►
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/security-risks-in-defi-delineating-technical-and-economic-security/
The frenetic evolution of DeFi makes it hard to understand its principles and risks. In our talk, We delineate DeFi along the axes of primitives, protocol types and security risks. We distinguish technical security, which has a healthy literature, from economic security, which is largely unexplored, connecting the latter with new models and thereby synthesizing insights from computer science and economics. Finally, we outline the open research challenges across these security types.
Speaker(s): Daniel Perez, Ariah Klages-Mundt, Lewis Gudgeon
Skill level: Intermediate
Track: Cryptoeconomics
Keywords: DeFi,Security Risk,Incentives
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
Hi
everyone
and
thanks
a
lot
for
coming
to
our
talk,
so
I'm,
Daniel
and
with
me
here
is
Ari,
and
this
is
a
prize
that
has
been
done
by
a
few
people.
So
there's
Sam
and
Louis,
who
are
in
the
audience,
but
I
won't
be
presenting
here
today
and
so
today,
we're
going
to
talk
about
secretarist
in
defy
and
in
particular
we're
gonna,
try
to
sort
of
give
some
definitions
and
explain
how
technical
security
and
economic
security
are
different
or
how
they
differ.
A
So
a
quick
outline
of
what
we'll
be
presenting
today,
so
this
talk
is
meant
to
be
fairly
accessible.
So
we'll
start
by
presenting
a
bit
the
different
Primitives
using
defy
and
then
we'll
present
a
couple
of
protocols
that
are
that
can
be
built
or,
and
once
we've
done.
This
we'll
enter
a
bit
more
into
the
main
part
of
the
talk
which
we'll
be
explaining
what
technical
security
and
economic
security
is,
and
we
will
finally
present
a
few
open
challenges
for
research,
with
the
focus
of
on
these
different
types
of
security.
A
So
I
will
start
on
a
very
high
level,
but
what
is
D5?
So
we
have
a
couple
definitions,
properties
for
D5,
so
the
definition
of
a
give
is
a
peer-to-peer
powered
Financial
system
and
for
a
typical
D5,
we're
saying
that
it
should
have
a
few
idealized
properties,
first,
one
being
non-custodial,
which
means
that
participants
should
have
control
on
over
their
funds
at
any
point
in
time
and
the
next
one
is
that
it
should
be
permissionless.
A
Anyone
should
be
able
to
participate
in
this
financial
activities
without
restrictions
or
without
being
able
to
be
censored
by
a
third
party
should
be
openly
auditable,
which
means
that
anyone
can
look
at
the
blood
state
of
the
blockchain
or
what
is
powering
the
defy
and
be
able
to
see
the
transactions
and
what
is
going
on.
And,
finally,
it
should
be
composable,
which
means
that
different
protocols
should
be
able
to
communicate
with
each
other
and
to
interact
to
form
sort
of
new
Financial
systems.
A
On
top
of
this,
so
well
with
this
D5
coming,
there
has
been
a
lot
of
controversy
and
all-
and
we
can
see
this
a
bit
as
like
two
sort
of
very
point
of
views
and
optimistic
and
a
pessimistic
point
of
view
for
the
defy
Optimist
defies
a
huge
technological
Advance.
This
is
new
Financial
system,
that's
openly
editable,
and
that
has
all
the
properties
listed
before
and
that's
obviously
very
promising
for
the
future
sure-
and
there
has
been
already
a
lot
of
good
things
with
D5.
A
For
example,
stable
coins
like
die,
has
been
used
in
countries
like
Argentina
to
fight
inflation,
any
sort
of
things,
and
also
we
have
seen
that
more
custodial
system
has
tend
to
fail
in
some
places
where
decentralized
Finance
could
could
have
allowed
people
to
have
more
visibility
on
what
was
going.
On
the
other
hand,
there's
also
this
pessimistic
view
that
is,
that
well
defied
and
regulated
its
hack
prone
there.
It
can
allow
people,
through
its
southernmost
nature,
to
to
commit
many
sorts
of
crime
like
scamming,
money
laundering
and
so
on
and
well.
