Upgradable smart contracts are a bug [https://medium.com/consensys-diligence/upgradeability-is-a-bug-dba0203152ce]. Remember this? It's mostly controversial now because very few projects do immutable smart contracts these days (but Curve and Yield Basis do).
So why immutable smart contracts are good?
- Humans make bugs in code. Steve McConnell in his book "Code Complete" famously wrote that average for software engineering industry is 1-25 per 1000 lines of code, which get to 0.5 defects per 1000 lines in Misrosoft after good testing. Average smart contract is several thousand lines = 1 bug after rigorous testing, hopefully not critical (critical parts should be smaller than few thousand lines). Now, imagine that smart contracts will be upgraded again and again and again - and now you need to secure not 2000 lines but 100000 lines (smart contracts in each release).
- Yes upgradability can save you if you find a mistake before hackers. But if you don't? Whoosh!
- Upgrades can break integrations. Remember Curve pools which use Aave tokens which are now disabled? Not nice.
- What if devs will be replaced by new devs? Will they be as competent as before? Less trust to humans = better!
- Maybe not an issue now, but upgradability does increase regulatory attack surface.
So, immutable smart contracts for the win!
#DeFi #security
So why immutable smart contracts are good?
- Humans make bugs in code. Steve McConnell in his book "Code Complete" famously wrote that average for software engineering industry is 1-25 per 1000 lines of code, which get to 0.5 defects per 1000 lines in Misrosoft after good testing. Average smart contract is several thousand lines = 1 bug after rigorous testing, hopefully not critical (critical parts should be smaller than few thousand lines). Now, imagine that smart contracts will be upgraded again and again and again - and now you need to secure not 2000 lines but 100000 lines (smart contracts in each release).
- Yes upgradability can save you if you find a mistake before hackers. But if you don't? Whoosh!
- Upgrades can break integrations. Remember Curve pools which use Aave tokens which are now disabled? Not nice.
- What if devs will be replaced by new devs? Will they be as competent as before? Less trust to humans = better!
- Maybe not an issue now, but upgradability does increase regulatory attack surface.
So, immutable smart contracts for the win!
#DeFi #security
Medium
Upgradeability Is a Bug
Upgradeability Is a Bug tl;dr Smart contracts are useful because they’re trustless. Immutability is a critical feature to achieve trustlessness. Upgradeability undermines a contract’s …
❤12👍6🔥2
Curious facts from Michael@Curve
Seeing a lot of FUD about Ethereum from Solana bros, so couldn't avoid commenting. Ethereum will do fine, FUD is to distort the perception of speculators. However, there's a grain of truth in it. IMO, L2-centric scaling roadmap DOES break composability. Would…
Looks like Vitalik now came to the same vision about L2s. Very very nice!
https://x.com/VitalikButerin/status/2018711006394843585
https://x.com/VitalikButerin/status/2018711006394843585
X (formerly Twitter)
vitalik.eth (@VitalikButerin) on X
There have recently been some discussions on the ongoing role of L2s in the Ethereum ecosystem, especially in the face of two facts:
* L2s' progress to stage 2 (and, secondarily, on interop) has b
* L2s' progress to stage 2 (and, secondarily, on interop) has b
❤14
Yesterday I noticed some unusual swaps in Yield Basis related pools on Curve. At first, I was very worried (always good to check when you see something unusual), but it appeared that the reason was someone exchanging 50M USDT to 36k USD worth of AAVE (sic!) [https://x.com/StaniKulechov/status/2032193345414664659].
On Aave, you can essentially swap collateral via an external exchange platform - CowSwap in this case. Aave (rightfully) made a warning that it's gonna be 99.9% slippage. But who reads warnings? What's slippage anyway? The user (on mobile!) pressed "proceed anyway". Rekt.
New wave of DeFi users are way less smart than we used to be in 2020, and same methods do not work! So... what can we do for them?
One thing: if there is an alternative how to do this action better - it's good if UI switches to the better way. In this case it'd be a limit order (but also TWAP could have been better).
Another one: I think that the method which CowSwap uses (e.g. competition between solvers) is unsuitable for such large swaps (and in this case, solvers failed even more miserably - they could've returned up to 7M worth of AAVE). IMO a much better way is what 1inch does: a moving limit order which can be arbitraged with CEXes as well. Maybe that's a better model overall. Cow wins competition not so much with technology but with a very very good UX.
