Unchained - The Mango Markets Attacker on Whether His 'Trade' Was Ethical or Not - Ep. 413

Episode Date: October 28, 2022

Avraham Eisenberg, blogger at DeepFi Value – more commonly known as the Mango Markets attacker – shared his insights about the exploitation of code, his personal story, and why there’s hatred directed towards profitable traders.    Show highlights: Laura’s description of the Mango Markets exploit the way in which code gets used in a different way from the original intention why Avi decided to return part of the funds he got from exploiting Mango Markets Avi’s clarification of a misconception regarding the bad debt of Mango Markets the difference between arbitrage trades and exploits why people making profitable strategies are hated, according to Avi how Avi got into crypto and the story of his failed online business  whether it is possible to run non-zero-sum games what he thinks of Compound’s decision to pause activity on illiquid assets     Thank you to our sponsors! Crypto.com Ava Labs   Avi Twitter DeepFi Value    Mango Markets exploit Explanation of the exploit “Highly profitable trading strategy” Twitter thread Mango Markets $42M Reimbursement Proposal Passes Mango Markets Exploiter Returns $67M After Revealing His Identity Mango Markets Hacker Proposes Keeping $70M ‘Bad Debt’ As Bounty Solana’s Mango Markets Sees $100M Drained in DeFi Exploit Previous discussion of Mango Markets on Unchained: The Chopping Block: 'Code Is Law' Is 'Obviously Not How Anything Works Ever'   Avi’s online business storyCompound Votes to Pause Activity for Illiquid Crypto Assets   Learn more about your ad choices. Visit megaphone.fm/adchoices

Hi, everyone. Welcome to Unchained. You're a no-hype resource for all things Crypto. I'm your host, Laura Shin, author of The Cryptopians. I started covering crypto seven years ago, and as a senior editor at Forbes was the first mainstream media reporter to cover cryptocurrency full-time. This is the October 28th, 2022 episode of Unchained. Get hot takes on crypto news every other week on the shopping block. Watch the live stream with Crypto Insiders, his Zeeb Qureshi, Tom Schmidt, Robert Leshner, and Turun Chitra. The latest episode is on YouTube and all podcast platforms. Avalanche was built to provide a robust Web3 infrastructure with flexible tools, so you can build anything you want, any way you want. Visit avox.network to discover how you can. With the crypto.com app, you can buy, earn, and spend crypto in one place. Download and get $25 with the code, Laura.

Link in the description. Today's guest is Avraham Eisenberg, blogger at Deep Phi Value, and more commonly known as the Mango Markets attacker. Welcome, Avi. So I should let listeners know that Avi agreed to chat with me as long as I did not ask him direct questions about what happened on Mango Markets. So I'm just going to give a little bit of an explication for those of you who don't know what happened here. Some people called this a hack. Some of them called this a market manipulation. Avi tweeted that he believed it was a highly profitable trading strategy.

Essentially what happened is that Avi and a team he was working with took out $114 million on mango markets that was not meant to be taken out by them. The way that this happened was that he essentially had a loan and he drove up the price of the collateral so that he was able to take out much, much larger loans, which effectively wiped out all the value in mango markets. A slightly more detailed description is he just funded one account with 5 million USDC. Then he offered 483 million units of MNCO perps. He founded a second account with 5 million USDC collateral and then took out a huge long position

that moved the price of the MNGO spot market. And that was what enabled him to take out the huge amount of loans and effectively drain Mingo markets. This kind of thing happens a lot in Defi where there's kind of an intent behind the code and then a way that the code actually works that differs from that intent. And as we just mentioned, some people would have said what you did was a hack or market manipulation. You called it a highly profitable trading strategy. So in general, how do you view these events when the way the code actually functions as different from the intent? So first of all, I think a lot of these, just speaking of generalities, sometimes it's very

unclear what the intent might have been. Sometimes the codes doesn't match the docs. Sometimes the docs say something and it's just not implemented. And sometimes the code does exactly what was intended. It's just that what was intended isn't what anyone wanted, which There's a couple of different lines. Like for a lending platform, they're willing to lend whatever the price of the token is. There's no intent that this depends. It kind of explicitly depends on what the current price of the token is.

