TWAP Oracle Manipulation Risks

Transcript

we have an interesting character here good friend Madi Gupta here to talk about twaps please take it away I'm excited to hear it thank you hey everyone so uh I'm gonna talk about devop oracles and why you probably shouldn't use them so very anti-talk but uh brief intro about me I'm Chief information security officer at polygon Elite security there and I love to play with D5 have worked on ethereum and blockchains for over for almost 10 years now one of the latest Innovations there uh trying to replace the traditional

oracles uh like chain link which is the market leader and stuff uh but they haven't really fade well and let's see why they haven't paid well okay so first of all T what like what is Steve operacles um so default form is time weighted average price oracles and their intention is to give you price of an asset based on uh decks or liquidity pool amm pool so the most common examples are uni swap V2 t-wop and uni swap V3 t-wop so what happens there the way t-bops work is they take a snapshot of the price of the token at the start of every block and you can then query

the average price of let's say last 60 blocks so you get an average price uh that means that uh if some if the price was like going up and down it was very volatile uh due to some manipulation or some errors or whatnot at the end you still get a fairly even price and that way you can in some cases get a reliable price at least that's the theory but obviously doesn't really work out in practice and that's why I'm here so who uses them inverse Finance for their inverse token Rari fuse pool 23 used it for vusd Rari fuse uh fuse spelled wrong but anyway pool 90 used for float and uh Euler I just remembered the Euler token

was CTX CTX had a pool on it uh they used it um so there's just like one common thing between these use cases all of them got hacked um so most of the users of devop as you can see haven't really fade well historically speaking uh t-bops are not safe they never were it's yeah better so who uses them securely I don't know does anyone know who you are like want to give a shout out to you like to be honest they have built a bunch of tooling around it to um actually do risk analysis around evolves and gives ability to the users to actually use them securely but there are still in practice very very very few

uh people who are using t-bops correctly or securely most of them are have either been hacked already or are vulnerable to multiple attacks some of them which I'll talk about um so it's a it's a very very very risky situation so first of all let's talk about how they are manipulated basically so uh we'll take a step back and see how uh pricing in uniswap works or amm Works uh I have three constants here the uni swap invariant constant price which is a straight line and a stable swap invariant I only needed the uni swap invariant but this was the first image on Google so uh let's use this so it the universe of invariant is based

on x y equal to K curve which means that uh the price or the curve moves up and down as you buy or sell an asset if you buy keep buying an asset its price keeps going up if you keep selling an asset the price keeps going down so how do you manipulate the price you just buy a bunch of uh each for example on each usdc pool the price of each will shoot up uh if you sell a bunch of each into each usdc Pool price of each will go down um you can then uh do the reverse trade later and that will bring the price back to normal so you can first of all like do let's say you buy a lot of eat initially so the price of eight goes up you also paid a lot of money to buy this

eat so you are you currently have impermanent loss but the pool is manipulated and then you do your attacks or whatever you want and at the end you uh sell all of the each that you bought now since the price is so high right now you'll also get a lot of money for selling this eat more than what the market is paying so that will uh like that let's say that's impermanent profit and it cancels out your impermanent loss so at the end you will not have any loss apart from the fee that you will pay to do these swaps for going up and going down so that's the base of how do you manipulate oracles or pricing on uniswap or amm pools uh using this same principle you can manipulate devops as

well devops are nothing but this price averaged over a Time amount of time so if you take this price over 10 blocks uh you can have a TV of 10 blocks uh the reason we do it we have t-bops and we just don't use spot price as uh flash loans and uh sandwich attacks and stuff like that so if you don't use a t-wop at all then you are directly vulnerable to flash loan attacks where someone takes a big loan does the manipulation then does the transaction which like exploits the protocol like if you take a flashlight and buy a lot of each now eat price is very high now you go to away you deposit the eat into away obviously is that oh it was supposed to be 1500 in reality

but obvious away query is this obviously is the price is one million dollar it allows you to borrow assets worth of like uh 700 k k based on 1 million collateral and you just walk away with that 700k DEQ deposited actually was just 1.5 million so this is a theoretical attack Vector against spot uh price oracles to prevent this we added t-wop that you can't just use the spot price of one block you need to wait for let's say 10 blocks to actually get the price and it is hard to manipulate a pool for 10 blocks uh because it creates an Arbitrage if you put the price up then there is incentive for someone to sell it and bring the price down uh the pool will be buying each for one million

