论文标题

用闪光贷款攻击defi生态系统,以获取乐趣和利润

Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit

论文作者

Qin, Kaihua, Zhou, Liyi, Livshits, Benjamin, Gervais, Arthur

论文摘要

信贷允许贷方将盈余资本借给借款人。在传统经济中,信贷承担借款人可能违约债务的风险,因此贷方需要借款人的前期抵押品,再加上利息费。由于区块链交易的原子量,贷方可以提供闪存贷款,即仅在一次交易中有效,必须在该交易结束时偿还。这个概念导致了许多有趣的攻击可能性,其中一些在2020年2月被利用。 本文是第一个探讨事务原子和闪光贷款对新生的分散融资(DEFI)生态系统的影响的内容。我们定量地表明了交易原子能如何增加套利收入。此外,我们以超过50万%的ROI分析了两次现有攻击。我们将发现攻击参数作为优化问题,以对基础以太坊区块链和Defi生态系统的状态进行优化问题。我们展示了恶意对手如何有效地最大程度地提高攻击利润,从而进一步损害了Defi生态系统。具体而言,我们介绍如何“增强”两次先前执行的攻击,以分别获得829.5万美元和110万美元的利润,这是2.37倍和1.73倍的提升。

Credit allows a lender to loan out surplus capital to a borrower. In the traditional economy, credit bears the risk that the borrower may default on its debt, the lender hence requires upfront collateral from the borrower, plus interest fee payments. Due to the atomicity of blockchain transactions, lenders can offer flash loans, i.e., loans that are only valid within one transaction and must be repaid by the end of that transaction. This concept has lead to a number of interesting attack possibilities, some of which were exploited in February 2020. This paper is the first to explore the implication of transaction atomicity and flash loans for the nascent decentralized finance (DeFi) ecosystem. We show quantitatively how transaction atomicity increases the arbitrage revenue. We moreover analyze two existing attacks with ROIs beyond 500k%. We formulate finding the attack parameters as an optimization problem over the state of the underlying Ethereum blockchain and the state of the DeFi ecosystem. We show how malicious adversaries can efficiently maximize an attack profit and hence damage the DeFi ecosystem further. Specifically, we present how two previously executed attacks can be "boosted" to result in a profit of 829.5k USD and 1.1M USD, respectively, which is a boost of 2.37x and 1.73x, respectively.

扫码加入交流群

加入微信交流群

微信交流群二维码

扫码加入学术交流群,获取更多资源