CrypticDefense

Never forget - DeFi changed forever from a single reddit post. 🦄 I've also added an interactive mc quiz to test your knowledge! crypticdefense.com/research/…

Coming back to this in one year.

Last week, @PropellerSwap announced Fynd AMM: • The issue is that if a pool overcharges, it loses trades to competing pools. If it undercharges, then LPs lose out on potential fees. • Fynd solves this by first finding the best available quote across various swap routes, and then adjusting its own fee to give the best price to traders while maximizing LP revenue. There are still many opportunities in the AMM space amid the Balancer wind down, and more problems to be solved. Take advantage of the time now. 🚀

AMM hacks of October: ~$19M lost through 10 exploits. • The simplest exploit seemed to be a bad `if` branch in the withdraw function of a Uniswap v4 liquidity manager (BitBay vault contract) that allowed an attacker to swap in the pool directly to push the price to the extreme, call `reposition()` (which now read the position price as out of range), then withdraw the entire balance of the contract as the internal liquidity accounting was now read as zero. • The most complex one seemed to be a missing zero-delta balance check during rebalance in a Uniswap v4 hook (GoldPesa). The attacker created a new position, then in the same tx executed a swap which called the contract's `rebalance()` function (pulls the existing position and adds it to the current price) that counted towards the attacker's delta balance, allowing them to take the funds for themselves. Although there is still some lack of understanding with integration, especially with Uniswap v4, it's clear that AMM bugs will always be some of the most subtle and dangerous in DeFi.

I’ve been spending some time writing and I’m quite surprised at how much it has improved my verbal articulation already. Highly recommend everyone to start writing daily. It wires your thoughts together very nicely.

As strange as it sounds, it feels like these constant waves of hacks are necessary for us to truly achieve safe software. Rather than viewing AI as a danger to cybersecurity, we should look at AI as a tool helping expose vulnerable software and an accelerator to reach the state of secure code. Each exploit is a lesson, and the next wave of exploits subsequently becomes more difficult for hackers. This will repeat until hacking becomes so infeasible in terms of time and cost, that we will no longer see any real software exploits, with the only danger left being social engineering. This is somewhat similar to what happened with the internet in the 90’s, where a massive surge in vulnerabilties forced software companies to take secure code more seriously, until the hacks finally slowed down.