Loans Flash

[Loans Flash @LoansFlash]

Send me some ETH please

[Loans Flash @LoansFlash]

@dYdX @korpi87

[korpi @korpi87]

PROFITING FROM PEG DEVIATIONS

LUSD<1$: Buy 1 LUSD on the market and redeem for 1$ worth of $ETH.

LUSD>1$: Provide ETH collateral, borrow LUSD and sell at premium to buy back lower.

https://t.co/Dq5gdYYYZ0

[korpi @korpi87]

INTEREST-FREE BORROWING

$LUSD borrowers pay a one-time fee as low as 0.5% of the borrowed amount.

No interest is charged later.

It's a more reliable model than other borrowing protocols which charge variable and unpredictable interest rates for the whole duration of the loan.

[korpi @korpi87]

HIGH CAPITAL EFFICIENCY

$LUSD requires minimum Collateral Ratio (CR) of 110% which means users can borrow up to 90% of the dollar value of their provided collateral.

It makes $LUSD more capital efficient than $DAI where the lowest CR for ETH vault is 130%.

[korpi @korpi87]

DATA FEED (system can't price itself)

The protocol uses @chainlink price feed for $ETH but it also has a back-up oracle from @WeAreTellor to be used under extreme circumstances.

✅ Low Risk

[korpi @korpi87]

$LUSD is backed by the most trustless collateral on Ethereum, $ETH.

Yes, it limits the total value of collateral that can be used to issue a stablecoin.

But it is also the safest collateral that exists on Ethereum.

Let's cover all the risk areas for LUSD.

[korpi @korpi87]

Accepting centralized collateral like USDC or WBTC is the most criticized issue for $DAI.

Actually, only 7% of DAI in circulation is generated from $ETH.

If there was some regulatory pressure on USDC / WBTC custodians and funds were frozen, DAI value would be at huge risk.

[korpi @korpi87]

Non-custodial stablecoins have 5 major risks:
- Collateral (value < issuance)
- Data Feed (system can't price itself)
- Governance (parameter failure)
- Base Layer (chain fails)
- Smart Contract (hack leads to insolvency)

Each can result in the stablecoin value going to zero.

[korpi @korpi87]

Custodial stablecoins have three major risks:
- Counterparty Risk (fraud, theft, govt seizure, etc.)
- Censorship Risk (operations blocked by regulators, etc.)
- Economic Risk (off-chain assets go down in value)

Each can result in the stablecoin value going to zero.

[korpi @korpi87]

There are two major classes of stablecoins:

Custodial: entrusted by off-chain collateral assets like fiat dollars that sit in a bank. Requires trust in third party.

Non-custodial (aka decentralized): fully on-chain and backed by smart contracts & economics. No trusted parties.

[korpi @korpi87]

You can read the unrolled version of this thread here: https://t.co/tQH4a6lVnO

[IOE @CT_IOE]

29/x
Metamask’s current solution is the (very effective) bright red warning (shown in the first image) telling the user how dangerous a signature may be when using ETH_SIGN. I think this is sufficient - although the best solution would be disabling the functionality entirely.

[IOE @CT_IOE]

28/x
Well- it turns out this is a Metamask issue, and many other platforms (such as Geth) do not allow ETH_SIGN to sign raw transactions anymore. Thus, much of the documentation online DOES NOT APPLY to Metamask currently. This leads to quite a bit of confusion on the risks here.

[IOE @CT_IOE]

26/x
Thus, there is (currently) no harm in signing messages when using PERSONAL_SIGN.

[IOE @CT_IOE]

25/x
So how does PERSONAL_SIGN protect against this? By using PERSONAL_SIGN, the prefix at the beginning of the message prevents it from being used as a transaction (as it would fail, since the prefix is not valid instructions for the evm).

[IOE @CT_IOE]

24/x
The attacker can then broadcast that transaction to the network, posing as you, and the transaction will be executed.

All by signing a message in Metamask.

[IOE @CT_IOE]

23/x
But - how can an attacker tell the network to execute that transaction? Because, with ETH_SIGN, you signed the raw transaction (in the form of a message) with your private key.

[IOE @CT_IOE]

17/x
eth-sig-util is simply a group of signing functions - which is exactly what we are looking for. Within here, we should find personalSign.

[IOE @CT_IOE]

16/x
Looking around a bit - we can see that personalSign comes from the “eth-sig-util” package. By checking out the code there - we can see the real PERSONAL_SIGN logic.

[IOE @CT_IOE]

15/x
Looking at PERSONAL_SIGN, we can see the rabbit hole goes a bit deeper. Instead of simply signing the raw message data and returning it - a new “personalSign” function is being called with our message.