Over the years, computers have upended nearly every industry. Digital products and services are becoming increasingly complex through constant iterative innovation. We have transformed the world with computer technology to meet our needs. From digital assistants to smart homes, automated procedures now affect every aspect of people's daily lives. So how can money be any different?

What is Decentralized Finance?

To better understand DeFi, we should first look at how traditional finance came about. Money is often thought of as something that's always been around, but it's not.

Humans originally exchanged goods and services for value. But as societies formed and developed, we invented money, a more convenient way of exchanging value. The currency then helped drive new innovations and productivity advancements. Progress has not come without a price, however.

What is the current financial situation? You would convert the value you earned for your hard work into government-issued currency and deposit it in a bank. You trust the government not to print more money overnight, and you trust the bank to keep your money safe. When it comes to investing, you entrust your assets to a financial advisor. By giving your money to others, you hope to make a profit. But the sad truth of our current financial system is that the trust we put in doesn’t always pay off accordingly.

We often have little say in how banks/corporates handle our investments, or even how governments manage the economy. In most cases, investors only get a small percentage of the return on the investment profits of their own funds.

Also, in finance, the world is not flat. The financial markets of various countries cannot flow normally. Take the bank interest rate as an example, you know? The annual interest rate of Japanese bank deposits is 0.07%, and the annual interest rate of loans is only 1.475%, while the annual interest rate of Indian bank loans is as high as 8.6%. So can Japanese lend money to Indians with more than 5% interest? This is good for both parties. But sorry, traditional finance doesn't allow you to do that. Besides, can someone from another country really lend money to an unknown Indian?

1. DeFi is trying to build something different

   Decentralized finance aims to create a financial system that is open to all and minimizes the need for one person to trust and rely on a central government. Technologies such as the internet, cryptography, and blockchain give us the tools to build and control financial systems, eliminating the need for a central authority.

There is a well-known saying in the blockchain world: "Don't trust, verify." Because with a blockchain network, you as an individual can verify any transaction that occurs on the blockchain.

2.

DeFi allows everyone to take charge of their finances Almost all DeFi applications are based on the Ethereum blockchain, the most popular programmable blockchain in the world. Ethereum is a blockchain network that maintains a shared digital ledger of value.

Developers write applications on Ethereum that can create, store and manage digital assets (also known as tokens) on the blockchain. These programs are called smart contracts or decentralized applications (DApps). They are contracts or agreements enforced by the Ethereum blockchain. You can build complex, irreversible agreements without the need for notaries, supervisors.

Decentralized finance has the opportunity to enable a more resilient and transparent financial system. Anyone with an internet connection can access and interact with smart contracts based on the Ethereum blockchain. Trusted smart contracts are open source and can call each other with other smart contracts. Thus, users can verify the code of the smart contract and choose the service that best suits them.

3.

What are some examples of popular DeFi applications? There are many different DeFi products and services, some of which may feel familiar to you, much like existing financial services, but with a decentralized character.

Currently, the most popular and fastest growing type of DeFi is lending platforms. Similar to a bank, users deposit funds and earn interest on their assets borrowed from other users. In this case, however, the asset is digitized and the smart contract connects the lender with the borrower, enforces the loan terms and distributes the interest. This all happens without the need for mutual trust or the existence of an intermediary bank. And, by cutting out middlemen and geographic constraints, lenders can earn higher returns and, thanks to the transparency of the blockchain, gain a clearer picture of risk.

There is also a class of tokens known as stablecoins that are also important to the DeFi ecosystem. You might think that the prices of all cryptocurrencies fluctuate frequently. However, a stablecoin is a token designed to have a fixed value, usually pegged to a fiat currency such as the U.S. dollar. For example, DAI is a stablecoin pegged 1:1 to the U.S. dollar and backed by ether (ETH). For every DAI produced, $1.50 worth of ETH is locked in the MakerDAO smart contract as collateral.

Another popular DeFi application is the so-called decentralized exchange, or DEX for short. It uses smart contracts to enforce transaction rules, execute transactions, and securely process funds. When you trade with a DEX, there are no exchange operators, no registration, no authentication or withdrawal fees.

4.

DeFi can break the financial market breakthrough between countries DeFi application smears any combination, based on blockchain and contracts, you can safely give money to someone in a world market, no matter who he is, and borrow it. Through the huge gains in between, and greatly reduce the popularity of traditional finance.

5.

DeFi can make money put together like Lego bricks With Lego bricks, you can start with a bunch of small bricks. Feel free to piece together what you want. The same goes for smart contracts. By piecing together the existing components of DeFi, you can combine, modify or create powerful financial instruments on demand.

Compound's cDAI, for example, is a perfect example of money Lego. When you deposit DAI to Compound, you receive cDAI tokens, which are used to record the DAI you deposited and any interest earned through the loan. Since cDAI is a token, you can send, receive and even use cDAI in other smart contracts. This is a typical pattern of funding Lego: ETH goes into MakerDAO to mint DAI tokens, DAI is supplied to Compound in exchange for cDAI, and cDAI tokens can be reused for other DApps.

6.

DeFi has different decentralization needs Because it is fundamentally different, decentralization where everything can or needs to be applied.

As mentioned earlier, stablecoins are very Chinese and English. However, not all stablecoins are as distributable as DAI. Which is actually a token in a token like a DeFi token, and for every USDC coin, a certain bank has a $1 deposit somewhere. You can tokenize "real-world assets" in a fixed center, and at the same time, this is a completely decentralized thing, because at this point you can trade, send and receive these tokens on the blockchain, But the need to physically manage or replace world assets cannot be completely eliminated.

For example, buying a house on the blockchain. Suppose someone tokenizes their home as a token, puts the token on a decentralized exchange, and then you buy it. Without the corresponding legal setup and laws, even if you own the token, you cannot easily force the person to move out of the house. As it stands, you will need to go back to the courts in your home country to resolve the dispute.

In short, the technology has limitations, and the boundaries of DeFi are starting to blur. It is certain that in the future, the law will adapt to the ever-evolving form of finance, and the place of DeFi in the world will become clearer. At least for now, there is one clear fact: DeFi exists and will continue to grow.

This time I will talk about it first, friends who like defi can go to Telegram to add me; @MC0MC0, +852 6200 8947

Yesterday, DeFi developer and senior architect of the Fantom Foundation, Anton Nell, tweeted that he and Andre Cronje (AC) have decided to quit DeFi and cryptocurrency and will close about 25 applications on April 3, 2022 and services, including yearn.fi, keep3r.network, chainlist.org, solidly.exchange, and bribe.crv.finance, among others. Anton Nell said this was not a knee-jerk reaction to hatred of the project, but a decision that had been in place for some time.

In the encryption community, the pot exploded at once.

Some people scolded: AC "rug pull run away"; irresponsible to users and investors; saying that it was a decision to quit for a while, but still launched Solidly in February to cut the last wave of leeks.

There are also people who support it: I pay tribute to AC’s continuous innovation and contributions to the DeFi field over the years; I think that AC is a real builder who pays more attention to the product level than other people who have made a lot of money in the crypto circle.

In any case, when such a departure was officially announced, the community was still shocked. The projects that it has closely cooperated with and created, such as Fantom, yearn.finance, solidly, Multichain, etc., all plummeted.

