How the Resolv Hack Was a Web2 Exploit, Not a Crypto One - Uneasy Money

Transcript

Hey everyone, I'm Ken Warwick and welcome to Unchained Money because what happens on chain never stays on chain. Before we start, nothing you hear on Unchained Money is financial advice. We're just four builders talking about what's happening on chain and we want you to always do your own research before aping in. You can find all our disclosures at unchainedcrypto.com/uneasymoney. The Energy Network is an intelligent decentralized grid that coordinates smart devices to balance supply and demand. Energy Dollar is the native token of the network from one of Europe's fastest growing energy startups.

Follow @fuseenergy on X to find out more. Multichain Advisors is an emerging technology growth firm that has helped create 50 plus billion dollars in enterprise value for 80 plus clients over the past four years. They're the partner to help navigate markets. Build real traction today at multichainadv.com. If crypto taxes feel overwhelming, you are not alone. That's why CryptoTaxGirl, a team that's been helping crypto investors since 2017, is offering $100 off on one-on-one crypto tax help. To get $100 off your crypto tax services, go to cryptotaxgirl.com/unchained.

Again that's cryptotaxgirl.com/unchained. All right, I'm here with my co-host Taylor Monahan, security expert. We could definitely use a few more security experts on this show this week where we got some stuff to cover and looking at CEO of Pudgy Penguins and joining us today we have a special guest Omer Goldberg, CEO of Chaos Labs. Welcome, Omer. >> [snorts] >> Um we have a lot of wild stuff to cover today, so let's just dive in. Um the first thing is this uh resolve um situation. Uh $300,000 in and $54 million gone. Um so what happened on Sunday night, I believe, an attacker

compromised Resolve's AWS-hosted private key. Uh minted $80 million of unbacked USR for 300K, dumped it on Curve, and walked away with 24 million in ETH. Um USR crashed from a dollar to two and a half cents, I think. Um Not too bad. Not zero. Held up okay there. Um and the protocol paused three hours later. The three hours later thing, I guess we'll get into that, but uh that seems like a decent amount of time for something like this to happen.

Um And and so yeah, there were a bunch of issues with Morpho lending markets. Um Steakhouse uh was also caught up in this. Um and uh I think you know, there's there's this um kind of automated allocation uh on the on the minting side. And you know, I mean we can probably we can probably jump into it here, Tay, uh with your take, but like this idea of like making it as convenient as possible to mint stablecoins. There was a long period of time, right? If you go back to like the Tether days where everyone was always mad at Tether uh because it was like this black box minting process and you know, only certain people are allowed to mint and you know, uh

maybe there's some stuff we can learn from CeFi, I guess. Yeah, well and I'm I'm very excited to hear Omer's perspective because for me, my perspective is this is actually there's a lot of wild stuff that happened and there's a lot of complexity in what happened and how uh where bad debt was accrued, where the losses happened, where things can be improved there. But at the root, we do and back go back to the fact that a single party had a single key, that thing was compromised by some bad actors, and that allowed them to take unilateral action.

And apparently this unilateral action, uh basically minting a whole bunch of USR was either not monitored or it maybe they had alerts on it, but nobody was monitoring those alerts. Um and so it you know, as we go into all of the more interesting complexities around this, I just want to remind everyone that at the end of the day, this is a very web two oriented hack. This is a key that was compromised that was controlled On AWS, right? On AWS. Yeah, so it's yeah, so it wasn't uh it's not quite your perfectly classic private key compromise, but it's about

as close it is as it gets. Basically, the key to AWS um was compromised and the AWS AWS and and basically all infra have like key management solutions. And so you like put your private key in this little section of AWS and you're like, "Now it can't be exported. Now it can't be compromised." But in order to interact with that key and in order to take actions like minting or any sort of actions, right? Um wherever that key lives, you have to be able to interact with it. And so sometimes the system can allow the key to be exported uh or, you know, uh if it's like slightly more secure then you just have to like ask the key to mint or burn or

whatever, do whatever, move everyone's money, whatever the case may be. Um So So just a question on that, right? Like so >> Yeah. you know, the the old school DeFi way um was you just have like a unencrypted private key sitting on your laptop. Yeah, your MetaMask or your laptop. Yeah, and someone breaks into your laptop and steals it. But we're like, "No, no, no, that's crazy. You wouldn't uh do that anymore. Now we're just going to put a single private key into AWS and Jeff Bezos will stop everyone from Yeah. Into the into their secrets manager where keys >> And so so just to be clear, this was not someone breaking AWS's key management system or something like that. This is

just someone getting a password for something effectively. Yeah, basically like getting into the AWS account and then once you're in the AWS account, you can basically command that key to do whatever you want. Um in most cases, in most hacks that we see, they just export the key from the secrets manager. In this case, it sounds like that wasn't what happened. They just they just were able to once they were in AWS, they were able to say, "Yo, mint me all this money. Thank you." Right. Right. So they didn't even have to exfiltrate the key. They could just It's like super user access as soon as you're in AWS.

Yeah. And I you know, it goes back to you know, the the the the attack surface, but also in my opinion, like this is basic risk management. The reason you don't want your private key compromised, the reason you don't keep it in your MetaMask, is because that key can then go and do things that harm your protocol or people or whatever. Um just because you move that key to AWS or another secure solution doesn't mean that those outcomes are now impossible.

It just changes how those outcomes are accomplished. And so instead of you know, hacking the one computer and taking out of MetaMask, you have the AWS and you take it out of AWS secrets manager. Um those sorts of things. And so I think we do need to get more robust in terms of, you know, just actually doing the threat modeling and actually understanding what are we protecting against, how do you monitor these things, how do you prevent these things from happening. Um cuz in my opinion, like I've I've just as a as a Pudgy maxi, uh I just want to make sure that Luca, the private key that allows you to mint more uh Pudgy Penguin NFTs, right? That that's uh not in the AWS. Yeah, yeah, we're we're good. Okay.

>> [laughter] >> Um Omer, what's your what's your take on this? Uh I Yeah. I mean, hey, let's start with a lot of money was lost and bad debt was created. So first thing, it's like a difficult event for the industry. Um just like on the AWS front, like even within AWS, there are levels to it, right? Like So probably the most straightforward thing is like storing a single key uh in your EKS, but even if you are using AWS and you're using their secret manager, you can have uh like two fac uh on AWS. You can have biometrics. And of course, on top of everything, like if

you care about security, you don't want to have a single key that ever has unlimited permission to do an infinite mint. So even if one person in the organization um is compromised, you want it to at least require, you know, several more. And that makes it all the more difficult for any attacker to get unilateral control over the minting function. So even in AWS and kind of web two, there are levels to um security uh that you can take in order to kind of protect protocols. So so just a question on that, right? Like um is there any good reason why someone would have a single Like is this some like architectural choice where they're like, "Uh we don't want to be there when minting happens. We want, you know, people to be

able to mint anytime. We want it to be convenient or or whatever. So we need this key that has the minting control to live in AWS so that at any time someone can turn up and we can mint tokens." Is that Like architecturally, is that kind of the the intent here or uh is it just not not, you know, well thought out? >> mean So A, I mean, I haven't at least seen like an official postmortem. I think >> Postmortem yet, right? Yeah, some of it is still ongoing and um I think they're they're negotiating with the exploiter and you know, I expect them to kind of share more details once it's no longer an ongoing situation, but I don't think that anyone would be interested to hear their take, but I don't think that anyone would

argue that this is like an architectural like decision or that it's like superior in any way. I don't know like what the circumstances were that that led them to kind of making that choice. The interestingly like on the audit, there were other parts of the contract that required multi-sig and had a different like operational security model, so to answer your question, I don't know, but it does seem like for any kind of stable coin, you know, we've seen these hacks before. Infinite mint hacks like super prevalent in 2021, 2022.