There's no intent that the price of the token should be non-volatile. It's hard to say, oh, the intent was that the token price should never change. I mean, crypto prices change all the time. So it's kind of hard to even define where your intent is in some of these cases. It kind of would partly reject the premise here. Oh, so you are saying that essentially because the loan was taken at the time that the price of MNGio was reflected, you know, at what other people perceived to be this unfair or manipulated price that you were saying, that was the price and therefore taking.

that amount of loans was like a fair and square deal or any situation that resembles this? Well, I think in general, you'd have to define if a protocol uses, for example, a twop, then their intent is that the average price of a particular token over a particular period of time is what they're going to price off. If protocol uses it, a spot price. Twop is time-weighted average price or something? I forget what that's right. Okay. An average price over a period of time. Or some protocols will use the instant price. It won't take an average.

But whatever methodology they used to determine the price, that's what the intent is. Now, if you were able to get it to recognize a price that didn't reflect what the actual average price was or what the actual spot price was, then it could be said that you're doing something that doesn't reflect the intent, But if actual price was that way under whatever rules they had,

and it's not clear what it means to say they're not. It doesn't reflect the intent. It sounds like, I mean, again, this goes back to how in your tweet you said that you felt that this was a highly profitable trading strategy. And maybe this takes us to sort of the next kind of event in this story, which was that you then made a proposal to return $67 million to investors, as long as they agreed to a condition, which we'll talk about later. But just overall, like, when, because it's, you know, this isn't the first time that a hacker has returned some of the money.

So why do you think that people who are in this type of situation offered to return some amount of it back? I mean, I can't speak for anyone else. In this case, as I stated publicly, I wanted to ensure that other users weren't hurt. And so I helped negotiate the settlement and make sure that everyone, well, the users of the platform would be able to withdraw, even though the platform was technically insolvent. And so why not do something a little bit more similar to what someone like Samsung does, where, you know, you identified something in the code that would enable one person

to, you know, kind of profit from it at the expense of others. And with Sam, you know, as I'm sure you're aware, he often will either warn the community about these kinds of potential attacks or he'll try to, more often, he'll try to rescue the money before someone can exploit those situations. So why not approach it that way instead? I think he's mostly looking at different kinds of stuff. I'm mostly looking at arbitrages and trades and he seems to be looking more for exploits. So I don't know that it's darkly comparable. You know, also, if you believed that what you did was legal, then why is it that you decided to return some of this money? For what I said earlier on that, I wanted to ensure that the

users would be able to withdraw and access their funds. Okay. Well, one other thing that I wanted to ask was there was a condition that you had on returning the money, which was that Mingo should repay some bad debt that it used to save Sond in June? Yeah, that's a misconception. I think someone at some firm told someone to one of the journalists and just went everywhere and it has no basis in reality. As far as I know, Mingo did not have significant bad debt as a couple of weeks ago prior to whatever happened.

The Solent thing is just a, I don't know where it came from. So, yeah, the settlement was just related to the current insolvency or the insolvency as of a few weeks ago, and was trying to make sure that users would be able to recover funds that had been deposited at the time. And nothing to do with Soland and nothing to do with the account that moved over from there. That wasn't bad to dead as far as I know. Okay. And so in general, when we see these kinds of situations, you proposed what some people view as an extremely high bounty amount. And I was curious for your thoughts on how these kinds of bounty amounts should be decided. I mean, I don't really view it that way. I think bounty is kind of more relevance to different situations. So what term would you use?

The ultimate agreement, as I said, was a settlement to ensure that users would be able to recover funds and the exchange would remain capitalized to continue operations. It's not, it was just something that all the parties were able to agree on. Okay. Yeah. And ultimately, it was 47 million that was decided upon that you and your team would receive. Is that correct? It's somewhat more complicated in that because of initial capital and other various things. And I can't really comment on the specific numbers. Okay, right. I think I saw some commentary that you had spent about $10 million on the attack, therefore it would ultimately be $37 million. Okay, so in a moment we're going to talk about some other conversations that were happening around this event.

