Epicenter - Learn about Crypto, Blockchain, Ethereum, Bitcoin and Distributed Technologies - Marc Zeller & Stani Kulechov: Aave – Unlocking Access to Capital With Flash Loans

Episode Date: April 28, 2020

Aave is building a suite of non-custodial DeFi tools that allow users to earn interest on their deposits and borrow assets. Earlier this year, Aave released its Flash Loans feature, which is drumming up a lot of excitement in the ecosystem. Flash Loans have a number of applications like executing liquidations or refinancing and require no collateral on the part of the borrower. As we have seen since they were introduced, they have also been used by malicious actors to exploit vulnerabilities in some DeFi protocols. Nevertheless, this powerful tool is an important “money lego” component that enables various new use cases. Stani Kulechov, Aave Founder & CEO, and Marc Zeller, Integrations Lead, explain their vision for the Aave protocol as an essential part of the DeFi ecosystem.Topics covered in this episode:Stani and Marc's backgrounds and how they became involved in cryptoMarc's previous project, Variabl, and why it failedHow Aave came out of EthLendSwitching from an OTC model to a pooled modelYield hacking and other DeFi use casesWhat the Flash Loan is and why it is usefulHow one can do DeFi refinancing with Flash LoansThe Flash Loans attacks which happened in FebruarySmart contract security and how the community should response to attacksWhy privacy is DeFi is desirable, but also hard to doEpisode links: Aave Protocol websiteSneak Peek at Flash LoansFlash Loans - One Month InAave TwitterStani Kulechov TwitterMarc Zeller TwitterSponsors: Least Authority: Register for Security Sessions on April 30th to learn about security audits for your blockchain project - https://leastauthority.com/meetupShapeShift: ShapeShift is the leading crypto platform offering zero-commission trading - https://shapeshift.com/This episode is hosted by Sebastien Couture. Show notes and listening options: epicenter.tv/337

This is Epicenter, Episode 337 with guests, Stani Kulachov, and Mark Zeller. Hi, welcome to Epicenter. My name is Sebastian Kucho. Today, my guests are Stani Kulachov and Mark Zeller, respectively. They are the CEO and integrations lead at AVE. So AVE is building a suite of non-custodial defy tools which allow users to earn interest on their deposits and borrow assets. Now, one of the things which brought AVE to some prominence recently was the release of their flash loan product. Certainly, this is something you've all heard about because in recent months, there have been a number of attacks on various Ethereum smart contracts, which have leveraged flash loans or some similar

mechanism. Mind you, as far as I know, none of these actually involved the AVE flash loan contract, but since we recorded this interview at ECC, the BZX attack had just happened and it was pretty fresh. So we did talk about it in this conversation. So since their launch, AVEA, has seen some phenomenal growth. And according to their website, as of today, it was about $50 million locked in Ave, which is about half of the capital in compound. They support 17 tokens, a number of stable coins, and they're integrated with several wallets and daps. Now, in terms of user experience, these integrations are important because they allow users to leverage flash loans without the need to write code. Now, this is something that we talked about

in the interview as like a hopeful outlook on the future. Well, in just a few, weeks since we recorded that, several codeless applications have emerged that allow people to do just that. So you can now use flash loans in money Legos and literally just drag and drop different components of defy in a user-facing application and leverage a flash loan to do refinancing, for example. So here's what you'll learn in this interview. Stonyam Mark's background in how they became involved in crypto. The various projects they were involved with previously, including variable and why that failed. the project which preceded AVE, EFLend, and how it switched from an OTC model to the pool model that they have today.

We talked about yield hacking and other defy use cases. We discussed what is a flash loan, what it's useful for, and how you can use it to do things like defy refinancing. We discussed the flash loan attacks, which happened in February and the specifics of the attacks. We talked about smart contract security and how the community should respond to attacks and why DFI privacy is desirable but so hard to do. So reset everything. This event that I've been organizing for the last three or four weeks has come together in ways that I would never have imagined when I first had this idea. Now, if you remember at the beginning, I had this idea to do a conference where I'd get like Bitcoiners and Ethereum people together and discuss their differences, but that has totally

just fallen to the wayside and reset everything has become, has become. a multidisciplinary conference about the paradigm shifts that are happening around us and that will continue to operate in society for the foreseeable future because of this crisis, which is just so huge. So we're going to talk about health and wellness, media and journalism, money and economics, tech and privacy, politics and governance, and work and collaboration. And just look at the website. Check out the list of speakers that we have for this conference. I'm just blown away by the amount of interest and enthusiasm for these topics. So I'm just going to list off a few here.

Amesh Adalja, senior scholar at John Hopkins University. Azim Azar, the founder of Exponential View, the great newsletter which talks about long-term trends in the economy and an industry. Brian Bellendorf of Hyperledger, Ruth Ben Gate, who's a historian at New York University. She's going to talk about authoritarianism and the risks of authoritarianism postage. COVID. Jim Bianco of Bianco Research. Corey Doctoro, the author, Yaya Funnucci, who was on the podcast recently. Nick Grossman of Union Square Adventures. We've got Dr. Yelena Kegmenevich, who's a psychologist at Georgetown University, Riva Tess of Intel, Jeff Jarvis, author of What Will Google Do

and Professor of Journalism at CUNY. And the list goes on and on and on. Just check out the website, reset everything in that events. It's happening on 29th and 30th. Oh, that's That's another thing. We got so much response for this. We had to do two days instead of just one. So it's on Wednesday and Thursday of this week. It starts tomorrow as this drops, starting at noon UTC. So check out the website to get your own local time zone. It's set up so that when you go to the website you see in your local time zone when the talks are happening. And yeah, I'm looking forward to seeing everybody in there asking questions. We want to make it interactive. We want people to feel free to ask questions and ask their questions to these

experts. And yeah, we have about 700 signs right now and hoping to get to a thousand by the time this starts. It's come and join us for Reset Everything. We'd love to see you there. Security audits are a vital step for building security into your systems and helping your users, your stakeholders, not to mention your future investors, better understand security risks. And being transparent about your security audits and how you're mitigating vulnerabilities, well, that creates confidence in your product. Least authority, is a security consulting company that conducts software security audits of all sizes, from smart contracts to entire blockchains. And even if you understand the value of a security audit,

