Managing Risks in DeFi - Hugh Karp (Nexus Mutual) - TOKEN2049

cool hey everyone good to be here um going to start with a question first um who of you has a djinn score very good very good only a few um yeah well this presentation is not really for you um it's for the people that are a bit more risk management focused a bit more institutional focused so um just going to go through some of the risks and defy how we manage how you can manage them and give you some options and things like that so um tpl is massive about a year ago we're at 10 billion about two years ago we're only at roughly one billion um nexus launched may 2019 uh we had about three million tbl for quite a long time and and now we're up over 500 million so um riding this massive devote wave and obviously as the size grows as more people get involved that becomes more interesting to many more um many more investors many more funds and things like that so um it's it's on a very very strong wave at the moment and um it can't really be ignored um courtesy of d5 llama for the graph so so what are the like primary use cases in defy really trying to boil this down you basically have trading swapping coins for other coins you've got borrowing so if you've got some crypto take out a loan to stablecoin loan or something sell that buy a house whatever or you can farm or you can gear up and even take a leverage long position and i guess more recently with the advent of compound really starting kicking things off yield farming has become a really big thing and that's where you kind of provide liquidity to particular protocols and earn some yield the yields are massive compared to what you can get in your bank account but where do they actually come from um there's three main categories here and and the the first two are actually fundamental um as in there's actually economic um activity behind them um and so you've got the lenders on the other side of um the people who are borrowing and stuff they pay interest um to the lenders um and then you've got the exchange fee so for example if you're providing liquidity on uni swap then you earn some of the exchange fees um and they get distributed against against all the liquidity providers and then we've got the big third category which is really what's driving a lot of this tvl growth and and that's essentially protocol incentives and that's where the protocols essentially pay you to provide liquidity to their platform and they boost up your yield so it's basically paying users to use the platform and in a lot of cases you can actually borrow funds leverage up to your farm and you're actually paying negative interest because of the protocol incentives more than offset the um the lending interest and so that's not sustainable into the long term but um it can and it has shown a really strong powerful incentive to bootstrap a network and that um for early users and early adopters um then that that can really really provide some material um yield and so who knows how long that's really going to last for um it it's it's proven that it can keep going and the new farms will still keep coming around um but it's probably it's not going to last indefinitely um and so we're kind of in this bit of a sweet spot now about um and it's a big opportunity right now to to make the most use of that and the whole idea is that the whole premise is that that can bootstrap us to a point where these are meaningful networks they have wide usage and then the first two categories of phase effectively provide enough incentive for the liquidity to stay so how do you access these yields and what do you do usually you purchase some like stable coins um i mean you can do this with other crypto like eth or btc or whatever um or the native protocol token and you essentially then deposit it into the protocol and um on a regular basis you can claim the yield in the tokens sell it on the market and repeat it up your stable coin position etc so you kind of just go through this cycle um and the key point here is that you are providing liquidity or collateral money whatever to a smart contract and every single um interaction here involves you um putting your money in a smart contract and essentially trusting that that smart contract does what um you think it does and so i guess what we're here to talk about in terms of managing the risks is what if the smart contracts fail so i doubt very many people in in this room including myself can actually read the smart contracts um you're more or less just trusting that they operate as you think they operate um and you're kind of relying on the fact that a lot of other people are using them there's a lot of other money in here and therefore it's probably okay um and so you know largely that's probably going to do you all right but there's a whole bunch of things that can potentially go wrong so we can have coding errors basically the code we all thought it did something but there's an edge case there and all of a sudden it doesn't um and money can be drained from the from the pool there's a potential like outside input error so where you have an oracle so a lot of these lending pools in particular will rely on price feed oracles whether that's by chain link or their own um oracle systems and if that oracle gives you the the wrong value too high or too low then all of a sudden you can extract money from the from the pool or it liquidates people unfairly et cetera so there can be losses there and one that's not actually talked about that much mainly because it hasn't act really happened yet is you could have a severe governance failure where basically a malicious proposal to update the system say in the worst case it would be give all the money in the protocol to address x um then usually you'd expect the tokens to vote that down so they don't get attacked but but if someone manages to get the control of enough of the tokens or something for a split second to vote um and approve that then all of a sudden they could actually steal the whole um funds in the pool maker was potentially open to this type of attack a while ago but if they did i mean they did patch it et cetera but one of the instances was if there was enough mkr on markets that could be borrowed then you could do a flash loan attack where you borrow the mkr for one block vote and then hand it back and and therefore you could actually push through a governance um vote um that went through so that's not that's not possible anymore but the point being that um it is a um for maker the point being that that type of attack can happen um so i'll go just going to go through two examples here um and i think this is important because the two examples i've chosen are