ZKPodcast: Tarun and James talk Flashloans & more

Transcript

[Music] welcome to zero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me Anna and me Fredrik this week we sit down with James Prestwich and Tarun Chitra once again we chat about the recent events / loans and we generally catch up about some of the goings-on in the space but before we start in we want to say thank you to this week's sponsor new cipher new cipher is a cryptography company that

builds privacy-preserving infrastructure and protocols the company aims to offer accessible intuitive and extensible runtime and interfaces for secrets management and dynamic access control the company is currently looking for an engineering lead to work on a new open-source cryptographic product they are building from the ground up you'll get to work on a lot of cool primitives like fully homomorphic encryption and zero knowledge proof new cipher are headquartered in San Francisco but they are a remote first company for more about their work have a look at new cipher comm that is nu CY pH er comm or check out the link in the show notes for more about the role so thank you again

new cipher and now here's our conversation with James and Tarun so we are here at SBC the Stanford blockchain conference with our friends Tarun and James welcome back to the show guys hi Anna last time we spoke with you or last time I spoke with you was in Osaka we actually did an episode with Georgio's who sadly is not here at the Stanford blockchain conference and I think we're all a little sad that he's not here 100% I miss giorgos but we do have Fredrik this time exactly yes we went from the southern part of Europe to the northern

part of Europe yeah both of you have been on the show actually I think twice or three times each so some of our listeners will know you but I think it is definitely worth it to do very quick intros just to brief them on who you are hi i'm turin i founded a company called gauntlet and we do sort of economic stress testing and threat analysis for layer one and defy protocols my name is James Prestwich I'm the co-founder of a company called Summa we work on interoperability and cross chain protocols for layer 1 chains and I hear you're also an Oracle of sorts Jordans been trying to tell me that but I really

don't believe it what is what is James and Oracle of so a little bit of color and this isn't there's basically been these attacks well attacks I put quotes around the tactics there is kind of a weird combination of poor economic incentives with logic bugs as opposed to kind of some smart contract bugs that are unintentional and the these attacks basically took advantage of the ability to borrow a really large amount of money with very little collateral upfront and James has been advocating using these in cryptocurrency systems and smart contracts for many months because the person who made the idea in the

beginning kind of didn't take it to its conclusion and there was some code online that was half-finished for doing it and James was all like someone needs to do this and he got his wish you know first Oracle context flash loans started as marble protocol this was the first implementation that I know of that did this so the team at marble works for compound now so they're working on a completely different thing and the marble codebase existed and was relatively unmanned tained and forgotten about until pretty recently flash loans got deployed a while back have built up

a little bit of a capital pool you know an amount of money that would be significant to you or me but is in the grand scheme of finance not all that much but it's only in like the last week that we've seen them actually used in practice for real fascinating economic events ok so this is this flash loan concept I think the majority of this episode is going to be about exploit like we're basically we're here together to talk like some things that have happened recently we have a few ideas to cover I think this sort of exploit around flash loans is the one we want to start on but why don't we first define a little bit more clearly what is this flash loan

what is that well you know flash loans are one of the few things that seem to be unique to blockchain finance it's something that doesn't really have an analogue in traditional finance and the idea is basically that because a transaction in aetherium takes a zero real time borrowing money for the duration of a transaction should be free and because there's essentially no risk to the lender because the contraction force that the loan is repaid in the transaction and there's no opportunity cost to the lender the actual cost of that loan is zero and so hypothetically

you should be able to borrow any amount of money for the space of one transaction for no cost anyone should be able to do this at any time and that's a flash loan and that's a flash loan is there any sort of historic like word are there flash loan type things elsewhere because you just said this is like crypto specific but like does it come from somewhere else there are things in traditional finance that do vaguely resemble this so one thing James alluded to is that you know when you're taking a loan one of the majority of sort of the majority of the component of risk that you're measuring is the duration risk so if I'm a lender if I give you a loan for 30 years versus

one minute those should have very different prices I should charge you different fees and there is this kind of idea in finance that as that time goes to zero so if you could do the loan instantaneously then it should have no duration risk because I'm getting things back the problem with duration zero is that you need to trust that all of the things that the person is borrowing it for actually complete and they can repay the loan and in the normal world this would be as if you went to your bank and said hey I want a five hundred thousand dollar loan to buy a house and if I don't win the house you get the loan back right in the real world there's duration risk no matter what because you need to deal with humans who are going to put a bid in on a house and

then etc but in cryptocurrencies the fact that your smart contract can execute these things and only executes and borrows alone if the conditions are met allows you to ameliorate this trust central banks do do things like flash loans but they do it basically because they're printing money there they're changing the rate of inflation and then they basically go and immediately sell against that rate in the open market so this US Fed might say hey we're increasing the Fed fund rate by 25 basis points but then instantly go and sell in like the euro dollar or Treasury curves a ton against that so average is out to

zero and there's a sense in which that has a similar duration lack of duration risk kind of the reason that this is possible and interesting on chain is that when you make a transaction in aetherium you're acquiring the global exclusive right to update the state of aetherium so nobody else is allowed to make any transactions door during your transactions execution and so it's like you go to your bank and you say halt the entire financial system until I have bought this house and or given you your money back so this is why it's something that is unique in Chains but when you