well, do you know what that process looks like? Do you know how a security audit works? Well, Lease Authority is here to help. They guide their clients through the entire process and help them demystify it and end up with a final product, which is a report that you can share with your stakeholders, your users, and the community. So if you'd like to get a better idea of what a security audit could do and could mean for your project. You should join the Least Authority Security Sessions Meetup. It's happening on Thursday, this Thursday, April 30th, and you can learn how to prepare for an audit and how to identify the auditing skill sets that are important for your project. To sign up, go to Leastauthority.com slash meetup. Once again,

that's on April 30th, and there will be several sessions throughout the day to accommodate for all time zones, and yes, you can go to security sessions and also to reset everything. Now, if you can't make the event for some reason, you can still schedule a free, no obligation call with them so they can at least walk you through that security audit process, and you can do that. It's really easy. Just go to the website, leased authority.com, and there's a big red button there so you can schedule a call, but do try to make the event. It's on the 29th, and it's free. You can register at leased authority.com slash meetup. Crypto to crypto trading has been around for a long time and Shapeshift is one of the pioneers in this space. Back in 2014, when we were just starting the podcast, Shapeshift was creating

the first usable crypto to crypto trading platform that allowed you to easily swap one asset for another like Google Translate. Well, they're still innovating, bringing you products that allow you to buy crypto a fiat, trade, track, and secure your digital assets. So to sign up, go to beta.shapeshift.com and here you'll receive 100 free Fox tokens. These tokens allow you to trade commission free. Each of the tokens is $10 in free trading per month, which means you start with a thousand bucks in free trading. You can connect your ledger, your treasure, or your keep key hardware wallet. It's totally non-custodial. And if you don't have a keep key, if you don't have a hardware wallet, I'll tell you how you can get a free one.

All you got to do is leave us an iTunes review. Go to episode. center.rocks slash Apple or just look for Epicenter in Apple podcast, leave an iTunes review, take a screenshot and email me at Keepkey at Epicenter.tv. TV and I'll send you a discount code for a free Keepkey hardware wallet. Right. So leave an iTunes review, get a free hardware wallet. That's the great deal, right? And you can also sign up at beta.com and you'll get 100 Fox tokens for free. So you can trade commission free. And with that, here is our interview with Stanley Kulachov and Mark Zeller. I'm here with

Stanley Kulachov and Mark Zedar. And so they're respectively the CEO and developer relations at AVE. AVE is a defy tool that allows you to do a number of things, including lending,

borrowing. And one of the things I think that they're probably the most known for in the space at the moment is flash loans because they've released a flash loan product. Now, flash loans at the moment is being discussed quite a bit, I guess, here at this conference and also on Twitter, et cetera. And we'll get into that during this interview. Thank you for joining me today.

Thanks for having us, Sebastian. So tell me a bit about your background and how you guys got involved in crypto. Yeah, so my story is pretty interesting. I used to be, well, I have always been a nerd out. Haven't we all? That's why we're here. Yeah, and basically ended up going into law school and liked rules and so forth, but was very intrigued by finance in general, more towards financial instruments and all crazy

things that you could actually do and create different kinds of products and ended up finding about Ethereum back in, I think, was 2016 beginning in Helsinki, Slash, which was one of the biggest startup events in the globe. And I just got more interested. I found the, kind of like, I understood the idea of smart contract technology, especially like the immunity and what it can actually bring into financial transactions. And that just got me into thinking like, hey, we could do pretty cool stuff with this. And let's do something with lending. And then we started EITLAND, which was, kind of like the legacy of AVE, that was the first landing protocol on Ethereum, and one thing

led to another, and then we came the Flash Boys. And Mark? Just like this guy, I'm a law school dropout. But he's not yet, so. Drop out to be. Keep faith. I've been involved in Ethereum since 2015, my good friend, Android Kurtz, which is around, talk to me about this new crazy Bitcoin where you can run code on. And obviously my first reaction is watershed coin. And then I've been to Reddit and then I spent like three months day and night into the rabbit holes. And we created Ethereum France with a few friends and that ended up like the ATC. So that's cool. And I work with Consensus on the variable project. We were trying to make stable coins based on derivative products. And I work for a French

brokers called Coinos, La Maison de Bitcoin for the French audience. Very, very ingrained in the French crypto space. Are you not? Yeah, ready. You've been everywhere here. And it's my pleasure to have joined just before the Devcon at Osaka, the Avey team for the release of the new protocol and their magnet. I'd be following Mark from, I think, 2016 with his, I mean that was also kind of like a

defy project as well, that Mark was building the variable and it was pretty cool to actually get Mark involved into AVE since Osaka and we have done pretty cool stuff and this guy got the best crypto swag

like ever. I want to I want to ask you briefly about variable, which you were working on with our common friend, Simon Polaro. Yeah. And so you think that that product was maybe a little bit too early for its time, or are there other reasons why it failed? So I think we learned a lot, and I think it's good for the industry. I see two main reasons for variable failure. One, yes, it was a bit early because we developed that at the end of 2016.

the product was ready in March, April 2017. It was like even before like the big pump of Ethereum and the crypto models. And yeah, we are an alpha with 300 users and it was going on. And I was one of them. You was one of them. But yeah, a bit early. And the second thing is that to tell the truth, the Mecca Dow model, the over-collaritalized loans is much easier to bootstrap than.

their adaptive product. And I'm very happy that Megadau prevail in this industry because that is a very cool product. MakerDAO is a great team. So absolutely no regret on my side. Just to stay on Variable, just one moment. Variable was building a stable coin based on derivatives. What derivatives? Because, I mean, at the moment, there was like a few derivative products in the space, but what were those derivatives or what did you intend for those to be? So the main topic today is Avey, so let's keep it short.

