Flash attacks on decentralized finance (DeFi) platforms will be the new normal, according to Haseeb Qureshi, managing partner at Dragonfly Capital, a cryptocurrency venture fund. In the wake of consecutive attacks on Ethereum-based DeFi platform bZx, industry insiders are rethinking how the decentralized finance movement, which allows users to engage in tokenized margin trading and lending, will wrestle with bad actors who are able to exploit holes in the system.
Qureshi is anticipating an influx of attacks.
“We saw the first glimpses of this in the recent bZx hacks, and I suspect that’s only the the tip of the spear.”
BZx got hit back to back, with the first attack stealing roughly $350,000 in Ethereum (ETH) from the startup’s lending platform Fulcrum.
The first attack, launched on February 14th, involved a flow of maneuvers to net a profit of 1,193 ETH, currently worth $275,344.
A larger copycat attack occurred days later, wiping out 2,388 ETH worth $559,000. Writing in bZx’s Telegram channel, co-founder Kyle Kistner characterized it as an “oracle manipulation attack.”
Writes Qureshi,
“Flash attacks have big security implications. I’ve increasingly come to believe that what flash loans really unlock are flash attacks – capital-intensive attacks funded by flash loans.”
Flash loans are well suited for blockchains because they allow entire transactions to be rolled back. If a lender sends ETH to a borrower but the borrower is not able to repay the debt, the lender can undo the loan through a smart contract that nullifies the original transaction.
Says Emilio Frangella, a developer at fintech startup Aave,
“Seems completely risk free right? Well, not completely. While very small, there is still a certain degree of risk involving smart contracts and the underlying layer (the blockchain itself). Flash Loans leverage a specific condition to work which enforces that the funds are returned at the end of the execution. There is still the remote possibility that a bug is found in the bytecode of the contract, or at a deeper level in the EVM [Ethereum virtual machine], that might allow an attacker to circumvent this condition.”
As the DeFi movement attempts to disrupt traditional finance at scale, the early days are opening the door to anonymous actors who can destabilize the disruptors. Says Qureshi,
“With flash loans, attackers no longer need to have any skin in the game. Flash loans materially change the risks for an attacker.”
By hitting the reset button on incentives, flash loans are a game-changer that come with a new set of challenges. Adds Qureshi,
“I believe flash loans are a big security threat. But flash loans are not going away, and we need to think carefully about the impact they will have for DeFi security going forward.”
Jon Evans, founding director of the GitHub Archive Program, isn’t so sure. Perhaps the DeFi movement is actually a newfangled, overblown and over-hyped model that will never entice the Everyman to disrupt the status quo on the scale it intends.
Evans asks,
“What is the point of ‘borrowing money using money as collateral‘ for the 99.9% of people who aren’t true-believer HODLers loath to even consider simply selling their crypto?”
You can check out Qureshi’s full analysis here.
Featured Image: Shutterstock/Elnur