dollar if you brought the price up to one million so it's expensive or it was supposed to be expensive to maintain this uh in like the price up so this is the argument cost to maintain imbalance is high but in reality it's not and there are two reasons one is people forget about 51 percent attack so people talk about how you can sell the eat for 1 million so there is an arbitrary opportunity that is worth one million dollars but the thing is you can do selfish Mining and a 51 person attack and just not let anyone take the Arbitrage uh 51 percent attack costs just fifteen thousand dollars on

ethereum right now um it's actually probably even lower uh since the price has gone down in the recent times uh people like all of the ethereum people wanted to cut down mining rewards we started with like 10 8 now we are at two eat if you remember correctly and as you cut down mining reward you also cut down the cost for a 51 percent attack uh at this point like in Nvidia itself has enough hashing power to pull off a 51 attack on ethereum that's how decentralized we are but keeping that aside ah there is just one thing to add here obviously if you are doing a 51 percent attack it is probably illegal I'm not a lawyer but uh probably is and uh it requires social consensus because I

don't think any hacker has enough hash power in their basement they can they will have to collaborate with a bunch of different companies to pull this off um so you there is protection in a social sense but in economic sense there is no protection it just saves you from fifteen thousand dollars so if you are building a decentralized Oracle uh using t-vops and you are depending on social consensus then might as well just use chain language depends on social consensus anyway so it defeats the purpose if you have to depend on social aspects not economic aspects okay so concentrated liquidity is another thing that makes attacking uh these oracles easier because as I said

like when you are buying it uh on the normal curve the price keeps going up the first date you buy for 1500 the next eight second date for 2000 then 3000 and so on uh but if the liquidity is concentrated all of the eats might cost just between 1450 and 15 50. so you may not be overpaying at all for your eat um so concentrated liquidity or V3 makes it easier um I'm a bit short on time so I'll go fast um so the other argument is devops allow you to take average price over a very long period you can make it 100 blocks so even if you do a 51 percent attack for 100 blocks that will cost you 150k uh actually like more so uh it still becomes expensive 1.5 million dollar but

the reality is the way math works it doesn't uh it's a very bad thing so the way averages work is even if you can manipulate it for one block the result is infinity infinity plus price is one price is one price is one price is one divided by n number of blocks the final resultant average price is still Infinity That's How match work it's not what I created so the whole argument of uh having multiple blocks and making t-bops safer doesn't hold mathematically um so I was saying as I said like you will have to pay fee for going up and down guess what made it easier or cost lower 0.01 percent fee from uni swap pools and now most of the pools that are

volume on uniswap use this 0.01 percent fee and guess what it makes t-bop attacks even more cheaper uh another argument is if there is high liquidity it will take more uh like it will cost more to do the attack because even 0.01 of a high number is a high number but what if the liquidity was just provided by the attacker himself like what if they withdraw it first and then do the attack uh they you can't have any guarantees that are liquidity that is present today will also be present tomorrow you see a pool you see oh it has one billion dollar in liquidity let's just use it for our t-wop one week later your protocol is life but liquidity is gone some other protocol gave them gave additional

incentives uh we some like uh someone forged uni swap giving started giving like sushi rewards and all of the liquidity went to Sushi now uni swap has no liquidity and the pool becomes vulnerable so even if the pool might be safe right now it may not be safe tomorrow so you'll have to have continuous monitoring and all um so there are a bunch of different attack vectors that I won't talk about since I'm uh out of time but one another thing I'll talk about is the merge so 51 attack still on pow still has a cost of fifteen thousand dollars but when we get the merge when we get proof of stake the cost just goes away uh Lido coinbase and all of these different validators

that have a such big leg stake they will have a very very very good chance to uh have the and predictably they will know that I will be mining block n n plus 1 n plus two even a single validator if I'm running a node at my home I'll also like theoretically I will have a chance to mind block n plus n plus one and I will know this if I know this I can pull off the attack I just described without having anything at risk nobody can mine a block faster than me it is my slot it is guaranteed to be my slot um so if I knew that if I knew that that is going to happen I can pull off the attacks I just described all of the big validators uh validating pool will have a larger chance to pull off these

attacks than individual uh people but even individual bills have will have the chance it's a decentralized environment we give everyone a chance to manipulate devops so at the end I'll conclude by saying like you can definitely use tivob securely there are some people who are using it some Rari pools some Euler pools are using it properly at least for now but it using t-bops is like walking in a mine of like a Minefield basically so Euler has provided you a whole map of where the landmines are but it's still risky you you can still press on one of the landmine without checking the map so it's uh like you will have to weigh the pros and cons here do you really want to

play that game do you really want to uh walk on a landmine uh field of landmine when there are alternatives available uh if you want you can but that's not something I will be willing to do and that's basically the end of my talk if you want to reach out here are my details and thanks for listening [Applause]