And of course for users: it's totally not good to operate with any meaningfully large amounts from mobile. Mobile-first and big money are not very compatible.
On Aave, you can essentially swap collateral via an external exchange platform - CowSwap in this case. Aave (rightfully) made a warning that it's gonna be 99.9% slippage. But who reads warnings? What's slippage anyway? The user (on mobile!) pressed "proceed anyway". Rekt.
New wave of DeFi users are way less smart than we used to be in 2020, and same methods do not work! So... what can we do for them?
One thing: if there is an alternative how to do this action better - it's good if UI switches to the better way. In this case it'd be a limit order (but also TWAP could have been better).
Another one: I think that the method which CowSwap uses (e.g. competition between solvers) is unsuitable for such large swaps (and in this case, solvers failed even more miserably - they could've returned up to 7M worth of AAVE). IMO a much better way is what 1inch does: a moving limit order which can be arbitraged with CEXes as well. Maybe that's a better model overall. Cow wins competition not so much with technology but with a very very good UX.
And of course for users: it's totally not good to operate with any meaningfully large amounts from mobile. Mobile-first and big money are not very compatible.
X (formerly Twitter)
Stani (@StaniKulechov) on X
Earlier today, a user attempted to buy AAVE using $50M USDT through the Aave interface.
Given the unusually large size of the single order, the Aave interface, like most trading interfaces, warned the user about extraordinary slippage and required confirmation…
Given the unusually large size of the single order, the Aave interface, like most trading interfaces, warned the user about extraordinary slippage and required confirmation…
👍11🔥9💯5❤1🙏1🤣1
A quick thought about Bitcoin quantum safety (even though I am somewhat doubtful about the claim that "everything will be hacked soon" but who knows).
Today Bitcoin addresses are not reversible to private keys even by quantum computers. But as soon as the address transacts - it well can be since public key / signature is exposed. Bitcoin transactions do not reuse addresses by default these days, so the problem appears only while tx is pending, but that can be enough time to hack the key corresponding to this address and redirect the funds.
If Bitcoin introduces a new quantum-safe signature scheme - they CAN migrate without users having to do something! Just first tx old_signature_address->new_signature_address must be a zero-knowledge proof of sorts which does not expose the public key or signature corresponding to the old address (which was using the quantum-unsafe ECDSA).
This, however, still leaves Satoshi's Bitcoins vulnerable, and there is no workaround here. So that jackpot will be available to whoever makes the first quantum computer: likely a state actor, probably the United States (which will, of course, make Bitcoin Great Again).
Otherwise (unlike Ethereum or Solana!) there's a clear and simple migration path for Bitcoin which does not require users actively migrating their accounts before quantum computers become available.
Today Bitcoin addresses are not reversible to private keys even by quantum computers. But as soon as the address transacts - it well can be since public key / signature is exposed. Bitcoin transactions do not reuse addresses by default these days, so the problem appears only while tx is pending, but that can be enough time to hack the key corresponding to this address and redirect the funds.
If Bitcoin introduces a new quantum-safe signature scheme - they CAN migrate without users having to do something! Just first tx old_signature_address->new_signature_address must be a zero-knowledge proof of sorts which does not expose the public key or signature corresponding to the old address (which was using the quantum-unsafe ECDSA).
This, however, still leaves Satoshi's Bitcoins vulnerable, and there is no workaround here. So that jackpot will be available to whoever makes the first quantum computer: likely a state actor, probably the United States (which will, of course, make Bitcoin Great Again).
Otherwise (unlike Ethereum or Solana!) there's a clear and simple migration path for Bitcoin which does not require users actively migrating their accounts before quantum computers become available.
❤15👍7⚡2👏1
Observing the hack which happened yesterday to rsETH, which caused a serious contagion at Aave. Wow, it's a lot to unfold.
First of all, looks like there is no exposure of Curve or Yield Basis to either rsETH or Aave problems. But this all of the issue started with LayerZero which is relied upon by crypto with quarter of a trillion in value. How? Let's have a look.
