DeFi by Design EP#89: DeFi Safety & Security w/Revoke Cash

Transcript

welcome to D5 by Design where we talk all things blockchain and cryptocurrency while striving to educate Empower and enrich it's your boy Andy and welcome back to the D5 site YouTube Channel smash the like button on this video that really helps us out and sit back and enjoy the content thank you very much what's going on guys welcome back to episode 88 of the D5 by Design podcast here today today is Jay pal day now the day that you're actually hearing this will have been passed but we are on the edge of our seats as we arise another interest rate hike and I'm looking forward to the days of crypto where what the central banks of the world don't they don't have that big of an influence anymore but we're back in the

D5 World we're talking to a D5 OG today Roscoe from revoke cash I remember the good old times during D5 summer when I would uh go and farm yams and every other yam clone and then find some hack on Twitter or some exploit from some guy and be like oh man gotta go and and revoke all my accesses so we're going to talk today a lot about D5 security safety risk management some of Roscoe's outlook for the state of D5 uh ethereum kind of what's going on and so yeah strap in this will be a good one if you're kind of new to the to the risk management world or if you want to uh shape it shape up on your practices so here today with Rob as well cheers Rob how you doing good morning doing well yeah happy j-pow

day probably another interest rate hike uh nothing we haven't seen before so all is well in macro and crypto worlds I'm stoked to talk to uh to Roscoe because um it's important you know like it's not something we talk about every day where um we cover you know kind of like the uh the calmer kind of like uh the stuff that is necessary but not talked about too much um so we're going to talk about some of the security practices and some of the risk management practices here today and yeah Andy like you said Rosco is an OG I'm stoked to cover um his thoughts on uh kind of the the evolving world of crypto as we see it today so Roscoe how you doing man hey nice to be here thanks uh thanks for

inviting me on yeah for sure how did you jump into uh to defy and come up with this idea yeah um yeah it's been a while now [Music] um so I've I've been involved in like crypto on the development side since early 2018 somewhere around that um uh made my first like crypto Investments during like the Bull Run of 2017 and then I guess when I lost all of that you know you have to go go in it for the tech so that's when I got into development um uh just kidding but um yeah so then I I have I've worked on a few different

projects and then at some point I think 2019 um we were at um Defcon in Osaka in Japan and by then like D5 or like modern DFI didn't didn't exist of course but like there were things like uniswap and and like it was definitely developing um and and one of these things that the uh that that these D5 these emerging D5 platforms um had was you know you have to you have to Grant allowances to your tokens um so if you want to swap die for eth on on unit swap uh you have to like give

uh permission to uniswap to take those tokens from your account uh and and then give you new tokens of course um and and I remember I was talking to paulberg from sablier um at Defcon and actually one of the early versions of Savior um which is like a money streaming uh service for for those who don't know it um one of the early bathtub versions had like a bug um where where tests are where test users um actually lost lost some money uh well of course they were repaid uh uh from

the from the smart contracts because it was like they didn't actually lose it but that is sort of where Paul node is the real world danger of these allowances because these These funds were lost because of allowances and and sort of the the the thing there is that like if you if you deposit funds into some application you kind of know uh These funds you know they they might be at risk right I I give this to like some D5 thing well maybe I'm not going to see them ever again but for the funds that are in your wallets um you don't really maybe understand uh the the risk that they face

um so basically yeah after that uh that kind of click with me as well and I figured okay well we need to have a way to mitigate those risks sort of link to allowances and and that is where our revoked cash was born and then over the years that followed essentially um yeah was expanded new chains were added new functionality was added and here we are today yeah yeah so when you allow a token allowance for let's say um let's say like Ave coin in your wallet and you deposit you know 10 Ave of your 20 Ave coins into some protocol um right the the there's a chance that by allowing them to access your Ave

tokens those other 10 that are still in your wallet could technically be drained um if I'm not mistaken however if you only allow token allowance for Ave there's the other tokens in your wallet can't be drained is that correct does that kind of statement work yeah that's that's exactly right so allowances are really on a on a sort of per token basis um so there's there's actually no way to give an allowance for all your tokens at the same time so you have to do like one allowance for your die one allowance for your Ave tokens uh Etc and would you say that having a a hardware wallet would defend against a lot of um like allowance attacks because if I

