DeFi Risk: How to Secure Your Protocol with Blockchain Simulations - Omer Goldberg

Transcript

users that interact with your protocol to get a better idea of how the protocol is going to behave and perform under Black Swan events High volatility in times of high Market stress so how do we do it for simulations like I started the talk super overloaded what does it mean for us it means forking the blockchain so a good simulation environment is as close to possible that's why you're going to see in production the second you start deviating away from that you're just making assumptions and assumptions on assumptions is where you get stuck so we currently support all evm compatible blocks every simulation starts from selecting a block height now the benefit of selecting of working off of a fork is you get a complete a

snapshot of whatever Network you're on so that's called liquidity positions across protocols like Ave Euler LP positions in uniswap everything is is one to one and this is already a much better starting point with less assumptions needed to be made now in addition to forking the blockchain we've built a suite of tools that helped orchestration so we can manip if we want to test the Black Swan event you might not get it from the block height that you're looking at but we can create it for you or you can create it yourself so we can move liquidity uh seamlessly across uni pools curve pools whatever is interesting and relevant for the protocol that we're working with we can create positions

highly levered positions and what's super interesting is that we can also control the return value of price feeds so that also goes for chain link price feeds and that also goes for on-chain oracles now the reason why that's important and very different is because oracles are not part of a developer's infrastructure they don't control the code typically that means it's extremely they have to do all of these kind of like mock tests to see what would happen if a price uh hit you know at level X so here they can do it out of the box and they can start working with price fees and price trajectories identical to things observed in Black Thursday the UST crash post FTX and also just generate them

synthetically based on their needs foreign so one is the forked environment and this is excellent for any kind of security and just testing that you know when you're doing Chaos engineering which is thinking of the worst possible environment for your application things just work but we also have another use case which is optimization now an optimization what you want to do is you want to run the different configurations for your protocol so we can go back to the Envy example of liquidation thresholds again there's a trade-off here between profit and security for the users and we want to see with statistical significance where it's going to perform best for this we use the chaos evm the chaos CVM is an evm we've built from scratch

in Python it's highly performant and it allows us to run hundreds of thousands of simulations per day under different price trajectories liquidity levels Market environments to reach results that are statistically significant that measure the amount of value that's at risk for a protocol with this forums improve and evolve it's no longer someone writing a nice post and trying to explain why liquidation threshold or any risk parameter should be increased or decreased there's data that goes along with it and because we have we run this hybrid model and we measure all of the end results and the final recommendations on the on-chain stimulator you don't need to take our word for it it's not Black Box uh we give you a UI and a block Explorer you

can verify the result of every single block every single simulation to the level of every single block into every single transaction with tools that you're used to using today so to sum up what a simulation engine is and what it allows you to do it allows you to simulate liquidity attacks on protocols it could be a single protocol or it could be many protocols if you have a complex trading strategy that you're participating in it lets us do we could say that liquidity tax and Market manipulation are are synonymous but you could think of if we were looking for an example something like Avi Eisenberg and mango right so an attacker who has access to Capital and the the amount of capital will speak about it but it's a function

of the the depth of liquidity for the given pool and how the prices are being read and we can build all of this to basically try and quantify what is the price of manipulation and is it profitable additionally Black Swan events so it's trivial to the second you pick a block I uh you inherit everything uh from that block we can make it even worse we can change it based on the protocol's needs uh volatility price movement so the ability to control oracles and generalized protocol testing we have a bunch of tools for this that we're probably I'm getting the the signal from the from the stages everything is running late today we're not going to be able to get to so I'll just run through it for the last minute

and whoever's interested in this type of tooling can speak to me and I'll probably publish it as a Blog so anybody can read it async we have monitoring tools as I mentioned we have the parameter optimization which is live for Ave uniswap osmosis dydx and a bunch of other protocols to be announced over the coming weeks we have tools predict based on our models the plausibility of liquidity attacks and the profitability with the core thesis is if it's profitable there's a high likelihood that it's going to happen and we need to adjust risk parameters accordingly now I had a whole case study prepared this will go into the blog whoever's interested in to learn about how mango could have been prevented or the tax

that Avi Eisenberg was um threatening Ave with or even tried with the Curve attack uh come talk to me um and that is basically it if you want to catch me after this is the best way to do it Twitter Omer a Goldberg and then just on the contacts Forum on the chaos Labs at XYZ website thanks everyone I hope you're enjoying the conference [Music] thank you