DeFi risks and DeFi hacks

The joint report of the EBA and ESMA on recent developments in crypto-assets finds that lending protocols are the most attacked type of DeFi protocol, while bridges between blockchains lose the most money. The most common causes of attacks on lending protocols are price manipulation, followed by smart contract exploits and, less often, stolen private keys. The report names the attack on the lending protocol Euler Finance in March 2023, with 197 million dollars in losses, and the attack on Curve Finance in July 2023, with 73.5 million dollars stolen.

A price manipulation attack often uses a flash loan, a loan that is borrowed and repaid in the same transaction, to move a thin market and trick an oracle into a wrong price. The usual controls are code audits and oracles that draw on several markets; a firm adds a limit on how much it places in one protocol. The smart contract audit page and the answer on blockchain oracles cover both.

The Bank for International Settlements described the financial side in "DeFi risks and the decentralisation illusion". High leverage in crypto markets makes them procyclical, stablecoins that promise a fixed value can face runs, and DeFi has no lender of last resort to absorb a shock. Protocols are built on top of each other, so a failure in one spreads to the others. The authors also argue that full decentralization is an illusion: governance needs some central control, and voting power concentrates in large token holders.

For a regulated firm this turns into concrete questions: who holds the upgrade keys, how fast can governance change a parameter, and which other protocols and stablecoins does the position depend on? ESMA's report on DeFi in the EU found serious risks to investor protection and new forms of market manipulation, including maximal extractable value, and limited risks to financial stability so far.

Classic insurers cover crypto custodians against theft through crime and specie policies, which the crypto insurance page explains. For losses inside DeFi there are cover protocols. Nexus Mutual calls itself a crypto insurance alternative, has offered cover since 2019 and lists smart contract hacks, custody failures, slashing and stablecoin depegs among the risks it covers. A buyer reads the cover wording and the published claims history before relying on such cover.

Risk & Compliance is one of Finance Loop's four fields, and DeFi risk is where it meets Investment & Digital Assets. Finance Loop's partners DeFiAM Labs and the Multichain Asset Managers Association work on DeFi that regulated firms can use, and Finance Loop brings risk managers, smart contract auditors and DeFi builders together at events in Frankfurt, Munich, Berlin and Hamburg.

Smart contract bugs, oracle and price manipulation, stolen keys, leverage and runs on stablecoins, links between protocols, and governance changes by large token holders. For an EU user there is also no supervisor to complain to when a fully decentralized protocol fails.

An attacker borrows a large amount in a flash loan, uses it to move a price that a protocol reads from a thin market, takes out more value than it should and repays the loan, all in one transaction.

According to the EBA and ESMA, lending protocols are attacked most often, while bridges between blockchains account for the highest losses.

Partly. Cover protocols such as Nexus Mutual sell cover against smart contract hacks, custody failures, slashing and depegs. Custodians buy conventional crime and specie insurance for assets they hold.