had let's say this example I deposited 10 of it then I had still had 10 on my on my wallet uh like let's call it a metamask but I've you know got my treasure or my ledger connected I would then still have to go and approve that that second transaction right if they were trying to drain more or no are actually no um because essentially what you do is uh you sort of tell the die token like hey if if this protocol let's say if uniswap asks you for my money they can take it like without me needing to do anything for that so um of course Hardware wallets definitely offer more protection uh for certain use

cases than than like hot wallets like you know that your seed phrase like your private keys are safe on the device but in the case of these allowance type scams um they actually don't need your private Keys uh because you're actually telling telling the smart contract like hey it's okay if this person wants my money give it to them if they ask yeah yeah so we saw a lot of instances where people lost Eve because they approved Ethan made a bunch in their wallet and or wrapped teeth yeah how how common is it for protocols to uh request a permission for all of the

tokens in the wallet rather than you know just a few that that you're intending on swallowing yeah very common I would say um there was a while where sort of people were moving towards like sort of uh the the just enough allowances um I think maybe in like 2020 but then at some point um as we've as we've uh experienced like gas fees started to rise and and that's kind of when these platforms stopped uh moving towards that and and went back to sort of these unlimited allowances and the reason for that is if you do like an

allowance that is just enough then every time you want to swap these tokens for example you would have to approve another allowance um which I think at the height of gas fees was like another 20 30 dollars added just to like uh approve one of these allowances um so when that's the case it like there's definitely something like a case to be made for these unlimited allowances um uh so it's really a trade-off between like the convenience and and the lower costs of unlimited allowances versus the safety of of these like just enough allowances was there a a particular incident um or event that that caused you to uh

create revoke cash were you like a victim of a of an allowance attack or did you just kind of see this as like a uh an important thing to create in the industry yeah I guess more of the second than of course uh a big part of the um the inspiration was sort of that whole like chatting with uh with Paul Bergen in Osaka um but like at that time in in like the end of 2019 there hadn't really been any big allowance exploits like maybe here and there someone lost some money um but nothing really high profile so um initially uh like a lot of people weren't really

aware of the issues so a big part of it has also been just sort of like educating people on that um but then in 2020 like after D5 summer and and when a lot of Diva really took off that is when um when people really sort of realized a lot of people realize at least like the risks that these allowances can have and then it was good that revoke that cash already existed because um you know having to develop something in sort of the Heat of the Moment has never ideal of course yeah I remember like I said clearly like yams time and all the other Forks um

so so right now there are there are still protocols that exist where you have to allow access to your entire entire wallet versus token what does that look like from a user's perspective like how can how can a user know like on metamask you know on on uniswapi you go approve access to usdc to swap or something right but is there a separate approval kind of confirmation um uh pop up on metamask that you can that they're able to to tell and differentiate um you know when you're doing a full token approval versus just in a one um well so uh in in like the the mathematics

interface for example um when you get this pop-up for a token approval there's always um like a another tab I'm not entirely sure like what uh what the title of the tab is right now but um you can like inspect exactly what you're doing um and you can also edit that like inside your metamask pop-up um and and just to reiterate like in an allowance is always for like one specific type of token uh like die but then it can be like either a low amount or or an unlimited amount um but so even if like protocols like unit swap for example don't offer a

native like a button for you to just approve a tiny bit of tokens like just enough you can also um set that yourself in the metamask pop-up and it's like with um a lot of mathematics interfaces it's not the most user friendly or the most understandable uh to update that um but if you if you read up on it a bit then um that's definitely a good option yeah yeah it's uh it's it's weird I feel like I've only seen single token but now that you mentioned it makes me kind of think of uh of of all the ones out there so so a simple way to kind of see which

protocols you've interacted with and which protocols have uh access to your funds is to kind of go on um revoke.cash and you can really you can see every single protocol that you've interacted with um and then you can basically revoke access to the funds so what does that transaction look like on like a tech side it's basically is it like a reversion of of the initial or kind of what does that look like all right so yeah like four um like when you're setting an approval for a token when you're setting an allowance um you have to like that transaction uh you have to provide like who you're

