Source-linked AI summary
SoK: Decentralized Finance (DeFi)
Sam M. Werner, Daniel Perez, Lewis Gudgeon, Ariah Klages-Mundt, Dominik Harz, William J. Knottenbelt
TL;DR
DeFi’s rapid expansion has made its principles and security risks difficult to understand, particularly because economic security remains largely unexplored. This SoK systematizes DeFi primitives, protocol types, exploits, and security risks, distinguishing technical from economic security and identifying open challenges. It illustrates the practical stakes through documented governance, oracle, deleveraging, and composability risks, while highlighting unresolved challenges in modeling integrated systems.
Problem
DeFi’s rapidly evolving ecosystem creates challenges in understanding its principles and security risks, while economic security remains largely unexplored.
Method
The SoK systematizes DeFi primitives and protocol types, defines exploits, and categorizes technical and economic security risks using atomicity.
Results
The paper establishes economic security alongside technical security, defines risk categories, connects them to suitable models, and identifies open research challenges requiring holistic analysis.
Takeaways & Limitations
Understanding DeFi security requires analyzing both technical and economic risks across integrated protocols.
Takeaways & Limitations
Deleveraging feedback can make stablecoins illiquid and increase their price, forcing leveraged agents to pay premium prices to deleverage.
Abstract
from arXiv · showhide
Decentralized Finance (DeFi), a blockchain powered peer-to-peer financial system, is mushrooming. Two years ago the total value locked in DeFi systems was approximately 700m USD, now, as of April 2022, it stands at around 150bn USD. The frenetic evolution of the ecosystem has created challenges in understanding the basic principles of these systems and their security risks. In this Systematization of Knowledge (SoK) we delineate the DeFi ecosystem along the following axes: its primitives, its operational protocol types and its security. We provide a distinction between technical security, which has a healthy literature, and economic security, which is largely unexplored, connecting the latter with new models and thereby synthesizing insights from computer science, economics and finance. Finally, we outline the open research challenges in the ecosystem across these security types.
1 DEFI: FINANCE 2.0?
DeFi combines an expansive promise of non-custodial, permissionless, auditable, and composable finance with serious security concerns. This SoK systematizes the ecosystem and distinguishes technical from largely unexplored economic security through atomicity.
- DeFi’s promise: DeFi aims to provide non-custodial, permissionless, openly auditable, and composable financial services.Its composability allows financial services to be combined into new products and services.
- DeFi’s growth: Over 150bn USD in total value locked by April 2022 marked rapid growth from around 700m USD at the start of 2020.Ethereum accounted for 75bn USD, while collateralized lending and DEXs represented approximately 54% and 31% of TVL, respectively.
- Security concerns: DeFi’s openness permits unaudited or malicious smart contracts, while audited protocols have also suffered serious exploits.The paper presents these risks alongside concerns that the ecosystem can facilitate novel forms of financial crime.
- Paper contribution: The SoK separates technical security from economic security using atomicity: whether attacks can fail nearly instantaneously and costlessly or instead involve duration and costly failure.This distinction maps different security types to different models and clarifies the use of economic-risk terminology.
- Paper contribution: The paper surveys DeFi primitives and protocol operations, defines exploits, classifies technical and economic risks, and identifies six open research challenges.Its related-work discussion states that existing surveys do not delineate these new security challenges across DeFi.
2 DEFI PRIMITIVES
DeFi rests on secure ledgers, programmable smart contracts, transaction execution, externally triggered updates, oracles, and governance. These primitives enable composability but also create substantial challenges in understanding interactions and emergent security properties.
- Blockchain layer: DeFi assumes an underlying ledger with consistency, integrity, and availability; without them, protocols built on it are inherently insecure.The ledger is treated as an input rather than analyzed as part of the DeFi protocol itself.
- Smart contracts: Smart contracts encode protocol rules, communicate through message calls, support conditional execution and bounded iteration, and execute atomically.Atomicity means a transaction either fully updates state or fails without altering it.
- Composability: Composability enables complex financial architectures but creates a vast interaction space whose emergent security properties are difficult to understand.The paper identifies this complexity as a major burden for analyzing composed smart contracts.
- Transaction execution: Miners choose transaction inclusion and ordering, enabling revenue extraction through reordering, inserted transactions, or bribery; this value is called Miner Extractable Value.Transactions in each block execute sequentially in the miner-selected order.
- Transaction execution: Smart-contract state updates require externally triggered transactions, so protocols use financially incentivized keepers for tasks such as automatic liquidation.Smart contracts cannot create transactions programmatically.
- Oracles: Oracles import off-chain data into the blockchain for smart contracts, but centralized and decentralized designs carry distinct manipulation and incentive risks.Decentralized oracles rely on incentives because off-chain data correctness cannot be verified on-chain.
- Governance: Governance changes the parameters governing participant interactions, either algorithmically or through agents such as councils or governance-token holders.Protocol upgrades commonly require proposals, token thresholds, and a quorum.
