Hacker News new | ask | show | jobs
by nootropicat 2094 days ago
It's way safer and less complex than you would expect. Most staking contracts are a copy-paste of two basic staking contracts (from synthetix and sushiswap), so it's enough to do a text diff and see what was changed, which is trivial. For more complex contracts that do something more, funds at risk are the best bug bounty there is - in the current environment if something had >$10M for a month and wasn't hacked, it most likely can't be trivially hacked. Bzrx, the single most incompetent defi platform, was hacked just two weeks after a relaunch for $8M - most likely someone was waiting from the start for it to get enough funds to make the hack worthwhile. Almost no hacks happened during the entire yield farming craze.

Key word trivially - some contracts are custodial, so if someone hacked the owners (or they turned out to be scammers) funds could be stolen, which arguably has a reverse Lindy effect in the beginning. Fortunately people are starting to demand at least timelocks and/or multisigs. Another risk is how well liquidations function during a price crash, for protocols that need them.

The current risk premium was and still is absurdly overestimated, but that was a good thing (for me) as without it three or even four digit APYs wouldn't last a day, but thanks to the unwarranted risk premium they lasted about 2 months. During the short peak three weeks ago it was possible to make even ~8% per day (on millions of dollars - good liquidity), completely risk free (trivial staking contracts). The great crypto bullrun of 2020 already happened and few outside of ethereum even noticed.

You will see billions flow into defi on ethereum as others realize the real level of risk too (which guarantees those astronomical returns are never going to return - but even 10% apy on dollars is good in the current environment).

2 comments

Me think you are in a bit too deep and may be underestimating how things can go wrong.

Another possibility is that you have a high risk tolerance as well as an uncommon knack for this sort of thing that most people don’t have.

I have low risk tolerance, but these contracts are usually very simple. I described the basic process of analysis on reddit some time ago (second half): https://reddit.com/r/ethtrader/comments/ihpj6f/yield_farming...

In total, I did this with about 40 different farms. There was a time when there were several new ones every day. For a while it was pretty much a 24/7 job as maximizing apy required constantly jumping to some new hype. I was constantly afraid of depositing into a contract that would allow the owner to steal everything, but the worst I noticed were locking bugs + two contracts that allowed the owner to mint infinite tokens (of these two, only one used it to clean the liquidity pool).

The list of farms in that reddit post is obsolete (I think only sushiswap is still running, but with low roi), in general this particular way of making money has run its course.

"In total, I did this with about 40 different farms. There was a time when there were several new ones every day. For a while it was pretty much a 24/7 job as maximizing apy required constantly jumping to some new hype."

There is a line from a movie ...

"Short everything that guy has touched"

My friend made over $500k from the Uniswap airdrop, he woke up on Thursday and realized he had another half million dollars. He sold it all immediately for stablecoins, and actually missed out on another $750k if he had waited a few hours and sold at the UNI peak.

So yes, it is crazy and complex and difficult, but the rewards are vast for those that dare enter the world.

Every transaction is two-sided. I don't follow the crypto markets in detail any more, but if there was a "UNI peak", then someone who dared to enter the world exchanged stablecoins for Uniswap at about the time UNI peaked. That daring transactor might not agree that the rewards are vast.

Timing markets at the hour level is fraught with risk and cannot generally be done without information not known to the broader market.

Advertising profits without details on how much was invested in what assets and when?

A major disservice, doubly so in a risky space like cryptocurrency and on a public forum. This really just makes the space seem even less trustworthy.

I gave you everything you needed to know! Uniswap airdrop! $500k profits! The rules of the airdrop are published! If none of this makes sense to you then you aren’t even remotely in the crypto space. Uniswap is the biggest dex in the world! Do 20 minutes of googling
For every lucky person making $500k there are 100 people loosing $5k.
Wrong! UNI was airdropped for free to all previous users of uniswap! No one lost anything. And in any trade, both sides have a coincidence of wants, so no one “loses”.
What is so complex about being lucky and receiving an airdrop on multiple addresses ? Some guys are just born lucky...
>Another possibility is that you have a high risk tolerance as well as an uncommon knack for this sort of thing that most people don’t have.

Ding ding. Which is why returns won't last as the information asymmetry curve is flattened.

As an investor who is not into crypto, I don't understand this comment, let alone use it to correctly price the risk of crypto.
agreed; this reads like someone explaining their casino good luck charm strategy.
Defi yield farming is too dangerous for people who are not deep into the space. It's like listening to hedge fund traders talk shop and hear the type of trades they do to make alpha.

If you want to dabble in crypto, make a Coinbase account and go 50/50 BTC and ETH, and don't sell until you retire.

If you want to play with the fast money Defi, then you need to do a lot of self-study and learning.

Wrong, there was never any luck involved. The single worst case scenario was that the token price dumps to 0 immediately after I deposit, which would mean I don't even make the gas fee back. Didn't happen.
Stay away from putting money into unique smart contracts that haven't been running for a long time with a lot of activity. Stay away from smart contracts that are custodial (where the creator is given privilege to all depositors' funds).