Sure, sure. So in Lehman words, when you have a short position and you match that with someone willing to take the option in the other side, you can create some sort of somewhat stability from that for a third users. And we were based on that. Basically, yeah, not open, but somewhat around that. Basically, when someone takes a long position,

someone takes short, you basically hedge that risk and you kind of have the same thing as the overcloudals, MakerDAO system with 200% of regularization. And I think the model was pretty cool. It's just like, for example, back in that same period, we were doing Eidland back in the days. And one of the problems we had is that we didn't have any stable points. And this was the time where MakerDAO wasn't there. That was variable, actually, but it wasn't that live. And let's say, USDT was on Omni-Chane, so it wasn't used.

at all. So kind of like it was the early days, but I think it's just about like bootstrapping. But one of the most interesting projects out there at that time. And I'm pretty sure that same model will be launched now. I mean, there's a lot of derivative products coming out, but pretty cool. Yeah, I think it will happen eventually. Like the situation is way better now to launch this kind of product. Sure. Yeah. It seems that the ecosystem is much more more. now, there's some sort of stable foundations, the use cases are starting to emerge. And the most important thing, there's actually volume on chain now, which was always the case, but not that much in 2016. One thing about the volume, this is something that I don't know

that everyone probably understands, but we are looking at the Dex volumes all the time, and they're growing. And now that we have the flash loans, what people are trying to argue that you should not use, let's say, Dex oracles when you're building systems. But one of the kind of issues are that the more you have Dex volume, the more you will have lending volume. And that basically means that the ratio will be always the same and you can do always the same kind of flash attacks if there is decentralized oracles. If you get your price from Uniswap Khyber, there will be always this kind of like BZX

type of attacks that we will talk about a bit shortly. And I'm not sure if people understand that yet and not sure how it will be solved actually. Let's talk about Abe for a moment and talk about what you've built and what you're solving in the space. Like what did you introduce to the space that wasn't there before? Yeah. So in the very beginning, well, it was pretty much first landing protocol.

It was OTC style, so whatever asset you actually have. you could just collateralize and borrow against and different lenders can take the risk. So after that, what we actually did is we noticed that the pooled model, now that we have stable coins on the ecosystem and there was successful pooled models, for example, Unisvap compound, we basically turned Eidland into AVE, which meant going from order matching, lending and borrowing into pooled model, where you can grab the liquidity instantly as a borrower, and you can just deposit as a lender and start earning, which is very powerful.

So just to sort of recap there. With a pooled model, you put all the liquidity in one pool. Exactly. Borrow is borough from that liquidity instead of matching directly like a borer with a lender. Exactly. And that was pretty, it was pretty much the idea of the compound model. And that was particularly the defy narrative at that point. And we wanted to expand the narrative.

and trying to think like how we bootstrap more liquidity. Because end of the day, the whole Web 3.0 network effect is liquidity. So you get liquidity when you know how to yield hack. So the thing that people are doing now is yield hacking, how you get more yield from your protocol. And that's why we see things like iron curve where people are trying to get more, more APR and APIs and more yield. And Flash loans was part of this strategy. So we introduced FlashLans. loans into the protocol to get basically more compensability and more earnings to the depositors because all those flash loans that are executed on the, there's the rest of the other guys waving. So the more actually there is usage of flash loans and people are building cool

products in different hackathons and we're not. Basically we get more yield for the depositors and since they're rewarded to bring the liquidity, we get basically more liquidity and we do this kind of like a yield hacking. Interesting. Can you explain a bit more of this sort of the yield hacking? Yeah, give a real like example. So I have a few land, which is all native tokens, and they are just sitting around. So I deposit that in Avey, obviously, because the rates are not very high, but I can use that as a collateral. And one of the cheapest stable coin we have, given the situation today, is T-U-S-D and U-S-D-S-D.

So I bought I used my land as a collateral. I borrowed some USDC. I swapped thanks to Gerve and at a very low sleepage, my USTC to USDT, which is Teter. And that USDT I deposited in iron.finance. That's going to switch to the best yield of the of Defi and and mint me some YSDC, which is the tokenization of a deposit in iron. And that why. USDT, I deposit that as a liquidity provider into curve. So at the end of the day, I borrow at five-ish percent some USDC, and I've got some USDT deposited, and I get the Aval yield plus the iron yield, plus the curve yield, and I end up with 23% APR. So I pay 6% and I get 23. And that's basically yield tracking and in DFI when you are aware of the opportunities you can actually make money with money. Are there any tools that sort of like simplify this sort of uh I have the feeling that the iron and curve guys are the best fit in the ecosystem to create this kind of stuff yeah because right now it's all about being able to monitor and understand what are the protocols out there what are

the risk because obviously when you write the yield of several protocols you also take the risk of several protocols and that's why the tools like defi the device core are really important they give grades to the main protocols and there's also defy zap doing this kind of recipes so yeah right now it's really manual but soon you will click one button and get them this kind of opportunity call them the yield riding actually it's better than the yield hacking and this uh what actually mark explained is it's kind of like uh semi somehow semi simple compared to what's coming up like you might have a transaction chain of or or just different it doesn't have to be like flash loans and everything in the same transaction but different kind of a thing that you are going to do you might

have 20 30 40 different transactions just to grab that extra yield and then you have algorithms running and doing. And I think because as I previously said that the liquidity is the network effect in Defi, there will be developers like Iron and Curve where they're building for end users to actually take that opportunity. Like a lot of things, what's the, do you think the upside for these teams is to build these tools or actually go and exploit these opportunities? What's the biggest upside for them? I think, well, I haven't talked with, about that with them, but I think they are also liquidity providers.

So the more liquidity they have, the more attractive the protocol is, and they earn the same yield than everyone. Like, when the incentive are aligned, that's usually good outcomes. Yeah, I think because like liquidity isn't

unlimited, it feels now in DeFi that there's enough funds everywhere and there's a lot of kind of like people in Ethereum that have, I mean, are whales and with flashed ones now everyone is a whale. well kind of like and and the thing is that it still will it will be unlimited i mean limited and you have to build for others as well to get that liquid it and it's just we can always look at the traditional finance and how the money is structured there and it's pretty much

will be the same in defy what other use cases are are you seeing on on ave aside from this yield writing what are what do you be using eflint for how alve is used from for example okay the very first thing is you deposit an error. That's like the very easiest way to start doing things. So you deposit, say you have like 100, you deposit it and you'll earn yield, say from like compound or from... Yeah, compound interest, basically. And stable coins are pretty cool things.