A
There
had
also
been
like
many
hacks,
as
probably
you
have
all
seen,
and
this
North
Korean
hackers
hacking
protocols
and
also
recently,
a
bit
more
recently,
the
crypto
mixer
being
sanctioned
and
and
so
on.
So
well
in
this
talk
well,
we'll
we'll
focus
mostly
so
on
security,
which
is
something
that
we
think
is
absolutely
it's.
A
To
begin
with,
then
it
uses
a
few
other
properties
of
the
blockchain,
and
here
one
that
I
want
to
highlight,
because
it's
very
there's
a
lot
of
sort
of
security
issues,
because
this
are
like
many
potential.
Let's
say
it's
atomicity,
which
means
that
if
a
transaction
starts,
it
will
either
succeed
completely
or
it
will
revert,
but
there
cannot
be
a
half
transactions
that
just
cannot
be
and
and
obviously
D5
relies
on
Smart
contracts,
which
are
programs
that
run
on
the
blockchain
and
using
these
Primitives.
A
There
are
a
few
really
essential
piece
of
software
and
of
other
Primitives
that
are
required
for
defy
first
one
being
oracles
so
because
blockchain
cannot
have
access
to
off-chain
information.
Somebody
needs
to
take
this
option,
information
and
put
it
on
chain
and-
and
these
are
called
oracles
and
are
used,
for
example,
to
to
get
price
of,
say
USD,
because
this
is
not
an
information
you
could
possibly
have.
A
Then
there
is
governance
which
is
used
typically
to
upgrade
D5
protocols
with
time
change,
parameters
and
these
sort
of
things
then
we
have
Keepers,
which
are
off
chain
sort
of
bots
and
that
will
submit
transactions
to
update
States.
This
is
because,
in
most
blockchain
systems
you
need
a
transaction
to
be
able
to
perform
any
sort
of
State
transition
and
therefore
somebody
has
to
take
care
of
this.
And
finally,
there
are
many
Market
mechanisms
that
are
used
in
D5.
A
There
are
collateralization
where
people
will
put
somebody
at
stake
to
make
sure
that
you
can
hit
the
default
on
the
position.
For
example,
then,
there's
arbitragers
there's
also
liquidations
equations,
which
are
used
if
somebody
does
not
have
enough
collateral
for
whatever
position,
so
that
covers
roughly
the
main
primitive
that
we'll
need
in
D5
protocols
and
now
I'll
present
just
a
couple
of
the
five
protocols.
A
So
there
are
many
types
of
protocols,
but
we
don't
really
have
time
to
go
through
all
of
them.
So
we'll
first
start
with
automated
micro
makers,
which
are
decentralized
on
change.
Electronic
changes
because
on
chain
it's
way
too
expensive
to
have
some
order.
Book
based,
dexes,
amms
or
somehow
has
become
extremely
popular
and
they
have
a
lot
of
good
properties.
A
A
few
properties
are
less
good,
but
the
main
idea
is
that
people
will
come
and
provide
liquidity
to
a
pool
that
consists
of
typically
two
or
more
assets
and
by
providing
these
liquidity
they
in
some
way
commit
to
a
portfolio
of
these
underlying
assets
and
a
portfolio
that
will
be
rebalanced
by
arbitragers.
That
will
try
to
keep
the
prices
consistent
with
some
all
other
off-chain,
for
example,
prices
or
prices
on
some
other
exchanges.
A
Once
that
is
done,
people
can
trade
through
this
pool
and
that
generates
fee
for
fees
for
the
pool,
and
typically
this
is
profitable
in
the
case
where
they
are
volatility.
Harvesting,
when
it's
it
was
talked
just
before,
was
a
lot
more
advanced
than
this.
But
basically
it's
if
the
price
is
around
some
line
and
going
up
and
down
it's
typically
profitable,
as
opposed
to.
If
the
price
is
consistently
diverging,
then
maybe
not
so,
and
it
there's
still
some
risk
and
especially
strategy
risk
and
adverse
selection.
A
Risk
involved
with
these
amms
and
another
very
important
type
of
protocol
for
D5
or
protocol
for
low
limit
funds
also
called
lending
protocols
which
are
Unchained
markets
where
people
can
borrow
and
lend
assets.
So
typically,
people
will
come
and
deposit
some
assets
that
are
pulled
in
smart
contracts.