on big protocols um that people um naturally believe really battle tested have been through lots of audits um lots of security lots of people looking at them and therefore they should be okay so sushiwa no one actually lost any money here but um the the famous samsung um who has basically been saving everyone in d5 for for several years um he discovered a critical vulnerability in in sushi swaps contracts in the miso contracts and um 350 million was at risk and so no one lost any money um and it was patched and everything but the really interesting thing here is that sushi had undergone formal verification with um satoru and and basically had come back and said yes my contracts are good and and so formal verification is thought of as a very high standard it's basically mathematically proving that the smart contracts can only operate as per a specific specification and what happened here was the specification was actually incomplete and so one of the things that they needed to test they didn't test against and and you know i'm not blame satoru here because you know this is really hard stuff it's um you know it's very hard to get that specification absolutely complete um but the point being that even with the really high quality audit formal verification firm a really high quality development team these issues can still slip through compound so this one's only from a few weeks ago um so compound's been on mainnet for a long time um they upgraded to v2 it's been there for ages it's been operating absolutely fine they had an oracle issue issue at one point um but but they've resolved that but apart from that nothing has been a problem the compound has gone to decentralized governance and that means that anyone can put up a proposal and to update the smart contracts and if it's approved by the circuit holders then it upgrades and what's happened here is that there was an upgrade put through it had been audited and been looked at by a whole bunch of really um high quality auditors and people from the community and and so it was approved but it turned out there was a bug and um basically the bug has meant that a whole bunch of the comp um so the compound token um incentives that get applied to the lenders and borrowers in the in the um in the protocol as incentives they basically could be unfairly claimed by some people and unable to be claimed by some others so it basically didn't work it was like it wasn't fair like these people are supposed to get this this amount of money and only a few people could take the whole lot basically so um unintentional existing protocol massive amount loss i think it's i think it's basically up to about 140 million um now of comp that's at risk i'm not quite sure how much of that has actually been taken but but the point being that um compound is really highly thought of in terms of security and process and and risk and because with if you've got the potential to upgrade these smart contracts it can still lead to bugs so if you're looking to allocate funds into d5 um this is just a general very simple way of thinking about risk that applies to any industry but i think it's very important to apply it to d5 as well and so what you what you first need to do is understand the risk what's the likelihood and you break it up into two components what's the likelihood of some events happening and what's the consequence if that event does happen and so if you've got a low likelihood event it's very un unlikely to happen uncertain happen low probability event but the consequences are really high that's when you should start looking at insurance because you essentially can't handle that yourself um for all the other situations you really shouldn't be looking at insurance you should be look either if it's a low consequence low probability just ignore it you should accept that as day-to-day um if it happens quite frequently but the consequence is low then you should be actually managing it taking some other action um to do it and if it's a high likelihood high consequence then just get out of there so that's a really simple framework but um but smart contract risk tends to fall in the low likelihood and potential high consequence and so that's kind of where insurance solutions um come in so that's what we've developed um nexus's products for primarily um we've got a few products here i'll just run through um the first the first two um protocol carver is kind of the first product we've we've launched with basically it prevents uh it protects liquidity so when you provide liquidity to a protocol if there's um a hack uh governance failure an oracle failure that leads to loss and you lost money then um then you can um claim and i think that there's a there's an exclusion there that's probably good to be aware of and that's effectively rug pools aren't covered um so if there is a core team or someone that has full control of the protocol and can extract all the money um and that's built into the smart contracts and they do that um then that's not covered um mainly because it's just a massively high moral hazard um uni swap compound all those others don't that's not applicable because you can't actually do that so yeah i think that that one's an important one because the more admin key risk there is the less d5 we are anyway so we should be getting rid of those admin keys in the first place um yeah so d5 is money lego um this is my quick side of if there's a few things put together you probably should worry a bit but as soon as you start stacking stuff on top of other things then um protocol on protocol and protocol that's when it can get really risky and that's that's essentially what um our second product is um i'm calling this yield token cover and it's rather than covering a specific protocol like uni swap or sushi swap compound etc this is covering a specific token um so for example urine bolts curve pulls idle volts etc if you have a specific urine vault like it's the usdc volt as an example they have like eight strategies underneath that vault and so they can they can push the money into a whole different bunch of protocols they earn yield they do the farming automatically and they push the yield back up to the user and it's very easy to use passive yield strategy and you don't really have to do anything but you never really know where your money goes because there's eight strategies and they rebalance all the time based on where the highest yield is and and so rather than having to work out all i need to cover on year and a compound curve all the rest of it um we basically have one product to just cover the entire stack um so it's full stack d5 coverage for a specific token and the idea here is that