Research Report of JFSA Multilateral Joint Research on the Chainof Trust of Decentralized Finance

June 2022
QUNIE Corporation

1

Background and purpose of this study
Decentralized financial systems based on blockchain technology enable Peer-to-Peer/Pool (P2P)
financial transactions that reduce or eliminate the need for intermediaries and centralized processes.
The financial services built primarily on public blockchains using smart contracts are called "DeFi(Decentralized Finance)". The crypto-asset market is currently growing rapidly, with TVL (Total Value
Locked, the total value of crypto-assets deposited in a typical DeFi service) temporarily exceeding$100 billion1 . On the other hand, DeFi is continuously experiencing fund theft due to smart contract
vulnerabilities and theft of private keys, with the highest loss amount exceeding $600 million as ofMarch 2022 (see 2-6-6), and the amount of damage when incidents occur is significant. Concerns
have also been raised in terms of AML/CFT, user protection, and financial system stability.
Therefore, in this study, as part of the JFSA's "Multilateral Joint Research project", we conducted
research on technical risks in the chain of trust (see 1-1-4) of decentralized financial systems,
including DeFi. Although decentralized financial systems are considered to have decentralized andautonomous systems and governance as compared to existing financial systems, there are many
DeFi that are considered to have multiple trust points (see 1-1-4). There are also some incidents inwhich the Weakest Link (see 1-1-5) among the components of DeFi was considered to be exploited.
In addition, DeFi is now mainly operated by a Decentralized Autonomous Organization (DAO), but
despite the name of DAO, there are some cases where it is believed that autonomous management
is not being conducted but it is operated by a specific authority, and decision-making is conducted bya very small number of large governance token holders. Therefore, based on the assumption that thecurrent major DeFi projects have certain trust points, we analyzed the case studies of representative
DeFi projects; Uniswap (decentralized exchange: DEX), Maker (crypto-asset-backed stablecoin), andAAVE (lending), and their past incidents, and also interviewed the people involved in DeFi, in order to
identify risks related to decentralized financial systems.
In general, entities trusted by users and other parties are subject to liability and may also be subject
to regulation (e.g., banks). On the other hand, in DeFi, where parameter changes, smart contract
upgrades, and decisions on use of funds are (to a certain extent) left to the community,
decentralization of responsibility may make it difficult to identify regulatory targets, and a detailed trust
point analysis for each project is considered necessary.2 The DeFi is a decentralized financial systemthat is not only a financial institution, but also a community. In order for society as a whole to reap thefruits of innovation that a decentralized financial system can bring, it is important to identify andassess the risks of such a system and explore risk reduction measures with a view to the sounddevelopment of a decentralized financial system.

1 DeFi pulse TVL(USD) 11/9/2021 9:00AM JST $110.26B https://www.defipulse.com/
2 However, the transparency, autonomy, and tamper-resistance of blockchain may be utilized to reduce risk in a manner

different from the traditional financial system, and traditional approaches to financial regulation may not necessarily be theoptimal solution for decentralized finance as well. Based on objective analysis, this study focuses on providing a perspectivefrom which regulators, developers, business stakeholders, and others can collaborate to solve the challenges of decentralized
financial systems.

2

Acknowledgement
In preparing this report, we received useful advice and comments from Professor Naoyuki Iwashita of
Kyoto University, Professor Kazue Sako of Waseda University, Project Professor Shigeya Suzuki of
Keio University, and Research Professor Shin'ichiro Matsuo of Georgetown University. We also
received useful suggestions and advice from observers from the Digital Agency and the Bank ofJapan, as well as from officials of the Financial Services Agency.
However, any errors in the content regarding this report are attributed to the trustee, Qunie
Corporation.

Disclaimer
The contents of this report do not represent the official views of the JFSA.
The contents in this report other than historical or current facts are forward-looking statements basedon information available at the time of writing, and actual trends may vary due to a variety ofuncertainties.

3

Table of Contents
Background and purpose of this study
2
Acknowledgement
3
Disclaimer
3
Table of Contents
4
Glossary
6
Chapter 1. Getting the Big Picture on Chains of Trust for Decentralized Financial Systems
7
1-1 Main definitions for decentralized financial systems
7
1-1-1 Decentralized Financial System
7
1-1-2 DeFi (Decentralized Finance)
7
1-1-3 DAO (Decentralized Autonomous Organization)
7
1-1-4 Trust Point/ Chain of trust
8
1-1-5 Weakest Link
8
1-2 Key components of a decentralized financial system
8
1-3 Mapping of the main components that make up a decentralized financial system
13
1-3-1 Layering Concept
14
1-4 Analysis of technical characteristics of components per layer
16
1-4-1 Blockchain Infrastructure
16
1-4-2 Blockchain Infrastructure Extension Servise
19
1-4-3 Application Infrastructure and Applications
21
1-4-4 Aggregation29
1-4-5 User and User Interface
29
1-5 Interoperability Analysis
30
Chapter 2. Analysis of Major DeFi Projects
31
2-1 Identification of DeFi projects to be studied
31
2-1-1 Selection of DeFi Projects to be Investigated (Decentralized Exchange)
31
2-1-2 Selection of DeFi Projects to be Investigated (Crypto-asset Stablecoin Issuance Platform)
33
2-1-3 Selection of DeFi projects for study (lending platform)
34
2-2 Analysis of the decentralized exchange Uniswap
35
2-2-1 Overall Project Overview
35
2-2-2 Main Technological Characteristics
39
2-2-3 Cooperation with Financial Institutions44
2-2-4 Governance operations45
2-2-5 Incident cases
49
2-2-6 Uniswap Main Trust Points
51
2-3 Stablecoin Maker (DAI) Analysis
53
2-3-1 Overall Project Overview
53
2-3-2 Main Technological Characteristics
57
2-3-3 Cooperation with financial institutions
68
2-3-4 Governance Operations69
2-3-5 Incident Cases
74
2-3-6 Maker's main trust points
78
2-4 Lending Aave Analysis
79
2-4-1 Overall Project Overview
79
2-4-2 Main Technological Characteristics
83
2-4-3 Cooperation with financial institutions90
2-4-4 Governance operations91
2-4-5 Aave's main trust points
95
2-5 Results of Analysis of the Three Projects
97
2-5-1 Component Mapping of Major DeFi Projects
97
2-5-2 Comparison of Analysis Results for Surveyed Projects
99
2-6 Results of Major Incident Case Analysis of Other DeFi Projects
1102-6-1 The DAO Attack
1104

2-6-2 Flash Loan Attack #1
2-6-3 Flash Loan Attack #2
2-6-4 Money Laundering
2-6-5 Bitcoin Vulnerability (CVE-2018-17144)
2-6-6 Stealing of Funds Locked in a two-way Bridge in a Side Chain (Ronin Network)
2-6-7 Major Incident Cases after 2020
2-7 Analysis of Trust Point Weakest Link in Chains of trust
2-7-1 Analysis of Trust Points
2-7-2 Analysis of Weakest Link
Chapter 3. Identifying Risks in a Decentralized Financial System
3-1 Identifying Risk Factors in System Operation
3-2 Identifying Risk Factors in System Development
3-3 Identifying Risk Factors in Governance
3-4 Identifying Risk Factors in Engagement with Financial Markets
Chapter 4. Analysis of Risk Mitigation Measures in a Decentralized Financial System
4-1 Analysis of Risk Mitigation Measures in System Operation
4-2 Analysis of Risk Mitigation Measures in System Development
4-3 Analysis of Risk Mitigation Measures in Governance
4-4 Analysis of Risk Mitigation Measures in Engagement with financial markets
Conclusion

5

115
118
120
123
125
128
133
133
135
139
139
149
154
156
159
159
165
169
170
172

Glossary
Terminology

Definition

AML/CFT

Anti Money Laundering and Combating the Financing of Terrorism

BIS

Bank for International Settlements

DAO

Decentralized Autonomous Organization

DeFi

Decentralized Finance

ERC

Ethereum Request for Comments

EVM

Ethereum Virtual Machine
A virtual machine that runs an Ethereum client (node)3

FATF

Financial Action Task ForceFISC

The Center for Financial Industry Information Systems

FSB

Financial Stability Board

IEC

International Electrotechnical Commission

IPA

Information-technology Promotion Agency, JapanIOSCOInternational Organization of Securities Commissions

ISO

International Organization for Standardization

KYC
TVL

Know Your Customer
Customer verification program
Total Value Locked
Total value of crypto-assets deposited with DeFi

3 Ethereum.org VIRTUAL MACHINE (EVM) https://ethereum.org/en/developers/docs/evm/

6

Chapter 1. Getting the Big Picture on Chains of Trust for Decentralized Financial Systems
This chapter shows the overall picture of chains of trust in the decentralized financial system (see1-1-4) for the purpose of understanding how the decentralized financial system works. Specifically,
we identify the major components that make up a decentralized financial system and organize theminto a form that provides an entire perspective of the chains of trust by dividing the components intolayers and mapping them as a whole.
This chapter is organized as follows: 1-1 defines key terms such as decentralized financial system,
DeFi, DAO, and chains of trust; 1-2 describes the main components of them; 1-3 layers and maps themain components into layers to provide an overall picture of the chains of trust; and 1-4 describes thetechnical characteristics of the components by layer with specific examples. 1-5 describes the resultsof the interoperability analysis across the components between and within layers.
1-1 Main definitions for decentralized financial systems
1-1-1 Decentralized Financial System
The 2019 FSB report4 defines a decentralized financial system as financial system that
decentralized financial technology may give rise. It further defines decentralized financial technology
as technologies that may reduce or eliminate the need for one or more intermediaries or centralized
processes in the provision of financial services. We use the above definition throughout this report.
The “decentralized financial system” is said to aim at building a non-centralized system, as
opposed to the centralized system found in existing financial systems. On the other hand, in thedescription of “distributed” systems, "distributed" means to the decentralized arrangement ofcomputers, and centralized systems are also considered to be a form of distributed systems. In thisreport, which focuses on “decentralized financial systems”, "distributed" is used to include themeaning of non-centralization.
1-1-2 DeFi (Decentralized Finance)
The so-called DeFi has been discussed in various literature and articles but not clearly defined. In
this report, we define DeFi as "financial applications that could consists a part of decentralized
financial system" according to the reference5 . DeFi initially focused on proprietary token issuance forfunding and decentralized exchanges (DEX) that do not require the intermediation of traditional
exchanges for token exchange. As the DeFi ecosystem has expanded, however, various initiatives
such as lending, derivatives, and insurance have been introduced. There are also aggregators andother services that combine multiple DeFi transactions into a single location.
1-1-3 DAO (Decentralized Autonomous Organization)
There is no set definition of a decentralized autonomous organization (DAO) that operates a DeFi,
but definitions have been attempted by Chohan6 and Ethereum.org7 in 2017, all of which focus on theorganization's operations in a decentralized manner. In general, DAOs are considered to have thefollowing characteristics compared to traditional corporations (e.g., joint stock companies).
<DAO features in major DeFi projects>
4 Financial Stability Board: decentralised financial technologies: report on financial stability, regulatory and governanceimplications (2019). https://www.fsb.org/wpcontent/uploads/P060619.pdf
5 Ryosuke Ushida and James Angel: Regulatory Considerations on Centralized Aspects of DeFi Managed by DAOs (2021).
https://link.springer.com/chapter/10.1007/978-3-662-63958-0_2
6 Definition of DAO by Chohan: Organization that is run through rules encoded as computer programs called “smart contracts”,
WChohan, U.W.: The decentralized autonomous organization and governance issues. j. Cyber Policy 1-7 (2017).
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3082055
7 Definition of DAO by Ethereum.org (a community run by the Ethereum Foundation): a member-owned community where

centralized leadership is absent; a safe way to collaborate with strangers on the Internet; a safe place to entrust funds to a
specific purpose https://ethereum.org/ja/dao/

7

-

-

An organization that is managed autonomously by the participants, without the existence of acompany, representative, or board of directors to manage the organization.
The organization's operating rules are coded by smart contracts.
The token holder is granted a kind of voting right in the form of a token called a governancetoken, etc., and votes on certain decisions in the organization or community based on the rules ofthe smart contract.
The organization is a global one with participants belonging to multiple countries, and the country
or region to which the organization belongs is not necessarily specified because the governing
legal entity is not always clear.

Based on the references and the MakerDAO case study, this report defines an organization as "amember-owned community where centralized leadership is absent and operations are conducted byrules encoded as computer programs (smart contracts)”.
A well known example of a DAO in its early stage is “The DAO”, an investment fund organization
launched by the German company Slock.it in November 2015. “The DAO" was formed for profit anddissolved following a June 2016 fund leakage, but a DAO has since been introduced as a form ofcommunity management in numerous DeFi projects. In "The DAO," decision-making authority wasconcentrated in the hands of Slock.it, the operating company, and designated curators, but now, as in
MakerDAO, there are moves to dissolve an operating company (such as Maker Foundation) andincrease the degree of decentralization. However, there are many cases where an organization iscalled a DAO but is not actually operated autonomously.
1-1-4 Trust Point / Chain of trust
Trust is defined in the JFSA's "Study Group on Digital and Decentralized Finance" Interim report as"The intention to entrust one's own vulnerabilities to the other party's behavior based on the
expectation that the other party will take important actions regardless of whether the other party ismonitored or controlled”, and “the degree of belief that the other party will act as expected without
confirming the actions"8.
Based on this definition, this report defines a trust point as "a centralized element in a decentralized
financial system that users and others are forced to trust unconditionally", and a chain of trust as "achain of dependencies that includes a trust point”.
Also, the Single Point of Failure (SPoF) is used to describe the relationship between components,
and is defined as "the part of a component of a system that, if it stops, will cause the entire system tostop"9. It often overlaps with the Trust Point.
1-1-5 Weakest Link
In this report, Weakest Link, for the purposes of this report, refers to the components of DeFi andthe connections between components that are the weakest in terms of security. By targeting the
Weakest Link, attackers attempt to increase the likelihood of a successful attack the most.
1-2 Key components of a decentralized financial system
A decentralized financial system consists of a variety of components, including not only theblockchain and smart contracts, but also the user interface, wallet, developer team, and infrastructure
providers. This section provides an overview of each of the major components of a decentralized
financial system, including their technical characteristics and their role in a decentralized financial
system.
(1) Blockchain infrastructure

8

Study Group on Digital and Decentralized Finance: Study Group on Digital and Decentralized Finance Interim Reporthttps://www.fsa.go.jp/news/r3/singi/20211117/seiri.pdf
9What is JPNIC SPOF https://www.nic.ad.jp/ja/mailmagazine/backnumber/2019/vol1667.html

8

The following blockchains are used as the basis for structuring DeFi.
a. Main chain (e.g. Ethereum)
It is the base blockchain for running the DeFi protocol and is the parent chain for sidechainsand Layer 2 scaling solutions. The main chain generally has the following characteristics(described primarily with Ethereum in mind)
-

-

-

-

-

Flexible smart contract functionality for deploying DeFi protocols.
The client (node) shares blocks and other data via a peer-to-peer (P2P) network between
nodes. Clients (nodes) are equipped with virtual machines (EVM) to execute smart
contracts
There are two types of accounts held in the blockchain.
 Externally Owned Accounts (EOAs) are managed with a private key and can send andreceive native tokens or other tokens and deploy and execute smart contracts(equivalent of an address of Bitcoin).
 The contract account is the deployed smart contract account, and smart contracts are
executed in response to the receipt of messages from EOAs or other contract
accounts.
The clients (nodes) that make up the main chain are equipped with Ethereum node
software, which is common software provided by the Ethereum Foundation and others,
and the virtual machines (EVMs) necessary to execute smart contracts.
A large number of DeFi are running on the main chain, and the increase in the number ofusers has caused problems such as the transaction execution fee (gas price) to skyrocket
and transaction congestion, which makes code execution (incorporation into the block,which is a prerequisite for code execution) time consuming.
Recently, emerging chains such as Avalanche and Solana have appeared on the market,
and their market share has been changing to some extent.
There is also a hierarchical chain10 that scales up the main chain and is considered to haveinteroperability and scalability.

b. Side chain11 (e.g. Polygon)
It is a blockchain that operates in parallel with the main chain in order to improve theprocessing speed of the main chain and otherwise scale it up, and generally has the following
characteristics
-

-

-

-

While main chain’s consensus algorithms (e.g. Ethereum currently uses PoW: Proof ofWork) are often energy intensive and limited in processing speed, sidechains can reduce
power consumption and CO2 emissions by using consensus algorithms independent of themain chain (PoA: Proof of Authority, DPoS: Delegated Proof of Stake, BFT: Byzantine
Fault Tolerance, etc.) and thereby improve transaction processing speed and reduce gas
costs.
It is connected to the main chain by a two-way bridge12 . When funds are exchanged
between the main and side chains, funds are locked in the two-way bridge to prevent
double spending.
Some sidechains are based on the same virtual machine as the main chain (e.g., EVM), in
which case the same programming language and libraries function in the sidechain as in
the main chain (Ethereum).
There are generally two types of accounts held in the sidechain: externally owned
accounts and contract accounts, as in the main chain.

10 Tiered Chain: A blockchain with a unique network structure that includes a main chain and individual subchains connected

to it, such as Polkadot. The subchain executes smart contracts, while the main chain relays messages.
11 Ethereum.org SIDECHAINS https://ethereum.org/en/developers/docs/scaling/sidechains/
12 Ability to exchange tokens between main and sidechains Ethereum.org Blockchain bridges https://ethereum.org/en/bridges/9(2) Layer 2 scaling solution
There are off-chain solutions to scale up the Ethereum blockchain, such as increasing
processing speed, as the following Rollup.
*Rollup13 : A mechanism to improve processing speed by executing transactions off-chain(Layer 2) outside the Ethereum main chain (Layer 1) and sending only the result data to Layer
1.
a. Optimistic Rollup14
Optimistic Rollup is said to improve processing speed because it assumes that transactions
are valid by default and does not perform the calculations necessary to verify the validity ofthe data being written. It also inherits Ethereum's security. When a write is made to the
Ethereum main chain, the validity of the written data is not verified. Instead, Fraud-Proof
allows a challenge to be filed if the verifier detects an unauthorized state transition during thechallenge period (basically 7 days).
b. zk-Rollup (Zero Knowledge Rollup)15
zk-Rollup combines hundreds of transactions into one off-chain transaction and generates acryptographic proof of validity of the transaction data. Because only the validity proofs ofvalidity are sent to the Ethereum main chain, rather than all transaction data, the datacontained is said to be smaller, making block verification faster and cheaper.
Since zk-Rollup verifies the validity of data at the time of writing to the main chain, there isno fraud verification delay in transferring funds from Layer 2 to Layer 1, as in Optimistic
Rollup.
(3) Native tokens (e.g., ETH)
A token (cryptocurrency) commonly used within the blockchain infrastructure and required
as a transaction execution fee (gas fee), etc.
(4) Smart Contracts16
Smart contracts are generally rules (contracts) that are written as programs andautomatically executed and processed on the blockchain (distributed ledger). On Ethereumand similar "blockchain infrastructure" they mean code (functionality) and data (state) that
resides at a specific address on the blockchain.
In Ethereum and similar blockchains, smart contracts are held in a contract account and are
invoked from externally owned accounts or other smart contracts via messages. The smart
contract is written to the blockchain and executed by a minor or validator in the process ofvalidating the transaction. Its execution log and post-execution vouchers are recorded in theblock so that everyone can verify that the genuine program code has been executed andshare the status.
Smart contracts usually cannot be modified or deleted, and execution results cannot be
undone, but there is room for smart contracts to be upgraded by replacing references withnew contract addresses if indirect references are used, for example through support bydevelopment tools.
In addition, smart contracts can be executed by deploying them to the blockchain, but the
deployment process in DeFi generally requires the private key of an externally owned accountheld by an administrator or authority (who holds the private key needed to deploy the smart
contract).
13 LAYER 2 ROLLUPS https://ethereum.org/ja/developers/docs/scaling/layer-2-rollups/
14 Ethereum.org OPTIMISTIC ROLLUPS https://ethereum.org/en/developers/docs/scaling/optimistic-rollups/
15 Ethereum.org ZERO-KNOWLEDGE ROLLUPS https://ethereum.org/en/developers/docs/scaling/zk-rollups
16 Ethereum.org INTRODUCTION TO SMART CONTRACTS https://ethereum.org/ja/developers/docs/smart-contracts/

10In this report, the smart contracts that enable DeFi functions and services are referred to as"DeFi protocols". Strictly speaking, the DeFi protocol consists of a smart contract that runs on
the blockchain and the DeFi protocol interface that allows users to operate the smart contractfrom the outside. The DeFi protocol interface refers to the DeFi protocol operation screen andinformation displayed in a web browser.

Figure 1-2 Flow of smart contract execution (in Ethereum)(5) Wallet
The wallet manages the user's private key, maintains the wallet address and otherinformation for the user to perform transactions with the private key, and provides the userinterface (e.g., web browser or smartphone app control screen). The user usually connects theirown wallet to each DeFi service.
<About the private key>
In ISO/IEC20008-117 , the key used for signing and verification with public key
cryptography is called the signing key (private key) and the key used for verification is called
the verification key (public key). In this report, they are referred to as private key and public
key, respectively.18 IPA explains thet in public key cryptography, two keys (private key andpublic key) are used in pairs. In digital signatures, a message is encrypted using a private
key, which is then verified using the public key of the pair to ensure the integrity of themessage and the authentication of the signer (see 1-2(6)).
a. Cold wallet
Cold wallets manage users' private keys in a completely isolated state from the Internet using
paper wallets or dedicated hardware wallets. Therefore, cold wallets are generally lessconvenient than hot wallets, but they are considered more resistant to attacks via the network,and are used for storing high-value crypto-assets at crypto-asset exchanges, etc.
b. Hot Wallet19

17 ISO/IEC 20008-1:2013(en) Information technology - Security techniques - Anonymous digital signatures Part 1: General

https://www.iso.org/obp/ui#iso:std:iso-iec:20008:-1:ed-1:v1:en
18 2.2 Public Key Cryptography 2.1 Overview https://www.ipa.go.jp/security/pki/022.html
19 FSA Summary of FATF Report to G20 Finance Ministers and Central Bank Governors on So-Called Stablecoins (Provisional

Translation) (7/2020) https://www.fsa.go.jp/inter/etc/20200701.pdf

11

Hot wallets are classified into the following two categories based on the location of the user's
private keys.
-

Unhosted wallet
Unhosted wallets are generally defined as wallets where the private key is managed
directly by the user who is the holder of the wallet, and the user can directly perform
crypto-asset transfer transactions, etc. Unhosted wallets use Ethereum libraries such as
web3.js to connect directly to the Ethereum blockchain.

-

Hosted wallet
In hosted wallets, users entrust the management of their private keys to a walletadministrator (host/custodian) such as a cryptocurrency exchange, and users cannot
directly execute crypto-asset transfer transactions.

(6) User Interface
The IPA defines a user interface as "a point where a user, a device, and system interact
when the user uses the device system"20 . In DeFi, it refers to the user authentication21 screen
and user operation screen (GUI: Graphical User Interface) of a web browser or smartphone
application when using the DeFi service, as well as the commands used by operational
operators (CLI: Command Line Interface).
(7) Infrastructure providers
Infrastructure providers are blockchain node hosting services that offer API and otherservices to DeFi developers and wallet providers to build DeFi functions and services, such asaccess to the blockchain. Major infrastructure providers include Infura (by Consensys),
Quicknode (by QuickNode), and alchemy (by alchemy).
(8) DeFi System Development Tools
Development tools for DeFi system developers to develop/test DeFi protocol smart contracts,
etc., such as Truffle and Hardhat in Ethereum.
Development tool features include developing/debugging smart contracts, compiling source
code, testing on local nodes, and deploying to the blockchain for developement. Somedevelopment tools utilize the capabilities of infrastructure providers, such as Infura.
(9) Code Auditing Company
A company that provides analysis services to detect design problems, code errors, andsecurity vulnerabilities in smart contract code through static verification (code analysis, formal
verification, etc.) using code auditing tools, dynamic verification, and desk review by code
auditors.
(10) Client software22
Software used by DeFi developers and operators to access clients (nodes) from the outsidewhen performing operations such as deploying and maintaining smart contracts andmonitoring the operation of the DeFi protocol, including terminal emulators and web browsers(infrastructure provider), and so on.

20 IPA Quality at the Point of Use" in a Connected World https://www.ipa.go.jp/files/000057850.pdf
21 User authentication is a system for identifying users to a system or application. This system can be used to control access to

specific information and protect information. The most common method is to use "multi-factor authentication," in which a user
is authenticated by a combination of several of the following factors
Only known to the user (password)
Items owned by the user (keys, cards, smart phones, phones, etc.)
Representation of user characteristics (biometrics such as fingerprints)
22 Ethereum.org SPIN UP YOUR OWN ETHEREUM NODE https://ethereum.org/ja/developers/docs/nodes-and-clients/run-anode/12(11) Oracle23
A data feed for smart contracts to retrieve off-chain external data, mainly used as a priceoracle to retrieve external market prices and interest rates. There are cases where multiple
external feeds are set up by self to obtain external market prices (Maker), and cases where
external decentralized oracle services such as Chainlink are used (Aave).
(12) Governance token/ Governance vote
Although there is no strict definition of a governance token, it generally refers to a token thatis granted the right to vote on community decisions, such as modifying the functionality of the
DeFi protocol, changing parameters such as additions and interest rates, and using
community funds, by the governance token holders. A mechanism whereby holders voteaccording to rules determined by the amount held and implement what is passed is often
referred to as "governance voting".
(13) KYC certified companies
When DeFi services are provided to institutional investors, such as Aave, an external KYC
certification company may perform KYC certification of institutional investors, etc. (As an
example, an institutional investor certified by a KYC certification company is white-listed andnotified to DeFi and recognized as a KYC-compliant user by DeFi, etc.).
(14) Aggregators24
It refers to a function or service that aggregates various DeFi services that exist on theblockchain into a single location (e.g., website) and provides users with opportunities for
efficient crypto-asset transactions.
DeFi aggregators find optimal token exchange rates and yields from decentralizedexchanges, lending protocols, liquidity pools, etc. and offer them on their platforms.

1-3 Mapping of the main components that make up a decentralized financial system
The overall mapping was based on the key components outlined in 1-2 and the dependencies in
DeFi's chain of trust
In this report, the analysis is conducted with Ethereum in mind as the blockchain infrastructure, andthe relationship with other main and side chains is specified in each case. In addition, although themapping is divided into layers to clarify the dependencies of the chain of trust, it should be noted thatthe trust and security relationships of the components may in fact span the entire layer, and thedivision into layers does not mean that the target is limited to a specific layer.

23 Ethereum.org ORACLES https://ethereum.org/ja/developers/docs/oracles/
24 DeFi Aggregator https://coinmarketcap.com/alexandria/glossary/defi-aggregator

13

Figure 1-3 Mapping of the main components of a decentralized financial system
1-3-1 Layering Concept
For the purpose of placing the dependencies between components up and down between layers, thefollowing concept is used to classify the layers in which the major components are placed.
(1) Hardware/ Infrastructure software layer
Place hardware and operating system, Internet, and P2P Network for the blockchain.
(2) Blockchain infrastructure (Layer 1) layer
The main chain (Ethereum), which is the blockchain infrastructure, as well as side chains andhierarchical chains are placed. Externally owned accounts, contract accounts, and native tokens
are also placed in this layer as they are part of the blockchain functionality.
Sidechains are placed in parallel with the Ethereum blockchain as they connect with the main
Ethereum chain via a two-way bridge and operate independently of Ethereum.
Outside of the blockchain are infrastructure providers that work with the blockchain
infrastructure, cold and hot wallets that work with externally owned and contracted accounts, andclient software.
(3) Blockchain Infrastructure Extension Service (Layer 2) Layer
Layer 2 scaling solutions that run dependent on the blockchain infrastructure is placed in thislayer.
In addition, since infrastructure providers, unhosted wallets, wallet administrators, and client
software are related to both layers 1 and 2, they are placed across both layers.
(4) Application Infrastructure Layer
Oracles, stabled coins, and governance tokens that are normally required for application layers
such as the DeFi protocol (smart contracts) are placed.
Outside of the blockchain, an external oracle that works with the Oracle, DeFi systemdevelopment tools to develop the application infrastructure, etc. are placed.
(5) Application layer

14

The application layer contains the DeFi protocol (smart contract) applications (various DeFi
functions and services, etc.).
Outside of the blockchain, the DeFi protocol interface, that work with the DeFi protocol,
community forums, client software, DeFi system development tools, etc. are placed.
(6) Aggregation layer
The aggregation layer includes a DeFi aggregator that aggregates multiple DeFi projects.
(Components outside the blockchain of the DeFi Aggregator are omitted as the mapping shows
the dependencies of the DeFi projects.)(7) User/User Interface Layer
User interface between the user and other components is placed in this layer.

151-4 Analysis of technical characteristics of components per layer
1-4-1 Blockchain Infrastructure
An overview and key technical characteristics are described for the following blockchain infrastructures.
(1) Overview and technical characteristics of the blockchain infrastructure
Table 1-4-1 Technical characteristics of the blockchain infrastructure
Blockchain(Native Token)

Ethereum(ETH)

Polygon(MATIC)

Avalanche(AVAX)BNB Smart Chain(BNB)

Polkadot(DOT)

Classification.

main chain

side-chain

main chain

main chain

main chain(hierarchical chain)-

Numerous DeFi
and smart
contracts arebeing built.
Migration to Eth
2.0 is underway
in stages toresolve scalability
and other issues.

--

Sidechain of
Ethereum,
compatible with
EVM25
High processing
speed and low
remittance fees
due to scaling
technology-

Low remittancefees with scaling
technology
Compatible with
Ethereum and
EVM-

Low remittancefees with scaling
technology
Compatible with
Ethereum and
EVM
Consensus
algorithm with
fixed 21validators forhigh speed
processing-

Aim to build ahighlyinteroperable
infrastructure byconnecting themain chain (relay
chain) and thepara-chains(individual
blockchains thatscale up).

Summary-

Service Launch

2015

2017

2020

2019

2017

Founder

Vitalik Buterin

Jaynti Kanani (CEO)Sandep Nailwal,
Anurag Arjun

Emin Sirer (Professor
at Cornwell)

Changpeng Zhao
(CEO of BinanceExchange)

Dr. Gavin Wood (Cofounder of Ethereum)

Development team,etc.

Ethereum Foundation

Polygon Technology

Ava Labs

Binance Holdings Ltd.

Web3 Foundation-

25 In this table, "compatible" means that Ethereum smart contracts will run on other blockchains.

16-Consensus algorithm

GHOST26 (Proof ofWork)
Eth2.0: Proof of Stakein transition

Proof of Stake

Proof of Stake

Proof of Staked
Authority (PoSA)27

Nominated Proof of
Stake (NPoS)

Smart Contract
Development
Language28

Solidity, Vyper

Solidity, Vyper

Solidity, Vyper

Solidity, Vyper

Solidity, Vyper

Throughput

15TPS

65,000TPS

400-1,500TPS

10,000TPS

1,000TPS

Execution model(machine)

Account-Based29(EVM)

Account-Based(EVM)

UTXO-Based30(AVM+EVM+more)

Account-Based(EVM)

Account-Based

Avarage block
generation time31

14sec.

2sec32

2sec

5sec.

6sec.

Major Token
Standards

ERC-20, ERC-721,
ERC-1155

ERC-20, ERC-721,
ERC-1155

ERC-20, ERC-721,
ERC-1155

BEP-20, BEP-721,
BEP-1155-

Major Stablecoins

USDT, USDC, DAI,
TerraUSD

USDT, USDC, DAI,
TerraUSD

USDT, DAI, TUSD,
TerraUSD

DAI, BUSD,
TerraUSD

USDT, USDC, sUSD,
TerraUSD

Major DeFi Services

Uniswap, Maker,
Aave

Uniswap, Maker,
Aave

Maker, Aave,
Pangolin

Maker, Aave,
Pancake Swap

Reef, Curve

Major NFT Services

Flow, Enjin, Mana,
Opensea

Polygonpunks,
Opensea

NFTrade, Kalao

Juggerworld,
Treasureland

Bondly, Xen

Major Wallet

Metamask,
Trust wallet

Metamask,
Coinbase Wallet

Avalanche wallet,
Metamask

Metamask,
Trust Wallet

Polka Wallet,
Trust Wallet

26 GHOST (Greedy Heaviest Observed Subtree): A mechanism that makes the chain with the most accumulated calculations the correct chain.
27 PoSA:PoS (Proof of Stake) combined with PoA (Proof of Authority) Binance Smart Chain What is Binance Smart Chain? https://docs.binance.org/faq/bsc/bsc.html
28 https://chainstack.com/protocols/ethereum/
29 Account-Based: A method of managing and recording account balances as data, just like a bankbook.
30 UTXO-Based (Unspent Transaction output): Method to calculate and obtain the address balance based on transaction data only
31 Solana comparison to other chains https://www.reddit.com/r/solana/comments/qpt2bb/solana_comparison_to_other_chains/
32 Polygon PoS Chain Average Block Time Chart https://polygonscan.com/chart/blocktime

17[Column: Ethereum 2.0 Sharding33 ]Sharding is a multi-phase upgrade to improve Ethereum's scalability and capacity. This upgrade
is expected to be released in 2023. Features of sharding as follows.
---

Sharding is the process of horizontally partitioning a database to distribute the load, reducing
network congestion and increasing transactions per second by creating new chains called"shards.
The shard chain distributes the network load across 64 new chains and low hardware
requirements, making it easier for nodes to run.
In a shard chain, the validator only needs to run or maintain shards, which are small pieces ofdata, and does not need to validate the entire network. This speeds up processing and reduces
hardware requirements.
Sharding is said to eventually allow people to run Ethereum on their personal PCs andsmartphones without having to rely on intermediary services. It is expected that more people will
be able to participate as clients and execute transactions on sharded Ethereum.

Figure 1-3-1 Ethereum 2.0 sharding34*Beacon Chain in the figure will be the main chain of Ethereum 2.0.

33 Ethereum.org Shard Chain https://ethereum.org/ja/upgrades/shard-chains/
34 How Ethereum 2.0 Addresses the Problem of Rising Gas Prices and Scales Dai and DeFi https://blog.makerdao.com/eth2-0/

18

1-4-2 Blockchain Infrastructure Extension Service
The following is the overview and key technical characteristics of the following Layer 2 scaling solutions with the main objective of increasing
throughput and reducing gas fees
Table 1-4-2: Technical Characteristics of the Service for Extending the Functionality of the Foundational Blockchain
Scaling Solution

OptimismArbitrum-

Summary-

Developed by a startup
born out of Ethereum's
Plasma Group.
Compatible with
Ethereum EVMs.

-

Offchain Labs wasfounded and developedby researchers at
Princeton University.
The company uses its
own AVM (Arbitrum
virtual Machine), whichis compatible with
EVM.

