Inverse Finance stung for $1.2 million via flash loan attack

A decentralized autonomous organization (DAO) called Inverse Finance has been robbed of cryptocurrency somehow exchangeable for $1.2 million, just two months after being taken for $15.6 million. "Inverse Finance’s Frontier money market was subject to an oracle price manipulation incident that resulted in a net loss of $5.83 …

[Joe W]

Past tense

Note the use in that statement; "The developers of the DAO believed they could eliminate human error or manipulation of investor funds by placing decision-making power into the hands of an automated system and a crowdsourced process."

I could write that one was born every minute or somesuch (note the praeteritio)...

[ShadowSystems]

The philosopher Nelson said it best.

<Nelson>Ha Ha!</Nelson>

[Howard Sway]

this oracle implementation was reviewed by a competent third-party team as well

They've not only redefined the concept of "currency", they've redefined the concept of "competent" too!

Maybe they only deal in cryptocompetency, which is much more exciting than that square old traditional competency.

[Ian 55]

Re: this oracle implementation was reviewed by a competent third-party team as well

"It is worth noting that this oracle implementation was reviewed by a competent third-party team as well"

.. just not very well.

[Michael Wojcik]

Re: this oracle implementation was reviewed by a competent third-party team as well

I don't think anyone's found a problem with the oracle implementation. The oracle design was broken.

[DS999]

The final stage of the crypto collapse

Is when they attack each other. Previously this was pretty rare, only the "have nots" were attacking. The "haves" who were already crypto millionaires (on paper at least) didn't want to scare away the fish, lest the supply of greater fools dry up due over fears of the safety of crypto as an "investment".

Now that it has become obvious to them the ship is sinking, they are attacking each other - that's what has been happening with the funds going down. There are some reportedly using arbitrage between exchanges to enrich themselves, which has the side effect of driving other parties into margin calls and liquidation. It isn't clear whether these "flash loan attacks" are outside actors or done from "within the community" but I would not be surprised if the latter is the case.

This is what happens in an unregulated environment. After all Wall Street has had over a century of regulations to stop various bad behaviors. Not all of course, but there are tons of things you would go to prison for if you tried in the stock market that are perfectly legal with crypto.

The insiders have realized crypto's reputation has become too damaged over the last month or so for it to ever bring in more investors than it had last year, so there's no hope of ever posting new highs. The only way to win at this point is by stealing from your fellow cryptobros. If you HODL you will end up with nothing before long.

El Reg needs a popcorn icon for this.

[cdrcat]

Re: The final stage of the crypto collapse

I would paraphrase your comment as “cabal of insiders team up against retail investors” (The haves team up against the fish). That sounds like nonsense: most crypto is inherently trustless: if any individual can defect against the group (defect against your “haves”) they will, which is just sensible economics.

Disclaimer: I no didly-squat about crypto and I don’t own none

[Doctor Syntax]

Re: The final stage of the crypto collapse

Whatever it is they're stealing from each other is only worth anything unless they manage to cash out and the moment they try to do that the price goes down again because, as you say, the supply of greater fools is drying up.

[DS999]

Re: The final stage of the crypto collapse

The arbitrage attacks they are doing to collapse the exchanges results in real dollars flowing to them, that's why they are doing it because stealing crypto is as you say useless since the supply of willing buyers is reduced and growing smaller by the day.

[Michael Wojcik]

Re: The final stage of the crypto collapse

Since the cost of these attacks is extremely low, it really doesn't matter. If the attacker extracts 1% of the nominal value as hard currency and/or goods and services, they've made a decent day's payout.

Also, as we saw in a number of cases, a number of the True Believers have cash reserves they're still willing to pour in to try to prop up their houses of cards. (Ugh, that metaphor is so mixed it looks like I got it from Tornado. Anyway.) So there's still room for the artful types to extract real value before the whole thing goes cold iron.

[JimmyPage]

Amateur hour at a crypto specialist

...weather to follow.

I am convinced that as I get older, modern life has changed so that it's ever easier to spot morons at a distance. Maybe it's natures way of allowing me the best use of my diminishing lifespan.

[ecofeco]

Re: Amateur hour at a crypto specialist

Are we related?

[druck]

Incompetence or scam?

Either way your money is gone.

[Snowy]

Re: Incompetence or scam?

or clever inside job.

[newspuppy]

Programming for smart contract execution... What could go wrong?

Inverse Finance has top programming talent creating smart contracts to get rid of the human element to have 'perfect' contract execution so as to "....eliminate human error or manipulation of investor funds by placing decision-making power into the hands of an automated system and a crowdsourced process."

I have in my career designed hardware: motherboards, graphics cards, add on accelerators, SBC, and I have also programmed.. primitive operating systems.. programs...