So we try to have very diverse set of stable coins because they bear less risk than compared to using different assets like that all. So basically we try to have very diverse set of stable coin offerings. And basically on the borrower side, you can deposit, let's say, Eid, that you're a long on, and then you can basically borrow a stable coin, leverage up by buying some other currency, or you can just convert it to euros or dollars and spend those funds in real life. And with flash loans, you can do crazy stuff. Like you can actually swap your collateral.

If you have EITs as a collateral, you can swap it to another collateral, for example, link, or you can just go 50-50 or whatever is your strategy. and do a bunch of other interesting things. Before we were talking about some of the applications for this, and one of them was refinancing. Can you just sort of explain how one would leverage refinancing and what the opportunities there are to get better rates? Yeah, so the most interesting thing about refinance is that, let's say,

we can take an example, you have a CDP open, well, make it outwalled, and you're paying, let's say, hypothetically, the stability fee is, for example, 8%. on dye. So you collateralize E to borrow dye. And now you have spent that die in real life. Let's say you have Baudai Ford Focus, right? And then what happens is that you see that there is at 4% the very same amount of loan on USDAC, but that's in, for example, compound. So what you could do actually, you could refinance returning that die loan by taking a flash loan from AVE, closing the CDP, taking that it that was collateralized, putting it into compound and taking USDC, and swapping that USDC into Dai in Khyber or UNISWP and returning that loan back to AVE,

and then you have refinanced yourself from higher interest rate to lower interest rate without returning the loan, and you're super happy now. I feel like in the video we need to have, like, you know, borrow die from a make, and then like just sort of like the steps so that people can see that's the very cool thing about an ecosystem of nerds is that all of those things all those interactions very complex transaction that are

based on 30 or 40 blockchain interaction for the end user you click on a button doing exactly that on collateral swap.com it's one click you don't even as as a user to understand what exactly is happening Obviously, everything is auditable, so if you want to dive down, if you want to understand what happened, you can see and follow the trails of money. But at the end of the day, for the EU user, they don't even know that complexity. They just know that they swap an 8% burden to a 4% burden, and that's cool for us.

And what was the project in 8th, London? One bridge, right? Yeah, one bridge. Yeah, from one-inch exchange guys. So basically, our collateral swap is based from swapping within Mecadau, and one bridge is swapping between different lending protocols, just like the example of Stanley. So this is not science fiction.

This is live today on Mainnet. And it's one click of the button. You don't have to be an R-Corp developer. You don't have to understand everything about DFI to actually do this today. Let's dive into Flash Loans a little bit more. So explain for our listeners what is a Flash Loan. And for how long has this idea existed? Is it a new idea in DeFi or has it existed in sort of traditional finance before?

Yeah, I think from traditional finance, I mean, there is occasions where you just need to borrow to settle accounts for very short period of time. The very, like, normal stuff can be overnight loans, but they might be shorter. Like in Finland, we used to have, we used to call this kind of like minute money where you need to open a company and you have to put €5,000 on the account. but you just needed to do it for that particular visit to the bank account. And then once you have done it, you can return those funds to whatever you borrowed them. So you actually don't need that capital, but you just need for a specific transaction. Now, in terms of the DFI ecosystem, there was a couple of previous iterations of flash loans. And I think as a concept, it's not that new because of the, I mean, the atomicity of Ethereum has been known from the very get-go.

But I think what made them pretty popular is that we tried to do the flash loans to the developer community and into the different hackathons. And that's why we see people building things and getting a bit of network effect. And what end up happening is that people are looking, okay, here's a very cool thing. How I could actually use to make a lot of money. And then we saw the hacks that happened on VZX. So you're saying that the recent proliferation of flashed, are the developer tools that have been built in part by AVE to make these things easily accessible. We basically improve the developer experience by a significant amount.

We also did advertise something that was existent but not very well marketed. So to tell the truth, it's during the BZX incident that I discovered that DOIDX had some kind of of functionality that can work like a flash loan and nobody was aware of like and we are specialists in the in the ecosystem and so yeah i think we the possibility were always here but we as we develop tools that are accessible on our protocol we unleashed the the creativity of developers And I think it's still early days. I think it's just we are, I mean there's on a daily basis from five to 15 flash loans a day with the other protocol. And it's fully utilized by compensability.

So it's not flash loans within our own protocol, but it's actually someone refinances alone. Someone does some sort of a margin trading, collateral swap and whatnot. And arbitrage is one of the big use cases. I think Mark will explain a lot of how about this. like we are seeing like this amount of flash long it really reminds me like the very early days of defy and et land where like we see like small loan transactions and and and just when things are getting bigger and there's more tools compatibility and then we will start to see like more and more utilization and that is the very momentum where you need to think of how you reward the liquidity providers

because at some point the the let's say a thousand eater 10 thousand eater might not be sufficient you might need more liquidity for the flash lending activity that will be happening in the defyx system. So just in AVEA, like last night I was playing around with the platform, when you go to the website, you can log in with your web tree wallet and you have access to the lending and the borrowing. The flash loans, though, are more of a sort of developer feature. Like you need to write smart contract code in order to execute this flash loan to build these transactions. Are you guys moving towards a product where it's more sort of click, more of a user interface, where people will be able to kind of compose their flash loans in the browser.

So I have two answer to that. The first one is we really see ourselves as a protocol. So we are really open to third-party developers, and we try to incorporate them. Basically, it's my main job at Avae to make the third-party developer life easier. and we really embrace the strategy that third parties can build upon our protocol DAPs that do exactly that and that's basically what is already happening like 1x.ag also done by the 1 inch guy allows you to use flash loan to do margin trading and that's

good part of the flash loan volume that exists today collateral swap all these kind of features and yeah, I really have the vision of the protocol and people built upon that. It's the world money, Legos, ethos, and I do believe in that. The cool part is like so many people have asked like, hey, is there like a dragon drop thing and to test it out? I want that. Yeah, exactly. Exactly. You and Peter was talking about it yesterday a whole day and I was thinking about this.

