Pith. sign in

REVIEW 3 major objections 4 minor 49 references

A theory of Lending Protocols in DeFi

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper builds a state-machine model of DeFi lending and proves invariant laws plus conditions under which price and utilization manipulation attacks succeed.

desk verdict A valuable formal model of DeFi lending protocols, but Theorem 5.1(1) is false as stated because the deposit front-running threshold is missing an exchange-rate factor, so the paper needs revision before I'd rely on it. read the letter →

arxiv 2506.15295 v1 pith:FKUZ6EB5 submitted 2025-06-18 cs.GT cs.CRcs.LO

Massimo Bartoletti , Enrico Lipparini This is my paper · ORCID
classification cs.GTcs.CRcs.LO
keywords DeFilendingprotocolsstate-machinemodelexchangerateliquidationfront-runningpricemanipulationutilizationattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that mainstream decentralized lending platforms, despite their implementation complexity, share a common formal core that can be captured by a small state-machine model. Within that model it proves structural laws: exchange rates only increase through interest accrual, total user net worth is conserved by every action except price updates, and the only user action that transfers value is liquidation. It then establishes precise conditions under which strategic users can profitably front-run price updates and under which capital-rich adversaries can carry out price-manipulation or utilization-manipulation attacks. If the abstraction is faithful, these theorems give a compact, rigorous map of when lending-protocol incentives align with protocol stability and when they do not.

What carries the argument

The central object is the lending-pool state machine: states are triples $\Gamma = (\omega,\Lambda,\pi)$ holding wallet balances, the lending-pool function (reserves plus per-user credit and debit tokens), and a price oracle. The load-bearing definitions are the exchange rate $XR_\Lambda(T) = (\Lambda(T) + S_\Lambda(T^d))/S_\Lambda(T^c)$ (with value 1 when no credit tokens exist), net worth $W_\Gamma(A)$, health factor $H_\Lambda(A) = T_{\mathrm{liq}}\cdot W^c_\Lambda(A)/W^d_\Lambda(A)$, utilization $U_\Lambda(T) = S_\Lambda(T^d)/(\Lambda(T)+S_\Lambda(T^d))$, and the linear utilization interest rate $I_\Lambda(T) = \alpha\, U_\Lambda(T) + \beta$. The seven transition rules (deposit, borrow, repay, redeem, liquidation, interest accrual, price update) plus a swap action are what carry the proofs: they directly determine how exchange rates, net worth, and health factors evolve, making the invariants and attack thresholds derivable as theorems.

What would settle it

Run a fork of Aave v1 with the paper's parameters and execute the Theorem 6.1 sequence (deposit, price drop by $\delta > \pi(T_2)(1-T_{\mathrm{liq}})$, borrow, restore price): if the attacker's net position is not negative after restoring the price, the model's continuity and no-fee abstractions fail. Alternatively, scan historical Aave blocks containing no oracle updates and check whether the sum of all users' net worth is exactly preserved; any deviation caused by fees, rounding, or interest-trigger mechanics would falsify the transfer of Theorem 3.6 to the real protocol.

Watch

Extended reading notes

Core claim

The central discovery is a formal operational model of lending protocols, defined as a labelled transition system over blockchain states that include user wallets, a lending-pool state, and a price oracle. Using this model, the paper proves that exchange rates are monotone under interest accrual (Lemma 3.4), that the sum of all users' net worth is preserved by every action except price updates (Theorem 3.6), and that liquidations are the only user actions that change the net worth of the participants, transferring value from the liquidated borrower to the liquidator in proportion to the liquidation reward (Lemma 4.1). It also proves that a user who anticipates a price update can always improve her gain by front-running it with a swap (Theorem 5.2), while no simple action guarantees a gain before an interest accrual unless the interest rate is constant (Theorem 5.4). Finally, it gives formal success conditions for attacks: Theorem 6.1 shows a price decrease exceeding a threshold derived from the liquidation threshold lets an attacker with no prior credit or debt borrow into a negative net position, Theorems 6.2 shows a small price drop can make a targeted borrower liquidatable, and Theorems 6.3 and 6.4 show how depositing or borrowing before an interest accrual, under a utilization-based rate, transfers value away from other users.

Load-bearing premise

The whole edifice rests on the assumption that the abstract state machine in Section 2 faithfully captures the economically relevant behavior of real lending protocols, despite continuous token balances, no fees, no flash loans, fixed protocol parameters, and interest rates that depend only on aggregate reserves, credits, and debits.

