The curious case of Harvest Finance, Oct. 21-28

We had been graced with yet another typical “degen yield farm” popping out and in of relevance this week.

Harvest Finance collected as a lot as $1 billion in whole worth locked earlier than an “financial exploit” despatched it tumbling down. Its worth locked measure now hovering round $300 million and prospects for a restoration trying bleak.

The exploit has as soon as once more reignited debates amongst DeFi group members as as to if a lot of these flash loan-based arbitrage assaults are literally hacks.

Harvest options yield farming vaults just like Yearn’s. They problem tokenized vault shares primarily based on the worth of the property provided by customers. A few of these vaults depend on Curve’s Y pool, which powers liquidity for swaps between USDT, USDC, DAI and TUSD.

The assault used flash loans to transform $17 million USDT into USDC by Curve, briefly boosting the USDC worth to $1.01. The attacker then used one other flash-loaned stash of some $50 million USDC — which the system thought of to be value $50.5 million — to enter the Harvest USDC vault.

After getting into, the attacker would reverse the earlier USDC commerce again into USDT to deliver the value in steadiness, after which instantly redeem their shares of Harvest’s swimming pools to obtain $50.5 million in USDC — a internet revenue of $500,000 per cycle repeated sufficient occasions to acquire $24 million in loot.

So is that this a hack or not?

Technically, there have been no vulnerabilities concerned right here. There was a bypassed examine for a lot of these “arbitrage trades” that detects if the value of those stablecoins deviates an excessive amount of from their meant worth. But it surely was already set fairly low and it’s actually extra of a light inconvenience than an precise blocker — an attacker simply wants to make use of extra exploitation cycles.

So in that sense, proponents of the speculation that that is simply an arbitrage commerce are right — there isn’t any unintended habits within the code, it’s extra like weaponized market manipulation repeated at pace.

The Harvest Finance staff however assumed accountability for this as a design flaw, which is commendable.

Actually, I’m not even certain what the purpose of those semantic debates is. Folks misplaced cash in a preventable method. An audit ought to’ve caught this and marked it as a important problem.

However there’s undoubtedly a case to be made that it’s a special class from bugs like reentrancy. It highlights that these monetary constructing blocks — also known as “cash Lego” — have to be designed with utmost care on the drafting board.

It’s like if any person created a gun out of Lego elements and other people had been debating if the gun was “created” or “found” as a result of the elements had been technically assembled as designed. Both method the Lego elements must be reworked in order that they will’t develop into a deadly weapon.

A bit an excessive amount of belief for crypto requirements

Earlier than the hack, Harvest was notable for its excessive diploma of centralization. In its glory days, the entire $1 billion may’ve been stolen by a single tackle, almost definitely managed by the nameless staff behind the undertaking. A few audits highlighted that reality, additionally making it clear that the tackle was capable of nominate minters and create tokens at will.

Followers of the undertaking vigorously defended it, saying that due to the time lock, the governance key holders may solely steal the cash 12 hours after signaling their intentions, or that they might solely print a restricted variety of tokens.

I’ll allow you to be the choose of these arguments. The broader level is that within the seek for yield, these “degens” are ignoring the essential tenets of decentralization and, you already know, what DeFi is about.

And I’m not saying it’s dangerous due to some idealistic rules I’ve. It’s due to rug pulls. These are the precise circumstances that led to disasters like UniCats.