Why Smart Contract Risk Isn't the Real Threat to Vaults Anymore

Transcript

So as you um as we discussed VETA offers infrastructure for these vaults. So what exactly does that mean and break down what VATE's role is versus like for instance curators? [clears throat] >> So vault this is really important. There's a distinction between the actual risk management that's happening at an economic level and what the infrastructure needs are. So VETA is an infrastructure provider primarily. Our job is to build a platform that allows curators and distributors and users to get access to whatever forms of onchain markets and onchain products they want.

Right? Our goal is to make this as wide as possible. Meaning we want to support the widest range of range of chains and assets and protocols and markets and doing that in a way that's secure. Right? That that turns out to be a really hard problem. How do you integrate things quickly while ensuring that um you know you don't compromise on security? Once we establish that universe of products that can be built on our platform, this is where a role like a curator comes in who's basically solving that user preference and packaging up these different markets that we've made available um to fit that fintech or that user's need. Right? So if that's determining what collateral to lend against, right, there's a risk management question there of how do we underwrite different forms of

collateral? If it's managing a liquidity buffer so that users always have a guarantee to be able to withdraw up to x% of their portfolio, that's a curator decision. So how we like to think about it at VETA is when you deploy and create a vault, there's really three parties that come together to make this happen. There's the vault infrastructure provider that's creating that platform and the smart contracts that actually hold and deploy the assets. There's the curator that's doing the risk management and then selecting collateral types and things of that nature. Uh and then there's the distributor who typically owns the user relationship and they have views on what their users want. They may have strategic needs for these products.

So all three of these parties come together to deploy an instance of a vault that meets a very specific product need. >> Okay. So now let's talk about um one of the aspects that people should definitely know about because even though you know in the comparison to the centralized lenders that we had seen you know BlockFi and Celsius there is of course still risk when it comes to vaults and DeFi. Um so one aspect would be that uh potentially the curators are taking on risk to get the yield. So, if something goes wrong and um let so let's say we'll we'll go to kind of the end of a you know potential event here. Let's

say a user put some money into a vault and the end result is they didn't get some or even all of their money back. What are the different possible things that might have happened to uh you know cause that result? >> Yeah, this is so this is a question of risk, right? when a user puts their money into this kind of system, what are the layers of risk that they're accepting? Because there are different layers. So there's one level of risk which is just raw smart contract risk, right? At the end of the day, all of these things, whether it's the vault itself or the underlying protocols themselves or the assets, they're all built on chain in code that's running on the blockchain, which we call smart contracts. And those can have inherent risks. In fact, the sort of uh exploits

that we saw back in 2021 for over that time period, those were actually mostly smart contract based exploits where there's some flaw of logic in the code that allows for someone to, you know, basically steal funds. So, that's one form of risk. That's something that could go wrong. One one just side comment is that what we've seen in recent history over the last six to 12 months is smart contract risk has come way down as we've converged on much better coding practices, better auditing tools, better cyber, you know, capabilities. But what's gone up is actually um key management risk or operational risk where you have layers of different protocols that have some governance functions that do things like

upgrade the protocol or allow the whitelisting of new markets. And that's actually turned out to be the layer where risk is now consolidated. This was true of kelp, the kelp incident. It's true of um you know uh uh drift. Basically many of the major exploits that we've seen over the last six months were operational failures. So that's a form of risk that customers might be take or users might be taking, right? Um you really have to look at the supply chain of D5 protocols, assets, vaults and look at the governance risk in those. And then the final one is economic risk and collateral risk.