And actually Jordan from our team was trying to push really hard. forward with this that someone could build this kind of things and we have a very interesting developer community now it's growing super fast and it just i'm pretty sure that someone will do this pretty soon and and then basically you could just try to do different kind of like if this then that uh stipe yeah exactly that's what we need we need like if this and that for flash loans yeah yeah exactly should have a zapier final license well i i know for sure that jelato finance is looking carefully at are called right now and this kind of guys like defies up and yeah yeah definitely like gelato is building there if this and that so the very cool sign uh that this is happening is that we have to

remind ourselves that the protocol is live for two months like only two months yeah this is an important thing it's brand new like it just came out in only two months we already have like several cool live project right now on Mainnet that you can use one click of a button that tells something about the developer community that we are part of. People are actually looking at the calls. I have like dozens and dozens and dozens and thousands and hundreds of telegram groups with developers that are actually building every two weeks. We do the integration recap and there's new stuff happening every day.

So yeah, it's going to happen. And I think the collateral spot actually was born in a way that I was brainstorming and Telegrainty and saying, hey man, how does the collateral changing? Can I open a position with a little bit of BAT and a little bit of ether, like rest of an meter collateral? And Mariano said that that's basically not super at this moment. And I was thinking, well, actually, you could use flashinals probably to do this. And we're brainstorming a moment.

And then I made a tweet about this. hey actually this one of cool use case for flash loans that you could actually do and this kind of like collateral swap and then I asked like can someone build this thing and then there was David actually from our community well just came later to our community but with the collateral swaps but basically what was funny is that he said hey this looks interesting I will try to actually build this thing and then he just built it and yeah and there's like people are using it so it's just like it's a very cool period not just like for

national but for us as well to experience like how many people are like interested in trying to do different kinds of things that's just pretty cool. Interesting. Let's switch gears a little bit and talk about this recent attack

which happened just a few weeks ago over during East Denver. Yeah. Describe sort of what happened. Let's play out the scenario of how this attack was discovered and then we can I guess dive into the more ethical, philosophical.

How many attacks three or two in total? Well, two to the best of my knowledge. And third was a trial. Yeah. The first thing I want to say on this subject is that it's not an attack on Avey. Like sometimes we can see a... Because Avae was used? No.

No. No, okay. So it's not an attack on Avey. So Avey was not AAC. There's some confusion. a flash loan from AVE was not used So basically they used The Ninja loans

So I don't know the name they use of D-YDX which is Kind of flash loans But a bit more limited Because you can only do it I think in their platform And something like that And the second attack was the flash loan

From BZX So they had some flash loan somewhat So And they use that because BDX did not have re-entrancy prevention in the protocol. So basically, if you want to use AVE flash loan and use that liquidity inside the AVE protocol, or a smart contract architecture doesn't argue you to do that, because obviously you can do like some kind of circular logic issue,

and that's a bad practice to do that. And they did not have that. And that was basically the second hack. Can you talk about the specific attack and sort of how that played out, like the different steps or the different like transactions in the attack and how it was leveraged to walk away with a couple hundred thousand dollars? The first one was pretty straightforward. So basically they took a flash loan in it and basically converted to, I think,

WBDC was it that way? And then they pushed the price down in the decentralized exchanges, which affected basically the price of Uniswap to plunge on WBTC. And at the same time, half of the funds that the attacker had, he basically took a leveraged position in BZX. So he basically broke a bit their Oracle there and made money at the same time with the short position that was leveraged. And then that was pretty much about it.

So the kind of challenges that in BZACs, they took the prices from these interlaced exchanges, Khyber, which also routes stuff to the UNISFAP. And when the price was pushed down, basically that was the moment when problems happened. And because they had a short position on leverage, which basically means that they need less money to gain more money, they basically exploited this situation. So the situation that they exploited had to do, I mean, mostly with the fact that price feed on Uniswap for WBTC, there was only one price feed, I believe, right? And so it's more about liquidity.

It's not a Uniswap, like the V1 of Uniswap doesn't really have a price feed. Like the smart contract of Uniswap are pretty simple in terms of architecture. So basically, the only job of Uniswap is to keep 50% worth of one asset and 50% worth of the other asset. no matter the amount of units of asset A and B. And the only way Uniswap define the price is through market making opportunities, arbitrage opportunities. So if the price is higher or lower on Uniswap than other platforms, like they bet that people will take advantage of that to actually make money through arbitrage.

And obviously, when there's opportunity to make money, usually there's someone to take it. So it does work. But I will not say that Uniswap have any kind of oracle of price feed because it's like an arbitration-based price speed. Okay, but where was the sort of that? So the WBTC liquidity on Uniswap is quite low, so you don't need that much money to affect the price a lot. Okay, I thought there was something to do with price fees at some point there. It's the way the BZX. understand the price of WBTC, and if you can manipulate somewhat easily the price on Uniswap and

Uniswap is part of the price feed, then you can manipulate the price on BZX and take profit out of that. Okay. That's uniswap. It was the other way around. Okay. Yeah. Understood. It's not exactly this, but it's a simplified version of what happened.

What was the reaction to this attack and, you know, what was your take on what this sort of signals for the space generally. Yeah, I think the very big reaction it was, I mean, if you look at the big picture, it was basically there's risks in DFI and system are being built, not properly audited, and the thing is that the TVL, which is like the total locked value of a smart conject of a specific DFI protocol, they're growing a lot. Like every protocol has been growing substantially. And the thing is that when you have more and more this asset under management,

what you need to do is put more diligence and more audits into the code. And in this case also, especially the second attack, by the way, there was actually a third attack, but it happened a couple of months before. So in Vziacs as well, that was the one-inch guys actually exposing it. So what in the second was funny is that there was a poor implementation of the flash loans in that particular protocol and they got flashed themselves and it just shows that

even though the innovation that needs to be put into the space to keep it growing and keep it like moving forward it has to be done very carefully because you need to have really good protocols and the risks are too high and it just takes one protocol to go bust to lose the whole fate into the space and take two years to people regain interest again like we had with the dole hack We have to remind of self that this is not the beginning of 2018 anymore. Like, there's real amounts in the 5, 1 billion, a bit less due to the markets right now, but around a billion dollars. Like, we are a $28 million protocol.