phrase it that way it kind of shows you that the loan may be free but the right to take out that loan the right to halt everything else going on is going to be expensive yeah so I guess maybe to add a tiny bit of historical context what this sort of attacked resembled is something called the Saurus attack from the 1990s and what happened then is George Soros this hedge fund manager realized that the British government the British central bank basically was pegging their currency to the German deutsche mark and you know he believed that this was incorrect

because there there should have been more of a fluctuation but the British Bank was artificially keeping their exchange rate constant because Germany is a net exporter to Britain and Britain's a net importer and so what Soros did was he borrowed a gigantic alone so I think his hedge fund size was maybe 100 million dollars but he was able to aggregate like six billion dollars of capital which sounds like a lot for an individual but compared to a central bank that's not like a gigantic amount but then he basically cornered the market on Deutsche marks first pounds he would by buying up six billion dollars of the asset the British government was sort of forced to break the peg they couldn't afford to keep the peg up because the market wasn't functioning because he basically bought up all the

supply and then no one could they couldn't hold what they were trying to do and then once I happened the pound devalued and he had sort of a short position externally and and this whole thing happened in one assyrian transaction and and that's basically what you know this kind of famous thing someone someone whoever whoever did this figured out how to do it kind of what is the name of this thing that we're talking about do we have has it like shaken out enough that there's like some term for what just happened hmm is there a term for just like the fulcrum attack the fulcrum exploit maybe like yeah the fulcrum exploit is a good name for like this specific instance of it okay typically we call these Soros

attacks because they always remind us of the pound and George Soros and we use that name because it's an attack that is only available to people who have insane amounts of money usually yes huge massed work that's what's so interesting about flash loans is that George Soros was able to do this because he could leverage six billion dollars right and he could have a direct fight with a central bank in the market not everybody has that capability in the traditional financial world the thing that's so interesting about Flash

is that once they have a lot of liquidity on chain anyone who can write a transaction who can write a fairly complex smart contract can execute these attacks but it's kind of a stretch to call it an exploit or an attack it's sort of it's a good part of the system it's an its design it's a great trade it's a very good trade in the fulcrum case specifically though they failed to like put sanity checks on their pricing so their system actually allowed the person to go into the read and to keep open a position that should have been closed it's like in the fulcrum case

specifically we should probably call it an attack but the general like case the Soros case it's not it's it's a good trade ok what what hap of what actually happened we talked about the flash loans but there was some other there were other projects that were actually involved or this this attacker or exploit ur or smart trader whatever you want to call him/her they used a number of tools in order to do this so and I've seen it written up a number of times on Twitter I was amazed at how it like turns into seven steps or something like that like you have quite clear so why don't we cover that the BuzzFeed articles seven easy steps for you to win and profit number six will

blow your mind yeah it might be like a little difficult to go through every step and also pretty boring but we can like point to the critical thing here is fulcrum is a lending protocol right so you're supposed to put down collateral and it allows you to borrow against that collateral and mount you borrow has to be less than what you put down okay okay so the core like issue is that fulcrum would allow you to go to outside markets like Khyber to source like trades for the stuff you're borrowing

and it would allow you to like manipulate your position but khyber sources liquidity from other Unchained venues and so the khyber price can move significantly depending on what's available and folk hram to like sanity check the khyber price in certain cases and so the attackers set up a manipulation where they could get more money out of fulcrum because fulcrum would pay any khyber price that came back even if it caused fulcrum to pay out more tokens than they had borrowed so they were able to get more tokens out

of fulcrum than value they put in as collateral and I think in the end they made it out was something like three hundred fifty thousand dollars right and the second attack got out with about six hundred and fifty thousand and neither of those are as action were actually optimal right so there's quite a bit of optimization on the first one you could have actually gotten much closer to a million dollars and the second one I think because was kind of close to the optimum was like eight hundred right so that the core thing is just that fulcrum was not properly checking prices and so it resulted in a situation where it paid out more money than they actually had

borrowed so you took tokens that were from the fulcrum pool and paid them out to the attacker almost directly so I found actually just found one of the tweets that summarized it not into seven points but six and I wonder I mean I I think it is actually worth it to say it on air just so people kind of can follow what we're talking about so the idea here was that someone took 2.7 million in a flash loan on dy/dx protocol they put 5.5 eath on compound finance so like half of our almost a little over half of the eath on comp on compound and borrowed against it 112 w BTC they then went and shorted w BTC on b ZX

I hope everyone follows that's fulcrum that's fulcrum and then they dumped a hundred and twelve WBT see on Khyber Eunice WAP to trigger the short they then paid back the loan and made profit right so the critical path there is that the short on vzx used Khyber's very illiquid market that the attacker was able to manipulate and did not sanity check the price so it let the it created a situation where the collateral did not

cover the amount of money B's EDX paid out to the attacker what would it mean like so they shorted WBT see how did shorting that like what trade did they do after that that like allowed them to pay this back actually that's not completely clear to me so the way like Khyber and Yunus WAP and a bunch of these on chain automated market makers work is that you can push the price anywhere as long as you have enough like WB TC or ether you can push that price all the way up to infinity or all the way down to next to zero I know and one tiny comment on that which is you need to actually have both assets to do this

trade and you can't actually go to infinity or 0 but you can go arbitrarily close and how close that go makes your cost go up to infinity as you try to go right but because WB TC in Khyber noona swap is a very small illiquid market the costs are much lower than they would be for eath or die or most other tokens so because that market is so thin your dollar goes a long way in moving the price around hmm shorting WB TC right they buy it back then to pay back the compound finance loan you can spend at 112 WB TC would be a lot cheaper right is that so the way

