<\/p>\n
Curve Finance\u2019s recent near-death experience<\/a> (and its averted propagation) may seem like a blur in Web3\u2019s rear-view mirror, but it\u2019s actually something that keeps happening in the industry. It\u2019s not the first time that a decentralized finance<\/a> protocol \u2014 or any decentralized app for that matter \u2014 has been affected by an attack that is perfectly legal within its own code. More so, the crisis could\u2019ve been prevented if on-chain risk management existed.<\/p>\n All of this points to a broader problem in Web3. That is the problem of limited expressivity and resources<\/em> that exist in its development environments and how it affects security overall.<\/p>\n When the Curve Finance attacker was able to retrieve US$61.7 million in assets from Curve Finance\u2019s smart contracts<\/a>, many media outlets<\/a> and commentators called the event a \u201chack<\/a>.\u201d But this was not a hack \u2014 it was an exploit. The difference here is key.\u00a0<\/p>\n In this context, a hack would\u2019ve taken place if the attacker had somehow bypassed or broken an existing security measure. But the attack on Curve was an exploit. Nothing that happened that was out of the ordinary in terms of what the protocol\u2019s Vyper code allowed for. The looter simply took advantage of how the protocol\u2019s design worked.<\/p>\n Who\u2019s to blame for this? No one. Curve\u2019s Vyper code, like most of the (Solidity) code that\u2019s used in Web3 applications, is severely limited in its ability to express complexity beyond relatively simple transaction logic.\u00a0<\/p>\n This makes it hard for anyone to design security measures that would prevent this or any other attacks. More worryingly, it also makes it hard for anyone to properly design tools to prevent their spread across DeFi\u2019s vast and composable liquidity landscape.<\/p>\n But it doesn\u2019t mean there was nothing Curve could do to prevent this attack and its spread across DeFi. A simple example of a solution would be on-chain risk analysis.\u00a0<\/p>\n The generalized version of a problematic pattern that could be solved can be summarized in a hypothetical situation like this one:<\/p>\nHack or exploit?<\/strong><\/h4>\n
On-chain risk analysis<\/h4>\n
\n