Other
people
can
come
and
borrow
these
assets,
and
to
do
so,
they
will
need
to
be
over
collateralized,
so
they
cannot
default
on
their
position.
A
So
with
all
this,
then
these
protocols
can
communicate
together,
as
I
mentioned
earlier,
and,
for
example,
one
person
could
deposit
some
money
in
an
emm
and
get
some
LP
shares
and
use.
This
MP
shares,
for
example,
in
lending
protocol
as
collateral
to
be
able
to
borrow
some
other
type
of
asset,
and
that's
a
very
interesting
thing,
with
D5
that
all
this
protocol
can
really
very
easily
communicate.
A
So
now
that
I'm
done
with
this
sort
of
intro
background
about
defy
itself
we'll
dive
a
bit
more
into
the
security
and
we'll
really
try
now
to
to
delineate
Technical
and
economical
security
and
first
we'll
start
with
some
informal
definition.
And
so
we
say
here
that
for
protocol
or
smart
contract
to
be
technically
secure,
it
needs
to
be
secure
from
an
attacker
who
is
limited
to
Atomic
actions
and
we're
like
here
being
secure,
has
been
going
to
get
exploited.
A
Or
is
there
a
bundle
of
transactions,
but
the
property
needs
to
be
that
all
these
actions
will
be
executed,
atomically
and
because
of
this,
so
technical,
so
attacks
on
technical
security
are
risk-free
because,
basically
the
attacker
can
just
perform
the
attack
and
at
the
end
of
the
transaction
or
of
this
Atomic
operation,
he
can
see
if
yes
or
no,
he
made
money
and
if
he
did
not
make
any
money.
But
if
he
made
money
he
profits.
If
he
didn't
he'll,
only
pay
the
gas
fees
and
can
revert
the
transactions.
A
So
by
definition,
or
by
kind
of
extending
the
definition,
a
technical
attack
will
always
be
risk-free.
Otherwise
it
it
will
fit
our
other
type
of
attack,
and
so
there
are
some
examples
of
tactical
attacks
are
Atomic
Mev
sandwich
attacks
and,
for
example,
like
reference,
C,
or
also
attacks
that
exploit
logical
bugs
and
that's
all
now
fairly
well
studied.
We
know
more
or
less
how
to
protect
against
these
they're,
of
course,
like
testing,
smart
contracts
very
well
in
program,
analysis
or
formal
methods,
and
these
are
in
general,
the
better
studied
one.
A
So
smart
rank
vulnerabilities.
We
have
re-entrancy
interior
manipulation,
logical
bugs,
all
of
which
are
right
now
quite
well
studied.
There
are
single
transaction
sandwich
attacks,
which
is
where,
if
a
protocol
say,
would
use
the
spot
price
of
an
amm
to
to
use
as
a
price
in
their
protocol,
an
attacker
could
come
and
in
Balance
the
same
so
that
when
the
protocol
would
try
to
look
up
the
price
it
would
get.
The
wrong
price
and
under
attacker
could
fairly
easily
exploit
this
to
make
money
or
governance
attack.
A
B
Basically,
you
have
to
like
set
up
set.
It
set
up
the
attack
and
then
actually
perform
the
attack
later
on,
and
something
could
happen
in
between
that
those
two
those
two
times
and
basically
something
the
attack
could
fail.
If
something
happens
in
in
between
those
those
two
actions
and
such
as
the
market
responding
or
other
agents
responding,
and
to
address
this,
we
really
need
to
have
economic
models
of
what's
happening
in
between
these
transactions,
and
the
attacker
would
need
to
to
understand
this
and
basically
manipulate
what's
happening
in
between
these
transactions.
B
So,
let's
hammer
down
a
little
bit
further,
what
the
difference
is
between
Technical
and
Economic
Security,
so
in
a
technical
exploit,
we
have
an
attacker
who's
effectively.
Finding
a
sequence
of
contract
calls
that
leads
to
a
profit,
and
these
are
either
in
a
single
transaction
or
a
bundle
of
transactions.
But
it's
being
done
all
at
once
or
not
at
all,
and
for
these
formal
models
of
contracts
are
basically
enough.
