Right here is the written transcription of the podcast:
Ish Goel: Hey guys, my identify Ish Goel and I’m the CEO at Somish Blockchain Labs. We’re again for our fourth episode of the All About Good Contracts podcast, and I’ve acquired as we speak once more with me, Nitika who shall be speaking about flash loans on this episode. So guys, flash loans have instantly, I imply, in February they ultimately type of grew to become very well-known for good and for dangerous causes.
We’re going to discuss flash loans on this video, when it comes to what actually flash loans are ? Why are they instantly so related? We’ll speak in regards to the bZx assault. And, ultimately, for those who watch the video until the top, there may be one factor which we’re going to discuss, which could be very attention-grabbing, most likely essentially the most attention-grabbing half is flash loans actually an assault on good contracts?
So, I believe the group is break up into two opinions, whether or not they’re truly assaults or whether or not your good contract ought to truly have the ability to deal with the flash loans. So let’s get began, the primary query Nitika that I need you to reply for us and our viewers is what are flash loans?
Nitika Goel: So, just like the identify suggests flash loans are loans, that are there for a flash of time solely.
Ish Goel: Okay.
Nitika Goel: Typically, we now have loans and want collateral earlier than we truly borrow cash. In flash loans, the idea is, with out collateral, I’m in a position to borrow cash offered I return the cash in the identical transaction.
Ish Goel: So, it’s like an uncollateralized mortgage.
Nitika Goel: So, I can borrow like an enormous sum of cash, I imply, as a result of I don’t need to repay it actually.
Ish Goel: Since you’re repaying in the identical transaction.
Nitika Goel: Sure, so that is majorly used as we speak for like arbitrage alternatives or the totally different sorts of assaults which have simply occurred prior to now, the place folks in a flash make some huge cash,
Ish Goel: …however nonetheless, I imply, how would you clarify this to a layman? So, sometimes if you exit within the conventional world to take a traditional mortgage, the place you’re offering some type of a collateral, the rates of interest are type of decrease. However in an unsecured mortgage they typically are typically increased, on this case how does it work? and if you say that, the mortgage needs to be returned again in a single transaction, what does it precisely imply? How can the mortgage be returned?
Nitika Goel: Yeah, so I’ll borrow some cash. The good contract is prepared to provide me an sum of money, I can do in any way I need with the cash in the identical transaction, I execute a big set of transactions as an a big set of operate calls two totally different venture protocols, no matter it’s,
Ish Goel: Let’s take an instance, how are you going to borrow a flash mortgage? Are you able to give some examples on that?
Nitika Goel: There are protocols as we speak like dYdX, Aave, which permit flash loans out there. They’ve, fairly some liquidity the place you possibly can borrow truly large sum of money and execute these.
Ish Goel: How does it work? So that you go on the platforms?
Nitika Goel: Sure, so it’s all through good contract. You write a wise contract the place you borrow cash from the supposed dYdX contract, you execute some set of transactions, for instance, you see an arbitrage alternative like the value is increased on one protocol and it’s decrease on the opposite. You carry out these transactions. You’ve made some cash out of the arbitrage.
In order that’s what you retain and the remaining is what you come back again to the dYdX Protocol. So it’s all in the identical transaction. In case you’re not in a position to make use of the arbitrage alternative or circumstances have modified, someone has entrance run your transaction, the transaction will fail. So mainly, for those who don’t return the cash in the identical transaction, the transaction won’t undergo in any respect.
Ish Goel: So, is it just like leverage buying and selling? Like if you take a leverage by having a small sum of money, however you’re taking a excessive leverage, let’s say 5 X and then you definitely put a purchase throughout some particular asset. So, is it just like that?
Nitika Goel: So, even leverage would require some collateral, and it’s not topic that you need to return it instantly. Flash loans are a distinct idea since you are borrowing with out a collateral and why is it attainable to take a mortgage with out the collateral, since you are sure to return in the identical transaction. It’s Ethereum which is securing, you understand, the good contracts in Ethereum are securing this that if in any respect, you’re not in a position to return the cash in the identical transaction the transaction will undergo.
So, that’s the way it’s totally different from a daily margin buying and selling or leverage or no matter you’re speaking about.
Ish Goel: However, how have they grow to be so related as we speak? Like all people retains speaking about flash loans. Everyone knows there was an assault again in Feb. Why are they so related as we speak?
Nitika Goel: Truthfully, if we truly see the DeFi world, we are able to now see there’s an exponential development within the quantity of Ether being locked up in several protocols.The variety of protocols have elevated, the quantity which is locked is elevated. So now firstly, you have got liquidity out there the place you possibly can borrow.
Ish Goel: In fact,
Nitika Goel: Then you have got protocols that are enabling you to borrow. All of those didn’t exist someday again. So that you want someone to, you understand, provide the cash to carry out these flash loans, the totally different sorts of tasks that we now have now, they’re making this attainable and the latest assault on bZx, in February. So, it was like an enormous sum of money, greater than $300,000. In order that’s the type of, you understand, alternative that folks can now see with flash loans.
Ish Goel: So let’s speak in regards to the bZx assault now I believe we’re all to know what actually occurred.
Nitika Goel: That is fairly a fancy one, so I’ll simply take a shot at it. So, what occurred was that, there’s a protocol referred to as dYdX, which is a lending protocol and permits flash loans. So the attacker used dYdX to borrow 10,000 Ethers beneath a flash mortgage, so ensuing that, on the finish of the transaction, he needed to return 10,000 Ether again to dYdX.