From fringe coder to DeFi hub

Before becoming the "King of DeFi", AC was just an engineer that few people knew. Of course, every "mythical" character will have a super brain. It can be said that AC is not a computer science major, he is a law major, and he planned to become a defense lawyer. Until one day, because of sending a friend to a computer science lecture, AC attended the lecture by the way, but I didn't expect that I had a strong interest in the course. Afterwards, AC taught himself relevant courses and successfully became a lecturer.

Friends who like Defi can add me on telegram; @MC0MC0; +852 6200 8947

The end of the crypto era for AC

在了解 DeFi 的重要性之前，我们先来了解一下 DeFi 是什么。它来自英文Decentralized Finance，DeFi是这句话的缩写，如果直译是“去中心化金融”。但实际上，称其为“分布式金融”或“开放式金融”更为合适，因为本质上并没有完全“去中心化”的金融，而且大多都不同程度地存在中心化和去中心化的现象。组合。但是，DeFi 已经成为一种惯例，更适合传播。

那么具体来说，什么是 DeFi？一般指建立在智能合约平台（如以太坊）上的加密资产、金融智能合约和协议。这些资产、智能合约、协议可以像乐高一样组合在一起，所以也被称为“货币乐高”。

金融的本质可以浓缩为：效用和风险在时间和空间上的交换。理论上，去中心化金融提供的所有服务和产品都与传统金融世界相同。在传统金融体系中，融资投资、储蓄、信贷、结算、证券交易、商业保险、金融信息咨询等金融服务均由中心化金融机构提供给用户。然而，DeFi 使用分布式账本技术，包括区块链、加密货币和智能合约，来提供借贷、融资、稳定币和信贷安排等服务。

DeFi 的特点：

可互操作

当前的金融体系由可转移性有限或双向访问的围墙花园组成。在可能实现互操作的情况下，它由中间商和寻租者控制。开放金融是由平台定义的，这些平台可以在一定程度的透明度下协同工作，并在功能上相互补充。这有助于加强我们所有项目作为一个整体的复合效应。

2.可组合

对许多人来说，乐高玩具是他们最喜欢的童年玩具，你可以用无限的想象力创造你想要的东西。在 DeFi 中，只要技术有效，任何想法都可以构建。可组合性是指像乐高一样可以选择和组合成多种组合的概念。

3.可编程

比特币彻底改变了货币的定义。以太坊支持比现有产品和服务更可定制的新型金融工具和资产。数字资产和证券将迎来金融机制和增长的新时代。

4.无障碍和包容

在传统的中心化金融中，用户想要获得服务必须通过金融机构，并且必须接受金融机构的各种复杂条款。服务能否完成以及何时完成，取决于金融机构的服务效率和安全水平。而且 DeFi 对任何可以连接互联网的人开放，同时大大降低成本，创造价值自由流动的世界，打破地域限制。

DeFi 产品使世界各地的人们能够以点对点的方式参与金融活动（如消费、借贷、借贷、赌博和交易），而无需依赖银行和政府等中介机构。

DeFi 是如何运作的？

DeFi 解决方案由区块链技术提供支持，使用该技术最强大的功能：比特币 (BTC) 和以太坊 (ETH) 等可编程数字资产。这些数字资产具有货币价值主要是因为它们的价值存储属性。由于这些资产是可编程的，我们可以将它们锁定在智能合约中作为抵押品（类似于房屋抵押贷款）。

我们还可以用可证明的锁定值做各种有趣的事情。有了这种抵押品，贷款以所谓的“稳定币”的形式获得。“稳定币”是一种数字货币，其价值与美元等世界货币挂钩。我们可以将这些稳定资产换成其他数字资产，在互联网上消费，或者借给贷款协议赚取利息。除了我们今天所知的金融产品范围之外，还有更高级的事情可以做。

大致意思是数字储备资产用于抵押完全数字化、去中介化的创新金融产品。您可以随时随地直接与代码交互，无需中介公司，这是一个具有代表性的转变。

DeFi 的影响：

DeFi 是一种极具竞争力的企业资本配置模式，它降低了市场准入门槛，同时将市场参与者之间的竞争效率提升到了一个新的水平。

DeFi 将增加竞争强度，促进良性竞争，从而提高市场效率。DeFi 使金融服务能够建立在一个相对透明的世界中，使市场层面的信息对所有参与者透明，从而建立信任，同时也使实现市场效率成为可能。同时，通过区块链加密技术，个人隐私也得到保护，有利于市场和个人。

预计 DeFi 将带领我们进入下一个生产力时代，每个人都将被覆盖，连接到复杂的金融设施，并获得资本的支持。可以想象，如果资本能够以几乎零摩擦的方式流动并几乎立即部署到最迫切需要资金的地方，那将会产生很大的不同。

DeFi 将载入加密历史，因为它真正实现了产品与市场的契合。迄今为止，加密历史上有两种产品市场匹配，一种是比特币，另一种是 DeFi。尽管 DeFi 规模还很小，但按照目前的发展趋势，它不仅尝试构建一个与传统金融平行的领域，还尝试与传统金融相结合，实现新的功能。这是一个非常有趣的领域，值得进一步探索。

The rise of DeFi is also to be expected. After all, the services of traditional financial giants are moved to the chain through code protocols. There are countless stories to tell based on these alone. The decentralized currency trading system no longer has to take the risk of capital security to buy niche tokens from small exchanges. Decentralized lending, stable currency and other services, combined with DeFi's low entry threshold, also laid the foundation for DeFi to achieve inclusiveness.

So how do you understand DeFi?

As long as it is an insider, it is impossible not to know DeFi, but many people have only heard of DeFi, but do not understand what DeFi is. With a definition, investing and analyzing will not go astray.

DeFi is actually very simple to understand. In a distributed system (that is, what we call a blockchain system), distributed applications (that is, Dapps) are used to provide decentralized financial services, and these different Dapps and different service forms , which also constitutes a financial ecology, which is DeFi. DeFi is not a single coin or a project.

And going deep into DeFi, there are actually a lot of ways to play, and there is never a shortage of opportunities to make money. For me, the most powerful wealth effect in the DeFi world is mining.

How to understand mining?

Mining in DeFi is actually very easy to understand from another way of thinking: when a DeFi project is just launched, the most insufficiency is liquidity and cryptocurrency deposits, then I send a project token, and anyone comes to me to deposit and lock the warehouse , you can get token rewards, which is the most basic mining in DeFi - liquidity mining. This will attract more funds to participate in the project and encourage users to provide liquidity, so as to obtain users, traffic and funds in the early stage of the project, making the project burst out in the initial stage.Remember to download Coinbase Wallet or MetaMask Wallet。

Methods of DeFi Mining

The easiest way to mine DeFi is to mine in wallets or exchanges. Some wallets or exchanges will integrate some well-known DeFi projects into their own software. Of course, they will also charge a handling fee for the proceeds of mining;

The second is to directly mine in the DeFi project, directly enter the operation interface of the project, log in to the on-chain wallet, and authorize some of the permissions of the on-chain wallet to the project, so that funds can be directly deposited and locked. The premise of this is that you need to consider enough security issues, which I will talk about later.

The DeFi world is very big now, and there is no shortage of opportunities for you to earn, as long as you have a heart to find opportunities and a method to judge at any time.

If you don't understand, you can ask me, I can explain some knowledge of Defi to you, my telegram; +852 6200 8947 (@MC0MC0)，remember to chat with me

What exactly is DeFi, and how did it come about? How to understand it? What exactly is the point of DeFi?