It's kind of the core one of the core functions that you need to be careful of. So it'll be interesting like to hear the reasoning, but there are a lot of ways to do it. And that's just on the AWS front like also there are DeFi native solutions like to do this, right? So there are things like proof of reserve oracles, right? So you have like a separate oracle that is basically tasked with understanding the value of the reserves at any given time. And there's just like a like an on-chain check, right? Like there shouldn't be a gap. I think at the end the ratio between the minted USR to what was backed was 266 to one. Right? Right. And many stablecoins today will do things A like controlling the velocity at which something should

be minted. So you know, maybe there shouldn't be more than 10 million mints within an hour. Like the the max is 10 million per hour and if you want to mint 80 million, it takes you a day, which is totally like a legitimate choice. >> Dude, I don't have time for that. I don't have time for that I need my 80 mil. I need my 80 mil in 3 seconds or I'll find another stablecoin. This is a competitive market. I can't wait all day for 80 mil. >> tradeoffs and tradeoffs were were made but there are ways to mitigate this both on the web three side and the web two side.

Yeah. Right. Yeah. Yeah, interesting. I mean, so so you know, this like most DeFi things that I'm sure Tay you you got more takes here, but like it feels like there are one you know, in like the nuclear industry they call like normal accidents, right? Like these like cascading things of like the guy just like leaves the door open because it's cold that day and then old wind blows onto the console and the console gets cold and it does a weird thing that it doesn't usually do and then like something catches on fire down and then all of a sudden you get a nuclear meltdown.

And you know, there's a bunch of things where it's like, "Ah, man, we're supposed to have an alarm if the door was open for too long, but the alarm the battery ran out and you know, like the you just have these like weird series of events that you know, you think, "Well, there's not going to be five of these things or seven of these things. You know, we've got seven failsafes. There's no way that seven things could go wrong consecutively." I mean, it's funny. Like people probably forget this, but Synthetics had a an oracle related issue like this where we printed 11 billion dollars worth of synthetic ether back in 2019.

This is when we learned not to roll our own oracles and and switched to Chainlink. But but you know, we had a bunch of checks there as well like, "Oh, you can't do this. You can't do this." But it was it was this weird situation and we didn't have any cap on minting, you know, cuz it was DeFi where like you can't stop things from happening. Like code is law, bro. So so you know, we had we had all of these things that we could have done that we didn't do that like were you know, very obvious checks.

But but we then subsequently were like, "Okay, we've learned our lesson. We'll we'll do this." We also had you know, a situation where we had to negotiate with the hacker. I think we paid him like 50 and got the money back. But we luckily we paused the protocol fairly quickly. We had like a a pause thing and I think paused it within like an hour or something like that, less than an hour after it happened, so. So yeah, Tay, what's your what's >> [snorts] >> what's your take on this like from an architectural standpoint even though we don't have a postmortem yet, but >> [snorts] >> what's >> I think it just again, it just goes back to DeFi spends a lot of time I think thinking

about and analyzing and obsessing about sort of more novel risks and more interesting things and especially the things that seem like impossible to mitigate. And as a result somehow like the basic operational security and basic threat modeling just doesn't get paid attention to. It's a very weird thing. Smart contract audit I mean, that's that's like startup life, right? Like I'm sure if you I'm sure if you go back to the start I'm sure It is.

>> back to the start of this thing, there's someone that was like we'll just use AWS KMS for the first six weeks and then we'll like switch to this like multi and they've got a whole plan of like all these things that they're going to do and then life life comes at you fast and you're like, "Holy we have a billion dollars in TVL. This is Yeah. We've got other things we're scrambling to solve. It just it's it's it's so interesting to me because if you if you just imagine like the most basic threat model for a stablecoin like an infinite mint, basically like losing control of of the supply is like top of the list. Okay, so how does that

happen, right? And so you just go down the list and it's interesting to me that there was you know, cuz there are they have undergone audits. There have been discussions. They they obviously do it's not like they're just complete idiots and not thinking about risk. They are. But like the the biggest, most basic, top of mind one, it doesn't seem like people have paid enough attention to and it's not just them. Like I don't I really don't want to pick on them. They're probably better than most of DeFi because at least it's in an AWS.

>> [laughter] >> Like no joke. Yeah, there's a lot of people I mean, you know, you don't you don't hear about the things that don't happen, right? And you know, there's a lot of people that just have like an infinite mint PK sitting in MetaMask on their like machine, right? And for whatever reason they don't get the Zoom call or something and so you never hear about it. Yeah, exactly. So I would just encourage people like again, just go back to and especially the security auditors and the risk people like I understand that you want to look at the most novel, most DeFi, most smart contract, these hard, impossible, like super fun things.

But if you're not going to just sit there and like at least like write down what the requirements are to mint and acknowledge that it's like it's a it's whoever has access to this AWS can mint forever, then I then I I just question like how you can call that a security audit, right? It's just it's just the most basic stuff. But I want to give Omer the the chance to to talk about his perspective on this cuz it's definitely very different than mine.

No, I think I'm like a pretty aligned with everything that you've said thus far. Came to your your comment on like the startup life and things moving fast like on one hand that's true, but I think just every startup has you know, tradeoffs that are acceptable. So if you're like running a social media site and you're obsessed with growth and you know, you're going to make some tradeoffs or prioritize differently like security and the worst case is like um some you know, consumer aspect being leaked, which isn't great either, but maybe there's like an argument there, but like as a stablecoin startup just for any or any asset issuer in general, I think there's like I don't know if there's um it's the worst case scenario, right? So

that should be top of mind for for everyone even if it does introduce friction. And like yes, security introduces friction, but there's a reason for it and um so yeah, I think that's like just a good framing for anyone who's working with assets. On Taylor, really interested to hear your perspective on like the security audit itself because I think when people hear security audit or like risk, in their mind they assume that the auditor is engaged or looking at every part of the system, which isn't necessarily the case because a lot of these protocols are iterating. They'll work with like many auditors and each will look at different parts of the system and also different points in time. I think the

the metric for this or the number someone had said something like 14 audits had been done, but when you look at the audits, I think and it needs to be verified, but that no part of the system was audited more than twice and that most of the audits were on separate components. So Which is a bit like even for me that feels unusual, right? Like you know, the the iterative audit approach is definitely something that I think has has kind of like grown over time, but it used to be that you would sit there and like do three full holistic end-to-end audits, but to your point, Tay, you could do 50 end-to-end holistic audits on smart contracts and no one

looks at like the KMS, you know, opsec, right? And then no one says to you, "Hey, like is by any chance is the password in like a Apple Notes for this AWS?" Yeah. And you're like, "Oh, yeah, it is. Yeah, but like it's kind of like it's fine. Like Amazon's safe." worry about it, bro. Yeah it's um I think you're right on the audits. I didn't look I didn't dive into every single one, but I there are a huge amount of audits, but they did seem to be pretty narrow in scope.