But first, a quick word from the sponsors who make this show possible. For years, you've heard about the promise of blockchain technology. and yet high fees, security risks, and unreliable chains have been the reality. It doesn't have to be this way. Avalanche believes innovators deserve Web3 infrastructure they can count on, with the flexibility and tooling to build anything they want, any way they want. Chosen by global leaders like KKR, Deloitte, Lemonade, and MasterCard, Avalanche has built a strong reputation as one of the world's fastest, most reliable blockchains.

To learn more about Avalanche, visit Avox.network or follow on Twitter at Avalanche Avox. Explore the platform millions are using for its speed, stability, and scalability. Avalanche, create without limits. Back to my conversation with AVI. So I was curious, you know, one of the conditions was that the Dow agree that no criminal investigations would be pursued against you or your team. And I was wondering what your thoughts were on how much influenced Dow's really have over that kind of situation. Yeah, I can't comment on the legal aspects of this. There's a settlement agreement.

And the terms of that are out there. It's able to count beyond that. Okay. And I was also curious, and this is probably also for other people. a similar situation to you. But what are your thoughts on, you know, people who, I guess, perpetrate these types of economic attacks or these, you know, types of arbitrages? What are your thoughts on how comfortable they should be about coming out and claiming that they were part of those trades? I mean, I think when there's any profitable trader is going to attract some jealousy

and some hate. And like you look at some of the stuff people say about Sam, and, and And he's obviously made billions of dollars with various hard of profitable trades. Yeah, and he gets lots of hate. Wrecked had a whole article. Calling came out recently. Yeah, if you're out there in your public, you're kind of painting a target on yourself. But here's what it is. So you feel basically people are going to hate on them anyway,

so they should feel comfortable just owning who they are? Is that the conclusion? Yeah, I mean, I have a post for almost a year ago talked about some of my profitable arbitraishes, NFT swipe, sniping, interest rate arbitrages, other lending protocols. And yeah, some people weren't happy.

I remember when I was, when I was flipping NFTs, people were annoyed because the bots, which I was running a bot, was making it harder for people to win their own gas wars. So I was getting ahead of them. And there's a lot of hate for that, for, for sculptors. It's like, if you ever

look through the farms, there's always hate for like ticket sculptors. Well, there's some selection of people just don't like seeing other people make money, is what it is. That is true, actually. I'll definitely agree with that. So I was curious, can you just talk a little bit more about your history with crypto and, you know, how you came to be so just highly skilled and knowledgeable about Defi?

So I've been coding for a long time just kind of as a hobby. and I got up to crypto early 2021. I was going to prediction markets. A lot of fun on the polymarket back in the day. They're a prediction market on Polygon. And then I started looking into yield farming. I started looking into NFTs back when they took off last year. And I just kept researching and figuring out how ERV 1559 works,

which is key to the NFTs. You have to figure out how to get the cheapest gas possible. I had to figure out how the different chains worked. Everything moved so fast last year that everything was kind of happening at once and you just have to learn all the protocols. And then over time, you kind of just get used to it. There's less and less novelty. And every new protocol is a copy of the same three protocols.

So it takes less and less time to pick up. And then you just, you find the loopholes. You find the arpe charges. And it's a very wide variety of trades as you can see from my blogs and my tweets. You know, I have to say that I'm absolutely amazed that you only got into crypto in early 2021. Yeah. Well, that's when I got really serious. When I was like 19, I think I was doing arbitrages between Coinbase and Circle.

Back when Circle used to sell Bitcoin, it was like, you would buy Bitcoin for $500. And then you would sell it for $5 and Circle and send it back to the bank. This was, I don't know, 2014, 2015, something like that. And then I gave it all up and I quit and I sold all my bitcoins. And now they're way higher. And then I kind of got back in last year. When was that period when you sold like 2015, 2016 or something? I was doing this arbitrage.

I remember looking back in my emails, and like at one point I had 13 bitcoins back when they were worth $200. And then I think I had like three bitcoins kind of left over. And then they had this incredible pump. And I sold all my bitcoins at $2,500. So that would have been, I guess, early 2017 during the first kind of. I was the second bull run, the first kind of institutional one. And then I said, no, I got it.