approving and then how much you're approving so um you're basically like if you're if you're approving unit swap um uh then for example you send to like the die smart contract you say hey die die Bank um if so this address that belongs to unit swap can take up to 1 000 of my die or 10 000 or something like that um and then sort of when you want to revoke that you do the exact same thing but you say zero so you say hey if if you need to swap asks for my money um I will I will allow up to zero die to be taken

um and and that that's like uh that corresponds to like revoking it um but technically they are the exact same thing so either you're saying I am approving up to 10 000 or up to zero um just one of them we call revoking and the other we call it proving how how like uh frequently do you suggest um D5 power users revoke their permissions right that's a good question I actually posted a a threat on the uh or or a tweet on the on the revoke.cash Twitter today uh about revoke Wednesday

so we're trying to push this new uh new initiative that you know every Wednesday you should be checking your your allowances um and like if you're a very heavy user then maybe you should check it more often and if you like rarely use crypto really then of course you don't have to keep checking uh if you didn't do anything um but I think as a rule of thumb just every week is a pretty good interval to just check like hey what have I been up to um and so yeah revoke Wednesday nice yeah we can uh we can definitely get in that that healthy routine there and on on revoke cash um okay so so

actually taking a step back on on metamask there's the option to see your connected sites right and that isn't necessarily what has permission to access your tokens that's just the the app the decentralized applications that a user has connected their their wallet to does revoke cash when you're looking at like okay what have you been up to over the last week does it tell you what site you've connected to or does it tell you like even more in depth like okay this is this is what still has permission to access some of your tokens right yeah so actually yeah like like you also mentioned like that there are two very different things

um and in one case uh the connected the connected um apps or the connected websites in your metamask that is like a metamask specific thing um and and what that means is that all these websites if you go to the website then they can see your your wallet address um but that is not something that that has like that's not Unchained that that doesn't really have anything to do with like uh the blockchain or like smart contracts in general um so also when you go to revoke.cash i i there's no way for the revoke that cash website to know like which websites you're connected to on on metamask

um and so the only thing that that we can really tell you um which is sort of the more important thing is is like you said you know who still has access to your tokens and um yeah so from that point of view it doesn't really matter who can see your address because if I can see your address that doesn't really mean anything for security uh purposes uh but if I have the the permission to take your money then that does uh obviously uh have a have a much bigger impact right and some of these so some of these approvals are with protocols that have a decentralized way of basically controlling the

protocol in that even if they even if there was one person on the team who's trying to you know uh steal a bunch of user funds they really couldn't but the main issue here is that there's some and that we've seen in the past and this is why it's very important that we have some of these sleuths on chain who check things like admin key and Master Lock and things like this because there's some there's some protocols you connect to that with just a couple clicks and a very easy um either a multi-sig or just a single wallet can basically drain all the users wallets uh that are that have approved um so I know that we've seen a few of these in the past and definitely have saved uh quite a few people with revoke.cash but

there's also something to be said kind of about the design of smart contracts when it comes to uh these these protocols um yeah I mean I guess like again on a technical level like is there something that uh users can if they want if they choose to dig into the code or can look can just like a few key identifiers for protocols um you know that are that are kind of sketchy like is there anything that comes to the top of your mind um yeah I think um when you're really like looking at the Smart contract code um I think one of the biggest things to look out for is like upgradability of smart contracts

um because once like if a smart contract is upgradable um then it doesn't really matter what the the current version of the smart contracts logic is um because they they might as well change that that logic to something completely different uh tomorrow um and and then of course not every upgradable contract is is the same um as you also mentioned like sometimes the the admin is just one single account which is a lot worse than an admin being like a multi-sig for example um but in general like the the

like for example if you're looking at at your allowances like which ones should you revoke and which ones you know might be fine um like for example if you're looking at uniswap um those are non-upgradable contracts uh that have been around for quite a long time um that have been audited that have been like thoroughly reviewed so something like that and and like similar platforms um that's probably fine if you have allowances to those platforms um but then yeah if if as soon as something is upgradable um yeah you just don't know what what has it been like developing