Um At some point I do feel like the audits become like security theater and this like sort of even what we're sort of seeing with like the the risk people and like this sort of like partnership engagement relationship thing that's emerging, it feels a bit like security theater. Um the way that like I would approach this is like you're going to sit down first as a team and you're going to again like attack surface threat model. Like, what are the bad things that can happen and let's prioritize them. Um and then yeah, there's going to be certain experts that can help like check yourself, help you

write the test, help you understand the stuff, help you mitigate the risk, whatever it may be. Um but if you don't have that, it's just like the approach, right? If you don't have the initial threat model done so that you know exactly what you're trying to accomplish and what risk you're trying to mitigate, then you end up being like, "Okay, we just we need an audit." And so you find the available auditor at the price point that you want with the branding that you want and then you're like, "Hey, audit me." And like >> Yeah, it's like a rubber stamp sort of. I need to I need to put the audit on my, you know, website sort of thing. So >> And and this is in defense of security

auditors, this is why the auditors are like, "That's out of scope. Like, we were not engaged to look at that thing. We weren't supposed to look at that thing. Why didn't we ask that question?" Because that's not what we're there for. I do get it, but I do think like at a some point Oops. Sorry. Um at some [clears throat] point Baby shark. It broke [snorts] through my do not disturb even. Um at We'll talk about it next week, whatever that was. I'm sure. Um at some point I I just think the security auditors have to like um I don't know, figure out a way to to to make sure that the teams are properly

prepared and are sort of aligned like There's there's best position to get an audit. stuff that you can do, right? Like, just be like, "Hey guys, like we're not going to audit this, but if we're going to put our name on your website, we want to make sure like some basic due diligence of, you know, just checking to make sure that the infinite mint password is not in Apple notes. Just if you don't mind. We'll just check on that. Hey Luca, like, you know, you have for what it's worth, I was joking about the NFTs, right? But you've got a lot of attack surface in your life, right? Um you know, like you you have to you have to think about this sort of

stuff, you know, particularly when it comes to like abstract, right? Like there's a wall there's wallet in front like you've got like a lot of tax attack surface across all of the abstract stuff, let alone, you know, Pengu presumably you you guys kind of closed that off, right? And and Pudgy's I was joking about the NFTs, you can't you can't mint more Pudgy's unfortunately. Um but but on the abstract side like you have a lot of attack surface. Like, how how do you think about this? Yeah, I mean as somebody who's not a technical lead, all I can say is it's it's for a while and a lot of the members on the team can quote me on this has been my biggest fear and I remind them consistently that it's my biggest fear.

And that, you know, there's a lot of things that we can fight, but one of the you know, that's a code red Delta Force, you know, you you you you you can't go back from that. And so, you know, all I can do as a non-technical founder is stress to the rest of the guys and saying that, you know, we have to make sure we practice, you know, best in class opsec and I really trust them to do it. But uh you know, I have the beauty is about our organization is the president of Igloo who's Lorenzo is like a four-times national robotics champion.

He was our CTO before he was our president. And so he has a really great deep dive to kind of DD when I when I make those call to actions to make sure that when those guys say, you know, we're practicing best in class opsec and then it's not and I probably would say it's like the one place I will never question the cost. It's the one place I will never question the resources or the effort or, you know, the parameters that are needed to make certain changes. I think we need, you know, multiple lawyers to sign, multiple people in different jurisdictions. Uh you know, one person can't, you know, ruin the whole ship if there's some reason hog-tied, you know, in a hotel room. Uh you know, we we as best practices you can kind of enable. I've

basically encouraged them and said like, "Look there's places we can cut corners and places we can be cheap. This is the place that if it costs a gargantuan amount of money, it costs a gargantuan amount of money. And that's probably the best that I can do as a non-technical founder and then have my guy Lorenzo fact-check when these guys say that we're we're we're, you know, taking the best steps to making sure that everything is as safe as possible. But like, you know, the chain >> It's also like posture, right? Like, it's like, you know, I'm non-technical like, don't bother me about this, guys. Like, I'm talking to Walmart, you know, about like the next you know, merch deal.

That kind of attitude I think is is what becomes like very concerning, right? If there if there isn't like a sense of you know, ownership even if you're non-technical, right? That like, "Hey, let's make sure we don't do really dumb stuff." Like, let's actually invest the time and effort and and that's like it's not even usually money, right? It's just like the time to slow down to say, "Let's do opsec right." As opposed to whatever's expedient to just, you know, get things done. Yeah, I'm super paranoid about this. So like I every couple of weeks I drop a chat to some people just thinking of things. Actually on the chain side, the the difficult element actually is because we have that interface and that curated interface,

it's actually less about the back end and our side of the ship that I worry about. It's the other people's side of the ship, but because of because I curate the interface in the front end, if some of the third parties get hacked, they blame me as a curator. And that has actually happened and when that happened, we actually went out of our own pocket to refund, probably set a bad precedent in that respect. Um but but, you know, we it was the first time that it had happened. It was really early after launch. You know, today, you know, we obviously have to be featured on the portal and the platform that we curate, you have to go through a couple audits, you know, through trusted people that we obviously respect, you know, who whose audits we respect. Uh but that's actually the more complicated one is is

is if I curate something and I say something to the community that some, you know, by by being on our platform that it's safe and then that gets compromised, huh unfortunately, they blame me even though being frank, like you can only do best practice and that's ultimately, you know, to the builder, but that's the more tricky one. I'm pretty confident on our boat especially because one, I'm super paranoid and I repeat it to the team consistently across both organizations, Pudgy Penguins and Abstract. Uh and I'm very confident in that team's talent and ability to like listen and understand that that's a huge risk factor if not the biggest risk. You can come back from pretty much everything. Like, that's one of the few things I think is very hard to come back from. So like in that, you know, I can

come back from fud, I can come back from low sentiment. Like, that thing those things happen. A big hack is something that's really hard to come back from. Even on the social side, I had my socials hit. So then you have that like everyone's on YubiKeys. You know, at Pudgy Penguins we pay a guy a six-figure salary to literally do opsec all day. We have a head of security at Pudgy Penguins. You wouldn't even believe that. Ex-CIA guy named Bo. So he's great. You know, most organizations don't have a you know, head of security running around, but like I'm that paranoid about it that it it means a ton to me. And so some fishing, things like that. So we take it very seriously here.

Yes. Awesome. So let's talk about contagion here cuz I think this is another very interesting >> [laughter] >> thing. Um Tay, do you want to just walk us through I know. I I am here to listen. I'm here to listen. It is cuz this is like quite over my head. Once we get into the weeds on this, this is over my head. And so I'm here to learn on this one. All right, Omar, walk us through it. All right, I'll I'll do my best to go through the timeline. Um and then also Luca, there's some interesting like parallels like with what you were describing with the front end because usually when you get there are actually like many different types of front end attacks, but I think the one that um it seems that nation-state actors like DPRK like North

Korea have been weaponizing is what's called a supply chain attack. Um and in supply chain attack, let's say on your website you're using a bunch of JavaScript packages like popular ones, um someone through social engineering or any other vector is able to get control of that package and then makes a small modification where they put like a special surprise in the package for anyone who's downloading it and effectively like what that does in many cases it gives an attacker root access to your machine. So Kane, in like your example of someone holding like a PK on their laptop, um there are just many cases where someone might be installing like a JavaScript or Python package and suddenly like all the keys are

um are compromised. So, it could actually come from what >> we don't we don't have this on uh on the list of things from this week cuz it's been crazy, but um I actually had a small scare uh yesterday morning um where the the Python Python LLM, yeah. Yeah, yeah, it got it got compromised. And I had literally been in the process the night before of installing a bunch of Python stuff uh related to agents. And my immediate thought was like, I have no idea what dependencies I pulled down. It was probably like 100 things that I pulled down to make this stupid uh thing that I was bycoding work, right?

And I like I just was not paying attention to it. I was like I was like, "Uh this is fine." And then I woke up the next morning and I was like, "Oh, Python, that Python LLM, that sounds bad. I was doing a bunch of Python stuff." So, So, so it's a different machine. Like I don't know what you installed >> No, I checked I yeah, I I checked it. I checked it. But I I wasn't at the machine and I was like, uh this is not great. So, so it's it's really common and I'll just like say on that note like even for this our solution. So, there are companies that um all they do is like kind of uh make sure that all the packages that are being sold in an organization are safe. And you know, when you're working with Claude, he's

probably or open it like Codex, it's pulling in whatever it needs at runtime. But um there's something called uh package pinning. Right? So, like you you reviewed a version of the package, you're not auto updating. Um it only kind of allows you to auto update after it's um it's clean. So, that's also like the best practice for everyone, but we can speak more about what happened over the weekend and transition there. Um So, during the weekend at around 2:20 uh UTC, I think it was the the exploit started. There was an infinite mint. Um and the attacker I think did several calls to mint if I'm not mistaken. So, it wasn't some like atomic thing that they ran. Um and that's when the contagion started.