these typically work is that you move the price one direction right and then you go and you views fulcrum and then you already moved the price that one direction so you already have that asset you go and move the price right back right and then you pay back compound so you're entering into like a stack here right is your borrowing you're shorting you're moving Khyber you're resolving the short you're unmoving Khyber you're unbar owing hmm and where's the money sitting then like after at the end of this like what what what currency is it sitting in ether okay they got ether from the fulcrum pool and so the the one question I think

that always confuses people is who are the main losers in this yeah right like somehow you know the counting has to be zero-sum eventually right and the main losers are the unis pool holder so the people who were in the WBT CII's pool as well as the fulcrum pool lenders so these on chain lending protocols work by having basically people lend their tokens for contracts so they lock up some tokens in a contract and then borrowers as james said kind of post collateral and they borrow against it and when borrowers default they basically the loss is socialized over all the people so let's say each of us put in 25% of a pool and a loan is made

for 5% of the pool but then our 4% of the pool and then that loan defaults then each of us loses one percent right so the weird thing I think that is kind of always a little bit complicated in these systems that people don't realize is that these losses are not there's not there ways that losses can happen that don't even have to come from defaults or from someone manipulating in price you also have multiple parties involved who have to actually have incentives to ensure that when the contract does go underwater that collateral that has defaulted it can be sold or it can be

converted to something that's more liquid and so I think in the case of compound versus bzx compound relies on using what's known as a liquidation incentive so in the liquidation incentive basically let's say anna has $150 worth of aetherium and she needs to buy a microphone and unfortunately the microphone salesperson only takes aetherium it only takes USD so she goes to compound she goes and borrows a hundred dollars worth of stable coin like posting her hundred fifty dollars aetherium collateral now suppose the theorems price goes down relative to USD to $100 now your $99.99

now your collateral isn't default because the system has lent you $100 but it only has 99 dollars worth of collateral yeah so in order to get rid of this net liability which these over collateralized loans can't ever be you know how to and be in the state of having a net viability they basically auction your collateral in the case of comments on auction it's just there's an incentive where someone can call a function call in maker it's called poke but in in compound that there's just like house like a normal name where you can basically get you you can basically through the first one there you give it you give a wallet that has at least 5% away you basically get a discount looks like 5% so they say your

collateral is worth exactly $100 let's not be liquidated compound the contract sells your collateral for 95 US DC or 95 died and so anyone who has that can buy the collateral and they get a discount they're getting 5% off so if they can sell it quickly enough and not incur too much in trading costs and transaction fees then they've made a profit and these are the keepers of these systems these Liquidators and these mechanisms for incentivizing people to use and one of the reasons maker and compound has been able to grow so big is they actually have a small but healthy set of these keepers and liquidators and the question that people always wonder is like how big can these things grow if you know they're very reliant on keepers

and these so I'm only saying this for compound because I've spent a lot of time we like written paper that like stress tested and analyzed suits but bzx doesn't have that they actually have a weird liquidation that going and that is another thing that like people started taking advantage of and well okay so we've covered what a flash loan is we've covered the steps we've covered who was potentially affected do we know who did it you know I think the ultimate conspiracy theory of this industry right now is everyone playing playing the you know the you know that meme with spider-man pointing at other spider-man and I think it's you know it might be better to talk about what the

type of person who would have done it would have to have known you know there's a meme of 19 year old in Pakistan does Saurus attack against smart contracts that I saw but you know I think the person who has done this has to know a lot about all the systems all the systems also the flash loans and dy/dx we're not in their public GUI or like visual API II like you actually haven't probably were running a node probably reading their contract quite carefully and figuring out the right time to call them and it's actually kind of amazing it happened on like Valentine's Day also there's another attack actually in December with maker and synthetics I'm sorry I that one is definitely on the attack is there's an

arc like there is another winning trade there's another winning trade yes I don't mean to call these things I personally think they they're not attacks usually I but but you know when they're covered they're called up but the event event yeah but someone found this way to basically manipulate nkr and the synthetic version of n terror so it's like a derivative on on that and there's basically moved the you know swap price up and down because the only place to get MKR is you know swap and that happened on Christmas like it actually it was it was the interesting thing is with aunch analytics you can actually track that the person was testing the strategy for three weeks and doing very tiny amounts of it and then on Christmas Day just went crazy and it was it was within it took like twenty

four hours before someone else was also doing the same trade and that went down to zero but I think it this holiday appearance with this thing suspect someone knows that like those are good days that people are not paying attention busy on Valentine's Day in crypto people know in the DS Denver yeah actually that's kind of funny they did host a conference during a conference with hundreds of attendees maybe that was more that was the distraction it being it I mean the the systems have been run for a long time why do you think it took as long as it did for someone to actually do this like is it just that it was that hard to analyze or what like why is it taking so long and if it's taking so long like what what does that

mean for what's still left out there to exploit I think there's a fairly complex calculus for anyone like making these transactions is there's not actually a huge amount of money in these systems they're walking away with like three hundred thousand five hundred thousand it's not a I never have to work again amount of money right it's very high-risk because a lot of these are like potentially crimes in some jurisdictions they're it's very hard to liquidate that ether now because everybody is watching it so there's

