Auditing DeFi in the Era of IntraBlock Loans: Preparing for the Next Wave of Exploits

Transcript

Hi everybody. My name is Near. I'm CEO of Eureka Labs and I'm going to in the next 5 minutes I'm going to talk to you about something very very cool that I think everybody should be aware of either you're developer of a DeFi protocol, an auditor, or even if you are God forbid a white hat hack attacker trying to attack a protocol, I think it's something that you need to understand that it's going to be in your war chest pretty soon. So when you're looking today the way the flash loans work, the main limitation they have is that you can need to borrow and repay the loan at the same transaction. You cannot do anything across multiple transactions using basically a flash loan. This is done by

getting any type of loan from Aave, Balancer, Uniswap. Basically any protocol protocol that has liquidity allows anyone to borrow an infinite amount of capital completely under collateralized. So when you're for example auditing a protocol, you need to be aware of anyone having this tool in their war chest trying to do something to your protocol. On one of what we're developing on top of our block builder on Ethereum mainnet, which is going to go live in Q2, is something we're calling intro block loan, which is an extension of a flash loan that allows anyone to borrow uncollateralized loan for the duration of a whole Ethereum block. So this enables user to basically run any type of strategy from MEV

strategies to any type of attack they want on a block level. You can take a loan at the beginning of a block and anytime later repay it. Basically this is done because we as a block builder has atomicity over an entire block. So we're able to verify the solvency of the loan. We're able to give anyone any amount of money they want completely uncollateralized to run this. And this is something that I think everyone should be aware of that pretty soon it's going to be live and it's going to be available to anybody who wants to do anything they want with this. So, a few example of things you need to be aware of when you're auditing or developing a protocol, I'll give two examples of things that could be done with this. The first one is any type of

Oracle manipulation. So, think about any Oracle that needs to be updated mid-block. An attacker can take in a billion-dollar loan in any token they want, do something either change the price of in a dex or any other thing that they want, wait for the Oracle Oracle update to happen in the middle of the block and then later on do the attack with the capital that they borrowed from the inter-block loan. At the end of the block, they only need to repay this. So, you need to be aware that multi-transactions attacks are available right now. That's just one quick example. The second one, which I honestly I can't take credit, I remember talking to this with someone and he said he's going to do it, is let's say you know that there's a DAO

resolution that is about to be settled in a specific block and in that block the DAO smart contract is going to take a snapshot of the token holders to decide their voting power on that resolution. So, if you know exactly when that resolution is about to happen, you know exactly that what block it could happen, you can in a way sandwich it basically borrowing a large amount of that token at the beginning of a block, staking it, waiting until some point of the block that snapshot is going to be taken of the holders with you as one of the major holders of that token, and then at the end of the block you unstake it and you basically repay the loan. You didn't make any money, of course, you paid at the fee of the loan, but you gained a substantial amount of voting

power in that resolution. There's a lot of different use cases that could be used. We're very focused on MEV, either we're talking about like front-running or sandwiching or or yield basis. We talked even examples, people told me they're going to use this for airdrop farming across multiple transactions. There's a lot of cool things that people will be able and will do with this. And I think if we're looking from an auditor perspective, it's something that you need to be aware of that this exists. It's not longer the attacks are not only happening on a transaction level.

They're going to start happening on a block level. And if I can give you a small teaser, it's actually going to be in the future be able to be done on multiple blocks. So we'll be able to give users uncollateralized loan for more than a single block to be able to run complex strategies, complex or even attacks. And it's definitely something that everybody should be aware. Um so just to finish, how auditors can stay ahead of this. So when you're thinking right now you're auditing the code, a lot of times you're being thinking about the single transaction. What will happen here? Will be the call stack? What How will this basically go back? You need to start thinking on a block level. And in the future I can tell you even on a multiple block level. You can You need to think that whoever's going to try to attack

this is going to have basically infinite amount of money in any in any token they wish to do basically anything they want. And you need to be aware and design your protocol and basically audit it according to that. I'll finish it with saying I think that the the next wave of DeFi exploit are not going to happen in the smart contract level, but actually going to be on a Yeah. on a mempool perspective. And I think we should all be aware of that. And you should all know that this is going to happen. Thank you. >> No, no. >> Thank you.