3 DEFI PROTOCOLS
DeFi protocols provide distinct financial operations, including asset exchange, lending, stablecoins, investment strategies, and derivatives. Their mechanisms rely on on-chain liquidity, collateral, economic incentives, and composability, each introducing associated design challenges.
- Protocol taxonomy: DeFi protocols are categorized by the type of operation they provide.The paper uses this operational categorization to organize the ecosystem’s protocol types.
- On-chain asset exchange: DEXs enable non-custodial digital-asset exchange with trades settled on-chain and publicly verifiable.Wrapped tokens and cross-chain solutions extend the assets that DEXs can support.
- On-chain asset exchange: AMMs replace order books with on-chain liquidity pools and algorithmic pricing rules, allowing anyone to provide liquidity.Thin liquidity can let a single trade significantly move prices relative to the broader market.
- Lending and borrowing: Loanable-funds protocols pool deposited cryptoassets in smart contracts to create distributed markets for borrowing and lending.Over-collateralized loans require collateral exceeding the debt value, while flash loans must be repaid with interest within one transaction.
- Stablecoins: Non-custodial stablecoins seek price stability through economic mechanisms and on-chain collateral rather than trusted custodians.Designs include collateral, agents, governance, and issuance mechanisms, while stability requires economically secure participation.
- Investment strategies: DeFi investment funds automate liquidity allocation by encoding investment strategies in smart contracts that transact with other protocols.They are designed for liquidity providers facing a complex space of yield-generating options.
- Derivatives: DeFi derivatives include synthetic assets, futures, perpetual swaps, and options, but centralized exchanges still account for about 99% of derivative trading volume.The derivatives market represented about 62% of the cryptoassets trading market as of March 2022.
4 WHAT IS A DEFI EXPLOIT?
The paper defines DeFi exploits by comparing smart-contract behavior with intended properties across on-chain and off-chain information. It then distinguishes exploit categories using whether attacks are atomic and risk-free or non-atomic and costly, while noting that some economic failures are not security exploits.
- Exploit Definition: DeFi exploit analysis begins by classifying relevant information as off-chain ground truth, on-chain ground truth, or on-chain estimates of off-chain ground truth.Oracle-reported prices are examples of on-chain estimates of off-chain ground truth.
- Exploit Definition: A protocol consists of smart contracts with intended properties that depend on information available up to the current state.These properties can include AMM invariants or over-collateralization requirements for loan positions.
- Exploit Definition: An exploit can arise from implementation differences, incidental discrepancies in external information, or deviations from intended protocol properties.The paper uses this framework to connect exploit types with the information and behavior on which protocols rely.
- Exploit Definition: The distinction between technical and economic exploits depends on atomicity: technical attacks are near-instantaneous and can fail without meaningful cost, whereas economic attacks take time and expose attackers to costs and failure risk.Non-atomic attacks leave room for markets or other agents to react, unlike atomic attacks.
- Exploit Definition: Some events, including stablecoin collapses caused by breaching a mechanism’s economic limits, may be currency runs or attacks rather than security exploits.The classification depends on whether formal smart-contract properties were exploited.
5 TECHNICAL SECURITY
Technical security concerns atomic DeFi exploits that violate intended protocol properties and produce risk-free attacker profit. The section covers smart-contract vulnerabilities, transaction-ordering attacks, and single-transaction attacks, while noting that common mitigations may not resolve underlying economic incentives.
- Technical Security: Technical security means that an attacker cannot atomically exploit a protocol at the expense of value held by the protocol or its users.Atomic execution makes outcomes effectively binary: success yields profit, while failure generally costs only gas fees.
- Technical Security: Current blockchains enable risk-free technical manipulation within one transaction or within an ordered bundle of transactions in the same block.These attacks leave no opportunity for markets or other agents to react during execution.
- Technical Security: The technical-security categories are smart-contract vulnerabilities, transaction-ordering attacks, and attacks executed within a single transaction.The paper positions these categories as consequences of atomicity, transaction ordering, and contract composability.
- Smart Contract Vulnerabilities: Reentrancy lets an untrusted contract repeatedly re-enter a partially updated victim contract, potentially draining funds.Static analysis, reentrancy guards, and completing state updates before external calls are described as defenses.
- Smart Contract Vulnerabilities: Logical bugs can cause unrecoverable financial losses because smart-contract immutability makes their consequences more severe than in many other software systems.The paper notes that many simple mistakes have escaped both development processes and professional audits.
- Single Transaction Attacks: Timelocks prevent governance updates from occurring instantaneously, but they may resolve only the technical issue rather than the protocol’s incentive problems.The delay gives other participants an opportunity to react.
- Transaction Ordering Attacks: Transaction-ordering attacks use front-running or back-running within a block, and miners can execute them risk-free.Displacement attacks front-run target transactions without depending on whether those transactions execute afterward.
6 ECONOMIC SECURITY
The paper defines economic security around strictly non-atomic, potentially unprofitable exploits whose success depends on actions unfolding over time. It distinguishes these risks from technical security and argues that economic design, models, and incentive structures are required to analyze and mitigate them.