Kelp's rsETH uses a LayerZero bridge. The bridge allows to transfer rsETH to/from other chains. Minting of rsETH can only happen on Ethereum, and all the rsETH on non-Ethereum chain are backed by mainnet-rsETH kept in the bridge.
On LayerZero one can choose so-called DVNs. DVNs are nodes which essentially bring a message from another chain. 2-of-3 DVN configuration would mean that two DVNs should agree on the fact that "give 100'000 rsETH to Eve" is exactly what was requested on another chain. And here's the problem: rsETH has a 1-of-1 DVN configuration: just one DVN (although it's the main LayerZero DVN) is used and fully trusted. So it approved a message which allowed to give the hacker all the rsETH in the bridge, although it was never sent on the source chain (Unichain in this case).
As you probably heard, 1-of-1 configuration for multisigs is kinda unsafe. Same with DVNs. But this was THE official LayerZero DVN - how could it approve a wrong message? Was it hacked? Was it fooled? We don't know. But things can happen when you trust one single party - whoever that would be.
So ok, the hacker fooled the official LayerZero DVN to give him a lot of rsETH. What's next? The most profitable for the hacker appeared to supply rsETH on Aave and borrow all possible ETH there. And Aave was left with rsETH which cannot be really sold and maxborrowed ETH, so no one can withdraw ETH. Potentially 300m-sized bad debt. Maybe not - technically those are still backed, but bank run on Aave is happening.
So which conclusions could we make from this?
* Non-isolated lending like on Aave is very risky (although it's the most capital efficient!). Aave v4 with hub-and-spoke model is probably less risky. Morpho also. And lending on Curve, as well as Silo, is probably the most isolated -> safest in that regard.
* Lending protocols are riskier than DEXes to supply funds. USDC/USDT pool on Curve has only exposure to the two assets in the pool, Aave has exposure to all asset added there.
* Asset onboarding on lending protocols should be looked at more carefully. 1-of-1 DVN configuration on rsETH is really a miss: this should have been upgraded to at least 2-of-2 before onboarding.
* Cross-chain is hard and potentially risky. Only use cross-chain infrastructure when absolutely necessary, and do it REALLY carefully.
In any case, I think DeFi will learn from this incident and become stronger than before. Crypto is a harsh environment which no bank would have survived - yet we are working with that. Permissionless infrastructure requires extraordinary efforts to be safe - and we are doing those efforts!
First of all, looks like there is no exposure of Curve or Yield Basis to either rsETH or Aave problems. But this all of the issue started with LayerZero which is relied upon by crypto with quarter of a trillion in value. How? Let's have a look.
Kelp's rsETH uses a LayerZero bridge. The bridge allows to transfer rsETH to/from other chains. Minting of rsETH can only happen on Ethereum, and all the rsETH on non-Ethereum chain are backed by mainnet-rsETH kept in the bridge.
On LayerZero one can choose so-called DVNs. DVNs are nodes which essentially bring a message from another chain. 2-of-3 DVN configuration would mean that two DVNs should agree on the fact that "give 100'000 rsETH to Eve" is exactly what was requested on another chain. And here's the problem: rsETH has a 1-of-1 DVN configuration: just one DVN (although it's the main LayerZero DVN) is used and fully trusted. So it approved a message which allowed to give the hacker all the rsETH in the bridge, although it was never sent on the source chain (Unichain in this case).
As you probably heard, 1-of-1 configuration for multisigs is kinda unsafe. Same with DVNs. But this was THE official LayerZero DVN - how could it approve a wrong message? Was it hacked? Was it fooled? We don't know. But things can happen when you trust one single party - whoever that would be.
So ok, the hacker fooled the official LayerZero DVN to give him a lot of rsETH. What's next? The most profitable for the hacker appeared to supply rsETH on Aave and borrow all possible ETH there. And Aave was left with rsETH which cannot be really sold and maxborrowed ETH, so no one can withdraw ETH. Potentially 300m-sized bad debt. Maybe not - technically those are still backed, but bank run on Aave is happening.
So which conclusions could we make from this?
* Non-isolated lending like on Aave is very risky (although it's the most capital efficient!). Aave v4 with hub-and-spoke model is probably less risky. Morpho also. And lending on Curve, as well as Silo, is probably the most isolated -> safest in that regard.