Nitika Goel: So, he wrote a bit of code, which triggered a transaction on the dYdX protocol and primarily… step one was to borrow 10,000 price of Ether.
Nitika Goel: Now, out of these 10,000, he took 5000 and put that as a collateral on compound, which is one other protocol for lending
Ish Goel: A compound finance. Proper?
Nitika Goel: So, and he borrowed 112 WBTC towards these 5000 Ethers that he simply deposited as collateral.
Ish Goel: The second step, out of the 10,000 Ethers that he took as a flash mortgage, 5000 have been deposited as a collateral on compound finance towards which he took 112 WBTC.
Nitika Goel: So now he has 112 WBTC at his disposal and 5000 Ether left. Now, out of the 5000 which can be left, he took 1300 Ethers and he took a brief place on bZx or Fulcrum mainly, and that’s the place the trick occurred.
Ish Goel: Okay.
Nitika Goel: So, when he took a brief place, he took a 5 X leverage. So this was once more, the Eth-WBTC pair.
Nitika Goel: So he took a brief place on Ether.
Ish Goel: So mainly he mentioned that, the value of WBTC goes to go up. So he took a 5 X leverage with 1300 Ethers which is once more, an enormous quantity.
And he mentioned that Ether worth goes to go down. WBTC will go up and he’s saying Ether goes down, okay.
Nitika Goel: Now, the bZx protocol is a large sum of money, this resulted in truly a transaction the place, the bZX protocol offered 5637 Ethers. 5 thousand 600 and thirty seven Ethers for WBTC.
Ish Goel: The protocol offered it off.
Nitika Goel: Yeah, the protocol routed it through Kyber which once more, internally routed it through Uniswap. So mainly the alternate occurred on Uniswap. This resulted, as a result of there may be much less liquidity and the quantity is excessive, so this led to cost slippages and it resulted within the worth of WBTC capturing as much as 3 times. Now this man had 112 WBTC, so he offered off his 112 WBTC at 3x the value. Now, all of this resulted in earnings for him. He returned the 10,000 that he had borrowed from dYdX, and he closed his flash mortgage, total leading to $350,000 plus earnings.
Ish Goel: For the attacker, this wasn’t precisely a direct revenue on a…
so, primarily your entire quantity ended up being a $350,000 price of Ether. So guys now could be essentially the most attention-grabbing a part of this episode, as I promised at first, we needed to discuss this entire confusion round flash loans. Whether or not they’re truly assaults or ought to good contracts be able to dealing with flash loans?
Nitika Goel: The viewers is split right here. So there are folks such as you mentioned, who don’t suppose that that is an assault as a result of, regardless of the attacker did, ultimately adopted no matter was written within the good contract, the good contract was not inbuilt a solution to deal with such large quantities. In order that was the place the issue truly occurred.
There might have been mitigations and undoubtedly, like in future folks constructing such issues are taking good care of these items from day one, so mainly did it do one thing which was not supposed to do.
Ish Goel: No.Probably not.
Nitika Goel: There are arbitrage alternatives all over the place round within the system and there are protocols which truly rely on these.
So for instance, when the attacker offered his WBTC, the value once more fluctuated, proper? As a result of now he’s promoting such an enormous quantity of BTC into the system. And it was the arbitrage alternative that folks noticed that balanced the value once more. So protocols are additionally depending on such arbitrage alternatives to steadiness the ecosystem.
I believe the necessary factor is that, the protocols, all of those lending or outlined protocols which can be developing, must be made in such a means that they will deal with such assaults. We can’t cease assaults, in actual fact, these will truly convey in additional folks to DeFi as a result of it can appeal to extra folks.
Ish Goel: Sure. So, flash mortgage proof contracts must be the pondering of the builders.I believe from an audit perspective, if you wish to correlate, I believe this is among the large issues that you just additionally spoke to me about offline, good contracts primarily, once we audit, we’re taking a look at how they’re dealing with flash loans.
And as you mentioned, I believe ensuring that the good contracts are flash mortgage proof is what’s required.
Nitika Goel: So the brand new protocols they’re all interrelated. There’s not one protocol which shall be performing its logic individually. We’re depending on different protocols for costs. We’re dependent for trades which can be X, Y, Z factors of interplay between two protocols and the DeFi sphere.So, you understand, issues like these have to be taken care of.
Ish Goel: Cool guys, in order that’s it from our fourth episode of the All About Good Contract Audit Podcast Collection, we had a superb session on flash loans as we speak.
Thanks a lot for watching this video. We’ll be again quickly with our subsequent video as effectively.
If you’re on this house, and if you’re beginning to write good contracts or ending up your DeFi product, now could be the time to prepare to your audit.
So please get in touch with us. We’re more than pleased to speak you thru how audits work and be sure that probably we’re in a position to work collectively.
I’m going to ask Nitika to induce you to subscribe to our channel, so Nitika do the honors, they aren’t listening to me, they’re watching our movies, however not subscribing to our channel. So go forward and make your pitch
Nitika Goel: Guys, please do subscribe to our channel, like and share this video and do go away your feedback within the remark part under.
Ish Goel: Thanks a lot for watching. Bye bye now.
