DeFi Security: Understanding Common Hacks and Exploits

[00:00:00]every opportunity comes with risks and defy is no exception for every way you can make money in defy it seems there are at least two ways you can lose it although this risk can't be avoided entirely with careful risk management and sensible judgment you can at least decrease your chances of getting totally wrecked so what are some of the common ways people lose money in defy what are the different types of hacks and exploits and most importantly how can you minimize your chances of being negatively affected by hacks in the future you'll find answers to these questions in this video before we begin if you want to learn more about decentralized finance and the technology behind it make sure you subscribe to my channel hit the bell icon and enable all notifications you can also consider supporting us on patreon and joining our defy community and one more thing before we start this video is a collaboration between cinematics and rect.news rec news is an anonymous platform for whistleblowers and defy detectives to present their findings to the community they analyze all the major hacks and exploits and provide creative commentary on all things crypto and defy with an aim to educate and entertain the readers their site directed news contains their own articles as well as an ai generated news aggregator that gives coverage of all the most important recent events within crypto and defy in particular so back to the topic of the video how can i get wrecked in d5 we wouldn't have time to cover every single type of exploit and of course many types remain unknown but there are a few techniques that occur regularly and we'll now look at a few examples drag pool trackpool has become a commonly used term across all of d5 and is now used to refer to many types of hacks and exploits but it actually refers to a specific technique of suddenly removing the majority of liquidity from a liquidity pool the sudden loss of liquidity can create a death spiral for the token as token holders try to sell as fast as possible in order to save their profits to rackpool is usually the final move from a malicious team and is a common form of exit scam where the protocol deletes all traces of social media as they try to escape with the funds as this type of attack is technically very simple it is often the chosen technique for quick cash grabs by low effort projects however this does not mean the profits are low and there have been several major rack pools where users have lost multiple millions one such example would be the case of meerkat finance who after just one day of operation were racked for 13 million busd and about 73 000 bnb totaling around 31 million dollars at that time if a large liquidity pool is used within a project then the project team should not have the ability to retrieve these assets if they do then you are placing your trust in the project team initially muket finance did not have this ability however shortly before the attack the meerkat finance deployer upgraded two of their faults giving themselves the ultimate backdoor into defaults how can we avoid getting rack pooled check how the liquidity is locked is there a time lock is there a multisig do you research into the project find out who is backing it and what is the purpose of the project is the team known if they are what can you find about them proving identity online is becoming increasingly difficult and scammers are turning to unusual methods to build the trust of others as was the case with the trade fund who some suspected to have used deep fake technology to create a video of a fake ceo this story was covered by wrecked news on the other hand if you can't find any information on who is behind the project remember that an anonymous team isn't necessarily a bad thing as the founder of bitcoin remains anonymous to this day economic exploit flash loan there was a period of time when it seemed every week brought a new defy hack and the words flashlight were never far from the scene the association of flash loans with hacks and exploits led many in the community to believe that their impact was solely negative however it's worth remembering that these transactions were already possible for wales with large accounts and that flash loans in themselves are not a malicious tool they simply give access to large amounts of funding on a very short time frame this funding can then be used to take advantage of loopholes in code or to manipulate pricing and profit from arbitrage flash loans are uncollateralized and secure loans that must be paid back before the blockchain transaction ends if not repaid the smart contract reverses the transaction so that it's like the loan never happened in the first place because the smart contract for the loan must be fulfilled in the same transaction that it is lent out the borrower has to use other smart contracts to perform instant trades with the loan funds before the transaction ends if you want to learn more about flash loans check out this video here most flash loans attacks involve the manipulation of the token price using a large amount of capital one example of a major flash loan attack would be harvest finance who lost 33.8 million dollars to an attacker in october of 2020.

[00:05:44]fusd fell 13.7 percent and the farm token fell 67 percent over two hours as the hacker took out a 50 million dollar usdt flash loan then used the curve finance y pool to swap funds and stretch stablecoin prices out of proportion the following actions took place in a 7 minute time period take a 50 million dollar usdt flash loan swap 11.4 million usdc to usdt causing usdt price to go up deposit 60.6 million usdt into volt exchange 11.4 million usdt to usdc usdt price goes down withdraw 61.1 million usdt from volt resulting in half a million usdt profit rinse and repeat 32 times without any prior testing convert to run btc and exit to btc and it via tornado cache a service that allows for making anonymous transactions on ethereum therefore covering the attacker's tracks the attacker was able to withdraw more usdt at step 4 because of the change to usdt price as the price of usdt was lower during the time of the withdrawal their shares represent more usdt from the vault pool approximately four cycles can fit into a 10 million gas limit and although the profit on each cycle was less than one percent around five hundred thousand dollars per repetition adds up quite quickly flash loans are often used to manipulate prices which allows for arbitrage where it would otherwise not be possible to avoid flash loan price manipulation attacks protocols should look to use reliable oracles flash loans can also be used for other attack methods such as reentrancy front running or arbitrage arbitrage refers to taking advantage of price differences between different markets in order to generate a profit these types of opportunities are especially common in immature markets such as defy and crypto arbitrage opportunities tend to decrease as liquidity increases and the market becomes more efficient if a pool is manipulated with flash loans for example to allow room for arbitrage then this may also be considered an exploit as liquidity providers can end up losing their funds as was the case with saddle finance during the launch in january this year at least three major arps took over 7.9 btc from the early liquidity providers within 6 minutes despite the claim to have solved the problem of slippage although this was only arbitrage the users still lost out a saddle finance was unable to protect them from the arbitragers who are simply buying and selling within the limitations of the code this brings us to one of the common questions regarding losing funds in defy was it a hack or was it an exploit defy is still such a new concept that the entire industry is a live experiment testing new ideas as we build a new financial system this means that loopholes are often found in life code and when these loopholes can be used to withdraw funds without forcibly manipulating anything then perhaps it's best called an exploit however this labeling could be applied to all hacks as they can only operate with the code that has been written whether we call them a hack or an exploit the end result is the same if loopholes exist then eventually someone will take advantage of them and there is little we can do to stop this even security audits do not guarantee safety rec news also writes each hack and exploit on direct news leaderboard which shows not only how much was stolen from the protocol in dollar value at that time but also who audited the protocol before the hack you can find links to these pages in the description box below if you look at direct leaderboard we can see that the majority of hacked protocols actually had a security audit completed prior to the attack this proves that an audit is not a guarantee of safety and audit firms can also fail the leaderboard shows who audited the specific piece of code that was exploited according to the leaderboard the most notorious security companies are currently pack shield with three failed audits certik with two and quan stamp also with two many of the most recent regular news articles covered audited protocols showing that in the end there is very little difference between an audited and unaudited protocol users often make the mistake of believing that one security audit can cover an entire protocol forever however all defy protocols are full of moving parts and even if a protocol is audited very thoroughly a single small update can render the audit useless so what do you think about hacks in defy have you ever been affected by any of them comment down below also don't forget to check out direct.news for more content like this and as always if you enjoyed this video smash the like button subscribe to my channel and check out cinematics on patreon to join our defy community thanks for watching