Orbs VP Ran Hammer Says Future of Defi ‘Hinges on Liquidity Aggregation’

April 22, 2024 Bitcoin.com

Balancer blames ‘social engineering attack’ on DNS provider for website hijack

September 21, 2023 Coin Telegraph

attack

Blockchain security firms SlowMist and CertiK also believe the crypto wallet drainer Angel Drainer was involved in the estimated $238,000 exploit.

The team behind Balancer, an Ethereum-based automated market maker, believes a social engineering attack on its DNS service provider was what led to its website’s frontend being compromised on Sept. 19, leading to an estimated $238,000 in crypto stolen.

“After investigation, it is clear that this was a social engineering attack on EuroDNS, the domain registrar used for .fi TLDs,” the firm explained in a Sept. 20 X post.

Approximately 8 hours after the first warning of the attack, Balancer said its decentralized autonomous organization (DAO) was actively addressing the DNS attack and was working to recover the Balancer UI.

At 5:45 pm UTC on Sept. 20, Balancer said it was successful in securing the domain and bringing it back under the control of Balancer DAO. It also confirmed its subdomains “app.balancer.fi” and other “balancer.fi” are safe to use again.

After investigation it is clear that this was a social engineering attack on EuroDNS, the domain registrar used for .fi TLDs.

We are exploring deprecating the .fi TLD in order to move to a more secure registrar and suggest that other projects using the TLD do the same.

[2/2]
— Balancer (@Balancer) September 20, 2023

However, it suggested any other projects using the same top-level domain should consider moving to a more secure registrar.

EuroDNS is a Luxembourg-based domain name registrar and DNS service provider. Cointelegraph has reached out to EuroDNS for comment.

Angel Drainer involved

Blockchain security firms SlowMist and CertiK reported that the attacker employed Angel Drainer phishing contracts.

SlowMist said the exploiters attacked the Balancer’s website via Border Gateway Protocol hijacking — a process where hackers take control of IP addresses by corrupting internet routing tables.

The hackers then induced users to “approve” and transfer funds via the “transferFrom” function to the Balancer exploiter, it explained.

The hacker, whom SlowMist believes may be related to Russia, has already bridged some of the stolen Ether (ETH) to Bitcoin (BTC) addresses via THORChain before eventually being bridging the ETH back to Ethereum, blockchain security firm SlowMist explained on Sept. 20.

SlowMist stated in an earlier post that the hacker transferred about 15 wrapped-Ether (wETH.e) on the Avalanche blockchain.

Balancer Hack Update

So far, we have the following findings about the @Balancer exploiter:

1/ The attacker’s fee came from the phishing group #AngelDrainer. In other words, after the attacker (AngelDrainer) attacked the website via BGP hijacking, then induced users to… https://t.co/5g6P2aPEz8 pic.twitter.com/3PInfe9VC1
— MistTrack️ (@MistTrack_io) September 20, 2023

Meanwhile, despite Balancer confirming its subdomains, balancer.fi to now be safe, visits to the website still shows “Deceptive site ahead” warning when attempting to access the Balancer’s website.

*Balancer’s website as of Sept. 20 at 10:22 pm UTC. Source: Balancer.*

Cointelegraph reached out to Balancer to confirm the amount of funds lost but did not receive an immediate response.

Magazine: $3.4B of Bitcoin in a popcorn tin: The Silk Road hacker’s story

Uniswap releases version 4 code, allowing for new types of liquidity pools

June 13, 2023 Coin Telegraph

Automated Market Maker

The new version features “hooks” that will allow for more customized options, but it will not be implemented until more feedback is obtained from the community.

Uniswap Labs has released a draft of the code for Uniswap V4, according to a June 13 blog post from Uniswap’s Founder, Hayden Adams. The new code features “hooks” or plugins that allow developers to create custom liquidity pools.

Uniswap is the largest decentralized crypto exchange in the world by volume. Its latest version is V3 and was deployed on May 4, 2021.

*Uniswap's official user interface. Source: Uniswap*

According to the post, V4’s “hooks” feature will allow future developers to create on-chain limit orders, automatic deposits to lending protocols, auto-compounded liquidity provider (LP) fees, and many other innovations to the exchange once it is implemented.