Editorial extensions

If this is right

  • Total net worth conservation (Theorem 3.6) means that, away from price updates, any profit one user extracts through liquidation is exactly another user's loss: the protocol itself is value-neutral, so liquidation incentives are purely redistributive.
  • Exchange-rate monotonicity under interest accrual (Lemma 3.4) implies that credit tokens always appreciate relative to their underlying base tokens whenever there is outstanding debt, which is what makes supplying liquidity yield-bearing.
  • Theorem 5.2 says that a user who can spot an impending price change and swap just before it always obtains a strictly higher gain, with the bonus proportional to the swapped amount and the price shift; no other lending action changes the outcome of a foreseen price update.
  • The threshold in Theorem 6.1, $\delta > \pi(T_2)(1-T_{\mathrm{liq}})$, gives a concrete, checkable condition under which a temporary price fall lets an attacker with zero prior exposure borrow into a negative net position and default on the difference.
  • Theorems 6.3 and 6.4 show that any utilization-dependent rate with $\alpha > 0$ is exploitable: a well-timed deposit or borrow before an interest accrual transfers value from other users to the attacker, so such rates are stable only in the constant-rate case $\alpha = 0$.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The net-worth conservation theorem suggests that on-chain liquidation mechanisms are zero-sum at the level of users: the liquidation reward $R_{\mathrm{liq}}>1$ is always paid by the liquidated borrower, so an empirical check on historical Aave blocks could verify whether aggregate liquidator gains are indeed offset by liquidated borrowers' losses (plus fees and rounding).
  • Theorem 5.2 identifies swap-before-price-update as a canonical form of maximal extractable value in lending protocols, and it implies that oracle designs with delayed or time-weighted prices would break the theorem's premise that the price update is known and atomic with the swap, thereby neutralizing the front-run.
  • The utilization-attack theorems suggest a concrete design safeguard: if interest rates are made Lipschitz-bounded in utilization, or if utilization is measured with a delay or an average rather than instantaneously, the magnitude of the value transfer in Theorems 6.3 and 6.4 would be damped even when $\alpha > 0$.
  • The paper's monotonicity results imply that any fee, rounding rule, or flash-loan feature added to a real protocol introduces a source of value creation or destruction that the invariant theorems do not capture; each such feature could be tested in isolation by checking whether it breaks net-worth conservation in a forks of the state machine.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a formal operational model of DeFi lending protocols as a labelled transition system over blockchain states, with wallets, lending pools, exchange rates, token prices, collateralization, health factors, and interest accrual. It proves invariants (determinism, base-token preservation, exchange-rate monotonicity, total net-worth preservation), analyzes the effect of each transaction on net worth and health factor, derives front-running strategies for impending liquidations, price updates, and interest accruals, and characterizes price-manipulation and utilization-manipulation attacks. Proofs are provided in appendices with a dependency graph.

Significance. If correct, this would be a valuable formal foundation for reasoning about the incentive structure of mainstream lending protocols. The paper's strengths are its clean axiomatic semantics, the explicit dependency graph for proofs, the breadth of analyzed scenarios, and the concreteness of the attack conditions in Theorems 6.1-6.4, which yield falsifiable predictions. However, the presence of incorrect algebraic statements in advertised results means the current version is not yet reliable as a reference.