Loopring-

Developed by Chinesestartup Loopring.
It is the first zk-Rollup
on the mainnet and is
focused on building its
own products andcapabilities at layer 2.

zkSync-Developed by Matter
Labs, a startup in
Berlin.
Compatible with
Ethereum EVMs.

Type of Rollup

Optimistic Rollup

Optimistic Rollup

zk-Rollup

zk-RollupService Launch

2021

2021

2019

2020

Founder

Jinglan Wang,
Karl Floersch,
Kevin Ho (Plasma Group)

Steven Goldfeder (CEO),
Edward W. Felten (Chief
Science Officer),
Harry KalodnerDaniel Wang
(Founder and CEO)Alex Gluchowski(Co-Founder & CEO)Development
Language

Solidity

Solidity, Vyper, Yul

Solidity

Solidity, ZincThroughput

500TPS

500TPS2,000TPS

2,000TPS

Major Stablecoins

USDT, USDC, DAI

USDT, USDC, DAI

USDT, USDC, DAI

USDT, USDC, DAI

Major DeFi

Uniswap, Maker, Aave

Uniswap, Maker, Aave

Loopring Exchange

Maker, SynFutures

Major NFT Services

Quixotic, Optipunks

STRATOS, tofuNFT

Gamestop

Tevaera, tofuNFT

19

Major Wallet

Metamask,
Coinbase Wallet

Metamask,
Coinbase Wallet

20

Loopring Wallet

Go Pocket,
FoxWallet1-4-3 Application Infrastructure and Applications
The technical characteristics of the following DeFi projects are described as below.
(1) Decentralized Exchange (DEX)
Table 1-4-3-1 Summary of major decentralized exchanges (DEXs)
DeFi Project

Uniswap

Curve FinanceSushiSwap-

Establishment,
Founder, Organization
management

Available
blockchain

-

-

-

Ethereum
PolygonAvalanche
BNB Smart Chain
OptimismArbitrum, etc.

Ethereum
PolygonOptimismArbitrum--

Outline, Features, etc.

-

TVL
(as of 4/20/2022)

Established in
November 2018
Founder: Hayden
Adams
Organization
management:
Uniswap.org

Protocol for token
exchange of
crypto-assets,
stablecoins, etc.
Automated Market
Maker (AMM)
automaticallydetermines thetoken exchange
price.
Liquidity providers
earn a fee forproviding liquidityof any token pairto the liquidity
pool.

$7.04B

Established inAugust 2020
Founder: Russianscientist Michael
EgorovMr. Egorov holds
71% of CRV(GovernanceTokens)Organization
management:
Curve DAO--

Decentralizedexchange
specializing in theexchange of
stablecoins.
It is said to bepossible to trade
betweenstablecoins withlow slippage rates
and transactionfees.

$10.32B

21

Established in
September 2020
Founder: Chef
Nomi, CoFounder: 0xMaki(bothpseudonyms)
In September
2020,
management
authority wastransferred to
Sam BankmanFried, CEO of
AlamedaResearch.
Organization
management:
Sushiswap core
team
Ethereum
PolygonAvalanche
BNB Smart Chain
OptimismArbitrum, etc.

--

Created as a forkof Uniswap in
September 2020.
Liquidity providers
can be rewarded
with SUSHI
tokens(governancetoken) for
providing liquidity.

$1.49BGovernance--

Incidents-

Voting by UNI
Approved by 2
votes
Snapshot Voting(Selection of
Proposal Targets)
GovernanceVoting (to approveor disapprove
implementation)
9/25/2020
When the $275
million was leakedin the attack on
the exchange
KuCoin, it was
exchanged for
ETH on Uniswap
and allegedly
laundered.
4/18/2020
ERC-777
Reentrancy
Vulnerability (see2-2-4) attack
results in$300,000 loss--

Voting by CRVApproved by 2
votes
Snapshot Voting(Selection of
Proposal Targets)
GovernanceVoting (to approveor disapprove
implementation)

-

-

-

-

22

11/11/2021
Governanceattack (hijackingof votes throughlarge purchasesof governancetokens) resulting
in $30 million inlossesVoting by SUSHI(Vote only once.)
Communities canveto at 40% of allissuedgovernancetokens.
Some (consideredsmall changes)
are not voted on,
but decided by the
management andthe core team.
9/17/2021
Supply chain
attack(incorporating
malicious code
into the source) of
the MISO platform(SushiSwap's
platform for IDOs
(fundraising bylaunching new
tokens on theDEX)) resulted ina $3 million
outflow(2) Stablecoin Issuance Platform
In this report, the discussion is based on the following two categories of stablecoins-

Digital money type stablecoins: Tether, USD Coin, etc.
Issued at a price pegged to the value of a fiat currency (e.g., 1 coin = $1) and redeemed at an amount equal to the issue price (and thoseequivalent thereto)-

Crypto-asset type stablecoins: DAI, TerraUSD, etc.
Some, like DAI, attempt to stabilize value by holding other crypto-assets and stablecoins as overcollateral, while others, like TerraUSD, areunsecured and attempt to stabilize value algorithmically.
Table 1-4-3-2 Overview of Major Stablecoin Issuance Platforms
DeFi Project

Maker (DAI)

Tether (USDT)USD Coin (USDC)

TerraUSD (UST)

Stablecoin Type

Crypto-asset type

Digital money type

Digital money type

Crypto-asset type-

Establishment, Founder,
Organization management

Available Blockchains

Established in
December 2017
Founder: Rune
Christensen (Danish)
Organization
management: In order
to increase the degreeof decentralization as adecentralized
autonomous
organization, theMakerDAO took over
operations of the Maker
Foundation in July
2021.
Ethereum
PolygonAvalanche
BNB Smart Chain-

Established in 2014
Issued and managed byTether Limited, a Hong
Kong limited company
iFinex (Hong Kong)
manages Tether andexchange Bitfinex-

Established in
September 2018
Issued and managed by
the Centre Consortium,
founded by Circle andCoinbase

Ethereum
PolygonAvalanche
BNB Smart Chain

Ethereum
PolygonAvalanche

23

-

-

Established in January
2018
Founder: Do Kwon
(CEO: Founder of
TMON, Korea), Daniel
Shin
Organization
management:
Terraform Labs (asubsidiary of Terra
alliance) operates
Seoul, Korea.

Terra
Ethereum
PolygonAvalanche

Optimism
Arbitrum
Loopring
zkSync, etc.

BNB Smart
ChainPolkadot
OptimismArbitrum
Loopring
zkSync, etc.

Polkadot
OptimismArbitrum
Loopring
zkSync, etc.

BNB Smart Chain
Polkadot, etc.

Outline, Features, etc.

Issue balance 35(as of 5/18/2022)$6.52B-

Governance-

Incidents

When a new DAI isissued, the price isstabilized by depositing
crypto-assets as
collaterals above the
DAI issue amount.

Voting by MKR
Approved byGovernance Poll(governance changes)
or Executive Vote(technical changes)
3/12/2020
The sharp drop in
market prices prevented
mandatory liquidationfrom catching up, andzero bids for collateralauctions resulted in aloss of $8.32 million(see 2-3-4).

-

It is believed that
Tether owns andmanages backing
assets equivalent to theamount of the USDT
issuance.

$79.71B-

It is believed that Circle
owns and manages
backing assets
equivalent to theamount of USDC
issuance.

$52.26B-$11.28B--

Operated and managed
by Tether Limited-

3/1/2021
Ransom attack
demanding 500 BTC
via forged documents
and threatening emails(no damage)-Operated and managed
by the Centre
Consortium--

35 Cryptocurrencies https://coinmarketcap.com/coins/

24-

Algorithmically control
the UST to maintain
1USD byadding/removing LUNA
(native token of Terra
blockchain).
Deposit USTs with
Anchor Protocol andearn up to 19.5% yield

Voting with LUNA
tokensVote only once.
Decided by more than
50% of agrrements by
the governance vote5/10/2022
A mounting commotion
occurred as the market
price fell due to thelarge volume of UST
sales and the inability tomaintain 1USD. Prices
fell 87%.

(3) Lending Platforms
Table 1-4-3-3 Summary of Major Lending Platforms
DeFi Project

Aave

Compound-Establishment,
Founder, Organization
management

Available
Blockchain-

Ethereum
PolygonAvalanche
BNB Smart Chain
OptimismArbitrumzkSync, etc.
-

Outline, Features, etc.

-

-

TVL
(as of 4/20/2022)

Established in November 2017
Founder: a serial entrepreneur
Stani Kulechov
Organization management:
Aavenomics community-

Ethereum
Avalanche
BNB Smart Chain

Lenders can earn a yield by
providing crypto-assets,
stablecoins, or other tokens to
the liquidity poolInterest rates are automaticallyadjusted based on supply anddemand.
Flash Loan (a transaction thatis completed from borrowing to
repayment within a single
transaction) can be executed.

--

Lenders can earn a yield by
providing crypto-assets,
stablecoins, or other tokens to
the liquidity poolInterest rates are automaticallyadjusted based on supply anddemand.

$11.46B$6.34B--

GovernanceVoting by AAVE
Approved by 2 votes
1) Snapshot voting (selectionof proposal targets)
2) Governance Voting(decision on whether toimplement)-

Incidents

Established in 2017
Founders: Robert Leshner,
Geoffrey Hayes (CEO andCTO of Compound Labs, Inc,software developer of theCompound protocol)
Organization management:
The Compound team is notconsidered to be involved in
the operation.

--(4) Derivatives platform

25

Voting by COMP
Vote only once.
Minimum 7 days from proposalof voting to its execution
Ability to disable a set ofservices in case of unexpectedvulnerabilities
10/4/2021
162 million in losses due tofaulty upgrades
9/30/2021
Upgrade Failure Leads to $90
Million in incorrect payments

Table 1-4-3-4 Summary of major derivatives platforms
DeFi Project

Synthetix

Opyn.

-

Establishment,
Founder, Organization
management

Available
blockchain

Established in
September 2017
Founder:
Australian Kain
Warwick
Organization
management: 5
DAOs
 Spartan Council
 Protocol DAO
 Synthetix DAO
 Ambassadors
DAO GrantsDAO
Ethereum
PolygonAvalanche
BNB Smart Chain

Ribbon Finance--

Ethereum--

Outline, Features, etc.
-

TVL
(as of 4/20/2022)

Governance

Allows users togenerate andtrade tokens(synthetic assets)
linked to the priceof fiat currencies,
stocks, andcommodities suchas gold and oil.
Synthetic Assets
are traded on a
dedicatedexchange called
Synthetix
Exchange(Kwenta).

Established in
2019
Founder: Zubin
Koticha, Alexis
Gauba, Aparna
Krishnan
Organization
management:
team of threefounders andpartners-

DeFi protocol thatallows users tobuy, sell, andcreate options
Allows users to
exchange option
spreads andcombos, execute
flash mint36(borrowing
unsecured options
up to repayment
within one
transaction), andautomatically
execute andcreate new
options atmaturity.

$276.1M$111.4M--

The Governing
Body approves
the two
improvement
proposals.
1) Improvement
proposal (SIP)
Spartan Council
interviews andapproves SIP
authorCore teammanages
operations
 Whitelist/Blackl
ist registration
 Module Update Oracle
Management
 Emergency
systemshutdown

36 What is a flash mint? https://github.com/opynfinance/v2-documentation

26-

Established in
February 2021
Founder.
Julian Koh(Former Coinbase
engineer)
Organization
management:
Ribbon DAO

Ethereum--

DeFi's various
derivatives can be
combined tocreate any
structured productPackagedfinancial productsthat use acombination ofderivatives toachieve specificrisk/returnobjectives, suchas betting on pricevolatility,
increasing yield,
or securing
principal$106.8M-

Voting with RBN
tokensVote only once.
Snapshot Voting
Judged by 50% ormore in favor oragainst2) Configuration
Change Proposal(SCCP)
Includessystem existing
parameterchanges,otherwise sameas SIP
Incidents

6/25/2019
Oracle Attack on
FX Price Feeds
Loses $1 Billion

Withdrawexcess token
balance-

10/8/2021
Airdrop (benefit)
attack converted$2.5 million after
outflow(5) Insurance
Table 1-4-3-5 Summary of major insurance platforms
DeFi Project
Establishment,
Founder, Organization
management
Available
blockchain

Armor
-

Outline, Features, etc.

-

Governance

Established in November 2020
Founder: Jose Macedo,
Azeem Ahmed, Robert Forster
Organization management:
ArmorDAO Community

Ethereum-TVL(as of 2022/4/20)

Nexus MutualProtect your investment fromthe risks of smart contracts incommon protocols such as
Uniswap, Maker, AAVE, etc.
Detects changes in balanceson supported protocols andprompts you to adjust yourplan accordingly. The exact
amount protected by each
protocol is billed in seconds.
Based on Nexus Mutual's
insurance, multiple protocols,
coverage, etc. added.

$511.5M38--

Established in May 2019
Founder: Hugh Karp,
Insurance Actuaries in the UK
Organization management:
Nexus Mutual Community
Ethereum
Solana.
Decentralized insurance
platform that allows risk
sharing for smart contract
vulnerabilities and other
unforeseen events
The company provides
decentralized insurance tousers on the blockchain using
ETH. A digital cooperative
operating as a voluntary
mutual in the UK, providing an"insurance alternative" toEthereum users37
Drawing experience fromprominent advisors andpartners such as Kenetic,
Blockchain Capital, Version
One, Semantic Ventures,
Collider Ventures, and others$481.7M

Voting with ARMOR tokens
Vote only once.
Hybrid control by two owners
1) Team multisig.

37 https://medium.com/multi-io/defi-explained-nexus-mutual-12d01f4471bb
38 https://www.stelareum.io/en/defi-tvl/protocol/armor.html

27-

Voting with NXM tokens
One screening and two voting
1) Decision making ofCompensation by Advisory
Board (White List)

Managed by the
management team
2) Governance Voting
User Voting
Incidents

2/28/2021
Loss of $850,000 due to a
fraud by the team member-

2) Advisory Committee Vote
3) Member Voting-

12/4/2020
Targeted attack on founder'spersonal address results in $8
million loss

※ KYC / AML Requirements for Nexus Mutual
To become a member, you must verify your identity using the KYC / AML process. If this fails, themembership fee will be refunded<Countries not eligible for membership>
China, Mexico, Syria, Ethiopia, North Korea, Trinidad and Tobago, India, Russia, andTunisia, Iran, Serbia, Vanuatu, Iraq, South Korea, Yemen, Japan, Sri Lanka(6) NFT (Non-Fungible Token Non-Fungible Token)
NFTs are generally unique, irreplaceable tokens within a smart contract that are recorded on
the blockchain, and are utilized for services such as associating easily replicable items such asimages, video, audio, and other types of digital files as metadata.
Table 1-4-3-6 Summary of main NFT services
DeFi Project
Establishment,
Founder, Organization
management
Available
blockchain

Outline, Features, etc.

Opensea-Established in December 2017
Foundar: Co-founders Devin
Finzer (CEO), Alex Atallah,
CTO
Organization management:
Opensea

Ethereum
Polygon, etc.
-

CryptoPunks-

Established in June 2017
Founder: Co-founders Matt
Hall, John Watkinson
Organization management:
Larva Labs

Ethereum
Polygon

NFT's largest project
The world's largest NFT
marketplace
Based in New York, U.S.A.

--

One of NFT's oldest projects
The First NFT art withownership of each piece of art
recorded in Ethereum
Purchased by Visa, a major
credit card company, and is
attracting attention.

Aggregate transaction
value39(as of 2022/4/20)$23.5B$2.66B

GovernanceOperated and managed byOpensea

Operated and managed by Larva
Labs

Incidents

10/14/2021
Emergency fix for security
vulnerability identified(measures completed in 1
hour, no damage)

39 NFT Marketplaces https://dappradar.com/nft/marketplaces28-

1-4-4 Aggregation
Table 1-4-4 Summary of DeFi Aggregators
DeFi Project

Instadapp-

Establishment,
Founder, Organization
management

Available
Blockchain-

Ethereum-

Outline, Features, etc.
-

TVL
(as of 4/20/2020)

Established in
December 2018
Founder: Sowmay
Jain (Co-founder& CEO)
Organization
management:
Instadapp
Community

A smart walletthat aggregates
DeFi protocols
such asMakerDAO,
Compound, andUniswap for
managing assets.
The dashboard
allows users to
see all DeFi in
one place.

$5.19B-

Governance-Voting with INST
tokensSnapshot(selection of
proposal targets)
Governance Vote(decision to
implement or not)DeFi Saver-

Ethereum---One-stop
management
application for
DeFi protocol.
Unique automatedasset
management andliquidation
protection
features.
Known as aleveragemanagement tool.

$509.7M-

Managed andoperated by Defi
Saver

-

-

-

Liquidity protocols
providedecentralized
token swaps as
automated market
makers (AMMs)
The protocol isdesigned tocapture themarginal gains ofarbitrage.

$14.5M-

10/8/2020
Loss of 310,000
DAI due tovulnerability intoken exchange
contract

Established in
December 2020
Co-founders:
Sergej Kunz,
Anton Bukov
Organization
management:
1inch DAO

Ethereum
Avalanche
BNB Smart Chain, etc.

-

Incidents

Established in
April 2019
Founder: Nenad
Palinkasevic(Co-founder)
Organization
management: Defi
Saver

1inch

Voting with 1INCH
tokensSnapshot(selection of
proposal targets)
Governance Vote(decision to
implement or not)-1-4-5 User and User Interface(1) User Interface
When users use DeFi's functions and services, such as crypto-asset purchases andexchanges and crypto-asset deposits into the liquidity pool, they operate transactions from theuser authentication screen or user operation screen (GUI: Graphical User Interface) of a web
browser or smartphone application.
(2) Operators (including administrators and authorized persons who deploy)29

DeFi system operation tasks, such as deployment and maintenance of smart contracts andmonitoring of DeFi protocol operation, are controlled from the user operation screen of the client
software.
(3) DeFi system developer
Develop and test DeFi protocols (smart contracts) using development tools such as Truffle.
(4) Code auditors
Auditing of smart contracts through auditing tools and test execution.
(5) Community participants
Posting opinions and proposals on the DeFi project community forum and on-chain voting withgovernance tokens.
1-5 Interoperability Analysis
Interoperability between DeFi projects deployed on the same blockchain as well as interoperability
between Ethereum blockchain and Layer 2 scaling solutions and main and side chains were analyzed
to examine their technical characteristics and challenges.
(1) Token interoperation between DeFi projects within the blockchain (Ethereum)
Ethereum has developed token standards such as ERC-20, and many DeFi projects are
issuing governance tokens and stablecoins in compliance with these token standards. The
tokens that comply with the standard can be used as the same type of operating target in any
DeFi project. A token that conforms to the standard can be used in any DeFi project as an
operating target of the same type. Therefore, interoperability is high.
However, it also means that any DeFi project could be linked to the project, so there is a risk of
unexpected attacks in transactions such as arbitrage.
(2) Interoperation between Ethereum mainchain and Layer 2 solutions
The use of Layer 2 solutions is growing as a scaling measure for Ethereum, and many DeFi
projects are adopting Layer 2 solutions. Layer 2 solutions are EVM compatible, and the samedevelopment languages and libraries as Ethereum work. On the other hand, it is still adeveloping technology, and there are issues such as the fact that validity is not verified at thetime data is written and transactions must wait for the fraud proof challenge period (e.g.,
Optimistic Rollup) to be confirmed.
(3) Interoperation between Ethereum main chain and side chains
The Ethereum mainchain and sidechains are provided with the ability to connect via a two-way
bridge, and many sidechains are operating in connection with Ethereum. Many sidechains are
EVM-compatible and function with the same programming language and libraries as Ethereum.
In addition, when funds are exchanged between the main chain and sidechains, it is possible tolock funds into a two-way bridge and exchange funds, preventing double payments.
In recent years, Ethereum transaction congestion and rising gas fees have led to increased
use of sidechains in search of faster processing and lower gas fees for gaming and otheractivities. At the same time, there is a growing risk that billions of dollars of large sums of money
are locked up in two-way bridges and targeted by attackers, and there have been a number ofincidents, as discussed below.

30

Chapter 2. Analysis of Major DeFi Projects
This chapter identifies issues, problems, and risk matters by selecting major DeFi projects andconducting a detailed study of their organization, stakeholders, technical characteristics, governance
operations, collaboration with financial institutions, and incident cases.
This chapter is organized as follows: in 2-1, we select the DeFi projects to be studied from threeservices: decentralized exchanges, stablecoin issuance, and lending; in 2-2 to 2-4, we report theresults of a detailed study of the three selected DeFi projects; in 2-5, we compare the results of theanalysis of the three DeFi projects to identify overall trends and the characteristics of each DeFi
project; and in 2-6, we examine incident cases that occurred in other DeFi projects and analyze risk
matters. Finally, in 2-7, the results of the analysis of trust points in the chain of trust is explained.
2-1 Identification of DeFi projects to be studied
With reference to indicators such as TVL and survey objectives, the following three services wereselected as targets from the six main DeFi projects mentioned above.
(1) Decentralized Exchange (DEX)This is a basic use case for DeFi, which automatically exchanges multiple cryptoassets/stablecoins, and therefore should be included in the study.
(2) Crypto-asset-based stablecoin issuance platform
Among DeFi projects that issue stablecoins, which are often used in crypto-asset and DeFi
transactions, crypto-asset-type stablecoins, whose issuance itself is also decentralized, shouldbe the object of the study.
(3) Lending Platforms
Since this is a basic use case of DeFi and TVL is the largest, it is the subject of the study.
2-1-1 Selection of DeFi Projects to be Investigated (Decentralized Exchange)
Regarding decentralized exchanges, based on the comparison of the following DeFi projects,
Uniswap is selected for investigation. Because of its large TVL, incident cases, and technicalcharacteristics that should be investigated, such as making smart contracts non-upgradeable, it wasdetermined that Uniswap was appropriate.
Table 2-1-1 Selection of DeFi Projects to be Investigated (Decentralized Exchange)
DeFi Project
Modification of existingsmart contracts(Addition of products
and services, changeof parameters, etc.)

Uniswap

Curve FinanceSushiSwap--

Only some of theparameters can be
modified-

Modified by Curve
team after
passage ofgovernance vote-

Modified by Curve
team after
passage ofgovernance vote

Modification of existingsmart contracts(modification of core
contract)-Core contract is
not upgradeable

31

After passing agovernance vote,determined by avote of 9community
members
After passing agovernance vote,determined by avote of 9community
membersDeployment of new
smart contracts(e.g., deploying new
smart contracts forversion upgrades, etc.)-

Conducted by thedevelopment
company(Uniswap Labs)

Emergency activation(e.g., emergency
suspension of service)-Core contract
cannot be
stopped.

Governance Token

UNI-

Number of addresses
holding governancetokens and percentageof addresses holding
such tokens

Governance Vote
Proposed Subject

Proposal approvalconditions

276,000
addresses
Percentage of 1stplace holdings:
17.34%
Percentage of top
10 addresses held
53.42%
Add or change
liquidity pools
Change numericalparameters suchas commissions
Proposed items
are not limited,
but the core
contract isunchangeable
and the topics
related to othertechnical
characteristics will
be limited as thescope of thegovernance vote.
1) Snapshot:
Select proposal
targets bysoliciting a wide
range of opinions
Quorum 50,000
UNI (0.05% of
total), majority of
votes cast in favor
2) Governance Vote:
Quorum of 40
million UNI (4% of
the total) to
decide whether or
not to implement
the proposal;
majority of thevotes cast are infavor.

-

Conducted by theCurve team-

Determined by avote of 9community
members.

-

After passing agovernance vote,determined by avote of 9community
members
Determined by avote of 9community
members.

CRV

SUSHI

-

-

-

-

-

52,000 addresses
Percentage of 1stplace holdings:
36.07%
Percentage of top
10 addresses held
83.60%

Add or change
liquidity pools
Change numericalparameters suchas commissions
Core contract
modification

1) Snapshot:
Quorum 30%,
51% in favor
2) Governance Vote:
Quorum 15%,60% in favor.

32

-

-

17,000 addresses
Percentage of 1stplace holdings:
18.19%
Percentage of top
10 addresses held
65.18%

Core contractchanges and use
of funds

1) Snapshot:
A quorum of 5
million SUSHI
tokens and amajority of thevotes cast are infavor.
2) Governance Vote:
Decided by amultisig of 9community
members after
being passed by
vote (6 of 9)

Number of votes (as of
12/12/2021)

1) 7 of 32 cases
passedApproval rate 22%2) 5 out of 6 approved
83% approval rate1) 60 of 68 approved
Approval rate 88a%2) All 14 cases passed
100% approval rate

13 of 15 cases passed
87% approval rate

2-1-2 Selection of DeFi Projects to be Investigated (Crypto-asset Stablecoin Issuance Platform)
For the crypto-asset stablecoin issuance platform, Maker is selected for investigation based on thefollowing DeFi project comparison results: the TVL is expensive, the transition to a decentralized
autonomous organization (DAO) is the most advanced case among the DeFi projects, and the other
DeFi projects are all centralized organizations run by companies, and Maker fits the purpose ofinvestigating a diverse set of subjects, it was deemed appropriate as a research target.
Table 2-1-2 Selection of DeFi Projects to be Investigated (Stablecoin Issuance)
DeFi Project
Modify existing smart
contracts (addproducts, services,change parameters,
etc.)
Modification of existingsmart contracts(modification of core
contract)
Deployment of new
smart contracts(e.g., deploying new
smart contracts forversion upgrades, etc.)

Maker (DAI)-

Voted on by
GovernanceTokens-Voted on by
GovernanceTokens-Voted on by
GovernanceTokens-

Decision by offchain voting:executed at
50,000 MKR (5%of total)

Emergency activation(e.g., emergency
suspension of service)
Governance Token
Number of addresses
holding governancetokens and its
percentage

Governance Vote
Proposed Subject

Tether (USDT)

MKR
76,000 addresses
Percentage of 1stplace holdings:
17.39%
Percentage of top
10 addresses held
45.38%
Two types of
proposals will be madedepending on thenature of the proposal
1) Governance Poll
Stabilization fees,
collateral ratiochanges, etc.
2) Executive vote
Technical
changes to theMaker protocol-

Implemented byTether Limited-

Implemented byTether Limited-

Implemented byTether Limited-

Implemented byTether Limited

USD Coin (USDC)-

Implemented byCentreConsortium-

Implemented byCentreConsortium-

Implemented byCentreConsortium-

Implemented byCentreConsortium

-

-

-

-

-

-

-

33

Conditions forpassage of a voting

Number of votes (as of
12/12/2021)

Same conditions
for both 1) and 2)
Quorum of 10,000
MKR (1%),majority is in favor
1) Approved 271 out of
302 cases, 90%
approval rate2) Approved 47 out of
48 cases, 98%
approval rate

-

-

-

-

2-1-3 Selection of DeFi projects for study (lending platform)
Regarding lending platforms, based on the comparison of the following DeFi projects, Aave isselected for the study because of its large TVL and its services rarely seen elsewhere, such as thelaunch of KYC services for institutional investors.
Table 2-1-3 Selection of DeFi Projects for Investigation (Lending)
DeFi Project
Modification of existing smart
contracts
Addition of products andservices, parameter changes,
etc.
Modification of existing smart
contracts (modification of core
contract)
Deployment of new smart
contracts(e.g., deploying new smart
contracts for version upgrades,
etc.)
Emergency activation (e.g.,
emergency suspension ofservice)
Governance Token
Number of addresses holding
governance tokens and its
percentage

Conditions for passage of avoting

Proposal approval conditions

Aave

Compound-Voting by Governance
Token

-

Voting by Governance
Token

-

Voting by Governance
Token

-

Voting by Governance
Token

-

Aave Core Team
determines-

Compound Labs
determines-

Aave Core Team
determines-

Determined by a multisigof 6 community members(4-of-6)

AAVE

COMP

-

-

100,000 addresses
Percentage of 1st placeholdings: 18.54%
Percentage of top 10
addresses held 62.30%
Two types of proposals will bemade depending on the natureof the proposal
1) Short-time lock execution
Some changes requiring
quick intervention, etc.
2) Long time lock execution
Changes affecting
governance
1) Short-time lock execution
Quorum of 2% anddifference in favor/against
is 0.5% or more
34-

181,000 addresses
1st place retention rate:
28.99%
Percentage of top 10
addresses held 54.32%-

Cast an on-chain voting(one time only)-

Proposal: 65,000 COMPs(0.65% of the total) infavor

Number of votes (as of
12/12/2021)

2) Long-time lock execution
Quorum of 20% and adifference in favor/against
is 15% or more
Approved 41 out of 50
cases, 82% approval rate-

Pass: 400,000 COMP (4%of the total) and a majorityof the votes cast-

Approved 32 out of 38
cases, 84% approval rate

2-2 Analysis of the decentralized exchange Uniswap
Uniswap is the subject of a detailed research study, including a project overview, governing body,
key technical characteristics, governance operations, and incident cases. Uniswap has some uniquefetures; a development company Uniswap Labs is considered to be involved to some extent in the
management of the Uniswap community, as well as Uniswap is unique in that it makes smart contracts
non-upgradeable. The investigation of each item clarifies the actual situation and identify risk issues.
2-2-1 Overall Project Overview
The main components of Uniswap, their mapping and community overview are shown in the figure
and table below.

35

Figure 2-2-1-1 Main components of Uniswap

36

Figure 2-2-1-2 Mapping of main components of Uniswap

37

Table 2-2-1 Uniswap: Community, Development Company, and Version Trends
Classifica
Item
Summary
Supplementary information
tion
Uniswap Community
Community
Operated by governor token
Active under the name of DAO.
holders (addresses held: 276,000)
Development andmanagement of Uniswap
Uniswap Labs
protocols and various tools
Organizat
Location: New York, United
Operation of the website
ion
Developmen
States(Uniswap.org)
t company
Founder, CEO: Hayden
SEC (U.S. Securities andAdams
Exchange Commission)
Date of fondation: Nov. 2018
reportedly conducted aninvestigation into Uniswap
Labs (Sep. 2021).40
1) Uniswap v1
Launched in November
2018
The three versions continue
Developed in Vyper
to operate separately.
language.
Uniswap v1 (as of March
Main Functions
2022)
 AMM (AutomatedTradable crypto-assets:
Market Maker)
approx. 200
 Liquidity pooling
Trading Pairs: 385(exchange of cryptoasset pairs) via ETH,etc.
2) Uniswap v2
Launched in May 2020
Developed in Solidity
language
Uniswap
Uniswap v2 (as of March
Main Functions
Version and2022)
Working Liquidity pooling among
Main
Tradable crypto-assets: 1,909
Versioncrypto-assets (not via
Functions
Trading pairs: 3,259
ETH) Flash SwapTWAP(time weighted average
price) Oracle, etc.
3) Uniswap v3
Launched in May 2021
Developed in Solidity
language
Main Functions
Uniswap v3 (as of March Liquidity aggregation2022)
functions (e.g.,
Tradable crypto-assets: 456
concentrated liquidity)
Trading Pair: 915
 Extended
commissions, (e.g.,
specification changes
to NFT, 3 commission
rates, etc.)

40 SEC Investigating Uniswap Labs: Report https://www.coindesk.com/policy/2021/09/03/sec-investigating-uniswap-labs-report/

38



Oracle Advancement,
etc.

2-2-2 Main Technological Characteristics
The main technological characteristics of Uniswap are outlined below.
(1) AMM (Automated Market Maker)41--

The smart contract automatically calculates the transaction price (exchange rate) based on
the amount of crypto-assets deposited in Uniswap's liquidity pool (pairs of crypto-assets tobe exchanged).
Compared to the order book method that was mainly used in the early DEX, off-chain
processing is not required and the order speed is faster (implemented since Uniswap v1).

Figure 2-2-1 Uniswap AMM42 (The Figure cited from Bank of Japan website)(2) Flash Swap43-

This is a mechanism that allows unsecured withdrawal and use of crypto-asset A in aliquidity pool consisting of crypto-assets A and B, provided that the sum of B and fees equal
to A are returned in a single transaction, and is mainly used for arbitrage.

-

If crypto-asset B is not returned, there is no transaction to withdraw crypto-asset A, and therisk of being unsecured is said to be mitigated.

-

Implemented in Uniswap v2

41 What Is an Automated Market Maker? https://www.coindesk.com/learn/2021/08/20/what-is-an-automated-market-maker/
42 Decentralized Finance in Crypto-assets The Emergence of Autonomous Financial Services and the Search for Governancehttps://www.boj.or.jp/research/wps_rev/rev_2021/data/rev21j03.pdf
43 Uniswap v2 Docs Flash Swap https://docs.uniswap.org/protocol/V2/concepts/core-concepts/flash-swaps

39

Figure 2-2-2 Uniswap: Flash Swap
(3) Concentrated Liquidity 44-

The ability to specify a price range at which liquidity is offered to the liquidity pool for
exchange.

-

It is a system that increases the capital efficiency of liquidity providers by specifying a pricerange for the liquidity pool and concentrating capital (similar to a limit order that specifies anupper and lower price range, and when the market price falls within the range, the pool's
crypto-assets are exchanged). Introduced in Uniswap v3, and it is estimated to improve
capital efficiency by 4,000x compared to v2.

-

If the market price moves outside of the specified price range, the liquidity of one of thecrypto-asset pairs will be depleted and no further commissions will be earned.

-

Liquidity positions for each liquidity provider are formed at different price points and withdifferent liquidity, so liquidity positions are managed with non-alternative tokens (NFT)
instead of the traditional alternative token (ERC20). Swap fees were continuously
reinvested in the liquidity pool in v1 and v2, but are no longer reinvested from v3.

44 Introducing Uniswap v3 https://uniswap.org/blog/uniswap-v3

40

Figure 2-2-3 Uniswap: Concentrated Liquidity Function<Description of figure 2-2-3>.
1) Uniswap v2 provides capital to the entire liquidity pool price range
In most liquidity pools, this large portion was never used and had low capital efficiency.
Example: DAI/USDC pair uses only 0.50% of capital for transactions between $0.99 and$1.01, but it is the price range that earns the most commissions.
*USDC (USD Coin): A dollar asset-backed stablecoin issued by Centre
2) Uniswap v3 can provide a concentration of capital to a specified range of liquidity pools
When market prices fluctuate within a specified range, capital is used effectively and capitalefficiency is improved.
It is possible to earn more commissions with less capital. In the event of large pricefluctuations, v3 has the advantage of offering less capital than v2, resulting in smaller losses.
(4) Flexible fees in v345-

Multiple fee categories offered per liquidity pool and liquidity provider-

Uniswap v1, v2 Fixed at 0.3% (hard coded)
Uniswap v3 Choose from 0.05%, 0.3%, or 1%.