So, fine, like USR is infinitely minted, but it's backed off chain. And in and of itself, like if it wasn't integrated anywhere at that point um they could contain everything, right? Cuz they'd be able to say like, "Hey, uh we know what was minted before and after this happened. We'll take a snapshot and either we'll um you know, make a new token uh that all the holders before that had had and just invalidate everything that the attacker had, but it's DeFi and everything is like >> Sure. I I was about to say, I don't know if you've heard of composability. Uh this is kind of our number one thing. We uh we don't want it to be only connected

to one thing. We want it to be connected to 100 things in a way that >> we did well. >> [laughter] >> We we nailed that part, right? >> [clears throat] >> Uh it was connected in many many places. Um and basically the attacker Curve was a big one. So, there were Curve pools that had USR against other stable coins. Uh started swapping there uh then before moving ultimately into Ethereum. Um and then all the lending protocols. So, I think it was Fluid, uh Venus, Morpheus uh were the main venues um they got hit up. And the attack from that point is like very simple. Um these venues accept USR as collateral. So, you deposit it as collateral, it's a stable coin and lets you kind of uh most

platforms will give you like a high loan-to-value ratio against it. So, not one-to-one, but let's say like 95% uh on each one and just start draining. Draining, draining, draining as much as you can in big batches. Um So, Fluid and Venus I think were like over 20 million uh piece. Uh then there was Morpheus, which I think in aggregate is over 10 million. Um and that's where the contagion happened and it's the same kind of a method of operation, just take whatever stable you can or kind of blue chip asset, move into ETH, and then figure out how you're going to to get it off chain.

Um So, there is a difference. I think that like in Fluid and Venus there were just actual markets for this. Um so, the attacker could do it pretty quickly and there was liquidity uh against it, which allowed for it. Um in Morpheus at the time of the hack, there was actually very little liquidity across most of the vaults. So, at the time of the hack, there was uh in Morpheus, the damage was 5K. Um which is great. It's it's nothing at that point, right? And uh you'd expect it to end. But Morpheus has this feature called uh public allocator.

And like in theory it's supposed to be really nice. Like you say, "Hey, if there's like an area where the or a market where the interest rate spikes um and I've whitelisted it um as a vault curator, I can route liquidity there automatically. Um automation, DeFi, composability >> good is probably happening in this situation, right? When interest spikes, there's a lot of demand. It's probably a a white swan, not a black swan is the reason here I'm assuming. Well, that's one I think that's like in the first 2 seconds that you think about it. You're like, "Oh, this is great.

We're going to make more uh yield like off of this like interest rate." And let you send all of the funds there. But then I think the immediate question is like, "Wait, like this thing had 5K >> rate spiking at that yeah. Why is it going from 5K to like, you know, tens of millions of dollars in like, you know, the 20 minutes? It's kind of weird. Um and so yeah, I think we're waiting for like several postmortems, but um from what it looks like and what you can see on chain, um there were batches of USCC and other stable coins that we don't know if it's the attacker or just random MEV bots, but uh we're requesting uh to borrow [clears throat] against USR uh and it was happily like approved. So,

you had all the USCC flowing through and it went from being like a 5K exposure on Morpheus to I think across all the markets it's around 10. I want to say eight, but it could be more. There's a lot of markets that had it listed. Um so, that was like part two uh of the hack, which is a little bit less um I don't think I don't recall something of that we've seen. Definitely seen like stables or infinite mints go into like a lending protocol or like a Curve pool and take whatever you can until it dries up. But it's the >> it's but the liquidity is gone, right? Like it's >> Yeah.

Yeah. Um but this part was different. It it lasted for um so so the Gauntlet vaults were the ones that were hit hardest. Um that was open I think for like between 90 minutes and and 2 hours, but there were different kind of curators I think up to 10 hours were uh supplying liquidity. And it's important to note also that there was Sorry, go ahead. Yeah, so so one one question that I always ask with these things, right? Because in my experience living in Australia, um every single time anyone's ever tried to uh do something with like any protocol I've been involved in, it's like 3:00 a.m.

Sydney time uh and and you know, like they know what they're doing, right? They know the time, they know where you'll where you'll be. Um so, a Sunday afternoon feels like a decent choice, right? Like 2:00 2:00 p.m. UTC. But I'm I'm a little bit surprised like that it wasn't, you know, middle of the night like uh you know, daytime Asia time or something like that. Um that that this happened uh or that it happened in the middle of the day even on a Sunday and you know, the visibility was was still so low. I know we haven't had postmortems yet, but that that part to me stood out as like

the the fact that the person like did it in multiple uh you know, multiple hops. So, it's almost like they it was somewhat planned, but maybe like they stumbled across this and then they're like, "Oh, and we've seen this before, too. Like, you know, someone's like, "Oh, I have all of the keys. What should I do?" right? And then they panic and like start stealing money. So, this like what's your take on on that? It doesn't it There's a few little signals here that feel like this was like the person stumbled upon this somehow and didn't didn't know what they had and then started doing Yeah.

>> [sighs and gasps] >> I would say I would Well, yeah, you go. I don't I would say a bit just cuz like they didn't It it seemed a little bit like a uh like cuz they minted and then they minted again. And then they're like, "All right, let me go run to Curve." And then they're like, "Oh, like let's It just It felt like they had some some semblance of a plan, but it did not feel like they had like run through this whole thing top to bottom beforehand or that they necessarily knew um maybe they didn't know, you know, they're kind of they had the first the initial the initial thing planned out, but they didn't, you know, they were rapidly evolving over time.

Um generally in terms of like the timing of hacks, uh it doesn't matter what time zone you're in when a really bad thing happens, it will be 3:00 a.m. wherever you are every single [laughter] time. Like, you have to expect that. Um and yeah, I saw like there was like commentary on PagerDuty. Guys, pay like you have to have pagers. Like I'm sorry. Like, I mean, you just heard my my phone break through do not disturb, right? Like that's that's my life and that's, you know, uh that should be everyone's life when there is an emergency and someone needs to get a hold of you uh even if you're in like do not disturb, even if you're asleep, it will break through and it will uh you know, bug you and make you wake up.

>> the the OpsGenie like uh little like ringtone, even my wife knows that. Like if that thing goes off, she's like, "You need to get over here immediately." Yeah. Yeah, I mean, that's like um like every organization that's managing money, I think that's like expected. Unfortunately, not everyone does it. And in Web 2, there's like a standard called SOC 2. It's not like anything crazy. I think that most financial or all financial institutions won't even talk to you if you don't have it. And just because you have it, it doesn't mean that you're some fortress, but it's it's the basics.

And part of that is having like alerts. Um and here it's um I don't know how many teams uh do that, right? So, PagerDuty, Opsgenie, got to have that. And in terms of the attacker, there's a few ways that I would interpret it. Um one is, you know, potentially um the attacker might have expected that the second that they received the PK, that there would be an alert. So, there there are solutions, for example, like CrowdStrike, where you will get that Opsgenie uh phone call or a PagerDuty immediately if it's detected that like any sensitive data leaves your system, right?