major comments (3)
  1. [Theorem 5.1(1), Appendix C] The threshold for the deposit strategy against an impending liquidation is incorrect. Under [Dep], depositing v units of T creates v/XR credits, each worth XR * pi(T), so the creditor value increases by exactly v*pi(T). The post-deposit health factor is therefore H' = (Wc + v*pi(T))/Wd * Tliq, giving the threshold v >= (Wd/Tliq - Wc)/pi(T), without the factor XR. The proof writes v/XR * pi in the numerator, silently dropping an XR factor. A concrete counterexample: XR=2, pi(T)=1, Wc=100, Wd=150, Tliq=2/3. The theorem requires v >= 250, but v=200 gives H' = (100+200)/150 * 2/3 = 4/3 >= 1, which disables the liquidation. The iff claim is false as stated.
  2. [Lemma 4.1(4), Section 4 and Appendix B] The stated equality gA(Γ,X) = -gB(Γ,X) = v*pi(T0)*Rliq is false. A liquidator pays v*pi(T0) in base tokens and receives credit tokens worth v*pi(T0)*Rliq, so her net gain is (Rliq-1)*v*pi(T0). The proof in Appendix B correctly derives gA = (Rliq-1)*v*pi(T0) and gB = (1-Rliq)*v*pi(T0). The statement in Section 4 should use the factor (Rliq-1), not Rliq. This is a load-bearing error because Lemma 4.1 is cited as a central economic characterization of user actions.
  3. [Section 7 and Theorems 6.2-6.4] The paper does not quantify the gap between the abstract model and concrete protocols, despite claiming to capture the essential features of mainstream platforms. The theorems in Section 6 assume uniform Tliq and Rliq, no fees, no flash loans, atomic price-update bundles, and cost-free oracle manipulation. For example, Theorem 6.2's liquidation attack sequence includes price updates px as free transactions; in reality, moving an AMM-based oracle has a capital cost that must be netted against the liquidation gain. The authors should either prove robustness of the strategic conclusions under these extensions or explicitly restrict the claims to the abstract model.
minor comments (4)
  1. [Section 2.3] The text has a typo: 'greter' should be 'greater' in the interest accrual rule discussion.
  2. [Appendix D, proof of Theorem 6.2] In the parenthetical price assignment, 'pi1(T2)=δ, pi1(T1)=pi(T1)' is inverted; the subsequent computation correctly uses pi1(T1)=δ and pi1(T2)=pi(T2). Please fix the parenthetical.
  3. [Lemma 4.4 proof] The case analysis for Wd=0 contains an inconsistent sentence: it says 'if Wd=0, the health factor cannot increase' but then enumerates cases where increased credits imply an increased health factor. This should be reworded to clarify that the health factor is already infinite when there is no debt.
  4. [Throughout] Some phrases use 'utility-based' where 'utilization-based' is meant (e.g., in the discussion of the linear interest rate function). A careful proofreading pass is recommended.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the theorems are derived from the stated state-machine axioms by direct algebraic proofs, with no fitted parameters or load-bearing self-citations.

full rationale

The paper builds a formal state-machine model in Section 2, then proves structural invariants (Section 3), single-action effects (Section 4), strategic optimality conditions (Section 5), and attack conditions (Section 6) directly from those definitions. Each result is justified by an explicit proof in the appendices; e.g., Lemma 3.4 follows by algebra from the exchange-rate definition (2.2) and the transition rules, Theorem 3.6 follows from the gain decomposition in Lemmas 4.1 and 4.3, and the strategy theorems in Section 5 are derived from the health-factor and gain formulas rather than assumed. The model does involve choices, such as continuous token amounts, no fees, and the linear utilization interest rate (2.15), but these are stated assumptions rather than conclusions smuggled into theorems. The attacks in Section 6 are proven under explicit hypotheses about the adversary's position; the theorems do not presuppose the claimed attack outcome. Self-citations such as [BCL21] and [BCJ+22] are used for motivation, related work, and context (e.g., 'key inspiration for our model'), but no load-bearing proof step rests on an unverified prior result by the same authors; no uniqueness theorem is imported, and no parameter is fitted to data and then renamed as a prediction. The paper is therefore self-contained as a formal derivation, and any errors in specific formulas (e.g., the disputed deposit threshold in Theorem 5.1(1)) would be correctness defects, not circularity.

Assumptions & free parameters 3 free parameters · 6 assumptions · 2 invented entities

Axioms are the modeling choices in Section 2 and the interest-rate constraints in (2.13) and (2.15). No parameters are fitted to data; alpha, beta, Tliq, and Rliq are protocol parameters that the theorems quantify over. Credit and debit tokens and the exchange rate are abstractions of existing Aave and Compound mechanisms, not new unverified entities.

