{"id":100323,"date":"2020-10-29T15:15:04","date_gmt":"2020-10-29T12:15:04","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/finance-redefined-the-curious-case-of-harvest-finance-oct-21-28\/"},"modified":"2020-10-29T15:15:04","modified_gmt":"2020-10-29T12:15:04","slug":"finance-redefined-the-curious-case-of-harvest-finance-oct-21-28","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/finance-redefined-the-curious-case-of-harvest-finance-oct-21-28\/","title":{"rendered":"# Finance Redefined: The curious case of Harvest Finance, Oct. 21-28"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a4e08165cf32\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a4e08165cf32\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/finance-redefined-the-curious-case-of-harvest-finance-oct-21-28\/#So_is_this_a_hack_or_not\" >So is this a hack or not?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/finance-redefined-the-curious-case-of-harvest-finance-oct-21-28\/#A_bit_too_much_trust_for_crypto_standards\" >A bit too much trust for crypto standards<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/finance-redefined-the-curious-case-of-harvest-finance-oct-21-28\/#The_crazy_story_of_bZX\" >The crazy story of bZX<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/finance-redefined-the-curious-case-of-harvest-finance-oct-21-28\/#The_DeFi_threat_to_staking\" >The DeFi threat to staking<\/a><\/li><\/ul><\/nav><\/div>\n<p>&#8220;<strong># Finance Redefined: The curious case of Harvest Finance, Oct. 21-28 <\/strong>&#8221;<\/p>\n<div data-v-5a136f3a=\"\">We were graced with one more typical \u201cdegen yield farm\u201d popping in and out of relevance this week.<\/p>\n<p>Harvest Finance collected as much as $1 billion in total value locked before an \u201ceconomic exploit\u201d sent it tumbling down. Its value locked measure now hovering around $300 million and prospects for a recovery looking bleak.<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/s3.cointelegraph.com\/uploads\/2020-10\/0c3c5640-d2de-4eb6-a59e-ab802d8cfc24.png\"\/><\/figure>\n<p>The exploit has once again reignited debates among DeFi community members as to whether these types of flash loan-based arbitrage attacks are actually hacks.<\/p>\n<p>Harvest features yield farming vaults similar to Yearn\u2019s. They issue tokenized vault shares based on the value of the assets supplied by users. Some of these vaults rely on Curve\u2019s Y pool, which powers liquidity for swaps between USDT, USDC, DAI and TUSD.<\/p>\n<p>The attack used flash loans to convert $17 million USDT into USDC through Curve, temporarily boosting the USDC price to $1.01. The attacker then used another flash-loaned stash of some $50 million USDC \u2014 which the system considered to be worth $50.5 million \u2014 to enter the Harvest USDC vault. <\/p>\n<p>After entering, the attacker would reverse the previous USDC trade back into USDT to bring the price in balance, and then im<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">media<\/a>tely redeem their shares of Harvest\u2019s pools to receive $50.5 million in USDC \u2014 a net profit of $500,000 per cycle repeated enough times to obtain $24 million in loot.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"So_is_this_a_hack_or_not\"><\/span>So is this a hack or not?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Technically, there were no vulnerabilities involved here. There was a bypassed check for these types of \u201carbitrage trades\u201d that detects if the price of these stablecoins deviates too much from their intended value. But it was already set quite low and it\u2019s really more of a mild inconvenience than an actual blocker \u2014 an attacker just needs to use more exploitation cycles.<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/s3.cointelegraph.com\/uploads\/2020-10\/1517a1bb-133c-48a3-9828-af025a896c57.png\"\/><figcaption style=\"text-align: center;\"><em>This sequence is dizzying, and it still omits many steps.<\/em><\/figcaption><\/figure>\n<p>So in that sense, proponents of the theory that this is just an arbitrage trade are correct \u2014 there is no unintended behavior in the code, it\u2019s more like weaponized market manipulation repeated at speed.<\/p>\n<p>The Harvest Finance team nevertheless assumed responsibility for this as a design flaw, which is commendable. <\/p>\n<p>Honestly, I\u2019m not even sure what the point of these semantic debates is. People lost money in a preventable way. An audit should\u2019ve caught this and marked it as a critical issue.<\/p>\n<p>But there\u2019s definitely a case to be made that it\u2019s a different category from bugs like reentrancy. It highlights that these financial building blocks \u2014 often referred to as \u201cmoney Lego\u201d \u2014 must be designed with utmost care at the drawing board.<\/p>\n<p>It\u2019s like if somebody created a gun out of Lego parts and people were debating if the gun was \u201ccreated\u201d or \u201cdiscovered\u201d because the parts were technically assembled as designed. Either way the Lego parts should be reworked so that they can\u2019t become a lethal weapon.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"A_bit_too_much_trust_for_crypto_standards\"><\/span>A bit too much trust for crypto standards<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Before the hack, Harvest was notable for its extreme degree of centralization. In its glory days, all of the $1 billion could\u2019ve been stolen by a single address, most likely controlled by the anonymous team behind the project. A couple of audits highlighted that fact, also making it clear that the address was able to nominate minters and create tokens at will.