Releasing the source code is the first step to launching a new version of Uniswap. The team now plans to converse with members of the Uniswap community and iterate on this base code over time. Once enough consensus has been built around a final version of it, V4 will go into a formal proposal and be placed before Uniswap’s governing body, UniswapDAO.

According to Adams’ post, Uniswap V4’s purpose is to “create a way for pool deployers to introduce code that performs a designated action at key points throughout the pool’s lifecycle – like before or after a swap, or before or after an LP position is changed.”

For example, deployers will be able to create time-weighted average market makers (TWAMMs) that allow users to sell large amounts of crypto in small batches over time. This may help traders to avoid being frontrun by EVM bots or to suffer adverse price movements. On-chain limit orders will also be possible, as pools will be able to incorporate logic that lets them fulfill an order only when a token hits a particular price.

Some other examples of “hooks” include code which can redeposit fees back into an LPs pool or lend out inventory when a particular pool isn’t being used.

In a conversation with Cointelegraph, Uniswap Labs Engineer Sara Reynolds said the new version will allow automated market maker (AMM) exchanges like Uniswap to develop more rapidly than ever before, thanks to the inherent customizability it allows:

“In V4 what we really start to see is sort of this ‘primitive’ for customized logic[…]and that’s really exciting because I think it will really start to evolve AMM innovation quite fast.”

Uniswap Labs Head of Comms Bridget Frey echoed this sentiment, stating “Right now, other people have to build new AMMs to do a lot of this work. Now, what you’ll be able to do is to build your project with a hook contract on top of Uniswap’s security and liquidity in ways that hopefully make the innovation faster and easier to do for all sorts of projects.”

Decentralized exchanges have seen an influx of new users recently. The top three DEXs experienced a 444% surge in volume after the United States Securities and Exchange sued their centralized competitors, Binance and Coinbase, for allegedly violating securities regulations. This surge occurred even though the SEC has also tried to change the definition of “exchange” to include decentralized ones. Crypto venture capital firm Paradigm has argued that decentralized exchanges do not fit the definition of an “exchange” found in securities laws.

Symbiosis integrates zkSync: ‘Natural evolution’ of scaling solutions

April 10, 2023 Coin Telegraph

Automated Market Maker

Cross-chain DeFi platform Symbiosis has integrated zkSync to improve transaction speed and reduce fees on its automated market-making protocol.

Cross-chain automated marker maker Symbiosis has onboarded layer-2 scaling protocol zkSync to improve speed and reduce fees of token swaps on its platform.

The decentralized exchange (DEX) was launched in March 2022. It provides single-sided stablecoin pools that deliver zero impermanent loss to liquid providers. It also facilitates ‘any-to-any’ native asset swaps on its platform across Ethereum Virtual Machine (EVM) and non-EVM networks.

Nick Avramov, co-founder of Symbiosis, told Cointelegraph that the integration of zkSync will provide one-click swaps from Ethereum, Polygon, Avalanche, BNB, Telos and other blockchains into zkSync and back.

The additional functionality also removes the need for users to switch between different wallets and interfaces. Avramov also confirmed that the integration improves the variety of token swaps through its DEX, supporting any-to-any native swaps to and from zkSync.

The integration of zkSync is also aimed at making liquidity transition to and from zkSync ‘secure, fast and cheap,’ while Avramov also highlighted the importance of layer-2 scaling protocols to various DeFi platforms and services.

“Scaling layers like Optimistic and ZK rollups are extremely important for the next big wave in Web3, mostly because they're lowering entry barriers both in terms of the price per swap and user experience of value-added services built on top.”

The Symbiosis co-founder also highlighted his personal view that ZK rollups could outcompete optimistic rollup solutions like Arbitrum and Optimism. Avramov also believes it is crucial for cross-chain players and interoperability layers to support ZK solutions as soon as possible.

"ZK represents an inevitable and natural evolution among scaling solutions.”

Symbiosis has processed over $100 million in total transaction volume in stablecoins, serves over 12,000 unique wallet addresses and an average of 3,000 daily transactions.

Ethereum-scaling ZK rollups continue to grab headlines in 2023. As previously reported by Cointelegraph, Ethereum layer-2 scaling platform Polygon released its zkEVM to mainnet beta, allowing developers to deploy smart contracts with increased finality and lower costs.

The scaling technology is not only limited to Ethereum or other smart contract blockchains. Swiss-based nonprofit ZeroSync Association is currently developing zero-knowledge proof tools that will allow Bitcoin (BTC) users to expedite the process of verifying individual blocks and, eventually, the entire blockchain.