actually like a very complex incentive like calculation going on here of when is it worth it to do this for an attacker if I have to spend hundreds or thousands of hours acquiring the experts to do this some amount of weeks you know making sure that it's going to work and implementing the software to do it and then all I'm going to get out of it is like a few years salary that I can't even go use for anything like I'm I wouldn't make this attack yeah I just I would have the the same calculus because the there's very little anonymity in nathie Liam compared especially compared to Bitcoin and I don't mean anonymity

and a strong sense of is there an alt proof I mean just even mixing services like people in aetherium who are Liquidators I feel like they use their addresses as vanity plates look at how much how many liquidations I've done it's very different than the Bitcoin Bitcoin or mindset of I don't want anyone to know who I am and these things are extremely traceable so the moment that you know this is 2013 in Bitcoin but for defy and the moment that the chain alysus of the world or the the governments of the world that want to analyze this figure out you know where which address did it I'm sure they could identify it on the theorem because people take so few privacy precautions

well and the account model is you know inherently opposed to privacy you're basically required to have a long-lived public key identity but if you look at the history of attacks and etherium even the huge ones even though like 10 plus million dollar thefts the eath tends to just move somewhere be stolen and sit there forever Wow people don't seem to be liquidating the proceeds of these attacks and sometimes like with the synthetic things they don't even seem to be like liquidating the proceeds of good trades and the

stigma is never going to fall off of those coins so this is what I think Tarun and I would not make these attacks is because you don't actually really get much out of them one other thing I will say to Frederick's point of it took a while for this particular attack is there's a there's a sense in which this this relies on different credit worthiness of different smart contracts so dy/dx bzx and compound you should think of them as three separate banks and different banks have different lending standards some banks will lend to anyone some banks will lend to no one some banks will lend cheaply some will lend it more expensively and you need

enough lenders with enough capital and enough differences in qualities of credit standards to do these types of things so fulcrum actually was quite small until recently and it very recently crossed the 10 million dollar line and I think base you needed someone of such a low quality as a bank in terms of their lending standards in order to take advantage of borrowing on the crappier one using that to collateralize a loan on a good one and then making a profit that way if that makes sense so this is a variance in credit standard not only like the knowledge-based necessary to execute it and overcoming the the legal risk but it's also the right environment needed

to be there to actually do it so turn would you say that the frequency of these attacks is going to scale with the square of the number of these defy banks that's a good lower bound because I feel like you can start doing crazy meta transaction things where I batch a single transaction to all three mm-hmm you know what I mean like it yeah the the square is assuming that we have to do them sequentially okay one thing here flatulence wasn't flush loan actually isn't that sort of a new phenomenon it just recently was like kind of the whole idea is deployed recently the idea is a few years old I am so I think marble actually did deploy a contract too two

years ago almost I'd have to actually go and look up the dates but the idea is a few years old there's been an implementation for a while but they only recently like with dy/dx started getting like a bit of liquidity the thing about like a flash loan is that it can be costlessly and riskless ly stapled on to any other smart contract and so all you need is like one or two of these defy pools - you know TAC flash loans onto their contract in order to have incredibly deep like flash liquidity pools so I think you're right in saying that like well the ideas been around for

a while it's only very recently that someone went and implemented it with some eath in the pool and and I will say some of the other flash lenders so you know Ave dy/dx BX they have some of them actually charge fees so on ave the most amazing thing was kind of watching doing when you're doing some chain analysis after this attack there were like I don't know I don't know how to make the number of people doing this it might have just been one bought just someone trying to optimize their strategy but there were people making failed function calls to every single one of these contracts because it's costless because if you run out of gas or you your transaction isn't worth go

through no one pays anything yeah or you pay an extremely small transaction fee yeah so you pay your gas bills yeah gas costs are negligible for almost everyone right now but James why do you love flush loans because it sort of sounds a little bit like flash loans were kind of the part of the problem or like like why would why are you Pro this flash loans don't contribute to these problems bzx had that problem whether flash loans existed or not flatulence didn't even make it easier to do this what it did was it opened up the possibility to more

people you're saying like all of a sudden you didn't have to be a whale to do this guy right game you didn't have to already have tons of money to play complex arbitrage games so beyond that like it's democratizing access to these kinds of complex trades and now that they exist we will never go back to a world without them it's not useful to say they're contributing to the problem or making things worse because the incentives are there to create them and to have them and people want to use them and so we have to move forward with this

world where they exist and I think that flash loans have some really cool use cases that we're gonna see over the next year and that they can be generalized a lot more than we've seen so far like right now we're seeing like flash loans of money that is sitting around doing something there's no reason that that money needs to exist bubble before being flash loaned you could have flash inflation of a token where the token supply goes to infinity and I have all of it for the space of one transaction it's the same as a flash loan but your flash loaning

the entire monetary base of that asset we can have flash access to ownership of a smart contract or flash access to like subsets of the state of a smart contract because we can have hard limits on what someone can do in the space of a transaction and we can ensure that they must return these things to normal by the end of the transaction the flash concept has a lot of very interesting and powerful ramifications on you know how we handle smart contracts state we're super early in this and again it's something that you can't effectively do

in traditional finance I've seen some speculation on Twitter that the tote the ERC 20 a token standard should be changed to have this in it like you can flash loan whatever amount you want just like to make it really clear that this can't happen whether you design for it or not right that that you like we need to educate people and like people need to build their apps with this in mind right the idea that someone with all of the money is going to come along and try to use your app to make a winning trade so it's an idea of Flash inflation was arrived at like by me and a couple other

