Price Manipulation Exploits

Transcript

all right we do have a speaker on the on the phone so this is Christoph Michelle who's um one of the top uh um uh what do they call them on um on code Arena [Music] um what's that wardens on Carter that's right so um uh Kristoff will be we'll be giving the talk um uh on post manipulation exploits all right yeah hey I'm Christophe Michelle I'm an independent security auditor and today's talk is about price manipulation exploits or in different title would be a brief history of Landing protocol exploits because what

we'll be doing today is we will build a landing protocol and then exploit it and iterate on it and then get hacked again and then the cycle continues but first of all like what is this about well protocols need some way to get prices of an asset and they can do it on chain for uh long tail assets especially because usually long tail assets are not traded on a centralized exchange and the question becomes how do you get any price from a decentralized exchange like an amm and in a tamper-proof way so you can't really manipulate it and we'll be building these Landing

protocols on unit server B2 for now and just a quick recap how this works so unusual b2s pulls a pool consists of two pairs of tokens X and Y and someone provides some initial liquidity of x x tokens and YY tokens and the ratio defines the relative price the spot price x per wiper X tokens and then you compute some initial value K and it's set to a square root of x times Y and then these pool balances x y and this draft what UK defined is uniswell with two invariant x times y equals K which you've probably heard of before

and then you can also derive it some swap out amounts while out that's depending on some x amount for swapping it in I think the best way to visualize this is by looking at it geometrically and the way it works here is for example so what on the x-axis there's the X reserves and on the y-axis you see the Y reserves and here if you look at this point at the top P Stars it's at x equals one and Y equals four so someone provided initial liquidity of x equals one and Y equals four and then you get this K value of 4 and

this x times y equals 4 defines the screen curve that you see here and then a state of DMM always the current state is the point on this curve and what happens is that if you trade them then you move along this curve so if you trade some excellent amount of three then what you get out this y out it's just here this difference on the y-axis and you end up at this new Point p and here below so using uni swap with two we can build a landing protocol and the way we do that is and how most of pretty much all defy Landing protocols work nowadays is by users who can deposit and borrow

tokens and they need to satisfy this inequality which basically just says that the sum of the collateral value needs to be created and the sum of the borrows and switches the sum of the deposits so the price of the X token times the number of tokens deposited times some collateral factor x and similar for the borrows and what is this collateral Factor well we choose it to be less than 100 because we're over collateralized Landing protocol and why do we need to do that because it's a peer-to-peer learning protocol which means all tokens that you want to borrow someone else must have

put in and because you don't know who you're actually lending to there's no risk framework or anything and you don't trust anyone so they need to overcollateralize the loan so in case they just run away and never pay back your borrow then you can liquidate their collateral and you don't end up with a loss questions so the big question now becomes is how do you choose this price function of token X and the first landing protocol is set out to just implement the price function as the spot price of X in the X and USD when unit swap pool but it's pretty easy to exploit this because at some points in 2020 someone

invented flash loans and then what happened here is the tech gets pretty obvious like it's it's not out here at the beginning at the ethereum price of four here in this case and what the attacker does they deposit some US dollar value as collateral to The Landing pool and then they trade on this amm and as you can see here where it says PN and then some number it's the new price so initially it was four but as you trade more and more amounts into it the new marginal price gets lower and lower let's say they trade in 5x and then you end up at this new Point here at the bottom and you can actually borrow these

X tokens at the price of 0.11 instead of four and then they borrowed it at this great price and what the attacker then does well they just do the reverse trade they trade it back up until the real price and this manipulation cost them only the fees here and they ended up getting a huge problem so um this was as coined as the seared D5 flashlight changed everything it was in the beginning of 2020 sometime and since then uh well let's see how to fix this so what we're doing now is in our V2 of the learning protocol so we

choose the price of x to be the time weighted average price of X in the pool and for a while everything works out well and then it's 2020 and your project manager tells you to also support LP tokens because there's this new thing of AP tokens and users want to use them in the learning protocol as collateral so your task is to find out how do you actually price these AP tokens for the landing protocol and SLP tokens are just a claim on the underlying food balances X and Y you can Define the price of an LP token just by the pool value divided by how many LP

tokens exist right and the way you do it is mathematically is the price of an LP token with the underlying X and Y would be the price of x times the reserve of X plus the price of Y times the reserve of Y divided by the lp total Supply and because you learn from your mistakes the surprise of why you're not using the spot price anymore but you're Now using a Time weighted average price to not get hacked by flash loans or any other trades but then what happens is you still get exploited and the reason why is because you still didn't really understand how unusual B2 works so

and the recourse is what you can see here in this graphic and what you see is here this yellow line is again the unit swap curve and doing trades we move along this curve again and this blue bar chart here it tells you the X pool balance at the current point and the red chart tells you the Y balance at the pawn and below the blue and red bar charts here it's just the sum of the individual blue and red charts so and what you can see here as we move along the curve which means as you do trades the sum here is not constant it really moves

and what this means in turn is this thing here like it also moves with trades again and an attacker can use this to still manipulate the price of an LP token and then profit from it and exploit your contract and what Finance was one of these protocols that were exploited this way but many of them followed and then some people thought about well why doesn't it fix this when when we trade it should be a fixed price right and then you can come up with some math and I'll

