Cardano Stack Exchange is a question and answer site for users and developers of the Cardano cryptocurrency ecosystem. It only takes a minute to sign up.
Sign up to join this community
Flash loans attacks are current in DeFi space and we saw several ones these last weeks on the Binance smart chain. (Pancake Bunny and Burger swaps)
Mr. Hoskinson said numerous times that if it took years for Cardano to implement smart contracts and DeFi, it was to avoid such attacks and to have a more secure plateform.
My question would therefore be : Will projects on Cardano be flash-loans-attacksless? If yes how? If not, can we find a way to secure it?
Thanks in advance
While flash loans will exist on Cardano, flash loan attacks will not.
To understand why, let's examine that PancakeBunny attack, https://www.coindesk.com/markets/2021/05/20/flash-loan-attack-causes-defi-token-bunny-to-crash-over-95/
https://twitter.com/PancakeBunnyFin/status/1395173389208334342
This pattern is a common vector for flash loan attacks. Key to the success of this attack is the ability to chain the execution of multiple smart contracts in series within a single blockchain transaction.
On Cardano, this simply won't be possible by design.
So how would flash loans on Cardano work? One option would be to write a validator script that implements the following rule: allow this UTXO to be spent so long as it is spent back into the same script address plus interest.
By design, the number of cases where this will be useful will be far more limited than on some other blockchains.
Flash loans generally exploit financial protocol vulnerabilities to manipulate the prices and exploit the system. For example, In the 2020 attack on Fulcrum built using bZx protocol, attackers used borrowed Ether to manipulate the price of sUSD( a stable coin); naturally, the price of the stable coin should have remained stable to prevent the attack. Smart contract writers should have anticipated the instability of stable coin prices under unusual market conditions. Formal verification methods would have identified this hidden issue.
Theoretically, these higher protocols are influenced by the underlying blockchain technology, which results in unreliable smart contract state estimation.
Cardano has brought the "Formal Methods" paradigm in creating smart contracts, enabling precise estimation of smart contracts behaviors provably. Moreover, Plutus is designed with such care to enable this technology. The potential of this mathematical precision has not yet been realized in the current ETH-dominated DeFi. In short, Cardano will prevent this type of protocol attacks by enabling smart contract writers to predict what can go wrong in which setting.
EDIT nov-02-2021: I misspoke earlier, details at the bottom.
Cardano is not intrinsically flashloan-attackless. Functional programming and formal verification help you a lot with the distance between spec and implementation, but do not give you anything with the distance between reality and spec. Reality (edge cases, attackers, things you failed to foresee) will be what gets you if your devs didn't let a simple bug through. Any proof engineer will tell you that false sense of security is a risk introduced by formal verification
It's tricky because we only use one word: "exploit" - when what we mean is either exploits at the software implementation level or exploits at the mechanism design level, but not both. The literature is infused with ambiguity, one must read diligently if they want to disambiguate this.
If you make progress on this, charge someone a lot of money.
EDIT: Cardano is in fact intrinsically flashloan-attackless at this time, but it is not because of "formal verification", it's because there are no multi-step yet atomic transactions. Flashloans, by definition, are an atomic transaction where an uncollateralized loan happens in the first step and it gets repaid in the last step. No multi-step yet atomic transactions, no flashloans, no flashloan attacks.