>> Mhm. Again, there are big big companies that like this is all they do. Um so, perhaps he got the key or or they got the key and thought that they had limited time. And it was in the middle of the night, but you know, the key would be rotated and they had to do whatever they had to do right at that moment. So, that's one possibility. Um the other possibility is something that like, you know, we call like an operator attack. So, it's not like a script or something. There's actually someone on the other end, which in this case it seems clear that there was, that is thinking about how to do the attack. And at that point, um you know, if you mint a hundred million dollars, like maybe the thinking process is, "Okay, I'm going to be exposed immediately. I'd rather do this

in smaller increments and batches. Um I think I'll get better like execution or maybe be able to kind of cover up my trails faster and do it in that way." And if someone did it in that way, could potentially suggest that they knew the team didn't have that security posture. But yeah, this is like all speculation. Um Mhm. Both of those things would make sense to me, right? If someone just thought that they had the key and they had to do it now cuz it'd be covered up, or someone more sophisticated that knows like the Oregon knows that they don't have these um or the alerting infrastructure in place and is taking their time maybe not to uh draw public attention and have like a better outcome.

Yeah. Yeah, and it is all speculative, but it is super fun to speculate. It's [laughter] yeah, it's I spent a lot of time doing it. Um and yeah, on your note, like the operator versus like automation, most things in crypto these days, like almost all them, are like what we call like hands-on keyboard, like manual operations. It doesn't mean that they're messy or immature or unsophisticated. It just means that um that that that that there's not there's just not a lot of great opportunities in crypto to pre-script something where uh that increases the chances that you'll be successful at

your hack. Um and the best most sophisticated operators are the ones that like practice beforehand and like have a really solid plan, but are also just so deeply familiar with how crypto works and janky things and error messages and all of that that they adapt really quickly. Um one example was the UXD when they had their mint happen. Um they were just uh they were just dumping it everywhere they could find liquidity, they were dumping it.

They were also like every single swapper in front end was trying to block them. There was addresses all over the place. Um and at one point, they got fished by like Inferno Drainer, like a wallet drainer. So, basically, DPRK, Lazarus Group, was like trying to dump all these coins that they had just infinitely minted. They get blocked on one front end, go to a second front end, accidentally get fished, lose a bunch of money to the fish, right? And probably, I think it was like two minutes later, did another mint of like 900 trillion coins. And to me, like that was like wild because it was so clear that they that these were operators. These are people with their

hands on the keyboard using crypto just like we do. But just how they it didn't even they didn't even flinch. They're like, "Oh, we just got drained. Here, let's go mint another Back to the wallet. >> go mint some more and then go to the proper cow swapper or wherever they were going. It was wild. Um and that's in crypto, that's the difference between unsophisticated and sophisticated. It's not necessarily that >> of like they clearly didn't, you know, they're like, "All right, we've done the thing. Now let's run around and like hit some front ends and see what happens, right?"

Like Yeah. They didn't have that, you know, fishing link already scoped out. They're like, "Oh, let's not let's make sure we don't go to this one, guys." Like, you know. They were not using MetaMask because we had the URL blocked. >> Yeah. Probably, I'm sure for the DPRK, that's like a contractual obligation to not use MetaMask at this point. It's so funny. It's so funny. I'm like, "Ah, suckers." >> [laughter] >> All right. [snorts] Um do we have any uh any closing thoughts on this before we go to our next >> Omer, what's your what's your biggest takeaway on like what people should do or what we should be looking for next in terms of like the team or the risk

people or the curators or whatever. A few things. So, I I think there's a whole other part um of this, which is like, "Okay, USR was compromised, whether it was hard to do it or sophisticated nation-state or just random person on the internet that got the key." That's one story. The second level of defense is like anyone who's running um a lending protocol in this case, right? So um like when you're onboarding an asset, like you look at counterparty risk. Part of that is like it's unique for for every asset, right? Um and there are just kind of measures you put in place, right? So, uh you review the asset, you can put like a debt ceiling like on top of it, so like a limit, and basically limit the credit

line that you give for every asset. Um typically, I mean, or always, if I give Aave as an example, the those limits and ceilings are always in line with demand, right? And just generally, you always think of like risk and reward as like two sides of the same token. Um so, for a relatively like small token uh like a USR, uh those ceilings and limits would be very low, um unless you saw some like real demand coming in. And you wouldn't expect it to happen within an hour out of nowhere, right? So, those teams as well, like if you're running a lending protocol, if you're a vault curator, like you need to think about the assets you're onboarding. You need to think about the assets you're

whitelisting. Um and even if the asset issuer um for whatever reason is compromised, there are many many measures that you can take in place in order to protect yourself. Um and yeah, it >> Maybe maybe we maybe we can cover that uh quickly after we go to ads cuz I I am curious about that cuz like, you know, a lot of these lending protocols, the entire point is curation, right? That like, you know, so so let's let's go to ads uh quickly. Um so, before we continue, uh here's a quick commercial break.

The world is about to see one of the largest infrastructure shifts of the century. New technologies are using more energy than ever before. But our legacy grids can't supply the demand. And we are barreling [music] towards a global bottleneck. So, Fuse is rebuilding it. The Energy Network is an intelligent [music] decentralized grid that coordinates smart devices to balance supply and demand. The network harmonizes existing infrastructure, increases grid [music] capacity, and unlocks low-cost clean energy. Energy Dollar is the native token of the network.

The more electricity the world needs, the higher the demand for the Energy [music] Network. The value of Energy Dollars may fluctuate. From one of Europe's fastest-growing energy startups, follow @fuseenergy on X to find out more. Multichain Advisors is an emerging technology growth firm that has helped create over 50 billion dollars in enterprise value for more than 80 clients like Piff, MoonPay Commerce, and Wormhole. They've worked with some of the largest and most impactful companies in the space.

They're the partner you want when you're navigating markets and trying to break out from the noise. They help navigate TGEs, go-to-market BD and partnerships, capital markets advisory, PR, media placements, KOL activations, and more, driving execution from launch to scale. Their results are measurable. To learn more and start building real traction today, visit multichainadv.com. If you're looking for help with crypto taxes, Crypto Tax Girl is offering $100 off for Unchained listeners. They provide personalized crypto tax reports and returns, and spots before April 15th are limited.

Go to cryptotaxgirl.com/unchained to save $100. Once again, the link is cryptotaxgirl.com/unchained. All right. Um we are back. We are just uh wrapping up our discussions of the Resolved hack, but I think this is a more broad question around DeFi lending markets, etc. You know, one of the things um certainly with Morpho uh, that is, you know, the claim to fame, right? Is that these are like isolated markets that are curated that, you know, have have, you know, individual, uh, operators of of the market or curators of the market who are

responsible for doing their own risk assessment, um, and therefore it's not like a centralized party, right? Um, this feels like it somewhat undermines that thesis, right? That, you know, some of the things that happened here with like, I mean, in particular the the we haven't even talked about this, the Oracle being hardcoded to a dollar, um, on a stablecoin, like and it's not like it's Tether, I mean, you wouldn't hardcode Tether either, but like, you know, you wouldn't you shouldn't be hardcoding any stable every single stablecoin over time at some point will have something that happens that causes it to depeg to some level, you know, maybe it's 97 cents, maybe it's

50 cents, right? But, uh, but like, you know, I've I've traded a couple of stablecoin depegs myself, but, um, but yeah, like the idea that you would just hardcode that, but also then have these like just-in-time liquidity like all of these things don't really speak to like manual well-thought-out curation. What's your what's your take on on that in terms of the like curated liquidity markets? A lot of thoughts. So, like, we won't go into this tangent, but just like how to price an asset is, um, there's a lot there like on stablecoins.

So, like I'll just give an example like if the if the collateral is high quality um and let's say that you're using whatever data source, um, like typically stablecoins, you know, people will loop them, um, or borrow at like very thin margins. And what you don't want, for example, is if there's just a big swap um, that moves it, you know, from a dollar to 98 cents for 30 seconds, you don't want to on one hand like liquidate people for hundreds of millions of dollars. Um, it's just like bad UX. So, that's like one side of it, but it's really not binary. Like there we have risk oracles, there are other solutions in the market.