people independently last year so I think Remco from 0x has an initial implementation of this that I'm excited to play around with but it's it's really like five lines of solidity with one function call like it's not complex it is trivial to staple on to any existing ERC 20 token or any newly deployed one and yet the ramifications could be explosive well uh interesting we've already seen some some reactions to this from people who were kind of being ostriches about this risk to their system in particular maker announced that there's kind of

this known bug that if you could borrow a bunch of MKR not even that much because of how few people actually vote and how little actually how it's the same X people who vote every time that you could visit a cover maker and crash the system and make the interest rate go really high really low or whatever and the flash alone thing is a little more scary for that because you don't even really need to borrow you can borrow vote close the borrow so you have no cost in completely affecting governance whoa so on the governance front because it's not being spent and it's not being trade this is it stays sort of in its form you just need it for signaling basically or for like allowing your

share of the of the vote yes so we've seen like the what's the name of the dow for make your governance take her down take her down yeah so we've seen like take her down as a thing we might expect to see flash governance in the future but again it's something that like the people building this have to design around right leg yes you build a governance system make sure that you're locking tokens for voting mm-hmm like it's trivial to design a solution for this it's just that people have to do it right and well it's also that the solutions for this are going to have negative user experience like they're

going to have real costs to the user so when you talk about locking tokens for voting you're talking about taking away liquidity from your users in order to vote in the governance so you're if they're validators they'd actually have to like possibly unblock right so you're talking about imposing costs on your users in order to solve for this generally speaking governance systems are actually more complex less specified financial systems bolted on to the actual protocol you wanted to build so I would expect that we see a disproportionate impact of things like this on governance because generally speaking governance systems are poorly

designed and more vulnerable to this than the underlying collateralised systems and and I guess it's in some sense this is a good way to optimize these governance systems because you know right now people complain about hey there's a lack of participation and our governance system and it's like okay well now you might have too much participation instantaneously and I think the more competition there is amongst people using flash loans the irony is that that's actually a safer is threatened model because now you can assume that any participant in the system can aggregate almost the whole money supply or potentially more with inflation and by doing that you will

just kill the bad mechanisms and converge on the ones that survive and so to kind of bring this back to something I said way earlier in the conversation the risks and opportunity costs of flash loans are very low but because being the first to get that flash loan can have impact on governance and impact on the arbitrage --is that are available buying the right to make an aetherium transaction is going to get very expensive in this world because you get the exclusive right to the entire chain so I was actually talking with my friend who says a Bitcoin core developer who who has you know was like oh my god you

know it's great that the theorem exists so that no one trusts to do this on Bitcoin because his master's thesis was actually on atomic transactions with infinite kind of like price impact here you're gonna just Doc's who it is right there well by saying with their masters these as well you know that's practically uniquely identifiable well they this person has publicly been quite quite quite talking about it has even though it's a Bitcoin cordeliers he's been trying to convince a big corner so this is actually a good way to make themselves anti fragile which I agree it's actually like a very good stress

testing methodology I just don't think the crypto kitties of the world are ready to be ready ready for their beanie baby annihilation to me this is like a very good example of the the disconnect between the shells saying like oh this is ready for our mass adoption and the people that actually know what it is and how it works and say no this is like super early days but it's so like I say that in a hopeful way that we will resolve these things and we learn these things as we go along well I think that that's why we all find this so interesting is we have discovered something that is unique to unchain systems and is causing a very rapid

maturation of our understanding of how these systems work so you kind of you love them because they're just putting things into the fire sort of it it it speeds it up it makes it like hotter yeah is a we are learning about how these systems work in practice and we're learning about the social structures of these systems by stress testing them live with real money it's Darwinism but for economic models like and when I hear about this and think about it it's like quantum mechanics for blockchain where so nice for that when you start like reading

quantum mechanics the first thing is your runner makes like you get in a lobbying running experiment where there's an electron trapped in a potential well and then you observe this and eventually the electron jumps out and you you go like how the did it jump out well you know the real answer is like it's actual position it's a probability curve and it must never in the well to begin with but what like the teacher will tell you or let at least what my teacher told me was don't worry about that yet it borrowed some energy from the universe jumped out of the well and then gave the energy back a really good way of teaching renormalization tonight I

never heard that nausea flash energy loans literally lungs well you know if we're just replicating the universe in digital form then oh no we can't really can't really do much better entropy wise so guys we have we've we actually have some time left and I'm wondering if we should cover some other kind of topics that are just like since we're here talking about blending you know true and you just gave a talk here at SPC and I think it's definitely one of my favorite talks and I would encourage people listening to this to watch it and you're talking about lending and how that affects proof of

steak protocols and I think it's a very interesting perspective because as we move into this world of proof of stake and move away from proof work there's a bunch of stuff that changes but this is an angle of it that I hadn't really thought deeply about before and I think you prevent presents a very like holistic and thought through view of it but maybe give a summary of it like how does how does lending effects proof of safe protocols yeah first of all thanks thanks for the kind words so basically you know what's the difference between proof of work and profess date so the original sort of Bitcoin talk post about purvis stake which is as far as I know

the earliest provenance I mean there are people who have made systems that call themselves stake but the first piece that ties Bitcoin proof of work to proof of stake was this post written in 2012 and I was first I first found it thanks to someone who's been on on the podcast Joe Bono he pointed out to me a long time ago and this post basically says there's a sort of a thought experiment for how you get proof of stake from as the limit of proof of work and the way it works is imagine if I instead of committing hash power and being selected by hache power distribution I instead I'm able to kind of have a virtual hash