Yeah. And audits take time. Audits are painful. And they're expensive. And they are crazy expensive. Like, nobody takes audits for funds. But if we do it, it's because. we, the safety is always of our users and the securities are top priority.

Do you think that causes a barrier to entry that a lot of projects can't? I mean, I know this was talked about last night at your event. The thing is like with the security that has been put in, I mean, I think office budget is like half a million a year on smart content artists solely. So it's, and it's just growing. And I don't think where is the kind of like a cap. And prices aren't going any lower. and we kind of have the responsibility to take more, put more effort to make sure that we have done things right. And that raises the barrier.

So in one way, like the flash loans, they're kind of reducing the barrier to enter and create products without liquidity. It's very difficult to overcome the security challenges. And I think that's, that is a barrier. And it becomes even more difficult to enter into the device base. I quite agree on that. I'm curious, if you have any thoughts about who are the losers? here. Of course, we can talk about the funds that were taken, but do you think that the sort of the space keeps taking a reputational hit every time this happens, or is it, you know, protocols

that are not well audited? And I mean, one thing that I was thinking about last night is this is maybe like a relatively new type of attack. You know, do audits even pick up this sort of thing? Or is it, you know, when they happen that all of a sudden now, like, smart contract auditing forms are looking at this specific type of attack and mitigating it? Yeah, because I mean, like the attack itself kind of existed because if you have the liquidity, you could do the same trick. But now everyone like, as Mark you wrote previously like now used to have like nerds and now you have like nerds with well like liquidity. And now you can actually perform that with technical knowledge, those kind of attacks. But I think every kind of like a hit is also an

opportunity to show like how things will be like how the aftermath is treated, how you communicate message and how you can improve things and raise standards. So every hit is also like opportunity to make things better and more resilient. I think so, right? Yeah, we we all have to learn in the context of is it too expensive to build on defy right now because you have to audit. I want to remind also that compared to the state of Ethereum in late 2015, or 2016, there's been a lot of job into standardization. So basically, let's say a stupid example right now, building a ERC20, you go to Open Ziplin,

the contract are there, it's like copy-based. In 2016, that was not as much the case. The standard ERC20 was already there, but the tools were not as good as today. And I think we are growing, like, more and more stuff are standardized, there's more and more open libraries, there's more and more code you can build upon like safe code, audited code, use code, tools from the community.

So it's easier and easier to get started. But yes, audits are really expensive, but every dollar spend there are well spent. Exactly. And wisely spent. So we accept that price gladly. Exactly. And what I like to add in Marx also, I thought, is that what's interesting that you don't need to build actually in infrastructure layer. You don't need to build another

alve or another compound because you have the infrastructure providers already where you can get the liquidity and basically there's the application layer where you can build a lot of cool stuff and with more quicker way and you don't need to have the of course you need to have very like high high security but basically it's not the same as in infrastructure smart contract level. So in kind of like noting that, that you can still be a developer, make a cool hack in like places like in London and so forth and actually just create a new product that people will use and that get audited. And I think simplicity is the key. We're building a lot of complexity, but we just need to find simple ways to build very interesting things. For example, a rate trader like iron.com, we are big fans of what Andre do.

When you look at the code, well, it's not easy to build that, obviously. But it's not that complex as an architecture because he leverage upon several protocols and just switch the money around. Obviously, you have to build things securely. But I think third-party developer can build the money legos, like build new layers on existing protocols, just like you say. Yeah, and Andre is a very smart guy. I mean, what he built is pretty cool stuff. And I mean, the thing is he's a one-man theme.

And basically there was a trade which had a lot of slippage and was not a hack. And I think there was a lot of people from the community just like attacking and asking, hey, what's happening here? And probably not even like users, but actually just people from the community. And there was like a lot of hysteria. And he wrote a blog post like, why building a defy sucks? Because like you try to do everything. And then people expect that you're 24-7.

customer service representative at the same time and you're a developer and debugging everything and we are building financial products i mean we if you're pushing something out there we we need to understand that as well but also it kind of shows that how much we have to grow as a people and have better human compatibility exactly we have to be better human beings and we have to learn the difference obviously if something happened with avi well it's my job to respond it's my job to be there, I'm on payroll and I'm really interesting to Avi and I'm gladly 24 hours service to respond to anything that may happen. But Andre is not, nobody payroll. Nobody pays for his service. Like, it's one guy, like, coding day and night to offer us free service to have like great

yield, like the best per yield on defy. And if the only answer, he is, like, like your support is not good enough, your platform is not safe enough. Well, obviously, it's going to step back from the ecosystem. And we all lose from that. And, yeah, I want to express my support to this guy. And all the guys that are trying to build upon protocols and on defy, you are welcome here. And we will do everything we can to support you guys. And Mark, Ray, it's a very good thing that because, like, what we're doing now,

and we're doing infrastructure level things, we kind of have to be very careful how we build things and put a lot of diligence because we also know that there's a lot of institutions coming into the space and looking at the protocols and wanting to engage with them and basically to make sure that we can onboard different size than institutions, they really need to feel comfortable.

Even though they're using trust as technology that they can verify instead of trusting, you're always running a brand game. Yeah, and just to finish on that subject, what happened on iron could have happened in the low liquidity pool of uniswap. Like the exact same scenario. If you bring too much liquidity in the low, too much money or assets in the low liquidity pool, you will have a huge slippage. It's not a bug. It's a feature.

The bug is that it did not implement sleepage allers, but sleeper jailers. but sleepage alert are standard for like six months in the ecosystem. It was not something for a huge time in DFI, and nobody told it was a huge issue. So no bugs. So just to end on this attack, and then I want to move on to something else, you know,

there's been some discussion around whether or not this is sort of ethical. And I think we've had similar discussions around things like the Dow hack, around the parody bug, and I like to ask you if you think these things are permissible and if the code allows for it are you of the opinion that code is law or other more ethical questions

that one should ask around these sorts of things? One thing we should ask with this question usually like is the code of law is also kind of like do we want to create something new or also like follow the old or something in between because the code is law is pretty new thing. I mean if you think about

like, I mean, if you do a hack, you hack a database, you steal a bunch of details, money, you commit a felony. And in that case, what it basically means that you have consequences. And if code is law and it permits to do that kind of thing, that's pretty funny. If that's agreed, I mean, in contractual, you can agree whatever, almost. But the thing is, in that case, it will create pretty interesting dynamics, as I was mentioned about the kind of like creating the Robin Hood hackers who are just hacking protocols, making them more resilient, but also they will walk away with the funds. So the consequences can be devastating as well. And I'm not sure that people will, all defy users or general public would actually be okay with that, at least this point.