Today, we will talk about the underlying logic of DeFi.

01 What is DeFi?

DeFi comes from decentralized finance in English, DeFi is the abbreviation of this phrase, if the literal translation is "decentralized finance".

But in fact, it is more appropriate to call it "distributed finance" or "open finance", because, in essence, there is no complete "decentralized" finance, and most of them are centralized and decentralized to varying degrees. combination. However, DeFi has become a convention and is more suitable for dissemination.

So specifically, what is DeFi? It generally refers to encrypted assets, financial smart contracts and agreements built on smart contract platforms (such as Ethereum).

02 Why understand DeFi?

In fact, digital assets are a good key to understanding Defi.

In an introductory finance course at MIT, there is a formula that really impressed me, he wrote mathematics+dollar=finance.

What does that mean? That is, mathematics plus money equals finance. It can be said that this is a very concise generalization.

We know that finance is actually the study of the generation, circulation and distribution of money and financial assets, so no matter which market or financial institution it is in, no matter how complicated the financial process is, there is a whole set of mathematical principles and algorithm steps behind it. And the goal of these formulas and steps is money, or more broadly, assets.

Then in the blockchain era, we directly write these mathematical principles and algorithm steps into smart contracts, and deploy them on the blockchain to become a Defi protocol. Therefore, most people who play Defi always focus on the algorithm or business logic of Defi.

So fully understand the nature of digital assets in Defi, understand how it is generated, how it flows, and what is the value behind it? how to use? How to destroy it? These will help you understand Defi more deeply.

Why do you want to do this?

Because I believe that when we study Defi, we study its development opportunities, not just make a little money or lose a little money and withdraw. If this is the case, it is better not to study it, and to see its logic. Even if you make money, it is due to luck, and the money you make with luck will often be lost due to your ability.

03 How to understand Defi?

How to understand Defi?

You may wish to ask yourself the following questions:

How big is the bubble in Defi?

Which Defi assets have real value?

Will Defi crash and when will it crash?

Where are Defi's entrepreneurial opportunities?

If you have not done in-depth research on the digital assets in Defi, you may be at a loss when faced with these problems.

So, let's start with Defi's digital assets.

We divide the digital assets involved in Defi into three categories:

The first category: underlying assets. For example, the mainstream digital assets you see: Bitcoin, Ethereum, etc.

However, it should be noted that the underlying assets are not part of Defi. For Defi, it is exogenous. For example, the US dollar and Bitcoin are generated outside of Defi, and their prices are mainly activities outside of Defi. impact in. Therefore, for Defi, these basic assets are equivalent to foreign exchange, which is not something he can decide by himself.

It seems that most sectors of the real economy are incapable of creating money and rely on the banking sector to provide money. Therefore, money is exogenous to sectors of the real economy, such as real estate and e-commerce.

Therefore, compared to Defi, the basic asset is a kind of exogenous asset, but it is very important to Defi.

The second category: stable assets. Mainly refers to various stable coins, such as USDT, USDC, DAI, etc.

These stable currency assets are also called stable value assets. They have established a relatively broad consensus, that is to say, many people believe that the value of such assets is equivalent to the US dollar or other legal currencies, and they are willing to use this value as the basis to use Exchange your own goods, services or financial assets with him.

An important feature of stable assets is that they are very liquid.

As we all know, if an asset whose price fluctuates frequently and rapidly, its liquidity is definitely not good.

Liquidity is an important indicator for measuring assets. Because if the price always goes up, then some people may want to buy it. After buying it, the price will go up again, but the person who sells will be reluctant to sell it, and will not sell it. write.

But there is always a time when the value of this thing depreciates. When the value of the thing depreciates, then the person who sells it must be eager to get rid of it immediately, but the person who buys it will dawdle, because the value of the purchase will depreciate.

Therefore, whether a thing is a financial asset or a commodity, if its price jumps up and down like a monkey climbing a tree, then the participants are gambling, and they are not willing to exchange based on value itself. Therefore, there are only stable commodities and assets, and everyone's mentality is the most stable.

The third category: Derivative assets. The so-called derivative asset means that its value is determined by the value of other assets. In Defi, in fact, most of the assets that you come into contact with are derivative assets.

Derivative assets are divided into many categories:

For example, note-type derivative assets, such as cToken in compound, lpToken in unicef, etc.

For example, currency derivative assets, such as COMP, CRV AAVE, YFI, and then YAM, etc., these assets do not have a clear valuation method, and they frequently rise and fall, much like stocks.

For example, high-end derivative assets, high-end derivative assets have just begun to appear, but the potential is very large. They are derivative assets of derivative assets.

The above is the classification of Defi digital assets.

Of course this is only the first step.

Next, we have to study how these assets are created, how they are circulated, how they are used, how they are destroyed, and so on.

This topic is very big, and everyone can explore it according to this thread.

Today we will analyze one of the topics: the value analysis of Defi.

If a worker wants to do a good job, he must first sharpen his tool. What kind of tool do we use to analyze its value? Just use the joint balance sheet, some people call it asset-liability proof.

As we all know, among the financial statements of an enterprise, the balance sheet is the largest sheet, which reflects the status and relationship of the assets, liabilities and equity of the enterprise at a certain point in time.

So what is a joint balance sheet? It is to draw together the balance sheets of multiple companies or multiple related departments of a company, and then analyze the relationship between the items.

For example, for example, there are two companies A and B, both of which are mortgage loans. So what we want to analyze is what is the difference between their lending? What's the connection?

For another example, someone has deposited an ETH in company A. Assuming that the value of ETH at this time is 400 US dollars, then if this person chooses a loan rate of 75%, that is, he brings out 300 DAI, then for company A, It has one more asset item on the left: ETH is worth $400.

Then according to the balance law of the balance sheet, at the right end of it is the liability side, and there is also a liability item of $400. Among them, this person withdrew 300 DAI, which is obviously a liability of Company A to this person.

Because in the future, if this person comes to Company A with DAI, Company A is obliged to repay the mortgaged assets by giving him ETH. So it is a liability.

Now, if this person takes the loaned 300 DAI to company B for mortgage loan, and lends 900 bat, the Chinese name of bat is more interesting, called Basic Attention Coin, which is a well-known digital currency. Everyone can understand it as a digital currency.

Now these 900 bats are just worth 225 US dollars. Company B chose such a loan of 225 US dollars. In addition, he got some cTokens, here is cBAT, then these CBAt should be added up to the value of the 900 bats that were borrowed. It's equal to $300, or 300 DAI.

So the value of the CBA is $75.

So, for Company B, his 300 DAI asset is actually a liability item from Company A. So we have to connect them to analyze.

This is the analytical logic of the joint balance sheet. It reflects the relationship between assets and liabilities of related entities.

Only when the asset-liability relationship is clear can its value be better analyzed. It can also be said that balance sheet analysis is an important step in Defi value analysis. Otherwise, some projects and some companies look very high-quality, but in fact you don’t know how it works behind the scenes, and how these assets come from.

Then some friends may want to ask, but what you said above doesn't seem to be too complicated.

Yes, I only exemplified the asset-liability relationship between the two companies.

In reality, it is the simplest to involve two companies, and many projects are related to N companies, which is very complicated.

So, why use the logic of joint balance sheets? The first is to really see the underlying logic of the project, the second is to analyze its value, and the third is to evaluate its risks, all in one go.