Introduce a protocol fee switch, whereby governance token holders can earn a fee if
switched on by governance vote (default is off; currently off as of May 2022)


Uniswap v2: Governance vote enables governance token holders to earns 0.05% of
0.3% commission
Uniswap v3: Governance vote enables governance token holders to set between 1025% of commission

45 Uniswap v2 Overview https://uniswap.org/blog/uniswap-v2

41

Figure 2-2-4 Flexibility of Uniswap Fees

(5) Advanced Oracles-

Uniswap v246 : TWAP (Time Weighted Average Price) Oracle-Measure the market price at the start of each block, calculate the cumulative price (Σprice x block generation time interval) of any crypto-asset pair from that price and thetime required to generate between blocks, and calculate TWAP from the cumulative
price and time difference between any two time points

Uniswap v347 : TWAP efficiency improvementEfficiently obtain TWAP within the past 9 days, contributing to lower gas costs

46 Price Oracles https://uniswap.org/blog/uniswap-v2#price-oracles
47 Advanced Oracles https://uniswap.org/blog/uniswap-v3

42

Figure 2-2-5 Uniswap Oracle(6) Scaling-

Uniswap v3 is being deployed on Ethereum's Layer 2 solution as well as on non-Ethereum
blockchains to address the issues of high gas fees and slow processing speeds caused by
Ethereum's increasing number of transactions. Deployment.
Table 2-2-6 Uniswap Deployment Destination
Item

Summary

Supplementary information-

Layer 2solution

Optimism Uniswap v3 deployed shortly after
Optimism service launch in July
2021

Arbitrum Uniswap v3 deployed shortly after
Arbitrum service launch in
September 2021

Blockchain

Ethereum Uniswap v1, v2, v3
Polygon Uniswap v3
Polygon service launched in April
2019
Uniswap v3 deployed in December
2021

43

-

Optimistic Rollup scaling
technology can increase
processing speed and reduce fees.
However, because of the waiting
period until the transaction is fully
guaranteed, a third-party liquidity
provider must be used for
immediate processing (fees will
apply).

-

Arbitrum Rollup method is used,which utilizes Optimistic Rollup andtheir original Layer 2 solution“arbitrum one”-

Provide scaling solutions using
Polygon, Ethereum-compatible
blockchain network

(7) Possibility to change (upgrade) smart contracts
Table 2-2-7 Uniswap: Smart Contract Upgradability
Item

Summary

Supplementary information

1) Core Contracts
Uniswap v1, v2
Core contract is not upgradeable
by design
Possibility tochange smart
contracts

Uniswap v3
Core contract is not upgradeable
by design (except for fee
parameters)--2) External contracts other than core
Can be changed, added, or deleted
without restriction (including feechanges)-Core contract: Critical logic
covered, minimal design
Liquidity Pool, AMM, Flash Swap,
Concentrated Liquidity, Advanced
Oracles
Since the core contract cannot be
upgraded, a different set will be
implemented as a new version, andvulnerabilities will be fixed andfunctionality improved along with it.
External contracts outside the core:fees, peripherals, interfaces,
governance voting, etc.
Uniswap Labs to implement
following passage of governancevote(8) License management
Table 2-2-8 Uniswap: License Management
Item

Summary

Supplementary information

Licenseprotection forcore contracts

Commercial license protection for
Uniswap v3 protocol
Business Source License 1.1 limits
the license to a maximum of two
years of v3 source code use in acommercial or production
environment.
Licensing periods can be changed
or waived at any time through agovernance vote.
Licensed includes Smart Contracts,
Math Libraries, Peripheral
Contracts, Interfaces, andDeveloper SDKs
Source code can be referenced.
Source code was diverted toSushiswap in an earlier version,
but it is said that the purpose is toprevent other diversions for acertain period of time.48--

Uniswap Labs, the developer,
entrusted the license management
authority of the source code to agovernance token holder.
The case of not making it clear that
it is not open source without
making it reusable

2-2-3 Cooperation with Financial Institutions
Table 2-2-3 Uniswap: Cooperation with Financial Institutions
Item

Summary

Supplementary information

48 https://www.coindesk.com/tech/2021/03/23/uniswap-v3-introduces-new-license-to-spoil-future-sushis/44

Announced a tie-up with a Fintech
company to explore market entry into
the consumer finance domain.49-

Listed ETPs (exchange-tradedproducts) passively linked to UNI50
Listed through Valour (Swiss AssetManagement Company), a
subsidiary of DeFi Technologies(Canadian Tech company)

Cooperation
with Financial
Institutions

Sygnum Bank AG (Swiss digital bank)announced the launch of custody andtrading services for several DeFi tokens(governance tokens) and stablecoins(USDC) (June 2021)

Launch of custody and trading services(November 2021)
Commonwealth Bank (Australia)
launches 10 crypto exchanges andcustody services in partnershipwith Gemini Exchange andChainalysis.
Offer trading and custody of DeFi
related stocks (January 2022)
Arab Bank Switzerland(Switzerland) offers 10 different
crypto-asset services.

--

PayPal, Robinhood (U.S. stock
management app operator)
E*Trade (U.S. online brokerage
firm)Stripe (U.S. online payment), etc.
Frankfurt, Germany Stock market
Euro-denominated Valour Uniswap
ETP (October 2021)
Swedish Stock Market
Krona Jian Valour Uniswap SEK(December 2021)-

Crypto-assets covered: AAVE,
UNI, ANT, CRV, MKR, SNX,
1INCH

-

Commonwealth Bank: Establishedin 1911
Crypto-assets covered: BTC, ETH,
BCH, UNI, LINK, MATIC, AAVE,
COMP, LTC, FIL--

Arab Bank Switzerland:
Established in 1962
Crypto-assets covered: AAVE,
FTM, COMP, SNX, LINK, MATIC,
GRT, CRV, UNI, YFI

2-2-4 Governance operations

49 https://www.coindesk.com/business/2021/07/28/uniswap-says-its-talking-with-paypal-robinhood-and-more-in-deleted-video/
50 https://valour.com/press/valours-uniswap-exchange-traded-product-etp-goes-live-on-nordic-growth45

Figure 2-2-4 Governance Voting Process with UNI(1) Community
Table 2-2-4-1 Uniswap: Community
Item
Purpose ofthecommunity(summarizedfrom official
documentation)51

Summary--

community-

UNI (governance token) is introduced for the purpose of community-led
growth, development, and self- sustainability, enabling shared community
ownership and a vibrant, diverse, and dedicated governance system.
Uniswap has always embraced the tenets of neutrality and trust minimization:
it is crucial that governance is constrained to where it is strictly necessary.
Uniswap governance framework is limited to contributing to both protocol
development and usage as well as development of the broader Uniswap
ecosystem.
Decentralized Autonomous Organization (DAO) by the governance token UNI
holders
No legal representatives, no management bodies such as board of directors
or board of trustees, no auditors(2) Governance tokens (UNI)
Table 2-2-4-2 Uniswap: Governance Token
Item

Summary

Supplementary information

Distribution of
UNI

A total of 1 billion UNI will be distributed
over 4 years starting in September
2020.
Community Members:
60.00% (600 million UNI)Team members and employees:
21.266% (212.66 million UNI)
Investors:
18.044% (180.44 million UNI)
Advisors:
0.69% (6.9 million UNI)

51 Introducing UNI https://uniswap.org/blog/uni

46-

Already distributed about 500
million UNI (as of December 2021)
Undistributed tokens are locked tothe smart contract

Number ofaddresses
held by UNI52(as of Jan.
2022)

UNI Features--

Number of addresses held by UNI:
276,000
Percentage of 1st place holdings:
17.34%
Percentage of top 10 addresses
held 53.42%
Voting rights in on-chain voting(governance tokens)--

The 5-7 addresses of major UNI
holders (Whale) who are delegatedto vote are the major decision
makers (from Blog)53
A proposal to review the voting
method and proposal thresholds
were rejected.

-(3) Decision-making
Table 2-2-4-3 Uniswap: Decision Making
Item

DecisionMaking
Methods54

Summary

Supplementary information

Governance voting by UNI in thefollowing two phases
1) Snapshot
Vote twice: temperature check andconsensus check2) Governance Vote
Decide whether to implement the
proposal
Voting run for 7 days each in 1)
and 2) and 2 days in TimeLockafter passage.
1) 50,000 UNI (0.005% of total to be
distributed) in favor

Conditions forpassage ofgovernance
vote

Actualnumber of
votes cast
(2021)
Items that canbe proposedin theGovernance
Vote

-

-

-

-

The possibility of manipulation ofcommunity opinion by large UNI
holders or anonymous or
pseudonymous persons who have
temporarily purchased large
quantities of UNI in the market,
since the management ofgovernance is entrusted to UNI
holders.

-

Fewer proposals were made thanin other projects.

-

The core contract is nonupgradeable by design and cannot
be modified or stopped. No
countermeasures have been
determined in the event when avulnerability is discovered.

2) Proposal: 2.5 million UNIs (0.25% of
total to be distributed) in favor
To pass: Quorum 40 million UNI (4%of total to be distributed), majority of
votes cast is in favor
1) 27 out of 35 approved (77% approvalrate)2) 6 out of 7 approved (86% approvalrate)1) Addition, modification, or deletion of
external contracts other than core
Interfacing with other blockchains(e.g., new deployments)
Renewal of Governor Bravo*(contract for governance), etc.

Snapshot voting is conducted offchain and governance voting is
conducted on-chain.
Temperature check: determine if
there is sufficient will to change thestatus quoConsensus check: Establish aformal discussion of the proposal

52 Etherscan Token Uniswap https://etherscan.io/token/0x1f9840a85d5af5bf1d1762f925bdaddc4201f984
53 https://gov.uniswap.org/t/consensus-check-abolish-delegates-and-change-the-uni-governance-voting-system/13458
54 https://docs.uniswap.org/protocol/concepts/governance/process472) Addition, modification, and deletionof parameter values
Add/ delete liquidity pools
Change parameter values such ascommissions
Change fee settings/ change
protocol fee switce (on/off)Allow UNI holders to collect a
portion of liquidity provider fees
(governance vote allows for fee
collection), etc.

-

3) Change in community management
Use of community funds (e.g.,
education funds)
Changes in governance operations(thresholds for governanceproposals, review of voting
methods)
4) Modification of the term of core
contract commercial use prohibition
license, waiverv3 has a two-year ban oncommercial use in the license, but
the license control can be changed
by a governance vote.

--

Large UNI holders can manipulate
commission profits by voting, andthere are no preventive measures.
If some UNI holders collude to takethe majority, there is a concern thatprofits will be defrauded. However,if fraud is discovered, participants
will leave and the market will
shrink, which may result in a selfcleansing effect.
A two-year license was introduced
to prevent diversion to otherprojects, but a governance votecan allow this to be overturned.

※ Governor Brabo:-

Smart contract for governance developed by Compound and deployed at Uniswap
Adopted by governance vote.
<Features>








Upgradeable smart contracts in Governor Brabo itself
Add "Abstain" option for voting
Added the ability to add comments when voting
Ability to change voting parameters (voting period, extension of voting body, quorum
thresholds)
Proposer can cancel his/her proposal
Delete Guardian (Governance Manager)
Sequential numbering of proposal IDs is possible(4) Addressing incidents
Table 2-2-4-4 Uniswap: Response to Incident
Item
Emergency
Measures toincidents

Summary-

Supplementary information

Core contract cannot be modified
and cannot be suspended.
External contracts, interfaces,parameters, etc., other than the48-

Core contract vulnerabilities, even
if discovered, cannot be fixed
If the attack cannot be stopped
from the outside, it cannot be
defended against and can be fatal.

Persons
authorized toinitiate
emergency
response

core can be urgently modified by
the development company
There are no specific rules, and there isno clear authority holder.
- It is assumed that emergency
measures will be implemented at
the developer's own discretion-

Compensatio
n fordamagescaused byincidents

Damage due to incidents, etc., is the
responsibility of the user and nocompensation will be provided (asspecified in Terms of Service55 ).

In the event of an emergency, it isassumed that the developer willtake action at its discretion, and the
UNI holder's involvement will belimited.
In the event of a major loss to auser, compensation from
community funds may be proposedin a governance vote, etc., but may
not be appropriately determined
depending on the circumstances ofthe loss to the large UNI holder.

(5) Other
Table 2-2-4-5 Uniswap: Other Matters
Item

Matters thatcan beimplemented
by thedeveloper

Anonymity of
UNI holders

Summary

Supplementary information

Deployment of new version of smart
contracts- Core contract upgrades are initiatedby the development company
Modification of external contracts,
interfaces, and parameters outside of
the core- Some actions on matters passed bygovernance vote and some at thediscretion of the developer (minor
modifications, such as gas fee
reductions).
- UNI holders are, in principle,
anonymous, making it difficult to
identify the actual entity.
- UNI holding addresses can be
identified, but in many cases cannot
be linked to real names because
KYC is not performed-

The developer decides what newfeatures to include in new versions,so there is a concern that thecommunity's opinions will not bereflected.

-

The code can be modified without
going through the community at thediscretion of the development
company.

-

Possibility that if a problem is
discovered with a voting decision,
the UNI holders involved in thedecision making cannot be
identified and the decision cannot
be reversed or the decision makers
cannot be held accountable.

2-2-5 Incident cases56
The following is an overview of the April 2020 incident case of the reentrancy vulnerability57 , thereasons for its occurrence, and the issues involved.
(1) Date of Occurrence: April 18, 2020
(2) Damages: Approximately $300,000

55 Uniswap Labs Terms of Service https://uniswap.org/terms-of-service
56 https://peckshield.medium.com/uniswap-lendf-me-hacks-root-cause-and-loss-analysis-50f3263dcc09
57 Reentrancy vulnerabilities are vulnerabilities that cause unauthorized execution of recursive processes (i.e., calling the sameprocess again before the smart contract process is finished, causing the transfer to be executed multiple times before the balanceis drawn, for example)

49

(3) Summary of Incident
On April 18, Uniswap was subjected to a reentrancy attack by an attacker who stole
approximately $300,000.
On April 19, another DeFi protocol, Lendf.Me, was attacked using the same technique, andapproximately $25 million was stolen.
In the transfer of funds after the Lendf.Me attack, the attacker directly used the services of acrypto-asset exchange, which led to the detection of metadata that could lead to theidentification of the attacker. This information allowed Lendf.Me to negotiate with theattacker and 99% of the funds were returned.

Figure 2-2-5-1 How the Uniswap Reentrancy Vulnerability Works

Figure 2-2-5-2 Outline of the attack
1. 4/18 Uniswap suffered a reentrancy attack and approximately $300,000 was stolen.
2. 4/19 Lendf.Me was attacked with the same technique and approximately $25 million wasstolen.
3. 4/19 Attacker directly used the services of a crypto-asset exchange during a fund transfer andmetadata of the attacker’s identity was detected
4. 4/21 Identity of attacker revealed, Lendf.Me negotiated, 99% of funds returned(5) Stolen funds and crypto-assets

50

Uniswap about $300,000 imBTC, ETH
Lendf.ME About $25 million WETH, USDT, HBTC, imBTC and 12 others in total(6) Cause of Occurrence
Due to reentrancy vulnerabilities in Uniswap and Lendf.Me smart contracts- There was a reentrancy vulnerability due to the lack of ERC-777 token support.
- Crypto-assets were received by abusing the approval request function of the ERC777 token
and re-calling it during the processing of the crypto-asset exchange.
(7) Incident Issues
Table 2-2-5 Uniswap Reentrancy Vulnerability Issues
Item

Sub-ItemPhenomenal
Factor

Deployment

Description of issues-

There was a re-entrancy vulnerability in the ERC777 token.
Uniswap v1 was attacked by an attacker due to a reentrancy
vulnerability caused by inadequate support for ERC-777 tokens.

-

Vulnerability in the source code was pointed out in the code audit, but it
was decided to fix it in the next version and no immediate action was
taken.
ConsenSys Code Audit Report in December 2018 (for immediate
release)58 , where this matter was noted.
 Severity: Major (the second most severe rank after Critical out offour.)
 There were a total of seven findings in the audit report, and thisfinding was the most significant.
 3.1 Liquidity pool can be stolen in some tokens (e.g. ERC-777)
The vulnerability in this case had been pointed out to us before theincident occurred, but the plan was to address it in the next version of
the software because then core contract can not be modified.
 Uniswap v1 core contract cannot be modified, so a change wasmade so that ERC777 tokens are no longer accepted. (Details
unknown)
 The vulnerability has already been fixed in v2.
The vulnerability was pointed out in the code audit, but the code could
not be modified due to the specifications of the core contract.
The results of the code audit were reported to Uniswap Labs
(addressed to CEO Hayden Adams), and it is believed that thevulnerability was recognized by the development company
management.

-

Deployment-

Motivatio
nal
Factors

Governance-

2-2-6 Uniswap Main Trust Points(1) Uniswap Labs (Development Company)-

Based in NY, USA, the company is believed to develop and manage the Uniswap protocol
and various tools, as well as operate user interfaces (websites, etc.).

-

In light of the Company's plans to hire a community lead, it is assumed that the lead will havea certain degree of influence over the operation of the Uniswap community.

-

Uniswap Labs approval would be required to implement the proposal as passed in thegovernance vote.

58 ConsenSys Uniswap-audit-report-2018-12 https://github.com/ConsenSys/Uniswap-audit-report-2018-12#31-liquidity-pool-can-be-stolen-in-some-tokens-eg-erc-777-29

51

(2) Venture Capital-

Approximately 18% of UNI has been distributed to early investors, suggesting that someinvestors have a strong influence in governance voting.

(3) Code Auditing Company-

It is assumed that users trust the results of audits by code auditing companies and use theprotocol.

(4) Wallet Provider-

Many users use a small number of non-custodial wallets such as Metamask (not only for
Uniswap, but for DeFi in general), and the impact of a vulnerability in a wallet would besignificant.

Figure 2-2-6-1 Main trust points (components) of Uniswap

Figure 2-2-6-2 Uniswap Main Trust Points (Governance Voting)52

2-3 Stablecoin Maker (DAI) Analysis
The survey research was conducted on the project overview, management organization, maintechnological characteristics, governance operations, and incident cases, with Maker as a studey
target. Maker is characterized by the fact that the founding company, the Maker Foundation, wasdisssolved and transitioned to the MakerDAO, that it has established teams and rules for DAO
operations by role, and that it is actively expanding into the real world in cooperation with financial
institutions. The survey clarified the actual situation and analyze issues, problems, and risk matters ineach of these areas.
2-3-1 Overall Project Overview
The main components of Maker, their mappings, and community overviews are shown in the chartand table below.

53

Figure 2-3-1-1 Main components of Maker

54

Figure 2-3-1-2 Mapping of Maker's main components

55

Table 2-3-1 Maker: Community and Related Corporations
Item

Summary

Supplementary information

MakerDAO
On-chain voting by governancetoken MKR holders: 83,000
addresses
MakerDAO has two management
teams as follows

Community(MakerDAO)

1) Domain Team (as of May 2022)60
Add collateral assets and design
oracle mechanisms.
ⅰ) Collateral Engineering Services
Team
Manage new collateral
implementation and maintenanceprocesses, includingⅱ) Oracle Team
Design of a new collateral type
oracle feed mechanism, etc.
ⅲ) Smart Contract Team
Adapter development anddeployment of new collateral, etc.
ⅳ) Risk Team
Risk analysis, etc., related tocollateral types for which additional
proposals have been madeⅴ) Legal Team
Create collateral legitimate work
product, etc.
Facilitators and contributors fromeach team leads the operation.
(2) Core units (as of May 2022)61
22 teams in total, with one facilitator fromeach team leading the operation
Real-World Finance
Risk
GovAlpha
Protocol Engineering
GrowthSustainable Ecosystem Scaling
Oracles
Governance Communications
Dai Foundation
StarkNet Engineering
Collateral Engineering Services
Development and UX-Founded in December 2014
Based in: California, USA 59
Founder: Rune Christensen
In July 2021, the Maker Foundation(Denmark) was dissolved and its
assets was transferred to
MakerDAO, a highly decentralized
and autonomous organization.

-

Domain teams are comprised ofindependent individuals and others
contracted by the MakerDAO.
On-chain voting approves domainteam composition and personnel
selection
The work of each team wasinherited from the Maker
Foundation.
Assume low quality risk at this time
as many of the domain team willcontinue to be involved in codedevelopment and operations from
the Maker Foundation.

-

-

-

-

-

-

The Core Unit is comprised ofindependent individuals and others
contracted by the MakerDAO.
On-chain voting approves thecomposition and selection of coreunit members.
The work of each unit was inheritedfrom the Maker Foundation.
Assumes low quality risk at this time
as many of the core units are likely
to continue to be involved in codedevelopment and operations from
the Maker Foundation.

59 https://www.crunchbase.com/organization/makerdao
60 MIP7: Onboarding and Offboarding Domain Teams (Collateral Onboarding)https://mips.makerdao.com/mips/details/MIP7#sentence-summary
61 MIP38: DAO Primitives State https://mips.makerdao.com/mips/details/MIP38#makerdao-shop-mds-001-

56

-Strategic Happiness
Data Insights
Deco Fixed-Rate
Immunefi Security
Sidestream Auction Services
Strategic Finance
TechOpsEVENTS
Content Production
MakerDAO Shop

RWA Company LLC62--

AffiliatedCompany--

The goal is to connect the traditional
credit market to MakerDAO to
extend the collateral for generating
DAI in the Maker protocol (Maker
Vault) from crypto-assets to real
assets.
Representing the Maker communityand helping clients (loan originators,etc.) borrow capital (DAI) at a lower
cost of capital through the Maker
Vault
Conclusion of various contracts withclients on behalf of DAOs who havedifficulty becoming a contracting
entity, etc.
Ensure transparency by providing
reports to MKR holders

DAI Foundation63--

A corporation to protect the Maker
community's intellectual property(trademarks, domain names,
software, SNS accounts, etc.)
In early 2020, the Maker Foundationtransfers trademark rights of Maker
and DAI to DAI Foundation.

-

-

-

-

Founded in May 2021
Location: Cayman Islands (under theFoundation Company Law of the
Cayman Islands)
CEO: Gregory Di Prisco, former
Maker Foundation Business
Development Lead

Founded in January 2020
Location: Denmark64
Chairman: Solen PeterNielsen,
former Head of Product at Maker
foundation
The Board of Directors consists ofsix members.

2-3-2 Main Technological Characteristics(1) Maker Vault 65-

Stablecoin DAI is generated by depositing collateral assets (crypto-assets such as ETH or
stablecoins such as USDC) into the Maker Vault contract
A Stability Fee is charged when DAI is returned. If the fee exceeds the threshold, the DAI
and MKR are exchanged at the Surplus Auction, and the MKR used for bidding is burned.
Interfaces built by Oasis66 and the community (Instadapp, Zerion, MyEtherWallet, etc.)
makes it easy to access to the Maker Vault.

62 RWA Company https://www.rwa.company/
63 The DAI Foundation https://daifoundation.org/
64 Announcing the Dai Foundation https://forum.makerdao.com/t/announcing-the-dai-foundation/1046
65 Makerdao Whitepaper Maker Vaults https://makerdao.com/en/whitepaper/#maker-vaults
66 https://oasis.app/

57

-

-

If the value of collateral falls below the liquidation ratio due to a decline in the value ofcollateral or other reasons, the collateral is automatically (compulsorily) liquidated through a
Collateral Auction.
The liquidation ratio is selected by on-chain voting for each collateral asset: around 150% for
ETH, 101% for USDC, etc.67 .

Figure 2-3-2-1 Maker Vault Overview(2) Stablecoin DAI68
Convert ETH to stablecoin DAI or DAI to ETH.
ETH is not an ERC20 token, so it is converted to an ERC20 internal token within the Maker
protocol before trading with others.
For depositing funds into the Vault collateral rules and clearing funds through Auction, Maker
prortocol internal tokenare used to exchange to avoid influence of external market prices.
Table 2-3-2 Maker: Summary of Stablecoin DAI
Item

Summary

Supplementary information--

Generate DAI-

Generate DAI (crypto-asset-backed
stablecoin) issued by locking
excess collateral into the Maker
Vault
 MCD: Multi Collateral DAI
Support multiple collateral
assetsSoft-pegged to USD. 1DAI = 1USD
DAI savings rate (DSR) is
determined by on-chain voting

67 https://daistats.com/#/collateral
68 https://makerdao.world/en/learn/Dai
69 https://daistats.com/#/overview

58-

The collateral to be deposited with
Vault depends on the collateral
assets. If the collateral ratio(liquidation ratio) is 150%,
collateral equivalent to at least 150
USD is required to generate 100
DAI
The main collateral assets
supported and the share of each
asset in the total amount ofcollateral layers.69
 USDC (51.5%)

Buy DAI--

Earn DAI
-

-

-

-

Borrow DAI

Exchange for fiat currency at
crypto-asset exchanges
Exchange for cryptocurrency on a
crypto-asset exchange
Exchange at DEX
 Uniswap, 1inch Exchange, etc.
Exchange in the P2P marketplace Local Cryptos, Local Bitcoins,Bisq, etc.
Interest income
 Earn interest by locking yourDAI holdings into a DSR (DAI
Savings Rate) contract
contract Access via various connection
methods to the Oasis Portal or
Maker protocol
 Parameters related to DAI
savings rate determined by onchain governance If DAI exceeds 1USD, MKR
holders are incentivized tolower DSR to reduce demand,and if DAI is less than 1USD,
MKR holders are incentivized
to raise DAI to stimulate
demand.
Rewards
 Bug bounties (rewarding those
who find protocol bugs), etc.
Grants Maker's development grant
programs (e.g., Gitcoin
Grants)Lending on lending platforms, etc.
 Lending DAI on platforms suchas Compound, AAVE, dYdX,
etc.
Hackathon MakerDAO Hackathon
Initiative, etc.
Video Game Tournaments
 Axie Infinity (tournament
reward)Borrowing through Maker or thirdparty lending platforms, etc.
 Borrow DAI with required
collateral on platforms such as
Oasis Borrow, Compound,
AAVE, and dYdX

59

-

-

-

ETH (22.3%)
WBTC (6.6%)
USDP (5.3%), (as of April
2022)

-

-

Use DAI--

Receive DAI-

Donations to Charity
 UNICEF, NeedsList (disaster
relief), PoolDai (charitableorganization donation fund),etc.
Online purchase (e-commerce) OpenSea (NFT), Decentraland(land on virtual space), Gods
Unchained (digital goods), etc.
DAI Debit Card Crypto.com, Fold App (buybitcoin), Monolith (connect
Visa debit card to noncustodial wallet), Wirex, etc.
Gaming and Gambling CelerX (eSports), Pool
Together (lottery)
Purchase Gift Cards
 Bidalli
Bill Payment
 Gold Plus Energy (U.S.-Texas,
electricity payment), living
Room of Satoshi (Australia)
Coinbase Commerce (digitalmoney payment)
Ching-Store (mobile store)
Request Network (Billing Process)
GILDED (on-chain accounting
services)--

Payroll by DAI-

Whisp Money (payroll solution
without KYC)
Sablier

Possibility of gradual increase in
use in the real world as well as in
the crypto-asset market

Some communities (Concource
Open Community) use DAI to pay
outside employees whose identities
are difficult to guarantee, such as
those working remotely fromoutside the country.

[Reference: Conversion of stablecoin DAI70]ⅰ) ETH to WETHETH is not an ERC20 token, so it is converted to WETH (Wrapped ETH), an ERC20 token, so
it can be traded with others. 1ETH = 1WETHⅱ) WETH to PETHWETH is converted to PETH (Pooled ETH) and pooled as collateral in the Vault.
PETH is a crypto-asset dedicated to MakerDAO Converted by Maker's internal rate
(1 WETH = 1.04 PETH, etc.).
ⅲ) PETH to DAIGenerate DAI based on PETH. Converted by rate (from DAI/ETH market price).
ⅳ) DAI to SIN
When liquidating DAI, it is converted to SIN before liquidation. 1DAI = 1SIN

70 MakerDAO Tokens Explained: DAI, WETH, PETH, SIN, MKR. Part 1 https://medium.com/coinmonks/makerdao-tokens-

explained-dai-weth-peth-sin-mkr-part-1-a46a0f687d5e60

Figure 2-3-2 Maker Stablecoin DAI Conversion(3) Direct Deposit DAI Module (D3M)71
A mechanism that works in conjunction with third-party lending protocols to efficiently
transfer DAI to the liquidity pool of such protocols, thereby adjusting the variable interest rateof DAI to be below the target interest rate determined by Maker governance (governancevote).
Automatically deposit/withdraw DAI to ensure target interest rates are met.
Already applied to Aave and Compound; application to Maple under consideration (undervote) (as of March 2022).

71 Maker Direct Deposit Dai Module (D3M) https://governance.aave.com/t/the-maker-direct-deposit-dai-module-d3m/3514

61

Figure 2-3-2-3 Maker D3M Overview(4) Liquidation System 2.072
When the collateral ratio falls below a predetermined level and the Vault is forced into
liquidation, the collateral assets deposited in the collateral-deficient Vault are auctioned toliquidate the liabilities (DAI). Auction participants acquire collateral assets by bidding for DAI.
New clearing mechanism for Dutch auction method launched in April 2021.
Auction bids are reduced until collateral is purchased
Allows partial bids and allows one or more bidders to split the auction amount by dividing theasking price to purchase the collateral.
Support for Flash Loan, which allows participants to participate in auctions by borrowing andrepaying at the same time, even if they do not have the original funds.
Auction bidding times and bid reduction rates are selected by on-chain voting.

72 Maker Protocol Technical Docs Liquidation 2.0 Module https://docs.makerdao.com/smart-contract-modules/dog-and-clipper-

detailed-documentation

62

Figure 2-3-2-4 Overview of Maker Liquidation System 2.0(5) Oracle management73
The Maker protocol calculates the median price of the required market price (e.g. ETH/USD)
from a set of prices received from the Oracle price feed (refer to 24 external market prices
such as Aave, Compound, Uniswap, etc. at74 (as of April 2022)) and determines thereference price required for DAI issuance, collateral clearing, etc. Determination of reference
prices required for DAI issuance, collateral liquidation, etc.
The Oracle Security Module (OSM) intentionally delays price reflection by one hour torespond to sudden market fluctuations and oracle attacks (e.g., when collateral asset prices
drop significantly, it is possible to take measures such as pledging additional collateral to
avoid liquidation).
The referenced price feed destinations, etc. are selected by on-chain voting.

73 Makerdao Community oracle https://github.com/makerdao/community/blob/master/faqs/oracles.md
74 MIP10c17: Subproposal for List of Feeds https://github.com/makerdao/mips/blob/master/MIP10/MIP10c17-List-of-Feeds.md

63

Figure 2-3-2-5 Maker Oracle Management Overview(6) Maker Protocol Auction-

Upon forced liquidation, the Maker Protocol acquires the liquidated vault collateral and sells
it using an auction mechanism.
Table 2-3-2-6 Maker: Protocol Auction Summary
Item

Maker
Protocol
Auctions75

Summary

Supplementary information

1) Surplus Auction
If DAI exceeds the Maker buffer limit,
the excess DAI is used to purchase
MKR tokens as surplus to reduce theamount of MKR tokens
2) Debt auctions
When DAI is insufficient foroutstanding obligations, MKR tokens
are issued and sold to bidders tosecure DAI3) Collateral auction
Forced liquidation of collateral bycharging a liquidation penalty in theevent of collateral shortages due tofalling token prices, etc.

-

(7) Keeper
Table 2-3-2-7 Maker: Keeper Summary
75 Maker Protocol Technical Docs The Auctions of the Maker Protocol Auctions https://docs.makerdao.com/keepers/the-auctions-of-the-maker-protocol

64

Item

Summary

Supplementary information-

Keepers are external agents(mainly BOTs) that run
automatically for arbitrage
according to an algorithm-

Market Maker Keeper
 DAI will be sold when DAI isabove the target price (1USD)
and DAI will be purchased
when DAI is below the target
price. 24 designatedexchanges (Binance,
Coinbase, etc.) can build
keepers77

Keeper76--

Market Maker Keeper automatically
executes trades by referencing themarket price on the designatedexchange.

Auction Keeper Participate and bid in surplus,
debt, and collateral auctions(8) Flashmint
Table 2-3-2-8 Maker: Flashmint Overview
Item

Summary-

Flashmint78-

Supplementary information

DAI can be created under thecondition of borrowing and returning(including fees) in one transaction.
Arbitrage opportunities available
with no collateral required-

There is a debt limit (DAI/ETH: 15
billion ETH, etc.)(9) DAI Savings Rate (DSR)
Table 2-3-2-9 Maker: Summary of DAI Savings Rates
Item

Summary-DAI Savings
Rate (DSR)79--

Supplementary information

Any DAI holder can earn intereston their savings.
Access via Oasis Save Portal or
Maker Protocol Gateways
The parameters that determine theamount of money a DAI holder getsare determined by on-chain
governance
If DAI exceeds 1 USD, MKR
holders lower their DSR; if DAI isless than 1 USD, MKR holders
raise their DAI.

-

76 Maker Protocol Technical Docs The Auctions of the Maker Protocol Keepers https://docs.makerdao.com/keepers/the-auctions-of-the-maker-protocol
77 MakerDAO market-maker-keeper https://github.com/makerdao/market-maker-keeper
78 Maker Protocol Technical Docs Flash Mint Module https://docs.makerdao.com/smart-contract-modules/flash-mint-module
79 Makerdao whitepaper The DAI Saving rate https://makerdao.com/en/whitepaper/#the-dai-savings-rate65

(10) GSM (Governance Security Module)
Table 2-3-2-9 Maker: Overview of GSM
Item

Summary-

GSM80

Supplementary information

The GSM allows for a certain
amount of time to wait for code
amendments and other actions
after a proposal is passed by agovernance vote.
Review changes made to thesystem and, if those changes are
deemed malicious, respond with aproposal cancellation (likely to be
implemented by the core team) oran Emergency Shutdown (voted on
by MKR holders) during the GSM
delay time-

GSM delay time is 48 hours (as ofJanuary 2022)(11) Dark Spell Mechanism
Table 2-3-2-10 Maker: Overview of Dark Spell Mechanism
Item

Summary--

Dark Spell
Mechanism81

Supplementary information

Mechanisms for modifying smart
contracts to fix criticalvulnerabilities
Apply protocol fixes without
downtime
Work Process
1) Darkspell (modified code)developed by MakerDAO's SmartContract Domain team.
(Code is kept secret until thecorrection takes effect to prevent
reverse engineering to read thecontents during the on-chain
voting and GSM delay period
before the correction code isapplied.)2) Communicate dark spells tocertain members in thecommunity and trusted third
parties.
3) Trusted third party quickly
coordinates discussions andrecognizes votes.
4) Trusted third party directs thegovernance facilitator toschedule a voting.
5) Wait for GSM delay period after
voting is scheduled and passed.

--

Interested parties
 Smart Contract Domain Team Governance Facilitator Trusted Third Party (selectedby on-chain voting. Currently
not registered) Certain members of the Maker
community (not to bedisclosed)
A different process than regulargovernance and executive voting Voting time is set to 24 hours(fixed) No quorum or threshold for
passage of the vote is defined.

