Martinet Lee | A flashback at flash loans

uh today is going to be a flash talk about flash you know about flash stones and martin luther khan stan recently came back to taiwan so uh very nice to see actual humans um so so since it's gonna be fast uh i'm just not gonna jump right into it so flash flow uh you know like it provides a large amount of liquidity is in a single transaction kind of the whole gist of it and as auditors uh so we we often see or you know like last year there was so many flagship attacks and then how it's being used in these attacks is basically we can classify two uh kind of two categories one is to accelerate the attack you know like to provide more liquid if you make make it more efficient but the other one is more interesting is to actually perform market manipulation and this is in a general sense um so this is i would say it's my opinion i kind of like abstracted away like some some different terms like uh so we'll see an example uh later well in the next slide here a typical scenario here is like an aggregator of some sort takes users in a single asset and deposits into an amm consists of multiple assets right and so and like as a user as a default user we don't really see this as like exchange i'm like depositing into something right how is it market or exchange but actually um we can we can actually abstract it so that uh when we look at this problem what is essentially buying the lp token right the lp token does have some value and you're buying the lp shares with your single assets so it is a market so with that kind of abstraction now i'm going back to the high level thing that actually flash lot of times it's just doing this market manipulation either it's for um you know if someone is using it as oracle which unfortunately uh some some projects still do um but you know like i would say in general it's like market manipulation and the attacker's logic is really simple in plain words so you know you just become the seller that's your first step and then you manipulate the market price of the goods and then force people to buy at this bad price then remove the manipulation then you get the profit right so that's uh that's basically the logic of how you do um you know this sort of attack so here notice that the third step is very important you have to be able to force people to buy this stuff and this is uh this is oftentimes we see in those vulnerable uh protocols then there are sometimes these functions that you know cause the deposit function automatically maybe when user is depositing or you know when when user or when they're trying to decentralize something then people can actually call maybe harvest or something like that like to enable the deposit basically so this step is very important and the other two part uh so let's look at the manipulate market price of the goods if you look at it like when you deposit into ave or compound it's actually the same thing in the market and you deposit a single asset you get another asset back there's an exchange but that market is okay because well supposedly it's okay because the share doesn't change it's like you know um always increasing right but then so this is the other property that uh is i think it's pretty important to look for like does the mark is it possible for the market to shift sideways uh and you know in a single transaction as such so these are two things i would say and you know um if he's borrowing money now we're talking about loans basically you're gonna borrow money become the seller it's just wrapping around that attack logic so flashlight is just enabling this but the real thing is here so when we're talking about how do we uh how do we prevent flash loans we're actually talking about how do we prevent market manipulation like at a higher level we think this is the most or like a super set of the problems that we want to solve and we want to see people to kind of secure their product goals and so well in technical terms now borrow money is flash flow you deposit into poor acquire external health insurance that's basically becoming the seller and then you manipulate the market price of the lp share and single asset sometimes by draining uh one of the single acid in the pool or you know depositing a huge amount of acid into the pore it depends and you force the aggregator to obtain lp shares with the single acid so that's the sum of their functions and then uh the rest is kind of the same remove manipulation withdraw from lp which is realizing profits and return money and interest so that's that's kind of the attacker logic in very technical terms and so um any questions yep so and and our kind of um we actually seen a lot of protocols like trying to do this uh and we kind of unfortunately have to say that there's we don't see a perfect solution to this problem uh and you know the general problem here is that an aggregator of some sorts takes one assets or several assets to convert to output assets where the input asset is not the output asset right so it's the market this is not soviet so i'm gonna list down a couple uh like attempted solutions that was you know working on this flashlight thing so one thing is using price deviation checks in percentages so they're like oh okay you can market like the market can change but just for a bit right percentage is one way absolute numbers is another way and then um using oracle and virtual price is also uh another way you know like oh i'm going to trust oracle to tell me like what the uh actual prices and use that to trade instead of the real market price right now so some of the issues here is like in percentage it's basically telling the people attacking to hack me tenderly just five percent please like if it's if it's more than five percent you're gonna get a reverb but within five percent it's okay so the problem with this is if the um you can see this as five percent is basically uh protecting you from the attacker only by like all those gas costs all those like fees generated by the amm and all that but it's as soon as the pool becomes larger and this five percent becomes profitable then this is actually good like they can still do it and this is uh you know like some events uh we're basically kind of this absolute number is not really a good idea because you know prohibits large depositors when the full size grows not really great uh oracle virtual price um the general we kind of also abstracted the kind of abstract idea or problem that we see here is basically you're not trading at the