Of course, the above is just a small topic of digital assets, and this is only one of the angles of analyzing Defi.

Defi is in a very special position. Traditional finance includes financial technology. One of the financial technologies is blockchain. There is digital currency in blockchain. Defi is only a very small branch of blockchain digital currency. But this branch is very hot recently, but many people have only heard of Defi without understanding what is a really good project in Defi.

For example, you only know Bitcoin, but do you know why you know Bitcoin? Today I hope to use 1 hour to upgrade you from a beginner of Defi to a relatively proficient.

With a definition, investing and analyzing will not go astray. The definition of Defi is very simple. In a distributed system—that is, what we call a blockchain system—using distributed applications—that is, Dapps—provides a decentralized financial ecosystem. Defi is an ecology, not a single coin or a project.

The particularity of Defi lies in the decentralized distributed finance. The counterpart to this is centralized finance. We want to compare the two and analyze why Defi can flourish and grow so fast.

1. Definition and advantages of Defi

There are many functions in centralized finance. for example:

(1) Legal affairs, compliance, KYC, AML, accountants, law firms;

(2) Exchanges, the China Securities Regulatory Commission, and the China Banking Regulatory Commission shall supervise the exchanges. What exchanges and CSRC do is to match and review transactions, settlement and supervision;

(3) Banks and brokerages. Do escrow, pay, borrow.

(4) Central Bank. Provide currency.

These functions are all implemented in centralized finance. While it works fine, it has many drawbacks. These shortcomings can all be supplemented by Defi.

For example, Defi does not need the central bank, because it has its own digital currency, Bitcoin, Ethereum, EOS, USDT, USDC can be used as the underlying payment means; Defi has smart contracts, and in Ethereum, code is law. So we don’t need legal affairs and judges. As long as there is a smart contract, we can judge which contract can be executed; we don’t need a contract, we just need to write the smart contract and it will be executed automatically when it expires. There is no contract dispute; because it is established in the district On the blockchain, contracts will not be tampered with, and contracts do not need to be kept in notaries and safes; all transactions can be traced, transparent and fair; Defi is born without borders and without intermediaries.

These features of Defi can make up for the shortcomings of centralized finance. For example, centralized finance is difficult to be inclusive. Its transaction cost is very high, the transaction is complicated and the speed is slow, and there are intermediaries such as banks, exchanges, brokers, accountants, lawyers, etc., and they all charge service fees.

Defi is an addition to the future of centralized finance. We cannot say that Defi can subvert centralized finance, which is unlikely, just like it is impossible for ants to shake elephants. But it is very well compensated and tried. It can make up for what centralized finance does not do well in Defi.

1. The meaning of Defi to achieve inclusive finance

In traditional finance, a quarter of the world's population, about 1.7 billion people, is unbanked. Maybe the bank has not opened branches in the area, maybe it requires a lot of documents and materials to open an account, and there is also a management fee for opening an account, which makes some people do not want or have no way to open an account. However, 80% of the unbanked people in the world have mobile phones and can connect to the Internet. These people may be able to enjoy financial services, that is, Defi. Only decentralized and distributed finance can reduce costs to a minimum. The Internet realizes the popularization of finance.

The actual meaning of inclusive finance is "inclusive" and "benefit". "Public" means that everyone can participate, and "benefit" means that the cost is low. The investment bank Goldman Sachs may charge dozens or millions of fees. I have worked in an investment bank before, and the salaries of investment bank executives are all derived from handling fees and service fees.

The benefits of Defi doing inclusive finance:

1. The entry barrier is very low. As long as you need a mobile phone and connect to the Internet, you can borrow, pay, make derivatives, and insurance;

2. Reliable. are written into the code;

3. Transparent, open and open. Defi's opponents, even investment banks, are on an equal footing. No one can have an advantage. There is no information, status advantage, no lower rates, and faster efficiency. It is impossible to do in traditional finance;

4. No counterparty risk. In the past, whoever P2P lends money to, if the other party defaults, they can only rely on the P2P company to collect the debt. If the P2P company runs away and the other party does not repay the money, the money will be gone. In Defi, the form of pawn or mortgage is strictly used to ensure that the other party can pay and repay the debt. At the same time, the smart contract is used for borrowing. As long as the time is up, the oracle machine and the link are added, and the execution will be executed immediately, without any mechanism. Can minimize counterparty risk;

5. Reduce the risk of intermediaries. Defi has no intermediaries, only smart contracts. Costs will also be reduced because there are no intermediaries;

6. Composability. For example, UMA, Synthetix, anything can be used as derivatives, can bet, make contracts, and one person can create contracts. Like Lego blocks. Synthetix recently launched a derivative with Tesla stock as the base. Combinable and programmable is a major feature of Defi, which will make financial products particularly rich, I'm afraid you can't think of it.

Various characteristics make Defi full of vitality. New things, especially things with potential and vitality, must be concerned.

1. The ecology and development trend of Defi

2. The scale of Defi

In October last year, Defi only had 50 million US dollars locked up. At the beginning of the year, it reached 100 million US dollars. In February and March, it rushed to 1 billion US dollars. Now it has 6.7 billion US dollars locked. Locking is an important parameter of Defi. On Defi, you don't know who the other party is, so you must mortgage and lock the position. Trading volume is just a parameter. Which market and product can increase a hundred times in volume in one year, only Defi has it.

1. The ecology of Defi

First of all, there must be the underlying public chain. The public chain of Defi is mainly Ethereum. 95% of Defi uses Ethereum, as well as EOS and Bitcoin. Ethereum has smart contracts, and they are widely used. Bitcoin's smart contract capabilities are poor, although it belongs to the leader of encrypted digital currency;

The second is payment, which is paid in stable coins. Defi has its own stable currency, such as DAI, which is a stable currency specially made by Marker for payment;

It is borrowing again, followed by transactions, which will be divided into normal transactions and derivatives transactions;

The other is wallets and brokers, exchanges, as well as oracles (insurance) and gambling. The oracle machine is to provide a data interface, so that the data that occurs in the real world can be connected to Defi's financial products;

The last is asset management and financial management.

The other is relatively niche analysis tools, collection tools and aggregators. KYC, etc., you can find it on Defiprime, the project is the most complete.

1. How to participate in Defi

The easiest steps are six:

Step 1: Build a wallet first, I use Metamask, Coinbase is universal, and everyone will use it.

The Metamask wallet is very convenient, but some people like to use the wallet of the exchange. At present, I know that only Coinbase provides Defi services on exchanges.

The Defi circle is ten times faster than traditional finance. Some people joke that traditional finance is the same for ten years, and nothing changes in ten years. Fintech is slightly faster, and digital currency is much faster than Fintech. After Defi came in, traditional finance became classical finance, and Defi changed faster.

There are real wallets, wallets with bank account links, hard and soft wallets provided on wallet services, wallets provided by digital currency exchanges, and finally wallets provided on Defi services.

Defi wallets store encrypted

The second step: recharge, you need to recharge from other wallets, generally the most used is ETH, you can also recharge USDC or USDT. USDT is not very easy to use in Defi, it seems to be despised.

Why do we use the DAI stablecoin in Defi more instead of USDT? Because everyone is worried about USDT. Stablecoins are created because digital currencies are too volatile. The reason for using digital currency is that legal currency has always been inflationary, indiscriminate, unlimited, depreciated, and limited by national boundaries. Therefore, because fiat currency has so many shortcomings, with digital currency, the volatility of digital currency is too large, and there is stable currency, and stable currency reserves are insufficient. Everyone was worried about USDT, so they had to make a stable currency DAI in Defi.

