Marc Vlad - DeFiScan.info: Transparency on Decentralization in DeFi

Hi guys, this is the last talk. Uh it's very nice for me to introduce uh Mara uh he's a decentralization researcher and he as to the fight collective the fight scan illness ocean protocol privacy guardians and so it's very uh a pleasure for me uh to leave the is uh so

thank you so much. Thank you so much. Hello everyone. Um well for the introduction I'm here to tell you more about Defi, how decentralized it really is. So yeah, T5 scan is a MIT license uh dashboard and framework that enables everybody to understand better how much decentralization there is in their pockets.

So for me and I hope for a lot of you TI's for value are about transparency resilience from states and bad actors community which is open and non-exclusive accessible low KYC no need for address open 24 hours trustlessness why trust anyone in the era of cryptography and this is my take maybe some don't agree and we can debate But there is a sense of public utility to defy. The problem is we don't really have this uh in my opinion in my experience we see a lot of um opuscation in defy in the sense that a lot of dev are making very complex choices in the way we need to allocate capital or the way we design protocols and they can gain um information asymmetry and and rug us in some way. So we don't want people to to to have other protocols uh where you can just be abused because they're open. We also have a lot of ephemeral apps we like to call in the in the collective uh which uh regards um applications that are not really durable over time and uh that could be breakable pretty fast. The vitri driven thesis is um the fact that we don't have really a strong forum and a community that tells us what is really good defy on it's mostly like hey this one is backed by a6c paradigm and and this big money smart money people rather than having an academic or a peerreview community to to do it is still pretty gated.

I don't know if you use DeFi but uh you don't want to be Venezuelan or a US citizen. Uh and there is a lot of trusted setups. Um we still have a lot of application that relies on multi6 are um or ways to to to to change the the state of a program with multiple uh signature multiple wallets. And so yeah, we still rely a lot on on logistics and it's still very much profit focused. We could argue about what's the main profit aspect of crypto and defy.

I like to say stable coins and um I don't know if you know but stable coins are pretty crazy. Let me speak about it a bit. uh 80% of of the stable coins are uh representing most of the the market in DeFi. All the volumes they bring in into the space is huge and all almost all the stable co 99.8% of them as of 2024 were fully centralized like USDT and USDC uh if you know about it.

We also have currently a lot of regulation happening in DeFi and the the crypto asset market and we are promoting through the US gen these kind of stable coins which are reserved back and at the end of the day when we use uh this ever president stable coins in crypto we're actually funding the US federal reserve with perpetual loans. So yeah, we still believe there is a lot of work to do here and the most important thing for us is the transparency aspect of it. So these are the question we try to answer uh at scan. So yeah, who is this protocol? Uh what permissions affect me?

Any failure dependencies and how mature is the tech I'm using? Are the people aware about this? Uh did they disclose about it? So yeah, we we this is the main goal of defy scan, right? Skilling devs with state of the art contracts and what we should do.

U it's also about community uh consensus and promoting uh best state-of-the-art products. So yeah, this is defi first of all a framework where everybody can participate. um are actually work working in a paper in the next few months about a more granular approach of uh of how we can assess decentralization. It's also tools and resources. So all our reports are accessible and we also have a permission scanners on our GitHub that you can use.

I also recommend the L2B permission scanners where you can put any small contracts presence out to a JS5 and you can study how which permission are actually having centralized endpoints and it's also a public dashboard that you can find at T5 and I send to you uh on a basis if you go to me. So today the the slides were were downloaded. So it's not updated. We have 17 reviewed and we we reached over 60%. We just review pendant protocol if people are aware of it and we're a team of around seven between the BT the treasury allocations and the research.

So yeah what's the framework about? Let's let's get into it. So um segmentation risk in defi is first the chain like everybody on defy. Oh, take my Solana application and the day after Solana is down and you don't have access to your phone. Maybe you still have a state of the lever and your your IOU kind of stuff there, but you cannot use it.

So no Solana for centralization centralization upgradability. This is the one we we we overlook the most. There are so many protocols that could be so way so much different than they are today in the next block because some Some person with the LT6 with the the key permissions can upgrade the logics of the smart contracts. The autonomy obviously pretty obvious like how on what do you rely you rely on centralized stable coin you rely on oracles exit window related to upgradability. So if you do an update please give me 30 days a week two weeks to to to decide if I want to stay or I want to leave and accessibility.

Um I don't see a lot of front end people in this conference but there is a lot of money to be made do more front ends for D5. It's a it's a great risk for for them to have only one. So we hear we have a nice pizza short by L2 and uh the way we score uh the the protocols. So first of all to be even considered as a project trying to do DeFi you need to be blockchain based uh financial technology. You need your asset not to be into study uh by any centralized entity.

You need the public documentation uh that outlines the protocol contracts and expected performance. You need open source code and of course verified contracts. This is verified contracts. When you you upload the deploy contract, you need to verify it. You can do it in many ways, but you should be verifying it um on on the block explorer to show everyone that if you're using this contract, this is indeed the code operating behind.