and like foundingrevote.cash like that there isn't a clear like monetization strategy or something with remote cash like are you guys VC back like what's kind of the like like what what is it like you know building a decentralized application that is almost like a public good to the to the infrastructure of of defy right yeah so initially um revoke the cash was just like uh a side project that I hacked up in a couple of days um just sort of to um yeah to solve this issue of of like you know we have a bunch of

approvals and we don't know what to do with them um and for a long time that was just kind of what it was and you know every now and then I would write a little bit of code on that and um uh yeah and and it would grow um slowly but steadily um but then as crypto grew um we saw that there's like a lot more um yeah like a lot more people started using revoke and you know there were a lot of feature requests like oh can you support this chain can you support that chain can you

um support other new functionalities um so at some point it was sort of starting it was a bit too big to be like a a side project right um so that is when I decided to just go full on on this and as it is today uh so we broke that cash is uh the one-man Army that's me um but I am it's no longer a side project um so it is um just me Manning Manning the man in the ship and and you know like I get some help here and there and I have uh like

every for for some things I get like freelance freelance help um but overall you know it just being me means that um you know there's there's not a super high burn rate um and it means that I that that the application can do things in yeah in in the sort of in a sustainable way um and yeah so I development has been funded through like um things like Bitcoin grants uh and donations and um until now that that has been uh enough to sort of fund my development of

it um but I have been thinking more about like hey how how can this be sort of more of a business um rather than sort of yeah like I mean uh rather than like more of a product uh project and it's it's kind of a um it's kind of an interesting dilemma like being in sort of the security space because sort of these security tools should be accessible to people because you know people are losing money uh to scams and to to like bugs hacks whatever um and you just want to make sure that you can help as many people as possible

to not get scammed um but then at the same time you also like need to need to be sustainable you need to to to make money um so yeah I've been I've been sort of trying to come up with um with like certain features and functionality uh that would be sort of like nice to have that you could pay for but that wouldn't really impact uh regular users ability to to keep themselves safe um and um yeah and so that that is sort of the the short term uh roadmap in like the coming let's say three months

uh the idea is to just have like some some tiny uh added features that that people can like pay uh a tiny subscription for and and see if that can can be enough to sort of make up for like in addition to sort of the donations and the grants that we get um yeah to sort of maybe expand that uh expand the company as well and and see how how that goes nice yeah good yeah yeah that's very cool is there a vision like what what are some of the added features you know that that you have that are kind of like nice to haves um

and you're kind of like forecasting you know as uh new features to to implement onto the application right yeah I think I think one of the big ones um is sort of like more uh more book operations so you know checking a bunch of addresses at the same time uh on a bunch of chains at the same time um because those are not necessarily things that you know are are prohibitive to um sort of the free users um but if you uh but they can be a big Time Saver um which I think makes it sort of a good um a good candidate for a paid feature

um yeah because everyone can still access all the same functionality uh just some people can do it a bit faster um yeah cool and then and then and then in this at the same time um you know there's there's also uh there are still a lot of things that can be expanded for like the free version as well for like ever for everybody because I think still like almost everything about revoke the cash should be free um so other things that we're thinking of um or that I'm thinking of is that is like um uh better education so more of like a knowledge base for people to sort of understand what what like D5 security and what like crypto security means

um we or there is also the um revoke.cash um browser extension that was released uh a couple of months ago which essentially acts as as like a a middleman between the um the application that you're interacting with and your wallet like your metamask and anytime you do something that might be potentially harmful uh like uh approving an allowance or like listing nsts for sale then you get a pop-up from the revoke the cache browser extension and it just tells you hey um this is what you're about to do are

you sure that's that's what you want to do and then it's up to the user to fit to to to say yes or no to that and like if you're a user and um for example you're trying to swap tokens you're trying to swap your die for each then it makes sense that you have to set an allowance for die but if you're trying to Mint an nft and then you see this pop-up saying oh do you want to approve an allowance for all your boardaves um then you know it should also be pretty clear to you that that's not your intention um so that's that's kind of the idea there and and uh yeah it's been it's been cool to see the growth of that as well and and the