free parameters (3)
  • Tliq (liquidation threshold) = 2/3 in examples; otherwise symbolic
    Protocol parameter, assumed fixed and uniform across tokens (Section 2.2, [Liq]). Theorems quantify over 0<Tliq<1; not fitted to data.
  • Rliq (liquidation reward factor) = 1.1 in example; otherwise symbolic
    Protocol parameter in [Liq]; Theorems quantify over Rliq>1.
  • alpha, beta (linear utilization interest rate) = alpha=0, beta=0.12 in example; alpha>0, beta>0 in Theorems 5.4, 6.3, 6.4
    Parameters of the instantiated interest rate function (2.15); not fitted, results hold for all positive values.
assumptions (6)
  • domain assumption Token amounts are nonnegative real numbers (Section 2.1).
    Abstracts away integer discretization and rounding of real implementations; acknowledged in Section 7.
  • domain assumption Interest rate IΛ(T) is strictly positive and depends only on Λ(T), SΛ(Tc), and SΛ(Td), independent of the distribution across users (Eq. 2.13).
    Captures utilization-based rates in Aave and Compound; used in Lemma 3.4 and later theorems.
  • domain assumption Price oracle updates are performed by a special user and can be arbitrarily manipulated, enabling the formal attacks in Section 6.
    Models oracle manipulation attacks; real oracles aggregate sources but are manipulable in practice (Section 6.1).
  • ad hoc to paper Swap actions [Swp] do not change prices; price-changing swaps are represented as [Swp] followed by [Px] (Section 2.3).
    Simplifies the model; in real AMMs swaps move prices automatically.
  • domain assumption Liquidation can repay any fraction of debt subject to post-health-factor <= 1 and seizes only credit tokens (Section 2.3, [Liq]).
    Aave caps at 50%; the paper argues the cap is easily bypassed by splitting, so it is safe to omit it.
  • domain assumption No flash loans, fees, or governance changes are modeled (Section 7).
    Abstracted away; the paper states that large short-term capital is implicitly assumed in the attacks.
invented entities (2)
  • Credit tokens Tc and debit tokens Td independent evidence
    purpose: Represent deposits (claims) and loans (obligations) inside the lending pool
    These abstract real aTokens/cTokens and debt tokens in Aave and Compound; not new postulates, but core to the model.
  • Exchange rate XRΛ(T) independent evidence
    purpose: Pricing of credit tokens relative to underlying base tokens
    Mirrors the exchange rate in Compound cTokens; definition (2.2).

how reviews work

0 comments
Cite this review

Pith. "Pith review of A theory of Lending Protocols in DeFi." pith.science (2026). https://pith.science/paper/FKUZ6EB5

@misc{pith2026250615295,
  author       = {Pith},
  title        = {Pith review of: A theory of Lending Protocols in DeFi},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FKUZ6EB5}},
  note         = {Machine review of arXiv:2506.15295}
}
read the original abstract

Lending protocols are one of the main applications of Decentralized Finance (DeFi), enabling crypto-assets loan markets with a total value estimated in the tens of billions of dollars. Unlike traditional lending systems, these protocols operate without relying on trusted authorities or off-chain enforcement mechanisms. To achieve key economic goals such as stability of the loan market, they devise instead trustless on-chain mechanisms, such as rewarding liquidators who repay the loans of under-collateralized borrowers by awarding them part of the borrower's collateral. The complexity of these incentive mechanisms, combined with their entanglement in low-level implementation details, makes it challenging to precisely assess the structural and economic properties of lending protocols, as well as to analyze user strategies and attacks. Crucially, since participation is open to anyone, any weaknesses in the incentive mechanism may give rise to unintended emergent behaviours, or even enable adversarial strategies aimed at making profits to the detriment of legit users, or at undermining the stability of the protocol. In this work, we propose a formal model of lending protocols that captures the essential features of mainstream platforms, enabling us to identify and prove key properties related to their economic and strategic dynamics.

Figures

Figures reproduced from arXiv: 2506.15295 by the authors.

Figure 1
Figure 1. Interactions between two users and a lending pool. 3. Structural properties of lending protocols We establish in this section some structural properties of lending protocols, such as relevant invariants on their reachable states. As usual, free variables in statements are meant to be universally quantified; furthermore, blockchain states in the hypotheses are always assumed to be reachable. For simplicity, we will j… view at source ↗
Figure 2
Figure 2. LP semantics. Appendix A. Proofs for Section 3 In this and the following appendices we provide detailed proofs for all your statements. These proofs are presented in the order in which the statements appear in the paper, even though this order does not always reflect their logical dependencies. To clarify the relationship among our statements, [PITH_FULL_IMAGE:figures/full_fig_p030_2.png] view at source ↗
Figure 3
Figure 3. Dependencies among the statements. Proof of Lemma 3.2. By inspection of the rules in [PITH_FULL_IMAGE:figures/full_fig_p031_3.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 45 canonical work pages

  1. [1]

    https://github.com/aave/aave-protocol/blob/efaeed363da70c64b5272bd4b8f468063ca5c361/contracts/lendingpool/LendingPoolLiquidationManager.sol#L181

    Aave maximum liquidation amount, 2020. https://github.com/aave/aave-protocol/blob/efaeed363da70c64b5272bd4b8f468063ca5c361/contracts/lendingpool/LendingPoolLiquidationManager.sol#L181

    work page 2020

  2. [2]

    https://github.com/aave/aave-protocol/blob/efaeed363da70c64b5272bd4b8f468063ca5c361/contracts/flashloan/interfaces/IFlashLoanReceiver.sol#L11

