Exploring DeFi: A Deep Dive into Curve (hack) and AMMs
As a part of my PhD research in DeFi, I am looking into Decentralized Exchanges (DEX), which are the backbone of Decentralized Finance (DeFi). In this post, I dig deeper into AMMs and Curve (Hack).
DEXs differ from the traditional exchanges, which use the order book to match buy orders with sell orders. The exchange price is decided by the last transaction and the traders set so call limit-orders. DEXs work differently - they use the mathematical formula called AMM (Automated Market Maker) that decides the exchange price.
Background
There are plenty of various AMM formulas. If you are interested, I refer you to my post about them:
Uniswap and Curve are the largest in terms of capital and traded volume AMM-based DEXs in DeFi. In this newsletter, let's dive into Curve, as it hit the headlines due to the recent hack.
What makes Curve so fascinating?
I had the pleasure of meeting and chatting with Michael, CEO and Founder of Curve, when gathering research for my paper about (yield) farming liquid staking tokens.
Curve v2 is currently under test by Bank for International Settlement (BIS), Swiss National Bank (SNB), Bank of France and Singapore for the future FX trading between CHF, EUR and SGD. You can read about this project here:
There are two versions of Curve:
Curve (v1) with AMM called "Stableswap invariant" is designed to trade pairs of stablecoins efficiently
Curve (v2) with AMM called "Cryptoswap invariant" is designed to trade any cryptocurrencies.
By applying sophisticated math, Curve manages to combine the benefits of its Uniswap v2 and v3 in one formula. There is no need to rebalance the position for LPs (Liquidity Providers, aka yield farmers), and traders/swappers enjoy low slippage costs (trading costs).
LPs (aka farmers) are market-makers that provide their tokens to pools at DEXs so that traders can swap them smoothly. LPs earn transaction fees as rewards. And it's LPs that were affected in the recent hack.
Curve Hack
Over 61mn USD was stolen in a reentrancy-attack from Curve. The attack exploited the vulnerability in Vyper - the programming language in which Curve is developed.
You can read more about reentrancy attacks, and in general DeFis, in my recent posts:
However, in the aftermath of the hacking attacks, Curve manage to get back a big part of the stolen tokens and will reimburse all LPs any costs
Lessons Learnt
When AMM-based DEX is hacked, it is LPs that are losing money. Traders are not affected. In the aftermath of the hack, 1.5bn (half of all total value locked) moved out from Curve, making LPing there extremely profitable. As Curve remains attractive to traders thanks to its AMM design, there are less LPs to share trading fees.
To conclude, the total assets in DeFi are below 100bn, whereas the (traditional) FX market has 7.5tr USD of daily traded volume. When those assets move to AMMs (which Bank for International Settlement is testing), the AMM-DEXs will flourish.
Thanks for reading, leave your comments and subscribe for more updates.
Have a great week ahead.