stories of people on Twitter as well that you know uh uh it has already like saved plenty of people from like phishing scams um just before they happen because we evoke the cash as it is right now um it's sort of like two-sided um on one on one hand you have sort of the the maintenance uh side where you're like okay well check in every Wednesday or check in periodically um like hey what are my allowances do I still need those or not and then they're sort of like the sort of after the fact damage control like oh I got scammed uh I went to this fish inside I clicked some stuff that I shouldn't have um what now and then revoke uh the cash

well obviously it doesn't help you to get your your assets back because if it's sold and it's stolen um but it does help sort of um roll back those allowances so that you can just keep using your wallet as usual after after you sort of like resets those allowances um but you know in in that second case it would be better if if you wouldn't get scammed in the first place and that is that is sort of where uh where that browser extension came from um and yeah that's uh so so there's also still plenty of things there that can be done yeah definitely cool all those browser

extensions have been helpful the gas and the and the rope.cash and of course the wallets and just kind of being able to get out in front of that issue before it comes up makes it even more appealing for for users it's almost like if we had something that would be like stop this is a scam don't click this obviously it's like easier said than done but like I mean the amount of board Apes that would be saved from that yeah is just is this insane kind of flipping switches here into what we have now in D5 I'm curious what your uh what your general thoughts are on on the D5 uh ecosystem currently and kind of what you see going forward feel free to be as optimistic or pessimistic or realistic as you as you

like cool yeah um yeah I think um I think of course D5 or like the the sort of D5 hype started in in summer of 2020 or at least that's where it really kicked off um and and I guess one of the Innovations there was like the like the the yields farming like liquidity mining those kinds of things um and that has sort of persisted for years um that that sort of same uh Paradigm um but what we saw in the summer of 2020 um

with you know the the sort of token inflations um going through the roof like okay well yeah you have this you have this sort of um yield farming you know you're getting this token to to to do a certain thing to like provide liquidity whatever um but then everybody's doing that just for the farming and they're dumping the token that like that whole dynamic has also still resisted um for a lot of a lot of big projects um and it would probably be good for for D5 in general like if more projects uh would be

um would be moving towards like more sustainable yields so rather than like inflationary tokens like if that yield can be can be found somewhere else um and of course you know that's not a new I that's not a new idea either um because you know that's essentially what what things like uh LP rewards for like unit swap provided is like okay yeah well you have this this tiny spread on the on the um uh or like this tiny fee if you're if you're providing liquidity like uh the the point 30 percent um so things like that and and and then it would be interesting to see if there's

if there's like way ways to to get higher than that point thirty percent but in in a sort of sustainable way without printing new tokens and um I think one one interesting uh protocol that has been doing that uh for a while is um uh like nfcx uh which is essentially like um a sort of erc20 wrapper for um for nfts so you can like uh deposit your nft and then you get like an ELC 20 version of that and you can and then they have like this big pool of nfcs that you can exchange

your your tokens for again like your UBC 20 tokens um but then every time people do that there's a fee um and that fee goes goes to to like the people that that are providing liquidity there so um that is essentially like you're you're providing liquidity on those nfts and on top of that you are getting like more fees from nfcx but those fees are generated like from actual usage of the products um and I think having more of that kind of dynamic is going to be really nice uh for D5 because at that point like you know uh we'll yeah it will just be more sustainable and and hopefully like less like uh

inflation power I guess yeah I agree better yeah the concept of real yield like however it's formed you know the most intuitive might be like lending and borrowing protocols where there is some interest paid to the lenders uh because the borrowers are using the product they're you know borrowing um and they're paying paying a fee in the form of interest to those lenders and then uh similar similarly like liquidity providers are lending their tokens or their liquidity in a sense to those who are uh swapping the tokens between uh like whatever Market pair is in that liquidity pool

um and and it seems like it builds in complexity from there um ultimately like there's the real yield that accrues uh like back to the Token holders and it's kind of like paid as a fee to those liquidity providers or those lenders and then is there you know sometimes it seems like there's there's like a token there's like there's cash or crew or like Revenue accrual to the Token itself um and maybe it it just looks like a burn program so like um by using that by using that token by burning it it's it's just another form