- Definition: Economic security concerns strictly non-atomic exploits that let attackers profit at the expense of protocol or user value.Such exploits involve multiple actions over time, so the attacker faces failure probability, upfront costs, and risk.
- Technical versus economic security: Technical exploits can execute atomically and risk-free, whereas economic exploits depend on market or incentive manipulation over time.An instantaneous AMM price oracle enables an atomic sandwich attack; a time-weighted average price can instead require non-atomic manipulation.
- Security analysis: Economic risks cannot be solved by technical means alone because they require models of market equilibria and better protocol incentive structures.The paper notes that defensive measures for economic security remain less established than those for technical security.
- Assumptions: Economic rationality assumes agents avoid strictly dominated strategies, while economic security also considers attackers with objectives beyond profit maximization.For example, an attacker seeking to shut down a system may attack when the cost remains moderate.
- Risk categories: Economic security includes risks from endogenous asset prices, governance extractable value, market manipulation, and oracle manipulation.Examples include deleveraging feedback in Dai, governance takeovers, price manipulation before borrowing, and oracle dependence on thin or manipulable markets.
7 OPEN RESEARCH CHALLENGES
The SoK identifies open DeFi research challenges across composability, governance, oracles, MEV, program analysis, and privacy, emphasizing interactions between technical and economic security.
- 7.1 Composability Risks: Composability risks remain largely unquantified because interconnected protocols can fail through both technical and economic mechanisms.Open questions include governance-token accumulation, stablecoin incentive failures, and insolvency in lending systems.
- 7.2 Governance: Governance research should model incentive compatibility, equilibria, stewardship rewards, minority protection, and the security implications of borrowed governance tokens.The paper specifically identifies flash-loan and lending-based governance-token borrowing as complicating both technical and economic security.
- 7.3 Oracles: Oracle research must address incentive-compatible price reporting and formally evaluate strengthening methods such as medianizers, reputation systems, and on-chain metrics.Governance is often directly connected because governors may choose the oracles used by protocols.
- 7.4 Miner Extractable Value: MEV research lacks methods to quantify negative externalities and the full opportunity set, while protective mechanisms remain needed against consensus instability and time-bandit attacks.The paper conjectures that optimizing block-level MEV is NP-hard and hard to approximate, and notes trade-offs in proposed protections.
- 7.5 Program Analysis: Program-analysis tools remain limited by difficult setup, isolated-contract reasoning, weak compositional analysis, and insufficient attention to semantic properties.Fully automatic tools are easier to use but generally analyze contracts in isolation; semi-automated tools can verify business logic but require substantial expertise.
- 7.6 Anonymity and Privacy: DeFi privacy remains significantly understudied, while zero-knowledge proofs and multiparty computation face high computational costs that limit adoption.Pseudoanonymous on-chain activity can become observable when an address is linked to a real-world identity.
8 CONCLUSION
The SoK systematically organizes DeFi primitives, protocol operations, exploits, and security risks, elevating economic security alongside technical security. It concludes that unresolved challenges require holistic analysis of both risk types despite DeFi’s promise.
- The SoK lays out DeFi primitives and categorizes protocols by the operations they provide.
- It defines exploits, establishes economic security alongside technical security, and introduces functional risk categories with corresponding modeling insights.
- The paper highlights open research challenges requiring a holistic understanding of technical and economic risks.
- DeFi’s permissionless and non-custodial potential remains accompanied by substantial unresolved technical and economic security challenges.The conclusion presents this tension between promise and challenge as central to the field’s research agenda.
A DEFI PROTOCOLS
Table 2 presents a selection of prominent DeFi protocols classified according to the paper’s proposed protocol types.
- Table 2 classifies selected prominent DeFi protocols according to the proposed protocol types.
B EMPIRICAL EXPLOITS
The empirical examples show that DeFi applications have experienced diverse exploits, including reentrancy, integer-manipulation, logic, and market-structure failures.
- DeFi applications have experienced a range of exploits and vulnerabilities documented from Sections 5 and 6.The appendix explicitly presents a non-exhaustive selection rather than a complete catalogue.
- Reentrancy Exploits: A reentrancy exploit drained around 25 million USD from dForce in April 2020 through an ERC-777 token callback mechanism.
- Integer Manipulation Exploits: An arithmetic-related bug in YAM prevented governance from reaching quorum and locked over 750 000 USD in treasury tokens indefinitely.
- A trivial logic error caused bZx to lose over 8 million USD despite two independent audits.
- A manipulated thinly traded XVS market led Venus to incur 100m USD of bad debt after the attacker borrowed BTC against inflated collateral prices.
C BATCH SETTLEMENT SYSTEMS
Gnosis exchange settles trades in periodic batches through decentralized keepers that compete to submit algorithmic matching solutions. The protocol executes the best submitted solution, but fairness depends on keeper-market competitiveness and resistance to gaming.
- Gnosis exchange matches trades algorithmically in periodic batches maintained by decentralized keepers.
- Keepers compete to solve a complicated matching problem and submit their solutions on-chain for protocol selection.
- If the keeper market is competitive, trades should settle at fair prices, but noncompetitive markets or gamed solution selection can create issues.