if there's a hack or an event which causes the token um that the basically the lp token liquidity provider token of the vault if that um d-pegs for whatever reason say money's taken from the vault then the value of that token would d-peg then you can always swap that token back for a stable coin or for dial for all for each and so this kind of allows you to cover the full stack of risk including a tether dpeg or something like that that could happen um and in in one go and so it's it's a newer product but it's a really kind of comprehensive d5 coverage um conceptually what we're trying to do at nexus is we're trying to provide the equivalent of the bank plus fdic insurance and we're trying to do that in the crypto native sense so when you can combine cover from from nexus with the aves the yarns the compounds curves of the world then um that's the car that corresponds to the crypto version of bank plus fdic insurance and so what we're really trying to do here is rebuild their financial stack in a decentralized way where people have full custody of of their own funds and if we're really going to achieve this mission then um people and the general population are going to want protections and and so that's that's the type of product that we're aiming to build with nexus and we believe that um the crypto neo banks the new wave of neo banks that are going to come up are going to start using the rvs the compounds the urns of the world for their interest bearing accounts and they're going to start using the nexuses of the world um for the insurance of the fdic components so what we're really trying to do is rebuild rebuild that financial stack um the big benefit right now is that the yields are just massively different to what you can get in your bank account and there's a big opportunity there the risks are obviously higher i personally think that the risk reward is still massively in favor of allocating to crypto um but um but you do need to be aware of what's going on and understand what's going on so yeah community-based coverage for crypto risk is what nexus is about um definitely starting with crypto risks and looking to cover um all manner of things within within crypto so if there are risks that you guys want to get covered um then we're definitely happy to look at it we're releasing new products quite regularly so um yeah come and chat love to talk to you what an awesome presentation um i've often been a big fan of nexus mutual i think what you're doing for the industry as a whole is amazing i think as you start to see it develop even more so with just on your last slide there how relevant it's going to be and you don't need insurance until that one day that you do and i think what you guys have been providing especially coming out of london it's a you know real honor to see you guys presenting for you personally um how do you think this space has has evolved and how do you deal with uh inbound inquiries and have those inquiries changed over the last 12 months from your your initial inquiries to now and how much kind of corporates are you dealing with as opposed to maybe your your you know your your core individuals that you would have previously had you yeah there's definitely been a shift um with the the we definitely started off like really crypto native with a um i guess a relatively small group of um people that were deep into crypto using us and like i'm trying it out and everything um and i guess over the past year or 18 months the institutions have started coming it's much more i guess business focused um there are definitely a whole bunch of d5 funds being set up starting to allocate and earning yield material yields into indeed and they're managing other people's money and they often will come to us because if you're managing other people's money you're more risk aware um and and they they want to kind of have that conversation about um how they can protect it they don't want to have to go to their lps and go we lost money because curve got hacked but you know who knows um that's that's something they really don't want to do so um so they're coming and talking to us so i think there's there's definitely a shift from um more retailer intended to institutional oriented um but also i think that um the way we are going to access retail um is going to be a bit different in the future it's going to be about bundled and combined products rather than go on depositing compound and then come and buy some coverage on nexus that's too high friction for most people um and so basically when you get layer twos cheaper gas costs um all that type of stuff bundled products um it all comes together a lot more nicely from a ux perspective and that's when we're gonna get back to the more retail user base and how are the hackers developing have you start to see a change in how you're starting to see hackers approach this i mean how how sophisticated have they got and how have the attacks changed over the last few years yeah i think i think one thing that's really promising from my perspective is that the hackers it's more the response from the protocol developers to the hacks that have happened um basically very very quickly um the eighth security network um really kicks into action there's a lot of help behind the scenes when a hack happens everyone's in there helping each other out it's a real community spirit which is actually really great to see um and they get in there they work out what the solutions are they help resolve that particular situation and then everyone knows and it's spread very quickly throughout tooling throughout everything else so that developers in the future are much less likely to make that mistake um and so um it's it's very it's very i think there's a very quick um cycle about making the protocols harder and hardening them i mean it's not just like we're never actually going to be able to say it's 100 safe but but every time this happens the whole system hardens and it becomes stronger maybe i'll pass it over to the floor if anybody has questions for the nexus mutual or the insurance sector as a whole anybody interested in it well i think that you guys have done a really really great job and uh thanks very much for coming down and running through that presentation if people want to find out more about you or nexus mutual what's the best way to go about that yeah jump on the website nexus mutual io and then you can jump jump into my discord or telegram chats and just ping me i'm pretty active in there so yeah more than happy to speak to you all days and nights i see you in there so i don't know when you sleep but thank you very much big round of applause for nexus mutual great job [Applause] you