Magazine: Crypto audits and bug bounties are broken: Here’s how to fix them

‘Over-Collateralization Can Help Mitigate the Risk of Stablecoin Depegging’ — Pendulum CTO

April 5, 2023 Bitcoin.com

PancakeSwap changes its recipe with the launch of Version 3

April 3, 2023 Coin Telegraph

Automated Market Maker

PancakeSwap has released version 3 of its BNB Chain, Aptos and Ethereum-based DeFi platform, touting improved performance and lower fees.

Decentralized finance (DeFi) protocol PancakeSwap has launched version 3 of its automated market maker platform on BNB Chain and Ethereum, with the upgrade encompassing performance improvements and lower fees.

Enhanced capital efficiency is cited as a key aspect of the upgrade, with a change in how liquidity providers can allocate capital on specific price intervals. In the previous version of PancakeSwap, liquidity from providers (LPs) was distributed uniformly along the price curve of trading pairs, which the platform notes was inefficient given that assets typically trade within certain ranges.

V3 allows liquidity providers to select a custom price range to provide liquidity, allowing specific control over capital investments to higher volume trading ranges. The release also touts the provision of four new trading fee tiers from 0.01%, 0.05%, 0.25%, and 1%, which is a change from V2’s standard 0.25%.

Every token pair can have liquidity pools for each tier. PancakeSwap expects asset pairs to be drawn to tiers where incentives for LPs and traders align, with the approach an effort to balance between traders targeting the lowest fees while still incentivizing LPs.

The PancakeSwap team unpacked the different trading fee tiers in correspondence with Cointelegraph. Assets such as stable pairs where impermanent loss is low (price changes after depositing to a liquidity pool) and prices typically match fall into the 0.01% tier.

The higher percentage trading fee tiers cater to assets that have higher impermanent loss or lower liquidity. This mechanism intends to provide more fee revenue and incentive for LPs.

PancakeSwap caters to a broad DeFi user base, accounting for over $2.5 billion of total value locked and serving over 1.5 million unique users.

The platform also revealed upcoming features that are still in development, including a trading rewards program incentivizing traders with exclusive benefits, while a position manager feature aims to improve user experience when depositing tokens as liquidity.

Arbitrum (ARB) has been front and center in DeFi-related news in March, with its highly-anticipated airdrop seeing around $3.3 million consolidated from over 1,400 addresses into two controlling wallets.

Magazine: 4 out of 10 NFT sales are fake: Learn to spot the signs of wash trading

FTX and Alameda Research Collapse Sad Event but ‘Good for the Long Run’ Says DWF Labs Managing Partner

January 27, 2023 Bitcoin.com

DeFi auditor nets $40,000 for identifying Uniswap vulnerability

January 4, 2023 Coin Telegraph

DeFi auditor nets ,000 for identifying Uniswap vulnerability

Automated Market Maker

A security firm flagged a now-fixed vulnerability to Uniswap, highlighting the potential for reentrancy attacks on the protocol’s Universal Router smart contract.

Uniswap’s recently launched bug bounty program has led to the discovery of a now-fixed vulnerability of the protocol’s Universal Router smart contract.

The automated market maker released two new smart contracts to its platform in November 2022. Permit2 allows token approvals to be shared and managed across different applications, while Universal Router unifies ERC-20 and nonfungible tokens (NFTs) swapping into a single swap router.

Uniswap also advertised a lucrative bug bounty program to identify potential vulnerabilities in its smart contracts towards the end of 2022 as it looked to assure the safety and efficacy of its protocol.

Smart contract security and auditing firm Dedaub announced that it had received a bug bounty after flagging a vulnerability in the Universal Router smart contract that would have allowed reentrancy to drain user funds mid-transaction.

The Dedaub team has disclosed a Critical vulnerability to the Uniswap team!

Funds are safe - Uniswap addressed the issue and redeployed the Universal Router smart contracts on all its chains

The vulnerability allows re-entertrancy to drain the user's funds, mid-tx.

pic.twitter.com/wFSFsohPvy
— Dedaub (@dedaub) January 2, 2023

According to Dedaub’s breakdown, the Universal Router allows users to perform diverse actions including swapping multiple tokens and NFTs in one transaction.

