This document provides an overview of risks in decentralized finance (DeFi) based on recent hacks and exploits. It discusses the growth of DeFi and common attack vectors like exploits, hacks, and rug pulls. At the protocol level, it identifies technical risks from smart contracts and key management, as well as economic risks around liquidity, concentration, stability, and asset quality. At the individual level, it recommends steps like using hardware wallets instead of hot wallets, verifying links, and avoiding phishing scams. In conclusion, it states that 68% of protocol attacks are technical in nature and that economic risks can be monitored, while managing individual security is also important for mitigating risks in DeFi.

1. Uncovering DeFi Largest Hacks - Key
Factors to Consider & How to Mitigate Risks
March 2022

2. Agenda
● Overview of DeFi & Its Exploits
● Protocol risks
● Risk at the individual level

3. A quick update about ITB

4. Partnerships
● CryptoExplorer, FoxBit… upcoming release

5. Overview of DeFi & Its Exploits

6. DeFi Growth
● 14x growth in deposits in 2021
● 320x since January 2020
● 30 million MAUs in MetaMask (50x)

7. DeFi Growth
Source: DeFi Llama

8. DeFi Incidents
Sources: NBC, The Street, Fortune, Newsweeek

9. Exploits/Attacks, Hacks, Rug Pulls…
● Exploit/attack: using crypto protocols in unintended
ways for the attackers’ gain (economic + technical)
● Hacks: accessing private keys or deploying functions in
an adversarial manner to withdraw funds (technical)
● Rug pulls: developers deliberately taking out user
funds through a “backdoor” (technical)

10. Exploits/Attacks, Hacks, Rug Pulls…
Source: Know Your Meme

11. Protocol Risks

12. Risk Types
● Technical risks
○ Smart contracts
○ Key management
● Economic risks
○ Supply-side
○ Demand-side
○ Stability
○ Assets

13. DeFi Attacks by Risk Vector
N = 50

14. Technical Risks

15. What can you do about technical risks?
● Check if project is audited
● Auditor track record
● Is it a fork?
● Founders public or anon?
● Bug bounties
● Multi-sig set up
● TVL and test of time
Source: CoinDesk

16. Audited vs Unaudited

17. Auditor Performance

18. Not All Audits Are The Same
● Protocol smart contracts
● Governance/token contracts
● Economic risk reviews
● Upgradeability risks
● Risks of inaction
Sources: Compound, Gauntlet

19. Economic Risks
● Supply-side
○ Liquidity
○ Concentration
○ Exit fee
● Demand-side
○ Collateral ratio
● Stability
○ Oracles
● Assets
○ Lowest MC, asset liquidity

20. Supply-Side
Source: IntoTheBlock Curve Insights

21. Supply-Side
Source: IntoTheBlock Curve Insights

22. Whale Concentration
Source: IntoTheBlock

23. Demand-Side
● Liquidations leading to “bad debt”
● Collateral ratio distribution
● Less pervasive
Sources: The Block, MakerDAO Risk Dashboard

24. Stability
● Actors and services preventing imbalances
● E.g. liquidators, arbitrageurs and oracles
● Off-chain data and “flash loan resistance”
● Assuring systems work as intended
Source: Gemini

25. Stability
● Lack of liquidators
● Liquidator resiliency
Source: Twitter

26. Assets
● Quality of assets supported and
their interconnectedness
● Isolated vs shared liquidity
● Ability to mint supply in time
● Nuanced asset specifications
Source: 1kx

27. Individual Risks

28. Individual Risks
● Hot wallets vs cold wallets
● Storing your private keys
● Convenience ←> Security
● 2FA, 3FA
● Buy only from official sites

29. Individual Risks
● Phishing scams
● Corrupted documents
● “Support accounts”
● Double check links
● Downside to transparency
Sources: CoinDesk, PrestigeOnline

30. Conclusions
● DeFi has substantial amounts of risks
● 68% of protocol attacks are technical
○ Audits, TVL, multi-sig set up
● Economic risks can be monitored
○ Supply, demand, stability and assets
● Managing individual risks is key

32. Thank You! Questions?
Lucas Outumuro
Head of Research at IntoTheBlock
Email: loutumuro@intotheblock.io
Twitter: @LucasOutumuro