Thread by @patio11

Checking in on how code-is-the-only-law, be-your-own-bank, lets-be-ungovernable world of DeFi is doing.

Oh, Compound had a $70 million bug this week? I suppose we'll go down the crypto governance flowchart to:

https://twitter.com/rleshner/status/1443730726751506432

Reporting on the bug: cointelegraph.com/news/compound-…

"What would the grown-up financial economy do if it lost $70 million?"

It is difficult to answer this question because it should be nearly impossible to lose it to anonymous counterparties. Everybody you're connected to has a name, an address, a phone number, etc.

But supposing you did end up wiring amount variable numbers of single digit millions to various counterparties, your ops team calls their ops team and asks for it back. They most likely send you a standardized "hold harmless" letter and then send back the money.

Grown up financial institutions don't charge a 10% surcharge for mistakes. "We are a society.", everyone knows that they have reputations which span decades/centuries and that burning them over a trifling amount of money is silly, etc.

Exceptions are very exceptional.

There was, for example, the Revlon bond unintended repayment by Citibank which distressed bond funds decided to just keep, on a fairly well-supported legal theory which nonetheless was the exact opposite of how industry practice suggested everyone behave. Contracts updated after.

"Would they threaten doxing users to the IRS?"

I mean if you work in the grown-up world you assume all your contras are very well known to the IRS because you don't do business with criminals. But "give me money or I will make trouble for you" generally considered uncouth.

"Who ultimately takes the loss if you can't recover $X0 million?"

I mean, that's why you have equity, right.

Operational loss. If it's much higher than you budgeted for for the quarter you'll have to write a bit about it in e.g. your quarterly report. That's pretty infrequent.

"Is tens of millions of ops losses exceptional?"

Less exceptional than you'd think. The entire economy runs through the financial system. Errors happen. Again, you have equity for a reason.

“Hold harmless” (a term of art) are one of those fascinating industry details. Here’s NACHA’s public version if you (a financial institution) need to reverse an ACH payment. Similar things exist for e.g. wires.

nacha.org/system/files/2…

The intent of this is “Bank A either through its own error or that of a customer has sent money to Bank B’s customer and wants it back ASAP. Bank B wants to be a good citizen but doesn’t want to get sued over this, so asks Bank A to take all liability if e.g. story complicated.”

And the letter is standardized specifically because you expect someone from Ops to sign it while they’re on the phone with a counterpart from the other Ops team.

A: “Hey looks like we sent you $8 million.”
B: “Hah Mondays am I right. OK, sent you a hold harmless.”
A: “Thanks. Executed.”
B: “Cool, sending back. Call back if you don’t get it by 2 PM.”
A: “Thanks.”
B: “No worries.”

It is almost literally that quick.

"So if people are so cool about this sort of thing how does any ops loss happen?"

I mean ops losses have causes and symptoms approximately as diverse as engineering bugs (and not infrequently spring from engineering bugs).

Suppose an audit discovers that you've undercharged 15,000 consumers at 500 financial institutions an average of $80 each because of a poorly written if statement... 6 months after it introduced to prod.

You'll have a meeting, sigh, and say "Charge it to ops losses."

"How'd nobody notice?"

I mean there is the auditor, noticing.

It could also easily have been discovered when at attentive customer called you after receiving their statement and said "My invoice said $113.21 but Chase says it was only $46.78 so I'm calling because I'm honest."

Obligatory disclaimer: this is an entirely hypothetical example. I have never been professionally involved in an incident which exactly resembled this in any particular.

Apologies for schadenfreude but I’m still chuckling over “Better give me my money back or I’m gonna pop a 1099-DIV in your %]*}*].”

Understand how it’s meant to be a threat but “Watch out or I will comply with the law we’ve both been ignoring happily!” just hilarious to me.

(The nature of the loss here is that they sent an unintended amount of rewards to users of the protocol, above the intended level of rewards. Reasonable compliance departments could differ on whether that’s 1099-INT or 1099-DIV or something else. Ofc it’s income; water is wet.)

How do they think that’s going to play out? “Thanks for your first 1099-INT in an 8 figure amount. I notice we only got one.” “Uhhh yeah.” “I mean this newspaper article about your company says the word ‘billions’ a lot.” “Uhh.” “So I’m curious. Do you have any others to file.”

Pause to acknowledge that I don’t think many people appreciate that a “decentralized” “protocol” has an address and EIN to write on the form they file with the IRS, which of course they do.