I'll tell you about the derivation here just the end result at some point people figured out you can come up with a formula here of the P Price which is 2 times the square root of price of token zero times price of 1 times K divided by the total Supply and as it says here notice how the price now only function of the t-wops P0 P1 and K and we know from the unit swap invariant that trades don't move K and P0 and P1 are t-wop so they are not moved by trades as well thus this price doesn't move when we do any swaps

so that's great now we really understood how unusual P2 works and then we build our new protocol for prices of normal tokens it's just the team up for prices of new tokens it's just uh what we just saw this new formula of Two Times Square of price x times price y times K divided by the total Supply and then you deploy it and uh guess what happens next you get exploited again yeah and if you enjoyed last week's Paradigm CTF and you want to do a CTF challenge uh I created one here for this exact problem I think it's quite interesting uh it's even two

today standard it's not that obvious I think how to exploit it so if you want to try it I guess uh or if you're watching it on demand just stop the video and try it yourself because I'll tell you how to exploit this one here so how do we exploit it let's let's think about what would happen if we double the price right so let's say we want to double the LP price and their P price as we said is just the pool value divided by the total Supply so we would double the pool value and doubling the pool well it just means we would double the reserves and by

doubling the reserves I mean I really mean we just dump tokens into the pool without minting any new LP tokens we just dump tokens into the pool and that's the cost you just have to wear with that's our manipulation pause it's the pool balance X plus the pool balance y and then let's say we also want to buy some LP tokens uh some LP amount of LP tokens so we have some initial cost to acquire these switches well the price of this IP token times a p and then what we can think about is the what I call the borrowable value which is

um how much does your collateral change or your oral value change how much can you borrow that's just the new LP price times the lp times the collateral factor and we said that the new LP price well it's just double the old ones it's two times price of P times a p times the collateral Factor and then you can come up with some equations you do the powerable amount minus the cost and then you see that it becomes profitable if the deposited LP tokens are greater than total Supply divided by two times collateral Factor minus one and because collateral factor is less

than 100 because we're over collateralized Landing protocol what this essentially means is that you need to deposit more LP tokens than the total Supply which seems kind of weird at first sight because well we only have at most total supplier pit tokens how should we deposit more than that but it turns out it's actually possible to do that and it's possible if DLP talking is both the collateral token on the borrowed token and what you can then do is the following attack so you're using two accounts here under your control account a and account B and the count a will have some if

collateral and B will build up some LP equilateral so what account a does is you take a huge e flash loan and you deposit this slash loan as collateral so you can borrow LP tokens against it and you borrow all the lp tokens in the landing pool and then you send these LP tokens to your accomplice account B and from B your deposit these tokens again into the landing pool as collateral and because they're now in the landing pool again what happens is that account a can again borrow the same LP tokens that they already borrowed and you can kind of end up in a loop doing

this over and over and over again and every time um account b gets more and more uh a bigger and bigger LP position as collateral you do this as long or such that at some point the deposited LPS are more than the total Supply and at this point you manipulate the pool price again by dumping tokens into the uni swap pool and then the price doubles and it becomes actually profitable to borrow ethereum against this inflated LP collateral value now and because account a here notice how they always borrow their P tokens that

have LP dats and the price increased the price doubled of this AP tone it could be that they're now underwater and if you want to like min max there's a tag you can actually liquidate your own account a to get some discount again and in the end you pay back your if flash loan and you get a profit here so you get hacked again and here this is cream Finance from the timeline is now October 2021 last year and it's pretty much just attacked it was just not LP tokens but uh you're on wall chairs but otherwise the attack is exactly the same

idea and now so you're on your fourth iteration of building a landing protocol and I hope you still have users and you can still find someone who yeah invest in you after getting hacked three times but let's see and maybe you should take a step back and really think about what's what's going on here and what's what you learned from all of these attacks so the first thing is if you think about how the previous attacks happened you could always manipulate the price in the same transaction right and that's kind of a bad practice I would say for for a price or a code so you should only come up with price oracles that can be

manipulated in the same transaction because what this leads to is that the exploits at least are not risk-free anymore for the attacker because now they can get a flash loan because Flash loans need to be paid back in the same block so they need to put up their own big Capital usually and they also need to keep the price manipulation going on across at least the block which comes with its own risk of arbitrages and the second thing we saw that the safety of an oracle depends on the context so the question is do all assets really need to be both collateral and plural

tokens so the previous attack was only possible because they were and there are other learning protocols out there that use the previous um price Oracle but they are not exploitable because the lp tokens are not collateral and the modern Landing protocols they kind of do this like all the finance for example they really think about what asset should be a collateral asset and what should be a borrow asset because in the end you are collateral asset should be highly liquid so and you don't want to have many collateral assets here so these are uh yeah

the hardest or the most precious type of assets together these collateral acids and also all of these exploits came kind of because there was some missing understanding of the underlying am that was used also for other modern learning protocols when Universe 3 initially came out there were many raw refuse protocol hacks because it turns out that unicevery 3 is easier to manipulate than we do at some point or in in some sense because they it has this concentrated liquidity thing and it concentrates the liquidity around the real price but what this also

means is that nettech air only needs to burn through this um really thin price range and this leads to less lipids when they run through it and on other price ranges there's only very few liquidity so it also makes it more Capital efficient to uh to exploit this in some way yeah and that's the current state of defy Landing protocols maybe next year can show you how to also exploit the version 4 of it but other than that if you have any questions for now reach out to me on Twitter read my blog or if you want to try the CTF then go to my GitHub here

and play it and otherwise thanks a lot