There's still problems here. Unis swap notably don't have verified contracts. Shame. Um yeah, so stage one pretty good decentralization level on device. Stage one, congratulation.

So yeah, you score at your speed on everything and um you have a security council that reach good standards. This is not defined by us but has been a network of of wider community notably to beat the foundation and other academics that I forgot the name sorry and so any good multic considered decentralizes at least seven signers with a 51% threshold obviously and at least 50% of the signers that are not insider to the team there also publicly announced there's a lot of debate about this this standard and I I would agree to to move a bit uh the flexibility out of this security concept. But uh we need consensus, right? Stage two means the only failing point of your protocols are the logics of your smart contracts. So if you are stage two protocol, you probably are immutable or very strong security console and yeah, we we we don't trust much or at all.

So let's get into into it a bit in practice. liquidity which is our star at defi scan and collective is a CDP protocol that enables you to meet stable coin with liquid staking tokens and uh if it has immutable code so it's non upgradeable there is no exit window um and there is at least five front ends uh in term of oracle sometimes they use oracles um they use two so there is a chain link as a primary oracle and teller as a secondary Oracle and if both fails they keep the price of the last time chain it worked to say they really thought about these dependencies on oracle that is way too much overlooked in in in D5. Um yeah, if you have more question on liquidity, I can keep more but uh yeah more or less liquidity is highly decentralized and probably the best thing put me on this one. Um the latest review so we miss spend that was released 16 but uh but yeah I I'm not sure I have a lot of time to keep on speaking. I do.

Uh so I I could quick review of all these protocols if you're interested. Are you interested for me to tell you more about each dependencies and it's of course available on the on the on the website. Okay, let's so yeah collective is also offering kind of reviews bounties. So if you want to if you know smart contracts I see father uh and uh and want to to to understand better protocol well you could come and disseate it for us with us for everybody with us sorry um through this process. So you you come on the defy scan you for the repo uh you put some contract address there and you assess how centralized the permissions are.

We peer review it in two, three weeks. You get a bounty, you get money, we're all happy and the state is more the the space is more transparent. Here are other uh protocols that I really enjoy and recommend decentralized researcher to know about. Uh blue is about stable coin. Defy safety is mostly about logic problem.

device best and to beat for layer 2 centralization risk and on capture which is very new um unfortunately not completely open source I still don't really know their their licensing models but they work on assessing how decentralized DAO is and so distribution multi parameterization supering work and and much needed work from our friends at please join the discord if you're interested to to to to scan with us simplify to make the space more transparent and uh ask me anything right now. We have time for question. If you have any questions you have to take them. Thank you. Any questions, sir?

super hard to do like uh you pick you codes fast the codes from project and see it's deployed on somewhere else right I don't know a front end that does this easily just spark contract and it just checks where else it's deployed like fork checker let's say and you could check for bad like code that window got exploited and you you just made a big repository of all this but um at the end of the day yeah you need to do your own research too right like I don't know what you're referring here uh but there have been a lot of works in the past right even though I think under their BS license right now are doing crazy things with the trucks. We'll see what they do there. But um yeah, so many forks of a deployed on the chains and you could find the total on the chains, right? But there is some differences and so how do you spot them without going through the code seeing the differences? Uh is a it could be a great to be a great as with an engineering approach.

Yes. Now I would say you can a lot of time doing it socially like if you go on a T5 project first TVM it's funny

if so who is the team because it's innovative we probably know

yeah for only sake I would be using at least three more tools. Uh so yeah, it's complicated for sure. But socially speaking, when we finish this point like um someone is deploying a new fancy D5 project, who are they? Are they if they're out of the blue, I don't think a lot of CN will grow that fast. You know, you need people tweet partnerships.

Which text are you using to deploy first or are you text your text? Are you for that was you know like being in the space for for not so long especially in defi engineering it's pretty new to me like all the innovation it's so fast but there aren't so many people and uh yeah defm amazing developers would be less than a thousand and so you will quickly find you know social circles even if they're addons or not right uh that are communicating interacting to picture each other. So that would be one of the first thing I look for a new protocol and see if it's worth of my time to form for their job. I don't know what's your strategy here. But yeah, um if you don't know the the new the owners, the developers behind the new protocols, take your time.

Take your time. Well, this I think we have a lot of um literature to be based on to say that you're doing bad work or not and even though it's not on the spotlight um thinking about the token recently which is not I don't like you but uh but yeah if your token on this is bad you're going to get so cheats on your Discord in your community. I mean with your community if your token allocation is bad and again you have very easily way to find all the social circles here and if it's bad it's probably market made by a big exchange sponsoring this or you know you just you just see that they're going to rug you in in three days because there's like three orders. Use bubble maps, use aram, um use a test scan and of course if you have concern also start discussion ask go under discord put your question where can I find this where is your job I told you stage zero there are so many projects I don't have the documentation and deploy like what are you doing but yeah I hope I answer your question any anyone else before we go for some bits Sir, you good? Thank you so much for being sir.

Thank you very much.

There's a third. There's a third I believe this When?