Like you really need to understand what is it that you're pricing, what is the use case that you're solving for, and within that, what are the the tradeoffs and limitations that you're willing to make. So, that's number one. It's it's not a binary like either hardcoded or have the live market price and deal with the volatility. There there are solutions that are engineered exactly for this. Um, on the So, how does that relate to to Morpho? Mor Morpho like one of the features, maybe in this case you would say it's a bug, is that the markets are immutable. So, the second you spin up a market, you cannot change the configuration of those uh of those markets at all. Here the Oracle was initialized at hardcoded to one, and it was one forever, right? It was one

before the hack, it was one after the hack. Um, and basically what that creates is like that vector in in this example for the the attacker to just drain everything. Mhm. Mhm. And I guess as a vault curator like what is in my eyes like the role or the responsibility of the curator? Um, we're we're in crypto and everyone likes to chase like super high returns. Um, so certainly like one of it is like, um, you're going to optimize the capital allocation on behalf of any of the depositors, right? Um, but again, going back to that like point like risk and reward two sides of the same token. I it's not worth kind of like getting incremental yield, um, at the risk of

financial ruin, right? So, that also needs to be in the kind of mind of everyone as they're configuring these markets. Um, each curator, um, has their own process, um, that they take. I'm not deeply familiar with um, how they approach the things or how these decisions were made, but on top of that it's just also this unlimited credit line. Um, like even in traditional finance, um, you know, banks won't just extend that to everyone, right? There there's ways that you >> you might even say especially like, you know, this is one this is one of the cha you know, like talk about composability, right? Um, also everyone's money is equal even if it's not, uh, real, right? Like, you know, the

idea that you the idea that you would like have some kind of check and be like, "Oh, this wallet doesn't look good and we're not going to, you know, we're not like it's just not really contemplated, uh, in in DeFi. It's like everything's fungible, every wallet, every position, every asset, and, you know, uh, that's where these like downstream kind of contagion things happen, right? Like one thing goes wrong upstream of you and you're like, "Oh, those guys are probably fine. I'll just treat everything that they do as completely safe."

And then you go, "Oh, oops. Okay, I didn't realize that." And it's hard to reason about, right? Like as you were saying, Tate, there's like 100 interrelated connections of things, right? Like how, you know, um, but also that's your job. That that was >> [laughter] >> Like that's kind of the job, all right? Like Okay, so I have a question. So, if I am a uh, like I get it's DeFi and nobody has any rights and there's no accountability or whatever, but like theoretically like people lost money here and it's not it's it's due to some like I put my money here and I expected XYZ to happen, promises were made,

whether they were uh, literal or implied, but like they were, right? I have no recourse though, right? Like or or is there is there potential recourse like starting to be baked into these things? Cuz this feels like especially the curator model feels especially prone to like this is a pretty established sort of relationship type situation and yet everyone's just shirking responsibility for the sake of it. No?

It's difficult. It's a difficult one because A, there's like nuance in this in the sense that not all, um, there's different levels of accountability, I would say. Like not all loss of funds are equal, right? Like if you mistake post on Twitter your PK and everything gets drained, like maybe I'll think about that differently than a super sophisticated, um, nation-state sponsored attack where your multi-sig was compromised and four people, um, were hacked over the course of a year. Like that kind of changes things, at least in my mind.

Um, that's number one. Um, there there is inherent like risk in these things and I think just like the vault curation model is something right now that is, um, it's unclear. Uh, like there there is no like if you went to go get like a money transmission license or commodity pool operator, those wouldn't even necessarily kind of like cover it anyways, so it's just like this new primitive, um, that there is no exact path, but I think having said all of that, um, the question is just like, you know, how what is the accountability of people and and how responsible are they and how transparent are they in communicating like the different things. Um, and I think everyone's taking like their own like path on that and we're seeing this

industry of vaults like unfold in real time. Um, so I don't really have like a good answer for that, but I would say that not all exploits are equal and there's different levels of responsibility. Certainly in this one like obviously it started with USR, but then it the ability to contain it um, it could have been contained on multiple levels. So, that is like a question. Um, and yeah, extending unlimited credit lines, I don't know, it doesn't sound like a good idea like at any point. Um, but hopefully like as an industry we can like learn from it and I would like to say that we're not going to see the same mistakes again, but it depends on us as as a collective.

Yeah. Yeah. Why would uh, why would you use a cure What's the value of using like a curated vault versus just like doing myself or >> More yield, right? Like that's my like, I mean, better risk-adjusted yield is the curator, right? But like the curator is typically, in my experience, right? Are like chasing like more long-tail yield opportunities, right? Like that's their their like if you think about what like the principal-agent problem here. Like what is the job of a curator? Like make me more money, not keep me more safe, right? Like and this is part of this is like a classic DeFi, you know, style up, right? Of like

assume that the risk is zero and then like take me out the risk curve as far as you can take me, so my yield is as high as possible, but like the risk remains zero, right? Like cuz that's your job. Like keep the risk at zero and keep the and it's like that's just not how it works, bro. Like like if someone's paying you 25% for something >> [laughter] >> and you're like, "This is total this is like treasury but the same thing. It's risk-free, right?" Like, you know, there's there's and like there's this like false equivocation of like all risk is risky and therefore all risks are the same because

everything is risk. Like you could get hit by a bus. Yes. DeFi There's my hot take. DeFi does not know how to reason about risk whatsoever and it's a freaking joke because people will literally say that. They'll say the risk of an alien coming down and exploding me is the same as As resolve having an infinite mint bug. Yeah, because their AWS was protected by a key that was on whatever ex-employee's computers and you know, blah blah blah. No, it's not. There are ways to reason about this. There's ways to reason about it and there's also ways for you to mitigate your risk.

You can mitigate your risk by putting the liability on someone else, but we don't do that either. We don't have any liability or responsibility or accountability. And like there it's a bit of like group insanity as well, right? Like but one of my favorite quotes ever is the the Larry um Cermak quote where he's like um iconic this is like 20 late 2020, right? And he's like I cannot imagine the level of stress that DeFi teams are under. You have a 24/7 bug bounty on your And this is like when we definitely had no idea what we're doing. Like the technology is about like new people have shown up like Homer who like actually I can help you to solve some of these problems, but

like back then you had to roll your own oracle, you had to do all this crazy Um and it and it is it was it like that part hasn't changed. It is a 24/7 365-day a year bug bounty. In the case of Resolve it was a $150 million bug bounty or 80 whatever the number is, right? For anyone anywhere in the world to get that AWS key. And that's the way that you need to live, right? Like that there are people outside your door clawing at your windows trying to get in.

And if you don't think like that if you don't if like I go to a hotel and I like immediately start looking around like and you know, I know Luka you're you're super paranoid as well, but like there like you have to think you know, especially if you deal with North Korea. It's why having a North Korean pen pal is so useful for me because like you can't forget like the guy is there all the time he like DMs me with like his All the time. >> And stuff. And so so like I don't forget that North Korea exists ever, right? Like my friend is over there. He's like doing stuff all the time, right? So um so What was he at 2 UTC?

>> [laughter] >> I know, right? Yeah, exactly. I know it's interesting. Yeah, yeah, yeah. So so yeah, so like I just I think that there's like this this like very fundamental like inability to judge risk that we have where where everything is so risky and and this is like an adaptation. This is a psychological thing, right? Like a human psychological thing that if you live in a war zone, if you live in a place where like it's constant risk of death and you know, total loss, right? You become a bit immune to it and it's easy for this like false equivocation to creep in of like everything's risk aliens, bro. Like what are you talking

about? It's like no, no, like we have a way of judging risk and it's called like the yield on the thing that you're doing. If the yield is 25% that's the market to And like you know, not saying that markets are efficient at all certainly not in DeFi, but like there were signs. If things if something's paying you 25% interest, there's like that's a signal. >> There's a there's a catch, right? We we all lived through Terra. Um so side note I think like OpenAI is like offering a 17.5% return to investors on the latest round, but we could talk about that later.