The router embeds a scripting language for a wide variety of token actions, which could include transfers to third party recipients. If correctly implemented, transfers would go to the recipient within specified parameters.

However, Dedaub identified a vulnerability in which a third-party code was invoked during the transfer, allowing the code to re-enter the Universal Router and claim any tokens that were temporarily in the contract.

Dedaub then suggested a straight-forward remedy, advising the Uniswap team to add a reentrancy lock to the core execution of the new router. Uniswap awarded the auditing firm a total of $40,000 for flagging the vulnerability. The amount included a 33% bonus for reporting the issue during Uniswap’s bonus period in November 2022.

Uniswap classified the issue as medium severity, while further assessment deemed the vulnerability to have high impact and low likelihood. According to Dedaub, the possibility of a user sending NFTs to an untrusted recipient directly was considered user error.

More complex and less likely scenarios were considered valid for reentrancy, which resulted in Uniswap deeming the vector to have a low likelihood. Cointelegraph has reached out to Uniswap to ascertain further details of its ongoing bounty program, amounts paid out and the number of bugs identified to date.

Bug bounties have become commonplace in the cryptocurrency and blockchain space as platforms and companies look to ensure the security of their software, systems and infrastructure.

Cryptocurrency exchange Coinbase recently clarified the terms of its bug bounty, while blockchain security firm Immunefi has facilitated over $65 million worth of bug bounties between ethical hackers and Web3 firms in 2022.

Trader Joe takes its first step into the Ethereum ecosystem

December 2, 2022 Coin Telegraph

Automated Market Maker

Despite the new multi-chain vision, the Trader Joe team confirmed that its “true home” and “top priority for all growth efforts” will continue to be on Avalanche.

Decentralized finance (DeFi) protocol Trader Joe has announced its very first expansion from Avalanche and onto the Ethereum ecosystem, as part of its plans to access new markets and drive up user activity.

The decentralized trading platform announced its “multi-chain” expansion into Ethereum layer-2 scaling solution Arbitrum One on Dec. 1 and follows around a month after it stated its intention to expand to additional markets and ink new partnerships amid falling TVL and user activity in the third quarter.

We're extremely excited to announce that @traderjoe_xyz has expanded into the Ethereum ecosystem with Arbitrum One as its destination! ‍ https://t.co/pjnoirxkVi
— Arbitrum (,) (@arbitrum) December 1, 2022

The team stated that they’re working closely with Offchain Labs — the team behind Arbitrum One — to launch a testnet “within the coming days,” before officially deploying it onto the Arbitrum One mainnet in January 2023:

“Deployment to Arbitrum One is the next step in this global expansion effort and we look forward to introducing the innovative AMM built on Avalanche, and also working with new partners to benefit the collective DeFi ecosystems of Arbitrum and Avalanche.”

The deployment comes as Trader Joe has also expanded its ecosystem through partnerships and integrations with wallets, data clients and other vectors” since the second quarter as a means to spread the exposure of Avalanche and the Trader Joe itself.

Among the most notable recent partnerships include that of Trust Wallet and Crypto.com.

Trader Joe added that the protocol’s original AMM — Joe V1 AMM — would also move onto Arbitrum One in addition to the Liquidity Book AMM, which will bring “zero slippage trades and discretized liquidity provisioning to all Arbinauts.”

As for why Trader Joe chose to deploy its AMMs on Arbitrum One, the team said they were impressed by Offchain Labs’ efforts in building an ecosystem of DeFi protocols on the network, which is indicative of its 53.4% market share in total value locked (TVL) across all Ethereum layer-2 scaling solutions.

“Deploying (the) Liquidity Book will be a great addition to the vibrant ecosystem,” the team added.

Image shared by Trader Joe regarding its recent Arbitrum expansion. Source: Joe Content.

Despite announcing that it was “time to go global” on Crypto Twitter, the Trader Joe team confirmed that its “true home” and “top priority for all growth efforts” will continue to be on Avalanche.

Trader Joe also also clarified that its token, JOE, in addition to lending platform Banker Joe, nonfungible token (NFT) marketplace JoePegs and its staking platform would not join Liquidity Book AMM and Joe V1 AMM on Arbitrum “in this initial phase.”

The announcement appears to have a positive impact on the price of JOE, which increased 13.35% from $0.163 to $0.185 over an eight hour period before cooling off to $0.179, according to data from CoinGecko.