Right? Even if you're doing something very simple like a lending strategy, uh what's really important is that the value of the collateral that is securing the loan doesn't drop more quickly than um it can be liquidated and actually used to repay users. So an example of this is where collateral just gets exploited and you know instantly wipes out all of its value. So that's sort of the spectrum of risk. It goes from smart contract to operational to economic risk. Different parties are involved in securing different parts of the stack. Like I said, smart contract risk, we've we've gotten we've made a lot of progress over the last 5 years to the point where, you know, very few exploits today at scale are a result of smart contract risk. Now, I think the industry

needs to solve the operational layer and that's one of the um you know, the most important areas. >> Okay. And so in that scenario I painted, it assumes that the user lost some money or didn't get all their money back. Um, but are there situations where when a vault has a loss that it isn't necessarily the user who eats that loss? And if so, what might those scenarios be? >> Yeah, one one thing that there's a lot of interest in is insurance. Um I think especially as these products become more mainstream and are adopted by traditional fintex and normal consumers um insurance becomes really compelling.

So this is an area where there's a lot of work going on and we've actually started to see insurance programs go out. We haven't seen a major claim be processed yet. So that's always something that people should be skeptical of. Right? it's easy to look at the marketing of insurance programs, but until we see a major event where we actually see what happens to claims. Uh it's it's really hard to know. So that's one sort of way of answering this question. It's, you know, insurance is sort of this category of transferring risk between players or people. Um on the other hand right when you think of the large brands that are now building these products right there are there are scenarios I can imagine where if someone loses money it's in the interest of the various businesses that are involved to

cover that loss right whether that's a distributor of fintech whether it's an underlying protocol whether it's a vault provider um so these are sort of the people that are available to cover losses either you transfer risk via insurance or someone who's constructed the product um has just you again chosen to to cover those losses or the user has to eat them um if they've accepted the risk. >> And one other thing is, you know, after the RS ETH attack, a lot of people talked about how when you're vetting partners, you're not always vetting certain aspects of their work, right?

Like, you know, how how do they manage those keys? Um, and I wondered um if there's some kind of like checklist that you think either um you know the different providers in this world should use to vet their partners or even for like a user who's considering do I want to put my money in this vault like what are all the different ways that you kind of vet uh who you might be working with? >> Yeah, this is a really complicated and and deep question. The first thing I'll say is that we absolutely need operational standards that make it easy for end users to actually understand what kind of operational risk they're taking. We can't expect end users to be able to do the diligence to look at the

supply chain and see which keys have which roles. It's just not practical. But what you can do is rely on um credible third parties who do this for a living like you know rating agencies who can evaluate the risk of these financial products all the way down the stack. And we're actually starting to see that category form both with cryptonnative players like what Credora is doing within you know redstone uh and even some large traditional players like SNP are starting to get interested in rating vaults. So that that's one flavor of of things that are important is that users should not be expected to do this assessment. It should come from experts who who do this um as their core business. As far as like best practices, obviously, you know, VETa, we have our

own diligence process. When we when we think of product construction and we work with partners, it's really important that people like key management, best best practices for key management are really important here. Do things like um important keys should be secured by multi-igs with time locks um where every signer is using hardware keys. These are some of the basic best practices that get you there. How you sign transactions, right? um are you blind signing in devices that aren't isolated? So there there are definitely best practices that are forming. What's not obvious to users of the product are are those best practices being followed across the whole chain.

>> Yeah. Yeah, that's that's definitely a much harder question to resolve. You just caught a piece of Unchained. I'm host Laura Shin and the full conversation is in the description below. [music] We go live every Monday and Thursday. Subscribe so you never miss it. If you hold crypto on your phone, your biggest vulnerability isn't your wallet, it's your carrier. AT&T, Verizon, and T-Mobile have been breached again and again, and SIM swaps are still one of the easiest ways for attackers to drain accounts. That's where Cape comes in.

America's privacy first mobile carrier. Same premium service, but Cape rotates the identifier on your SIM every 24 hours, deletes your call and text metadata after a day, and protects against SIM swaps with a 24word recovery phrase that only you control. You also get two middle toend encrypted secondary numbers for banking and signups, so you stop handing your real number to every app that asks. Go to cape.co/chained co/chained and use code unchained for 33% off your first six months.