B
So
to
say,
although
it
can
still
be
quite
a
hard
computer
science
problem
to
work
out
sort
of
optimal
the
optimal
ways
for
attacks
to
be
performed
in
comparison,
an
economic
in
an
economic
exploit.
An
attacker
is
performing
multiple
actions,
kind
of
at
different
times
or
really
different
points
in
the
sequence,
and
they
don't
necessarily
control
what
happens
between
those
actions
and
so
there's
no
guarantee
that
the
final
action
is
profitable.
B
So
what's
hammered
on
even
a
little
bit
further
with
like
a
very
simple
example
of
something
that'll
be
a
technical
exploit
and
then
something
we
can
change
a
little
bit
about
it.
That
turns
it
into
instead,
an
economic
exploit,
so
in
the
example
of
a
technical
exploit,
let's
say
a
protocol
uses
an
instantaneous
amm
price
as
an
Oracle
and
that
then
an
attacker
performs
an
atomic
sandwich
attack
to
steal
assets
from
that
protocol,
because
this
can
be
done
atomically.
This
is
a
technical
exploit,
but
we
could
change
it.
B
We
could
use
a
smarter
choice
of
Oracle
so
that
this
isn't
possible
and
that
leads
to
instead,
it
being
an
economic
exploit.
So
here
consider
that
the
protocol
instead
uses
a
little
bit
smarter
choice
of
of
Oracle,
a
Time
weighted
average
amm
price,
but
these
can
still
be
manipulated
over
time,
but
it
involves
risk
for
the
attacker,
but
they
still
may
be
able
to
steal
assets
and
actually
something
like
that.
B
Just
happened
very
recently
in
in
mango
I
believe
so
we
can
see
this
also
like
in
in
data
about
what's
been
happening
in
different
protocols.
So
one
example
here
to
kind
of
illustrate
this
a
little
further
is
something
that
happened
in
compound
in
November
2020..
Now
this
wasn't
really
clearly
an
exploit,
but
it
kind
of
illustrates
what
could
have
been
an
exploit
and
what
can
be
exploits
in
other
protocols.
B
So,
basically,
the
price
of
dye
was
trading
on
on
coinbase
and
for
a
very
short
period
of
time,
the
price
pumped
to
a
dollar
Thirty
and
because
compound
was
using
coinbase
as
an
oracle.
This
allowed
a
lot
of
liquidations
to
be
possible
on
compound
and
that
cost
a
lot
of
a
lot
of
LP's
money
and
compound
and
opened
up
a
lot
of
opportunity
for
profit
from
liquidating
those
positions.
B
So
how
do
we?
What
are
the
tools
available
to
like
help
to
fix
Economic,
Security
and
and
make
protocols
more
secure,
one
of
the
first
ones?
The
biggest
is
really
over
collateralization,
and
here
it
just
doesn't
come
without
risks,
though,
and
so
it's
very
important
to
include
an
analysis
of
the
the
actual
economics
in
designing
and
calibrating
your
your
protocol.
B
B
Another
important
area
is
in
the
design
of
governance
and
the
risks
that
can
come
up
from
your
governance
layer,
so
the
governance
is
basically
introducing
a
way
to
upgrade
protocols
and
these
need
sort
of
careful,
guardrails
and
careful
design
so
that
your
Governors
aren't
going
to
have
missed
incentives
to
do
things
that
are
actually
bad
for
protocol
users
and
so
commonly
governance
may
not
really
be
incentive
compatible
with
the
actual
users
of
the
protocol.
And
this
this
can
be
an
issue.
B
They
may
not
act
in
the
interest
of
these
protocol
users
and
to
illustrate
a
little
bit
in
some
sense.
Governors
have
some
honest
cash
flows,
but
these
cash
flows
may
not
always
be
very
high.
Sometimes
they
can
crash
and
then,
if
they
do
crash,
the
region
of
incentive
compatibility
might
shrink
and
it
may
be
more
profitable.
B
For
these
Governors
to,
instead
of
doing
sort
of
honest
actions
and
upgrading
the
protocol
in
good
ways
to
instead
decide
to
attack
the
protocol
and
basically
steal
assets
from
the
protocol
or
do
other
things
that
put
protocol
assets
at
risk
and
the
costs
to
do
this
can
sometimes
be
very
low
in
D5
and
should
be
part
of
the
design
of
governance
systems.
