Thread by @asiahodl

1/ DeFi exploits are slowing but the $ size has been increasing. $ALPHA lost $38m last week - what does that imply ? Does losing -$285 million matter?

We dive into the impact of exploits on Price & TVL 👇🏻👇🏻

2/ We list all the exploits vs TVL and price below.

Since the DeFi summer, protocols’ expected loss to hacks or failures = 0.1%. The Exploit Amount / TVL is much higher = 9%.

However, protocols are punished, losing -40% (average) of TVL in 24 hours.

messari.io/article/how-de…

3/ The most likely attack vector is a combination of an oracle attack with a flash loan. @chainlink has become the de-facto choice for projects looking to outsource oracles.

$LINK has been a beneficiary though also saw a node operator spam attack in Aug-2020

4/ @AaveAave is the go-to for flash loans. Attacks would have been possible anyway without flash loans (though more expensive).

There have been calls to disable flash loans. However, you can’t un-invent or ban a highly-demanded product in decentralized communities.

5/ Morals: a third of attacker have even returns all or a portion of funds. 👍

However, praying for this isn't a good strategy. What is?
1. Bug bounties
2. Governance power for contributors
3. White-hat hackers and 3rd party audits
4. Insurance

6/ Past attacks serve as bounty programs that reduce the risk DeFi will ever get “too big to fail.”

Each attack has been met with an equal reaction to build protocols with security first in mind.

messari.io/article/how-de…