<\/p>\n<p>Fans of the project vigorously defended it, saying that because of the time lock, the governance key holders could only steal the money 12 hours after signaling their intentions, or that they could only print a limited number of tokens.<\/p>\n<p>I\u2019ll let you be the judge of those arguments. The wider point is that in the search for yield, these \u201cdegens\u201d are ignoring the basic tenets of decentralization and, you know, what DeFi is about. <\/p>\n<p>And I\u2019m not saying it\u2019s bad because of some idealistic principles I have. It\u2019s because of rug pulls. These are the exact circumstances that led to disasters like UniCats. <\/p>\n<p><template data-name=\"subscription_form\" data-type=\"defi_newsletter\"\/><\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_crazy_story_of_bZX\"><\/span>The crazy story of bZX<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Speaking of hacks, I had the pleasure of interviewing the bZX team about their terrible year. They suffered a total of three hacks over 2020, although some of these definitely feel more like the \u201ceconomic exploits\u201d mentioned earlier.<\/p>\n<p>The team is nothing if not dedicated. One story that didn\u2019t make it to the article was how Kyle Kistner jumped a fence in the middle of the night and broke into the gated community where his co-founder Tom Bean lived. There was <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>arently a bug that needed to be fixed literally as soon as possible. <\/p>\n<p>Judging from the story, being a DeFi developer is not for the faint of heart, nor for people who like to sleep. <\/p>\n<p>Of course, one can\u2019t help but notice that bZX was exploited a bit too often. As a former bug bounty hunter I could definitely see how their security practices were sub-par earlier in the year \u2014 the bug bounty program was pretty bad, for example \u2014 but I also saw how they rectified many of their mistakes. Maybe there are other underlying issues, but I think they could eventually bounce back if no more incidents occur.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_DeFi_threat_to_staking\"><\/span>The DeFi threat to staking<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A ConsenSys report highlights an issue that has kind of been ignored so far, which is essentially the opportunity cost of staking in a DeFi environment.<\/p>\n<p>The idea is pretty simple: money chases the highest yields, and DeFi seems to be offering plenty of them these days. Even something relatively tame like 20% APY could beat the potential 8% or so from staking and validating Ethereum 2.0.<\/p>\n<p>That problem is compounded even more when you consider that Ethereum\u2019s Phase 0 won\u2019t let you withdraw or transfer the tokens you committed until Phase 1 or 2 comes. You\u2019re basically making a bet that the team will ship a full implementation in a reasonable timeframe, and you\u2019re not really getting rewarded that much for the risk.<\/p>\n<p>In that scenario, the more popular DeFi is, the less secure the network is, and that\u2019s a big problem.<\/p>\n<p>Thankfully, it is largely solvable through staking derivatives \u2014 liquid tokens backed by collateral used for staking, a sort of Ether IOU. There are risks involved \u2014 namely that the underlying collateral could get slashed and the IOUs would be suddenly worth less. The good thing for the network is that only DeFi is affected in this case, reestablishing the natural hierarchy of importance.<\/p>\n<p>But that highlights just how many unintended interactions there could be in the future. DeFi can already get extremely complex, and if people don\u2019t fully understand it, the consequences could be terrible.<\/p>\n<\/div>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong>\n<\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a> articles, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/general\/\" target=\"_blank\" rel=\"noopener noreferrer\">General category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/cointelegraph.com\/news\/finance-redefined-the-curious-case-of-harvest-finance-oct-21-28\" target=\"_blank\" rel=\"noopener noreferrer\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;# Finance Redefined: The curious case of Harvest Finance, Oct. 21-28 &#8221; We were graced with one more typical \u201cdegen yield farm\u201d popping in and out of relevance this week. Harvest Finance collected as much as $1 billion in total value locked before an \u201ceconomic exploit\u201d sent it tumbling down. Its value locked measure now&#8230;<\/p>\n","protected":false},"author":1,"featured_media":100324,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/s3.cointelegraph.com\/uploads\/2020-10\/5c604966-f6fd-450d-85fc-446fd8ba4c5c.jpg","fifu_image_alt":"","footnotes":""},"categories":[1],"tags":[74868,74891,4965],"class_list":["post-100323","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-defi","tag-ethereum","tag-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/100323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=100323"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/100323\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/100324"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=100323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=100323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=100323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}