There's two answer to that for me. Like on chain, yeah, God is low. Because the protocol should be permissionless. We should not have KWC at the protocol level. We should treat everybody equally with exactly the same rule defined by the protocols, defined by the codes, But I want to remind everyone that law is an actual thing in the midback ecosystem, like in the physical words, there's law, there's informants, there's jurisdiction. So if you commit on-chain a felony, and that is proven to be a felony, you might have to face legal consequences. And that's two separate things.

That doesn't mean we don't have law enforcement on-chain at the protocol level, that we cannot have it off-shane. And I would also like to say that there is a good saying by basically, I think, A6CNZ, that the basic software is hitting the word. And I like to sometimes think that at some point the law will lead the software. I mean, because things will happen on chain that people will either expect or there will be just so devastating consequences that you have to do something or have someone basically take the consequences. And I think governance itself is a very, very good tool. If you think about governance, I mean, on-chain governance where people can vote, good decision can be made.

And there's a very good history in the Ethereum space where something has happened or you have to make tough decisions and the Ethereum as a community comes up, steps up, and basically make decisions that they feel that are rationally the best ones to do at this point to go further from that particular moment. So I definitely think that if you want flexibility, governance is the key and you have to have a way to govern your protocol. And that's like something that we are now working at OV. Like how we can make sure that this protocol that is open source that we are giving to the

public, how we can, all the stakeholders that are involved with the tokenomics and governance can actually participate and we have measures to follow if something big happens. Let's then switch gears here and talk a little bit about privacy. And I'll start by asking you, you know, why would we want privacy and defense? So just to disclaim, me and Mark, we are privacy experts, right? Obviously. Well, at least the app, the trust community apps say so. We have a lot of badge of privacy somehow.

No, but I mean, so last night you spoke on a panel about privacy and defy and you made some interesting points. And I think that one of the things that a lot of people don't consider is so the technical and design challenges around having privacy and defy. and I'd like to get your thoughts on, you know, what are those challenges and how are they different from, you know, applying privacy, say, to layer one, like, you know, for something like ZCash. I always start with a reminder. We are trustless, permissionless protocol. So basically, if you want to use Rave, you don't have to ask the permission to anyone. You have a WebTree wallet, you have assets. You can interact directly with the protocol. Even our app is just a front end. If you want to interact with, the smart contract, you can find them very easily online and interact directly. We don't know at all who are our users for its just addresses. So obviously it's pseudonymous, like law

enforcement can do some chain analysis and end up finding the guys, but we are not doing this work for us. And it's really important for us to be as neutral as possible because we offer a technology as a protocol. Yeah. And that's a good point because the, the, kind of like accountability. So if you see everything in the public ledger, that's big. That's one of the coolest things ever. So basically, you actually see if there's any disparity under democratic decisions. You will see like lending rates of each on-chain protocol and trades and everything. So you can actually like the coolest thing about the whole like Ethereum blockchain at this moment is that like it's auditable by anyone. But as we are moving more and more into this kind of like a DeFi

economy, we're getting basically paid salaries and stream salaries in crypto. We're getting payments. We're doing interactions. People are starting to see what kind of like a financial profiles we have. And that's also something that we want to get away from. Like we are coming from a era where we have tech giants using our data and selling that data and selling our attention and basically making profit out of it. And we want to go away with that. And that's like why privacy is very important. And that's like, from technical perspective, it's not easy to do. And also, privacy might be not something that everyone needs now. That's why what we are looking at privacy and working at Avae is basically to apply that privacy technologies like ATS-Tech into the landing pool structure.

So if there are people who want privacy, we have separate pool for that and where the assets are and transactions are sealed. And then we have a more general pool and just like customized things. And that boils down of having different kinds of offerings. and different kinds of pool for various reasons, and privacy is one of these reasons. So how does that work, the sort of private pool? So the coolest part about the AVE protocol is that we have a pool manager contract. So basically, we can create different kinds of pools. And based on the tokenomics, those pools are governed, what kind of assets we can inject

into this AVE protocol and different pools and how they will be insured in the future, for example, if there's different kinds of bank run risks and so forth. So what is the cool part is that with the same smart contract infrastructure, you can create completely new pool. And by the governance, you can decide, for example, what kind of assets you could basically inject into this particular pool. And to have privacy, you could basically create another alternative pool to what we have and basically use ZK-based assets there. For example, ZK-A-Di. So if you deposit ZK-Di, you get in return ZKA-Di and other ZK-based assets. So that's like something that we're doing a lot of research at the moment.

And I think that will be a very cool experiment. Is this similar to the concept of a dark pool? Darkpool is more about kind of like an OTC marketplace. But the cool thing about dark pool is that the reason why people go OTC, they want to bank large trades, so if they want to sell or buy, and also that they want to hide their liquidity from the market and not affect market movements. and I think dark pools, I mean, privacy technology in dark pools is important if you want to achieve one of the biggest goals there.

So I would say it's like a big dark landing pool, but you should actually name it like dark, dark of a pool or something. Black ghost. Yeah, black ghost. And to roll back to the ZK-Eidi, I think it's like I'm really interested into that project and I hope it will come to light on main net in the next few weeks or at least months. because to me it's the ultimate form of online cash because it's one-to-hand with the dollar because one adi is always worth a die and it grows directly into your wallet so it's interest-bearing it's also private and yeah it's like the perfect tool for online money do you think that that privacy is something that the theorem space is focusing in

on and specifically with regards to defy. Do you think that the defy space is focusing enough on on privacy or would you like to see more efforts there? I think not at this moment. Not as much as this moment. And that's where you understand the difference between several blockchain ecosystem. Like for example, in Bitcoin, they have so many cool tools. They have wasabi. They have samurai wallet. They are wheelpool. They have the coin joined protocols. They have so many stuff. And if you, you want to mix your coin on Bitcoin, you just download the samurai wallet and you do it from your wallet. It's super easy to join a pool, super easy to mix, super easy to spend, super easy to

deposit your Bitcoin and go to the Lightning Network. Bitcoin is really focused on that. I will say as the opportunities to build things are wider in Ethereum, the focus is not as much directed into privacy. I do believe it will happen eventually. because right now it's magic internet money for a lot of persons. But since we have the stable coins and stable coins are becoming more and more a thing, we're starting to understand, well, if you look at my ENS address, that is very easy to find, you will see exactly how much I earned at Ave every month. You can check my address and you can know my salary.

