Since July, encrypted lending has risen by 55%, but now it also has to face the threat of AI-assisted hacker attacks, as well as the risk of risks spreading in a chain reaction between interrelated protocols. Here’s how to maintain security as much as possible.
As the charts turned from red to green, after a particularly sluggish performance in the second quarter, crypto lending has once again attracted attention.
Data from Galaxy shows that in the second quarter, $11.33 billion in funds flowed out of this sector. Part of the reason was the Kelp DAO hacking incident in April, which triggered a crisis of confidence among borrowers and even prevented users of one of the most trusted protocols, Aave, from withdrawing their ETH.
However, since the beginning of July, the total locked value in the lending sector has grown by more than 55%, and is currently around 56 billion US dollars.
But this also means that the "honey pot" has become even larger. In the era of AI auxiliary hackers, if one protocol is exploited, it could have a series of devastating effects on other protocols connected to it. Can users still trust the interwoven DeFi lending protocols?
Aave Labs Founder and CEO Stani Kulechov told Magazine, that this issue has now become a focal point of attention.
"When a protocol accepts a certain token as collateral, it also accepts the bridge for that token, the validator configuration, the oracle, as well as the operational security of the issuer."
And that is precisely why Aave has gotten into trouble.
The attack surface continues to expand.
When hackers took advantage of a cross-chain path involving Kelp DAO in April, they created 116,500 uncollateralized rsETH tokens (worth approximately $290 million at the time). Many of these tokens were subsequently used as collateral to borrow other assets on the Aave market.
Although the Aave contract itself was not compromised, the protocol still saw a decrease of about $15 billion in deposits within a few days after the vulnerability was exploited, and was forced to freeze its rsETH and wrsETH markets.
The lending market contracted by 16.78% in the second quarter. Source: Galaxy
Kulechov indicates that Aave has now adopted a more holistic approach to security.
"We have rebuilt our approach from a broader perspective," he said. "Our starting point is that security cannot be limited to smart contracts alone." He added that traditional audits "ignore the risks lurking in bridges, verifier networks, and other infrastructure upon which assets depend."
Users of lending protocols also need to assess the extent to which a protocol is exposed to external and internal risks.
Bitcoin-backed Lending Institution Ledn Chief Financial Officer Thomas Wu stated: "Every wrapper, bridge, and oracle between the lender and the underlying assets is another potential point for errors in the loan."
The co-founder and CEO of the encrypted lending platform Maple, Sid Powell, told Magazine that so-called "serious lenders" should assume that borrowers may fail at any time and base their decisions on that premise.
"What do I hold? Where is it placed? Can I see it in real time? If there is a problem, how fast can I get it back?"
When security fails, the ability to contain is very important.
DeFi Borrower Spark CEO Sam MacPherson stated that in addition to smart contracts, the team will also review governance design, operational security, collateral quality, liquidity management, as well as dependencies within the broader ecosystem.
Before the Kelp vulnerability occurred in April, Spark had already begun to gradually stop supporting rsETH on SparkLend as early as January. This was because their assessment was that the “lower usage rate and revenue” of rsETH were not sufficient to offset the “additional risks” associated with supporting it.
Kulechov indicates that Aave has also introduced a similar mechanism, where each asset will be re-evaluated on a quarterly basis and again after any significant changes. He mentioned that the protocol has already begun the "orderly exit" of 6 networks that do not meet the chain-level standards.
Lending ( TVL ) increased by over 55% compared to the end of the second quarter. Source: DeFiLlama
"No protocol can control the entire ecosystem, but it can control how much risk it is willing to take and how quickly it can respond when problems arise," said Kulechov.
MacPherson indicates that although preventing failure is the goal, the protocol also needs to have a contingency plan in place in case of issues.
Preventing losses is just part of the challenge. The protocol also needs to prove how losses will be contained in the event that real problems do arise.
Human error margin
SALT Lending Founder and CEO Shawn Owen stated that human error remains one of the biggest vulnerabilities and is also the most easily overlooked.
When assets are deployed elsewhere to earn interest, additional risks emerge. Crypto lending institutions suffered during the brutal market crash in 2022, when institutions such as Celsius, Voyager, and BlockFi collapsed one after another due to taking on risks that customers did not understand or anticipate.
To minimize the potential impact of attacks, Ledn entrusts customers' Bitcoin to qualified custodians instead of lending it out to generate additional profits.
Wu indicates that each transaction represents another potential point for error, 'so the fewer transactions there are, the lower the risk of encountering vulnerabilities.'
"The only way to eliminate these risks is to keep the client's bitcoins in isolated custody, implement strict controls, and minimize the number of transfers as much as possible."
Powell warns that when the inflow of deposits is so rapid that managers do not have time to find suitable borrowers, the pressure to maintain profits may lead to wrong decisions.
So they are willing to take on a bit more risk in order to achieve their goals. Perhaps the collateral requirements will be relaxed, or they might lend money to borrowers who would have been rejected just a year ago... Managers who are able to hold on during a downturn are usually those who are willing to say no to capital when there is no suitable place to invest it.
AI Can it make lending safer?
Despite the recent news about AI hackers, vulnerability exploits, and out-of-control agents, AI could actually help to enhance the security of encrypted lending.
Aave has been using AI for auxiliary testing outside of the regular security process. This protocol employs mutation testing, deliberately introducing vulnerabilities into the V4 contract, and the test suite identified 271 out of 304 injection vulnerabilities.
In recent reviews of their V3 and V4 codebases, three AI security tools identified a total of 71 issues. After manual verification, 20 of these were deemed valid. The remaining 51 issues also indicate that human security experts will continue to have a role to play in the foreseeable future.
AI Assistance for Aave V3 and V4 security review. Source: Aave
Kulechov indicates that: “AI is outstanding in terms of breadth and speed, but approximately 70% of the initial findings are false positives; therefore, expert judgment remains crucial.”
As the permissions, protocol knowledge, and decision-making processes of AI continue to strengthen, it itself will also become another potential point of attack.
"When AI intelligents start managing capital on the chain," said Kulechov, "their permissions, inputs, and decision-making logic also need to be protected just like contracts."
Therefore, as encrypted lending grows again, the challenge is not only to ensure the security of the code but also to make sure that every new part of this "puzzle" is understood, monitored, and can be contained in case of problems.
《Magazine》: Stablecoins can flow out of banks and countries like lightning.
DeFi
Lending
Hacker attack
Private Key
Self-hosted
Industry
More related content
Here are the events that occurred in today's crypto market.
The U.S. government transferred $770 million in seized bitcoins to Coinbase Prime.
Standard Chartered Bank plans to offer institutional crypto custody services in Singapore
Here are the events that occurred in today's crypto market.
The U.S. government transferred $770 million in seized bitcoins to Coinbase Prime.
Standard Chartered Bank plans to offer institutional crypto custody services in Singapore