So,
for
instance,
tokens
Can,
Be,
borrowed
and
agents
can
be
sort
of
anonymous,
and
this
can
lead
to
low
costs
to
to
actually
do
these
governance
attacks.
B
B
So
here
we
need
to
distinguish
between
one,
a
market
price
that
is
being
manipulated,
but
correctly
supplied
by
an
Oracle
and
two
an
oracle
that
is
itself
being
manipulated.
So
in
Market
manipulation
you
have
an
adversary
who
is
manipulating
the
market
price,
either
on
or
off
chain,
depending
where
that
market
is,
is
occurring
over
some
period
of
time
and
they
can
profit
if,
if
they
can.
C
B
If
the
manipulation
they
can
exploit
it
in
in
a
protocol
that
uses
that
market
as
an
Oracle
and
these
problems
persist,
even
if
the
Oracle
is
not
an
instantaneous
amm,
because
it's
just
there
is
some
liquidity
in
the
market
depending
on
that
liquidity.
There's
some
cost
to
affect
the
market
price
and
you
can
instigate
changes
to
market
price
that
are
then
reported
through
the
Oracle
system.
And
importantly,
though,
this
is
risky
because
you
have
to
do
it
over
time.
B
B
So
centralized
oracles
have
potentially
a
single
point
of
failure
and
you
might
want
to
control
for
that
in
designing
your
protocol
and
on-chain
amm
based
oracles,
as
we've
seen,
can
be
manipulated,
and
so
the
costs
of
manipulating
that,
depending
on
the
liquidity
in
those
markets,
is
something
you
should
be
carefully
considering
and
other
decentralized
Oracle.
Solutions
are
really
imperfect
for
the
issue
that
you
can't
really
verify
the
correctness
of
prices
on
chain,
and
so
it's
quite
an
open
problem.
B
How
to
do
this
very
well
so
that
sort
of
concludes
our
discussion
of
Technical
and
economic
security,
but
it
leads
to
a
host
of
new
research
challenges
that
are
really
going
to
be
important
for
securing
D5
protocols
into
the
future.
So
I'll
give
you
just
like
a
quick.
A
quick
flavor
of
these
one
is
around
composability
risks.
B
B
This
governance,
sort
of
risk
and
modeling
the
incentive
compatibility
of
of
Governors
and
sort
of
modeling
out
what
we
call
governance,
extractable
value
and
trying
to
understand
when
our
Governors
and
your
system
incentivize
to
do
things
that
are
good
for
the
protocol.
And
how
do
you
stop
them
from
doing
bad
things,
and
these
need
economic
models
about
how
these
governance
systems
work
over
time
and
how
the
agents
make
decisions?
B
So
it
should
be
even
harder
than
knapsack,
and
so
it
should
be
an
NP,
hard
problem
and
this
becomes
even
harder
than
if
you're
looking
at
interblock
Mev.
And
this
includes
cross
chain
Mev.
Because
now
you
have
to
look
at
an
inter-temporal
version
of
that
of
that
same
optimization
problem
and
there's
also
a
lot
of
work
to
be
done
in
sort
of
making
Anonymous
D5
protocols
and
preserving
privacy.
So
that
brings
us
to
the
end
of
the
talk.
B
Just
as
a
quick
recap,
we've
covered
how
defy
has
several
Innovations,
but
it
also
has
several
risks
and
to
fulfill
the
verse
the
the
vision
of
the
D5
Optimist.
We
really
need
to
make
sure
that
Defy
is
secure
and
to
do
that.
We've
delineated
two
types
of
security
risk
between
Technical
and
economic
security
and
the
key
distinctions
that
that
allow
this
to
be
useful.
B
A
C
B
We've
set
up
some
of
the
initial
models
that
like
helped
understand,
for
instance,
Economic
Security
and
the
mechanism
design
that
went
into
gyroscope
takes
all
of
that
knowledge
into
consideration
and
tries
to
do
the
best
mechanism
design
that
we
can
considering
how
we
understand
Economic
Security
today.
Thank.