I'll take my $8,000 or something. And I went into other areas. And I didn't look at crypto for a few years. Where the crypto went down? I went to say, hopefully it goes below $2,500 so I can feel good about, you know, sell. And if it never went, like the lowest it went was, what, $3,000 in March 2020. So, well, you know, so you talked about how you've been to coder all your life. And I was curious because when you tweeted that you were taking responsibility for this maneuver, Ari Paul tweeted a friendly suggestion to you that you, quote, spend your talent building instead of playing zero sum or negative games. And then he said that he felt you would have a lot more pride in what you had done with your life in the future. You responded something about how you've always. You've

already thought about this. Can you elaborate on that? Yeah, so I mean, I talked about my earlier e-commerce business, which was building, but that kind of got destroyed. How? So it's, there's still some active litigation, so I don't want to get into too much detail on that. But basically, we were selling a few million dollars a year on Amazon, and one of our competitors just shut us down and build Amazon false things about the quality of the products and got the account shut down. And that business was over, basically. Very nice to roll out there. So basically that kind of made you feel that it was impossible to make a living in, you know,

what Ari would call like a not zero-sum game? Is that what you're... I think it's definitely possible. It's just very hard to actually enforce your rights. Legal system is extremely slow. I guess I feel that once I had that experience, I'm just going to... I'm happy to get into any industry, any area.

And I'm not so concerned about building distinction. It just doesn't feel that I need to care about that. I care about running my business and trades and whatever properly. And I'm sure everything's by the book, but I don't see this kind of artificial builder distinction doesn't really seem relevant to me. So, I mean, you know, you've argued in our conversation, you know, that what you did was just a trade. or an arbitrage. But as I'm sure you're aware, a lot of people, as I mentioned, view this as Mark of Nubulation. I mean, you're here on this interview, but you're wearing sunglasses.

I'm sure you're aware that people would at least view what you're doing as being more like a gray hat hack, if not flat out black hat hack. And like you said, you know, you would do this interview as long as you didn't have to actually talk about the event. So doesn't that sort of show that you understand that there's some risk here and that maybe this isn't fully on the up and up. I mean, I can't talk about that because there was a settlement's agreement, like I said, and go to details on that, unfortunately.

Okay. Well, let's talk about something else, which is that this week compound decided to pause for assets that have low market liquidity. And basically, that was because they didn't want to have the kind of event that happened on Manko markets. And I was curious to hear your thoughts on the fact that, you know, essentially what you did with mango markets is what prompted this change. I guess that and maybe, I mean, I was also tweeting various potential trades in AFA and others.

I think that it's good that the various big protocols have taken a closer look and decided to clear off some of their lower quality collateral. I'm a heavy user of some of these. Ava, in particular, I've used heavily. have many good trades with Alpha, and I'm happy that they're starting to clean up their risk exposures. Even though that basically removes these kinds of opportunities for you? Well, I've had many other opportunities with Alpha. The interest rate arbitrage on Ample from a year ago, I used them to borrow UST, extremely profitable. recently I did this great

FW AirDrop play with Alpha just powered a few million worth of F and then before the moors after the moors I got this free FW that I could tell You're like a mini Kevinzo

There's Avers just had a lot of cool opportunities over the year and I wouldn't want them to get trained All right. Well, last question. Is there any particular message that you have for the defy community or the crypto community in general? I don't think so. No. Oh, like nothing about maybe, I guess, shoddy construction of these smart contracts that enable these opportunities, nothing like that.

I mean, I have opinions on all this stuff, but I don't have this any kind of overarching narrative. All right. Well, is there anything else that I didn't ask you that you'd want to say? No. Okay. Well, thank you so much for coming on Unchained. Thank you for having me. Don't forget. Next up is the weekly news recap. Stick around for this week in crypto after this short break. Join over 10 million people using crypto.com. The easiest place to buy, earn, and spend over 150 cryptocurrencies.

Spend your crypto anywhere using the crypto.com visa card. Get up to 8% cash back instantly, plus 100% rebates for your Netflix, Spotify, and Amazon Prime subscriptions. Download the crypto.com app now and get $25 with the code Laura. Link in the description. The scorebed app here with trusted stats in real-time sports news. Yeah, hey, who should I take in the Boston game? Well, statistically speaking. No more statistically speaking, I want hot takes.

I want knee-jerk reactions. That's not really what I do. Is that because you don't have any knees? Or? The score bet. Trusted sports content, seamless sports betting. Download today. 19 plus Ontario only.

