Flash Loans Expose Growing Gap in DeFi Insurance

Flash loans themselves are not the problem — vulnerable code is

article-image

whitehoune/Shutterstock.com modified by Blockworks

share

Flash loan attacks are not common — but their consequences are dire.

Most recently, decentralized finance (DeFi) lending and borrowing protocol Euler Finance booked a $197 million loss in a flash loan attack.

The attacker exploited a vulnerable code, Euler Labs, the team behind the Euler Finance protocol, said in a tweet, tricking it into believing there were fewer collateral tokens than debt tokens.

“As a result, the attacker was able to liquidate these underwater accounts and profit from the liquidation bonuses,” the company tweeted

Hugh Karp, the founder of Nexus Mutual, a smart contract insurance company, told Blockworks that flash loans themselves —  where traders are able to borrow cryptocurrencies without any collateral and return assets within the same transaction — are not the problem.

“Flashloans sound sexy, but all flash loans do is allow a hacker to conduct the attack without having spare funds lying around,” Karp said. “The attack would have been exploitable without the use of flash loans.”

Blockworks Research analyst Ren Yu Kong said that, ultimately, a fundamental vulnerability exists within the smart contract for a flash loan attack to happen. 

“Flash loan attacks are as preventable as any other attack vector, and at the day it still requires developers to go through various security audits and take into account flash loans as an attack vector when writing the code,” Kong said.

The real problem, though, according to Karp, is whether humans are capable of creating secure software free of defects. 

“While that’s possible, it is quite difficult as even the most security-focused teams, such as NASA and teams within the aviation industry, struggle with this,” Karp said.

Even if DeFi security continues to improve, the possibility of failure is rather inevitable — at some point. 

“DeFi cover providers have to be very careful with their risk selection and in their risk management practices, like setting exposure limits and adequately pricing risk. There are no shortcuts,” Karp said.

Jesse Pollack, Coinbase’s protocol lead, said in a tweet that in order to prevent further attacks, “better insurance primitives and coverage need to be a part of the solution.”

Existing DeFi insurance is underpriced, according to Kong — considering it’s often marketed as yield, though the costs associated with an insurance premium could potentially outweigh the downside protection it provides.

“That’s a combination of exploits in DeFi generally being all or nothing — if a protocol gets exploited, more often than not everything is gone — and a much higher percentage chance of an exploit occurring than insurance underwriters price,” Kong said. 

Another solution, a Twitter user who goes by Duncan said, is bringing in more audits to cover soft exploits, adding that there are a “ton of different examples right now” along those lines.


Don’t miss the next big story – join our free daily newsletter.

Tags

Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

Mon - Wed, March 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience: Attend expert-led panel discussions and fireside chats Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts.

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Research report - cover graphics (1).jpg

Research

In this report, we dive into crypto private market data to gather insights on where the future of the industry is headed. Despite a notable downturn in private raises, capital continues to infuse promising projects that aim to transform payments, banking, consumer experiences, community, and more, with 2023 being the fourth-largest year for crypto venture capital.

article-image

BUZZ holds shares of Coinbase, Robinhood and MicroStrategy

article-image

Opinion: Even though I didn’t pay for my “Diamond Hands” burger with BTC, don’t let that fool you into thinking that crypto’s development is futile

article-image

The results mark “a major positive inflection point,” one analyst says, as the exchange carries net income momentum into a crypto rally

article-image

While the slate of 10 US spot bitcoin funds have tallied $4.6 billion of net inflows thus far, half of the field is lagging the leaders

article-image

Trading volumes totalled $154 billion in Q4, including $125 billion in institutional volume

article-image

DeFi on Bitcoin is all the rage right now and Stacks is positioned to benefit