News for hackers. Stuff that matters.
Re:DeFi bug accidentally gives $90M to users by drfxyjhdyfrhgc on Friday October 01, 2021 @08:26AM (#28717557)
>So code isn't the law?

Code is law. This law was just written incorrectly. This is a known risk; it's the reason why defi interest rates are similar to junk bonds.

Re:DeFi bug accidentally gives $90M to users by automatic6131 on Friday October 01, 2021 @08:50AM (#28717790)
Yes, let's turn the [financial|legal](delete as appropriate) system into an obfuscated C competition. Last place prize is: [lose your life savings|spend life in prison].
Re:DeFi bug accidentally gives $90M to users by beambot on Friday October 01, 2021 @01:38PM (#28721362)
Curious. I would claim that our current finance and legal system frequently does the very same for the impoverished or disenfranchised...

Underbanked get hammered by fees with no safety net for emergency expenses. And large portions of our population get saddled with poor legal representation resulting in de facto indentured survitude in for-profit prisons.

Re:DeFi bug accidentally gives $90M to users by pavel_lishin on Friday October 01, 2021 @02:48PM (#28722094)
That's a fair criticism of the current system, but not a good justification for introducing another shitty, broken system as an alternative.
Re:DeFi bug accidentally gives $90M to users by sneak on Friday October 01, 2021 @03:05PM (#28722244)
You don’t need a justification for giving people more choices that they’re free to ignore if they don’t like the terms or circumstances.

More options are better. Nothing about DeFi or cryptocurrencies invalidates or prevents people from continuing to bank as usual. The whole alternative system is opt-in.

Re:DeFi bug accidentally gives $90M to users by fennecfoxen on Friday October 01, 2021 @08:53AM (#28717816)
I don’t understand why anyone, even an enthusiast, would dare to touch cryptocurrency lending with a forty-nine-and-a-half-foot pole. There’s no technical measure that can force me to pay back the coins I borrowed if I don’t have them. If you wanted to enforce being paid back in the real world legal system you’d be much better served with normal lending systems, know your customers, and report them to credit authorities. And if it’s not one of those “stablecoins” you’re borrowing something that could conceivably be worth 10x more in a year; that sounds like financial suicide. What do you possibly gain from engaging with all this?

Maybe if I built a defi lending platform myself so I could take a lot of loans from my customers and then default. That’d work just fine. Otherwise, run for the hills.

Re:DeFi bug accidentally gives $90M to users by Workaccount2 on Friday October 01, 2021 @09:01AM (#28717880)
Crypto evangelists have done so much to obfuscate the fundamental problem of the real world/digital world divide that I think many of them have lost sight of the problem themselves.

Until we find the API for reality, many of these decentralized projects are hopeless.

Re:DeFi bug accidentally gives $90M to users by doliveira on Friday October 01, 2021 @09:06AM (#28717929)
> Until we find the API for reality, many of these decentralized projects are hopeless.

That was nicely put. I see so many of these projects promising to end with banking, bureaucracy, but forgetting that at some level the bits and bytes have to be input or acted on by a human.

Re:DeFi bug accidentally gives $90M to users by belltaco on Friday October 01, 2021 @09:13AM (#28718003)
In some ways it's like the early days of banks, where flaws like this were found and fixed. However a lot of those fixes were put in place by governments and regulation with the threats of prison time and fines for both banks and their customers.

Another question is if things like this will poison the well and scare people away permanently.