If you have questions or concerns about your gambling or the gambling of someone close to you, please go to conicsonterio.ca. With Amex Platinum, almost every purchase made with your card can be covered with points, including new tastes, new fits, and virtually everything in between. That's the powerful backing of Amex. Conditions apply.

Thanks for tuning in to this week's news recap. Reddit onboards 3 million users to NFTs. Since the launch of Reddit's NFT marketplace in July, users of the platform have created 3 million wallets, according to Reddit chief product officer Polly Bot. The methods by which the social media platform achieved this adoption in such a short time caught the attention of many. The company's strategy was to avoid blockchain terms like crypto or NFTs.

Reddit refers to NFTs as digital collectibles and only briefly mentions that they will be available on the blockchain. With the more user-friendly approach, trading volumes have soared over the past few days, reaching a sales volume of $2.5 million on Monday. Kane and Linder, co-founder and CEO of Gaming Company Stardust, told the block, I think that decontextualization, that these are just games, these are just collectibles, these are just items you can take from one game to another, it's going to make this technology so much more accessible.

Updated policy terms give Apple a hefty cut of NFT app purchases. Tech Giant Apple updated its App Store policy terms to give more clarity on how to sell NFTs and crypto within the iOS ecosystem. As per the new terms, applications offering terms, trading of NFTs will be restricted from including buttons, external links, or other calls to action that direct consumers to purchasing mechanisms other than in-app purchases. Although Apple is showing interest in working with crypto assets, it seems determined to get its share, which is 30% of all in-app purchases, a fee that has long been criticized. Daniel Mason, partner of Framework Ventures, tweeted that this decision harms NFT marketplaces like

OpenC in Magic Eden or, quote, anyone trying to get in the payment flow. Mr. Mason also mentioned that the winners are likely to be crypto exchanges, web three games, and infrastructure providers. NFT royalty drama continues. Looks rare, an NFT marketplace on Ethereum decided to remove mandatory royalties from its platform, joining others like pseudoswap, X2Y2, and Magic Eden. Instead, each quarter, the protocol will distribute to creators 25, percent of the platform fees charged by Looks Rare. The pseudonymous Looks Rare co-founder, known as Guts,

said, with this change, looks rare wants to buck the trend with our solution that actually enforces income for creators, while still remaining attractive to traders with an effectively zero-fee offering. It's a way to turn all that zero royalty volume into something that still benefits the creators. In related news, a new research report from Galaxy Digital showed that Nike and Yuga Labs are the entities that earned the most in NFT royalties, raising the question of whether small creators or big corporations benefit from royalties. MakerDAO partners with Coinbase, but not everyone is on board. OG decentralized lending protocol MakerDAO had some interesting developments this week. First, the community ratified a Coinbase partnership, which consists

of depositing $1.6 billion worth of Maker's USDC into Coinbase Prime, the exchange. its institutional arm. In this way, Maker will earn a 1.5% annual yield, which will account for $24 million of revenue per year. The decision was not supported by everyone in the Maker-Dow community. Chris Black, a recognized delegate and community member, tweeted the proposal, quote, will permanently end Maker-Dow's claims of decentralization and censorship resistance. Second, a governance proposal was passed to support the endgame plan of Roon Christensen, the founder of MakerDAO. As a consequence, the Dow will break into smaller units called Meta-Dows, with the intention of building a more decentralized project. Lastly, the community also voted in favor of a

plan to accumulate staked ether or steeth, Lido's liquid staking derivative of eth. A jump in prices triggers talk of a bull market. The crypto markets experienced some relief for a couple of days after weeks of falling prices. Ethereum jumped by 20% in the past past seven days, reaching pre-merged price levels. Meanwhile, the price of Bitcoin rose 8% in the same period, and the total crypto market cap surpassed the $1 trillion mark once again. This rally wiped out almost $1 billion worth of short positions and already triggered talks of an incoming bull market. A potential reason why ETH has outperformed the market is that the token has gone deflationary over the past few weeks, with its supply getting close to pre-merge levels. The market share

of Bitcoin against altcoins hit a two-year high this week. Some believe that this is a good sign for altcoins since BTC usually leads the way prior to an alt-coin pump. Cryptotrater and analyst Arthur Hayes thinks this pump in the markets has to do with the possibility of the U.S. Treasury, quote, supplying the market with more short-term T-bills to alleviate a shortage. Other people mentioned, perhaps jokingly, that the reason the price has spiked was the publication of Matt Levine's 40,000-word article on crypto. However, that seems quite unlikely since other assets and traditional financial markets also experienced massive gains.