80 Makerdao whitepaper Governance of the Maker Protocol https://makerdao.com/en/whitepaper/#use-of-the-mkr-token-in-maker-governance
81 Makerdao MIP15: Dark Spell Mechanism https://mips.makerdao.com/mips/details/MIP15#sentence-summary666) Apply the code modification after
the GSM delay period has
elapsed.
7) Trusted third party and smart
contract domain team to create adarkspell post-mortem analysis
and publish it to the entire
community.

(12) Emergency shutdown
Table 2-3-2-12 Maker: Summary of Emergency Shutdown
Item

Summary---

Emergency
Shutdown82

Supplementary information

Ability to shut down the Maker
protocol to protect it from malicious
attacks or to facilitate Maker
protocol upgrades.
MKR holder deposits MKR in the
Emergency Shutdown Module(ESM), which is immediately
executed when the threshold isexceeded.
Execution is done in 3 phases,
followed by redeployment
depending on the cause of theoutbreak1) Maker protocol shutdown
Oracle Price Feed Frozen, Vault
Owners Withdraw Assets
2) Auction processing after
emergency stop
After the shutdown starts, forced
clearing by collateral auction
starts, and the protocol stops
after all auctions are completed.
3) DAI holder claims the remaining
collateral
DAI holders claim collateral
directly at a fixed rate
Vault holders have priority over
DAI holders
4) Redeploy protocols according to
the nature of the attack
 Governance Attacks
Disable the attacker andredeploy with everything else
intact Oracle Attack
Fix the oracle module andredeploy with everything else
intact Black Swan Event--

Threshold for initiating emergency
shutdown is 75,000 MKR (as ofJanuary 2022)
Black Swan Event: A Major
Surprise Attack
Difficult to countermeasure, suchas oracle attacks and other highly
coordinated external pricemanipulation, and there is no direct
workaround

82 Makerdao Whitepaper Emergency Shutdown https://makerdao.com/en/whitepaper/#emergency-shutdown

67



Redeploy with new
improvements
Unreasonable emergency
shutdown
Disable the attacker andredeploy with everything else
intact(13) Available platforms
Table 2-3-2-12 Maker: DAI Available Platforms
Item

Layer 2
Solution

Blockchain

Summary

Supplementary information

DAI is available in multiple Ethereum
Layer 2 solutions
OptimismArbitrum
Loopring
zkSyncAztec 2.0
DAI can be used on multiple
blockchains (used by bridges)83
Ethereum
Avalanche
PolygonBinance Smart Chain
FantomklaytnxDAIHarmony
SolanaCelo
Moonriver--2-3-3 Cooperation with financial institutions
Table 2-3-3 Maker: Cooperation with Financial Institutions
Item

Cooperation
with Financial
Institutions

Summary

Supplementary information

Launched custody and trading services(June 2021)
Sygnum Bank AG (Swiss digitalbank) Announced the launch ofcustody and trading services
for Maker and several othercrypto-asset tokens.
 Usd Coin (USDC) banking
services already in place

Tradable Crypto-assets:- Aave (AAVE), Uniswap (UNI),
Aragon (ANT), Curve (CRV), Maker(MKR), Synthetix (SNX), 1inch
network (1INCH)

83 Avalanche Token Dai Stablecoin https://snowtrace.io/token/0xd586E7F844cEa2F87f50152665BCbc2C279D8d70

68

Entered into the real estate loan market(October 2021)- Forge (digital assets subsidiary of
Société Générale) Partnership in real estate loans
through STO (Security Token
Offering).
 As a "Security Token
Refinancing" loan, thecompany proposes to refinancewith OFH Security Tokens(Housing Finance Bonds),
which are backed by realestate loans.
 The tokens are made inaccordance with French law
and will serve as collateral for a$20 million loan to be taken out
by DAI.

--This is the first example of a wellestablished bank working with a
MakerDAO on bond collateral.
For the DAI issuance plan, Forgelists six entities
1) Société Générale
2) Forge
3) MakerDAO protocol
4) Legal representative ofMakerDAO
5) Role of the DIIS Group (French
Fixed Income Investors)
Securities Agent
6) Exchanges
French related laws are seen as ameasure to clear real world legal
requirements, as they require
securities agents to secure loan
liquidation, etc.

2-3-4 Governance Operations

Figure 2-3-4 Governance Voting Process with MKR(1) Community
Table 2-3-4-1 Maker: Community Basics
Item
Purpose ofthecommunity(summarizedfrom official
documentation)84

Summary--Community-

MakerDAO is a decentralized governance community that enables thegeneration of DAI, the world’s leading decentralized stablecoin.
The decentralized governance community of MakerDAO manages thegeneration of DAI through an embedded governance mechanism within the
Maker Protocol.
MKR holders have the sole authority to enact changes to the system throughvoting.
Decentralized Autonomous Organization (MakerDAO) of Governance Token
MKR Holders
The MakerDAO is managed by the Domain Team and Core Unit.

84 MakerDAO https://makerdao.world/en/learn/MakerDAO

69

-Domain team or core unit facilitator will lead the operation.

(2) Governance token (MKR)
Table 2-3-4-2 Maker Governance Tokens
Item

Distribution of
MKR85

Number ofaddresses
held byMKR86(as of Jan.
2022)

MKR
Features87

Summary

Supplementary information

MKR: 1 million tokens already
distributed (as of January 2022)
Distribute a portion to early
adopters
Sold a portion to VC(Andreessen Horowitz, Polychain
Capital and others)
Number of addresses held by
MKR: 76,000
Percentage of 1st place holdings:
17.39%
Percentage of top 10 addresses
held 45.38%
1) Voting rights in on-chain voting(governance tokens)2) Resource for recapitalization- Additional supply of MKR when
Maker Protocol becomes insolvent(upward price pressure on MKR)
- Excess accumulation of DAI on the
Maker Protocol balance sheet,exchanging DAI for MKR andburning MKR (upward pricepressure on MKR)--

No undistributed portions locked tosmart contracts, as is the case withUNI-

The function of 2) provides an
incentive to maintain a healthy
protocol for holders who expect theprice of MKR to rise.

(3) Decision-making
Table 2-3-4-3 Maker: Decision-Making
Item

Summary-

DecisionMaking
Methods-

Supplementary information

On-chain voting by MKR in two
parts depending on the proposal
1) Governance Poll
Decide on governance and DAO
process other than technicalchanges to Maker protocol
2) Executive Vote
Decide on technical changes tothe Maker protocol. Make
protocol changes such as DAI
distribution according to the
proposal and budget passed byvoting 1).
Voting period:-

In the majority of voting 2),
proposals of high importanceinvolving protocol changes arebeing voted on in the governancevoting decided in 1).

85 Maker Profile https://messari.io/asset/maker/profile/launch-and-initial-token-distribution
86 Etherscan Token Maker https://etherscan.io/token/0x9f8f72aa9304c8b593d555f12ef6589cc3a579a2
87 MKR Token https://makerdao.world/en/faqs/mkr-token/

70




Conditions forpassage ofgovernancevote (as ofJanuary
2022)
Actualnumber of
votes cast
(2021)-

Quorum 10,000 MKR (1% of total)
To pass: Majority of votes cast is infavor1) 275 out of 307 approved(90% approval rate)2) 47 out of 47 approved(100% approval rate)-

Items that canbe proposedin theGovernance
Vote-

Maker Vault
risk
parameters
controlled by
Maker
Governance1) 7 days, 2) up to 30 days2) will be a continuous
approval voting model, and if
the number of votes for thelatest successful proposal isexceeded, the proposal will beapproved. If not, the proposal
is rejected.

--

Proposals will be discussed in thefollowing 9 categories of forums
1) Update (notification of latest
information)2) Governance (General
Governance)
3) Maker Protocol Improvement
Proposals (MIP) (e.g., parameterchanges)4) Core Unit (various activities of
the Core Unit)
5) Collateral on-boarding (additionof collateral assets)
6) Developers (tools anddocumentation)7) Community Development
8) Employee Recruitment
9) Site feedback (Q&A on site use)-

Proposals that have formed
consensus opinion and received
majority approval are sent for onchain voting (decision made byCore Unit team)

MKR holders can participate inproposal and governance voting inforums such as Add new collateral asset types
 Change or add risk parameters
 DAI Savings Rate Changes
 Selecting Oracle Price Feeds
 Perform emergency shutdown Decided to upgrade system
 Payments for infrastructure andother services
 Voting can be outsourced to a
published proxy

Examples of key risk parametersfor Maker Vault
1) Debt limit
Maximum amount of debt thatcan be created by a single
collateral type2) Stabilization fee
Incurred at the time of DAI
settlement (liquidation fee
calculated from Vault's collateral
assets and DAI generated)
3) Liquidation ratio
The minimum required collateral
ratio for a given collateral type. If
the collateral ratio falls below the
71

-

-

-

-

Maker
Governance
Voters(as of January
2022)

-

liquidation ratio, the liquidation
process is initiated.
4) Liquidation penalty
Additional fees collected at thetime of liquidation
5) Maker Protocol Auction Duration
Change the duration of debt andsurplus auctions (maximum
duration cannot be changed)
On-chain voting is done by voting
proxies and individuals, but almost
all voting is done by voting proxies.
Breakdown of voting proxies
 Total 18 addresses: 9
published, 9 not published(Shadow Delegate)
 Number of votes held: 98,500(10.0% of total Jan. 2022)
The main published voting proxies
are1) Flip Flop Flap Delegate LLC(individual investor) 32,0002) schuppi (individual investor)
20,0003) Feedblack loops LLC 10,000
Tim Black, MakerDAO
Community Contributor
4) MakerMan (private investor)
0.52 million5) Monetsupply 0.5 million
MakerDAO Risk Core Unit Core
Contributor6) gauntlet (financial modelingcompany) 3,000
7) ACREinvest (investmentcompany) 1,000
8) Just in case (individual investor)
549) GFX Labs (DeFi Builder Team)28
In addition to the above, venture
capitalists are also said to be
involved. The following VCs werevoting directly until 2019, but do notappear to be voting now88
 Andreessen Horowitz(California, USA) Field Technologies Inc.
(Minnesota, U.S.A.)-

Two of the voting proxies are
MakerDAO members, and together
they hold 15,000 votes. These two
members exceed the quorum(10,000 votes) for the proposal andare considered to have significant
influence on the decision-making
process through governancevoting.

(4) Addressing incidents
Table 2-3-4-4 Response to Maker Incident
88 Centralized Governance in Decentralized Finance (DeFi): https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3971791

72

Item

Summary

Supplementary information-

Emergency
measures toincidents-

MKR holders deposit MKRs in the
Emergency Shutdown Module(ESM), which immediately
executes a shutdown when thethreshold is exceeded.
Dark spell mechanism to fix criticalvulnerabilities-

Personsauthorized toinitiate
emergency
response--

Compensatio
n fordamagescaused byincidents-

Emergency shutdown is triggeredby MKR holder.
The Dark Spell Mechanism isactivated by the Governance
Facilitator.
Damage caused by incidents, etc.
is the responsibility of the user and,in principle, no compensation will
be provided (as specified in Termsof Use89 ).
Compensation for damages from
the March 2020 incident was
proposed for a governance vote,and the vote resulted in a decision
not to compensate (since
compensation would be made byprinting more MKRs, which was
opposed by major holders who
were concerned about the pricereduction of MKRs).

The emergency shutdown requires
currently 75,000 MKR (being
processed to raise it to 100,000),and voting proxies alone will not beable to reach 100,000 votes. The
cooperation of many other MKR
holders (individual voters) will be
required. If the voting proxy is lateor there are no other cooperating
parties, it is assumed that it will bedifficult to immediately defend
against the attack
Dark spell mechanism takes aminimum of 3 days to fix the code,
so there is concern that publicly
known defects may not be
addressed in time.

-

Dark Spell Mechanism has no
publicly disclosed stakeholders,such as trusted third parties orcommunity identifiers, and requires
trust in authority figures-

The possibility that the status of thelarge MKR holders' damages will
determine whether they support or
oppose the governance proposal,
and that equal judgment will not be
exercised.

(5) OtherItem
Anonymity of
MKR holders

Table 2-3-4-5 Maker Governance Operations and Other Matters
Summary
Supplementary information
MKR holders are, in principle,
Possibility of not being able toanonymous, and it is difficult to
identify the MKR holders involved
identify the actual entity.
in the decision-making process,In many cases, MKR holding
making it difficult to revert theaddresses can be identified but
decision and hold the decisioncannot be linked to real names
maker accountablebecause KYC is not performed
However, voting proxies can be
identified as individuals or

89 MakerDAO Terms of Use https://vote.makerdao.com/terms

73corporations because their
attributes are made public.
2-3-5 Incident Cases90
An overview of the March 2020 zero-bid attack incident case, the reasons for its occurrence, andthe issues involved are presented as below.
(1) Date of Occurrence: March 12, 2020
(2) Damages: approximately $8.32 million(3) Incident Summary
The company lost approximately $8.32 million worth of ETH due to zero bidding after it was
attacked for a weakness that prevented proper bidding when Maker's collateral forced liquidation
occurred due to network congestion and gas fee spikes caused by the ETH price collapse.
(4) Case flow

Figure 2-3-4-1 Maker Zero Bid Attack
1.

Black Thursday (stock market crash due to COVID-19 and the U.S. travel ban etc.) caused
crypto-assets such as ETH to plunge (ETH: $194 to $111, a 43% drop); transactions on
Ethereum spiked, causing network congestion and a spike in gas prices.

2.

Due to the above, Maker's Price Oracle was unable to update prices and delayed; it could
not keep up with the market price of ETH, resulting in a delay in the reflection of thereference price.

90 https://blog.makerdao.com/the-market-collapse-of-march-12-2020-how-it-impacted-makerdao/

https://insights.glassnode.com/what-really-happened-to-makerdao/
https://www.blocknative.com/blog/mempool-forensics
https://makerdao.com/en/whitepaper/https://docs.makerdao.com/keepers/the-auctions-of-the-maker-protocol#to-summarize-we-have-three-types-of-auctions
https://docs.makerdao.com/keepers/auction-keepers
https://www.coindesk.com/tech/2020/09/23/makerdao-users-hosed-by-march-flash-crash-wont-get-mkr-payouts-say-mkrwhales/

74

3.

Subsequently, the price oracle was updated at once, resulting in a drop of approximately
20% in the price of ETH within Maker. A large number of Vaults experienced ETH collateralshortages, and a forced liquidation (collateral auction) of approximately 1,200 Vaults was
executed.

4.

In the collateral auction, the attacker set up a "zero bid" (exchanged DAI at zero value for
ETH).

5.

Due to forced liquidation, four keepers submitted DAI purchase bids for liquidation, but all
four did not function properly and failed to submit bids.
- Keeper#1, #2 Due to gas price spike, bid transaction was not processed within thetime limit (10 minutes).
- Keeper#3 Maker Foundation operated the system, but it did not work due to technicalproblems caused by network congestion.
- Keeper#4 DAI to be cleared was exhausted and processing stopped for several hours.

6.

The attacker made zero bids (bids to purchase ETH at zero DAI) and all four keepers did notwork, so the attacker won the bids and stole a total of $8.32 million worth of ETH. (Of the4,447 auction bids made by Keeper and attackers, 1,462 were zero bids.)

7.

Conducted a Maker Protocol debt auction on March 19 to eliminate the $5.4 million collateralshortfall created by the zero bid by issuing additional MKRs (as of March 29, 20,980 MKRs
were generated and 5.3 million DAI were provided)(5) Cause of Occurrence-

Gas price spike in Ethereum due to the ETH price collapse, which exploited the fact that
Keeper was not working properly to set up a zero bid-

Post-incident investigations suggested that the Ethereum network congestion may havebeen deliberate due to a large number of meaningless transactions, and that the attackers
may have created a gas price spike that prevented Keeper from working properly, thus
creating a zero-bid attack.91(6) Incident Issues
Table 2-3-5 Problems with Maker Zero Bid Attacks
Item

Sub-Item

Description of issues-

Phenomenal
Factors

Deploym
ent--

Keeper auction bids could not beprocessed due to gas pricing issues
Keeper's gas prices are calculated
based on average prices on
Ethereum, but they could not keep up
with the rapid increase in gas prices,and bid transactions were submitted atlower gas prices, which were notprocessed within the auction time limit.
Oracle's price reflections delayed.
Network congestion and gas pricespikes delayed the acquisition ofmarket prices from multiple Oracle
price feeds and delayed the internalreflection of ETH prices.
The Oracle price feed was operated
by a BOT (dark feed) of several

Existing Risks-

Legitimate auction bids
are not passed whilemalicious bids are
passed, resulting in zerobids and other attacks.

-

Oracle fails to reflectnormal prices, resulting
in a difference from themarket price, whichleads to an oracle attack

91 Evidence of Mempool Manipulation on Black Thursday: Hammerbots, Mempool Compression, and Spontaneous Stuck

Transactionshttps://www.blocknative.com/blog/mempool-forensics

75

-

Platform--

Operatio
n
-

-

-

-

Motivatio
nal
Factors

Operation--anonymous individuals, which caused
delays in obtaining market prices dueto the network being affected bycongestion.
High volume of transactions caused
congestion in the Ethereum networkand gas prices skyrocketed.
The increase in transactions due tothe ETH price collapse and the large
number of meaningless transactions(possibly intentional) caused network
congestion, which led to the gas pricespike.
Attacker made zero bids during theprocessing of a collateral auction withforced liquidation of the Vault
The collateral auction was originallyconducted by Keeper to buy DAI
according to the internal market price,
but the attacker's zero bid was
accepted and passed the auction.
One of the Keepers was not
functioning when the attack occurred.
Keeper#3 was operated by the Maker
Foundation, but did not work due totechnical problems caused by network
congestion
When a large number of forced
liquidations took place simultaneously,
there were insufficient DAI assets to
be used in the liquidation.
Keeper#4 was operating correctly, but
did not function because a large
number of forced liquidations weretaking place at the same time, causing
DAI to run out and bids could not be
placed. At this point, ETH had
collapsed and it was difficult to procure
the DAI needed for liquidation.
Failure to take precautions against
attacks on collateral assets due to
ETH price collapse, etc.
In this case, since ETH was the single
collateral asset, the collapse of theETH price caused DAI to be forced toliquidate, which had a significant
impact.
The MakerDAO called the attack a"black swan event" (a serious surprise
attack) and stated that there is no failsafe solution to the attack, but a
combination of proper governance andMaker protocols.
There was no plan in place in case all
Keepers were shut down.

76-

The increase intransactions causes
processing delays andgas price spikes, which
prevent normaltransactions from going
through and cause avariety of negative
effects.

-

Possible to accept zerobids depending on
situations.

-

Auction bid processing
capacity is reduced,
resulting in processing
delays and bidding
failures.

-

Depletion of collateral
assets prevents
mandatory liquidationand legitimate bidding.

-Price manipulation ofcollateral assets causes
massive forced
liquidation and prevents
legitimate bidding-

When Keeper is shut
down, legitimate auction
bids and arbitrage to

-

-

-

-

-

Governa
nce

-

-

-

Regulation

At the time of the attack, only four
Keepers were in operation, and as aresult, they were not all functional; theimpact and measures if all Keeper
systems were shut down was notconsidered in advance, causing thedamage.
On-chain voting was controlled bymajor MKR holders and losses were
not compensated.
On-chain vote results in decision not
to compensate investors for losses(Septenber 2020)
The vote was dominated by large MKR
holders and was rejected by 9% of
MKR holders (38 users). The
compensation included printing more
MKR tokens, and opposition to theadditional issuance lowering the priceoutweighed the compensation
proposal.
Sued by investors who suffered losses
in the case (April 2020).
20 investors who lost their funds have
filed a lawsuit against Maker's
organization. Reason for the lawsuit
alleged that the risk of losing all of
their collateral due to Vault's forced
liquidation was not explained to them.
Organizations subject to litigation,
related parties Maker Foundation
 Maker Ecosystem GrowthFoundation
 Dai Foundation
 Related parties including theMaker Foundation
Brought in the United States District
Court for the Northern District ofCalifornia by Plaintiff Peter Johnson,
represented by Harris Berne
Christensen LLP, Portland, Oregon.
September 25,2020 Defendant's(Maker) motion was granted and thecase was stayed and assigned to theAmerican Arbitration Association.
Defendant's motion alleged that
Plaintiff contracted to view the "DAI
Terms of Use" upon signing up for theMaker platform.
The Ethereum network congestion
was intentionally caused by anattacker, but there does not appear tobe any criminal investigation, and thetheft of $8.32 million has not been
charged as a crime.

77

keep prices at 1USD
are not performed.
Abusive bidding andsignificant pricefluctuations will occur.

-

On-chain voting may becontrolled by large MKR
holders and a few MKR
holders may be harmed-

Even if the loss iscaused by external
factors of the market
price collapse, it can belitigated if the loss iscaused by reasons not
attributable to theinvestor.

-

Attacks against the DeFi
project are less culpableand may increase crime

2-3-6 Maker's main trust points(1) RWA Company, DAI Foundation (affiliated corporation)
The Maker Foundation was dissolved, but the RWA Company, which handles various contracts
with clients, and the DAI Foundation, the management corporation for the intellectual property of
the Maker community, continue to exist.
(2) Domain Team Core Unit (MakerDAO)
Domain teams and core units organized within the MakerDAO have taken over key operationsof the Maker Foundation (code development, risk management, sales activities, etc.).
(3)

Venture Capital/Voting Proxy
A portion of MKR has been sold to venture capitalists and other investors through an ICO, and
it is likely that the initial investors have some influence on the governance vote.
Voting proxies at ・18 addresses have been delegated to vote by individual investors and havesignificant influence in governance voting. The holding entity for 9 addresses is not disclosed.

(4)

Dark Spell Mechanism
A mechanism for domain teams to develop fix code and for certain persons in the community ortrusted third parties to fix critical vulnerabilities under special authorization. Details of third
parties, etc. are not disclosed.

(5)

Keeper.
In order for mandatory liquidation to be properly handled in the event of a decline in collateral
asset prices, it is a prerequisite that the keepers who bid on collateral auctions, etc., arefunctional, and if they are dysfunctional, it will cause the incidents described above.

(6)

Code Auditing Company
It is assumed that users trust the results of audits by code auditing companies and use theprotocol.

(7)

Wallet Provider
Many users use a small number of non-custodial wallets such as Metamask (not just Maker, but
DeFi in general), and the impact of a vulnerability in a wallet would be significant.

78

Figure 2-3-6-1 Maker's main trust points (components)

Figure 2-3-6-2 Maker's Main Trust Points (Governance Voting)
2-4 Lending Aave Analysis
Aave is a subject of a detailed research study, including a project overview, governing body, key
technical characteristics, and governance operations. Aave, a lending protocol, offers advanced
services such as DeFi services for institutional investors in cooperation with KYC providers and credit
delegation, and is actively expanding into the financial market in cooperation with financial
institutions. We clarified the actual situation through a study of each item and analyzed issues,
problems, and risk matters.
2-4-1 Overall Project Overview
The main components of Aave, their mapping and community overview are shown in the figure andtable below.

79Figure 2-4-1-1 Main components of Aave

80

Figure 2-4-1-2 Mapping of Aave's main components

81

Table 2-4-1-3 Aave: Community, Developer, and Version Trends
Item

Versionand
Main
Functions

Communityaffiliatedcompany

Summary-

Supplementary information

2017: Inauguration as ETHLend
2018: Name changed to Aave.
2020: v1 launch (ETHLend protocol
no longer functional)
2021: v2 launch
March 2022: v3 launch-

Aave Community (DAO)- Operated by governor token holders(number of addresses held: 100,000)- Further improve dispersion andindependence in accordance with apolicy called Aavenomics92- Aave Core Team manages the Aave
community--

Aave Limited93
Aave's U.K. subsidiary
Obtained approval from the Financial
Conduct Authority (FCA) in the U.K.
to operate as an "electronic money
institution" (approved in July 2020).
Details of its activities as a legal entity
are not known.
Aave SAGL
Switzerland
Details of activities are unknown.

Aave
Core
Team

-

Develop and operate Aave protocols(code modification and related
operations) and manage thecommunity.

--

Founded in May 2017
Location: London
Founder: Stani Kulechov(Founder&CEO)
Operating members: 53 members
located in the U.K., U.S.A., and othercountries (Jan. 2022)94
At the time of the survey, there wereno specific activities in the UK.95
Founded in 2018
Location: Switzerland (Chiasso)
Founder: Stani Kulechov(Founder&CEO)

Lead: Stani Kulechov
Aave management members share roles.
-

Aave Risk
DAO(as ofFebruary
2022)

Aave
GrantsDAO--

Perform risk analysis and evaluationof Aave protocol and Safety module
Activities budget: $750,000 per year
Operating Fund Total of 6 multisig (4of-6) to be determined
Nominated 3 RiskDAOs, 2 Gauntlet,
and 1 Aave commmunity

A grant program that funds ideas
submitted by the community, with aManaged by 7 members plus
university students
 Project Management &Governance: monet-supply Market Risk Analysis:
Thomas, Jack, Roberto, Jeremy Technical Risk: Mateusz
 Real World Asset Risk: Will
 Student Contributor: Blockchain
at Berkeley
Lead:
Shreyas Hariharan (Llama Founder,
Uniswap grants)

92 Decentralizing Aave https://docs.aave.com/aavenomics/
93 Aave Limited https://aave.co.uk/
94 RocketReach Aave Information https://rocketreach.co/aave-profile_b443387efa0db443
95 The Financial Services Register https://register.fca.org.uk/s/firm?id=0010X00004U9vVAQAZ

82

(as ofFebruary
2022)

-

-

Guardian(as ofFebruary
2022)

-

-

-

PartnerCompany
96

focus on empowering a broader
network of community developers
Grant budget: $4 million per year
Operating budget: $500,000 per year
Committee: 8 members in total 1
lead, 7 reviewers

Established as a community multisig
to protect against potential
governance hijacking by centralized
actors.
Multisig runs 5-of-10
Smart contract updates andemergency keys (protocol
suspension) can be triggered.
It operates with 10 members, all ofwhom were elected in September
2021.
Proposed by Grants DAO lead
(Shreyas Hariharan)

Gauntlet Network97- Provide a dashboard withrecommended values for parametersthat balance Aave's capital efficiency
and risk- Participate as a risk contributor in thereview of the Aave Improvement
Proposal (AIP) for the Aave
Governance Proposal
Certora98- Perform a code audit of the Aave
protocol.
- Participate as a security contributor in
the review of the Aave Improvement
Proposal (AIP) for the Aave
Governance Proposal

Reviewers:
Aleks Larsen, Blockchain CapitalJose Maria Macedo, Delphi Digital
Imran Khan (DeFi Alliance)
Maggie Love (W3BCLOUD and
SheFi)
Corbin Page (ConsenSys Codefi)
Nick Cannon (Gauntlet)
Calvin Chu (Independent)
10 subjects
Arthur0x (DeFiance Capital)
Coderdan (Aavegotchi)
Gavi Galloway (Standard Crypto)
Isa Kivlighan (Aave community,
previously head of marketing on the
Aave Genesis team)
0xMaki (Sushi)
Hilmar Maximilian Orth (Gelato)
Meltem Demirors (Coinshares)
Corbin Page (ConsenSys Codefi,
Aave Grants DAO)
Imran Khan (DeFi Alliance, Aave
Grants DAO)
Dennison Bertram (Tally)--

Established in 2018 ∙ Headquarteredin New York, US(32 employees as of Mar. 2022)

Founded in 2019 Headquartered in
Tel Aviv, Israel
37 employees (as of Mar. 2022)
Aave Founder Stani Kulechov Joins
Advisory Board

2-4-2 Main Technological Characteristics(1) Overall view of the protocol99-

Users (individuals, institutions, etc.) can earn interest by depositing crypto-assets (including
some stablecoins) into the Aave protocol's lending pool (smart contracts), and can borrowfrom the pool on the condition that they deposit the prescribed collateral assets. (As ofJanuary 2022, more than 30 crypto-assets and stablecoins including ETH, LINK, USDT, andAAVE are supported).

96 Aave Developers Governance Guide https://docs.aave.com/developers/guides/governance-guide
97 Gauntlet Networks, Inc. https://www.crunchbase.com/organization/gauntlet
98 Certora Inc. https://www.crunchbase.com/organization/certora
99 aave-v2-whitepaper https://github.com/aave/protocol-v2/blob/master/aave-v2-whitepaper.pdf

83-

When crypto-assets are deposited into the Lending Pool, the pool receives aToken100 (e.g.,aETH) with the initial letter "a" of the crypto-asset on a 1:1 basis, and the proceeds earned
by the pool is distributed to the aToken holders. The aToken is burned when the cryptoasset is withdrawn.

-

Crypto-asset prices refer to an external oracle (Chainlink)101 .

-Lending and borrowing rates are calculated systematically by referencing the oracle.

-

Liquidation occurs if collateral asset prices decline at the time of borrowing.

-

The user who deposited the crypto-assets can assign a line of credit secured by the cryptoassets to another party, and the assignee can borrow without collateral (credit delegation). In
return for the credit risk, the transferor (Delegator) receives additional revenue.

Figure 2-4-2-1 Aave: Overall view of the protocol(2) Aave interest bearing tokens (aToken)102-

When a crypto-asset is deposited, a token with an a in the initial letter of the crypto-asset isgenerated at a 1:1 ratio and burned when the crypto-asset is withdrawn.

-

For example, depositing 1 ETH generates 1aETH token, and burning 1aETH returns 1 ETH.

-

aToken has the advantage of being able to grant interest directly in real time without gas
fees within the Aave protocol.

(3) Liquidation103-

Liquidation occurs when the value of crypto-assets deposited in the lending pool by users
falls below a predetermined collateral ratio due to a decline in the value of crypto-assets oran increase in the value of crypto-assets borrowed.

100 Aave AToken https://docs.aave.com/developers/tokens/atoken
101 Price Oracle https://docs.aave.com/developers/v/2.0/the-core-protocol/price-oracle
102 Aave Developers aTokens https://docs.aave.com/developers/v/1.0/developing-on-aave/the-protocol/atokens#:~:text=The%20aTokens%20are%20interest%2Dbearing,safely%20stored%2C%20transferred%20or%20traded.
103 Aave FAQ Liquidations https://docs.aave.com/faq/liquidations84

-

In liquidation, up to 50% of the collateral is refunded and a liquidation fee is deducted fromthe collateral.

(4) Safety Module/ Safety Incentive104-

Safety Module (SM): A mechanism to compensate for a large amount of liquidation fromAAVE tokens staked voluntarily by users for the purpose of resolving the protocol's
insolvency. Safety incentive (SI): A system whereby a fee is earned in exchange for staking
out SMs.
<Details of Safety Module/ Safety Incentive>ⅰ) The AAVE token holder stakes (locks) the AAVE token in the SM.
ⅱ) A portion of AAVE's fee income is paid to the staker as compensation.
ⅲ) In the event of a shortage of funds due to the occurrence of a major liquidation or otherevent, AAVE tokens deposited with SM will be sold through an auction (Auction Module)(to be compensated from up to 30% of the staked AAVE tokens).
ⅳ) The funds acquired through the auction will be used to eliminate the funding shortfall.
ⅴ) If funds are still insufficient after the auction, they will be covered from the Ecosystem
Reserve. These compensations will be made by selling AAVE tokens through theAuction Module protocol.
*Out of the total 16 million tokens issued for AAVE tokens, 3 million tokens have been
distributed for operational reserves.

104 Aavenomics Safety Module https://docs.aave.com/aavenomics/safety-module

85

Figure 2-4-2 Aave: Safety Module / Safety Incentive(5) Flash Loan105-

A system that enables borrowing, etc., without the need to deposit collateral in advance bycompleting all borrowing and repayment within one transaction.

-

Arbitrage and collateral exchange are expected to be the main applications.

-

The fee is 0.09% of the borrowed token-denominated debt. In addition, there is a gas fee for
deployments and smart contract executions.

-

The design is designed to prevent flash loan attacks by providing a more plentiful supply
than demand for crypto-assets via liquidity pools.

<Specific example of a Flash Loan (assuming arbitrage opportunities arise between the AAVE
market and other exchanges)>
Execute the following ⅰ) to ⅴ) in one transactionⅰ) Borrow 1 ETH from the liquidity pool on an unsecured basis.
At this time, 1 ETH shall be exchangeable for 200 DAI in the Aave Market.

105 Aave Developers Flash Loans https://docs.aave.com/developers/guides/flash-loans

86ⅱ) Book an exchange transaction at 220 DAI for the 1 ETH borrowed in (i) at anotherexchange where there is a difference in exchange rates.
ⅲ) Make a reservation to exchange 200 DAI for 1 ETH at Aave Market.
ⅳ) Return 1 ETH and 0.0009 ETH with 0.09% commission.
ⅴ) The exchange transaction reservation is executed. As a result, a profit equivalent to 19.82
DAI* is earned (gas fees are actually deducted from this amount). 20DAI- 0.0009ETH(0.18DAI)

Figure 2-4-2-3 Aave: Flash Loan
(6) Credit Delegation106-

A credit delegation is a mechanism whereby a person who deposits crypto-assets with Aavecan enjoy additional yield by ceding a line of credit secured by those crypto-assets toanother party.

-

The lender and borrower agree on the interest rate and term, and enter into a contract.
Currently, one transferee can be designated for each collateralized asset, but in the future,
the ability to transfer to multiple transferees will be considered.

<Specific examples of Credit Delegation>In the example in Figure 2-4-2-4, Karen pledges collateral on Chad's behalf, allowing
Chad to borrow crypto-assets.



In V1, the contract between Karen and Chad was made enforceable using OpenLaw*, anelectronic contracting service that includes smart contracts, based on an off-chain
agreement between the two parties. In V2, the electronic contract function is incorporated
into Aave.

OpenLaw107 : Blockchain-based electronic contracting service provided by ConsenSys.