power distribution that looks at looks like the limit of every time I get a block reward I immediately reinvest it and now that changes my relative probability of winning and so that's sort of a limited proof of work because improved work if you get a blocker word you have to go sell it or somehow exchange it for a minor turn the mine around right there's this latency it doesn't happen instantaneously and so that's that's what this where this idea came from so in improving work however this this disconnect means that the asset itself is disconnected from the thing securing it unless you can bring that thing on chain via an Oracle which is the hash power the actual hash power

distribution is off chain and it's distinct from the asset that makes transactions and proof of stake by design to get this kind of instantaneous reinvesting of Blocher words you end up making the asset exactly the same as the asset that's used for transaction so the asset used for security has to have a really high value relative to all other competing instruments and moreover the rate of return has to be higher than alternative rate of returns on the same instrument which is different than proof of work because of that now basically lending is a natural simple way of generating yield on an asset you own and

on chain lending in particular because it's censorship resistant basically there's no really way kind of with the flash loans to say hey this won't exist because people are just going to deploy these contracts and do them the exact same way and on chain lending can't really be stopped as long as you meet the conditions to borrow you you can go or lend you can earn that yield so now you you look at the staking ass and you realize there's a financial attack surface area that really corresponds to the fact that staking coins have to compete on the basis of relative returns rather than on the basis of Hodel monix or kind of like yeah I've invested a lot of money into electricity

and so you know I need to recoup my investment or kind of something James has written about with Hassoun and Brandon Curtis about kind of like minor extractable value and how you how you should try to cost that out and so yeah so this talk basically you know made a kind of simple but rigorous math mathematical model for people who view their assets as portfolios of like staked assets versus plant assets and you know I think the extensions of this will come as we find more sources of yield like if there is a way for proof of stake tokens to be used in derivatives then then now you increase

your portfolio to portion staked portion lent portion and derivatives and you know that component those components increase whereas in proof of work this distinction really helps you separate them so at a high level that's that's about so are you saying that because you are using your asset for staking and for lending and for other things the rates these pay compete with each other yeah and so over time people will allocate capital so that those rates converge or if let's say let's say you're a staking coin and you're not the numeraire so you're not the denomination that people

really use for trading like if you're not Bitcoin or USD uh-huh then people will do you'll just rebalance to whatever gives you the highest rate and you do say this in proof-of-work a little bit in terms of miners mining on the lower end of the coin spectrum where they do really reallocate there especially if they're cheap the new coins they do reallocate yep so you can't avoid that person GPU coins sometimes reallocate on the like minute Lea basis miners with large GPU farms are constantly evaluated in which coin is most profitable to mine on be it bitcoin cash or music coin which is a real coin exists music coin is a real proof of

werk coin what does it do music it's PO I think it does music licensing okay so the point being that this coin that you've never heard of which is probably not even in the top 250 is being considered by GPU miners at all times so stagers essentially are forced to reallocate out of staking if there are better returns yeah and and it's more instantaneous like the trade-off you have for being instantaneously reinvesting your block reward is that you now have made it so that you the timescale at which you have to rebalance

is faster mm-hmm is this true even if there's an unbundling period right so this is the the the the criticisms I think that that this model has it's too simplistic it doesn't include on bonding periods it doesn't include it doesn't include mistaking derivatives but the idea is to make the simplest possible non-trivial model where this does happen and then slowly add in those features to see how they protect against this but I think in the unbounding case it actually just corresponds to you know changing the risk profile of the system in a certain way but there's no reason that everyone doesn't try to unbond at the same time like at the end of the period like at the end of the app hawkers right so if

some better opportunity is available elsewhere right everyone one bond to pursue it and one of my greatest things like flash loans that I hope happens and maybe people who are running proofs sake networks hope this doesn't happen is that a competing chain goes and launches an on chain lending platform with a bonding curve that's like designed to be kind of easily manipulable so that this this does happen and people stops taking and in the crazy world and this is where James I think will have a lot of opinions is the cross chain world where I can actually cross chain I can collateralize a Bitcoin loan on aetherium and then kind of like remove security so you can imagine that you can remove security stickers who are

rebalancing rebalance from one chain to another and they do it via lending right because every ether that is bonded for you know a tokenized asset or for CDP or whatever is actually in proof of stake taking potential security away from the chain yeah yeah it's kind of great so it's gonna be another form of Darwinism that I think once you have many proof estate chains life--all oh really I mean there's this conversation that I've had a ton of times of what does a fully interoperable or look like where you know you can move any tokens anywhere and and sort of at the limit what does that mean does it mean that all tokens

become the same thing and are worth the same thing and like all these sort of philosophical questions which are instinct think about but I guess to sort of made me summarize and put a period on this my question would be what should someone who's designing a proof of stake protocol do like what should they look at or think about as they do that yeah so one of the mitigations that I think people are trying to do although I don't think they're necessarily framing it in the lending phrase is is staking derivatives so validators right now I think the real yields are quite low so they're actually losing money in a lot of cases because they end up paying too much you have to buy nodes they have to you know I think people underestimate of

the cost of running nodes been to thousands hunting or they estimated them but told investors there were less or something I don't know you're choose or choose your poison but basically the validators don't have liquidity and like if they could borrow against their stake tokens and hey they can keep their nodes up and there's been this talk about staking derivatives there's another side effect of staking derivatives which are basically loans against your staked asset which is that they the base protocol actually now knows all the lending activity if you can make the primary lending market it's taking derivative market which is very difficult to do for a lot of reasons but