Despite prices rising in the past few days, there's still a long way to go to recover all these losses. Recently, news broke that VC firm A16C's first crypto fund is down 40% in the first half of the year. Additionally, Pantera Capital, one of the big players in the industry, has also suffered significant losses. Pantara's early-stage token fund has lost 71% of its value since the beginning of the year, according to the block. The debate about how to regulate crypto spices up. Last week, FtX CEO, Sam Bankman Freed, published an industry norms manual in which he proposed enforcing regulation on DFI

protocols via their front ends, thus setting off a heated debate on crypto regulation. In a long rebuttal, Eric Voorhees, founder and CEO of ShapeShift, said that Bankman-Fried's proposal would put crypto on a path to tyranny. However, SBF claimed that his plan is, quote, better than the status quo and better than we're likely to get. Gabriel Shapiro, General Counsel at Delphi Labs, disagreed with SBF's take on the difficulty of determining whether a website is a broker, saying mere websites must not be regulated broker-dealers. Shapiro and Bankmentfried have agreed to come on unchained to debate everything about crypto regulation.

If you have any questions for them, slide into my DMs. Speaking of regulation, this week, Securities and Exchange Commission chair, Gary Gensler, claimed there is centralization in the crypto market. Speaking at the annual meeting of the Securities Industry and Financial Markets Association, he said, we've seen even centralization in the crypto market, which was found, on the idea of decentralization. This field actually has significant concentration among intermediaries in the middle of the market. Moreover, lawmakers Elizabeth Warren and Alexandria Ocasio-Cortez sent a letter to several agencies with concerns about former regulators working in the crypto industry.

In particular, 28 SECFEC officials and 15 CFDC officials have left to work in crypto. Celsius's bidding procedure plans get approved. U.S. Judge Martin Glenn, who is overseeing seeing the bankruptcy case of Cryptolender Celsius has approved the company's bidding procedure plans. The order sets December 12th as the deadline for final bids, with a potential auction happening three days later. In addition, following the release of customer information earlier this month, Glenn appointed a consumer privacy ombudsman to protect consumers' private data throughout the sale process. Gavin Wood, PocaDot founder, steps down as CEO of Parity. Gavin Wood, founder of the Pocodot blockchain, stepped down as CEO of Parody Technologies,

the legal entity behind Pocodot. In a statement, Wood said, I'll be pointing my regained focus towards exploring how we can contribute to making Pocod and Web3 more relevant to large swaths of the population. Wood was one of Ethereum's co-founders and later decided to build Pocodot, a blockchain designed specifically for interoperability. The new prime minister of the UK is, Pro-Crypto.

The United Kingdom has a new crypto-friendly prime minister, as Rishi Sunak replaced Liz Truss, whose exit was quite dramatic. Sunak served as a finance minister for former Prime Minister Boris Johnson. During that time, he advocated for the UK to become a crypto hub. His first days coincided with lawmakers from the House of Commons in the UK, voting in favor of recognizing crypto assets as regulated financial instruments. Time for fun, biz. The Metaverse doesn't look very promising.

A group of professional soccer players tried to play the first soccer game while wearing virtual reality glasses. As you could probably guess, it did not go very well. The video shows the players failing to kick the ball even when it was a few inches away from them. They stumble about. The goalie flattens himself on the ground several feet away from the ball, sometimes in front of it.

They look, uh, not even amateur, but more like absurdist. Is this the future of the Metaverse? We looking good, crypto influencer Punk 6529 tweeted Riley. Thanks so much for joining us today. To learn more about Avi and the Manko Markets Attack, check out the show notes for this episode. Unchained is produced by me, Laura Shin, without from Anthony Yun, Matt Pilchard, Juan Ivanovich, Sam Shri-Rom, Pamajam, Shemdar, Shashank, and CLK transcription. Thanks for listening.

Thank you.