What's special about smart contracts?

1. Self-custody and selfcontrol of assets
2. Unfiltered access to financial infrastructure
3. Free entry of service providers
4. Conceptually non-custodial services run as autonomous codes on the infrastructure
5. Blockchain = common resource
6. Services = platforms

Blockchain-based Decentralized Finance in a Nutshell

1. Self-custody and selfcontrol of assets
2. Unfiltered access to financial infrastructure
3. Free entry of service providers
4. Conceptually non-custodial services run as autonomous codes on the infrastructure
5. Blockchain = common resource
6. Services = platforms

What the focus of this paper?

What is a smart contract/DeFi application?

• piece of code that performs operations on the blockchain
• can be
  • called (= used) by anyone
  • deployed by anyone
• organized
  • as a platform
  • often requires deposits of assets
  • often involves transfers of assets
• immutable?
  • actually not exactly...

some features

DeFi Security Risks

Risk is in every layer of the tech stack!

• Network Layer
  • DDoS attacks etc.
• Blockchain Layer
  • Sybil attacks
  • MEV
• Smart Contract Layer
  • Malicious code
  • Bug exploits
• Interface Layer
  • Oracle attacks
  • Malicious plug-ins (e.g., malicious wallet installation etc.)

Known Smart Contract Vulnerabilities

• Re-entrancy
• Insecure arithmetic
• Unexpected ETH flows (force feeding)
• Unprivileged access/writes
• Etc...

What can we do to prevent exploit? What are common fault lines? 

• do transfers work under all circumstances
  • edge cases matter
• reliance on oracles
  • use price and input from other sources
  • oracles can be manipulated
• applications may be used by others in unexpected ways
  • flash-loan attacks
  • unobserved risks created by users (Morpho)
• smart contract code of other applications that you rely on may change
  • Morpho v. AAVE

Three Examples of Exploits

Re-entrancy - The DAO hack

Re-entrancy - The DAO hack

fallback() with "evil" logic

The DAO

withdraw

send

receive() is missing!

• Hacker calls withdraw
• The DAO sends ETH
• No receive()
  • Do fallback()
  • fallback  takes ETH and calls withdraw()
  • First withdraw is still running!!!
  • Nested loop and balance never updates

It's happened before

Unprivileged Writes - The Parity Wallet hack

DeFi Exploits 

Smart Contract Scams

• Too many to enumerate here
  • SetApproveForAll -> "I give you access to my digital assets to move around"
    • OK for NFT marketplaces and maybe DEX.
    • NOT OK if you don't trust the URL (see "Uniswap phishing attack")
  • SendEth -> Well..."Send your ETH to X address"
    • OK, but what if it's invoked when you try to "mint" an NFT?? 
  • Hidden "disable transfer" functions
    • Cannot sell token (Squid token)
  • Buy/Sell taxes
    • Scammer can change tax from 5% to 99% for all holders except owner
    • Slippage threshold makes all transactions fail
• Scammers think of new tricks every time a trick becomes "known"
  • Honeypots!!

Token Scams (not just scam tokens)

A word about tokens: What might token investors be concerned about?

• Prat, Danos, Marcasse (Management Science 2025) "Fundamental Pricing of Utility Tokens"
  • tokens first sold to investors ...
  • ... but eventually make their way to users
• hidden features of tokens:
  • Squid Game Token could not be sold
• Do the economics of the tokens work?
  • set incentives
  • pay for usage
  • optimizing for usage and income
  • payment mechanisms
• trust issuer?
  • can the be interference?
  • will there be updates and continuoed development (Canidio 2022)

• tokens are mostly financial instruments
• ... but they don't neatly fit into our existing nomenclature
• same for issuers, usage, evolution of tokens
• requires a different "mindset" to understand 

Code-Audits?

What is so special about "auditing" smart contracts?

• software code reviews and standards are nothing new
• cyber-attacks happen everywhere
• ... yet blockchain is different
• Cyber-attack: indirect cost
  • loss of data
  • loss of secrets
  • abuse of information
• Blockchain exploit:
  • direct loss of funds of customers/users
  • often irretrievable
  • no accountability, no recourse
  • no ability of courts or regulators to order return of funds

When do you do the review? Circumstances may matter

What kind of code review?

The cyber-attack \(-\) code-review  problem

known
knowns

unknown
knowns

known
unknowns

unknown
unknowns

• write the code as well as you can before you deploy
• code audit verifies that you
  • followed the right procedure
  • made no obvious error

• you lacked full expertise and missed important checks
• code audit identifies the issue and allows you to fix them

• you get caught off-guard by problems that you didn't think would be a problem
• you need out-of-the-box thinking

Some evidence on The Code Review Decision: "Auditing Smart Contracts" by Wayne Landsman, Evgeny Lyandres, Edward Maydew, Daniel Rabetti, Che Zhang (likely to be published in the Journal of Accounting and Economics)

1. Code Review Decision

   • Who asks for code review?
   • What type of review?
     • Centralized firm? What level of reputation?
     • Decentralized “bounty” system?

2. Audit Effectiveness

   • Do audits reduce the likelihood or severity of future security breaches?

3. Post-Breach Responses

   • How do developers and auditors react after hacks?
   • Effects on auditor reputation and market share?

Research Questions

1. Audit Demand

• Who seeks audits?
  • oracles, bridges, cross-chain designs, lending logic.
• Top tier
  • Larger and more visible protocols.
• Ex exploit
  • Systemic hacks increase demand for high-reputation audits.

Main Findings Part 1: Audit Demand

• Naive average:
  • audits do not reduce hack probability.
• Correcting for selection
  • top-tier and decentralized (bounty) audits are associated with fewer and smaller losses.

Main Findings Part 2: Audit Effectiveness

• Hacked protocols:
  • upgrade auditors or
  • add bounty programs.
• Auditors implicated in hacks
  • lose about 4 pp of market share short-term, but usually recover.
  • Strong, visible crisis management mitigates reputational damage.

Main Findings Part 3: Post Breach Effects

Solutions?

Some options