Trader Joe is currently the top-ranked decentralized exchange (DEX) and third-ranked DeFi protocol on Avalanche with $94.13 million in TVL, trailing only Ethereum-native lending platform AAVE and Avalanche-based liquid staking provider Benqi, according to data from DeFi aggregator DefiLlama.

New fix for curse of impermanent loss proposed on Avalanche

August 24, 2022 Coin Telegraph

Automated Market Maker

Trader Joe says its Liquidity Book will mitigate the impermanent loss “suffered by so many liquidity providers on other DEXs” during times of market turbulence.

Avalanche-based decentralized finance (DeFi) protocol Trader Joe claims it may have found a way to mitigate one of DeFi’s biggest weaknesses — impermanent loss.

In a newly released white paper on Tuesday called the JOE v2 Liquidity Book, authored by Quant developers and researchers Adam Sturges, TraderWaWa, Hanzo and software engineer Louis MeMyself, the developers outlined the use of Liquidity Book (LB) with an additional variable fee swap feature to “provide traders with zero or low slippage trades.”

/4 Impermanent Loss

One of the most critical issues of Uniswap V3 is that impermanent loss often exceeds swap fees.

A study effectuated by the @Bancor team showed that 50% of Uniswap V3 LPs lose money.

Liquidity Book solves this problem by introducing variable swap fees.
— The DeFi Investor (@TheDeFinvestor) August 23, 2022

Trader Joe said the new strategy will mitigate impermanent loss “suffered by so many liquidity providers (LPs) on other DEXs during market turbulence.”

Impermanent loss, which has been seen as one of DeFi’s greatest weaknesses, happens when the price of token changes after one deposits it in a liquidity pool-based automated market maker as part of yield farming — a type of investment in which one lends tokens to earn rewards (not the same as staking).

It’s also one of the reasons that institutional investors have been treading with caution in the DeFi space, according to digital-asset management firm IDEG’s chief investment officer Markus Thielen.

Speaking to Cointelegraph, Thielen said that his firm and other institutional investors “have been less engaged with automated market makers (AMMs) as the risk of impermanent loss is too high,” adding:

“I must admit that Trader Joe’s v2 whitepaper offers a novel idea and liquidity providers have generated 30bps for facilitating trades, which is an attractive return when future growth is uncertain for the industry. We want to see how much liquidity v2 is now attracting and how Trader Joe's TVL will improve.”

Thielen added that in order to get a competitive edge in the digital asset sector, investors need to look for alternative investments with good fundamentals, rather than just relying on blue-chip assets:

“As a crypto fund, we can’t just rely on ETH and BTC, we want other layer ones and alt coins to thrive, so we applaud the Trader Joe team for keeping developing and other AMM on their toes.”

According to the paper, Trader Joe’s Liquidity Book (LB) is a type of liquidity pool (LP) that arranges the liquidity of an asset pair into price bins, which are exchanged at a constant price.

The LB introduces a new variable swap fee, which is designed to protect traders from impermanent loss by compensating LPs in the event of extreme market volatility so that the liquidity can be more efficiently managed in response to sudden price movements.

Trader Joe’s LB will also offer zero to low slippage trades, which will serve to offer traders better buying rates.

If properly executed, this may represent a significant breakthrough in DeFi. A recent study showed that over 50% of Uniswap v3 LPs lose money in times of market turbulence because impermanent loss exceeded the swap fees.

The wait is finally over….

Introducing: Liquidity Book

A next gen AMM protocol that is highly efficient, flexible and built for #DeFi https://t.co/6l2FoaJ0xo
— Trader Joe | New AMM Soon (@traderjoe_xyz) August 22, 2022

Thorchain is another DeFi protocol providing impermanent loss protection for LP deposits after the first 100 days (with partial protection before that point).

The Trader Joe protocol dubs itself as a “one-stop decentralized trading platform” that is built on smart contract platform Avalanche.

The protocol is currently the largest decentralized exchange (DEX) on Avalanche, with $191 million in total value locked (TVL) on the protocol.

The DeFi protocol allows users to trade, farm, lend and stake among other things.

Trader Joe’s token, JOE, saw its price briefly spike following the white paper release and is trading at $0.28 at the time of writing, though it’s still down 94.5% from its all-time-high, according to CoinMarketCap.

Automated Market Maker

Angel Drainer involved

Share this video