I can tell you that I have never had a hardware bug or software bug. In telling you this I would be LYING... I have yet to see perfect hardware or code. There are ALWAYS ways that it can be AB/used to make things happen that one did not anticipate...

The more complex.. the more esoteric the potential problems.

We see that on CPU's with side channel attacks... CPU's designed by teams far more intelligent then myself...

It is only the arrogance of untested youth that can think something would be perfect and unbreakable.......

In the days when most programmers have no clue as to what is really going on in the 'machine', and they use high level foundations or classes/libraries..... they think it shall be perfect.

This smart contract concept is lovely.. but it gives me the willies... and makes me worry.. as the more complex the system... the harder it is to anticipate all the different AB/use cases. Sometimes a human is good as they can stop something that looks out of the ordinary....

I am truly worried about the future.. where young inexperienced programmers think the world can easily be replicated using logic... What about a bit error induced by a solar flare on the hardware? How do they manage a hardware error during the smart contract execution? ARRG ... enough for now... I feel old. I am old. Too old..

[An_Old_Dog]

Re: Programming for smart contract execution... What could go wrong?

Inverse Finance dev would say to newspuppy: "Whaaaat-everrrr. Gotta go now, I've got a job interview in a noisy, distraction-laden, trendy, spendy, fashionable coffeeshop with a company building the Next Big Thing!"

[Anonymous Coward]

Re: Programming for smart contract execution... What could go wrong?

How do they manage a hardware error during the smart contract execution?

Smart contracts are programs whose bytecode and state are stored and recorded on the blockchain. They're executed by many different machines on the network, and the result of each stage is acquired by consensus. So every machine executing any given stage of a contract would have to be hit by the same hardware error at the same time.

So, in theory, (and we all know about theory and practice) the only way to derail a smart contract would be by having more than 50% control of the network. Something which flash-loans and Proof-of-Stake systems make worryingly easy - as news outlets have reported in the past.

[Doctor Syntax]

Re: Programming for smart contract execution... What could go wrong?

It's one way. The other way is that it's buggy. It doesn't matter how many machines execute it, all they're doing is making the same error.

[Anonymous Coward]

Re: Programming for smart contract execution... What could go wrong?

Yes, but that's true of all software. Should we all just go back to pen and paper because current software development processes still allow the creation of bugs?

[Michael Wojcik]

Re: Programming for smart contract execution... What could go wrong?

If your software isn't sitting in an append-only register, you can, y'know, fix it.

As it is, there's a large body of methodologically-sound research showing that the smart-contract domain is rife with terribly buggy programs. If anything, it seems to be worse than the (appalling) state of software in general.

[katrinab]

Re: Programming for smart contract execution... What could go wrong?

Most software-based workflows have humans involved somewhere in the process.

There’s also patches, bug fixes and stuff like that.

[Mike Pellatt]

Re: Programming for smart contract execution... What could go wrong?

Not if:

i) You've got the functional specification right

ii) Each machine has a separately coded implementation

This is, after all, how safety-critical fly-by-wire systems were supposed to be implemented.

I have no idea:

a) If that is still the case

b) If cryptobros have heard of this

[Michael Wojcik]

Re: Programming for smart contract execution... What could go wrong?

Each machine has a separately coded implementation

That's not how "smart contracts" work. They're small programs appended to a blockchain which are executed by anyone who wants to be "paid" for executing them (modulo various conditions). One implementation, which is no longer under your control once it's in the wild.

[newspuppy]

Re: Programming for smart contract execution... What could go wrong?

Thanks for the clarification on a bit error.

[Ian Johnston]

Re: Programming for smart contract execution... What could go wrong?

It is only the arrogance of untested youth that can think something would be perfect and unbreakable.......

I don't think the people who build these systems think that, or even care. All they are doing is building something to lure in mugs until the day when the system can be "hacked", assets "stolen" and the organisation shut down.

[newspuppy]

Re: Programming for smart contract execution... What could go wrong?

I think that there are some younger programmers that are idealistic.. and think that crypto currencies can solve all the problems and ills that exist in the world...

Not all are scammers and con artists.....

[Jan K.]

1 million... 15 millions... surely a typo as it should be billions??

Or has the crypto-market-business-thing really gone that much downhill?

[Doctor Syntax]

The "earnings" from the attack have gone down by an order of magnitude in a couple of months. Maybe that's a pointer.

[Terry 6]

So a Ponzi scheme raids another Ponzi scheme because there aren't enough suckers feeding real money into the system to sustain it. Have I understood this?

[Phil Kingston]

Missed the bit where they're going to spaff it all on NFT images of deez nutz

[JWLong]

Inverse Finance

Even the name is a joke!

[BiancaStevenson]

That’s why I prefer to trust my financial manager instead of dealing with my finances myself, you know. And that’s the reason why I don’t let him invest in crypto. Blockchain is not as safe as it seems to be, actually.