106 Aave Developers Credit Delegation https://docs.aave.com/developers/guides/credit-delegation
107 OpenLaw REAL WORLD CONTRACTS FOR ETHEREUM https://www.openlaw.io/

87

Figure 2-4-2-4 Aave: Summary of Credit Delegationⅰ)ⅱ) Karen deposits 1,000,000 USDT into Aave's lending pool and obtains 1,000,000 aUSDT.
ⅲ) Karen obtains ETH at a fixed rate of 3% by depositing 1 million aUSDT in the Credit
Delegation Vault (CDV).
ⅳ) Chad and Karen, who wish to borrow on an unsecured basis, agree on the amount ofcredit, interest rate (8% annual interest rate in the figure), and other borrowing terms andconditions, and sign a contract (in AaveV1, the credit delegation contract is signed by
OpenLaw)ⅴ) After the contract is signed, Karen establishes the amount of Chad's credit according to thecontract.
ⅵ) Chad borrows to the extent of the relevant credit amount (in the figure, ETH equivalent to750,000 USD is borrowed). The credit mandate allows Karen to earn a higher yield andChad to raise funds without collateral.
(7) AaveArc/ Whitelister 108
a. AaveARC
A Permissioned Institutional DeFi Protocol designed to enable institutional investors andothers to participate in the DeFi ecosystem in a compliant manner.
KYC and financial due diligence can be performed by institutional investors, utilizing the
key features of the AAVE protocol only with other institutional investors who have received
similar approval to operate. The four crypto-assets covered at this time are ETH, WBTC,USDC, and AAVE.
Deployed on Arbitrum and Optimism, Ethereum's L2 solution, in January 2022109
b. Whitelister
108 Aave launches permissioned DeFi platform Aave Arc, Fireblocks becomes first whitelister

https://www.theblockcrypto.com/post/129277/aave-arc-permissioned-defi-platform-fireblocks-first-whitelister
109 Wall Street's Jane Street Borrows $25M Via DeFi Lending Platform https://thedefiant.io/jane-street-25/

88

-

Perform due diligence on institutional investors accessing the AAVE protocol via AaveArc,
approve and "white list" all participating institutions to ensure compliance with KYC andAML regulations.

-Fireblocks is the first company to launch; Securitize (US) and SEBA Bank (Switzerland)
are in the process of implementing governance proposals (as of February 2022).

<Whitelister specific example 1: FireBlock's DeFi Gateway110 >Figure 2-4-2-5-1 AaveArc Whitelister: FireBlock
Flow of authenticationⅰ) Execute KYC with Fireblocks framework and whitelist financial institutions andinstitutional investorsⅱ) Whitelisted persons access AaveArc via Fireblocks' DeFi gatewayⅲ) Use Fireblocks' secure Multi Party Computing (MPC) wallet-

30 registered financial institutions and institutional investors:
Bluefire Capital, Celsius, CoinShares, Seba Bank, GSR, Ribbit Capital, and QCPCapital, Wintermute, etc.

<Whitelister Specific Example #2: Securitize, Inc. SecuritizeID111 >Figure 2-4-2-5-2 AaveArc Whitelister: Securitize
Flow of authentication
110 Aave Governance Add Fireblocks as a whitelister on Aave Arc https://governance.aave.com/t/add-fireblocks-as-a-whitelister-

on-aave-arc/5753
111 Aave Governance ARC: Appoint Securitize as a Whitelister to Aave Arc https://governance.aave.com/t/arc-appointsecuritize-as-a-whitelister-to-aave-arc/6434

89ⅰ) When a financial institution or institutional investor creates a SecuritizeiD in its own wallet,
the wallet is linked to the AaveARC whitelist.
ⅱ) Once you sign in to AaveArc from the wallet and obtain authorization, the wallet address is
authorized to perform transactions such as lending, borrowing, and clearing on AaveArc.
(8) Oracle112-

Partnered with Chainlink, an external Oracle to obtain information on the market price of
crypto-assets. Chainlink, as a decentralized Oracle, provides a service that calculates theappropriate price from multiple market prices.

(8) Scaling
Table 2-4-2-8 Aave Scaling
Item

Layer 2
Solution

Summary

Supplementary information

Aave available in multiple Layer 2
solutions
ArbitrumzkSyncAztec 2.0-

Blockchain

Aave available on multiple blockchains.
Ethereum
Avalanche
PolygonBinance Smart Chain
FantomxDAI
Heco
Solana-Platforms have restrictions on thefunctions that can be performed.
Different platforms have different
versions deployed (e.g., V2 for
Ethereum, V3 for Avalanche)

2-4-3 Cooperation with financial institutions
Table 2-4-3 Aave: Cooperation with Financial Institutions
Item

Summary-

Cooperation
with Financial
Institutions

Supplementary information

Taurus (Swiss fintech company)
has formed a strategic alliance withAAVE to integrate AAVE V1 andV2 into its digital asset
infrastructure, providing access to
the AAVE protocol for its
customers, financial institutions
and institutional investors.113(March 2021)

Main Customers- Sygnum Bank (Switzerland)- SEBA Bank (Switzerland)- Arab Bank Switzerkland(Switzerland)- Vontobel (Swiss Investment
Company)

112 Aave Developers Price Oracle https://docs.aave.com/developers/v/2.0/the-core-protocol/price-oracle
113 Taurus and Aave announce strategic collaboration https://blog.taurushq.com/taurus-strategic-collaboration-aave/

90

-

-

-

Sygnum Bank AG (Swiss digitalbank) announces the launch ofcustody and trading services forseveral DeFi tokens (governancetokens) including AAVE tokens andstablecoins (USDC)114 (June 2021)
Launch of custody and trading
services (November 2021)
Commonwealth Bank (Australia)
launches 10 crypto exchanges andcustody services in partnershipwith Gemini Exchange andChainalysis.
Offer trading and custody of DeFi
related products (January 2022)
Arab Bank Switzerland(Switzerland) offers 10 different
crypto-asset services.

-

Tradable crypto-assets: AAVE,
UNI, ANT, CRV, MKR, SNX,
1INCH

-

Commonwealth Bank: Establishedin 1911
Tradable crypto-assets: BTC, ETH,
BCH, UNI, LINK, MATIC, AAVE,
COMP, LTC, FIL--

Arab Bank Switzerland:
Established in 1962
Tradable crypto-assets: AAVE,
FTM, COMP, SNX, LINK, MATIC,
GRT, CRV, UNI, YFI

2-4-4 Governance operations

Figure 2-4-4 Governance Voting Process Using AAVE
(1) Community
Table 2-4-1 Aave: Basic Community Information
Item
Purpose ofthecommunity(summarizedfrom official

Summary-

The Aavenomics introduce a formalized path to the decentralization andautonomy of the Aave Protocol.

114 Sygnum launches first phase of institutional-grade access to decentralised financehttps://www.insights.sygnum.com/post/sygnum-launches-first-phase-of-institutional-grade-access-to-decentralised-finance91

documentation)115
Community-

Decentralized Autonomous Organizations (DAOs) by holders of governancetokens AAVE
The Core Team leads the management of the Aave community.

(2) Governance token (AAVE)
Table 2-4-2 Aave: Governance Tokens
Item

Summary-

AAVE
Distribution--

Supplementary information

Of the total AAVE supply of 16
million tokens
Distribution to LEND (formerly
Governance Token) holders: 13
million tokens
Ecosystem Reserve funds (locked
into smart contracts): 3 million
tokens---Number ofaddresses
held by
AAVE118 (asof February
2022)

-

Number of addresses held by
AAVE: 100,000
Percentage of 1st place holdings:
18.54%
Percentage of top 10 addresses
held 62.30%-

AAVE
Features

1) Voting rights in on-chain voting(governance tokens)
2) AAVE protocol stabilization tool
- AAVEs deposited with SM in theevent of insolvency were sold at
auction to compensate for losses.

Raised $16.2 million in an ICO of
LEND tokens as ETHLend in
November 2017116
Convert LEND tokens to AAVE
tokens at a 100:1 ratio for Aave v1
launch 117
Large AAVE token holders(including funds for system use)
1) Aave Protocol/ Ecosystem
Reserve 4 addresses 7.07
million votes
2) Binance 3 addresses 1.34
million votes
3) Balancer 1 address 1,110,000
votes4) Polygon 1 address 280,000
votes
Of the top AAVE holders, #1-9 areprotocols and crypto-asset
exchanges, but voting may takeplace among theseIn May 2021, out of 3.3 million votes
in favor of the long time lockproposal, 2.7 million votes were
cast by just 1 address. Based on
the number of votes, it appears thatthe 1st place holder voted(Proposal: extend the end date of
the Aave Safety Module Incentive
by 100 years)-

115 Decentralizing Aave https://docs.aave.com/aavenomics/
116 ETHLend Token Sale event successfully Closes With $16.2 million usd raised https://medium.com/aave/ethlend-token-sale-event-successfully-closes-with-16-2-million-usd-raised-d0e0a1206141
117 Aave Migration and Staking https://docs.aave.com/faq/migration-and-staking
118 Etherscan Token Aave https://etherscan.io/token/0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9#balances92-

A certain amount is retained as an
AAVE reserve and used to make up
for any shortfall in funds.

(3) Decision-making
Table 2-4-3 Aave: Decision Making
Item

Summary

Supplementary information-

DecisionMaking
Methods

Proposals are divided into threestages of decision-making
1) Snapshot Voting See trends infavor of the proposal(temperature check)2) AIP (Aave Improvement
Proposals) Community review of
proposals
3) Governance Voting AAVE
holders vote to approve/reject1) Snapshot voting (off-chain)
Voting period: 3 days
Conditions for passage: Proposal
must be approved by more than
50 votes for a quorum and amajority of the votes cast.

-Votes and proposals can bedelegated-

2) AIPs are not voted on, but
determined by determinedcommunity members.
In 3), as a countermeasure against
malicious proposals, a mechanism
is in place to allow the Guardian tocancel a proposal with a 5-of-10
multisig approval during the waiting
period of the governance vote.

2) AIP (off-chain)- Pre-designated community
members (Core Team, Grants
DAO, Gauntlet Network, Certora)
make the decision

Conditions forpassage ofgovernancevote3) Governance voting (on-chain)
A. Short time lock
Proposal:- Proposals not related togovernance, such as asset lists,
parameter updates, ecosystemspending, etc.
- Aave Protocol, Fee collection,
Contracts, AAVE Eeserve
Ecosystem- Change short time lockparameters, etc.
Voting period:
1 day waiting period, 5 days
grace period, 3 days voting
periodConditions for passage:
Quorum of 320,000 votes (2% of
the total), 50.5% of the votes
cast are in favor.
B. Long time lock
Proposal:- Aave Protocol Changes Affecting
Governance Consensus

93

-

-

Upgrade AAVE token and AAVE
protocol, change governanceparameters, change long time
lock parameters, etc.
Voting period:
7 days waiting period, 5 days
grace period, 10 days voting
periodConditions for passage:
Quorum 3.2 million votes (20% of
the total), 57.5% of the votes castare in favor.
Actualnumber of
votes cast (in2021)

Items that canbe proposedin theGovernance
Vote

Aave
Governance
Voters (as ofFebruary
2022)-

Governance Vote: 46 of 53 passed(87% approval rate)1) Changes to AAVE protocol, tollcollection contract, AAVE reserve
ecosystem, governance parameters,and voting parameters
2) AAVE Token and AAVE Protocol
Upgrade3) Distribution of community funds(grants, compensation, etc.)
4) Guardian Recommendation

-

-

-

Regular voters (same members
vote on most proposals)
1) Voter A: 224,000 votes
2) Voter B: 125,000 votes
3) Voter C: 111,000 votes
4) Voter D: 103,000 votes
Total 563,000 votes-

Of the 53 governance votes, there
were 2 long time lock proposals (1passed, 1 rejected due to lack ofquorum)The total number of votes cast by
the four regular voters exceeds thequorum of 320,000 votes for thegovernance proposal (short timelock)Personal information of each voter
is unknown.

(4) Addressing incidents
Table 2-4-4 Aave: Response to Incidents
Item

Summary-

Emergency
measures toincidents

Personsauthorized toinitiate--

Supplementary information

In the event of a malicious proposalon the Governance vote, theGuardian can cancel the proposal
with a multisig approval during thewaiting period.119
In the event of an emergency, suchas an external attack, Guardiancan trigger an emergency key(protocol suspension) using
multisig.120
Triggered by 10 Guardian
multisignatures-

All multisig approvals are 5-of-10(Ethereum blockchain).

-

Guardian is determined bygovernance vote (all were most119 AIP 4: Activation of Aave Protocol Governance V2 https://aave.github.io/aip/AIP-4/
120 Authorize the Guardian to hold the emergency keys for V2 https://staging.aave.com/governance/proposal/49/

94

emergency
response
Compensatio
n fordamagescaused byincidents

recently elected in September
2021)-

Damage due to incidents, etc., isthe responsibility of the user andno compensation will be provided(as specified in Terms of Use121 ).

-(5) Other
Table 2-4-5 Aave: Governance Operation and Other Matters
Item

Summary-

Anonymity ofAAVE holders-

Supplementary information

AAVE holders are in principle
anonymous, making it difficult to
identify the actual entity.
AAVE's holding addresses can be
identified, but in many cases
cannot be linked to real names
because KYC is not performed on
the majority of addresses
Institutional investors on the white
list have been KYC'd and can be
identified.

-Possibility of not being able toidentify AAVE holders involved indecision making, making it difficult
to hold them accountable

2-4-5 Aave's main trust points(1) AAVE Limited, AAVE SAGL (affiliated corporation)
AAVE Limited, which has obtained an electronic money business license from the FCA (detailsof the scope of the license are unknown), and other related corporations exist.

(2) Gurdian (DAO)
A 10-member Gurdian, elected by governance vote, manages the multisig and has strong
authority to cancel governance proposals and to provide emergency response in the event of anincident, etc.
(3) Venture capitalists/larger governance token holders
The reality exists that a small number of governance token holders control the majority of
governance votes.
(4) External oracles
Since data on crypto-asset prices, etc. is obtained from an external oracle (Chainlink), collateralliquidation, etc. may be affected in the event of a malfunction, etc. of the external oracle.

(5) Whitelister
In order to register institutional investors on the AaveArc whitelist, certain companies accreditedby AAVE conducts KYC, etc.
121 Aave.com Terms of Use https://aave.com/term-of-use/95

(6) AIP (Aave Improvement Proposal) Reviewer
Two subcontractors participate in the review of the AIP (Aave Improvement Proposal), and areconsidered to play a role in ensuring the reliability of the AIP.
(7) Code Auditing Company
It is assumed that users trust the results of audits by code auditing companies and use theprotocol.
(8) Wallet provider
Many users use a small number of non-custodial wallets such as Metamask (not just Maker, but
DeFi in general), and the impact of a vulnerability in a wallet would be significant.

Figure 2-4-5-1 Aave's main trust points (components)

96

Figure 2-4-5-2 Aave's Main Trust Points (Governance Voting)
2-5 Results of Analysis of the Three Projects
We compared the three projects in terms of the organizations, their collaboration with financial
institutions, technological characteristics, and governance operations to analyze trends in DeFi
projects as a whole and the characteristics of individual DeFi projects.
2-5-1 Component Mapping of Major DeFi Projects
Based on the mapping results of the main components of the three projects surveyed, an example
mapping of the components of the main DeFi projects with generic components is shown below. Notethat the mapping example shows a basic configuration based on the major DeFI projects surveyed,and does not take into account individual requirements such as side chains consisting of specificapplications.

97

Figure 2-5-1 Mapping of Major Components of Major DeFi Projects

982-5-2 Comparison of Analysis Results for Surveyed Projects
The comparative results of the three projects studied are shown in the following table.

99

Table 2-5-2 Comparison of analysis results for projects studied
Item

SummaryContents
Services
providedServiceStart DateTVL
(as ofFebruary 13,
2022)

Uniswap

Aave

Decentralized Exchange (DEX)

Stablecoin (DAI) issued

Crypto-asset-Backed Lending

November 2018

December 2014

May 2017

TVL $8.29 billion

Outstanding balance $16.95 billion

TVL $10.74 billion

1.65 billion U.S. dollars
Liquidity pool fee income
UniswapV2 $827 million
UniswapV3 $817 million andothers0.69 billion U.S. dollars
Income from stabilization fees,
liquidation penalties, etc.

3.1 billion dollars
Income from loan fees
Aavev2 $256 million
Aavev1 $0.27 billion and others

GovernanceToken

UNI (addresses held: 276,000)

MKR (addresses held: 83,000)

AAVE (addresses held: 106,000)

Founder

Hayden Adams

Rune Christensen

Stani KulechovCommunity

Uniswap Community (DAO)

MakerDAO

Aavenomics Community (DAO)

Total fees (in2021)122

Community
RelatedOrganiza
tions

maker

Governance token holders are the core of the company's operations
Involvement in certain community operations of related organizations and teams within the DAO-

Community
Management

Community
Objectives(summarizedfrom the--Uniswap Labs takes the lead inprotocol development andmanagement, and interface
operation and management.
UNI (governance token) is
introduced for the purpose ofcommunity-led growth,development, and self--

The organization within thecommunity plays a central rolein protocol development andmanagement, and community
operations.
Domain Teams: 5 teams
Core Unit: 22 teams
MakerDAO is a decentralized
governance community thatenables the generation of DAI,

122 https://cryptofees.info/2021

100

-

-

-

The core team develops andmanages protocols andcommunity operations.
Community multisig by Guardian(outside experts approved bygovernance vote, 10 total) 10
members in total)
The Aavenomics introduce aformalized path to thedecentralization and autonomyof the Aave Protocol.

official
documentation)--

sustainability, enabling sharedcommunity ownership and avibrant, diverse, and dedicatedgovernance system.
Uniswap has always embraced
the tenets of neutrality and trust
minimization: it is crucial thatgovernance is constrained towhere it is strictly necessary.
Uniswap governance frameworkis limited to contributing to bothprotocol development andusage as well as developmentof the broader Uniswap
ecosystem.

--

the world’s leading
decentralized stablecoin.
The decentralized governancecommunity of MakerDAO
manages the generation of DAI
through an embedded
governance mechanism within
the Maker Protocol.
MKR holders have the soleauthority to enact changes tothe system through voting.

-Managementof community
funds

Main Related
Organizations-

Management of wallets holding
Grants Program funds
Approved by the Grant
Allocation Committee with a 4of-5 multisig out of 6
members123

Uniswap Labs (U.S.)- Protocol development andmanagement, involvement incommunity management, etc.

-

Management of wallets holding
community funds
Four of the core unit facilitators
are nominated and approved in a
2-of-3 multisig124

DAI Foundation (Denmark)- Intellectual property
management, etc.

123 Uniswap Grants Program v0.1 https://gov.uniswap.org/t/rfc-uniswap-grants-program-v0-1/9081
124 MIP47: MakerDAO Multisignature Wallet Management https://mips.makerdao.com/mips/details/MIP47#sentence-summary
125 Defi Watch Aave on Polygon has an admin key https://defiwatch.net/tag/aave/

101

Management of wallets holding
community funds
Although not explicitly stated in
the documentation, it isassumed that community
members (Core Team, Grants
DAO, etc.) hold theadministrator's private key.
It was noted that the signer of
Aave's Polygon market multisig(3-of-5) is unknown and that one
Aave member may hold five
private keys.No response fromthe Aave community. (From May
2021 DefiWatch)125
Aave Limited (U.K.)- Already licensed by FCA as anelectronic money vendor
Aave SAGL, Switzerland

Dissolved
Organization

PartnerCompany

Technicalcharacteristics--Main
Technical
Characteristics

RWA Company LLC (Cayman
Islands)- Manage investments in realworld assets, sign contracts withclients, etc.
Maker Ecosystem GrowthFoundation (MEGF) (Cayman
Islands)- Ecosystem, Oasis system(wallet, etc.) development- Information linkage with thecommunity
Maker Foundation (Denmark)- Upon dissolution in July 2021,
Maker Foundation assets weretransferred to MakerDAO andoperations was taken over bydomain teams/core units within
MakerDAO--

Registered as a software
manufacturer-

Gauntlet Network (U.S.)- Participate in the review of AIP(Aave Improvement Proposals)
as a risk parameter assessment
contributor
Certora, Israel- Participate as a security
contributor in the review of the
Aave Improvement Proposal(AIP) for the Aave Governance
Proposal-

AMM (Automated Market
Maker)
Flash Swap
Concentrated Liquidity
Flexisible Fee-

Maker Vault (DAI generation)
Liquidation System 2.0
Dai Direct Deposit Module(D3M)
Keeper (market makers/
auction)Flash Mint
102-

Aave interest bearing tokens(aToken)Flash Loan
Credit Delegation
Aave Arc/White ListerOracleFunctions-

UpgradeAvailability--

Price calculation within own
project without using Oracle
Calculate TWAP (time weighted
average price) by taking the
cumulative total of prices ofcrypto-asset pairs
Measure market prices for all
crypto-asset pairs before any
trades are madeCore contract is not
upgradeable by design(AMM, liquidity aggregation
functions, oracle functions, etc.)
Some parameters (fees) can bechanged.
Contracts other than the core(fees, peripherals, interface,
governance voting, etc.) can bechanged.
It is believed that thedevelopment company has
administrative privileges(administrator's private key) tomodify the code.

Supported
Blockchains(Scalability)*Blockchains
where theprotocol isdeployed andthe token isavailable
Emergency
response---

Ethereum
Ethereum 2nd Layer solution(Optimism, Arbitrum)
Side chain (Polygon)-

Dependent on external oracle
services
Market prices and lending rates
are obtained using Chainlink, adecentralized oracle service, andare reflected internally.

-

Smart contracts are upgradeable.
Supported by incorporating a feature in the smart contract that allows
upgrades to be made in advance-

Domain team and core unit
facilitators are considered tohave administrative privileges in
deploying code--

Oracle's structure within selfprojects
Oracle Price Feed" gets prices
from multiple external markets
Overall median price iscalculated and reflected in theinternal price after 1 hour-

Ethereum
Ethereum 2nd Layer solutions(Optimism, Arbitrum, Loopring,
zkSync, Aztec 2.0)
Sidechains (avalanche,
Polygon, BSC, Fantom, Klaytn,
xDAI, Harmony, solana, Celo,
Moonriver)

Details unknown
The smart contract allows for proposal cancellation by the administrator,
but does not define a proposal cancellation function or an administrator
103

-

-

-

10 Guardian multisigs approvecode deployments
Was Core Team's 3-of-5 multisig
management, but delegated to
Aave Governance managementin November 2020

Ethereum
Ethereum 2nd Layer solution(Arbitrum, zkSync, Aztec 2.0)
Side chains (avalanche,
Polygon, BSC, Fantom, xDAI,
Heco, Sora)

Governance proposals can becanceled

1) Cancellationof malicious
proposals

who can perform it (assuming it is performed by the developer or coreunit in case of emergency?)

Emergency
response
2) Urgent
smart contract
fixes

-

-

In principle, not supported
because the core contract is not
upgradable.
-

Emergency
response3) What to dowhen attacked

Community
DecisionMaking

Number of
GovernanceTokensDistributed
InitialDistribution ofGovernanceTokens1) FreeDistribution--

UNI: 1 billion tokens being
distributed sequentially(being distributed over 4 years
starting in September 2020)
Initial distribution in the following
percentages
Community members 60%
Team members, employees
21.266%
Investors 18.044%
Advisors 0.69%--

Dark spell mechanism allows for
emergency correction
A mechanism to modify smart
contracts to fix criticalvulnerabilities.
Only certain parties will be
involved, and the content will not
be made public until a certain
period of time has elapsed after
the correction is completed.
Protocol can be stopped byemergency shutdown
A certain number of governancevote protects Maker Protocol
from Malicious attacks
Vote at any time, regardless ofthe proposal.
MKR: 1 million tokens already
distributed(as of January 2022)
Distributed and sold 1 million
tokensDistribute a portion to early
adopters

126 https://messari.io/asset/aave/profile/launch-and-initial-token-distribution

104-

As a countermeasure in theevent of a malicious proposal,
the proposal can be cancelled by
the selected authority (Guardian)
via multisig approval during thewaiting period of the governancevote-

Unknown.
Content unknown as not definedin documentation (assumed tobe performed by core team incase of emergency)-

Possible to pause the protocol
with the emergency key
In the event of an emergency,such as an external attack,Guardian's multisig approval cantrigger an emergency key.

--

AAVE: 16 million tokens already
distributed(as of January 2022)
Former LEND token holders 13
million tokens
Breakdown: Founder & Project
23%, Investors 77
Reserve fund: 3 million
tokens126

Initial
Distribution ofGovernanceTokens2) Paid
Distribution
Number ofaddresses
holding
governancetokensNone

276,000 addresses

Sold to venture capitalists via
ICO (Andreessen Horowitz,
Polychain Capital, etc.)

83,000 addresses

1) On-chain voting2) Used to recapitalize stablecoin
DAIs (add or delete DAIs)
3) Used as funds (MKR issued) incase of shortage of liquidation
funds
1) Smart contract changes
Application processing (D3M,
Vaults, Clearing Systems,
Oracle, etc.)
Change parameter values
 Additional changes to newcollateral asset types
 Additional changes toexisting risk parameters
 DAI Savings Rate Changes
Decide on system upgrades
2) Selection of oracle price feeds

None106,000 addresses

1) On-chain voting2) Used as a reserve fund (safety
module) in case of insufficientliquidation funds

Role ofGovernanceTokens1) On-chain voting

Items that canbe proposed intheGovernanceVote1) Application

1) Smart contract changes
Non-core application processing(additional liquidity poolchanges, interfaces, governancevoting, etc.)
Change parameter values (e.g.,
fees)

Items that canbe proposed intheGovernanceVote2) Governance

1) Change in community
management
Distribution of community funds,changes in governance voting2) Modification of the term of core
contract commercial license,
waiver1) Change in community
management
Distribution of community funds,changes in governance voting2) Execution of emergency shutdown(always possible to vote)

1) Change in community
management
Distribution of community funds,changes in governance voting2) Guardian Recommendation

Items thatcannot be1) Smart contract changes(No specific restrictions)(No specific restrictions)

1051) Smart contract changes
Application processing (Lending,
SM/SI, Flash Loan, Credit
Delegation, etc.)
Change parameter values (e.g.,commissions)
Decide on system upgradesproposed in agovernance
vote

GovernanceVotingProcess

System upgrades (performed by
the developer)

Two-tier voting: snapshot voting andgovernance voting1) Snapshot- Voting 2 days, quorum 0.05%,
over 50% in favor
2) Governance Vote
- Voting 5 days, quorum 4%, over
50% in favor

Choose between Governance Voting
and Executive Voting, depending on
the nature of the proposal.
1) Governance Poll
Decide on policies, etc. otherthan changes to the smart
contract, such as the amount,interest rate, and selection of
personnel, etc.
Voting 7 days, quorum 1%,
50% or more in favor
2) Executive Vote
Determine only the portion of
the smart contract that ischangedVote 30 days, quorum 1%,
50% or more in favor

Two-tier voting: snapshot voting andgovernance voting1) Snapshot
3 days to vote, quorum 50
votes, 50% or more in favor
2) Governance Vote
Short time lock (not related togovernance): 3 days ofvoting, 2% quorum, 50.5% ormore in favorLong time lock (proposals
affecting governance: 10days to vote, 20% quorum,
57.5% or more in favor)---

GovernanceVoting Ratio(2021 Actual)
Percentage ofGovernance
Proposals
Passed(Actual resultsfor 2021)

2-day waiting period after the
proposal is approved
Management can cancel
proposals during the waiting
period.
Deployed by administrator after
waiting period-

Governance turnout: approx. 59%.

-

Snapshot Voting 77% (27/35)
Governance Voting 86% (6/7)-

Waiting period after the proposal
is approved (2 days for B only)
Authority can cancel proposals
during the waiting period
After the waiting period, anyone
can deploy-

Governance turnout: approx. 49%.

-

Governance Voting 90%(275/307)
Executive Voting 100% (47/47)

-

106

-

-

Waiting period after the proposal
is approved1) 1 day2) 7 days
During the waiting period, theselected Guardian can cancel
the proposal.
Deployed by administrator after
waiting period-

Governance turnout: approx. 23%.

-

Short time lock 88% (45/51)
Long time lock 50% (1/2 case)Main Voters

Settlementrelated

Large token holders Mainly 10organizations- 4 universities (Berkelay,
Stanford, Harvard, UCLA)- Fintech (Gauntlet, Dharma, Kiva)- VC (Andreessen Horowitz,
Monet Supply, Index Corp.)
Individual investors can delegate
voting rights
Other voters Mainly 3- DeFi project stakeholders(Ethrerum Foundation, Variant,Compound, etc.)

Voting proxy 18 Address- Public Agent 9 Address- Non-public Agent 9 Addresses
Individual investors can delegate
voting rights.
Large private investor (anonymous)

Use for debit card settlement funds
Crypto.com
Payments can be made to about 30 stores such as UNI, MKR, AAVE, etc. for product purchases (Shopping.io)
and travel (Travala.com)-

Cooperat
ion with
Financial
Institutions-financial
Products

Large token holders 4 addresses(including funds for system use)
- Aave- Binance- Balancer- Polygon
Regular voters 4 addresses(anonymous)- The 4 addresses have madedecision on most of the
proposals on the 1) snapshot.
- Individual investors can delegate
their voting rights.

--

Listed an ETP (exchange-tradedproduct) passively linked to UNI
through Valour (Swiss asset
management company), a
subsidiary of DeFi Technologies(Canadian tech company).
Frankfur Stock Exchange inGermany: Euro-denominated
Valour Uniswap ETP (October
2021)
Stockholm’s Nordic GrowthMarket in Sweden: Swedish
Krona-denominated Valour
Uniswap SEK (December 2021)

Monolith
Convert DAI into fiat currency
and load onto Visa debit card for
use

-

-

-

107

-

Sygnum Bank AG (Swiss digital bank) announced the launch of custody and trading services for several DeFi
tokens (governance tokens) and stablecoins (USDC) (June 2021)-

Commonwealth Bank (Australia)
launched 10 crypto exchanges
and custody services inpartnership with Gemini
Exchange and Chainalysis(November 2021).

-

Arab Bank Switzerland to offer
10 crypto-asset-related services(January 2022)-

Custody
TradingServices---

STO Real
Estate Loan
STO: Security
Token Offering

Other
Initiatives-

The company is reportedly
considering entering the market
through a tie-up with a Fintech
company (July 2021).
PayPalFormed partnership with Forge(digital assets subsidiary of
Société Générale) for real estateloans through STO (October
2021)*Six entities in the DAI issuanceplan1) Société Générale
2) Forge
3) MakerDAO protocol
4) Legal representative ofMakerDAO
5) Role of the DIIS Group(French Fixed Income
Investors) Securities Agent
6) Exchanges

Donate to charity (pay as USD)
- UNICEF (charity organization)- NeedsList (Disaster Relief)- PoolDai (Charitable Giving Fund)
Payroll Solutions
108-

Commonwealth Bank (Australia)
launched 10 crypto exchanges
and custody services inpartnership with Gemini
Exchange and Chainalysis(November 2021).

-

Arab Bank Switzerland to offer
10 crypto-asset-related services(January 2022)-

AaveARC- Ability for institutional investors
who have undergone financial
due diligence to borrow and lend
crypto-assets with otherapproved institutional investors-Robinhood (U.S. stock
management application
operator)
E*Trade (U.S. online brokerage
firm)Stripe (U.S. online payment),
etc.

-

Whisp Money (in somecommunities, payroll is paid withDAI to outside employers withKYC unstable)

109

Whitelister
Firms approved by Aave toregister institutional investors on
the AaveARC White List
Registered: U.S. company
Fireblocks (January 2022)
In the process of registration:
Securitize (U.S.), SEBA Bank
(Switzerland)2-6 Results of Major Incident Case Analysis of Other DeFi Projects
We did research on some major incidents that occurred outside of the three projects studied. An
overview of the incident, the reasons for its occurrence, and the problems and responses to them aredescribed as below.
2-6-1 The DAO Attack
The DAO is a decentralized investment fund on Ethreum deployed by Slock.it (Germany) in April
2016 and is considered the first DAO. Participants received DAO tokens in exchange for transferring
ETH to The DAO, where investment targets were voted on by the token holders and investment
returns were distributed as rewards. This paper provides an overview of the June 2016 attack on The
DAO that targeted the reentrancy vulnerability and the Ethereum hard fork that was implemented as a
response to the attack, as well as the reasons for the attack and the issues involved.
(1) Date of Occurrence: June 17, 2016
(2) Outline of the case
The attacker took advantage of a vulnerability in The DAO's reward transfer function to transfer
a large amount of rewards to their own child DAO (their own exclusive address for disbursing
funds), which was tied to the parent DAO, and obtained 3.6 million ETH. However, since the child
DAO's funds could not be transferred for 27 days, The DAO avoided damage by performing a
hard fork of Ethereum (transaction deactivation) before that time.
(3) Damage: No damage due to hard fork. Temporary damage stolen was approximately $70
million. (3.6 million ETH)
(4) Case flow127

Figure 2-6-1 The DAO Attack
1.

The DAO128 Split function129 is used to create its own child DAO independent of the parent
DAO.

2.

Exploiting a vulnerability in the Split function, the attecker embedded a smart contract that
automatically repeated the remittance of rewards before the parent DAO's balance was
updated for the transfer of funds from the parent DAO to the child DAO, and repeatedly

127 SEC Report; https://www.sec.gov/litigation/investreport/34-81207.pdf

Harvard Law School Report: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3014782
128 The DAO: an autonomous diversified investment fund established by Slock.it (Germany)
129 Split function: A function that allows users who disagree with an investment proposal to separate their own funds from theparent DAO, the pool of investment funds, and split them into child DAOs; creation of child DAOs through the Split function
requires curator approval and DAO voting approval (one week).

110

transferred more funds than the attacker held to the child DAO for a total of 3.6 million
ETH.
3.

As an emergency measure, the defenders set up the "RobinHoodGroup" and evacuated
70% of the total funds using the same technique as the attackers. (They quickly
evacuated the funds by devising a way to get more rewards than the attackers)

4.

The attacker was unable to transfer 3.6 million ETH of funds from the child DAO becauseof the restriction that funds in the child DAO using the Split function could not betransferred for 27 days.

5.

The following three proposals were considered as possible solutions to the incident, and
3) Hard fork130 was executed.
1) Do not fork and surrender the funds to the attacker
2) Soft fork and freeze the attacker's account3) Perform a hard fork and make it look as if the transaction itself never happened.

6.

Opposition to the hard fork split within Ethereum, creating Ethereum Classic, which
maintained the original transaction record.
Table 2-6-1-1 History of The DAO from Establishment to Incident

Date

EventsContents-

November,
2015

DAO
Proposal

April 29,2016

Deploying
The DAO
Code-

April 30 ~~ May 28,
2016

Provisionand sale of
DAO tokens

May 26,2016

The DAO
Code
Vulnerability
Surfacesand Security
Proposals-

The DAO, an investment
fund organization launchedby German company
Slock.it UG, has announced
that it issues DAO tokens in
exchange for the virtual
currency ETH, calling it"crowdfunding"
Slock.it deployed DAO code
to the Ethereum blockchain

DAO tokens are now offeredand sold.
During the offering period,
DAO sold approximately
1.15 billion DAO tokens in
exchange for a total of
approximately 12 million
ETH (valued at
approximately $150 million
at the time)

GitHub user discovers flawin smart contract code
This user notified Ethereum
developer and Bitcoin
Foundation founder Peter
Vessenes

Supplement-

At the Ethereum Developer
Conference in London,
Christoph Jentzsch, CEO of
Slock.it, described the DAO
proposal as a "commercial
DAO-

Token prices varied fromapproximately 1 to 1.5 ETH
per 100 DAO tokens,
depending on when thetokens were purchased
during the offering period-

Note: Since DAO tokens are
securities, the U.S. SEC
indicated in a July 2017
report that it was originallyrequired to register theoffering and sale of DAO
tokens.
Slock.it initially proposed a
broader security proposalthat included the formationof a "DAO Security" group,
the establishment of a "bugbounty program," andregular external audits of-

130 Hard fork: An update that does not guarantee backward compatibility after the fork. The rules are rewritten, resulting in apermanent fork.