DAI has full (excess) collateral, relatively transparent auditing, distributed management, and there is no risk of running away. Make up for the deficiencies of other currencies. The size of DAI is now $400 million. USDT has 10 billion US dollars, and it has been issued all the time, desperately.

assets. This is not the core. The core is whether it is self-management or custody, whether it is to be managed by others or managed by yourself. The advantage of Defi wallet is that it is managed by yourself, which is more secure. Put it on the exchange, what if it gets hacked? If it is lost in the bank, there is usually compensation, and if the exchange is hacked, there is usually no compensation. From the perspective of convenience, it is more convenient to put it on the exchange, but the security is relatively poor.

DAI is a pawn stablecoin issued by Marker, a pawnshop. People who go to the pawnshop want to borrow money, and they need to mortgage an item, such as a Rolex watch, which is worth 10,000 USDT, lends 5,000 USDT, and returns in three days to get 6,000 USDT. DAI is just like a pawnshop. One person mortgages ten Ethereums on Marker and lends 2000 DAI. After ten days, I may have to pay back 2050 DAI and 10 ETH back to me. DAI is a pawn stablecoin issued by Marker and collateralized by digital currency. At the beginning of the issuance, only BAT and ETH could be mortgaged, and now it has expanded to more than a dozen currencies.

There are several important data when mortgage, one is mortgage rate. For example, ten ETHs are mortgaged, worth $4,000, how much DAI can you take out, 50%, 60%, but it is impossible to reach or exceed 100%. The pawn mortgage rate will be less than the value of the mortgaged assets; the second is the lending rate; the third is the clearance rate. If the market value fluctuates too much and triggers a certain critical point, the mortgaged coins will be taken out for clearance. This is the same as leverage, because the volatility is too large and the position is cleared by the exchange. Pay attention to these data when exchanging mortgages for stablecoins.

The third step is to choose the way and project you want to participate in.

For example, investing, borrowing, managing wealth, buying insurance, and trading derivatives. After you choose which website to open, you will be asked if you want to connect to the wallet. Connecting to it will usually lock you up.

Lending is the most primitive financial activity of human beings, and if there is finance, there will be lending services. Lending is also the biggest product of Defi. In the past, loans could only be borrowed from banks. The emerging consumer loans, P2P, and online loans came out. However, P2P has been eliminated by the group and has been subject to many policy restrictions. The judicial upper limit of private lending interest rates has been reduced from 24% recognized by the court to 15.4% , is also difficult to do.

Defi has many innovations to solve these lending problems:

1. Degree of difficulty. To borrow money, the biggest problem is that the more money you are short of, the less people will dare to lend you. The richer the bank, the more willing to lend you. Dislike the poor and love the rich. People who are really short of money usually can't borrow money from the bank. Consumer loans and online loans also require review and credit records. Defi does not need these, because it is relatively easy to use digital currency as collateral.

2. No KYC is required, it is transnational. Any other loans can be cross-regional, but still within the country. Only fiat currency can be limited, and it is impossible to borrow US dollars.

3. Dynamic adjustment of interest rates. None of the other borrowings can be dynamically adjusted with the market. Because Defi uses smart contracts and algorithms, it can calculate the interest rate at this moment and the interest rate at the next moment at any time.

4. The cost of borrowing is very low. Because there is no intermediary and counterparty risk. But here only refers to the borrowing fee, and the gas fee for the transfer fee to the miners is getting higher and higher. This is not because of the Defi project, but because the Ethereum GAS fee is as high as 10%, which is more ruthless than the bank.

5. Dynamic adjustment of interest rates. None of the other borrowings can be dynamically adjusted with the market. Because Defi uses smart contracts and algorithms, it can calculate the interest rate at this moment and the interest rate at the next moment at any time.

6. The cost of borrowing is very low. Because there is no intermediary and counterparty risk. But here only refers to the borrowing fee, and the gas fee for the transfer fee to the miners is getting higher and higher. This is not because of the Defi project, but because the Ethereum GAS fee is as high as 10%, which is more ruthless than the bank.

One of the more well-known projects in lending is Compound, whose liquidity mining token COMP has ignited the enthusiasm for this wave of Defi, and the other project is Aave, which has grown very fast (the latest data Aave has ranked first in terms of loan volume) Previously Compound is the absolute boss. Their borrowing rates sometimes vary.

Aggregators are also popular now, and logging into the platform can glue all lending platforms together.

In addition to borrowing, there are other financial management, insurance, and derivatives transactions. I have the opportunity to elaborate on the time relationship.

The fourth is lock-up and mortgage. Generally, it is how much Ethereum is locked, and there will be some handling fees in the middle.

The fifth step is to see that there is a reward or risk,

The sixth step is that you initiate redemption, release the locked coins, and calculate the interest to be paid or the income to be harvested.

These steps are easy and simple, and difficult. Looking at Defi's financial derivatives, I also feel very creative, and there are still many points to dig deeper. The current society is to reward people who know how to dig deep and try to eat crabs.

1. DeFi Exchange DEX and Derivatives

In classical finance, exchanges are the most profitable, and Huobi, Binance, and OK are the top three. But they have many drawbacks. One is that all coins are placed on the exchange, which will lead to hacker attacks, and there will be more or less incidents of the Mentougou exchange being hacked; the second is the handling fee. Suppose a small coin is not available on one exchange and needs to be bought on another exchange. Then go to Defi, there are three to four steps in the middle, and you have to pay for each step. Transactions and transfers require fees.

For exchanges in Defi, as long as you find an opponent in the liquidity pool, you can exchange them directly, turning the four or five-step handling fee into one step. The handling fee is relatively cheap, and the accounts are managed by themselves, not on the exchange, which is relatively safe, fair and equitable.

When the exchange opens derivatives, everyone is worried about the situation of pins being inserted. Because it's centralized, maybe it's downtime, maybe it's intentional, I don't know. But it is impossible for a decentralized exchange to manipulate prices. Therefore, decentralized exchanges are becoming more and more popular. Last year, major exchanges despised Defi, believing that without liquidity, it could not be done. But I didn’t expect that there will be a liquidity mining model this year, and the liquidity has risen, and the coins of the Dex exchange are flying into the sky. To put it vulgarly, the exchange is a "casino", and it is guaranteed to make no loss, so the exchange token will have such a large appreciation.

DeX can suck the traffic of classical exchanges to Defi. Defi lock-up volume can range from tens of millions last year to billions this year. Where does the money come from, it should not be new funds, but existing and existing funds. It is from the original exchange wallet. Centralized exchanges have been seriously injured in this wave of Defi craze. So they all follow up, and follow up by setting up funds and other means. They know this is where the big money is looking, and it's dangerous not to keep up. OK did it pretty fast.

The largest Dex exchange is Uniswap, and everyone should pay attention to the issued coins. Curve is emerging.

Let’s briefly talk about derivatives exchanges. The advantage is that they will not be monopolized, and you can design any derivatives you want. In traditional finance, derivatives can only be designed by investment banks and exchanges, and trading is done by large institutions. Defi has lowered the threshold to a very low level, and anyone can make derivatives or even design derivatives. Synthetix, just mentioned, is doing the best in derivatives. Tesla's derivatives will be launched recently, and you can use currency to go long and short Tesla's stock. Apple stock, gold, foreign exchange, Nasdaq index can be exchanged on Synthetix.

