Why Crypto Apps Shouldn't Stop a User From Losing $50 Million If They Really Want to

Transcript

So, a user on Ave and maybe Tay, you can tell us. Uh, I know you've got some hot takes, but has there been any more information on like who the user was, what was going on? Like people were speculating maybe, you know, a user lost >> close to $50 million uh on a through the mobile interface, >> which is just like even that is like pretty amazing, right? Yeah. >> So, they they basically made um made a trade incorrectly. Um the the interface popped up a warning saying like, "You're about to wreck yourself, bro." Um and they were like, you know, I don't know, maybe watching TV or something. And

they're like, "Yeah, sure, sure, fine." Um and and just, you know, clicked through the warnings and here we are. Now, there were a few people. It'd be good to like at least close out the like, was this a real thing that happened? Was this some kind of mev? Like, do we have any info on that? >> So, I don't think that the user has been identified. There's been a huge amount of speculation, as there always is. >> Um, I looked a little bit on chain, but I just, you know, the the common whale names always show up. Uh, and I don't necessarily have like much faith in those. I think the biggest thing,

the other like big rumor was that this is like somehow money laundering and that it was like intentional. I'm just going to tell you no. >> Like uh because one, you don't need to you don't need to do this complex. >> There are ways to money launder. >> There's so many easier ways to money launder. Um, two, whenever you do something like this, it catches the attention and it puts you front and center on the radar. So, like objectively speaking, like you're going to be more successfully at moneyaundering if your address is like doesn't exist anywhere right now. This address and all of the subsequent addresses are like everywhere. Um, it doesn't necessarily mean that people

have like tagged those funds as like stolen funds, but they could be, right? Like if there have been incidences that are a little bit gray area, let's call them um where like a lot of like the MEV bots that are doing like the automated front running and stuff. Um like they don't use their their centralized exchange accounts with those accounts >> like because they do get tagged as like the exploer and stuff like that. Even if they return the funds, there's still like that risk score attributed to them. So generally, yeah, I don't it's also complex. It's also risky, right? Like you you can't just like hail marry this.

Um >> you don't know you don't know that the you're going to get the >> Exactly. Exactly. >> Right. So >> because there's like four layers and I think that's like one of the interesting things that came out in the postmortem was like the first question was like whoa how did the UI allow this? Well the first question was whoa why was anyone swapping 50 million on mobile you maniacs. >> I know. The second question though was yeah was you know how did the UI allow this? Then you got into the deeper questions like okay wait even if it was a low liquidity market like this was really the best route are we sure? Turns out like no it wasn't even the best route although

there was just there were no good routes. Um, and so yeah, just all of that. Uh, yeah, it it basically like the people that walked away with the money are like the builders, the the the layers that are, you know, taking a fee on the transactions. Uh, you had like a lot of back running on this one, which was kind of interesting. We haven't seen like background is >> and yeah, a lot of money, right? So, >> um, and there was also like the way that I think cow swaps, so cow swap provide like it's valuable because it allows you to do these usually allows you to do

these big orders um, without a huge amount of like slippage. Like it's going to get you like the best execution. And it does this through this like there's like these solvers and auction mechanisms and they're all competing with each other and on and on and on. In this case, um I guess because the market was just so illquid and the amount was so high, the auction process also sort of uh >> failed because the solvers there were some solvers that like put a bid up to solve it in a certain way and get a certain price, but then they either couldn't get it on chain for some reason or the like the checks to make sure that it could potentially be on chain failed.

due to like it requiring a huge amount of gas or whatever it may be. >> Um and so yeah, there was like you know uh there was like a lot of really interesting technical under the under the surface things about this incident. I personally just go back to the first question which is the most important question which is >> how did the [ __ ] internet race let someone do and look you know for what it's worth right um I have had the experience uh for the last you know three years or whatever of building stuff we've got a bunch of people building a platform we've built uh a ton of infrastructure and interfaces and things and like the number of times

that my wallets break [ __ ] in our platform and people are like, "Oh, because they test like, you know, I'll say to them, guys, like you got to test with like 10 grand. You can't test with a 100 bucks. Like, it just doesn't, you know, you got to like find the median size transaction, right? And then they'll test with like, you know, 100 bucks, 100 bucks, 100 bucks. Then they'll test with 10,000 and they'll be like "Oh >> work like, you know, this thing's broken." I'm like, "Okay, cool. tell me when you're really confident and then I'll put like a million dollars through it and then it breaks in a different way and I'm like all right guys like you know so we we had this with like all of our routing