>> [laughter] >> I'm the first to say this is like if I I'd be lying if I told you that I slept well since I started this company. It's literally 24/7 365, but solutions exist and I think that's the goal of like the curator, right? Like most people don't understand and they're delegating responsibility to you. For that they pay you a fee and the expectation is is that you're doing everything possible to get them the best the best risk-adjusted return. To frame it though a little bit differently like right now where we are is while things might feel bearish, there's so much happening in terms of like enterprises, FinTechs coming in on chain. So we have the vaults with Kraken. Obviously Coinbase launched theirs last year. And

this is like a completely like different risk profile where they're not degens. Like obviously they want like high yield, but before anything what they want to see make sure that there's no principal loss for any of these users. Um and the current market that we're in is just everything is is compressed. So the yields have come down like crazy. Um in many cases we're not above like the T-bill rate. And for many folks who might not be super long-term oriented, that is enough incentive to venture further out on the risk curve. Um and you know, markets are markets and there's mean reversion and like if you're playing that game um there there's just a matter of time,

right? So you need to think about like what is where are you depositing your funds? What type of yield product is it? Is it something that's always trying to be the highest returning? If it is, it's it's a really risky game that you're playing and I think retail uh delegates because of that and I think enterprise looks at differently. So hopefully um as the space matures like there's just a different uh incentive structure for people who are like more long-term oriented and not chasing the latest trade. I mean that's a good it's a good uh segue into the next topic which is that Aave V4 has emerged out of governance hell um and I guess the good guys won. I don't know.

Um but uh but it looks like um it looks I mean Marc Zeller would say just use Aave. All right. I'll say it for him. Um but uh but you know, it looks or maybe not anymore. I guess he wouldn't say it anymore. Um so so it looks it looks like um I think this whole you know, ignoring the governance for a second, right? Like the the point of this Aave uh move from V3 to V4 um you know, the thinking behind it um is to replace the monolithic pools, right? Like to to you know, kind of spread the risk out um you know, while mitigating contagion risk. There's a bunch of things that they have done.

Um it's why like you know, I I was always a bit of a skeptic towards the like Aave V3 is some magical system that like will never be surpassed sort of thing. Like in that was that was one of the things in this whole governance debate of like we shouldn't be moving away from V4. Like of course we should have market uh driven uh shifts in in things. Like we shouldn't necessarily we shouldn't kick everyone out of V3 into V4, but we can't do that anyway, right? It's going to it's going to come down to like market incentives, right? Whether people move or not. Um but but yeah, I think I think there is uh there is this element of like you know, V4 is been 3 years of thinking about how to reason about these things from some

people who you know, have have uh got a pretty good take on it. So um yeah, my my my take on this is like you know, this is an interesting evolution another another option out there. Like V3 will continue to to operate you know, for the foreseeable future is my understanding. So um so yeah, what do we what do we think about the fact that Aave is really leaning into V4 and the architecture? Have you got a take on that? I have a a lot of thoughts as the risk manager of Aave.

>> [snorts] >> V3 was um it's the biggest DeFi protocol in the world and the growth over the past 2 plus years has been incredible. Um at the same time it's like it's not the end state, right? And to think it's a like and it poses some type of like innovators dilemma that a lot of other companies or DAOs or or groups might get stuck in. Like don't fix what's not broken but that um there are so many improvements uh to be done. And I think just you need to keep securely um you know, pushing like the innovation. V4 introduces um a lot of features that allow us to price risk more accurately. And then just also

overall build a better lending product um for retail and institutions alike. So that's like the motivation uh behind it. And I just think it's the next evolution in what is today lending. I mean yeah, it's it's interesting, right? Like clearly uh if you're launching a new um a new lending protocol, it has to be focused on institutions, right? Like we just talked about how retail can't price risk. Um it that that becomes hard, right? If retail's not pricing risk you're not then incentivized to properly price risk, right? Like your incentive is to just go out the risk curve as far as possible. If everyone assumes zero like institutions don't do that. I mean like not always, right?

Some do. Some do, but like collectively, right? Like I think TradFi probably has a more sophisticated eye towards risk than your average degen. Um and therefore if you're going to curate those people and and their money, you know, like an endowment or or you know, uh something like they're probably not just going to like yolo into some uh you know, weird weird like 25% APY vault, right? Um not not in size, right? And so you know, like there is there is definitely something to be said for uh like identifying the things that an institutional uh allocator is looking for or wants,

right? Um you know, you talk about like SOC 2 and and stuff like that. Like you know, there was a long period of time where the institutions were coming, but they weren't here yet. So we didn't need to like prepare for it by like doing stuff, right? Like we could just like do whatever we felt like, and invent everything ourselves. Um but it does feel like now that institutions are here, we do need to adapt, you know, like having PagerDuty, like have like just having things that if someone even applies like a cursory level of scrutiny to your operation, they're not going to be like, "Uh this is this is not viable, right? Like, you know, so um so I think there is like architectural stuff, but then there's a bunch of other uh elements that in order to attract

institutional capital, DeFi just has to do and get better at. And hopefully that will be a forcing function that is is actually better for retail, because if the institutions are forcing you, you know, this is it's like a similar argument like the regulator thing, right? If regulators are forcing you to be compliant and, you know, release uh disclosures and stuff like that, in theory that should drag along uh you know, um better better risk-adjusted um yields for everyone else, right? So. Yeah, it should. I I would say that the nice thing about V4 is that it's um it's not binary in the sense of like, "Hey, this is optimized for enterprise and it's not good for retail." Like, the

core innovation around it is just like this hub-and-spoke architecture. And uh in just a sentence, it lets us segregate the risk in a much more intentional way. Um so, if people do want that like those more experimental lending experience that have larger risk, you can do that, and you don't run the risk of contaminating larger pools. Um so, you basically have both, and um it's an evolution of like, you know, what Aave did really well with is like the pooled architecture. It's like the main pool where you deposit all of these.

Um and here it's just going to allow us to kind of target things um on an asset-by-asset basis, uh for certain pairs, uh configure what should the interest rate model uh be, and things like that. So, it's the most I would say like a highly configurable specific lending experience, while at the same time attracting that stuff from the users, right? So, that's what we're excited for, because hopefully or I'm confident that it's going to make our lives easier as we have better levers and can be more granular about what tradeoffs we're making, if any.

So, this is maybe a spicy take, right? But like, one of the uh I guess um unintended consequences of like even Aave V2, V3, this pool model, right? Is you got to be really careful about what you put in there. Yeah. Like, there's a lot of thought that, you know, there's a very high bar, right? Um there is something to be said for like that is a feature and not a bug, right? Like, I know people would get annoyed by it. I mean, I've been annoyed by it in the past where I'm like, "Come on, guys. Like, this is fine. Like, put this asset in in the pool so that we can start, you know, doing stuff with it." Um there is there, you know, having this like segregated hub-and-spoke thing, there's a

there is an argument that like will cause people to be less wary of things, cuz like, "Oh, no, it's in Aave. It'll be fine." But actually it's in some weird experimental pool. How do you how do you think about that? Yeah, so I mean, like it's sort of similar today in the sense that we're going to have there'll be several hubs, but like the big ones will be like the core and the main hub, right? And those are the ones that, you know, just blue chip, like safest assets. And then you'll have uh I think we'll start with one or two other hubs, and over time that will grow.