of like taking that fee um and instead of redistributing it back to the Token holders it it just kind of doesn't go anywhere it just kind of uh impacts the token beneficially um yeah and I'm I'm excited to see kind of like the the different use cases but I I totally agree how there's like the uh the there's the concept of like fake yield and real yield where like we can just print money out of thin air and recreate the system that you know like he's already perpetuated in like you know the the macro sense right um but we're not really fixing anything it's just printing fake inflationary tokens as yield and then there's uh

there's like the uh the actual demand for the product that people are willing to pay for which ultimately is like the real like cash flow or Revenue that can accrue back to uh back to a Project's token or back to their Community yeah and what I found super interesting Roscoe as well is that what Rob's seeing the demand for like users to borrow stable coins for example drives a lot of yield on on on the lending and borrowing protocols and you would think that with all central banks raising rates that there would be also an inherent raise in the rate of D5 stable coin borrowing but that's not the case it's actually inverse it's like we

see higher rates for stable coins when people are speculating on assets going up and borrowing stable coins to buy which tends to actually happen in lower interest rates environments so it's like we're in a we're kind of a weird flip-flop where rates are higher people are speculating less people have less Capital less desire to be crazy so the stable coin yields are much lower and the yields would be far much lower but the actual yields are much higher in the world that you can get and then once that kind of flips and comes back I anticipate the same thing so it's kind of this weird like fix where uh it's almost like we had it backwards like right now is when we need token inflation to boost our yields but then once the bull market kind of returns we

don't really need so much inflation because there's already just a lot of speculative activity um so I feel like yields were so Juiced up because of the the initial token inflation plus the the fact that actual speculation was happening at such a high level so it's just that interesting kind of like conundrum here of where when did the yields return and I think it's very much so of like when the speculative you kind of uh desire returns I think it's indicative of why people are borrowing like people might deposit uh into a into a like a treasury bond or something for like that risk-free rate um

and then people are borrowing money you know in like the macro economic sense to start a business or you know to kind of juice their people aren't really borrowing in the macro economy to like Leverage but I think that's the primaries and people borrow like D5 power users borrow um which drives interest rates up and it it is it is a an interesting balance Roscoe what do you what do you think yeah it's uh it's actually super interesting yeah I've I've never really um thought about that sort of um yeah relationship between the real world

um real world yields and and like uh uh on chain yields but it makes a lot of sense uh like yeah just like you said um a lot of the demands for stable coins is for speculation and is for like Leverage uh trading on on like crypto so in that sense sort of the demand for stable coins is not very different from just demand for crypto in general [Music] um which is yeah which is super interesting because they are kind of like they are very similar like very different assets than crypto like in in sort of like what it is uh yeah they're much closer to just like

real world US USD than than to like eat for example like if you talk about usdc but but then the Dynamics around it are much closer to each than to to like real world USD um yeah no it's a very interesting uh interesting Dynamics yeah I mean I don't know I I just wonder what will drive speculation back and yeah I don't know if we're ever gonna get D5 like it was but I think nfts are kind of kind of like big and something definitely pay attention for kind of just the future um I think those are definitely going to be kind of eating up again in a more speculative nature um yeah I mean also just the East tokenomics once we do get that activity

back and hopefully hopefully it's from defy nfts Dows and everything and gas is coming up like that burn is going to be so ridiculous that like I mean it's gonna be so deflationary it's not like it was so close on your sound Dot money and then it's kind of poked its head back up now which is kind of sad yeah it was getting super close and now it's like a little further away but man like all we need is a something man we just need like a little spark and that thing gets going and it's just like oh man like the people will be talking about the deflationary nature of that for just for for ages so I'm looking forward to that but yeah I don't know if we're out of the woods yet like necessarily price wise but definitely um you know excited to see the the future and stay safe uh

with uh revoke.cash and just uh yeah keep your head above water and don't get hacked you know that's always good advice yeah seriously um kind of wrapping up here as we uh get on with our community they can definitely get on revoke.cash and access the product and the Tool uh join either Discord or or join Twitter how else can we get involved um yeah um definitely uh join our Discord channel uh you know follow follow Twitter um use the product uh there's also you know of course the quarterly Bitcoin Grand

surrounds going on so you know if if you're uh if you're a user of the product and and want to support like future developments um make sure to contribute to that as well um yeah I mean spread the word stay safe sweet thanks for coming on Roscoe it was a pleasure man thanks guys