Michael Kunz - Beyond Open Source: IP Strategies for Web3 Projects

Transcript

[Applause] now thank you um it's nice to see you all today thanks for um showing up in this beautiful weather and uh also thanks for showing interest in the topic maybe um before I get started with the topic a few words to myself my name is Michael koun I'm a legal partner at mme which is a legal and tax consulting firm in Zurich anduk and um we've actually had the pleasure to work with a yeah quite a lot of crypto companies in the past we've um most famously helped establish the ethereum foundation around 10 years ago and and yeah have been seeing quite a lot in the space a lot of good and a lot of bad things um yeah and I hope that um you're going to like this presentation so we we're here to talk about IP protection and open source and

uh how to protect your software but I actually want to start with something else who of you has heard of vampire attacks okay a few okay so um in a vampire attack there are a few definitions out there but a good one that I found is that basically if um a protocol attacks another protocol and tries to assume its place by offering more attractive incentives now more interesting and that is actually what's happening in a vampire attack and so basically in defi when you talk about a vampire attack there's three things that are targeted so the first thing is it takes away the liquidity of a protocol the second thing is it takes away its users and the third thing is that it takes away the trading volume and

therefore the um the profit of the investors now towards the end of the presentation we're going to look at the question as to whether vampire attacks are actually legal and you should be able to answer that question towards the end but maybe to answer the question it should be helpful to actually look at an example of a vampire attack and I think the best example is the sushi swap attack on Unis swap which took place actually was like four and a half years ago so as most of you know Unis swap is an automated Market maker and and what's special about automated market makers is that they're exchanges but they don't actually connect buyers and sellers by matching orders they have liquidity pools and therefore need liquidity

providers so people who say I'm going to give you the tokens so that other people can actually use them for their trades now how does that work so people actually give liquidity in the form of ec20 tokens usually um and have to actually provide liquidity in both sides equally to make sure that the pool remains balanced in return for that liquidity they get a so-called LP token the lp token is a receipt that they can use to get the liquidity back at any time and the third step is that the swappers those who actually want to make the conversions they can use the liquidity pool to turn one token into the other now what's important is that the liquidity pool is better if there's more liquidity because if you want to

make large trades you're going to have what's called slippage when you have little liquidity in the pool so that's why in this space there's it's it's not kind of a Winner Takes It All mentality but those pools that have the most liquidity are actually usually doing the best now what happened in the attack um actually let's look for this Unis swaps what's interesting is that a Unis swap was um launched by a company called junis swop labs and um it was supported by quite notable VC investors the Investments were around $11 million and what's interesting is that um Unis swap Labs didn't have a token at that time so the investors actually bought into the

equity of the company so they bought shares of the company which means that it's a pretty centralized setup right it's pretty traditional that the investors come and buy the shares and that is it so um it's kind of like a web two way of Investments and that's also what um Sushi swap thought so an anonymous guy called Chef noi basically came along and said You know guys let's do another Unis swap but let's do one that is actually governed by the community and so what he did is that he launched a competing protocol with a Twist and that twist is that he added a sushi token and the sushi token actually had two purposes first it should allow people to govern the protocol collectively and second most importantly it had a fees share function

which meant that holders of the sushi token actually got a sixth of all the trading fees that are collected throughout the entire protocol now how did the attack work so in the first step it was basically just a marketing campaign So Sushi token was aird dropped to users of Unis Swap and they probably woke up in the morning and said wait you know I have this new token so what's that they Googled it and then the step two was the launch of a yield farming campaign and that was ingenious because the idea there was to say okay all you liquidity providers in Unis swap you have your liquidity deposited you have your LP token that sits idle and doesn't you know do anything why don't you deposit those LP tokens in my protocol you get another LP token from

my protocol Plus you get more Sushi tokens which means more profits for you towards the end and people said look I mean I have an LP token doesn't do anything I can get more Sushi if I deposited so let's do it in the third step all the liquidity in Unis swap represented by those LP tokens was moved from Unis swap to Sushi Swap and then in a four step the sushi swap automated marker liquidity pools were launched now what did happen in that attack so commercially it's interesting to see that Unis swap had around $500 million in liquidity before the attack started it went up to 2 billion because everybody wanted to actually get those uh Sushi to and then he went down again