    Aave v1 flashloan receiver interface, 2020. https://github.com/aave/aave-protocol/blob/efaeed363da70c64b5272bd4b8f468063ca5c361/contracts/flashloan/interfaces/IFlashLoanReceiver.sol#L11

    work page 2020

  3. [3]

    https://github.com/aave/aave-protocol/

    Aave v1 implementation, 2020. https://github.com/aave/aave-protocol/

    work page 2020

  4. [4]

    https://app.aave.com/markets

    Aave markets website, 2025. https://app.aave.com/markets

    work page 2025

  5. [5]

    https://www.aave.com

    Aave website, 2025. https://www.aave.com

    work page 2025

  6. [6]

    Improved price oracles: Constant function market makers

    Guillermo Angeris and Tarun Chitra. Improved price oracles: Constant function market makers. In ACM Conference on Advances in Financial Technologies ( AFT ) , pages 80--91. ACM , 2020. https://arxiv.org/abs/2003.10001

    arXiv 2020

  7. [7]

    https://cryptonews.com/news/defi-akropolis-drops-20-following-a-usd-2m-heavy-hack-8299.htm

    Akropolis Defi attack , 2020. https://cryptonews.com/news/defi-akropolis-drops-20-following-a-usd-2m-heavy-hack-8299.htm

    work page 2020

  8. [8]

    SecPLF : Secure protocols for loanable funds against oracle manipulation attacks

    Sanidhay Arora, Yingjiu Li, Yebo Feng, and Jiahua Xu. SecPLF : Secure protocols for loanable funds against oracle manipulation attacks. In ACM Asia Conference on Computer and Communications Security ( ASIA CCS ) . ACM , 2024

    work page 2024

Show all 49 references
  1. [9]

    MEV on Ethereum : A policy analysis

    Mikolaj Barczentewicz. MEV on Ethereum : A policy analysis. ICLE White Paper, 2023

    2023

  2. [10]

    Junttila, Alberto Lluch - Lafuente, Massimiliano Mirelli, and Andrea Vandin

    Massimo Bartoletti, James Hsin - yu Chiang, Tommi A. Junttila, Alberto Lluch - Lafuente, Massimiliano Mirelli, and Andrea Vandin. Formal analysis of Lending Pools in Decentralized Finance . In ISoLA , volume 13703 of LNCS , pages 335--355. Springer, 2022

    2022

  3. [11]

    SoK: Lending Pools in Decentralized Finance

    Massimo Bartoletti, James Hsin - yu Chiang, and Alberto Lluch - Lafuente. SoK: Lending Pools in Decentralized Finance . In Workshop on Trusted Smart Contracts , volume 12676 of LNCS , pages 553--578. Springer, 2021

    2021

  4. [12]

    A theory of Automated Market Makers in DeFi

    Massimo Bartoletti, James Hsin - yu Chiang, and Alberto Lluch - Lafuente. A theory of Automated Market Makers in DeFi . Logical Methods in Computer Science , 18(4), 2022

    2022

  5. [13]

    Formal verification in Solidity and Move : Insights from a comparative analysis

    Massimo Bartoletti, Silvia Crafa, and Enrico Lipparini. Formal verification in Solidity and Move : Insights from a comparative analysis. In Workshop on Formal Methods for Blockchains ( FMBC ) , volume 129 of OASIcs , pages 3:1--3:18. Schloss Dagstuhl - Leibniz-Zentrum f \" u r...

    2025

  6. [14]

    Optimal risk-aware interest rates for decentralized lending protocols

    Bastien Baude, Damien Challet, and Ioane Muni Toke. Optimal risk-aware interest rates for decentralized lending protocols . Working Papers hal-04971758, HAL, February 2025

    2025

  7. [15]

    Automated market makers and their implications for liquidity providers

    Werner Br \"o nnimann, Pascal Egloff, and Thomas Krabichler. Automated market makers and their implications for liquidity providers. Digital Finance , 6(3):573--604, Sep 2024

    2024

  8. [16]

    DeFi composability as MEV non-interference

    Massimo Bartoletti, Riccardo Marchesin, and Roberto Zunino. DeFi composability as MEV non-interference. In Financial Cryptography and Data Security , volume 14745 of LNCS , pages 369--387. Springer, 2024

    2024

  9. [17]

    Thinking Fast and Slow: Data-Driven Adaptive DeFi Borrow-Lending Protocol

    Mahsa Bastankhah, Viraj Nadkarni, Chi Jin, Sanjeev Kulkarni, and Pramod Viswanath. Thinking Fast and Slow: Data-Driven Adaptive DeFi Borrow-Lending Protocol . In Rainer B\" o hme and Lucianna Kiffer, editors, 6th Conference on Advances in Financial Technologies (AFT 2024) , vo...