* Lending protocols are riskier than DEXes to supply funds. USDC/USDT pool on Curve has only exposure to the two assets in the pool, Aave has exposure to all asset added there.
* Asset onboarding on lending protocols should be looked at more carefully. 1-of-1 DVN configuration on rsETH is really a miss: this should have been upgraded to at least 2-of-2 before onboarding.
* Cross-chain is hard and potentially risky. Only use cross-chain infrastructure when absolutely necessary, and do it REALLY carefully.
In any case, I think DeFi will learn from this incident and become stronger than before. Crypto is a harsh environment which no bank would have survived - yet we are working with that. Permissionless infrastructure requires extraordinary efforts to be safe - and we are doing those efforts!
❤34🔥16👍5👌2
I've made a proposal on how to recover bad debts in lending protocols, starting with Curve's own one as an example.
Better than bailouts?
https://gov.curve.finance/t/crv-long-llamalend-market-recovery/11062
🥳 Curve's UI | ✈️ Telegram Chat | 🤟 Twitter/X
🛸 China Chat | 📱 YouTube | 📱 Discord
Better than bailouts?
https://gov.curve.finance/t/crv-long-llamalend-market-recovery/11062
🥳 Curve's UI | ✈️ Telegram Chat | 🤟 Twitter/X
🛸 China Chat | 📱 YouTube | 📱 Discord
❤9💯4🔥2
Seeing many people getting their telegram hacked. The malware uses telegram of someone from your contact list to join some group. The group has a “SafeGuard” mini-app to “verify” yourself. It asks your telegram credentials and starts posting as if it was you.
Don’t fall for these and be safe
Don’t fall for these and be safe
❤14🙏10👀4🤝2
Here we go again. Custodial stablecoins EURR and USDR were hacked by company-s multisig wallet being compromised [https://www.coindesk.com/markets/2026/05/26/stablr-freezes-usdr-and-eurr-after-attacker-mints-usd13-5-million-in-unbacked-tokens]. It was a 1-of-3 multisig, i.e. worse than just an admin key.
In response to this hack of a MiCa-compliant (!) stablecoin the team did a very EU-compliant thing: froze money of everyone everywhere. So, if you had USDR deposits say on Curve or Morpho - you cannot withdraw.
What does that mean? Most likely this: if you see custodial finance (e.g. not decentralized but if someone holds your money) - you should be very cautious. Compliance apparently may mean that risks are higher than in decentralzied finance, not lower.
In response to this hack of a MiCa-compliant (!) stablecoin the team did a very EU-compliant thing: froze money of everyone everywhere. So, if you had USDR deposits say on Curve or Morpho - you cannot withdraw.
What does that mean? Most likely this: if you see custodial finance (e.g. not decentralized but if someone holds your money) - you should be very cautious. Compliance apparently may mean that risks are higher than in decentralzied finance, not lower.
Coindesk
StablR freezes USDR and EURR after attacker mints $13.5 million in unbacked tokens
The breach, linked to a 1-of-3 multisig wallet weakness, allowed attackers to compromise a key and mint $13.5 million in unbacked tokens, netting them $2.8 million.
💯12👍5🤔3❤2
Seeing a lot of fears about Claude Mythos allegedly being released today or tomorrow and "everything getting hacked".
I suspect that we should not directly translate its success in detecting bugs in browsers and Linux Kernel to smart contracts. The software where Mythos found something is containing tens of millions lines of code and simply cannot fit the context.
Smart contracts are really different. They usually have a few thousand lines of code, and both humans and "usual" AI perfectly fit that code in context and can reason well about it.
So I suspect we might not be having a wave of DeFi code hacks, but we may see a lot of things in OpSec getting hacked (looking like multisig keys compromises) and supply chain attacks on frontend dependencies, and those are way less dangerous in true DeFi.
🥳 Curve's UI | ✈️ Telegram Chat | 🤟 Twitter/X
🛸 China Chat | 📱 YouTube | 📱 Discord
I suspect that we should not directly translate its success in detecting bugs in browsers and Linux Kernel to smart contracts. The software where Mythos found something is containing tens of millions lines of code and simply cannot fit the context.