Re:DeFi bug accidentally gives $90M to users by bduerst on Friday October 01, 2021 @11:08AM (#28719451)
It's almost like an authority is needed to enforce contracts. This decentralization for the sake of being decentralized doesn't solve the problem fully.
Re:DeFi bug accidentally gives $90M to users by cguess on Friday October 01, 2021 @11:12AM (#28719502)
The difference is that the "early days of banking" were the 1200's CE (and arguably way before then). And even then, it took 800 years to really nail it down and finally get away from fiat currency. For some reasons none of this applies to crypto because reasons that definitely aren't a pump-and-dump.
Re:DeFi bug accidentally gives $90M to users by yokem55 on Friday October 01, 2021 @09:00AM (#28717873)
Because the only way to get a loan is to put up collateral that is locked into a contract. And that collateral can only be extracted if you pay back the loan. So, if you value the collateral less then your debt, then, sure, walk away. But if the value of that collateral falls to less then the liquidation threshold (an amount some percentage greater then the value of your debt), your debt will be paid back by a liquidation bot and the the liquidator will take your collateral for themselves.
Re:DeFi bug accidentally gives $90M to users by lottin on Friday October 01, 2021 @10:52AM (#28719187)
Yeah, but the whole purpose of a loan is to fund something, and to be able to fund something the amount loaned out needs to be larger than the collateral. Otherwise, there's no financing going on. It's simply a bet on the relative value of the principal vs the collateral. Calling this "a loan" is misleading.
Re:DeFi bug accidentally gives $90M to users by TameAntelope on Friday October 01, 2021 @12:27PM (#28720470)
What happens is someone takes a loan out with their BTC as collateral, the BTC grows, they earn more than the interest on the loan with the money they've borrowed, and make a lot of money chaining these together over and over again.

Vastly oversimplified (and possibly wrong), but if you want to know more, do some searching for "yield farming".

The point is that they want to keep their BTC because they think it's going to go up, so they take out a loan with their BTC as collateral rather than directly spend their BTC.

Re:DeFi bug accidentally gives $90M to users by lottin on Saturday October 02, 2021 @03:35AM (#28726768)
If you take a loan in BTC and post the same amount of BTC as collateral, the payoff from such a "loan" is the return on BTC during the holding period minus the rate of interest charged times the principal (or collateral, since it's the same amount). In finance, this called a "swap", and in a swap the principal is not actually exchanged because it's inconsequential, it's only used to calculate the amounts due. In short, what you describe is not loan, but a swap, which is a different kind of financial product.
Re:DeFi bug accidentally gives $90M to users by TameAntelope on Saturday October 02, 2021 @07:28PM (#28733103)
If you know all that, I think you'll probably understand how yield farming works better than I!
Re:DeFi bug accidentally gives $90M to users by pdonis on Friday October 01, 2021 @12:19PM (#28720383)
> the whole purpose of a loan is to fund something, and to be able to fund something the amount loaned out needs to be larger than the collateral

Um, what?

If I take out a mortgage to buy a house, the loan amount is not going to be larger than the value of the collateral (the house).

If I take out a loan to buy a car, the loan amount is not going to be larger than the value of the collateral (the car).

What kind of loan are you thinking of?

Re:DeFi bug accidentally gives $90M to users by lottin on Friday October 01, 2021 @03:26PM (#28722447)
A car or a house being used as collateral are kept by the borrower at their disposal. This means the borrower can benefit from the collateral asset, e.g. by using it or living in it, while the debt still hasn't been paid off. In these cases a fully colletarelised loan can make sense. But this is not the kind of collateral that we're talking about here. We're talking about collateral that is held by the lender in a margin account, or "locked" (in defi parlance), until the debt is paid off, which is the only kind of collateral that can be used in "decentralised finance", because the other type requires a contract (not a smart contract, an actual, legal contract) and the ability to litigate.
Re:DeFi bug accidentally gives $90M to users by throwawaygh on Friday October 01, 2021 @01:07PM (#28720987)
> If I take out a loan to buy a car, the loan amount is not going to be larger than the value of the collateral (the car).

Pray tell of these new cars whose value does not plummet the moment they are driven off the lot.

Re:DeFi bug accidentally gives $90M to users by pdonis on Friday October 01, 2021 @01:21PM (#28721162)
Which is why car loan providers usually require a substantial down payment so the loan is not underwater. (And why home mortgage providers usually require a LTV well under 100 percent--and make you pay mortgage insurance even then unless the LTV is even lower.)
Re:DeFi bug accidentally gives $90M to users by throwawaygh on Sunday October 03, 2021 @06:27PM (#28741052)
What the hell are you taking about? I have never made a down payment for a car and have never paid interest on a car loan. Ever. And I’ve purchased many cars.