exact real market price then and so um of course then there's another issue which is like um i've brought up in the earlier session which is the thermal 3d thing you're relying on the liveness and accuracy of the oracle as well uh so you know just something some risk to be reminded of so that's free attempted solutions and then we also have prohibited smart contract interactions uh we also see uh some some protocols do locking on blocks basically you cannot like deposit and withdraw within the same blocks or within uh you know sometimes that right uh then there's also some attempts on withdrawal deposit fee uh and uh oftentimes people would say like ah it's mitigated because it's not really profitable uh but we also see sometimes like deposit fee or withdrawal fee it's uh going down reduced over time you know the longer you put it uh into the protocol the withdrawal fee gets lower um and so kind of the issues of for these the first one is kind of obvious composability uh we would say like there's smartphone there's other smart contracts that are working as wallet there's other smart contract protocols obviously and so composability is one thing um but i would have to say this is sort of okay but then it doesn't really prohibit large funds like it doesn't really prohibit whales from doing anything bad right you're just you're just prohibiting smart contract that's it but then if they can still do market manipulation that's you know it's not helping that that's one the other thing is do some locking on blocks uh basically you can like you don't have to if you go back to to the steps we don't have to do all these in one single transaction if you have large amounts of funds um you know so so of course flash loan maybe that's one way to like really uh defend against it but then the mo the more general or more secure way to think of it is like oh can we prevent market manipulation can we prevent the well from attacking uh we do see at least some attackers definitely become some like sort of whales over last year so uh we would say this is one good thing to think about and um so that's the waiting for withdrawal deposit fee saying reduce over time is you know you can just wait mitigate it as it is not profitable this is oftentimes another uh kind of argument that we see from the developers to the auditors like oh it's it's okay because it's not profitable uh i would i would want to say it's it there's still briefing attack there's room for that it could be possible that you know although this attack alone doesn't seem profitable but maybe but because some political issues it is it actually makes sense for the attacker to maybe burn at a 100k to damage your reputation right and so this is uh something to think about obviously it's better than not having it but uh driven attack is not uh out of the way right we also listed these we haven't seen i would say uh but we also listed like possible solutions which is obviously not great complete centralization uh limits on size and deposit withdrawal that's the usability thing um you know and there's like locking deposit for some time before withdrawal becomes possible like yeah so for this one it's actually the same thing you can just uh deposit it and wait it out right and to to perform the attack uh yeah so that is the flash talk i hope that was like 15 minutes thank you [Music] oh yeah yeah so what's the recommendation then um it really depends i would say for myself and like you know different auditors would have different uh tastes i would say um so far like the breaking well there's two ways one thing is basically don't do don't create the problem itself so let's look at the problem statement which is which is a very cool feature if we can do it right like um aggregators some sort takes use a single asset and help them to get to to trade stuff right so if you're trying to trade stuff that's creating a problem um like a scenario for this so uh we we see like some other like some newer product codes they don't do this anymore they would just say like yeah you deposit your uh i don't know your free pool lp token basically they ask the user to uh deposit the lp token directly but obviously that uh decreases a lot of flexibility that's one um the other thing that would sort of say it might be okay is uh you know like the smart contract uh prohibit the smart contract from interacting and maybe have a white list but um then you're basically saying whoever you're whitelisted they their smart contract you're always going to trust them right uh if they if they change at some point uh then you might be in danger which we actually saw at some events uh and so yeah use uh which one what is both k3 unison b3 yeah they say they're resistant they are opposed to listening to platforms uh i mean i must say i'm not yet i haven't really dug into the units of d3 yet but then i thought uni swap itself is providing sort of a flashlight that's actually something it's sort of unrelated but related in a sense like it's talking about unison the other thing like flashlight where does it happen where wherever there's green swap or use of clones b2 phones there would be flashlights so just you know be aware of that um for oracle i i think they're just providing the infrastructure for it but they have teamwork so there's a yes you want that's it yeah and so tiwa is basically kiwa has a liveness problem right because you have to update it you have to if you run uh so so like the trivial t-walk is basically you know everything out and you have to call that every time once in a while to run the bug to do that and uh that's the trivial way and so you have loudness problem right like if the gas is too high if the network is congested well it can not you know it is possible that it doesn't go through um then like even for or if the server is down right it's like your bot server is down if you're doing via some decentralized quote-unquote decentralized uh network for example like keeper which is actually doing the same thing they have tiwa that complete clone from unison tiwa but when you're calling it they're just like they're changing the incentivization for for bot to call it solution is just to prevent flash along but it's not preventing the marketplace yeah exactly like like you can basically you can only prevent flash loans uh but then you you cannot really prevent market manipulation if they're well like too big uh yeah and we do see it's sort of as a concern because malicious attackers did become women last year thanks very much