Because derivatives are off-chain assets and require a fair person to provide price standards, Chain Link appears. This is also the reason why it has become the fifth largest currency by market value and has been so popular recently. The expansion of exchanges and the popularity of Defi have put oracles and data providers in the spotlight, pushing the market value of Chain Link to a high point. In fact, Chain Link has been around for many years. Chain Link’s current market cap is $5.8 billion,

YFI is an aggregator. You can see which ones have higher interest rates and better liquidity, and can be used as wealth management products. You can invest in whichever one is better. I call it a financial aggregator.

1. Risks and Inspirations of Defi

2. Code Risk

Many times because smart contracts are too transparent, all the code is on it. If code auditing is not done, some vulnerabilities will create technical risks. The stakes are high.

In February last year, BZX, a project in Defi, lost more than 4,000 Ethereum because hackers found a code loophole, and the price at that time was almost 1 million US dollars. So be careful when you try it. Defi is still very new.

1. Liquidity risk

The most obvious case is that on March 12 last year, Bitcoin fell sharply, and all locked positions were liquidated. The more liquidated the lower the price, the stampede occurred, which created a huge liquidity risk. But the overall lock-up of Defi is less than $1 billion. Now if there is a huge volatility, there may be huge liquidity risk. Everyone be careful. Before you make money, think about whether to lose money. Survival is the secret to winning in cryptocurrency. A lot of people make a lot of money, but lose a lot in a month or two.

1. Operational risk

Due to operational errors, anyone will have this. Because Defi supervises the wallet by itself. Don't forget your password. The Metamask wallet uses twelve mnemonic words, and no one can save them if they forget them.

Defi is on the rise now, the trend development is greater than the risk, and Defi is out of the circle. Derivatives exchanges are actually tools out of the circle, allowing all assets off the chain to be linked to the chain to make derivatives.

Defi can serve the real economy. We have always said that traditional finance is a zero-sum game, but if Defi can connect real assets, it will be able to generate real value, and we will not think of ICO as a pure leek. Defi has real projects whether it is liquidity mining or its own coins.

Defi's size is huge, and size speaks for itself. The volume has reached 6 billion, and it is estimated that it will continue to rise;

Defi increasingly involves low-level knowledge in finance and technology. If you don’t understand, just do storage and borrowing, and don’t touch derivatives. It is best to do professional things with professional knowledge, not AII IN you do not understand, in case of liquidity risk. When you see those who make money, you must also know that they are making money at the risk of the above. Higher risk means higher return.

For developers, make user-friendly apps. Defi has become relatively convenient this year. However, transaction fees are still high. Although the handling fee of the project party is not very high, the gas of Ethereum is unbearable.

The impact of classic exchanges on exchanges, derivatives contracts, wallets, assets, and spot transactions will all be affected by Defi. If you do your own exchange or work for an exchange, you really need to transition and follow Defi.

The current low-cost DeFi is a bit slow, and I have studied DeFi for a long time. Now doing projects is indeed more focused and innovative than we are. Hope that good Defi projects will be launched soon. Because there are many speculators, the market should be large.

When DCEP comes out in the future, it is not ruled out that Defi can be integrated. Of course, government regulation may not allow or want to do this. But Defi is a system that can use various currencies as the underlying exchange. In the future, it is entirely possible that the central bank's digital currency will become the underlying currency of Defi. Or Libra. Because Defi is essentially open and does not exclude any base currency. Bitcoin, Ethereum, and EOS can all be used, as long as they have smart contract functions, they are all compatible.

The recent frequent cross-chain security issues have attracted widespread attention in the market. This article hopes to start from the perspective of product design and tell readers why there are so many product security issues in this track. It should be stated that the problems pointed out in the article do not exist in every project. Most of the problems have already been designed with relevant coping strategies. The main purpose is to hope that more people can understand the complexity of this track. .

Let us take you to understand how common cross-chain bridges are designed, and then tell you about the security issues these cross-chain bridges may encounter.

No matter what the final presentation looks like, from the perspective of product design, there are only three mechanisms: side chain (side chain in a broad sense, rollup is also classified as side chain in the text), hash time lock, and notary public.

(1) Side chain Among the three schemes, the side chain scheme has the highest security, such as various parallel chains of rollup and polkadot. Security is shared between the mainchain and sidechains. However, the side chain scheme generally requires that the original chain and the target chain are isomorphic, so that the applicable scenarios are much less. This is also the reason why Buterin thinks that he approves of multi-chain, but does not approve of cross-chain, because there are too many problems in cross-chain solutions that cannot share security.

(2) Hash time lock

This solution is claimed to be the most decentralized heterogeneous cross-chain solution in point-to-point, but the cost is high and the user wait time is too long, resulting in the current adoption rate is not high. And when we still need a third party to act as an intermediate node for currency exchange, we also need a so-called intermediate consensus layer to meet the requirements of security and decentralization.

(3) Notary Public Mechanism This is the most commonly used heterogeneous cross-chain bridge solution at present. Most products on the market basically have the same root and the same origin, and there is almost no difference from the perspective of product design. The main differences may focus on the methods and steps of information verification, the consensus algorithm of the notary, the signature algorithm of the escrow wallet, etc. The difference in user experience and safety is not too big. Therefore, from a security point of view, the security risks faced also have many commonalities.

This article will focus on summarizing and analyzing some common security risks faced by the notary mechanism's cross-chain bridge.

The product logic flow of the notary mechanism

Before understanding the various risks faced by the notary mechanism, we need to understand the main design logic of this type of scheme from the product point of view.

(1) Brief description

This solution is actually very simple from a design philosophy point of view. When we face the cross-chain requirements of heterogeneous assets, the most intuitive solution is actually "mapping". Swapping means when user A crosses ETH from Ethereum to Fantom. We don't need to actually transfer the asset, or reissue it on Fantom (which can't be done either). Instead, first store user A's ETH to an address that cannot be moved, and then issue the corresponding 1:1 mapping asset on Fantom according to the amount of user A's ETH stored in this address. Mapped assets represent the right to use those ETHs on the original Ethereum chain. Because of the 1:1 peg, users on Fantom also recognize the value of this asset.

The most simplified cross-chain process

(2) Difficulties in design

There will be many problems here, the biggest of which is the management of multi-signature wallets, because ETH is charged from Ethereum to Fantom, and if user A wants to cross back, it will involve withdrawals.

The decentralization and security of deposit and withdrawal has become the biggest difficulty.

1. Who is in charge of the money?

2. Who will initiate?

3. Who will monitor transactions?

4. How to confirm that there is indeed a user transferring money in?

5. How to confirm that the user's money is indeed what the user wants to withdraw?

6. How to prevent replay attacks?

7. How to submit a failed transaction again?

8. What should I do if the multi-signature manager does evil?

9. What should I do if the machine is down?

The cross-chain technology of the cross-chain bridge also requires more participation, issuance, issuance, monitoring, synchronization verification and even an independent mutual consensus.

In order to further deepen the user's understanding, I will further explain the entire cross-chain process and currency withdrawal. to help understand.

(3) Further refinement of the process

1. Deposit

Let me first state that the process is just my own design plan after deduction, without careful demonstration, the purpose is to explore the possible security problems in the design logic, and can not be used as a formed plan.

