Harvest Finance, the attacker, the exploit and the elephant in the room

I don’t want this article to sound against DeFi or Aave or DyDx or any other protocol or app, because it’s not. I love DeFi, I love the teams in DeFi, they are giga brain chads that will change the world, they’ve pushed innovation to incredible heights, but mistakes are human and anyone can make them. It is important to correct what is wrong and push what works and adds value.

If you are actively involved in crypto Twitter, I’m sure that you’ve found something related to the Harvest Finance($FARM) exploit on your feed.

I’m writing this for 2 reasons:
- one is the fact that my perspective is subjective and I am interested to learn more about DeFi and it’s intricacies, I want to learn the products/apps (what they do, how they can be used etc.)

- the second is the fact that nobody seems to address (what I think the main issue is /the elephant in the room) which is the tool by which this exploit (and a few others) was possible, which is FLASH LOANS.

For anyone bumping into this article without knowing of what happened yesterday, here is a quick TL;DR :

Harvest Finance was/is one of the few (in my opinion of course) good DeFi projects with the purpose of increasing a user’s yield by applying custom strategies, basically users park their funds (USDT, USDC, WETH, WBTC etc), the protocol uses these funds into custom strategies and the user is paid out a yield in the form of FARM token. Harvest is similar in many ways to Yearn, which have been the blockbuster of the DeFi summer.

Harvest has proven to have quite a large and active community, and although developers and/or the guys running the projects are anonymous, they are known and respected figures in the ecosystem and people trusted them enough to put over $1B in the protocol.

In the past month the protocol had an outstanding growth, both in terms of TVL and token appreciation. Users were making nice profits, confidence was growing, code was audited, so rainbows and butterflies everywhere.
That until yesterday, when an unknown and very smart actor has used an arbitrage tool to drain $24million from the protocol, leaving a lot of people in awe and as an effect, TVL and price took a plunge of 60–70%.

Was this illegal? Not exactly since the smart arbitrageur only used tools freely available to anyone (anyone with a deep understanding of DeFi composability, solidity and smart contracts, AMMs, Curve pools, Harvest product etc. that is)

Was it immoral? It sure was, as a lot of people lost a lot of money, but since We want to “be our own bank”, be “decentralized” and other clichés of this nature, We need to be aware that morals doesn’t mean shit in a capitalist society where survival of the fittest is the game to play, where everybody wants to make a lot of money fast and can be easily blinded by greed and that We are also in charge of our own security and security of our funds.

My opinion on the exploit itself is not one sided, I am not in any way encouraging this behavior, but I am not trying to make the attacker a criminal because there is no actual crime when all you did is push a certain sequence of buttons available (theoretically) for everyone to push.

Did Harvest Finance fucked up? Yes, it did big time and they will have a very hard job now to restore investor’s confidence.

In some way, i can see “the good” in this very bad and unpleasant situation. What do I mean by good?
Well, we can see that audits are not enough, so clearly we need better auditors, or at least top class ones being used in products with high TVL.

We can see that being a “good” project doesn’t protect you from flawed smart contracts, so we need to be fully aware that this space is very new and untested, or as Andre Cronje put it “We are testing in production” hence there is always the risk of something bad happening, and when/if it happens, money will be lost as a consequence and there is no “Undo” button.

Another “good” thing about this debacle, it seems like the exploiter didn’t want to destroy Harvest, because he could have had, if he really wanted to. There were only 2 pools exploited and he only ran the attack for 7 minutes, but I’m sure that he could have attacked all pools and do it for maybe hours inflicting damage in the 100M+ range.

Was he scared do it? I don’t know, nobody knows.
Did he just wanted to show the flaw to the people involved in DeFi and take a big payout for it? Seems more probable at this moment.

This is also a consequence of the fact that bug bounties have been abandoned in the past years, and bounty hunters were not rewarded for their merits. There were numerous cases where honest bounty hunters found even critical bugs which literally saved a project and they were given only a few hundreds of dollars for their work while the team either acted as if there was no big deal or even disregarded altogether.

Getting back to the exploit, the crowd is either attacking the Harvest team or the attacker himself, but nobody is actually talking about the tool that made it all possible which is the flash loans.

So, what are flash loans and why do they exist?

- Flash Loans are uncollateralized loans in DeFi! Designed for developers, Flash Loans enable you to borrow instantly and easily, no collateral needed provided that the liquidity is returned to the pool within one transaction block — quoting from Aave website….wait!!! what?!? YES, you can lend out outrageous amounts of money with close to nothing of a cost and use that money to do whatever, as long as you will repay the capital back in one transaction(complicated, I know, that’s why is reserved only for a few)

- The main purpose of this type of loans is arbitrage, but there are few others like swapping collateral of loan positions, without having to repay the debt of the loan positions….BUT that is not all, as a byproduct, flash loans can also be used for : wash trading (welcome back CEX trading!), Pump (or Dump) market price manipulation, Oracle manipulation, attacking a protocol.

From the get go We can see that flash loans are not for everybody to use, they are built for “the smart guys” to use (goodbye decentralization and inclusion, I can’t see any resemblance to the system we want replace heh? ), but on the plus side, this was a tool constructed to help the markets (as long as everyone else trusts that the “smart guys” are good guys too, and talking of good guys, everybody has already forgotten ChefNomi)

So, while the crowd was cheering for this new discovery and product, others (maybe even the same guys, who knows) saw a big door opening with free money ready to be scooped away… lots of free money….and with a growing DeFi market, lots and lots of free money.

The flash loan is an excellent tool for attacking a protocol with minimal costs to the attacker. Until now, if someone wanted to attack a protocol, it would have costed a ton and would have risked a ton of money which they had to own and then worry about how to wash that initial capital out, but now, you can use a shit ton of money which you don’t have, to attack a protocol and extract (basically steal) but let’s say extract a lot of profit out of it.

It started with DyDx and bZx back in February not long after flash loans were launched and 830K were extracted almost killing bZx. Later 500k were drained from Balancer and then the most recent and notorious being the Eminence “hack” where someone walked away with 15M (returning 8M as a good Robin Hood that he is) and now with Harvest Finance where the guy (or organization), maybe even the same as in the Eminence’s case, banked 24M (and stopped at this number just because he’s also a good Robin Hood).

I recently saw some posts from the Aave team that the “flash loaned” more than 600M so far (none being used in any attack it seems).
Good, if we were to analyze this statement and run a quick calculus on how much value does these loans bring to the table, let’s assume that an arbitrageur profited aprox 5% average of this amount (probably less, but for the sake of argument), this means that this feature yielded about 30M in profits while keeping the markets stable.

If We then compare only the 24M + 15M being drained in last 2 attacks (okay 8M were recovered, but only by the good heart of the attacker) then we can see that in actuality this feature did more harm than good, and it did lot of harm, as those money have moved from the pockets of their rightful owners to the pockets of the attackers.

This feature is so powerful that it can destroy a protocol or a project completely making the hard work of a lot of people obsolete and making people’s money disappear in seconds.

I know that I am being subjective and I don’t see the full picture here (or I don’t understand it) but if flash loans are a real innovation, then, in its current iteration, it did a lot of harm and needs to change.

Maybe addresses who call the flash loan feature need to be KYC-ed and/or be whitelisted, since only a few people uses them anyway, so if only a small set of players uses them, then why not know who those players are and let’s make sure they play it useful and harmless?