E: woah! .06 seconds to the first downvote to a Dow thread comment on a two day old post! I’m out.

Re:DeFi bug accidentally gives $90M to users by plorkyeran on Friday October 01, 2021 @02:25PM (#28721871)
Currently several year-old cars are selling for nearly as much as brand-new cars. Even before the current car shortage, repossessed zero-money-down cars were commonly resold at basically the same price as the first sale.
Re:DeFi bug accidentally gives $90M to users by throwawaygh on Sunday October 03, 2021 @06:38PM (#28741142)
Currently. Which is mostly notable because it is not normal.
Re:DeFi bug accidentally gives $90M to users by UncleMeat on Friday October 01, 2021 @09:20AM (#28718076)
There is a huge problem with the collateral model: liquidity.

If you put up $X in FOO_COIN as collateral and FOO_COIN starts tanking in value, the contract is supposed to auto-liquidate once it hits a certain point. But there is absolutely no guarantee that this can find a buyer. So the "guaranteed" collateral recovery is not exactly guaranteed.

Re:DeFi bug accidentally gives $90M to users by yokem55 on Friday October 01, 2021 @09:56AM (#28718473)
That's why you can only borrow up to 80-ish% of your collateral, and that's getting very risky for the borrower. It also means that the sane lending protocols are somewhat stingy with what they take as collateral and then set the borrowing limits and liquidation thresholds fairly conservatively.

When the market starts making big moves downward the liquidation bots have a keen eye on which positions are at risk, watching and predicting the oracle updates, and within a block or 2 (~30 seconds) of a position being vulnerable have the deal all closed out. It can even be all done in a single transaction bundle that calls the liquidation function, pays back the debt, takes the collateral, and sells it on a dex, all in one go.

The market price for the collateral would have to drop more then 20% in the span of that 30-seconds for it to not be profitable for the liquidator.

That's not to say it's impossible for this to fail, the biggest and sharpest dumps happen during liquidation cascades. But a failure is in the category of 'black swan event', and not something that is seen with regularity.

Re:DeFi bug accidentally gives $90M to users by plorkyeran on Friday October 01, 2021 @02:27PM (#28721888)
A "black swan event" is something which was obviously possible in retrospect, but no one could have predicted other than via blind guessing. If you can explain how it'd happen in advance, it's not one.
Re:DeFi bug accidentally gives $90M to users by wizzwizz4 on Friday October 01, 2021 @10:41AM (#28719040)
> That's not to say it's impossible for this to fail, the biggest and sharpest dumps happen during liquidation cascades.

If it happens, it's not a black swan event.

Re:DeFi bug accidentally gives $90M to users by TomSwirly on Friday October 01, 2021 @12:35PM (#28720566)
This is a wrong use of the term.

Black swans are rare but actually exist.

https://en.wikipedia.org/wiki/Black_swan_theory

Re:DeFi bug accidentally gives $90M to users by wizzwizz4 on Friday October 01, 2021 @01:35PM (#28721328)
It's actually a correct use of the term. A “black swan” is something that is believed not to be possible – or, in retrospect, something that was believed impossible but happened anyway.

The term predates the discovery of black swans;

> However, in 1697, Dutch explorers led by Willem de Vlamingh became the first Europeans to see black swans, in Western Australia.[9] The term subsequently metamorphosed to connote the idea that a perceived impossibility might later be disproven. Taleb notes that in the 19th century, John Stuart Mill used the black swan logical fallacy as a new term to identify falsification.[10]

Re:DeFi bug accidentally gives $90M to users by bhaak on Friday October 01, 2021 @09:37AM (#28718257)
How is that different to traditional finance?

Evergrande almost went belly-up as the prices of their real state fell sharply because they sold so much of it to cover their credits.

The financial crisis from 2007 was because the collaterals were nowhere as sound as they were sold for.