A deposit transaction from the original chain to the target chain will in principle include these steps. (1) The user recharges to the escrow address (2) After the listener listens to the transaction, the BP (the consensus node is also a multi-signature administrator) initiates the transaction (3) The contract verifies the correctness of the BP signature (4) Whether there is a fault tolerance mechanism through the node (5) If there is no call back, if there is, recharge the target chain address according to the relationship between the mapped addresses (6) BP confirms the recharge transaction (7) After passing the miner, transfer the mapped tokens to the user's address on the target chain

It should be noted that this process is designed to discuss general heterogeneous cross-chains, so compared with anyswap and other solutions, a step is added to allow users to bind address relationships on the intermediate consensus layer. This is mainly due to the different ways of attaching information to different heterogeneous chain transactions. In order to handle it uniformly, let the user bind the mapping relationship first. If all transactions of the EVM chain are processed, this step is not required, and the target chain address can be directly attached when the transaction is initiated.

Back to the topic, it can be seen from the above process that starting from the second step, various logic verification problems and processing problems in different situations will be encountered.

The main validation logic includes: (1) After monitoring the transaction, verify the target chain transaction that initiates asset mapping and transfers to user A (2) Initiation of the target chain transaction and verification of the transaction result Of course, in addition to the verification logic drawn in my process, it should also include the verification of counterfeit currency recharge, as well as special handling issues that need to be done when calling different tokens. In order to better summarize the potential security risks in the follow-up, let's continue to understand the process of withdrawing coins.

1. Withdrawal

The process demonstrated by the withdrawal is the logic of the target chain mapping assets to exchange the original chain assets. It should be noted that many tokens currently have multiple chain versions, which means that many tokens are on multiple chains. Own the native token. Therefore, some bridge projects often set up asset pools. When the fund pool is sufficient, users cannot feel the existence of mapped assets such as anyDAI, but directly replace the token of the target chain version, but this does not affect the overall logic. So, the analysis continues.

The transaction process of withdrawing coins from the target chain to the original chain is as follows: (1) The user initiates a transaction (transfers the same amount of mapped assets to the escrow wallet on the target chain) (2) Verify the identity of the BP, and a BP initiates a withdrawal request (3) Confirm withdrawal permission and signature (4) After the miner completes the request to withdraw coins on the original chain, transfer the money from the escrow wallet of the original chain to user A (5) If there are problems such as node verification errors or downtime in the middle, it will be rolled back and restarted. As can be seen from the above process, the main verification logic involved here are: (1) Verification of origination and signature authority (2) Fault-tolerant mechanism after the problem occurs

(4) Security risks

1. Security issues in design logic After a careful understanding of the design of the cross-chain bridge, we can find that there are many challenges faced by the cross-chain bridge in the design logic. To summarize the problems mainly include three aspects (the relevant theft cases are marked at the end of the question)

(1) Deposit a) Permission loopholes in the deposit contract, resulting in the direct transfer of the deposited money. This is a stupid problem that almost all contract projects will encounter, b) The problem of counterfeit currency recharge. Some projects have not verified the authenticity of the cross-chain Token, resulting in fakeTOKEN -> realTOKEN (anyswap). To be honest, this is also a bit stupid. d) The problem of counterfeit currency recharge. Native assets such as ETH are different from ERC20 contracts. Many attacks are caused by improper handling of ETH, resulting in fakeETH -> realETH, which is why wrapped assets such as WETH are popular. (thorchain) c) Although different Tokens are all ERC20 standards, the specific implementation methods are different, or there are additional logics (rebase, fallback, etc.), and the developers did not do a good job of research during adaptation, such as (WETH, PERI, OMT) , WBNB, MATIC, AVAX), etc. will call the sender's custom fallback function to do additional operations after the transfer is completed, which increases the complexity of cross-chain bridge judgment.

(2) Cross-chain message transfer After the a-chain deposit is completed, and before the b-chain assets arrive in the account, the processing of the cross-chain bridge is like an independent blockchain system, that is, a consensus mechanism is required, and dpos is generally used. The following are the assumptions of using dpos. Issues that need to be considered, but I suspect that all nodes are owned by the project, and there is a risk of centralization in the first place. a) Monitor the deposit message, who will be the first to initiate a cross-chain processing proposal, random? Or take turns? Or according to the block order of the intermediate consensus layer? b) How do multiple notaries verify the correctness of the deposit? If the data sources are all from data providers such as infura, then infura is a single point of risk. The safest thing is to maintain nodes individually, which is costly. c) How to confirm that the cross-chain processing has been completed (b has arrived in the account), and there are several situations in which the processing has not been completed. i. Cross-chain bridge did not initiate processing ii. The cross-chain bridge initiated processing, but the verification & consensus failed iii. The cross-chain bridge verification is passed, but no transaction is initiated on the b-chain iv. There is a transaction on the b chain, but it fails (insufficient funds or other situations)

(3) Multi-signature verification problem Most of the hardest hit areas with frequent problems are code logic problems a) 3/5 signatures, I arbitrarily construct signatures that are not in the multi-signature list, which is also +1 (chainswap). b) The problem of centralization, nominally multi-signature, is actually in the hands of the project party, a huge risk of centralization c) The signature verification method, the development mode on different chains is different, which will inevitably lead to omissions when the developer is connected, wormhole example: The verification signature function on solana is a function in the system contract, and the system contract should be called normally. , the address of the system contract should be written in the code. They pass the address of the system contract as a parameter here. The hacker passed a fake system contract address when withdrawing the coins, bypassing the signature verification and successfully withdrawing the coins. .

(4) Refund

1. As discussed in (2)-c, there are many possibilities for cross-chain status. In any case, it is necessary to provide the user with a way to refund. For example, when anyswap deposits money, it will first send a message to the user on the source chain. anyToken, and then send anyToken to the user on the target chain, and then burn the anyToken of the source chain. The purpose of this is that no matter what the problem is, users can represent their assets by holding anyToken. There are 3 chains (source, target, cross-chain bridge) and 4 assets (original Token/anyToken on the source chain and target chain) in this process, which is very prone to code logic problems. b) The loophole that Thorchain broke out on July 23, 2021. The hacker used the code logic problem to construct a huge fake recharge. The cross-chain bridge could not handle it, so it entered the refund logic, resulting in the hacker g

1. Other security risks

However, the problems that can be displayed through the logical process are only business logic problems, not all. From a security point of view, we should also consider three other aspects of risk

(1) Systemic risk For example, the deposit of the original chain was successful at the beginning, but it was rolled back later. This is a huge problem. V God discussed that the assets crossed from Solana to Ethereum. After the cross-chain is completed, Solana is rolled back, and the user's assets are doubled without any solution. But such as layer2, which shares security with Ethereum, such as rollup, there will be no such problem.

etting a huge refund.

(2) Front-end risks a) Fake URLs, such as oxdao.fi 0xdao.fi oxdai.fi, etc. b) Xss attack, that is, cross-site scripting attack, is a code injection attack, such as www.xxxx.finance/?params=hackerscode12345, although the URL is indeed the official website, but the URL carries the code of the hacker, if the front-end development does not Be careful to prevent xss, then this code will be executed on the page, causing the user to authorize the signature of the hacker's transfer transaction, so do not open links of unknown origin. c) Cors cross-site service attack, in the strict same-origin policy, browsers are only allowed to load content from this site, that is, all content displayed by the www.xxxx.finance site and the interface called should come from xxxx. Finance domain name, but most projects currently allow cross-site calls, that is, the front end of xxxx can call the interface of quickswap, and vice versa, which brings convenience to development, but also brings risks. If I visit xxxx.finance, store some sensitive data in the browser cache, and then I visit a malicious website, if the same-origin policy of xxxx is not restricted, this malicious website can freely obtain the data stored in the cache of xxxx .