if you can find a way to do that then the money supply can actually be dynamically adjusted based on the expected lending activity so you're saying that if you're designing a proof of stake blockchain today and you're designing the you know issuance rate and you're designing the rewards for the proof of stake system you should be designing a lending market at the same time and launching that lending market at Genesis of the chain yes I'm saying you should you should you should try to make that distinct part of it of what you're building I'm not saying it's you know there's still a tax

on that someone could make a much more successful smart contract that's on your platform that works but the idea is if you can get all the early participants providing liquidity and getting the pool size to be really large then it's much harder to manipulate and then you can kind of then you make the variance and rates than the rate Delta's quite well hmm then you're a central bank right just FYI I just I you know I think I think I don't want to belabor that point too much but but the proof of stake does after you start counting all the ways of attacking it it starts looking like central bank what do you want to be when you grow up not Ben Bernanke so do you expect a lot of like central bank like

human oversight of proof of stake issuance rates and markets yeah I think these governance these these designs where people are like okay we're gonna have governance on the rates I'm not saying it's the best possible solution as we've learned from flash loans because you can imagine flash loaning the P US currency and crashing the rate there are tons of things you know like that but I I think I think there is there's a lot of benefit to that another case where I think there's actually you're forcibly building a lending market whether you like it or not and I don't know if everyone who's working on these types of things realizes this is like when you have a native stable coin native algorithmic stable Clinton because you're building in the lending

market into the staking protocol and it's actually very close to the type of thing I'm saying where it's you know in order to keep the token stable it's like adjusting its issuance and that ends up being a weird form of lending because it's if you're using the validators who are blocked are kind of like locking up more or less of their their tokens and that the lending activities looks like that it's like making certain tokens locked in a pool this seems a lot more complicated than proof-of-work infinitely I mean this is what I'm saying it's it's it's like I think the attack surface is just gigantic ginormous for the physique but it's cool that I think the Darwin is an

aspect is really cool right central bank's took hundreds of years to kind of find an equilibrium that's sort of an equilibrium and now we're gonna we're gonna compress hundreds of years of central banks competing with each other into like one year of every proof of state currency competing with each other via coin base and by Nance and then Libra wins I don't know that I have no clue what's happening there there talk at Sanford boxing conference suggested that nothing new has happened I don't think I they didn't say anything that wasn't in the original paper as far as I could tell no the only thing that's happened is the US government saying that they can't do well maybe it maybe it is just gonna be dollar back coin that's never stopped anyone in

blockchain before yeah that's fair enough so before we sign off from this conversation I did have one last note that I wanted to cover and that had to do with the work that you've been doing James on the EVM support on near or in near what do i how do I say this EVM support at or near for near on isn't it on okay so that is the EVM support on near so you were working on that and I just wondered when we were talking just before if I like this cross chain and like what that would mean when you when we talk about EVM support is does that actually Inc is that like a helpful in a cross chain context or because as I understood it was like redeploying it

separately like it's not related to the original EVM right so near has two projects one is the bridge which is a federated bridge between Ethan near and one is near EVM which we worked on in a nutshell you know we took the parity EVM from the parity aetherium client that Frederick put a lot of work into and we you know went through the code we took chunks of it and we compiled it Towe Azzam for deployment on near so we have a functioning EVM that runs on year and uses nears native token so you can deploy solidity contracts to Neer's test net today it's not part of the near

bridge project and I'm not sure what the state of that is or how usable it is but you know kind of what we've been doing at Summa and especially with crushing group is not just working on cross train communication but working on general interoperability standards and tooling and so the EVM already has a lot of tooling around it that lets you quickly deploy these smart contracts truffle for testing web 3 for UI so there's a large existing ecosystem and the near EVM is about taking that ecosystem and opening it up to use more chains would you for this to work though you'd have to redeploy each contract like it's not

like they just automatically you have to no no they don't like automatically migrate over you'd want to redeploy contracts as necessary and you know that means that you need new liquidity pools and aetherium has a lot more assets than near does and so right now that in your EVM is a fairly like siloed off part of the near ecosystem but you know like the EVM on substrate projects like other EVM oriented projects really what we're trying to do is take all of the existing tooling take truffle take web 3 take everything that uses it and apply it new places and you know we think that's

really compelling a lot of work has already been done in this industry and there's no sense starting over from scratch on every chain although does every does every network have that capacity like is it really appropriate for every network so every smart contract network is going to have that capacity the question is usually going to be whether it's economical to deploy evm and how is it economical to deploy any VM you know so I I don't know how like you're approaching this first substrate Frederick we're thinking about it the way that you just said that like there's been a lot of effort put into the VM into ways of analyzing by code and to like trying to write good

solidity libraries etc and while I actually like a large part of me does want to throw that out and say it's all because of what we're talking about here today but most of that will happen somewhere else anyway and so like yeah there's a trade-off here of like using already known kind of entities but then you know I think we have to start reinventing and have to start from scratch on other things as well but that I mean that we are doing that we're writing as per our contract language and rust then we're doing a bunch of other things but I think we we should do all of the things but you go yeah and and at the very if you were to find a better solution to write smart contracts in a

better way then it's not as if we can throw everything else out that was already done like we we have to slowly migrates through the better solution so we need to provide some path forward that migration yeah one of the things that we've been thinking about from your EVM that we'd be really interested in like talking to you guys about more is how does the EVM call outside of its silo how does the EVM call a near contract and process the results do you want to FF I basically yeah basically I mean we already solved this problem when we did the EOS on implementation so I mean we called from EVM T was them and like had Wazza many