111June 3,2016-

In response to theseconcerns, Slock.it publishedthe "DAO Security Proposal"
calling for the developmentof specific updates to The
DAO's code and theappointment of security
experts-

Christoph Jentzsch, CEO of
Slock.it, on behalf ofSlock.it, recommends that
all investment proposals besuspended until changes
are implemented to fix
vulnerabilities in DAO's code

Proposal toSuspend
DAO
Proposal

DAO's code, but the cost of
this proposal (125,000 ETH:
paid from The DAO's funds)
was immediately criticized
as too high, and Slock.it)
was immediately criticized
as too high, and Slock.it
decided to revise its
proposal and submit it-

June 6,2016

DAO
Vulnerability
Disclosure-

Vulnerability in The DAO
Smart Contract Announced
by Slock.it
There was a code update on
GitHub on the same day.

-June 17,
2016

-

DAO
incident
occurred-

Attackers stole
approximately 3.6 million
ETH (30% of the ETH raisedby the DAO offering)-

Since there was no quick
solution to update the smart
contract, The DAO
stakeholders formed the"RobinHoodGroup". Theycollected $60,000 in DAO
tokens from the community
and investors throughdonations and recovered
70% of the funds using thesame tactics as theattackers
The following three
proposals were discussed
as possible solutions to thestolen 3.6 million ETH
1) do nothing
Attackers gain 3.6 million
ETH2) soft fork
The attacker's child DAO
is frozen and cannot betransferred. However, 3.6
million ETH will not be
returned to the investor

Prevention
of DAO fundoutflows-

June 28 ~July 15,2016

Consideratio
n ofsolutions112

Slock.it Says Workaroundfor The DAO Vulnerability
Created, No Longer DAO
Funds at Risk ofVulnerability
However, workaround code
was developed but not
deployed
The stolen ETH was held at
an address controlled by theattacker, but the attacker
could not move the ETHfrom that address for 27
days due to the DAO code-

Key members of theRobinHoodGroup Griff Green, Community
Manager, Slock.it, Inc.
 Ethereum developerAlex Van de Sander Christoph Jentzch,
CEO of Slock.it, etc.

-

The hard fork was an
emergency plan proposedby the Ethereum Foundation
and was highly controversialin the community, as it went
against the blockchain
philosophy that transactions
should be irreversible.
Opinions in favor of hardforking Humans should makethe final decision--June 24,2016

Soft Fork
Consideratio
nAbandoned

July 15,
2016

Hard Fork
Agreed-July 20,
2016

Implement
Hard Fork

July 29,
2016

Birth ofEthereum
Classic-

and will be a loss to theinvestor
3) hard fork
Transfer all investor funds,
including the stolen 3.6
million ETH, from The DAO
to a recovery address to
avoid investor losses
Ethereum Foundation andthe community initially tried
to resolve the issue througha soft fork, but decided not
to implement the soft fork
after a flaw was found in thesoft fork code that allowed
for a DoS attack
A vote on the hard fork
proposal was held andpassed in the form ofsending a small amount of
ETH to the voting platform
A new forked Ethereum
blockchain became active
after the majority of the
Ethereum blockchain's
nodes adopted thenecessary software update
Hours after the hard fork,
opponents of the hard fork
resumed mining the original
blockchain and EthereumClassic was born-

through social
consensus.
 It is ethically wrong forthe attacker to profit
and requires community
intervention.
 Leaving ETH in thehands of an attacker
could reduce its value
in the future.
Opinions of opponents ofhard forking
 The unwinding oftransactions is contrary
to the blockchain
philosophy of "Code is
Law","Trustworthiness", and"Immutability".
 It undermines theoriginal purpose of the
Ethereum blockchain
and makes the rules of
the code base subject
to human interests.

-(5) Cause of Occurrence-

Phenomenal Factorsⅰ) Reentrancy Vulnerability
The DAO's smart contract did not take into account the possibility of reentrancy andupdated the internal token balance after funds and rewards were transferred.
ⅱ) A mechanism to update smart contracts that are running was lacking.

-

Motivational Factors
Slock.it failed to recognize 2) above and failed to deploy the modified code before it was
attacked.

(6) Incident Issues
Table 2-6-1-2 The DAO Attack Incident Issues
Item

Sub-Item

Description of issues-

Phenomenal
Factors

Deploym
ent-

Reentrancy vulnerability in the DAO
reward transfer function.
Because the DAO smart contract was
designed to update the internal token
balance after transferring funds, avulnerability existed that allowed
113

implication-

Vulnerability attacks
cause financial damage
to participants

-

-

-

-

-

-

Governa
nce-

Motivatio
nal
Factors

Operation-another function to be called before
the token balance was updated,allowing the funds to be transferredagain without updating the token
balance.
Vulnerabilities in DAO source code
were not discovered in advance bycode audit.
The source code was reviewed by asecurity audit company, but thevulnerabilities were not found.
(Ref.) SEC report: "DAO's source code
was reviewed by "one of the world's
leading security auditing firms" and no
problems were left behind during afive-day security analysis."
Lack of a mechanism to update
deployed smart contracts on an
emergency basis
Code fixes were deployed prior to theincident, but updates required a softfork/hard fork and could not be
updated urgently at the time of theincident
The organization was aware of thevulnerability, but was not proactively
taking countermeasures.
Slock.it announced prior awareness ofthe code vulnerability and stated thatno DAO funds were at risk of thevulnerability with a workaroundcreated, but the code for theworkaround was never deployed.
Slock.it initially offered a broad
security proposal, but was criticized forthe high cost of this proposal andlimited its countermeasures.
Authority was concentrated in the
curator (the administrator who serves
as a fail-safe function)
The curator was an individual
appointed by Slock.it.
Curators could make decisions basedon subjective criteria.
Decisions on the adoption or rejectionof investment proposals, timing, order,
frequency, and halving the voting
quorum (including proposals to
dismiss curators), etc.
DAO token voting rights wererestricted.
Curators did not provide participants(DAO token holders) with sufficient
information about the proposal.

114-

In the event of an
emergency, the smart
contract cannot be
updated and the attack
cannot be defended
against.

-The vulnerability wasdisclosed, but nocountermeasures weretaken, resulting in an
attack.

-The investment projects
are decided according
to the will of thefounding companies
and curators, and do notreflect the will of theparticipants.
Participants cannot
effectively dismiss
curators--

Unable to trigger
improvement activities
due to disadvantage ofparticipants and have torely on founding
companies and curators

Governance-

Participants were anonymous, making
it difficult for them to unite against the
curators.

-

A soft fork/hard fork was considered
as a solution to the incident, shaking
the very foundations of the blockchain
against its philosophy (Code is Law,reliability, immutability)-

A DeFi project incident affected theentire Ethereum platform.
The DAO was attacked, but thesolution was a hard fork of the
Ethereum platform
The Ethereum hard fork affected
applications on Ethereum not related
to The DAO.
No international rules have been
established for incidents on global
platforms
Ethereum is a global platform(Ethereum Foundation is a Swiss nonprofit organization) and can only be
regulated in countries where it is itself
registered (not subject to every
national law and regulation where it
provides services).
There is no international agreement on
how to investigate and respond toincidents on Ethereum.
The DAO was not registered as astock exchange.
The DAO may have been required toregister as it met the definition of aU.S. stock exchange in terms ofproviding a trading platform for DAO
tokens.
DAO token was not registered for sale.
DAO token was determined to be
securities by the SEC, meaning it had
be registered before sales.

--

Complian
ce
-

-

-

Trade-off between
blockchain philosophy
and human interests(recovery from damage
caused by humanintervention)-

DeFi project glitch
affects entire platform
Platform support could
affect other applications

-

-

-

No legal protection forparticipants outside thecountry of registration
Global investigation andmeasures to incidents
cannot be conductedsmoothly.

-

Concerns on Investor
Protection-

Concerns on Investor
Protection

2-6-2 Flash Loan Attack #1
Here, wel provide an overview of the Flash Loan Attack incident case that occurred on bZx131 , amargin trading and lending platform, in February 2020, the reasons for the incident, and the issues
involved.
(1) Date of Occurrence: February 15, 2020
(2) Damages: approximately $350,000(3) Summary of the Incident
By attacking a vulnerability in bZx's margin trading smart contract, the defendant intentionally
131 https://bzx.network/

115

inflated the price of WBTC through the mass exchange of ETH and stole 1,271 ETH througharbitrage.
(4) Case flow132

Figure 2-6-2 Flash Loan Attack #1
1. The following a) to f) were continuously executed in one transaction by Flash Loan.
a) The attacker borrowed 10,000 ETH from dYdX133 via Flash Loan.
(Major DeFi's that offer the Flash Loan feature: Aave, dYdX, Equalizer, etc.)b) The same attacker borrowed 112 WBTC134 from Compound135 with 5,500 ETH as
collateral.
c) The same attacker borrowed 5,637 ETH from bZx on margin trading with 1,300 ETH as
collateral. (leveraged at approx. 4.3x more than usual)d) 5,637 ETH borrowed on Zx was exchanged for 51 WBTC on KyberSwap136
KyberSwap exchanged ETH for WBTC on Uniswap, one of several decentralizedexchanges it partners with The large amount of ETH being exchanged caused Uniswap's
WBTC price to rise to about three times its normal level (Uniswap's exchange rate).
(Uniswap's exchange rate: 38 ETH/WBTC at normal time -> soared to 109 ETH/WBTC,
about 3 times the normal rate)e) Aiming to take advantage of the surge in WBTC prices on Uniswap, the ataccker
exchanged 112 WBTC that was borrowed from Compound on Uniswap for ETH, earning
6,871 ETH.
f)

With dYdX, the 10,000 ETH borrowed from Flash Loan is repaid, resulting in a profit of 71
ETH as the difference.
(Profit 71 ETH = 6,871 ETH exchanged + 4,200 ETH unused - 10,000 ETH repaid)

132 https://peckshield.medium.com/bzx-hack-full-disclosure-with-detailed-profit-analysis-e6b1fa9b18fc

https://bzx.network/pdfs/CertiK_Review_Report_for_bZx_v2.pdf
133 dYdX: DeFi platform for margin and derivatives trading: https://dydx.exchange/
134 WBTC: Wrapped BTC Stablecoin linked to Bitcoin on Ethereum
135 Compound: lending platform with TVL second to AAVE: https://compound.finance/
136 Kyberswap: DeFi platform for decentralized exchanges: https://kyberswap.com/about/kyberswap

116

2. WBTC price then returned to normal, at 38 ETH/WBTC.
3. The attacker repaid 112 WBTC borrowed at Compound and liquidated for 4,300 ETH. As aresult, The difference from the collateral was the profit of 1,200 ETH worth of WBTC was
obtained.
(5) Cause of Occurrence-

Due to an attack that exploited a vulnerability in bZx's margin trading smart contract.

-

A large amount of ETH was exchanged into WBTC using the bZx margin trading function,and due to a vulnerability, that prevented positions from being liquidated due to insufficient
ETH collateral even though the WBTC price was rising (ETH price was falling), the WBTC
price was intentionally inflated and the difference was stolen through arbitrage.
Table 2-6-2: Flash Loan Attack #1 Incident Issues

Item

Sub-Item

Description of issues--

Phenomenal
Factors

Deploym
ent

-

-

-

Motivatio
nal
Factors

Deploym
ent-

Governance-

Vulnerability in bZx's margin trading
smart contract.
bZx margin trading intentionallyinflated WBTC prices due tovulnerability of positions not being
liquidated due to lack of ETH collateral
After the incident occurred on
February 15, the system was
temporarily shut down and a smart
contract upgrade was announced on
2/16 (the fix was completed on
February 17)
Failed to discover vulnerabilities in bZx
source code in advance
Source code was reviewed by a code
auditing company, but novulnerabilities were found.
The audit was conducted by CertiK on
February 2020 and noted 6 points ofimprovement information, although
there were no serious vulnerabilities.
However, the vulnerability that caused
this issue was not detected
There are two ways to deploy: voting
and emergency, which presents
challenges for management.
In normal times, the governancetokens vote to approve, but fixes for
non-urgent vulnerabilities are included
in regular updates and take longer
time to address (vulnerability fixes
should not be voted on).
In an emergency, deployments can bemade without a vote, creating
loopholes such as developer
intentionality.
Governance was managed by votingwith governance token (BZRX), but inreality it was managed by the core

117

Existing Risks

-

-

-

-

-

Vulnerability attacks
cause financial damage
to participants.
The spread of damage
caused by the attack will
reduce confidence andinvestment in the cryptoasset itself.
If there are too many
attacks, the overall
confidence in the DeFi
market will decrease.

Participants' losses due
to attacks prior to fixing
vulnerability responses
in periodic updates.
Decrease in confidence
in applicable cryptoassets

Participants are harmed
by intentional proposals

founders and team members of thefounding company, bZeroX, LLC, anddecision-making authority wascentralized(No specific relationship between thisincident and governance issues)by founding companies,
core founders, etc.

*Revised bZx Governance Rule to address governance issues (effective since August 2021)137
Process to approve proposals by vote of governance token (BZRX)Stage 1: Forum Discussion
Submit proposals for review
0.5% of the total (5.15 million BZRX) consent required (2 days)
Stage 2: Snapshot Voting
Requires a minimum of 50% approval + 4% of the total (41.2 million BZRX) consent(3 days)Stage 3: On-chain governance decisions
Proposal will be implemented after TimeLock (2 days) Minimum 7 days total
Items to suggest
Funding, fees, token related, ecosystem related, marketing, development roadmap/feature
prioritization, salaries and personnel movement
2-6-3 Flash Loan Attack #2
The Flash Loan Attack incident case that occurred again in bZx immediately after the 2-6-2 incident
in February 2020 is discussed here, with an overview of the incident, the reasons for its occurrence,and the issues involved.
(1) Date of Occurrence: February 18, 2020
(2) Amount of loss: $633,000 (2,378 ETH)
(3) Summary of Incident
By attacking the Oracle vulnerability in bZx, the attacker intentionally inflated the sUSD138 priceby mass exchange of ETH and stole 2,378 ETH through arbitrage.
(4) Case flow139

137 https://bzx.network/blog/bzx-dao

https://bzx.network/pdfs/CertiK%20Verification%20Report%20for%20bZx.pdf
138 sUSD: Synthetix crypto-asset
139 https://peckshield.medium.com/bzx-hack-ii-full-disclosure-with-detailed-profit-analysis-8126eecc1360

118

Figure 2-6-3 Flash Loan Attack #2
1. The following a) to e) were continuously executed in one transaction by Flash Loan.
a) The attacker borrowed 7,500 ETH from bZx with a Flash Loan.
b) Exchanged 540 ETH for 92,419sUSD on KyberSwap. Then 360 ETH was exchanged for
63,584sUSD. (Exchanged 900ETH for 156,003sUSD in total)
KyberSwap exchanged ETH for sUSD on Uniswap, one of several decentralizedexchanges it partners with. This caused KyberSwap's sUSD price to rise approximately
threefold.
KyberSwap's exchange rate: 0.00372 ETH/sUSD under normal conditions -> soared about
3 times to 0.00899 ETH/sUSD.
c) At Synthetix140 , 6,000 ETH was exchanged for sUSD. 3,518 ETH was exchanged for
943,837 sUSD due to sUSD shortage and 2,482 ETH was refunded. (Exchange rate:
0.00372 ETH/sUSD under normal circumstances)d) Borrowed 6,796 ETH from bZx with 1.1 million sUSD as collateral. At normal sUSD prices,
the borrowing limit would be about 4,000 ETH, but bZx was able to borrow 6,796 ETH due
to the soaring sUSD because of the Oracle reference to KyberSwap. (The attacker left theborrowed state without repayment)e) The 7,500 ETH borrowed from bZx was repaid and a profit of 2,378 ETH was earned.
(Profit 2,378 ETH = 6,796 ETH borrowed + 3,082 ETH unused - 7,500 ETH repaid)(5) Cause of Occurrence-bZx's reliance on KyberSwap for Oracle price references caused the kyberSwap tointentionally inflate the sUSD price, and when the difference between the normal price andthe swap price increased, arbitrage was used to steal the difference.
Table 2-6-3 Flash Loan Attack #2 Incident Issues

Item

Sub-ItemPhenomenal
Factors

Deployment

Description of issues-

Vulnerability in Oracle reference inbZx.
bZx's reliance on KyberSwap for
Oracle price references caused

140 Synthetix: DeFi project of a decentralized exchange

119

Existing Risks-

Vulnerability attacks
cause financial damage
to participants--

Motivatio
nal
Factors-

KyberSwap to deliberately inflate theprice of sUSD, which was targeted
when the difference from the normal
price increased.
Oracle reference vulnerability in bZx
not discovered in advance
Source code was reviewed by a code
auditing company, but novulnerabilities were found.
CertiK's audit in February 2020 did notdetect the vulnerability that caused
thisSame as 2-6-2 Flash Loan Attack #1--

The spread of damage
caused by the attack will
reduce confidence andinvestment in the cryptoasset in question.
If there are too many
attacks, the overall
confidence in the DeFi
market will decrease.

-

2-6-4 Money Laundering
The following is an overview of the money laundering incident case that occurred in September
2020, the reasons for the incident, and the issues involved.
(1) Date of Occurrence: September 26, 2020
(2) Damages: Approximately $275 million(3) Outline of the caseApproximately $275 million worth of crypto-assets were stolen from KuCoin141, a Singaporebased crypto-asset exchange, when the hot wallet private keys of the exchange's
administrators were stolen.
The funds were dispersed and transferred to over 200 Bitcoin, Ethereum, and otherblockchain exchanges.
According to an investigation by Chainalysis, a blockchain analysis company, the attack was
carried out by the Lazarus Group, a North Korean cybercrime group.
In November of the same year, the $204 million was recovered through the freezing ofassets by various exchanges and with the cooperation of the police, and almost all of thedamage was covered, including compensation through insurance.
(4) Case flow142

141 KuCoin: Hong Kong's Crypto-asset Exchange
142 https://www.kucoin.com/news/en-kucoin-ceo-livestream-recap-latest-updates-about-security-incident

https://www.kucoin.com/news/en-kucoin-ceo-livestream-recap-latest-updates-about-security-incident-0930
https://www.kucoin.com/news/en-the-latest-updates-about-the-kucoin-security-incident
https://blog.chainalysis.com/reports/kucoin-hack-2020-defi-uniswap-japanese
https://blog.chainalysis.com/reports/lazarus-group-kucoin-exchange-hack-japan

120

Figure 2-6-4 Money Laundering
1.
2.
3.
4.
5.

An attacker stole the KuCoin administrator's hot wallet private key and a large amount ofcrypto-assets were stolen.
Bitcoin: 683 BTC of the 1,008 BTC stolen were transferred to the mixing service143 andanonymized.
USDT: Of the 19.83 million USDT stolen, 50,000 USDT was transferred to Chainlink144 ,Synthetix and several other DeFi.
USDT: USDT transferred to Uniswap and other exchanges and converted to othercurrencies.
USDT: After redemption, the money was transferred to the attacker's address.

<Major crypto-assets leaked from Kucoin>
19.83 million USDT
1,008 BTC ($10.76 million)
Various ERC-20*6 tokens worth $147 million
Stellar*7 tokens worth $87 million, etc.

(excluding USDT)(5) Cause of Occurrence-

The private key of the KuCoin administrator's hot wallet was stolen. However, detailed
information on the incident, including the circumstances of the theft of the administrator's
private key, has not been released at this time. (It has been announced that this information
would be released as soon as the investigation by the police and security authorities iscompleted.)-

Assets in cold wallets have not been leaked.
Table 2-6-4 Money Laundaring Incident Issues

Item

Sub-Item
OperationDescription of issues-

Stolen crypto-assets were replaced
without incident.

Existing Risks-

Stolen crypto-assets canbe easily laundered.

143 Mixing services: a method of mixing multiple Bitcoin remittance data to protect the privacy and anonymity of users. Makes

it difficult to track where assets were sent from and to where.
144 Chainlink: a decentralaized Oracle network connecting on-chain and off-chain

121

-

-

Phenomenal
Factors-

Operation-Technology-OperationMotivatio
nal
Factors-

Governa
nce

Regulation-

Of the USDT stolen, 20,000 USDT
was immediately converted to ETH via
Uniswap
It took a long time to freeze the stolen
crypto-assets (no fund transfers).
Crypto-asset freezes were
implemented with the cooperation ofmany exchanges and others to whichmoney was transferred (eachexchange handled asset freezes
individually)
Attacker cannot be identified.
Stolen crypto-assets are transferred toa number of DeFi, and the attackers'
destinations and addresses arerecorded on the blockchain, but it is
impossible to identify who did it
because they use an exchange that
does not require KYC
Stolen assets are difficult to trace.
Bitcoin uses a mixing service toanonymize the funds, making it difficult
to identify the movement of funds afterthat.
KuCoin administrator's hot wallet
private key stolen
However, detailed information on theincident, including the circumstances
surrounding the theft of theadministrator's private key, has notbeen released at this time
Lack of technology to manage theadministrator's private key
The technology required to manage
the administrator's private key may nothave been used (details are
undisclosed and not publicly available)
The administrator did not maintainstrict control of the private key.
Assumed that the administrator had aweak awareness of the importance ofmanaging private keys.
Inadequate protection against theft of
the administrator's private keys
Although the cause of theadministrator's private key theft has
not yet been announced and details
are not available, it is believed that
effective anti-theft measures werenecessary if private key management
operations were to be compromised
Guidance may have been needed
regarding the administrator's
measures to prevent private key theft.

122-

The damage to stolen
crypto-assets is
unstoppable andescalating.

-Funds transfers can be
repeated without
identifying the attacker.

-

Funds transfers make it
impossible to locate
stolen crypto-assets-

Theft of an
administrator's private
key results in the loss ofcrypto-assets anddamage to participants.
Decrease in confidence
in applicable cryptoassets--

Theft of administrator's
private keys throughweak technology-

Private key theft due tocareless managementby administrators-

Decrease in confidence
in applicable cryptoassets-

Decline in trust in the
DeFi market as a whole
due to a number ofincidents of private key-The detailed cause of theadministrator's private key theft is
unknown, but if there is a problem withthe private key management operation,
it is considered necessary to establish
certain standards as an anti-theftmeasuretheft by similaradministrators.

2-6-5 Bitcoin Vulnerability (CVE-2018-17144)145
This section provides an overview of the September 2018 Bitcoin vulnerability incident case, thereasons for its occurrence, and the issues of this incident.
(1) Date of Occurrence: September 18, 2018
(2) Amount of loss: None
(3) Outline of the case-

For Bitcoin Core146 versions 0.15.x, 0.16.0, 0.16.1, 0.16.2, and 0.16.2-

Vulnerabilities related to DoS attacks147 and double payments were discovered and fixed inversions 0.16.3 and 0.17.0rc4.

-

It was possible to intentionally crash the Bitcoin network node148by exploiting this vulnerability,
and if the majority of nodes in the hash rate did not have the modified program applied, they
were at risk of a 51% attack or other attacks. Therefore, the public announcement of thevulnerability was delayed to allow time for the majority of nodes to upgrade.

(4) Case flow149

145 CVE-2018-17144: Common Vulnerabilities and Exposures, identifier numbered by MITRE, a US non-profit organization
146 Bitcoin Core: An open source program that serves as the reference software for Bitcoin mining and trading.
147 Dos Attack: Denial of Service Attack, a cyber attack that maliciously sends large amounts of data to a server to make it

virtually impossible to run a service.
148 Node: a device that processes the blockchain. Nodes have the following functions: routing, blockchain database, mining, andwallet.
149 https://bitcoincore.org/notice/https://hackernoon.com/bitcoin-core-bug-cve-2018-17144-an-analysis-f80d9d373362

123

Figure 2-6-5 Bitcoin Vulnerability
September 17 14:57 Anonymous person discovered the vulnerability and reported it to several
parties at Bitcoin Core.
September 17 17:47 Bitcoin Core developer confirms vulnerability.
September 18 20:44 Bitcoin Core developer releases fixed program.
September 18 21:47 Public banners on Reddit and other sites encouraging node upgrades.
September 19 14:06 Additional message on mailing list to encourage node upgrades.
September 20 Full disclosure of this vulnerability.
(5) Cause of Occurrence
Table 2-6-5 Bitcoin Vulnerability Incident Issues
Item

Sub-ItemPhenomenal
Factors

Deployment

Description of issues--

Cases of double input of UTXO
(unspent transaction output)
sometimes slipped through thetransaction validity check.
While optimization of transaction
validity checks and UTXO
management has continued, thevulnerability was the result of
loosening checks for further
optimization in fixing of the version
0.15 fix.

Risks/Implications-

Risk of system
shutdown or theft of
funds

-

Risk of attack by a nodethat does not adopt thecorrection program intime
If a similar vulnerability
is discovered in the
DAO, Responsible
Disclosure may not beable to delay theannouncement of thevulnerability when aprogram fix needs to bevoted on and approved,
and the public may
become aware of theurgent vulnerability.

-

Motivatio
nal
Factors-

The vulnerability required a fix to be
applied to the majority of nodes at thehash rate, which took a long time toaddress.

-

Node upgrades are done at thediscretion of the node side, so there is
no guarantee that a request to reflecta modified program will be responded
to.
Malicious nodes may not update withold programs
Vulnerability was inherent from Bitcoin
Core version 0.15.x, but wasundetected for a long period of time.
In this case, the vulnerability was
discovered by an anonymous reporter.

Deploym
ent

-

-

124

-

Nodes are not upgradedwith old programs andvulnerabilities are not
fixed

-

In this case, theanonymous person
reported thevulnerability to the
Bitcoin Core

development teamwithout disclosing it
publicly, but it was up to
the person to decide
whether or not todisclose thevulnerability.
2-6-6 Stealing of Funds Locked in a two-way Bridge in a Side Chain (Ronin Network)
This section provides an overview of the incident case of theft of funds locked in a two-way bridgeof a side chain that occurred in March 2022, the reason for the incident, and the problem. The causeof this incident was the theft of private keys of validators. 9 validators were managed by 2 companies,
and 5 validators' private keys were stolen at the same time by one company's system attack, which isan unfavorable example of private key management.
(1) Date of Occurrence: March 23, 2022
(2) Losses: Approximately $620.1 million *Highest amount at the time of occurrence(3) Outline of the case-

On March 23, the private keys of some validators of the Ronin Network150 running Axie
Infinity151 were stolen, and the funds for the two-way bridge connecting the Ethereum
network and the Ronin Network (Ronin Bridge152 ) were stolen.

-

March 29, the incident was discovered when a user was unable to withdraw funds from
Ronin Bridge. Sky Mavis, the operator company in Vietnum of Ronin Bridge, shut down Roni
Bridge and investigated the cause.

-

April 6, Sky Mavis raises $150 million from several VC firms to cover losses.

-

April 14, The U.S. Federal Bureau of Investigation (FBI) announces that the North Korean
hacker group "Lazarus Group" and "APT38" are responsible for the attack.

-As of April 20, Ronin Bridge is out of service.

(4) Case flow153

150 Ronin Network: an Ethereum sidechain (creating a blockchain different from the parent mainchain and transferring funds

via a two-way bridge), launched in February 2021 by operator Sky Mavis exclusively for Axie Infinity.
151 Axie Infinity: Online game where players collect, train, and compete with NFT pets 8.3 million players (as of December
2021)
152 Ronin Bridge: a bridge that transfers funds between the Ethereum Network and the Ronin Network. Prevents double use of
Ethereum coins in the parent chain by locking them into the bridge.
153 https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=r
https://medium.com/uno-re/biggest-crypto-hack-of-all-time-a-breakdown-of-the-ronin-network-hack-ef8d9e25ba6bhttps://www.nansen.ai/research/ronin-the-engine-powering-axie-infinitys-growth125

Figure 2-6-6 Outline of the case1.

March 23, Private keys on 5 of the 9 nodes of the Ronin Network Validator were stolen, andETH and USDC locked in the Ronin Bridge were stolen. ETH and USDC locked in Ronin
Bridge were stolen. (The system required the approval of 5 of the 9 nodes.)2.

March 29, User is unable to withdraw ETH from Ronin Bridge and incident was discovered.
Validator threshold was immediately revised from 5 to 8. Confirmed that most of the stolen
funds were held in the attacker's wallet. Investigation of the attacker and monitoring of thewallet is underway in cooperation with government agencies.

3.

3/31 Replaced 4 nodes managed by Sky Mavis that were stolen and 1 node at Axie DAO(Sky Mavis is planning to migrate to a DAO and it is a candidate DAO to migrate to). New
validators are being considered for addition.

<Stolen Funds and Crypto-assets>
Total $620.1 million
ETH 173,600 ETH ($594.6 million)
USDC $25.5 million(5) Cause of Occurrence
The cause was that the private keys of 5 of 9 nodes of the Ronin Network Validator were stolen.
-

Sky Mavis 4 nodes
An attack on the Sky Mavis system resulted in the theft of the private keys of all four
nodes of validators stored on the centralized server. (Means of attack undisclosed).

-

Axie DAO 1 node
In November 2021, as a countermeasure to the skyrocketing fees associated with Ronin
Network's rapid transaction growth, one Axie DAO node was added to provide freetransactions to users, and the Sky Mavis node was allowed to sign by proxy.

-That action was completed in December 2021, but Sky Mavis did not remove the proxysignature authorization list. As a result, it was automatically stolen in conjunction with thetheft of the 4 Sky Mavis nodes.
Table 2-6-6: Issues with theft of funds locked to a two-way bridge in a side chain

Item

Sub-Item

Description of issues

126

risk implication-Phenomenal
Factors

Operation

Sky Mavis systems were attacked andthe private keys of four validator
nodes were stolen. (Details of theattack have not been released.)

The private keys of four Sky Mavis
validator nodes were stored on acentralized server, and the above
attack resulted in the simultaneoustheft of the private keys of all four
validators.

-

-

-

The private keys for the Axie DAO
validators, which were managed
separately from the four Sky Mavis
validators, were also stolen at thesame time.
--

OperationMotivatio
nal
Factors-

DeploymentNine private keys are managed by twoorganizations, Sky Mavis and Axie
DAO (Sky Mavis has centralized
control of the nodes.
The validator for Ronin Network may
have been specified by the operator,
Sky Mavis.

The PoA consensus validator
threshold for the Ronin Network was"5" (5 out of 9 for a block decision).
Ronin Network is a blockchain
dedicated to Axie Infinity games, andthe block creation time is only about 3
seconds, which was the minimum
threshold to minimize the PoA time.

Sidechains, such as Ronin Network,
lock Ethereum funds into a bridge andconvert them to sidechain cryptoassets, which locks a large amount offunds into the bridge and makes thisbridge vulnerable to attackers.

127

Theft of private keys ofvalidators leads to theftof funds
Hijacking of validators
could be used for otherattacks, such as
malicious contract
execution
Including the private
keys of the Axie DAO
validators, virtuallymajority of the private
keys were stolen in asingle attack.
The attack on Sky Mavis
would likely haveresulted in the automatictheft of Axie DAO's
private keys, and theprivate keys were
essentially not managed
separately.
When validator nodes
are operated by a small
number oforganizations, there isan increased risk thatthe private keys of thevalidators for thenumber of nodes
needed to make block
decisions can be stolen,
for example, if theprivate keys of thevalidators are stolen at
the same time.

-

Smaller thresholds
increase the risk ofprivate key theft forvalidators with thenumber of nodes
needed to make block
decisions.

-Sidechains with largetransaction amounts
have large amounts ofmoney locked up in theirbridges, making themeasy targets for
attackers.
Reference Solana blockchain
on 2/22/2022 was
attacked by the
Wormhole bridge--Governance

The attack prevented Axie Infinity
players who had exchanged Ethereum
ETH or USDC for Ronin RON, AXS, or
SLP from being able to pay out ETH or
USDC.

-

was attacked,
causing $325 million
in damage (due toan attack on avulnerability in thesignature contract).
Other side chains havealso locked up large
amounts of money inthe bridge.154
 Polygon: approx.
5.51 billion dollars
 Avalanche approx.
4.97 billion dollars,
etc. (as of
4/12/2022)
Funds are notrefundable.
In this case, Sky Mavis
announced on 4/6 that it
has raised $150 million
in funding from multiple
VC firms to ensure that
all affected users
receive refunds.

2-6-7 Major Incident Cases after 2020155
Many incidents have occurred due to software vulnerabilities and inadequate management ofprivate keys.
Table 2-6-7 Major Incident Cases after 2020
Date ofOccurrenceCause

4/19/2020

Softwarevulnerabi
lities(Reentrancy)

8/25/2020

Softwarevulnerabi
lities(Defects
instaking
pool
processi
ng)

Related DeFi

Amount ofdamageLendf.Me(Lending)

US$25
million[of which$21 million
wascollected].

Case Summary-

YFValue(current
Value DeFi)(YieldFarming)

Up to
US$170
million[Full
recovery]

154 https://dune.xyz/eliasimos/Bridge-Away-(from-Ethereum)
155 https://hacked.slowmist.io/en/

128-

ERC777 token reentrancy attack that
exploited a vulnerability in Ethereum.
The attackers had trouble cashing in thestolen crypto-assets (ETH, etc.) andmost of them were returned.
A vulnerability in the YFValue (YFV)
staking pool caused the YFValue timer
to reset, locking some funds in the pooland preventing them from being
withdrawn
A total of $170 million in the staking
pool was at risk of being locked and not
being able to be withdrawn, andextorted from the attackers.

9/14/2020

Softwarevulnerabi
lities(Unautho
rized
token
issuance)bZx(derivative)

US$8
million[Full
recovery]-

The management team then bailed out
the funds locked in the staking pool.156-

Approximately $8 million was stolen
when a vulnerability was exploited thatallowed bZx's iToken (a token that canaccumulate interest) to be illegally
amplified.
Later, they found the attacker andrecovered the full amount.

-

10/26/202
0

Fraudulent
manipulation ofOracleprices(Depletio
n ofcollateral
assets)HarvestFinance(YieldFarming)

US$34
million[of which$2.5
millionwascollected].

--

11/30/202
0

5/18/2021

8/10/2021

Softwarevulnerabi
lities(Reimbursementprocessing
defects)

SaffronFinance(Lending)

Fraudulent
manipulation oforacleprices(Depletio
n ofcollateral
assets)Venus(Lending)

Softwarevulnerabi
lities(Blockch

Poly Network(cross-chain
bridge)US$50
million[Full
recovery]-Smart contract redemption error(vulnerability that prevents funds frombeing withdrawn after writing certain
inputs) was attacked and deposits of 50
million DAI were locked for 8 weeks.