Smart contracts are really different. They usually have a few thousand lines of code, and both humans and "usual" AI perfectly fit that code in context and can reason well about it.
So I suspect we might not be having a wave of DeFi code hacks, but we may see a lot of things in OpSec getting hacked (looking like multisig keys compromises) and supply chain attacks on frontend dependencies, and those are way less dangerous in true DeFi.
🥳 Curve's UI | ✈️ Telegram Chat | 🤟 Twitter/X
🛸 China Chat | 📱 YouTube | 📱 Discord
👍13💯5❤4
So looks like Uniswap finds out tech which was used by Curve since its start in 2020 (using liquidity based on yield-bearing vaults), calls it FX layer (it's USD-USD swaps in reality) and tries to sell to financial institutions as something new?
https://blog.uniswap.org/spark-moves-150m-of-liquidity-to-v4-with-new-hook-coming-soon
🥳 Curve's UI | ✈️ Telegram Chat | 🤟 Twitter/X
🛸 China Chat | 📱 YouTube | 📱 Discord
https://blog.uniswap.org/spark-moves-150m-of-liquidity-to-v4-with-new-hook-coming-soon
🥳 Curve's UI | ✈️ Telegram Chat | 🤟 Twitter/X
🛸 China Chat | 📱 YouTube | 📱 Discord
Uniswap Labs
Spark Moves $150M of Liquidity to v4 with DualPool Hook Coming Soon
Spark has migrated $150M of stablecoin liquidity to Uniswap v4 and will soon move these assets to DualPool, a new v4 hook designed and built in collaboration with Uniswap Labs.
❤14😁13🤣2
In his recent interview, Andre Cronje weighted heavily (https://x.com/therollupco/status/2078961843008397433?s=20) in favor of smart contract upgradability, contrary to what he said before. For context: Andre was one of the people who ignited the DeFi summer in 2020, started a bunch of projects (including Yearn) and invented ve(3,3) variant of ve-tokenomics launched in Solidly, now used by Aerodrome.
Is he right to bash on immutability? I think no, very wrong.
Smart contracts can be hacked if mistakes were made - you know that. But having them upgradable means a possibility of a *hack by modification*. Especially if your upgrades are controlled by an EOA or a multisig, not a DAO.
Smart contracts are not large in size, so one *can* secure them in a bullet-proof way. If you are not sure - you can (and should) apply formal verification - it is about to become much more accessible than before (again, thanks to AI). If you are *still* not sure - make an ability to freeze a smart contract so that everyone can just do some sort of a safe withdrawal via the simplest possible route, so you have an emergency plan in case you have some issue detected.
If you are a dev - use immutability as your way to protect from all sorts of key compromises or infrastructure compromises, simialar to what LayerZero experienced with Kelp bridging. Immutability is your friend, not enemy. Andre is wrong.
🥳 Curve's UI | ✈️ Telegram Chat | 🤟 Twitter/X
🛸 China Chat | 📱 YouTube | 📱 Discord
Is he right to bash on immutability? I think no, very wrong.
Smart contracts can be hacked if mistakes were made - you know that. But having them upgradable means a possibility of a *hack by modification*. Especially if your upgrades are controlled by an EOA or a multisig, not a DAO.
Smart contracts are not large in size, so one *can* secure them in a bullet-proof way. If you are not sure - you can (and should) apply formal verification - it is about to become much more accessible than before (again, thanks to AI). If you are *still* not sure - make an ability to freeze a smart contract so that everyone can just do some sort of a safe withdrawal via the simplest possible route, so you have an emergency plan in case you have some issue detected.
If you are a dev - use immutability as your way to protect from all sorts of key compromises or infrastructure compromises, simialar to what LayerZero experienced with Kelp bridging. Immutability is your friend, not enemy. Andre is wrong.
🥳 Curve's UI | ✈️ Telegram Chat | 🤟 Twitter/X
🛸 China Chat | 📱 YouTube | 📱 Discord
X (formerly Twitter)
The Rollup (@therollupco) on X
Andre Cronje (@AndreCronjeTech), Founder of @flyingtulip_, shares why he no longer preaches decentralization, and why he's come to see immutability as a bug instead of a feature.
❤21👍4