and you can see in the second graph that it didn't really last right it hasn't really caused a lot of damage to Unis swap but it did give a tremendous boost to Sushi nevertheless Unis swap did do one thing they said you know what this this is you know this argument that we're a community govern that we're like web two and we're kind of like the bad guys um let's counter this by actually launching our uni token so the uni token was launched to the users of Unis swap that used it before the attack obviously right because after that there was all these other users that you didn't M actually um um reward now what's interesting is that the uniso uh token also has a governance function which is you know let's say limited to the back end doesn't have anything to do with the

front end operated by uniso blbs but that it actually always talked about this uh Revenue share which never happened like this fee switch you know you probably heard about this you know the community really wants it but then again they don't really want to have it and so it's you know it's an ongoing story there is right now no fees uh no Revenue share and the main reason is that it would actually make uni uh security token which is a problem for all the investors and for the company because they don't have issues with the SEC because they're based I think in the United States or at least many of the investors are so let's look at the legal perspective was this attack legal now as I mentioned initially the vampire attack targets three separate things the first

thing is well you go after the users is that legal well the good thing is that in on ethereum blockchain it's a public blockchain which means anybody can do chain analysis and actually figure out user behavior and say you know what these are the best users of Unis swap or those are all users of Unis swap I'm going to airdrop tokens to them absolutely legal the second thing is that they move the liquidity were they allowed to take the liquidity well as a matter of fact I would say yes yes because everybody who deposited the lp tokens in the sushi swap pools did so voluntarily because they wanted to make more money knowing that those tokens actually allow anybody who controls them to take out liquidity and move it and the third thing is the trading volume

which is generated by the swappers was that legal well obviously because swappers can use whatever protocol they like so and good all good we're not at the end the most important question is was it legal that Sushi swap was basically an exact copy of uni swap so when you look at that is basically Sushi swap had almost exact source code with a few notable differences which basically all concerned these Community Focus benefits and so from a legal perspective it's important to see that the source code of Unis swap version 2 at that time actually was owned by Unis swap Labs it was available it was published on GitHub

it was license under an open source license but does that alone mean that you can just go along grab the code redeploy it and basically create your competitor to understand that we have to understand how software is protected so in a nutshell if you whenever you create software it automatically is granted copyright protection you don't have to do anything at least in Switzerland I think the us there are some registration requirements but the most important thing here is that copyright own only protects the source code it doesn't protect the idea so if somebody actually comes along and takes away the idea of having liquidity pools and doing swapping with those pools that alone anybody can do as long

as they don't steal your code if you want to protect the idea behind your product you have to get a patent and it's possible to get a software patent also in the European Union um even though a lot of people think that that's not possible that it is possible but the software needs to offer a technical solution to a technical problem which is you know I'm not a patent attorney but let's say I would assume that you could actually get a patent for for what Unis swap created here now what is a license agreement so basically when you have copyrights you can prevent anybody from taking your code copying it changing it if you want people allow give them grants and rights to do something with your code you give them a license right and so the license

can be comprehensive that they can do whatever they want they can be very granular so if you buy a video game you have to install it on your desktop that's a copy of the source code that's all you can do but you have to do it to play a video game so you get a very very small license right so the ranges you know is very wide now what's important is that any use of source code or copyrighted source code of others that does not actually Grant is not based on a license is a copyright infringement which can lead to very high damages so open- Source licenses are basically nothing different they're just licenses that are standardized for Mak it PE uh easy for people to understand what the rules are right if you see GPL