-

The price of the Venus token (XVS)
doubled due to price manipulation bylarge traders. Hundreds of millions ofdollars worth of BTC and ETH wereborrowed using the inflated XVS ascollateral for the loans.
When the price of XVS fell and thecryptocurrency borrowed against XVS
had to be repaid, the system could nothandle the repayment on time due tothe low liquidity of XVS, resulting in aloss of $7.7 million in Venus protocols.
Since there is a 10% fee for providing
liquidity, the attacker earned $55 million,
the liquidity provider earned $20 million,
and the reseller earned $2 million in thiscase.
Poly Network suffered a hacking attack
that exploited a vulnerability inblockchain-to-blockchain transactions,stealing over $610 million in crypto-

US$77
million-

US$610
million[Full
refund]The attacker transferred 20 WETH toHarvest Finance's contract andmanipulated the price of Curve todeplete funds in crypto-assets (fUSDT,fUSDC). The attackers then converted
the funds into renBTC, stealing a total of
approximately $34 million. The
attackers attacked end-to-end over aseven-minute period, giving no
response time
The attackers used the Ethereum
mixing platform "Tornado.cash" toconceal the funds transfer.
Attackers returned $2.5 million to thedeveloper at USDT and USDC.

-

156 https://valuedefi.medium.com/yfv-update-staking-pool-exploit-713cb353ff7d

129

ain-toblockcha
intransacti
onglitches)

10/27/202
1

10/30/202
1

11/5/2021

Softwarevulnerabi
lities(Flashloan
attacks)
Inadequatemanagement ofprivatekeys
Inadequatemanagement ofprivatekeys

11/30/202
1

Softwarevulnerabi
lities(Inadequate token
pricing)

12/2/2021

Softwarevulnerabi
lities(Unautho
rizedinsertionofphishing
UI)

-

Cream
Finance(Lending)

US$130
million-

BoyX High
Speed (BXH)(DEX)

US$139millionbZx(derivative)

US$55
million[Full
refund]---Monox (DEX)

US$31
millionBadger DAO(YieldFarming)

US$120
million--

12/3/2021

2/2/2022

Softwarevulnerabi
lities(Tokentampering)

Polygon(side chain)

Softwarevulnerabi
litiesWormhole(two-way
bridge)US$2
million-

US$320
million130-

assets and transferring them to multiple
accounts including Binance Smart
Chain, Ethereum, and Polygon.
A statement was issued that the attack
was carried out to make the vulnerability
known, and the full amount was
returned a few days later.
Flash loan attacks stole a total of
approximately $130 million in Cream LP
tokens and ERC-20 tokens.
This was Cream Finance's third flash
loan hit, following two in February andone in August.
Private Key Compromise Leads to $139
Million Outflow
The attacker may have hacked into theprivate keyholder's computer or was
one of BXH's technical staff
Developers' private keys used to control
project deployment between Polygon
and BSC were compromised and $55
million stolenbZx DAO voted to approve plan for fullcompensation for damages
A smart contract vulnerability (where thesame token price was used as thereference price for the sale andpurchase of tokens) was exploited tomanipulate and inflate the price of Monotokens, which were then exchanged andwithdrawn for other tokens.
The attacker created a malicious API
key and inserted a phishing UI (UserInterface) by attacking a flaw inCloudflare on an external network.
The user's address was stolen by thecriminal and the funds were stolen by
the user clicking on the UI.
On 12/3, a white-hat hacker notified
Polygon of a critical vulnerability(allowing an attacker to arbitrarily
generate tokens using Polygon's
contracts), and a patch was released on
12/5, but MATIC coins equivalent to $2
million were stolen as until the patch
was apllied.
Responsible disclosure delayed thevulnerability announcement, and the fix
was officially disclosed the fix on
December 29.
A vulnerability in the smart contract (aflaw in the contract that verifies

(Defects
in thesignatureverificati
onprocess)---

4/17/2022

Softwarevulnerabi
lities(Inadequate
emergencycommitconditions)

Beanstalk(stablecoin)

US$182-signatures) was exploited, and funds
locked in the bridge were stolen.
Wormhole's parent company,
JumpCrypto, covered the damage with
its own funds to support the Solana
ecosystem.
Governance voting smart contract
vulnerability exploited and funds stolen
by Flash Loan157
Incident Flow1) The day before the incident, two
proposals were made: a malicious
governance proposal (specifying a
malicious smart contract address)
and 2) a normal proposal (dummy
Ukrainian donation proposal).
Intentionally the attacker made it lookilke that the proposal 1) is a proposal
with an incorrect address and let it get
mixed in other proposals as if it is anormal one.
2) On the day of the incident, Flash
Loan performed the following on Aave
 Borrowed a total of $1 billion
from Aave in ETH, USDC, andUSDT Borrowed funds to purchase 2/3
of Beanstalk's governor tokens
 Vote for malicious proposals withpurchased governance tokens
 Successfully executed a
malicious smart contract byactivating Beanstalk's
Emergency Commit and stole
Beanstalk's funds
Cause of the incident
1) No one in the community noticed themalicious proposal.
Verification of proposals
depended on the cooperation ofcommunity members, and noone was able to find a malicious
proposal
2) There was no mechanism to cancel
malicious proposals in the Emergency
Commit.
There needed to be amechanism to cancel proposals
and a cancellation period.
3) Inadequate conditions for activationof Emergency Commit in Beanstalk

157 Beanstalk Farms loses $182M in DeFi governance exploit

https://cointelegraph.com/news/beanstalk-farms-loses-182m-in-defi-governance-exploit

131

-

-

-

5/10/2022

Significa
nt dropin market
price duetomassiveselling of
stablecoins

Terra
Blockchain
TerraUSD(UST)
AnchorProtocolDecline inmarketprices
UST 83%.
LUNA
99%

158 Terra USD (UST) Dipeg fray: https://coinpost.jp/?p=350288

132(Activation condition) 1 day after
proposal & 2/3 or moreaffirmative votes to be executed
If the proposal is passed and acertain period of time (e.g., twodays) is waited, it would not be
attacked by Flash Loan.
4) Aave's Flash Loan was abused.
Aave's Flash Loan was exploited
to attack other DeFi projects
because of its unsecured,
unlimited borrowing
The market price failed to maintain
1USD due to massive selling of
Stablecoin UST and fell significantly158 .
There have been two previous
occasions when the price wastemporarily unable to maintain 1USD,
but this time the price was unable toreturn.
Case Flow
1) May 5, The overall price of cryptoassets, including Bitcoin and ETH,
fell. (Bitcoin fell up to 32% on 5/12)2) May 7, A large withdrawal ($1.4
billion) from Anchor Protocol reduces
deposit volume and the price ofstablecoin UST begins to drop. (Thelarge withdrawer is unknown. Assetmanagement companies BlackRock
and Citadel denied the involvement)
3) May 8, UST was sold for $258
million, further lowering the price.
4) May 9-10, UST fell 2% and could nolonger hold 1USD; LFG (LunaFoundation Guard) released theentire amount of about $4 billion in
Bitcoin they were holding to maintainthe price, but they were unable to getback to 1USD due to lack of funds
against selling. The price did not
return to 1USD due to lack of funds
for the sell-off. (UST market cap was$18.64 billion as of 5/8)
USTs were sold in large
quantities due to the uncertainlyin the market, causing the priceto collapse, and the algorithm
minted a large number of native
token LUNAs, causing the priceof LUNAs to fall.
Total LUNA supply: approx. 730
million tokens as of 5/5 →increased to 6.5 trillion tokens asof 5/13 (approx. 8,900x)
5) May 13, Terra blockchain operations
were temporarily suspended.
Market price UST: $1.0 to $0.17(down 83%); LUNA: $80 to $0.02(down 99%)
*Anchor Protocol: a savings protocol for the
Terra blockchain that offers up to 19.5%
yield when depositing UST tokens.
LUNA: Native token of the Terra
blockchain, used to maintain the price of
USTs. (burns when UST exceeds
1USD, and mints when UST falls below
1USD to maintain UST = 1USD)
2-7 Analysis of Trust Point Weakest Link in Chains of trust
Based on the results of the mapping of key components in the chains of trust and the analysis ofmajor DeFi projects and major incident cases, the following are considered trust points and weakest
links.
2-7-1 Analysis of Trust Points(1) Ethereum Library159-

Various services outside the blockchain, such as wallets that access the
Ethereum
blockchain, use a common library provided by the Ethereum Foundation and others, andusers assume that this library functions correctly.

-

Figure 2-7-1 Unhosted Wallet and client software depend on the Ethereum Library, and the
Ethereum Library is considered a trust point(2) Ethereum Node Software160
Nodes running on the Ethereum blockchain are encouraged to use common software
provided by the Ethereum Foundation and others, and node operators assume that thissoftware functions correctly (node operators assume that the developers and suppliers of
the respective software provide code that is free from vulnerabilities). (Node operators
assume that the developers and suppliers of the respective software are providing code thatis free from vulnerabilities and other problems).
The Ethereum node users and miners in Figure 2-7-1 depend on the software of the
Ethereum node and Ethereum Virtual Machine, and these software are considered to betrust points.
(3) Infrastructure provider provision services
In order to use the Ethereum blockchain, transactions are executed from an Ethereum node,but building this node yourself is burdensome, and you may use the services of an
inexpensive infrastructure provider. This service user assumes that the infrastructure
provider's service behaves correctly.
Wallet terminals and operational servers in Figure 2-7-1 depend on infrastructure providers,and infrastructure providers are considered to be trust points.
159 Ethereum.org JAVASCRIPT API LIBRARIES https://ethereum.org/ja/developers/docs/apis/javascript/
160 Ethereum.org NODES AND CLIENTS https://ethereum.org/ja/developers/docs/nodes-and-clients/133

(4) Code embedded in the Web browser
The code that runs in web browsers when using DeFi and wallets is provided by DeFi,
infrastructure providers, etc., and it is assumed that the code embedded by DeFi,
infrastructure providers, etc., works correctly.
(5) Generic codes used in DeFi
When developing DeFi protocols, peripheral functions, etc., generic open source code may
be imported from outside the supply chain, etc., to achieve specific functions, etc., assumingthat the code provided by the supplier works correctly in such cases.
(6) Internet
The network connections of the decentralized financial system, such as the connection
between investors' and users' wallets and infrastructure providers, and the P2P network
between Ethereum nodes operated by miners, are via the Internet, and are provided byseveral different Internet service providers, data center operators, and other Internet
interconnected services. Investors, users, and miners assume that the Internet connection
services behave correctly.
The Wallet terminals, operational servers, infrastructure providers, and Ethereum nodes in
Figure 2-7-1 are dependent on the Internet, and the Internet is considered to be a trust point.
(7) External Oracle services
Some DeFi projects do not calculate Oracle prices within their own projects for the purposeof Oracle attack protection, etc., but use external Oracle price provider services such as
Chainlink to obtain market prices and commission rates for their tokens. This DeFi project
assumes that the external oracle price providing services behave correctly.
The Oracle in Figure 2-5 is dependent on the external Oracle, and the external Oracle isconsidered to be the trust point.
(8) Execution of DeFi protocol processing (BOT processing to perform clearing, etc.)
The services provided by the DeFi protocol use multiple external BOTs (applications that
automatically execute certain tasks and processes) to execute processes such as token
price maintenance and clearing, but the details of these BOTs are not disclosed, and users
assume that the BOTs act correctly.
The Maker protocol in Figure 2-3-1-1 relies on an external BOT, the auction keeper/market
maker keeper, and the auction keeper/market maker keeper is considered to be a trust
point.
(9) DeFi protocol development (e.g., modification of smart contracts)
When modifying a smart contract, such as by proposing a governance vote, most
governance vote participants do not understand the content of the smart contract's code andassume that it acts correctly according to the proposal.
The voter in Figure 2-7-2 depends on the code content of the proposer's smart contract, andthe proposer is considered to be the trust point.
(10) Delegation of governance vote
Governance voting actually operates on a minority vote, and many individual voters may
delegate their vote to a large token holder. These individual voters assume that the major
token holder to whom they have delegated their vote vote as they expect.
Individual investors in Figure 2-3-3 Maker rely on voting proxies, and voting proxies are
considered to be trust points.

134

(11) Deploy smart contracts and parameter modifications passed by governance vote
After a proposal to modify a smart contract or parameter, such as adding a feature orchanging the interest rate, is passed by a governance vote, it is not deployed automatically,
but must be deployed by the administrator or authority. The proposer assumes that thisadministrator or authority correctly and promptly deploys what has been passed.
The proposer in Figure 2-7-2 is dependent on the deployment work of the administrator or
authority, and this administrator or authority is considered to be a trust point.
(12) Emergency Smart Contract Modification
In the event that an urgent smart contract modification is required, such as the discovery of avulnerability, the vulnerability may not be disclosed to the outside world but only to theparties involved, in accordance with Ethereum's Development Guide and other relevant
guidelines. Users assume that the core team of the DeFi project and other administratorsand developers correctly modify the smart contract and respond without causing any
damage.
Investors and users in Figure 2-5 rely on the DeFi System Development Tool via the DeFi
Protocol Interface, and the DeFi System Development Tool is considered to be a trust point.
(13) Cancellation of emergency system shutdowns and malicious proposals by the Authority.
Some DeFi projects have a rule that emergency system shutdowns and malicious proposal
cancellations are passed by a multisig vote of the authority appointed by the governancevote. Users assume that system shutdowns and proposal cancellations by the authority arecarried out for legitimate reasons.
The voters (including users) in Figure 2-7-2 are dependent on the legitimate actions of the
proposal cancellation authority, and the proposal cancellation authority is considered to be atrust point.
(14) Funds lock for two-way bridges connecting to side chains
The two-way bridge connecting the main chain and side chains was designed to lock funds
to be transferred between chains, and large amounts of funds were concentrated and stored
in the two-way bridge. The funds transferred between chains are secured by the funds
locked in the two-way bridge, and if the locked funds are leaked due to an attack, etc., thefunds cannot be transferred between chains anymore. (Example: Ronin Network Incident)
The Ethereum blockchain and Sidechain in Figure 2-5 rely on a two-way bridge fund lock,and the two-way bridge is considered to be a trust point.
2-7-2 Analysis of Weakest Link
(1) Sidechain validator private key management-

Among the multiple layers of components that make up the sidechain, such as theblockchain infrastructure and DeFi, there was a weakness in the private key management of
the validator, and this weakness was exploited to steal funds locked in the two-way bridge.
(Example: Ronin Network Incident)-

Of the multiple layers of other blockchains in Figure 2-5, the Weakest Link would be thevalidator's private key management in the Sidechain of the blockchain layer.

(2) Verification against malicious proposals-

When a malicious proposal is made, verification depends on the cooperation of community
members, so the role of conducting verification is not clear and no one could discover the135malicious proposal. In a decentralized organization, it is unclear whether verification is
ensured for malicious proposals because the community is free to participate and roles are
not clearly defined (Exsample: Beanstalk Incident).
-

Of the components that make up governance voting, such as DeFi protocols, voting rules,
proposers, and voters, the Weakest Link would be the rule deficiencies in governancevoting, where the role of verifying proposals was not made clear to anyone.

136

Figure 2-7-1 Analysis of trust points in the chains of trust (wallet terminals, operational servers, and Ethereum nodes)161

161 Ethereum.org NODES AND CLIENTS https://ethereum.org/en/developers/docs/nodes-and-clients/137

Figure 2-7-2 Analysis of Trust Points in the Chains of trust (Governance Voting and Deployment)162

162 Uniswap Governance Smartcontract https://github.com/Uniswap/governance/tree/master/contracts

Maker Governance Smartcontract https://github.com/makerdao/governance-portal-v2
Aave Governance Smartcontract https://github.com/aave/governance-v2

138Chapter 3. Identifying Risks in a Decentralized Financial System
In this chapter, we attempted to identify the major risk factors in decentralized finance based on the
major components of a decentralized financial system identified in Chapter 1 and the results of theanalysis of major DeFi projects and incident cases in Chapter 2. In this chapter we summarized eachrisk event and discussed the possible risk factors in the view points of System Operation in 3-1,
System Development in 3-2,Governance in 3-3, and 3-4: Engagement with Financial Markets in 3-4.
In addition, among the items listed below, there are issues that are particularly closely related to
DeFi (i.e., those that are exclusively necessary for DeFi functions, services, and operations) andthose that affect not only DeFi but also crypto-assets and blockchain in general. While emphasizingthat this distinction has nothing to do with the importance of ensuring security, etc., and that the line
between the two is not always clear, Chapter 4 discusses risk mitigation measures, focusing on
issues that are particularly close to DeFi.
3-1 Identifying Risk Factors in System Operation(1) Hardware
Table 3-1-1 Risk Factors in System Operation (Hardware)
Main items

Sub items

Risk events-

PC/Smartp
hone-ServerEquipment--

PublicCloud

Failure ofbases andsimultaneous
shutdown ofmany servers

Cold
WalletLoss orunavailabilityof cold wallet
private key--

Possible risk factors

PC/smartphone
malfunctions andthe wallet is
temporarily
unavailable.
Transaction
cannot be
executed due toequipment failureof Ethereumnode.
A power failure orother malfunction
at a location in the
public cloudcauses many
nodes to stop
simultaneously,
preventing theexecution of manytransactions.
Due to a problem
in applying OS
patches to servers
in the public
cloud, many
servers became
unavailable at thesame time, andtransactions could
not be executed.
The cold wallet
device (e.g., USB
flash drive) fails
and the user's

139

Issues closely
related to DeFi-

No sparePC/smartphone (aspare unit can besubstituted)

X
GeneralEquipment
Failure-No spare node isprepared.

X
GeneralEquipment
Failure-Public cloudcontracted at asingle location

X
Public Cloud
Usage Issues-

Not prepared toback up cold
wallet equipment(Metamask

X
GeneralEquipment
Failureprivate key is notavailable,
rendering thewallet unusable.

recommends
paper)--

Theft of Cold
Wallet Private
Keys-

The user's private
key or mnemonicsequence printed
and stored in acold wallet is lost,
and the wallet
becomesunusable.
The user's private
key or mnemonicsequence isprinted and stored
as a cold walleton a piece of
paper, and theattacker uses theuser's private key
to steal the funds.
The private key isstolen by
unknowingly using
a cold wallet withmalware, etc.
installed.

--

The paper onwhich the user's
private key ormnemonic
sequence isprinted is notproperly stored(forgotten where it
is stored,
accidentally
destroyed, etc.).

X
Private Key
Management
IssuesThe paper onwhich the user's
private key ormnemonic
sequence isprinted is not kept
as an important
item (e.g., notkept locked).

X
Private Key
Management
IssuesDifficult to tellfrom the outsidethat it is a securecold walletX
The problem of
how to identify
secure cold
wallets(2) Fundamental software network
Table 3-1-2 Risk Factors in System Operation (Infrastructure Software and Network)
Issues closely
Main items
Sub items
Risk events
Possible risk factors
related to DeFi
Wallet terminals
and operation
No measures toservers areprotect against
infected withmalware (e.g.,
malware throughapplying the latest
targeted attacks,
X
patches, obtaining
Malwareetc., resulting in
General Antibackups,
theft of users'
Malware Issues
education on theprivate keys andOperatinglatest malware
unauthorized
Systemcountermeasures,locking of dataetc.)
(ransomware
attack).
Vulnerabilities inFailure to
X
Operatingthe node's OS
implement a
GeneralSystem(Linux, Windows,
mechanism toOperating System
Vulnerabilitiesetc.) arepromptly apply
Issuesdiscovered and140exploited before
they are fixed(internal dataleakage,tampering, etc.).

OS fixes andpatches--InternetCommunicati
on failure,
data leakage

Internet
communication
failures (problems
withcommunication
infrastructuresuch as providers
and carriers) atwallet terminals,
operational
servers, Ethereum
Node, etc., may
result in theinability to use
funds or otheroperations,leakage ofcommunication
data, or otherrisks.

-

When P2P
network nodes ofthe same natureare structured insuch a way thatthey do not trust
each other, thejoint points
between P2P
networks ofdifferent quality
can be vulnerable
unless they rely
on some externalreferences or join
those P2P
networks on thesame node. The
joint point can bevulnerable
Possible risk ofdata leakage,
depending on themethod ofconnection to theinfrastructure
providerX
Issues related to
how P2P
networks andinfrastructure
providers connect
via the Internet(3) Blockchain infrastructure

Main items

Blockchain

Table 3-1-3 Risk factors in system operation (Blockchain infrastructure)
Issues closely
Sub items
Risk events
Possible risk factors
related to DeFi
There is concernthat the increased
volume of DeFi
Scaling measurestransactions
for the Ethereum
running on
main chain have
Ethereum will
not yet been
Processing
cause chronic
implemented.
delays due tocongestion on
X
However,chronic
Ethereum,
GeneralEthereum 2.0
increase in
resulting inBlockchain Issues
sharding istransactions
processing delays
currently inand transaction
transition and will
failures.
be completed in
Ethereum2023.
congestion is notinherently solved
by using 2nd141

Layer, a scaling
solution, or otherblockchains.
-

EthereumGas price
soars

-

-

Rapid
increase intransactions
due to market
impactDependence
on
P2PNetWork-

Front Running
Attack,Sandwich
Attack-Gas prices soar
as Ethereumtransactions
increase.
There is concernthat a high spikein gas prices willcause small users
to leave Ethereum
and the DeFi
project to run outof liquidity funds.
The network
becomescongested due tolarge transaction
volume caused byexternal factors
such as a market
price collapse,
which leads tohigh gas prices
and transaction
delays.
Users trust that
the P2PNetwork
will not be shut
down, and do notassume that amalfunction willcause the network
to be shut down.
Miners andvalidators
intentionally insert
their owntransactions
before or after thetransaction topreempt themarket price andearn a profit
margin.
Miners andvalidators
deliberately
rearrange theorder in whichtransactions areprocessed to

142

-

-

-

-

-

-

-

Gas prices arerising because
Ethereum scalingmeasures have
not yet been
implemented.
However, layer 2
solutions, side
chains, tiered
chains, and otherlow gas costenvironments are
already available.
When the market
price of a cryptoasset crashes due
to unforeseen
external factors,
the entire price ofthe crypto-asset
fluctuates due toa chain of trades.
Further increasein transactions in
response to themarketX
GeneralBlockchain Issues

X
Blockchain
Network Issues

Users are notconsidering how
to respond incase theP2PNetwork goes
down.

X
Blockchain
Network Issues

There arestrategic minors
and validators(acting in one's
own favor).
Due to the way
the blockchain
works, strategic
miners andvalidators cannot
be eliminated.

X
Blockchain Mining
and Validation
Issues-

MiningMonopoly-

Decreased
Incentives for
Minors-Validator
Collusion-

Hard fork of
the Platform

increase the costof gas.
51% attack(monopolizing
more than 50% of
the entire
network's miningrate) allows
malicious miners
to dominate themining, making it
impossible toguarantee
legitimate
operations, suchas validating
falsifiedtransactions.
If the incentive forminers is reduced
in a proof-of-workmarketenvironment(minercompensation <mining costs),
miners will be
reluctant toperform mining,
and legitimate
operations cannot
be guaranteed.
When Proof of
Stake validators
collude (validators
are fixed and freemarketcompetition iseliminated),
malicious
validators
dominate thevalidation andcannot guarantee
legitimate
operation.
A hard fork of theentire platform torecover from thedamage caused
by a single
application attack(Exsample: The
DAO attack).

143-

Malicious
minorities exist.
The blockchain
mechanism does
not eliminate
malicious miners.

X
Blockchain Mining
Issues-Miners will notmine without
reward incentives.

X
Blockchain Mining
Issues-Malicious
validators exist.
The blockchain
mechanism does
not exclude
malicious
validators.

X
Blockchain
Validation Issues

Platform
specification
changes due toplatform hard fork
(DeFi protocol
may need to besupported, butwhether or not
users need toＯ
Blockchain
update could
have major
impact on DeFi
protocol

-

-

-

-

-

Dependence
on Blockchain--

User Privacy
Protection--

SoftwareWallet (HotWallet)Attacks on hot
wallets

Users trust thatthe blockchain will
not fork(branching of theblockchain due toupdates such as
specification
changes).
For example, thecompany does not
anticipate that a
hard fork willcause a drop in
the price of thetokens or asuspension ofsometransactions.
All blockchaintransactions are
public, sotransactions andbalances at users'
addresses
become public(transaction
history can beseen by others,
addresses with alarge number oftokens held are
more likely to betargeted byattacks, etc.)
However, theaddress is not
linked to theindividual user.
Wallets that holdlarge amounts oftokens, such aslarge governancetoken holders andcommunity fundmanagers, arevulnerable toattackers.

144

respond depends
on the situation.)
Hard forks of theplatform are
ultimately decided
by the platform
administrators(e.g. EthereumFoundation).

-

Users are notconsidering how
to respond incase theblockchain forks.

Ｏ
Blockchain
update could
have major
impact on DeFi
users

-

Concerns that theemphasis ontransparency andsecurity throughpublic disclosureof transactions
has led to a lackof emphasis on
privacy protection.

X
Blockchain
Specification
Issues

Large holders oftokens exist (large
numbers oftokens are held ata particularaddress).
Wallet address
and token countＯ
Concentration offunds to specificaddresses in DeFi--

Service
shutdown at
wallet vendor

Hosted wallet
services cease
due to bankruptcy
of wallet vendor,etc., and wallet
funds become
unavailable.

--

Undesirable
Wallet Usage

SoftwareVulnerabilities(Wallet, client
software, etc.)-

Software(excluding
OS)
Vulnerability
in Ethereum
libraries(Web3.js,
ethers.js, etc.)-

The user is notaware of theexistence of
undesirable
wallets, such as
those withsecurity or quality
problems, anduses them without
being aware of it.

Softwarevulnerabilities candisrupt wallet andsystem client
software,temporarily
disabling wallet
usage and system
operations.
If a criticalvulnerability is
discovered in theWeb3.js library orother libraries andthis library
becomesunusable, many
services will beaffected because
Ethereum cannot
be connectedfrom the outside,
such as wallets
and system
operations.
*Web3.js libraryand other libraries
are common
Ethereum
blockchain access

145

-

-

-

-

are publicly
available
Hosted wallets
stored by wallet
vendors will nolonger beavailable(Other wallet
vendors may beavailable if they
have the user's
private key)
Users are notwilling to research
secure wallets on
their own (e.g.,users with low
literacy).
No information isdisclosed on thesafety of thewallet application,and there is no
mechanism fordisclosing
information.
Not prepared forserviceinterruptions due
to software
vulnerabilities(e.g., use ofmultiple wallets
and client
software)Not prepared forserviceinterruptions due
to libraryvulnerabilities(e.g., use ofmultiple wallets
and client
software)Users areconcentrated incertain libraries
Development
structure oflibraries may be
person-oriented(e.g., ethers.js
has onedeveloper andmaintainer).

X
Wallet Vendor
Management
IssuesX
The problem of
how to identify
secure wallets

Ｏ
Potential impact
on DeFi users
due to loss ofaccess to wallets,
etc.

Ｏ
Library
vulnerability may
affect DeFi
services--Ethereum
Node
SoftwareVulnerability-

software, andvulnerabilities canhave a significant
impact on external
connections.
Softwarevulnerability inEthereum Nodeprevents
communication
between nodes,
rendering theentire Ethereum
inoperable.
Ethereum Nodeand Ethereum
Virtual Machine
are node-common
software(development
language andimplementationdiffer for eachnode), and if a
defect occurs, thecorresponding
node will become
inoperable.
If any software
contains avulnerability, allnodes that use it
are affected by
the vulnerability.

--

Dependency
on Ethereum
library andEthereumNodesoftwareDiscontinuatio
n of Ethereum
libraryofferings bydevelopers(e.g.
EthereumFoundation)-

DeFi developers
trust that theWeb3.js libraryand Ethereum
Node software are
defect-free-

There is aconcern thatwallets will not beable to securely
connect toEthereum if theWeb3.js library orother libraries are
discontinued dueto the suspension

146-

Nodes are notprepared for node
shutdown due tosoftwarevulnerabilities(prepare nodesconsidering
multiplelanguages andimplementations)
Users areconcentrated on
specific
implementationsof the software.

We have notconsideredcountermeasuresin the event of aproblem with thelibrary (e.g.,changing toalternative
software, use ofmultiple software,etc.).
It is not clear
whether the
library can becontinued to be
operated by othervolunteers even if
the developer
does not operate
the library (if thelibrary cannot be
continued to beＯ
Ethereum node
softwarevulnerability may
affect DeFi
servicesＯ
By design DeFi’s
system structurethat requires theuse of applicable
software.

X
Generalmanagement
issues of thelibrary developer
used by DeFi, butwith a certain
impact on DeFi

of the developer's
activities, etc.
-

Lack ofdiversity inEthereum
library andEthereumNodesoftwareCommon softwareis initiallydiversified byvariousspecifications andimplementations,but as it is used,
there is concernthat it will
converge on asingle one andbecome moreconcentrated.

--

Concentrationof use ofservices
provided byinfrastructure
providersInfrastructure
providerInterruption ofservices
provided byinfrastructure
providers

Dependenceoninfrastructure
providerservices

Smart contractdriven processing
by users isconcentrated in a
few highly
convenient
infrastructure
providersServiceinterruptions due
to software
vulnerabilities ininfrastructure
providers, etc.,
prevent theexecution of smart
contract-driven
software that uses
them (Example:
Infura incident).
Users trust thatthe infrastructure
provider's service
will be troublefree, and nocountermeasures
are taken in
anticipation ofproblems.

(4) Application infrastructure and applications

147

-

-

used, the impact
on users will besignificant).
There is no
mechanism tomaintain andmanage thediversity ofcommon softwaredeveloped bycommon softwaredevelopers (e.g.
EthereumFoundation) withmultiple
specifications andimplementations.
The infrastructure
is provided by ahighly convenient
infrastructure
provider because
it is difficult forusers to build
their own
Ethereum nodes
and otherblockchain
connectivity due
to technical andcost issues.

Ｏ
Multiple
implementationsof libraries andsoftware used by
DeFi are DeFi
specific issues

Ｏ
Primarily DeFi
users use
infrastructure
providers

Users are notconsidering how
to respond topossible service
outages ofinfrastructure
providers (e.g.,use of multiple
providers).

Ｏ
Primarily DeFi
users use
infrastructure
providers

Users are notconsidering how
to respond incase of service
outage by
infrastructure
providers.

Ｏ
Primarily DeFi
users use
infrastructure
providersTable 3-1-4 Risk Factors in System Operation (Application Infrastructure andApplications)Issues closely
Main items
Sub items
Risk events
Possible risk factors
related to DeFi
No considerationof emergency
In the event of an
shutdown of DeFi
outflow of funds orprotocol as a
issuance ofmeans oftokens due to an
emergency
DeFi service
external attack,Blockchain
shutdown in
DeFi service
specifications
Ｏcase ofcannot beusually do not
emergency
stopped in anstop smart
emergency andcontracts, so thethe damage
DeFi protocolcannot be
must havestopped.
measuresfor
emergency.
There is aconcern that
services may beaffected due to
Not having
the inability tocontingency
respond quickly inpolicies andthe event ofprocedures in
unforeseen
Emergency
place
events (market
Ｏ
Procedures
Failure to
price collapse,
implement
external attacks,
DeFi
contingencyetc.).
Protocolmechanisms and
The measures
functionsplan forunforeseen
circumstances
may not be clear.
If the user is a
pseudonym, theIdentification
attacker/victim
DeFi projects doof DeFi
cannot be
not usually ask
Ｏprotocol users
identified at theusers for KYC
time of theincident.
Many DeFi
protocols do not
No contingency
have the ability tomeasures, such
Prevention offreeze funds in
as a token freeze
outflow ofＯthe event of an
function, havefunds
external attack,been
which increases
incorporated.
damage.
If a vulnerability or No
Withdrawal ofother defect in the
countermeasures
funds when
DeFi protocol
againstＯ
DeFi protocolcauses a service
withdrawing funds
is stopped
shurtdown, funds
from liquidity148

cannot be
withdrawn until
the service isrestored.
-Unlimitedborrowing offunds throughFlash Loan

Huge transactionsin the Flash Loan
will deplete theliquidity pool andcause the token
price to collapse.

-

Oracle Attack

Oracle-Delay inreflecting
external
oracle prices

External attacks
targetvulnerabilities inOracle pricing(e.g., arbitrage byintentionallygenerating a
difference
between themarket price andthe internal oracle
price)
Delays in external
oracle pricereferences due to
network
congestion, etc.,
result in adifference
between theexternal market
and internal
oracle prices.

--

pools, collateralpools, etc. in theevent of DeFi
protocol outage
Flash Loanrequires nocollateral had nolimit in loan
amount (however,there is a
disadvantage ofhigh fees whenborrowing large
amounts ofmoney, andadvancedknowledge isrequired to earn a
profit)Oracle pricing
methods varyfrom DeFi project
to project, and nosafe
implementation
method has been
establishedOf the DeFi
projects, Oracle
prices may belinked to market
prices for specificprojects
If the oracle priceis intentionally
delayed, theoracle pricecannot keep up
with suddenchanges inmarket prices,
resulting in alarge difference.

Ｏ

Ｏ
Oraclevulnerability is a
DeFi specificproblemＯ
Reflecting oracle
prices is a DeFi
specific problem

3-2 Identifying Risk Factors in System Development
Table 3-2 Risk Factors in System Development
Main items

Sub items

Software(excludingOS)

Risks of coderunning in a
web browser

Risk events-

Possible risk factors

If a vulnerability is
discovered incode such as theDefi protocol
interface executed
149-

DeFi users may
enter their private
keys and otherinformation fromthe wallet screen

Issues closely
related to DeFi
X
Code that runs in
web browsers isused by othersoftware, etc.,

by a web browser,
there is a risk thatthe wallet's private
key can be stolen.

-

Smart
contract not
upgradeable
-

-

Smart
contract

Smart
contracts
upgradeable-

Code
Vulnerability

If vulnerabilities
are discovered in
non-upgradeable
smart contracts,
there is a concernthat they cannot
be fixed,
increasing thedamage causedby attacks.
The problem isthat the expected
correction cannot
be made when
there is a problem
related to
upgradability.
Enforcement of
upgrades is basedon the assumptionthat there are novulnerabilities(generally
software isassumed to bevulnerable, but
smart contracts
are not allowed to
be vulnerable
becausevulnerabilities canlead directly tolosses or attacks)
Incidents using
publicly known
codevulnerabilities arerecurring, andvulnerabilities are
not preventable.
ⅰ) Reentrancy
vulnerabilities(The DAO,
Uniswap, etc.)ⅱ) Flash Loan
attacks (bZx,
Harvest Finance,
etc.)
150

provided in their
web browser, andthere is concernthat they may bevulnerable if thevulnerability is
discovered.

-

-

-

-

and is not an
issue closely
related to DeFi

It is extremely
difficult toeliminate allvulnerabilities insmart contracts,
and nonupgradability is
considered risky.