Um it'll be very clear like on the product like what it is, and like you said, like there there's also an element of education like it not only in Aave, just generally um yields should reflect like units of risk that you're taking. Um So, I mean, it does whether you know it or or you don't know it. So, it's it's just kind of just taking the best of the capital efficiency of what worked in V3, but allowing us to get more granular. Another thing, which is I think not many people know with the why it was so hard, and sometimes for like asset issuers annoying to integrate into Aave, we had to deal with this heavily in the migration from V2 to V3, is that once something is listed, it's super hard to delist it. Um and in the

transition from the bull market to the bear post-FTX, um we had a bunch of DeFi tokens that at their peak were trading at like 5 billion plus uh market cap FDV super liquid. >> I'm aware of a couple of them. Yeah, yeah. Not not naming names, but um >> [laughter] >> the more the CRV crisis, right? And for the OGs like the Aave Eisenberg attacks um on Mango Markets and others. And I I think V4 is like takes all the learnings that we had of that um and and just kind of packages it into like a new release. So, for asset issuers that are going to integrate, um it should be a smoother experience, and allows us to think and react more to what's happening in the market versus

saying like, "Hey, we're taking token X, we're putting it into the core market. It's going to probably be here forever now, or it's going to be really hard to offboard it." So, that was I think one of the core learnings. Yeah. Are you still So, for like the core markets and stuff, is Aave still going to uh let's say like uphold the I don't know how they even describe it, like the diligence they do on those assets, right? Because right now they they there actually is quite a bit of work with a bunch of different parties that goes into I mean, one of them, for example, is how can you mint this asset, and making sure it's behind not necessarily a literal multi-sig, but that it it is requires multiple independent parties to mint, right? Are they still doing that

for all of the markets, or So, so we >> Yeah, I mean, that's that's Chaos Labs. Um that's one of our responsibilities is that uh we do risk assessments for any asset, but at the same time they're Aave's been running for a long time, and there's a clear segregation of responsibilities, right? So, we're primarily tasked with financial uh risk. Um I was leading smart contract at the time, so over the past years uh BGD and Aave Labs are responsible for the smart contract risk under that. Um you know, access control, and there's a lot of the stuff that we spoke about today. Obviously, as a collective we're all responsible for everything, but those are the kind of ways that we for a

single asset, there is like a smart contract if it gets close to an actual listing. Like all these things happen, and then even when we list assets, the important thing is it's it's not cart blanche. So, an asset with a tiny market cap, even if it has a promising yield like historically, we might start it in an isolated market um where there's a ceiling that's defined and um yeah, I mean, over time based on the demand, based on the security posture, um you increase that or don't, depending on what you find. But there's like a a public actual documented process of how all of this happens, and probably at this point several hundred references that are living in the Aave forum

amongst other places. Yeah. Okay. And so, this is going to for V4, not only is this these processes going to continue, but they're probably you've been having a little bit more freedom for like what it's not uh let's say like as like black white, right? Because now you have these different hubs or these different ways and these different uh mechanisms and processes by which you can sort of like elevate something or downgrade it or whatever. Yeah. Yeah, I mean, so it a lot of freedom. It's also a ton of work. Like, it's uh there's not one day where we're not um spending hours like as a team on everything that's Aave. Chaos Labs AI is

our AI product, which helps us um streamline like I was going to say, like we Yeah, like we have a team, right? We're 50 >> Cloud. Cloud. Cloud. Uh Aave agent. Only Chaos Labs AI. Only Chaos Labs, not Cloud. >> [laughter] >> Fair enough. Fair enough. But um but yeah, it's a ton of work. I think every team naturally wants to be listed in the most liquid pools. So, you know, teams will vie for it and then like make a case why yes, why no. Uh but ultimately like as a DAO, we we kind of decide, uh and it's always better to kind of see the demand and then think about uh what the reward is and then versus that risk and make decisions on an asset-by-asset basis.

Yeah, I mean, I'll just say like from my I don't live in this world as deeply as Kain does, obviously, but I do have adjacent minimal experience, and I will say I was shocked when someone was like, "Hey, we need to upgrade our token uh because Aave said so." And I was like "What?" And they're like, "Yeah, our mint functionality is like super weak or some Like, help us." And I was like, "All right. Like, let's go." But that was like one of the first times where it was it was like a forcing function, right? And it was like a win-win. And it wasn't a regulation thing. It wasn't some government thing. It wasn't because Tay was on Twitter preaching, right?

It's like, "No, they want something. The way that you get this the way that everyone benefits, right? Is by having baseline like default [laughter] secure configurations." Um and yeah, I was it was it's one of the rare times that you see this happen. >> power. It's one of the few protocols that has market power to say, you >> Yeah. Like, if they if they went to Luca and they're like, "All right. Like, we'll we'll let you, you know, borrow against Pudgies, but you just got to, you know, throw away that uh infinite mint private key." You'd be like, "Okay, fine. I I was enjoying having that, but I guess I don't really need it." You know, like you would you

would like people would do things. It's like exchange listings, right? You know, exchanges Unfortunately, the exchanges don't necessarily have the most aligned interests in in the way that say Ave does with like, you know, composable DeFi stuff, but they're still a forcing function for like at least tell us what the emissions on the token are, bro. Like, we need that document. Like, you can't just invent your own, you know, uh vesting schedule and like have it off-chain and not tell anyone, right? Like, there's there's certain things that it does. So, I think, you know, Ave having market power probably they didn't use it enough arguably in the past, you could say, but maybe in V4 that will that will change.

Yeah, V4 is a clean slate. Um it lets us do a lot of things in the way that we wanted to do them over the years. Uh I will say on the exchanges, I think this year was like the first time that some of the exchanges actually woke up to the fact that they need to due diligence um assets as well because uh there was a case with Binance, I think, where they ended up paying, I don't know if it's like 300 or 400 million dollars out of pocket um where if you know, it didn't depeg, but like on their exchange, there was low liquidity on the weekend and they discovered from first principles what an oracle is and why it needs to kind of accurately uh price um the assets and it had to pay everything out of pocket. So, um the worlds are colliding. Uh

yeah, you'd hope that even without these incentives like people would take these things seriously, but these things definitely push cuz when you're launching a token, you want that liquidity, you want to be able to borrow against it, you want to be on a centralized exchange, and for all parties involved, I think this weekend showed it. Um there are consequences, not just the asset issuer, also the protocols that are taking on bad debt, paying out of pocket, um also the curators. So, um you need to do the max that you can do on your level, uh and there's still always going to be risk, but you want to be able to mitigate and minimize.

Yeah. I agree. And I I I just want I think that's a great great place to end, and I think that for far too long we think about it as like sort of everyone's on the most level playing field, and it's like, "Well, the users want this and they'll do this." And then, you know, the protocol doesn't have any any say over how the token is or how the asset is issued or how whatever. No, no, no, like in order to get this ecosystem to be strong and robust and valuable, every single player has to play and has to like do what's in their best interest and their users' best interest, and sometimes that means asking hard

questions and holding the people that they have relationships with accountable. And a lot of times the end user doesn't have the ability or the relationship or the incentive to do that to say the token or the protocol. And so, the more times we see the protocols, the asset issuers, the adjacent parties like come in and say like, "This is how it works, guys. This is how you mitigate this risk, and it's a bare minimum for you us even look at you." the better that everyone will be, and that's how we're going to keep leveling it up. Well said.

Agreed. Agreed. Um awesome. Uh special thank you to Omar um from Gas Labs. Uh thanks for joining us. That was that was super useful. Um that's it for this episode of Unchained Money. I'll see you guys next week. Thanks, Tay and Luca. Um if you enjoyed the conversation, follow the show on the Unchained feed on X and subscribe wherever you listen to podcasts. And if you're watching on YouTube, please like and subscribe or drop a comment. It really helps new people to reach the show. Um until next [music] time.