TWAP Oracles After the Merge

Transcript

so I'm excited to talk to you guys today about t-wop oracles and how the upcoming proof of stake merge changes the security considerations for them a little bit um just a quick obligatory personal slide uh I'm a solidity engineer I've been doing it since 2017. I currently work at uniswap Labs on the protocol team uh in the past I've done all kinds of stuff worked on fixed rate crypto bonds and nft lending and wbtc a bitco back in the day um okay so I'll start just by talking about two op oracles now in the current proof of work blockchain and some manipulations that can be done with them so I'm sure most of you guys already know two op oracles are a safe and decentralized Unchained price feed

um but you know why do we need them in the first place well you know the obvious thing you might do if you're trying to get an on-chain price is just use the spot price on the amm um but with things like flash loans this is quite easy to attack right because the spot price of the amm changes instantly and dynamically so you can take out a big flash loan move the price and then use that manipulated price for some kind of attack you know swap back and pay back your loan all in one transaction so two Ops were a way to basically get around this problem um what you do is you you know take some window of time and average the price across that entire window and this sort of automatically solves that problem especially because at least with the uni swap V2 and V3 t-wops the price is

snapshotted at the start of the block and only at the start of the block so any transactions during the block that move the price don't actually move the T watt price until the following block when the next snapshot is taken so these are still possible to manipulate but it increases the cost quite significantly which I'll explain in a slide in a couple of seconds here and importantly it requires multiple blocks so the attacker takes on some risk of getting arbitraged or competing with Mev Searchers and so on so just to walk through sort of the anatomy of a typical t-wop manipulation it comes in three stages so the first stage the attacker has to manipulate the price right takes some big amount of tokens swap it into the pool which moves the price

um then they have to wait a block again for the two op to update and then they use that manipulated price for something uh and finally and I think this stage often gets sort of overlooked they have to demonipulate the price to recoup their costs and this is because when they do the manipulation sort of by definition when they move the price they're incurring a lot of slippage right and so they're getting less value out than they put in so this demonipulation phase allows them to sort of make that loss back and just some example things that you might do if you were able to manipulate a t-wop for example if there's some lending protocol that uses the amm to up as its sort of price feed and you're able to manipulate the price beyond the LTV of that lending protocol you could take out an

undercoateralized loan you know you put in some amount of collateral you make it look like the value of that collateral is way more than it is and then you can borrow more than you put in effectively another thing you might be able to do is liquidate someone else's healthy Vault make it look like it's under collateralized when it's actually fine and you can take their collateral for Less value than it's worth again so it's really hard to actually execute on these at least with the way two Ops are constructed currently in proof of work so I use this really nice tool from Euler Finance which is a lending protocol that uses uniswap V3 t-wops for their price feed 23.7 trillion dollars is the eye-popping number here for how much Capital you would need to swap into the pool an ethusdc unisot V3 pool to move it 30 percent and 30 sounds like a

lot better it's pretty reasonable given like the LTV you need for a lot of lending protocols you need to again move the price more than the LTV to actually gain any value from this so this is with a 30 minute t-wop which I think is the a pretty standard configuration and to add insult to injury for the attacker here not only do they need this ridiculous amount of money which is more than all the value in crypto right now they also have to then wait a block and execute their manipulation and also do that demonipulation phase to recoup their cost and in that second block they're going to be competing with Mev Searchers and arbitragers again to actually get that so they have a pretty decent chance of spending all this upfront capital and then not actually making anything from it so pretty risky Endeavor right now at

least there's some ways that you can get it to work a lot of like a selfish Miner if you're a minor and able to mine two blocks in a row and execute them you can maybe like censor out all of the potential or potential competitors but really hard it doesn't happen very much in practice so what changes with the merch uh what am I here talking to you guys about today well predictability so this right here is a screenshot from Beacon chain which is uh you know a block Explorer for the ethereum upgraded uh chain and you can see this scheduled thing so you actually get to see an Epoch ahead of time which producers are creating which blocks and this is kind of interesting you know in proof of work it's sort of random

impulses at the time you don't know who's producing the next block in proof of work until they've mined it right so this is a little bit of a different way to think about things and specifically like what can you do with this new predictability this new knowledge well it makes these multi-block manipulations quite a bit easier so the first kind of most obvious thing you can do is if you're a big validator every once in a while you're going to get two blocks in a row and you know you'll know ahead of time that you have two blocks in a row so you can you know perform your manipulation in the first block and then in the second block you can do your attack and do your demonipulation and censor out any other competitors um should be pretty rare for an average

solo Staker like you or me to get two bucks in a row but bigger stakers or mining pool or staking pools may have that happen more often um if you don't have two in a row but you're a validator and you get a block since you know ahead of time in the block before yours you can use flashbots or some other private mempool service to perform the manipulation and then in your block again you censor out any competitors and you do your attack and your demonipulation there's a few complexities here where you know in that block before yours since you're not the one building it there's potential for competitors but you know you can do something like buy out the entire block or somehow work with flashbots to make sure your transactions at the end of the block so

it can't be arbitraged away um also this third thing I haven't seen talked about much but I don't see any reason that a large staking pool wouldn't be able to offer like multi-block flashbot style bundles where you give a bunch of transactions some execute in the first box some executing the second one and they only get their bribe or whatever if all of them executed the way you wanted them to and so again this takes away a lot of the risk from these manipulation attacks if you're able to get it to work but it's still really hard with the t-bots we have right now so I just ran those same kinds of simulations under this new proof of stake model and if you have two blocks in a row The Upfront cost is the same it's still the ridiculous 23 trillion dollar number the difference here is that if you have the

second block which is you know controlled by you you get risk-free demonipulation again because you can censor out any competitors now it will be in you know increasingly more rare and more costly to get more than two blocks in a row but if you did somehow have three box in a row the cost of this attack goes down because you know it's an average price over a bunch of blocks if you're able to manipulate the price and hold it there for two blocks then that moves the total average more than just having it there for one block right so with three blocks in a row it'd be nine and a half billion dollars and with five bucks in a row 100 million so still quite a lot but a little bit more reasonable so hopefully this sort of shows that it's

still really hard to execute these two Ops but it definitely is a little bit worse than in the current proof of work model so how can we improve this uh well luckily we have a pretty good uh way I don't know if I can scroll over a little bit so medians um basically the problem with with means is that any outliers or any crazy values that get into the window they affect the average right medians have this sort of nice feature where they automatically filter out outliers so what you do for a median t-wop is you take sort of window prices again you sort it by price so the low prices at the start and the high prices at the end and you find the middle um

oh you can't hear me oh sorry guys um so yeah it automatically filters out the outliers and now um in order to manipulate the price at all of the t-wop you need to manipulate it for over half of the blocks in the window which is pretty ridiculous so just to go back to that same example with the 30 minute t-wop you need to manipulate the price for 73 blocks of the 144 which good luck with that and also this kind of makes it easier like you can have shorter windows with a medium two up for the same reason like uh you know you might be able to get away with a 50 block 2 up instead of 144 because it's still pretty hard to get 25 blocks out of a window uh manipulated

so that was pretty much all I had guys um hopefully you found that somewhat interesting this is kind of an active open area of research right now there's lots of people working on it I took a lot of the information in this talk from you know conversations I've had at uniswap and um Doug Hoyt who's an engineer at Euler has done some great research as well he actually implemented a proof of concept of this median t-wop if you guys can find my slides later you can go look that up it's pretty cool um and yeah feel free to ask any questions I think I have a little bit of time right discussion at the end cool sounds great thanks guys [Applause]