Decentralized Finance (DeFiDeFi DeFi services use smart contracts, decentralized protocols, and tokens to offer a range of financial services that can sometimes replace those offered by banks, such as lending/borrowing, asset management, insurance, or asset exchange.) is a revolutionary concept, but it is not without risks.
Many protocols, both large and small, audited or not, have seen colossal amounts vanish. Some risks could have been anticipated, but some losses were not foreseeable, even by the most experienced.
The ecosystem is so young, with new concepts, coupled with the allure of enormous amounts and a lack of clarity on regulation… it’s the perfect place for any hacker, whether a lone enthusiast or an organization behind North Korea.
Risks Related to Smart Contracts
Smart contracts are at the core of DeFi. They automate transactions but are also vulnerable. A simple coding error can open the door to attacks, and once a transaction is completed, it is irreversible. Additionally, some actors accuse protocols of intentionally leaving vulnerabilities to disguise fraud as hacking.
The impact of oracles, which feed smart contracts with external information, must also be considered. Oracles can be manipulated or malfunction, compromising the integrity of transactions.
Exploits and Vulnerabilities
DeFi is like a giant Lego set where each piece (protocol) can fit with another. This creates a rich and interconnected ecosystem but also a complex and vulnerable one. Bugs and flaws in smart contracts can be exploited by malicious actors, leading to significant financial losses.
For example, during periods of high volatilityVolatility The degree of variation in an asset's price over time., some hackers exploit vulnerabilities to borrow a tokenToken A digital asset issued on a blockchain, representing various utilities, rights, or value. with a crypto that, on paper, is worth a certain amount but is actually worth much less. This is made possible by the latency of oracles and the manipulation of prices and liquidityLiquidity The ease with which an asset can be bought or sold without affecting its price. (an assetAsset Any digital asset, including cryptocurrencies. might have a nominal price, but if there is little liquidity, the price is easily manipulated).
These exploits are also facilitated by “flash loans,” which allow for large-scale operations.
It is worth noting that these exploits and flash loans, which continually pressure project developers, contribute to strengthening DeFi over time. Proven source codes (such as Uniswap, Curve, Aave) are reused and adapted, provided that the contracts (forks) are well executed and updated…
Bridges are often an ideal target for hackers, as they connect different blockchains and infrastructures, increasing the number of potential vulnerabilities.
Scams and “Rug Pulls”
A “rug pull” is a scam where developers withdraw all the money from a project, leaving investors with worthless tokens. It is essential to conduct due diligence and ensure the legitimacy of the projects in which you invest.
Navigating DeFi Safely
- Thorough Research: Before investing, it is crucial to research projects and tokens thoroughly. Check websites, whitepapers, and developer backgrounds. The older a project is, the more likely it is to be resilient (Lindy effect). As a beginner, I would limit investments to the same protocol, blockchainBlockchain A public and immutable ledger of cryptographic transactions, organized in blocks., or liquidity pool. I would feel more comfortable with decentralized and older blockchains like Ethereum, and with well-established projects like Curve, AAVE, and Uniswap.
- Private Key SecuritySecurity The measures and technologies used to protect blockchain networks and assets from theft, fraud, and attacks.: It is better to use a hardware walletHardware Wallet A physical device used to store cryptocurrencies offline. (cold walletWallet A tool used to store, send, and receive cryptocurrencies.) and be very cautious about the links you click. Pay attention to where you store your recovery keys. I often use links from official Twitter accounts and check the number of followers. I avoid clicking links from Telegram, Discord, and even Google (never use sponsored links).
- Join Communities: Participate in communities like Telegram or Discord to stay informed and ask questions. If you have doubts, seek advice from experienced developers.
It is very difficult to objectively judge the security of a project. Audits by some actors, like Certik, can be superficial (just stating that there are no errors in the code) and do not account for all criteria (decentralization, oracleOracle A service that provides off-chain data to a blockchain, enabling smart contracts to interact with real-world information., interconnection, liquidity, etc.). However, it is still more reassuring if a protocol is audited multiple times and regularly pays bug bounties. (Genuinely paid, unlike Mirror Protocol, which launched a huge bug bounty that was never paid out, despite having two major flaws leading to a $90M loss…)
The age and reputation of a protocol remain the two key elements.
DeFi is an exciting frontier of financial innovation, but it is also fraught with risks and challenges. By staying informed and exercising caution, you can navigate the DeFi ecosystem with increased confidence and enhanced security.
5 of the Biggest Hacks and Losses Ever Recorded in Crypto:
- Ronin Network: Approximately $624 million was stolen due to a validatorValidator A participant in a Proof of Stake network responsible for validating transactions and securing the network.A participant in a Proof of Stake network responsible for validating transactions and securing the network. hackHack A security breach allowing unauthorized access to assets or data.. Decentralization was therefore at fault.
- BNB BridgeBridge A protocol allowing the transfer of assets from one blockchain to another.: $586M – The hacker falsified deposit proofs in contracts to mintMint The creation of new tokens or coins. BNB.
- Wintermute: $160M – Hack of a vanity addressAddress A unique string of characters that identifies an entity or account on a blockchain network, allowing the sending and receiving of cryptocurrencies., admin wallet.
- Wormhole Bridge: $326M – Hack of a bridge smart contractSmart Contract A self-executing contract with the terms directly written into code on a blockchain. between blockchains.
- Poly Network: $611 million – Hack of a multi-chain smart contract.
For more information on hacks, visit: rekt.news
