Defining Risk in DeFi

Forecasting risk in decentralized finance (DeFi) means understanding the systematic threats facing the ecosystem. Using Campbell Harvey’s DeFi and the Future of Finance as a lens, Spectral describes seven threats to the space and potential solutions.

Growing a global financial system from a smart contract and spreadsheet to a centi-billion dollar capital market involves a couple of challenges. After all, the global financial system took at least three thousand years to evolve. Decentralized finance has been around for less than a decade. One area where it diverges significantly from traditional finance is risk. While decentralization mitigates many potential hazards and enables many new opportunities, it also introduces new sources of risk.

The early web was a wild west of strange protocols and anonymous users. For entertainment and sharing information, this was enough, but as commerce began to move online, providers battened down the hatches. Spam was an early worry. SSL and other advances helped prevent spammers and scammers from clogging up the net, but created a privacy nightmare as enormous data companies like Google, Amazon, Apple, Facebook raced to soak up the best customer data and better target ads. A common sentiment in cryptocurrency is that we have yet to move beyond “web 2.0” and the true potential of the blockchain–essentially connecting smart contracts to real-world events and automating many accounting and bureaucratic processes remains untapped.

At Spectral, we think the next step toward web3 requires truly mastering on-chain data. Our long-term vision is to build infrastructure for decentralized finance that is as robust and effective as its predecessor while remaining accessible, accountable, and transparent to its users. We think accurate risk forecasting using transparent on-chain data will bring us much closer.

DeFi’s Seven Principal Risks

Campbell Harvey, Duke University professor and author of DeFi and the Future of Finance identifies seven categories of risk with decentralized finance. “The principal risks DeFi faces today are smart contract, governance, oracle, scaling, exchange, custodial, and regulatory risks.” It’s a useful rubric for identifying DeFi’s soft spots.

Smart Contract Risk

DeFi dApps rely on smart contracts, which are essentially computer programs that use cryptocurrencies to transact. Design flaws, such as the notorious Slock.it exploit in 2016, which forced an Ethereum fork, can leave assets vulnerable to attack. Another potential “attack vector” would be an economic design flaw in the smart contract, such as a design that might leave one party in a transaction more vulnerable to price changes than the other and open the door for a flash-loan-driven price shock mid-transaction.

Crypto auditors like Certik, Consensys Diligence, or Quantstamp scan protocols for design flaws but fundamental issues with Ethereum Virtual Machine (EVM) can make 100 percent security difficult. One narrowly averted disaster occurred with MakerDAO in 2020, when a sudden drop in Ethereum prices nearly liquidated thousands of vaults and could have depegged their DAI stablecoin.

Governance Risk

Not all DeFi protocols rely entirely smart contracts (the way Uniswap does, for example). Many take the form of decentralized autonomous organizations (like MakerDAO) or otherwise have groups of humans running them. Tokenized voting can open protocols up to governance attacks. Beanstalk was attacked when “an attacker took out a loan to acquire enough of Beanstalk’s governance token to instantly pass a malicious proposal that allowed them to seize $182 million of Beanstalk’s reserves.” (A16ZCrypto) Decreasing governance risk often means carefully designing the governance structure of a DeFi protocol, building in safeguards, and increasing the cost of an attack to make them prohibitively expensive.

Reputation and identity protocols such as proof of humanity protocol, lens protocol, or Collab.Land are working to make on-chain behavior more transparent and reputation transportable across protocols. Spectral’s new risk analysis forecasting can also provide attestations and near real-time wallet information, for example, flagging previous interactions with known scammers during a transaction.

Oracle Risk

Most DeFi protocols rely on oracles–essentially feeds of up-to-date price information–to accurately price assets on a dApp for liquidation, borrowing or swaps. This information must be fast, accurate, secure and tamper-resistant and relying on them introduces another variable. “Oracles represent significant risks to the systems they help support,” writes Harvey. “If an oracle’s Cost of Corruption is ever less than their potential Profit from Corruption, the oracle is extremely vulnerable to attack.” He cites three varieties of oracle, Schelling-point oracles, which are decentralized and token-based, such as Augur or UMA but can be slow; API oracles such as Chainlink, which provide asynchronous, trusted feeds of information, but are essentially centralized; and finally “custom, application-specific oracles,” such as MakerDAO or Compound’s, which are usually generated by transaction prices within a protocol.