MIT you know okay that's a GPL license M license I kind of seen those before so it makes it very easy to actually distribute software what's important about the open source license is that there's no final definition but there's the open source initiative that basically says open source must meet 10 requirements and only if all those requirements are met the license can actually be called an open- Source license in short I would say that the license must allow the code to be used modified copied and distributed freely only then do we talk about an open source license now what's important two things first of all very very large misconception open source does not mean public domain so an open source product

an open source software always has an owner and has a license or that actually gives you a license so when you take open source code from the internet you are a license see and somebody owns that code and gives you rights to use it as opposed to public domain you can also say you know I don't want to have anything to do with that code I gift it to the world you say I put my code into the public domain and I renounce ownership people can do whatever they want one big difference between the two is liability because if you open source a code and it damages causes damages you are still liable if that damage is caused that with gross negligence or intentionally which you know shouldn't happen but gross negligent at least is

possible and the other thing is that publication doesn't mean licensing that's another thing that a lot of people don't know is that people publish code on GitHub all the time but there's many reasons to do so so one reason to do so is because you want to allow Community audits because you know people maybe trust put more trust in code that can actually review themselves or that at least you know that it's at least released in a transparent manner you only have a license and a right to use the code on GitHub if there's a license file that says you are allowed to use that code and these are the rules Etc right there's also often license files that says you don't have the right to do anything right just to make things clear so actually every repository should always have a license file just to make things clear many

don't but yeah that's for a separate topic so there's different open source licenses and I'm going to make this short I know this is probably um taking a lot of time away but the point is as you see in the graph most software is actually licensed under one of four licenses so we have the MIT license we have the Apache GPL and the BSD license right and that's basically more than three quars there's plenty of others but most of them are not used very often now how do they you know separate there's two families of Open Source licenses there are copy left licenses and permissive licenses and the copy left license like the GPL basically says you can do all these things that you have to do to be open source right

free distribution free changing and all these things but if you take the code you change it or you add to it or you take it and put it into your code you must release your product under the exact same license to make sure the code must remain open permissive licenses which are also called academic licenses don't have that rule there you can do whatever you want you can take the code repackage it and sell it for a million dollars completely legal right no rules regarding how you can actually distributed now when you look at the layer one blockchains most of the actually have um a permissive license chosen the exceptions are binance smart chain and PKA dot which have chosen a copy

left that's not a better or worse thing it's just different right so understanding that if you actually want to change the the code the source code of binance smart chain well you have to actually open source your contribution as well if you want to contribute and make the changes to the code of ethereum you're free to actually sell it for whatever money you want which brings me to the next topic no actually brings me to another topic first what are the Alternatives so you don't have to open source right you can still say you know I like open source but maybe I don't want to give it all way like that there's um three different models one is called open core which basically says it's kind of like you know a smaller version of the code is out there but if you want to have more like upgrades or

you want to have um more features then you have to pay for those it's kind of Premium as we know then there's a family of licenses which are called Source available licenses and the definition there is that the source code is publicly available but certain usage rights are restricted which is against the open source idea that you actually restrict rights in any way so they basically cannot be called open source they for example the business source license or we have the server side public license which are used by many many projects and there's interesting switch happening so a lot of Open Source projects move away because they say we're doing all this work people take it make a lot of money you know we need to

change something so a lot of products and software actually moved away from open source to um Source available and another thing which is very interesting is dual licensing which means that you're the copyright owner you can basically license it in one way two way three ways combine it there very combinations and one combination is very often chosen is that people say I give it to you with a hard copy left rule which is you know it sucks for corporations because they say okay I mean I use that but then basically my contribution has to be open I don't like that well if you don't like it you pay for it right so it's either with copy left or it's free you can do whatever you want but then you have to pay money now what does it mean you know when you talk about open source software

is it free you know people hear that often and you often here probably you know it's free as in Freedom not as in free beer but what does that mean and so to to keep it short is that the software must be freely available to anyone in source code form right binary is not enough it needs to be the human readable source code right that is the one requirement that does not mean that you cannot make money with it so what does that mean if you have a permissive license you can do whatever you want you can sell it you can even say I'm going to hide my code behind a pay wall I'm going to have it on GitHub and on my own pay wall where I charge $1,000 completely legal but with copy left it's a bit more difficult but the one thing

you cannot do is you cannot charge a software license because you know the software rights are given away freely but you can charge for providing support you can charge for warranty that you offer additional warranty you can actually say that you um charge for you know compiling the code and actually selling the binary you know people do that or you can say I put the code on a CD which people used earlier and they sold the CD for $1,000 it's all possible so just you know take that one takeaway doesn't mean that everything must be for free now let's come back to our topic forking protocols the question is can anybody take Unis swap V2 and just Fork it and create a copy as a matter of fact yes because the source code was licensed