Don’t get me wrong I think it’s mostly a house of cards but crypto finance is just traditional finance on steroids IMO.

Re:DeFi bug accidentally gives $90M to users by UncleMeat on Friday October 01, 2021 @10:10AM (#28718635)
> How is that different to traditional finance?

There are a lot more backstops. Traditional finance can have this problem, but we can install human systems to limit the blast radius of things. As you say, it is traditional finance on steroids.

Crypto enthusiasts seem to think it is the opposite. People tell me that defi loans are "zero risk" because of the automatic collateral systems and I just laugh and laugh.

Re:DeFi bug accidentally gives $90M to users by bhaak on Friday October 01, 2021 @02:21PM (#28721834)
Crypto finance and especially DeFi is tiny compared to traditional finance. The blast radius is still small without the regulations. But the regulations will come. Crypto finance is going down the same path that traditional finance did just in a period of a few years than a century.

Everybody who claims there's "zero risk" is either lying or blind to the risks. You can't get those large yields with zero risk.

Re:DeFi bug accidentally gives $90M to users by saalweachter on Friday October 01, 2021 @09:32AM (#28718207)
You can't get Rich with a capital R through safe, traditional investing working even a SWE job.

You can get upper-class rich, seven figures rich, comfortable house, vacation home, early retirement rich, but you can't get Private Jet Rich, Masters of the Universe Rich, Look At Me Rich.

If you want to be Rich you need to to resort to something like playing the lottery, or starting a unicorn startup, or exploiting large numbers of people for your own profit, or crazy "technically it's not a pyramid" schemes like crypto and DeFi.

Re:DeFi bug accidentally gives $90M to users by 6gvONxR4sf7o on Friday October 01, 2021 @06:02PM (#28723866)
> You can get upper-class rich, seven figures rich, comfortable house, vacation home, early retirement rich, but you can't get Private Jet Rich, Masters of the Universe Rich, Look At Me Rich.

SWE at the staff level will get you low to mid eight-figures rich [0] by the time you're old with safe, traditional investing. Sure you aren't Masters of the Universe Rich, but you're still filthy rich.

And how many crypto people are going to beat low-to-mid eight figures? Maybe if you put $100k into bitcoin in 2013, but I'd bet there are more SWEs making $500k+ than there are people who put that much into crypto early enough (and weren't already filthy rich).

[0] Low-to-mid eight-figures in today's dollars. Nine figures in future dollars. Assume $500k income, putting half away from 35 to 65, getting 7% (4.1% after 2.9% inflation).

Re:DeFi bug accidentally gives $90M to users by saalweachter on Saturday October 02, 2021 @08:29AM (#28728079)
> ...by the time you're old...

I think this is a deal-breaker for get-rich-quick types.

Re:DeFi bug accidentally gives $90M to users by ranma4703 on Friday October 01, 2021 @02:09PM (#28721719)
Sounds like we should tax people enough that they can't get "private jet rich", in order to disincentivize those harmful behaviors.

Nobody should have the power that having a billion dollars gives you

Re:DeFi bug accidentally gives $90M to users by nybble41 on Friday October 01, 2021 @04:29PM (#28723086)
> Nobody should have the power that having a billion dollars gives you

Let's pretend for a moment that I agreed with you on this. Your proposal to address the situation is to take all that money, which is currently at least somewhat distributed, and concentrate it in a single organization which already claims a license to steal, kidnap, and murder. I really don't think you've thought this through…

Re:DeFi bug accidentally gives $90M to users by whimsicalism on Friday October 01, 2021 @11:41AM (#28719877)
or inheritance
Re:DeFi bug accidentally gives $90M to users by canjobear on Friday October 01, 2021 @11:04AM (#28719384)
If the code is the law how can it be incorrect? It can only be incorrect by comparison with some other law (like "the code writer's intentions"), in which case you are effectively making that the true authoritative law, rather than the code.
Re:DeFi bug accidentally gives $90M to users by sremani on Friday October 01, 2021 @10:26AM (#28718850)
If Code is law, the compiler is the judge.