Corruption is one danger. Other oracle risks include system downtime and frontrunning by arbitrageur. To Harvey, oracles present “the largest systematic threat to DeFi today.” In October 2022, Solana-based DeFi protocol Mango Markets’ oracle feeds were corrupted and an attacker took out loans totaling $112,199,876 from their treasury (Blockworks). Jump Crypto president Kanav Kariya explained that the hacker pumped and dumped the (thinly traded) Mango token, taking advantage of the ensuing price spike to take out the loans.

Scaling Risk

Although the conversion of Ethereum to Proof of Stake and the rise of Layer 2 protocols like Polygon and Arbitrum have reduced transaction costs and generally made life cheaper and easier for dApps, blockchains remain difficult to scale if decentralization and the “triumvirate” of security, transparency, and immutability are prioritized. Scaling DeFi to include the entire world’s population will require faster transaction times and much larger throughput than any existing blockchain has been able to.

Exchange Risk

Harvey describes two main varieties of decentralized exchange, there are order-book exchanges and there are automatic market makers (AMMs). The latter use liquidity pools to allow trustless token exchanges, but in so doing, they leave parties susceptible to various types of risk, such as impermanent loss (when the value of liquidity loses value relative to what it could have earned on its own), intense volatility, frontrunning, and smart contract risk. Order-book exchanges have their own problems, especially frontrunning, and poor liquidity resulting large spreads between buying and selling prices. Regulatory compliance also becomes an issue if any assets are settled off-chain as they are in some hybrid models. However, as Harvey says, “both AMM and order-book DEXes are able to eliminate counterparty risk while offering traders a noncustodial and trustless exchange platform.”

Custodial Risk

There are three types of custody, each with its own risks. Self-custody places control entirely in the user's hands and with it most of the risk. Keys can be lost or stolen, clicking a phishing link or mistyping an address can make funds vanish. Relinquishing control to a third party reduces opportunities for user error, but brings other dangers—the largest hacks in the ecosystem have taken place on exchanges (such as Mt. Gox and FTX).

Insurance can provide some protection from large-scale hacks and crypto bank runs, and as exchanges become larger they’ve been able to survive many hacks. Still, nothing in web3 is as safe as an FDIC-insured savings account, for example–although of course there are plenty of risks with traditional banks. Nexus Mutual and Bridge provide crypto insurance and many traditional providers are beginning to offer some sort of insurance policy.

Regulatory Risk

While web3 is much less of a wild west than it once was, it remains significantly more volatile than traditional finance, and major catastrophes like the fall of Terra and the collapse of FTX remain commonplace. Some of the fundamental techniques that DeFi uses, such as staking and issuing governance tokens are coming under scrutiny by the Securities and Exchange Commission and advances in shared ownership that DAOs and NFTs are becoming a legal grey area. Protocols are beginning to request know your customer (KYC) information from users and are adhering to anti-money laundering (AML) regulations in the United States. Lobbying efforts are underway by the crypto community, with as many as 320 lobbyists employed by June 2022 (PYMNTS).

Potential Solutions

Customer protection can facilitate the relationship between web3 and regulatory bodies. In the real world, there are reputation and legal systems in place to prevent most scams and thefts. For trustless transactions a new type of awareness will have to come into play; this could take the form of a trusted layer on top of the trustless blockchain, taking the form of non-transferable tokens or attestations or, as forecasting and artificial intelligence improve, it could become a kind of situational awareness, perhaps a signal such as an address turning red in your send bar if there’s a high risk that your counterparty is connected to fraudulent behavior.

Some potential benefits of automated risk forecasting:

• Builds trust: weak risk management measures in the crypto industry can erode trust and confidence in the system. By detecting and preventing risk, individuals, and businesses can feel more secure in using and investing in crypto assets.
• Enhances the legitimacy of the industry: As the crypto industry continues to grow, there is a need for regulatory frameworks to ensure its legitimacy. The use of risk-intelligence technology can help legitimize the industry and create a safer environment for investors and users.
• Asset protection: Crypto assets are not backed by any physical collateral, making them vulnerable to theft and fraud. Implementing fraud detection and prevention measures can help protect assets and reduce the risk of losses for all parties involved.
• Improves efficiency: Security threats can be time-consuming and costly to resolve. By implementing risk intelligence technologies earlier on, transactions can be screened and processed more efficiently, reducing the risk of delays and associated costs.

At Spectral, we built the MACRO Score, an on-chain creditworthiness assessment score to allow lenders to become more capitally efficient, and giving users an easily understandable look at the risk they pose to themselves (and anyone lending to them). Our next product will look at the other side of a transaction, providing near-realtime awareness of potential risk and predictions about the potential risk.

Build with us

Spectral is sponsoring a number of hackathons over the next few months. We'd love to see what you can do with our API.