VM contracts interoperate well one of the interesting things about near is that the near contract execution is asynchronous so when you send a message you don't wait for the result right so you can't just like directly call from the EVMs synchronous call stack thing too near because you'll never get a result back so you have to finish up your EVM processing and have the EVM generate son list of messages that need to be sent which may result in messages coming back so you need to do actually quite a bit of like thinking and work on the proper way to do this yeah that sort of changes well that's a part of the problem of the EVM is that there are

some fundamental concepts once you get into trying to change that you're not actually salt like you're not actually providing a migration path anymore if you start saying that no this EVM is actually async and yet make a call and then you have to provide a function for that response to come in to then yeah you can take your contract from a theorem and deploy it anymore same thing if you want to remove some of the legacy you know back into of like 256 bit work that's at all yeah like then again like it's something easy I'm like but is that actually useful isn't it better to just start from scratch I don't know well one thing I guess it does seem like you should be able to

wrap these was like deferred futures and promises all right that you like basically make EVM wrappers that wait on events that the EVM is really bad it types well I'm just saying I mean I wish morality wrote code for me but getting getting back to like where we started off you know at Summa and a cross chain group we're interested in these like big picture interoperability projects is how do we bring the existing ecosystem to more chains and how do we build cohesive

ecosystems around these new chains and I think Neary VM you know we got a great opportunity to work with the near team directly on doing some of that and that's why I was excited about it and do you see yourself doing that for more projects - um I think we could conceivably deploy a few more EVMs if we wanted to I think that we're going to keep like iterating on and maintaining this one for a little while I don't know that the EVM is the perfect tool for all use cases it's probably not so I'm excited to see what you know like new teams come up with and if there's

anything there worth standardizing around it almost has a bit of like a substrate feel like the way you just described it like you deploy it it has all the tooling I know it's just a part of a blockchain but I know that in substrate you deploy and hold it a lot of the tooling is also included and I guess in the cosmos SDK it's similar but is that sort of like the one version of well we're seeing a bunch of different ecosystems that are developing cohesive tool sets within their ecosystem so cohesive tool set for substrate where you build a substrate chain and you get all of this stuff for free and the same in cosmos if you build a cosmos SDK module you're going to get the consensus mechanism and the network protocol and

the message handling for free essentially what you know cross chain group is about is a little bit more of the multi ecosystem standards and what can we give you for free just because you built something resembling a blockchain somewhere and what kind of standards can we implement that are broadly applicable to the polka-dot ecosystem and the cosmos ecosystem and the ease ecosystem and that's what you know I spend a lot of my time thinking about these days I would personally be a lot more excited if we standardized on was am than on EVM yes because like everyone is going in was in direction anyway well then with your word upsets all right no yeah kind of but not really it

sort of like yes you can have an asynchronous model of it or you can have this but like the subset is basically just Waze them without floating points for everyone yeah so like the host functions will look a bit different and so we kind of need to have huazi standard things kind of thing this is something that I actually I'm really enjoying is a developer is because there are a bunch of people standardized standardizing around various versions of wowza I can just right rust and I can be sure that my rest is going to run you know on substrate it's a little more difficult with the standard library thing but I can be sure it's gonna run on an ear and I can be sure it's going to run potentially on solana

and I can look forward to it running move what move move yes move is very rusty I can look forward to it running on the new rest cosmos like tender mint implementation as well we can because people are standardizing around wasm we can like start building things in rust and typescript and know that they will be useful on many chains for years to come we're also working on solidity to was them to compile our fun where were like others are as well I know the you awesome team was working on that as well was them is supposed to be a back-end of you'll now and so there's like oh really

that's really cool that I think that's a better migration path then like compiled your solidity code if you have to you know keep that compiled like there was him instead of compiled to UVM and have this janky the EVM was never designed to be an IR the EVM is itself very janky but it is you know like the thing we have and the thing that people use and I would love it if a lot of the solidity got seamlessly migrated to Azam but as we found out like developing near EVM there are a bunch of like fiddly little semantics that change depending on the environment you're in getting the

etherium call stack semantics right was actually very difficult so anytime like we moved from EVM to a Waze on VM I think we run the risk that contract behavior is going to subtly change flash loans might be different it depends on how people write contracts like some people write really shitty contracts where they depend on the gas price at some point and like have branch conditions on how much gas ease instance that yeah they're never gonna be deployed anywhere else you know one last point is you know inherently all contract rely on gas prices they could make edition worth 8 million gas tomorrow and

all contracts would break so like anything that affects how gas is metered is going to change the behavior of some contracts and it's going to change how people write contracts and so we can do a lot of things like near AVM where like it's easy for the developer to migrate over but there will be subtle changes in the costs and in the behavior and so what we're looking for is to get as close as possible and provide a good dev experience cool alright guys I think we have used up our time here in the Stanford alumni Business Center thank you guys for letting us use their your meeting room to record this podcast yeah and thank you so much for coming on the

show again thank you thanks for having us thanks guys and I guess till the next conference in your conference oh yeah zero knowledge summit Oh what is that end of March so zero knowledge summit end of March any Brewin March 31st get your application in okay thanks guys and to our listeners thanks for listening thanks for listening [Music]