>> where you know someone's like this works amazingly like we split up the transaction into like three hops and you know I'm like how much do you try like did you do the trade with and they're like $1,000 and I'm like okay let me put a hundred ETH through there and see what happens and it just breaks and I'm like Like so it is really challenging to test with $50 million unfortunately and like you get weird edge cate like cow swaps like you know I remember when cow swap launched I think I was one of the first people to do an eight figure trade on cow swap. I did like a a 10 10 11 million dollar swap between like SUSD and USDT or something um back whenever

you know 2021 or something like that whenever whenever it launched. Um, and I remember like Michael from Curve doing it and like, you know, people like did these, you know, and there was kind of a moment where you're like, uh, I hope this works, right? Um, and, uh, and so, you know, it is really hard to test a system for a $50 million trade. Now, that said, you don't need to test the mobile interface with a $50 million trade to see that it should block. you know, there's like some amount of slippage where it should just hard block the transaction and be like, >> "Yeah, >> go to go to your computer, bro. Like, don't >> Yes. Yeah. And that's that's my my general takeaway. There was a lot of

people that were saying actually that the protocol should not allow this amount of slippage." I >> Whoa, whoa, whoa. I see. And then like now all of a sudden we're like, "Oh, okay. That's >> so for me on the one hand like surface level like yeah the protocol shouldn't allow people to like lose money like that right but on the other hand like what does that mean like what what steps what things have to be included or fe like what do you have to do to make that reality right a real thing um and I think that typically at the protocol layer it's going to mean adding a whole bunch of like adjacent systems

right to like determine certain things you're going to have more you're going to be relying on like more or different oracles you're going to be doing all these checks whatever and that complexity generally I would advise to stay away from it at the protocol layer right because the complexity introduces risks as well um if there's like some magical way like wave a magic wand type [ __ ] and you can make the protocol like make sure no one ever loses $50 million like go for it you know but usually there's some real tangible downsides to doing that. Um, but yeah, the UI layer, especially when you're talking about mobile, you're talking about more retail oriented people, like one is it just shouldn't be possible to like lose this much money on a single,

you know, pressing a single button. Um and then two is it seems like they were somewhat aware of the possibility that there would be like high slippage and their assumption is that well people want there are certain circumstances where people want that much slippage so we have to give them a way to do it. fundamental problem, right? Like if I am trying to trade a million dollars because I need a hundred grand because it's just critical that I have that money and the market is nuking or whatever and you stop me at like an interface or protocol level and I know what I'm doing. Like there's an there's a presumption of like you know what you're doing sort of thing. But I

think my my hot take is that like those days are >> kind of over, right? days. Yeah. >> Days where like everyone knew what they were doing. Like sure if you're like in Miss browser like fine. You can assume like this person has a but like you built a [ __ ] mobile app. It's on the app store >> that exactly like this protocol >> Apple app store and you're like this guy I bet he knows what he's doing. Also there's an assumption of like you have $50 million you know what you're doing. like no one with $50 million would. And it's like you also can't trust that guy could like person could have been drunk.

Like who knows all sorts. >> Um yeah and then it also goes back to just this like you know I think this is like the one of the bigger problems with with crypto UX in general. There's like every single layer just sort of pushes the responsibility to the user and avoids making the hard decisions or like the potentially like like if you have to make a choice, you just push that choice to the user and then you're like well it might be bad so let's put a warning let's put a warning with a checkbox and it's like no like I'm sorry nobody reads the warnings guys spoiler like nobody reads warnings especially if they've seen that warning before right if you

warn someone on every single swap, >> every single time you're like, "Oh, just a heads up. This is going to lose five bucks." And you're like, "Yeah, sure, buddy. Whatever." Like, >> they literally don't see it. Um, and so my my hot take is that anytime you're designing a warning screen, especially one with a checkbox, um, that that's a failure as you as a product and a product builder and a product designer. That is your failure. The only people who think that's a good idea are freaking lawyers. um it it doesn't actually create a good experience even in the best of cases and it doesn't protect people from the worst of cases.

So do better like build a real product where um you're you're actually optimizing for the best outcomes and making sure that the user um is you're not just like absolving yourself of responsibility and pushing it. So here's the problem though like if like fundamentally a is like okay we're going to deploy a shield. >> Yes. >> Um and this is going to be a protocol level circuit breaker will automatically block swaps with more than 25% price impact. Okay. Yeah. So, let's just stop here and imagine that a shield before this had all happened was deployed a year ago

>> and this crackhead turns up to try and swap $50 million through the mobile interface and the slippage is like 22%. And it's a $10 million loss, we would still be having the exact same conversation. We'd be like, I cannot believe that this guy. And then we'd be like, a shield, what are these idiots doing? Why is it 25%? It should be 20%. Like there it's a really really hard thing to get right because what's the arbitrary line that you're saying for any given swap? Like should it scale with size? Like no, it can't do that because then it needs an oracle to know how much the money is worth because 20% of some illquid thing and it's just like

it drags along so much stuff that you just go eh like I promise you someone will lose multiple millions of dollars with a shield and a shield a shield guy is going to be like job done success and it's like no bro like you so it this is not a trivial problem you can't just put Cuz then you go, "Okay, let's make it 3%." The protocol will never let anyone lose more than 3%. And then some guy's going to lose like a billion dollars because they needed to pay down their march and they wanted to swap and they didn't care and they were having to eat 5% slippage. Like >> yes, >> it's not a trivial problem to solve

unfortunately. >> And I think the pro like if you zoom out a little bit or back, take one step back right? what is the problem that's trying to be solved? And whenever that problem is trying to avoid something like avoid a bad outcome, whenever that's like the problem that you're trying to solve, you end up with these sort of like in my opinion like bad solutions, right? I think shield is not a perfect solution. I think that the warnings especially are not a good solution, right? But if you take a step back, what is the problem?