Yeah, and that's where I copy mark strategies on yield hacking. So basically, yeah, some people watch all. chain what I do. You can do so like, you know, front running. You can do, of course, like you can look at one's salary or figure out like, you know, one's positions on things. But like you can also copy strategies.

So someone could build a system whereby they're like scanning the blockchain, figuring out which strategies people are executing. And you have sort of like you build like a decentralized E Toro copy trader type type of function. Without the scam part. Yeah. Yeah, that will be cool. I think there's like...

Set protocol is working on that, actually. Yeah, it's pretty cool stuff. You can basically follow others, and the social trading is pretty neat that they came up with it. And they're actually thinking about utilizing flash loans for basically closing a reopening position.

So I think the whole space is exploded with the flash loans, and I just can't wait to see more stuff. But in terms of the privacy and what you can do, there's a lot of features. especially in trading with the front running, for example, that if you have some interesting transaction that you want to prefer and someone basically scans it and just front runs your transaction. And I think it's becoming even like a business. I keep hearing all the time that,

okay, I wanted to make a transaction and someone front run at me. And that's pretty crazy. It happened to me in other contexts in the clearest context. And basically, yeah, they are doing like generalized frontrunner's script that monitor. the Ethereum main pools and Front Run new if the trade is profitable to them. That's somewhat an issue for Ethereum in midterm that can turn into a issue. Not a real issue right now, but it can turn into an issue. But obviously the good thing is that that can be mitigated. You can create some kind of only ports, fake transaction, do some beating gas worlds.

There's a lot of stuff that can happen. But yeah, it's quite interesting this ecosystem where everything is already-de-boned. Like, it's a brand-new thing that never happened in traditional finance. Like, nobody was aware of every single transaction. I don't know if you will turn into a dystopia or not. Like, all the opportunities are open at this space. There's so many cool things, you know, and I just like, we can't even imagine what's happening like within a few months

because things will change a lot. I mean, it's just, it's a space that just, keeps evolving and evolving. That's the coolest part here. So one final question before we wrap up here, and this kind of comes back to what we were talking about earlier, and we did touch on it a little bit. But I'd like to get your thoughts on the speed at which things are evolving. And obviously that has many positive effects, because we're seeing a proliferation of applications and there's a lot of innovation, and people are doing really cool things and building like a lot of really cool things. And that's happening here at this

event. And, you know, just in the last month with like, East Denver, East London and now like ETC, there's just like a lot of new stuff being built. So that's really cool. And it's like, it's interesting to see that. But at the same time, there are risks to that. And like one of the, one of the risks is attacks. Like this one or others, you know, the many other types of attacks that have happened in the past. What advice do you would you have to give the space with regards to, you know, how the ecosystem as a whole should innovate, yet at the same time, be cautious, say, of overzealousness and moving a little bit too fast, perhaps, where we end up in situations where types of attacks like the one we talked about can happen, or we

fall into a dystopia, or people are arrested by the... I was talking to John Shepton, Julian Sonsz's father yesterday, and, you know, where he talks about... talks about a situation where if people in the Ethereum space are building things that go against the interests of, say, governments like the U.S., well, they can get extradited, just like there are many sort of computer scientists that are facing extradition to the U.S. at the moment, Julian as well. Yeah, I think, like, that's the thing. That's the thing.

We're building things maybe a bit too fast, but innovation is something you can't slow down easily, and you shouldn't be able to slow it down because that's in your interest. but the thing is, like, part of that innovation, like the security is very important. And also, like, if you look at the whole regulation space, that's like, that's the next thing. I mean, now all the DFI protocols, they are building towards more decentralized direction or journey. There are protocols with admin keys, for example, but still they have, like, a plan to be more decentralized, and they have a reason for it. So there are a few decisions where you basically might have a safe harbor for a protocol that is sufficient to decentralize.

it avoids a certain type of regulation. And I think people are now building towards that direction. And if there is, will be in the future in this kind of safe harbor, when this kind of like grayness of regulation goes out and there's more clear rules, what will be interesting is that a completely new economy will be born. But if you go to a same path where basically everything needs to be KYC'd and everything will become very, very regulated, we actually are just running very expensive my SQL databases and that's not the kind of thing what you can achieve with defyne and the

blockchain technology that's not what I sign up for yeah yeah I want out if that happens yeah yeah that's why it's really important to keep the itos we are decentralized and perimisonized okay we see obviously on those money negos we are you can build a layer two layer three and something that has a great ux you you can put your passport in and And down the way, it's the money and supply to Ave and then there's new Midenments. At the end of the day, it's the first time in financial history that people have choice. If you want to dive and understand what is Web3, you don't have to use that fancy, easy thing that takes some commission. And you can download Web3 and go directly into Ave.

And we have the choice, and that's brand new, and we should embrace it. Cool, that's a great note to end on. Thank you for joining me today in the booth. And enjoy the rest of the conference. Thank you very much. Thank you for joining us on this week's episode. We release new episodes every week. You can find and subscribe to the show on iTunes, Spotify, YouTube, SoundCloud,

or wherever you listen to podcasts. And if you have a Google Home or Alexa device, you can tell it to listen to the latest episode of the Epicenter podcast. Go to Epicenter.tv slash subscribe for a full list of places where you can watch and listen. And while you're there, be sure to sign up for the newsletter, so you get new episodes in your inbox as they're released. If you want to interact with us, guests, or other podcast listeners, you can follow us on Twitter. And please leave us a review on iTunes. It helps people find the show, and we're always happy to read them.

So thanks so much, and we look forward to being back next week.