under the GPL open source license now remember what did Sushi swap do they took it okay they changed it so making changes modification they redistributed it by deploying it both of that is allowed under the GPL license what they would have to do and I didn't check that they would have have to actually open source their contributions under the GPL license as well I'm not sure if they did that but in principle it's not a copyright violation so every is happy but how do blockchain protocols deal with that problem problem um Unis swap learned mean changed at least her approach because he said you know what we don't want that to happen again so Unis swap V3 and V4 were actually released under the business

source license which says no compet no competitive use or commercial use for four years after that it becomes an MIT license you can use it freely but we have the four-year competitive Advantage bankor did the same also for the new product carbon which some of you may know also under the business source license and um curve which says no license at all right I only publish for informational purposes now people may think oh wait what about the open source EAS you know isn't everything supposed to be open source well the reality is there's too much money in defi for the open source EAS right and actually I've had an interesting conversation earlier um that

apparently uh re Arch shows that a lot of code is not even published in GitHub so um they're doing a PhD and around 5% of the code of you defi protocols is actually published the other 95% is completely proprietary and not even shared so so much for the open source ethos now some final thoughts what are the differences between web 2 and web 3 companies and I think that's if you take have you any takeaway then that's that one what's the difference the difference is that a web two company like Google or Facebook has two assets that make it really valuable it's user data the data you give for free that they sell which is super valuable the other thing is the codebase right it's not open source usually and that's also you know the algorithms and everything they have

that's protected by tra Trade Secrets that's why it's difficult to actually make a second Facebook or a second Google because you know the algorithms are secret so that's pretty hard now vampire attacks against web 3 companies are ultimately possible because the user data is out there right anybody can actually just check out the users and they drop tokens to them so okay that's not protected what else copas yeah also public also out there people can just take it so what does that mean how can a web 3 company protect its intellectual property and you know avoid you know being copied like that there's a few things they could do but none of them are really satisfying so one thing is you use a permission chain sure you can do that but you know the whole um

benefit of having like these money Legos completely goes out of the window the second thing is you don't publish the source code AS we've heard a lot of people do that and a lot of people don't care but it actually does have an impact on trust that is given by users the third the third thing is you don't give a license sure you can do that but people can just take the code anyways look at Sushi swap right Chef know me we don't know who that was even if Sushi if Unis swap was not licensable at all what do you do go after Chef nor me it's pretty difficult another thing that people thought about is technical limitations right you basically say okay if you want to withdraw liquidity you have to wait two months right that's also not really working because there's going to be a better product that

doesn't have this and so you know you have a competitive disadvantage which brings me to my final statement which a quote from a client that I very much like the difference between web 2 and web 3 is actually that in defi or in that way in web 3 you don't win by being first you only win by continuously being best and I think that's actually in the best interest of users because while cop Facebook and other companies basically sit on their throne and are never challenge in the web free company that's very different okay I am use more time I hope um you learned something today and yeah happy to uh ask answer [Applause] question amazing we still have a uh

space for one question if anyone in the audience wants to ask if not well thank you so much Michael oh okay so there there might be there might be one there might be one question let me let me just quickly run there uh sorry thanks so much Michael I only watched the last part but it was super interesting as a legal firm you're basically saying that licensing your Tech isn't helpful you still need to make it open source so kind of what is the solution and what does mme then um propose as their business case in web

3 yeah it really depends on on um on what you're building right I mean l1s we generally say open source right you want it to be open source right that's why most of them do it for for daps it's a bit different right many of them say yeah you know sure it's fine um the thing is that I do believe that what I've heard from a lot of client is that they say you know people AR going to use our software if they don't know what the code really does it is a problem right and so they have to publish and once it's out there anybody can take it so you're just going to you know regardless of how you're going to deal with it with regard licensing if you don't are if you're not willing to go after the infringers well at least you know it may actually keep people off

but there's so many copycats you know that are synonymous that it's very difficult to do something so I do personally think that continuously innovate is the best solution and I think that's just a reality that you know a lot of these um companies have to deal with thank you [Applause]