(3) Risk of additional functions Some cross-chain bridge projects not only provide cross-chain assets, but also provide cross-chain contract calls, which brings additional complexity. The attacker initiates a call to the x contract on the b chain on the a chain, and the cross-chain bridge directly calls the x contract regardless of what the x contract is. Unexpectedly, the x contract is a multi-signature contract of the cross-chain bridge on the b chain. It is to change the multi-signature account to the attacker's own address. After the execution is successful, the hacker can freely control the funds of the cross-chain bridge on the b-chain (game over).

Epilogue

1. The purpose of this report is to help users clearly understand the security risks of cross-chain bridges, not how vulnerable cross-chain bridges are to malicious rendering.

2. The cross-chain solution of the public mechanism is currently the most valuable, widely used and lowest cost solution. And any product goes through a scarred process, and these issues, from blockchain to scarred products, are sure to become more popular with time and experience.

Over the years, computers have disrupted nearly every industry. Each innovation builds on the previous one, so digital products and services become more complex. Through technology, we meet the needs of the world. From digital assistants to smart homes, programs now impact every aspect of our daily lives. So why is there an exception for money?

What does decentralized finance do?



To better understand DeFi, we should first look at how traditional finance came about. It feels like money has been around since we were born, but it's not.

Human beings originally aimed at bartering. But with the formation and development of human society, our economy also develops. We invented money to make the exchange of value easier. Subsequently, money helped introduce new innovations and higher levels of economic productivity. But progress has not come without a price.

Historically, central banks have issued the currencies that underpin our economies. Central banks and financial institutions manage and regulate the supply of currency in circulation. As our economies grow in size and complexity, central governments gain more power from them as more people trust them.


We believe that central banks will not print more money overnight. You trust the bank to store your funds safely. And, when it comes to investing, you can trust your assets to financial institutions. By giving them control of your money, you hope to make a profit. But looking at financial systems around the world, the sad truth is that the power that comes with that trust doesn't always pay off.

We often have little say in how companies handle our investments, or even how power institutions manage the economy. In most cases, investors only get a portion of the return from the risk these institutions take.

DeFi tries to build something different


Decentralized finance aims to create a financial system that is open to everyone in the world and minimizes people’s reliance on centralized financial institutions. Technologies such as the internet, cryptography, and blockchain provide the tools to jointly build and control financial systems without the need for a central financial institution.

There is a saying in the blockchain world: "Don't trust, verify." Because with the blockchain network, you can personally verify all transactions that take place on the blockchain.

DeFi puts everyone in control of their finances


Almost all DeFi applications are built on the Ethereum blockchain, the most popular programmable blockchain in the world. Ethereum is a blockchain network that maintains a shared ledger of digital value. Instead of a central authority, the participants that make up the network control the issuance of ether (ETH), the network’s native cryptocurrency, in a decentralized manner.

Developers can write applications on Ethereum to create, store and manage digital assets (also known as tokens) on the blockchain. These are called smart contracts or decentralized applications (DApps). They are contracts or agreements executed by the Ethereum blockchain. Or, just an application or script that runs programmatically on the Ethereum network. You can build complex irreversible protocols without a middleman.

Decentralized finance has the opportunity to build a more resilient and transparent financial system. Anyone with an internet connection can access and interact with smart contracts based on the Ethereum blockchain. Many smart contracts are built to be open source and interoperable with existing smart contracts. Thus, users can verify the code of the smart contract and choose the service that best suits them.

What are some examples of popular DeFi applications?


DeFi has many different products and services, some of which you may find familiar to existing financial services, but decentralized.

Arguably the most popular and fastest growing industry in DeFi is lending platforms. Similar to a bank, users can deposit money and earn interest from other users who borrow their assets. However, in this case, the asset is digital and the smart contract connects the lender with the borrower, enforces the terms of the loan and distributes the interest. This all happens without trusting each other or a middleman bank. And, thanks to the transparency provided by blockchain, lenders can earn higher returns and gain a clearer understanding of risks by cutting out middlemen

Tokens called stablecoins are also important to the DeFi ecosystem. You might feel like all cryptocurrency prices are on a roller coaster ride. However, stablecoins are tokens designed to hold a specific value, usually pegged to a fiat currency like the U.S. dollar. For example, DAI is a stablecoin pegged to the U.S. dollar and collateralized on the Ethereum (ETH) chain as a digital asset. For each DAI, $1.50 of Ethereum is locked in the MakerDAO smart contract as collateral.

Another popular DeFi application is the so-called decentralized exchange, or DEX for short. DEXs are cryptocurrency exchanges that use smart contracts to enforce trading rules, execute trades, and securely handle funds when necessary. When you trade with a DEX, there is no centralized exchange operator, no registration, no authentication or withdrawal fees.

DeFi is like Lego bricks

With Lego bricks, you can start with a bunch of small bricks. It's up to you how to put LEGO bricks together into something new. The same goes for smart contracts. With every new project, product or service launched on Ethereum, you will have an extra money Lego in your collection. By piecing together the existing components of DeFi, it is possible to autonomously combine, modify or create powerful new financial instruments through multiple layers of smart contracts.

cDAI is the perfect example of money Lego bricks in action. Compound is the money market, or in other words, Ethereum's lending service. When you provide DAI to Compound, you receive cDAI tokens, which represent both your DAI in Compound and any interest you earn on the loan. Since cDAI is a token, you can send, receive and even use cDAI in other smart contracts. Money Legos comes into play: ETH is put into MakerDAO to create DAI tokens, DAI is given to Compound, and cDAI tokens can be used in other DApps.

For example, you can exchange ETH for cDAI on a DEX and immediately start earning interest just holding cDAI. And since you choose how to interact with smart contracts on the blockchain, you can use a DEX aggregator like DEX.AG to compare and trade at the best prices across all popular DEXs in seconds.

Decentralization may make a difference

When it comes to DeFi services, the degree of decentralization varies. Not everything can or needs to be completely decentralized.

As mentioned earlier, stablecoins are popular in DeFi. However, not all stablecoins are as decentralized as DAI. Many of these are actually tokens representing fiat currency deposits. For example, for each USDC token, a 1:1 collateralization of $1 is issued in a bank in the United States. In theory, you can "tokenize" or create a token to represent any real-world asset. Here things become less black and white because while you can transact, send and receive these tokens on the blockchain, you cannot completely eliminate the need to physically manage or redeem real-world assets.

For example, buying a house on the blockchain. Say someone marks the deed as their home, puts it on a decentralized exchange, and you buy. Without real-world legal protection, you cannot force the person to leave his home to complete the transaction, whether or not you have a digital contract. So there is still a need for legal settlement of disputes.

In short, if technology is divorced from the real world, there are limitations, and the boundaries of DeFi begin to blur.

DeFi won't stop anytime soon


If you believe that you will buy digital currency in the future, then you can explore what DeFi can provide. Ethereum has become the blockchain of choice for many companies building their financial products. Every day above, more and more businesses or individuals are starting to build more and more DeFi applications...