Ｏ
Smart contract
design is a DeFi
specific problem

Transactions
executed on theblockchain cannot
be undone(basically, it is notpossible to rewind
an alreadyexecutedtransaction or
correct pastamounts).
This leaves thesmart contract
vulnerability
unacceptable,
even if it isupgradable.

Ｏ
Smart contract
design is a DeFi
specific problem

Smart contracts
have complex
features and it istechnically difficult
to detect all
vulnerabilities.

Ｏ
Smart contract
vulnerabilities area DeFi specificproblemIntrusion ofmalicious
code

Smart contracts
are externallyvulnerable due tomalicious code
embedded ingeneric code
imported from the
supply chain, etc.

-

When using
generic code, theprogram
specification is
not verified (or theskills to verify are
not available).

X
Malicious code is
a commonproblem with
softwareTestnet cannot
confirmtransactions
related toincentives, sothey may be
deployed on themain net without
adequate testing(Testnet: samefunctionality as
the main net, but
no transaction
fees, different
transaction
congestion, etc.)Ｏ
The Testnet
environment is a
DeFi specific
issue

-

Testing and code
auditing cannot
verify all smart
contract behavior

X
Smart contract
malfunction is a
DeFi specifictechnology issue,
but it is a user's
own problem andhas limited impact-

Securitytechnology
required for thedevelopment ofsmart contracts
has not been
established.
There are no
indicators tomeasure thetechnical skills ofsmart contractdevelopment
engineers.

X
Problem of
securing
development
engineers

If engineers do
not know theexisting
development

X
General System
Development
Issues-Test
Verification
Constraints

-

Smart
contract
malfunction-

Secureadvanceddevelopment
engineers

Skills IssuesforDevelopment
Engineers-

Partial test
verification is notpossible in thetest net, but evenin the main net,
there arerestrictions on
testing, andcomplete test
verification is notpossible.

Even if funds arelost due to a
malfunction of aself-created smart
contract (e.g., adiscrepancy in theremittanceaddress), thefunds cannot berecoveredbecause theycannot becorrected.
It is difficult tosecure highly
skilled engineers
who can develop
vulnerability-freecode for complex
processes suchas reentrancy(reentrancy
vulnerability
occurred in The
DAO andreoccurred in
Uniswap 4 years
later).
Inexperienced
engineersdeveloping the
program may

151

-

-

cause quality
degradation anddegrade-Code audit
concerns-

Attack on
funds locked
in two-way
bridge-Blockchain-

Connections
betweenblockchains--

Complexprocesses may
make it moredifficult for code
audits to findvulnerable (e.g.,
in case it has
across multiple
smart contracts).

Heavy losses due
to validator private
key theft attacks
targeting funds
locked in two-way
bridges between
Ethereum andsidechains(Example: March2022 Ronin
Network).
Billions of dollars
of funds arelocked up at
Polygon and
Avalanche, andthere areconcerns that if an
attack were tooccur and funds
were stolen, thedamage could becatastrophic.
External attacks
targetingvulnerabilities inprocessing acrossthe blockchain.
Cross-chain smart
contract
invocation
vulnerability casestudy
(PolyNetwork)
Example ofsignatureverification

152

-

-

rules and quality
control methods,
they cannot
ensure a certain
level of quality.
Smart contract
attacks are
becoming moresophisticated, andthe specializedskills of code
auditors and thevalidation
techniques ofauditing tools are
not keeping up
with new orcomplex attack
patterns.

Ethereum
specifications locklarge sums ofmoney in two-way
bridges forexchange offunds withsidechains,
making themvulnerable toattackers.

The complexity oftransactions
across theblockchain makes
it difficult to verify
with testing (testcases are notcomprehensive,lack of anomaly
testing, boundary
condition testing,etc.)

Ｏ
Code audit is a
DeFi specificissue

Ｏ
Exchange offunds between
blockchains is a
DeFi specificproblemＯInterlocking smart
contracts
betweenblockchains is a
DeFi specificproblem-

Main chain
impact from
quality issues
with otherblockchainsand layer 2
solutions-Defects in
somefunctions of
DeFi protocol(leakage ofconsideration
during gas
priceincrease)

DeFi
ProtocolDefect in
somefunctions of
DeFi protocol(leakage ofprevention ofzero bidding)--Interlocking
between DeFi
protocols-

vulnerability in the
Token Bridge
Protocol(Wormhole)
The use of sideand tiered chainsand Layer 2
solutions isincreasing as ascaling measure
for Ethereum.
Connecting toother blockchainsor layer 2
solutions withquality concerns
increases the riskof the main chain
being affected byvulnerability
attacks, etc. (e.g.
Polygon has
multiple reported
vulnerabilities)
The sudden spikein gas prices
prevents the DeFi
project's clearing
process, etc. fromoperating properly
and interrupts
business
processing(Keepertransactions
cannot keep up
with the spike ingas prices).

-

-

-

Zero-bid
processing drains
funds while theoriginal process isstuck due tosoaring gas
prices.

-Interlocking
between DeFi
protocols can be
exploited to breakassumptions
made by external
factors (e.g.,
Oracle pricing)
Huge sums ofmoney borrowed

-

153

-

There are anumber ofblockchain andlayer 2 solutions,some of whichhavevulnerabilities andother concerns.
No mechanism tocompare anddisclose
information onvulnerabilities ofplatforms

Ｏ
Interlocking smart
contracts
betweenblockchains is a
DeFi specificproblem

The businessprocess for the
DeFi project does
not take into
account the ability
to keep up withthe gas price of
one's transactionin the event of asudden gas pricespike.

Ｏ

No built-in
process topreventtransactions thatare not supposed
to occur, such as
zero bidding.

Ｏ

No maximum
transaction
amount (e.g.,liquidity pooldeposit amount)
The design does
not take into
account the factthat the system
can be linkedＯ-through Flash
Loan (unsecured
and unlimited) are
put into liquidity
pools of other
DeFi protocols,causing a suddenchange in theprice of Oracles
If the market priceof a specificexternal DeFi
protocol isreferenced in the
Oracle,manipulating theprice of thatspecific protocol
will cause theOracle price tofluctuate.

from various DeFi
protocols.

3-3 Identifying Risk Factors in Governance
Table 3-3 Risk Factors in Governance
Main items

Sub items

Risk events-

GovernanceVoting Control-

Governance Voting

Governance
Voter
Pseudonyms

Possible risk factors

Voting isdominated by asmall number ofmajor governancetoken holders withenough votes toconstitute a
quorum forpassage
Voting iscontrolled by thecommunity anddevelopers, whohold large
amounts ofgovernancetokens, including
those for systemuse.
Governancevoting isconducted underpseudonyms,
which may makeit impossible toidentify the party
to be held
accountable for

154

-

-

-

Issues closely
related to DeFi

Governancetokens are bought
and sold on thecrypto-asset
market, which is
structured so thatthose with themoney get more
votes (DAO
decision-making
is notdecentralized)
Unlimited numberof governor
tokensＯ

There is no
mechanism to linkuser accountaddresses toindividuals.

X
It's a problem withhow theblockchain works,
not DeFi specific.

-Quorum tovote is nothigh

the outcome ofthe vote.
Quorum forgovernance voting
is low anddecisions are
made by aminority opinion(very low quorumof 1-4% for major
DeFi projects)--

Low voterturnout-

Verification ofmalicious
proposals-

Dependency
on smart
contract
modifications

Low turnout forgovernancevoting, withdecisions being
made by a small
percentage ofvoters (extremely
low turnout for
major DeFi
projects, about 29%)

In the event of amalicious
proposal, sinceverification isdependent on thecooperation ofcommunity
members, there isa concern that noone will be able todetect a malicious
proposal because
the role ofconducting
verification is notclear.
When agovernance voting
proposal modifies
a smart contract,most governancevoting participants
do not understandthe content of thesmart contract
code and assume
that it will act
correctly
according to the
proposal

155

-

-

-

-

Low turnout for
Governance Votelikely means
fewer quorums topass proposals

Ｏ

Governancetokens arevaluable andspeculative in thecrypto-asset
market, so
speculative token
holders are lesswilling to vote
Governancetoken holders are
not motivated tovote (there is no
mechanism tomotivate them)Ｏ

In decentralizedorganizations,communities arefree to participate
and roles are notspecified
It is not clear
whetherverification ofmalicious
proposals will beensured.

Ｏ

Only a small
percentage ofgovernancevoting participants
are technicallycapable ofinterpreting smart
contracts; themajority are forprofit
Insufficient
disclosure of
information on
smart contractＯ-

Organizationof DAOs--

Location andmembershipof DAO--

DeFi
ProtocolLack ofawareness of
DeFi Protocol
Terms of Use

DAOs haveunclearrepresentatives
and boards of
directors, making
it difficult to holdthem accountable
when problems
occur.
DAO has noorganization to
pursue.
The location of
the DAO is
unclear.
DAO members
are dispersed
throughout theworld and cannot
be regulated or
pursued acrossnational borders.
There is aconcern thatusers may use theservice without
knowing thecontents of the
DeFi Protocol
Terms of Service
and incur losses.

-

-

-

-

modifications, andno assurance ofthe validity ofcomments
presented incommunity
forums, etc.
The DAO is anorganization of
non-trusting
participating
members and has
norepresentatives.
There are no laws
and regulations
applicable toDAOs, and theshape of theorganization is not
yet defined.

Ｏ

The DAO is notregistered withany public agency
and its location is
unclear.
It is unclear whichcountry's laws
and regulations
apply.

Ｏ

DeFi protocol
terms of use(user's own
responsibility) are
not madeavailable to users
before using theservice.

Ｏ

3-4 Identifying Risk Factors in Engagement with Financial Markets
Table 3-4 Risk Factors in Engagement with Financial Markets
Main items

Sub items

Risk events-

Cryptoasset
MarketLack ofbackstopfunctionality inthe cryptoasset market

In the event of asystemic risk suchas a pricecollapse of fiat
currency in thefinancial market,
the central bankof each country
functions as abackstop, but
156-

Possible risk factors

Issues closely
related to DeFi

No mechanism tostabilize the priceof tokens when
they fall in thecrypto-asset
marketX
Issues related tothe crypto-asset
market in general

-

-

-

Insufficient
explanation ofrisk of loss-

Risk of loss tofinancial
institutions

DeFi
ProtocolRisk ofcorporate loss

Insufficient
explanation tousers

there is nobackstop functionin the crypto-asset
market.
When systemicrisk materializes
in the crypto-asset
market, themarket as a wholeis greatly affected.
The company has
actually
experienced
major crashes
such as BlackThursday inMarch 2020, andit was difficult totakecountermeasures.
There is aconcern that
ordinary investors
with little expertise
may trade without
knowing the risksof volatile cryptoassets and suffer
losses.
Potential for
financial
institutions thatconnect with DeFi
applications to
trade cryptoassets to incur
losses duringmarket pricedeclines orincidents
The possibility
that companies
that have invested
in crypto-assets,
includinggovernancetokens, may suffer
losses as a resultof price declines.
There is aconcern thatusers may be
unaware of thedifferences
between DeFi
Protocol's terms

157-

No mechanism tomake users
aware of the riskof loss intransactions.

X
Issues related tothe crypto-asset
market in general-

Risk of loss
associated withthe use of DeFi
protocols, which
may have latentvulnerabilities,
and with holding
volatile cryptoassets

Ｏ
Issues with DeFi
applications andconnected
financial
institutions--

Risk of loss
associated withthe use of DeFi
protocols, which
may have latentvulnerabilities,
and with holding
volatile cryptoassets
The system is notdesigned to warn
users of thedifferences fromfiat currencies
and what to do incase of damage

Ｏ
Volatility issues
with crypto-assets
used in the DeFi
protocolＯ
Accountability
issues for DeFi
users

and conditions
and disclaimersfrom those ofgeneral financial
services, or that
DeFi Protocol's
response in theevent of loss (nocompensation forloss) may result ina loss.

beforetransactions are
made.

-

Smart
contract

Marketstability

The price declineof a specificcrypto-asset willautomaticallycascade to othercrypto-assets
through smart
contracts,
destabilizing themarket as awhole.

158

Smart contracts
automatically
executetransactions
according tocode, but do notincorporatemechanisms tostabilize financial
markets (e.g.,functions toprevent
propagation ofeffects).

Ｏ
Smart contract
functionality is a
DeFi specificissueChapter 4. Analysis of Risk Mitigation Measures in a Decentralized Financial System
This chapter attempts to discuss specific risk reduction measures and proposed countermeasureplans in supervision by authorities for DeFi-specific issues among the risk factors identified in theprevious chapter.
In 4-1, we analyze risk mitigation measures and proposals for their implementation from theperspective of system operation, in 4-2, system development, in 4-3, governance, and in 4-4,
engagement with financial markets.
With regard to the risk mitigation measures analyzed, as noted above, there are multiple areas
where trust points in a decentralized financial system are concentrated, which means that they havethe same risks as existing financial institutions, and risk mitigation measures are expected to be as
centralized as those of existing financial institutions.
However, as decentralized financial systems become more diversified, the risk reduction measures
analyzed in this report may not always be available, and therefore, we believe that the content of themeasures needs to be reviewed.
There is also a need to ensure that trust points are correctly identified by DeFi project management
organizations and users. Regarding the multiple trust points detected in the analysis of this study,
there is no particular discussion about trust points in the DeFi project community, etc., and there isconcern that the DeFi project management organization and users do not correctly recognize trust
points. Therefore, it is important to make the trust points correctly recognized by the DeFi project
management organization and users.
Since the discussion is premised on the assumption that the DeFi project and blockchain
management organizations are cooperative in the implementation of risk reduction measures, it isnecessary to consider a mechanism to obtain cooperation in the implementation of the measures.
4-1 Analysis of Risk Mitigation Measures in System Operation

Main items

Software(excluding
OS)

Table 4-1-1 Risk mitigation measures in system operation
Risk reduction
Sub items
Possible risk factors
measures (Proposal)
The developer'sorganization(e.g. EthereumFoundation)
Commonrecognizes thesoftware may berisk of this issue
equipped withand implements
multiplea mechanism toEthereum
specifications
distribute users
library andandacross multiple
Ethereum
implementations
software.
Node, but over timeFor
softwarethey converge
organizations
diversity is
into a single
that are subject
compromised.
one, and there isto the oversightno mechanismof theto maintain andauthorities,
managemake it adiversity.
condition thatdesign diversity
is met in the
procurement ofsoftware (i.e.,

159

Notes, etc.
There is aconcern thatblockchain
management
organizations
are often globalorganizations,making it difficult
to coordinate
from Japan.
Even ifdistributed
among multiple
software,continuous
monitoring,
including usage,
is necessary to
prevent
convergence toa single
software due to--Dependency
on Ethereum
library andEthereumNodesoftware-

Hot Wallet
Attacks

Dependence on
the quality of thesoftware and its
continued
availability tousers, and lackof considerationof what to do in
the event of
non-availability.
Large token
holders arevulnerable toattack because
their accountaddresses andtoken holdings
are publicly
available (if theyhold a large
number of
tokens at aparticular user
account
address).

160

make thepreparation ofmultiple piecesof software withdiffering
specifications
andimplementations
a condition).
Deviseconditions ofuse so that there
are nodifferences inconvenience
betweensoftware, andavoid
concentration ofuse.
If software
dispersion isdifficult, use
softwaredevelopment
quality
improvement
measures tosolve theproblem.

-

The developer'sorganization
shouldl inform
users of therisks of the
case.

-

Blockchain
specifications
make it difficult
to keep accountaddresses andtoken holdingsof large token
holders private.
As acountermeasure, disseminate
technical
information tolarge token
holders on how
to securely store-

convenience orother reasons.

-

Need toconsider ways toreach out todeveloperorganizations-

Regulatory
authorities or
equivalentbodies need toconsider rules toverify and certify
highly secureuser private key
storagetechnologies
and make themknown to users.
Examples ofprivate key
storagetechnologies-

users' private
keys.

-

Infrastructure
ProviderConcentrationof use ofservices
provided byinfrastructure
providers

Dependenceoninfrastructure-The
infrastructure isprovided by ahighlyconvenient
infrastructure
providerbecause it isdifficult for users
to build theirown Ethereum
nodes and otherblockchain
connectivity due
to technical andcost issues.
Users rely on
infrastructure
providers to
161

-

-

Infrastructure
providers should
inform users of
the risks
associated withconcentrated
use of theirservices (e.g.,by providing amechanism tocheck risks
when using
services).
Recommendusing multiple
infrastructure
providers
depending on
the severity ofⅰ) Secret sharing:
Private keys are
divided into
multiple keys
and stored
separately bymultiple people(use caseconfirmed atexpertinterviews).
ⅱ) Social Wallet:
A social wallet isa wallet in which
a trusted friendor acquaintanceis entrusted withthe custody
andright tochange thepublic key.
Trustedacquaintances/friends with theright to change
the public key
and entrust thecustody of the
key to them.
Since there are
multiple wallettechnologies, it
is important toprovide users
with options(from expert
interviews)

It is necessary to
make users with low
literacy aware of therisks involved.

providerservices

keep theirservices up andrunning.

the DeFi service
shutdown-

Suspension ofservices ofinfrastructure
providers-Unlimitedborrowing offunds throughFlash Loan
DeFi
ProtocolDeFi service
shutdown incase ofemergency

Users are notconsidering how
to addresspossible service
shutdown of
infrastructure
providers (e.g.,use of multiple
providers).

Users canborrow cryptoassets with nocollateral andlimist. (However,there is a
disadvantagethat borrowing alarge amount ofmoney mayresult in higher
fees, andadvancedknowledge isrequired to earna profit)No
consideration of
emergency
shutdown of
DeFi protocol asa measure of
emergency
162

-

-

Possiblemeasures to betaken includeⅰ) ChaosEngineering:
A method of
injecting failures
into theproduction
environment andkeeping
recoveryfunctionsrunning at all
times, as
implemented by
Netflix andAWS.
ⅱ) SOC2:(System andOrganization
Controls 2)
Use the internal
control andassurance
reportingframework at theoutsourcing
provider (trustee
company)-

Changing
unsecuredborrowing tosecuredborrowing will
prevent abuseby requiring
large amounts ofcollateral forlarge amounts ofborrowing.

-

We believe that
it is extremely
difficult todevelop acomplete smart
contract that isInfrastructure
providers to
implement
measures tostrengthen
resilience tofailures, such as
chaosengineering, toprevent
accidental
serviceshutdown
Infrastructure
providers obtain
qualitycertification(SOC2) to
reduce the riskof service
shutdown-

DeFi protocol
developers
should be awareof the risks ofthis matter andconsider setting
transaction
limits, etc.
ⅰ)Set collateralamount whenusing Flash
Loan (n% ofborrowed funds)ⅱ) Maximum
amount of Flash
Loan usage
Instruct the DeFi
project to createa feature thatallows for
emergency
shutdown of the
DeFi protocol in-Smart contracts
cannot be
stopped byblockchain
specifications,so the DeFi
protocol must be
used.

the event of an
emergency.

--

Measures for
unforeseen
circumstances-

Not having
contingency
policies andprocedures inplace
Failure to
implement
contingency
mechanisms
and functions--

Prevention of
outflow offunds

DeFi protocols
may not
considercontingency
plans, such as
the loss of funds
due to an attack

163

DeFi projects
developcontingency
plans forunforeseen
events andidentify
necessary
systemmeasures.
Implement
responses themesures suchas external
Oraclesuspension,
DeFi protocol
emergency
shutdows, etc.,
in accordancewith that policy.
DeFi projectplans and
conducts regulardrills of thecontingency
plan to ensure asmoothimplementationin the event ofan outbreak.
Because the
DeFi protocol is
at high risk ofattack,blockchain
governing
bodies should
guide therulemaking andimplementationof measures tounaffected by anattack.
Therefore, it isimportant tohave anemergency
shudwownfunction as ameasure ofminimizing
damage in theevent of an
emergency.
Contingency
plans andperiodic training
exercises could
be a way forblockchain
management
organizations to
issue guidance
for DeFi
projects.
Maker hasestablished five
major
contingencies
and hasdeveloped
contingency
plans for them.
Periodic training
could include
methods suchas hardening.
*Hardening:
To split a team into
two teams ofoperators andattackers toactually attack anddefend to gain
hands-onexperience.

prevent the lossof funds in theevent of an
attack.
-Withdrawal offunds when
DeFi protocol
is stopped-

Oracle attack-

OracleDelay inreflecting
external
Oracle prices-

No means ofwithdrawing
funds fromliquidity pools,
collateral pools,
etc. in the eventof DeFi protocol
shutdown

Oracle pricing
methods varyfrom DeFi
project toproject, and nosafe
implementation
method has
beenestablishedOf the DeFi
projects, oracle
prices may belinked to market
prices for
specific projects
If an Oracle
price isintentionally
delayed, theOracle pricecannot keep up
with suddenchanges inmarket prices,
resulting in alarge difference.

-

Instruct DeFi
projects toestablish theability towithdraw acertain amountof funds in an
emergency (butthere is concern
about the risk ofattack).

The blockchain
management
organization
should review
and disseminate
thestandardization
andrecommended
method of
Oracle pricing
across the DeFi
project.

--

The inability towithdraw funds
is a serious risk
for userprotection andmust beaddressed.
To reduce theimpact in theevent of an
outbreak,measures suchas limiting theamount spent bymaking users
aware of the risk
could beconsidered.

Ensure a certain
level of safety by
imforming usersof safe Oracle
usage.

Based on the analysis of risk mitigation measures for system operations, the following risk
mitigation measures are noted as particularly important
a. Lobbying blockchain governing bodies (e.g. Ethereum Foundation)
There is concern that the concentration of the use of Ethereum libraries and common software
will prevent the elimination of SPoF, which is a benefit of a decentralized financial system, and is164

an issue that has the same centralized risk as existing financial institutions. We believe that it isimportant to continuously monitor this issue to avoid convergence to a single one by intentionallypreparing multiple libraries and softwares, etc., and that feasibility should be examined.
b. Ensure that users are aware of the safe usage of Wallet DeFi
We believe that it is necessary to protect users from being disadvantaged by introducing amechanism to identify and inform users of how to use wallets and DeFi safely, so that they canhave high literacy about these topics (e.g., authentication by a certification authority, issuance ofa guiance, or notification of risks).
4-2 Analysis of Risk Mitigation Measures in System Development

Main items

Smart
Contract

Table 4-2 Risk Mitigation Measures in System Development
Risk reduction
Sub items
Possible risk factors
Notes, etc.
measures (Proposal)
Smart contract
It is extremely
upgrades are
difficult for
generally
developers andprovided bycode auditing
We believe that
infrastructure
Smartcompanies tomaking smart
providers (e.g.,contract noteliminate allcontracts
OpenZeppelin
upgradeable
smart contract
upgradable will
Upgradesvulnerabilities,
reduce risk.
Plugins), so it isand nonimportant to
upgradability is
consider whichrisky.
service todeploy.
DeFi protocols
The
could reduce
specifications ofrisk throughBlockchain
the blockchain
reversespecifications domake smart
transactions that
not allow for thecontracts
cancel past
reversal of pastvulnerable
transactionstransactions, but
because(e.g., reversing
there is atransactions thata moneySmartpossibility thathave beentransfer
contracts
past
executed cannot
transaction to
upgradeable
transactions canbe undone later
return funds)
be reversed(basically, it is
We believe thatthrough an
not possible tothe feasibility
automatic
rewind anandreverseexecuted
effectiveness oftransaction
transaction orreversemechanism.
correct pasttransactions
amounts, etc.).
require further
study.
Developers and In developing
code auditing
the DeFi
Need tocompanies haveprotocol, use theconsider ways to
Codetechnical
latestreach out toVulnerability
difficulty
technology toblockchain
detecting all
ensure themanagement
vulnerabilities
quality oforganizations
from thesoftware165

complex
functionality ofsmart contracts.

-

Test
verification
constraints

Developers areconcerned about
deploying to themain net without
havingtransaction
confirmation for
incentives in thetest net (samefunctionality as
the main net, but
no transaction
fees, different
transaction
congestion, etc.)

development
and eliminate
vulnerabilities asmuch aspossible.
ⅰ) Formal
verificationⅱ) Automatedtesting bymachinelearning, etc.
The blockchain
governing bodyshould be
responsible forsharing casestudies andrecommending
technologies tobe developed.
---

Code audit
concerns

As attacks
against smart
contracts
become moresophisticated,
code auditors'
specialized skills
and audit tool
validation
techniques are
not keeping up
with new orcomplex attack
patterns.

166-

Provide ameans forTestnet toconfirmtransactions
related toincentives.
Depending on
the contents,
test methods inthe main net will
be considered.

Code auditing
companies
improve thedetectionaccuracy ofsmart contract
vulnerability
detectiontechniques andtools.
Code auditing
firms shouldcollaborate on asystem fortechnical
improvement(e.g., by holding
periodiccompetitions

Although it ispreferable toenhance thefunctionality ofthe test net as acountermeasure, we believe that
there are issues
that makefeasibility
difficult, such as
cost, etc.
Therefore, it isnecessary tofurther study thefeasibility.
Examples ofanalysistechniques forcode auditing
toolsⅰ) Static
verification
Verify smart
contract codeⅱ) Dynamic
verification
Verification
while executing
smart contractsⅲ) Formal
verification- Using formal andmathematicalmethods, provethat the code isand rankingthem).

--

Attack on
funds locked
in two-way
bridgeBlockchain
Connections
betweenblockchains-

Main chain
impact from
quality issues
with otherblockchainsand layer 2
solutions

DeFi
ProtocolDefects in
some

-

-

The
specification is
to lock funds ina two-waybridge for theexchange offunds between
Ethereum andthe sidechain,and these funds
are targetedTransactions
across theblockchain arecomplex anddifficult to verify
through testing(test cases are
not exhaustive,
lack of anomaly
tests, boundary
condition tests,etc.).
There are anumber ofblockchain andlayer 2solutions, someof which havevulnerabilities
and otherconcerns.
No mechanism
to compare anddisclose
information onvulnerabilities ofplatforms
Developers are
not taking into167-

correct in thelight of the formal
specification
description andproperties

Implementationof measures toprevent attacks
targeting funds(e.g., upgrading Examples ofprivate key
private key
management
storagetechnology,
technologies
disseminatingⅰ) Secretsecure private
decentralization
keyⅱ) Social Wallet
managementⅲ) Social Walletmethods, etc.)
Review of
Revisespecifications for
specifications for
two-way bridges
locking funds inrequirestwo-way bridges
feasibility study(to avoid
concentratinglarge amounts offunds in one
place).

(Same as 4-2 code
vulnerability)-

The quality
assurance
should be
discussed
among the DeFi
projectstakeholders
whenconsidering thelinkage withLayer 2solutions andotherblockchains.

-

Apply Ethereumand 2nd Layer(Same as 4-2 code
vulnerability)-

Infrastructure
providers arereportedly
working toensure quality
by directly
checking theeffects ofprotocols withother DeFi
project
developers who
work together.

-

The following
scalingfunctions of
DeFi protocol(Lack ofconsideration
when gas
prices soar)

account thatsome DeFi
protocols try tokeep up withgas prices fortheir owntransactions in
the event of asudden gas
price spike

scalingtechnology tocreate amechanism that
does not cause
sudden gas
price spikes-

Defects in
somefunctions of
DeFi protocol(Lack of zero
biddingprevention
leakage)-

Interlocking
between DeFi
protocols-

Developers are
not incorporatingprocesses topreventtransactions thatare not
supposed tooccur, such as
zero bidding insome DeFi
protocols.
DeFi protocol
does not set acap on theamount oftransactions(e.g., theamountdeposited in theliquidity pool)
The DeFi
protocol is notdesigned to belinked fromvarious DeFi
projects.

-

-

-

-

Set a minimum
amount in the
DeFi protocol toprevent zero
bidding.
The problem
that the bidding
function didn’t
work as it canbe solved bytaking measures
for when gas
prices rise.
Considering that
DeFI protocols
are linked fromvarious external
DeFi protocols,
it is considerednecessary totest and validate
for selfprotection
Test validation
methods should
be included in
the codevulnerability
measures.

-measures areplanned andimplemented
Use ofEthereum 2.0(sharding,planned)Use of 2ndLayer Solutions
Use of Side
ChainsMaker set theminimum bid at
3% of theoriginal price.

(Same as 4-2 code
vulnerability)

Based on the analysis of risk reduction measures for system development, the following are
considered to be the main risk reduction measures
a. Need to consider a mechanism to cancel past transactions
The specifications of the blockchain do not allow transactions once executed to be undone later,
making smart contracts vulnerable to unacceptable conditions (basically, it is not possible to rewind
an executed transaction or correct past amounts).
As a countermeasure, a mechanism that allows secure unwinding upon discovery ofvulnerabilities (e.g., reversing a money transfer transaction to return funds) should be studied in
the future, including feasibility and effectiveness.
b. Advanced Smart Contract Vulnerability Countermeasures
From the incident case studies, it is extremely difficult to completely eliminate vulnerabilities, assmart contract vulnerabilities have not been eliminated to this day, and incidents such as

168

reentrancy vulnerabilities that occurred in the past have recurred since then. From the information
obtained from the expert interviews, the most advanced technologies have prepared advanced
development tools such as automated testing by machine learning, which has increased the ability
to detect vulnerabilities. However, the vulnerability of smart contracts is still far from being
completely eliminated.
While the immediate countermeasure is to reduce vulnerabilities by having experienced
developers, we believe it is important to continue to advance detection techniques to eliminate
smart contract vulnerabilities in the future.
c. Preventing theft of funds locked in a two-way bridge
Up to billions of dollars of funds are locked in side-chain two-way bridges, which are targetedby attackers. As measures to reduce this risk, it is important to improve the sophistication ofprivate key management technology and disseminate secure private key management methods.
In addition, specifications for locking funds in two-way bridges should be considered so that large
sums of money are not concentrated in one place.
4-3 Analysis of Risk Mitigation Measures in Governance

Main items

Governance Voting

Table 4-3 Risk Mitigation Measures in GovernanceRisk reduction
Sub items
Possible risk factors
measures (Proposal)
Low turnout for
Increase to thethe governanceoriginallyvoting, which
Not enoughdesired quorum
may havefor a quorum
as turnout forresulted in a
to vote.
governancesmaller quorum
votingfor the proposal
increases.
to pass.
GovernanceImprovetokens are
incentives forvaluable andgovernor token
speculative inholders to vote,
Low voterthe crypto-asset
such as voting
turnout
market, so
mandatespeculative
mechanisms
token holders
and token grants
are less willingfor voting
to voteThe role of thegoverning body
In decentralizedshould include
organizations,an explicit
communities areproposal verifier
free to(preferably
participate andpaid). Or
Verification ofroles are notconsidermalicious
specified.
proposal
proposals
It is unclear
verification
whetherthrough formal
verification willverification, etc.
be ensured for
Set appropriate
malicious
working periods
proposals(proposal time
locks) to validate

169

Notes, etc.
Instruct the
governing bodyto establish
rules to maintainan appropriate
turnout andquorum so thatgovernancevoting is notbiased in favorof a few
opinions.
Guidance to thegoverning bodyshould beprovided by theblockchain
governing body
Guidance toestablish rules
for thegoverning body
regarding therole of theverifier of the
proposal anddisclosure of its
contents.
Guidance to thegoverning bodyshould beprovided by theblockchain
governing bodymalicious
proposals.
-

Dependency
on smart
contract
modifications-

Only a small
percentage ofgovernancevotingparticipants aretechnicallycapable ofinterpreting
smart contracts
Insufficient
disclosure of
information on
the contents ofthe proposal,
and there is aconcern that thelegitimacy of the
proposal cannot
be guaranteed.

-

The role of thegoverning bodyshould include
disclosing thecontents of thesmart contract tothe voters forthe verifier or
the proposal (tocheck for any
discrepancies
with theproposal).

4-4 Analysis of Risk Mitigation Measures in Engagement with financial markets
Table 4-4 Risk Mitigation Measures in Engagement with Financial Markets
Risk reduction
Main items
Sub items
Possible risk factors
Notes, etc.
measures (Proposal)
Perform
Relationshi
verification on
Risk of loss to Risk of loss
p withthe reliability of
Crypto-assets
financialassociated withFinancialtheDeFi
are highly
institutions
the use of DeFi
Institutions
protocol.
volatile, and theprotocols, which
Set asset
risk of theft of
may have latent
allocations andfunds due tovulnerabilities,
maximumattacks, etc.
and with holding
Corporate
Risk of loss toamountsmust be taken
volatile cryptoRelations
corporationconsidering theinto accountassetsvolatility ofcrypto-assets
Possible market
Smart contracts
stabilizing
automatically
Consider market
functions for
executestabilization
crypto-assets
transactions
functions, suchincludeaccording toas ripple effectAbility to reflectcode, but do notof price volatility
Oracle prices
incorporate
chain
Smart
Marketmoderately inmechanisms toprevention, toContract
Stability
sudden pricestabilize
preventchangesfinancial
unforeseen
The function tomarkets (e.g.,
events fromsuppress thefunctions toaffecting thereflection of
prevent
financialOracle prices
propagation ofmarkets.
when priceeffects).
fluctuations

170

exceed the baseamount, etc.

171

Conclusion
This report describes the results of our research study on technological risks and other issues inchains of trust of the decentralized financial system. However, the decentralized financial system
including DeFi is still in its infancy and continues to grow, with many NFT services and aggregators
emerging, which are outside the central scope of this research study. In addition, since this researchstudy was mainly concerned with technical risks of DeFi projects inside the blockchain, we are awarethat we have not been able to comprehensively identify detailed risks for the external components ofthe blockchain. Therefore, the following items are pointed out as the main issues to be addressed in
the future and investigated in depth in future activities.
Matters that need to be addressed in depth as issues for the future inculde
Identify technological risks of the components that make up the wallet terminals and operational
servers outside the blockchain.
 Identify technogical risks covering operating systems, web browsers, wallets, client software,user interfaces, etc.
-

Status Update on smart contract vulnerability detection technology
 Technology for detecting smart contract vulnerabilities is still far from maturity, and althoughdevelopment tools using machine learning and auditing tools based on incident cases havebeen developed, it is necessary to continuously monitor the status of updates.

In addition, the risk reduction measures pointed out in this report are only examples, and in order tofind the optimal risk reduction measures, it is essential to discuss the issues with stakeholders such as
DeFi developers, business stakeholders, academia, and authorities to find solutions to the issues. For
example, on the DeFi project side, efforts should be made to reduce vulnerabilities to ensure the qualityof software development, and case dissemination and recommendations for development technologies
should be made by the governing body (such as Ethereum Foundation) for the blockchain. On the partof the financial supervisory authority, it is conceivable that they will develop a framework for bothinnovation and necessary risk reduction, such as by securing engineers, etc. with knowledge of DeFi
specifications and information security (code development, testing and verification techniques, etc.).
We hope that this report will help to promote constructive dialogue among stakeholders in the future.

172