6

Flash loans attacks are current in DeFi space and we saw several ones these last weeks on the Binance smart chain. (Pancake Bunny and Burger swaps)

Mr. Hoskinson said numerous times that if it took years for Cardano to implement smart contracts and DeFi, it was to avoid such attacks and to have a more secure plateform.

My question would therefore be : Will projects on Cardano be flash-loans-attacksless? If yes how? If not, can we find a way to secure it?

Thanks in advance

1

Flash loans generally exploit financial protocol vulnerabilities to manipulate the prices and exploit the system. For example, In the 2020 attack on Fulcrum built using bZx protocol, attackers used borrowed Ether to manipulate the price of sUSD( a stable coin); naturally, the price of the stable coin should have remained stable to prevent the attack. Smart contract writers should have anticipated the instability of stable coin prices under unusual market conditions. Formal verification methods would have identified this hidden issue.

Theoretically, these higher protocols are influenced by the underlying blockchain technology, which results in unreliable smart contract state estimation.

Cardano has brought the "Formal Methods" paradigm in creating smart contracts, enabling precise estimation of smart contracts behaviors provably. Moreover, Plutus is designed with such care to enable this technology. The potential of this mathematical precision has not yet been realized in the current ETH-dominated DeFi. In short, Cardano will prevent this type of protocol attacks by enabling smart contract writers to predict what can go wrong in which setting.

0

Cardano is not intrinsically flashloan-attackless. Functional programming and formal verification help you a lot with the distance between spec and implementation, but do not give you anything with the distance between reality and spec. Reality (edge cases, attackers, things you failed to foresee) will be what gets you if your devs didn't let a simple bug through. Any proof engineer will tell you that false sense of security is a risk introduced by formal verification

It's tricky because we only use one word: "exploit" - when what we mean is either exploits at the software implementation level or exploits at the mechanism design level, but not both. The literature is infused with ambiguity, one must read diligently if they want to disambiguate this.

If you make progress on this, charge someone a lot of money.

1
  • As long as you understand what formal verification can do, and can't do, I don't see why this should give a "false sense of security". And of course there will be buggy smart-contracts on cardano as well.
    – j.karlsson
    Sep 15 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.