like what are you actually trying to solve as a product, right? You're not trying to like avoid people losing money. Like you're trying to uh whatever allow people to get like the very best fair market rate on a swap. >> I mean I would go further and say like you are trying to ensure that what the user thinks they are doing is actually what they're doing, right? Like if a user wants to lose $49 million like and you know this is a little bit cipher punk, right? But if a user has some desire for some reason to burn $49 million to like prove a point or whatever and they know exactly what they want to do, you should let them do it.

>> Yes. Like if that's their intention, if it's genuinely their intent that they want to do that, for some reason they have some thing that they're trying to achieve that you don't know what it is, right? Um let them do it. >> Don't allow a user to do a thing that they don't understand or is like, you know, counter to the thing that they think they're doing. Like the guy just wanted to swap some AE, right? like like no one, you know, there's no one who thinks that this person thought that they were going to lose this money, right? Like they they were just trying to do a flop.

They're probably willing to eat some slippage. It was 50 mil. Like maybe they're willing to eat 500k at slippage, right? For some reason, they wanted to do this. Um so it's about aligning the intent of the user with the action. And the reason why that's so critical is because these are immutable transactions. >> Yes, >> there's no roll back. There's no per you know you can't go to like Vitalic and be like I didn't understand I made a mistake like you know um uh so so this is really challenging right because if you have immutable transactions and they're super high value you need to make sure that the intention of the user is aligned with the result that they're going to get right like that's the thing that I think is is the most important

thing but aligning user intent given how many different flavors of user intent you can have with the action given how many flavors of action you can have is just a really non-trivial problem. Like there there no like oneshot solution. >> There's no onesot solution. And also like just because they click a warning >> that doesn't align that is not aligning you intention because you know egg users are dumb and you can sit there and go like a person with $50 million is never going to like just hit the X button without reading it >> and it's like bro >> they absolutely >> they absolutely will they're more okay guys

secret ready the people with $50 million are more likely to not read or acknowledge a warning than the person with $2. No joke. Because people with $50 million have clicked through so many warnings in their lives, have sent so many transactions, have traded so much stuff. They are the worst offenders of just clicking things and even doing things on freaking mobile. Uh, and your job, like old UX product design wisdom was the user is drunk. And if your interface can't be used by a user who's drunk, then you you failed as a designer. Um, it is 100% true. And it's weird because in crypto it's often like the biggest most active people that uh are the most drunk.

>> I mean I've like I've done this so many times like you know >> you literally >> it's me right like well it's funny game >> on on X right someone was like where did Kane get $50 million to burn and I was like it wasn't me this time bro like but but you know it's so easy. So, two things I think. One is like, you know, you feel like you know what you're doing. I'm like, I'm I'm literally interacting directly with the contracts. I've read the function that I'm calling.

I know what I'm doing. Then it's like, oh, wrong contract. Oops. Right. And it's like, you know, it's it it's really easy like you've done a a bunch of times, then you're like, ah, I know what I'm doing. So, I just think like it's it's very easy to to uh get lulled into a false sense of security. Um, and I've seen so many people do this like pe, you know, friends of mine over the years that go, I did this thing and I've done it a hundred times and I just didn't think that it would be a problem this time and I didn't pay attention to what was going on. And you know they like um uh there was there was a guy who lost like 5 mil um you know uh a few months ago and just like a simple transaction

they've done a hundred times and they just didn't pay attention to it. Um so yeah I think uh I think like you know you you have all of these things that you know you should do like don't do infinite approvals. >> You know this was like an infinite approval issue right? Um, and then they got wrecked and they're like the approval was sitting there for two weeks or something. Infinite approval on an address that had like $8 million in it and it sat there for two weeks and if they'd revoked the approvals like they know they're supposed to do, then they would have been fine. And you know, you sit there for the rest of your life going like, "Oh man, I like what was I do? I was eating lunch and I could have been revoking that approval, right?"

Like I was, you know, anyway. So um so yeah I like I think this is just a hard problem um in immutable systems that's >> oh yeah >> hard comes down to >> it is hard I think the best advice I have for especially at the UI layer especially at the product layer um building a great product means knowing who you are building for and also who you are not building for. In my opinion, the A mobile app should know that should optimize heavily for the core majority demographic um and not over prioritize the like theoretical

edge cases because they are theoretical. Oh.