    2024

  10. [18]

    Agilerate: Bringing adaptivity and robustness to defi lending markets

    Mahsa Bastankhah, Viraj Nadkarni, Xuechao Wang, and Pramod Viswanath. Agilerate: Bringing adaptivity and robustness to defi lending markets. CoRR , abs/2410.13105, 2024

    2024 arXiv

  11. [19]

    A theoretical basis for MEV

    Massimo Bartoletti and Roberto Zunino. A theoretical basis for MEV . In Financial Cryptography and Data Security , LNCS. Springer, 2025. To appear

    2025

  12. [20]

    Flashsyn: Flash loan attack synthesis via counter example driven approximation

    Zhiyang Chen, Sidi Mohamed Beillahi, and Fan Long. Flashsyn: Flash loan attack synthesis via counter example driven approximation. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering , ICSE '24, New York, NY, USA, 2024. Association for Computin...

    2024

  13. [21]

    Why stake when you can borrow? Available at SSRN 3629988 , 2020

    Tarun Chitra and Alex Evans. Why stake when you can borrow? Available at SSRN 3629988 , 2020. https://arxiv.org/abs/2006.11156

    2020 arXiv

  14. [22]

    Attacks on dynamic defi interest rate curves, 2023

    Tarun Chitra, Peteris Erins, and Kshitij Kulkarni. Attacks on dynamic defi interest rate curves, 2023

    2023

  15. [23]

    Competitive equilibria between staking and on-chain lending

    Tarun Chitra. Competitive equilibria between staking and on-chain lending. arXiv preprint arXiv:2001.00919 , 2019. https://arxiv.org/abs/2001.00919

    2001 arXiv

  16. [24]

    https://app.compound.finance/markets

    Compound markets website, 2025. https://app.compound.finance/markets

    2025

  17. [25]

    https://compound.finance/

    Compound website, 2025. https://compound.finance/

    2025

  18. [26]

    The economics of interest rate models in decentralised lending protocols

    Samuel Cohen, Leandro Sánchez-Betancourt, and Lukasz Szpruch. The economics of interest rate models in decentralised lending protocols. SSRN Electronic Journal , 01 2023

    2023

  19. [27]

    Optimal Bidding Strategy for Maker Auctions

    Michael Darlin, Nikolaos Papadis, and Leandros Tassiulas. Optimal Bidding Strategy for Maker Auctions . arXiv preprint arXiv:2009.07086 , 2020. https://arxiv.org/abs/2009.07086

    2009 arXiv

  20. [28]

    Price oracle accuracy across blockchains: A measurement and analysis

    Robin Gans\"auer, Hichem Ben Aoun, Jan Droll, and Hannes Hartenstein. Price oracle accuracy across blockchains: A measurement and analysis. In International Workshop on Cryptoasset Analytics (CAAW) , 2025

    2025

  21. [29]

    The decentralized financial crisis

    Lewis Gudgeon, Daniel P \' e rez, Dominik Harz, Benjamin Livshits, and Arthur Gervais. The decentralized financial crisis. In Crypto Valley Conference on Blockchain Technology ( CVCBT ) , pages 1--15. IEEE , 2020

    2020

  22. [30]

    Empirical measurements on pricing oracles and decentralized governance for stablecoins

    Wanyun Catherine Gu, Anika Raghuvanshi, and Dan Boneh. Empirical measurements on pricing oracles and decentralized governance for stablecoins. Available at SSRN 3611231 , 2020. http://dx.doi.org/10.2139/ssrn.3611231

    2020 doi

  23. [31]

    DeFi protocols for loanable funds: Interest rates, liquidity and market efficiency

    Lewis Gudgeon, Sam Werner, Daniel Perez, and William J Knottenbelt. DeFi protocols for loanable funds: Interest rates, liquidity and market efficiency. In ACM Conference on Advances in Financial Technologies , pages 92--112, 2020

    2020

  24. [32]

    https://medium.com/harvest-finance/harvest-flashloan-economic-attack-post-mortem-3cf900d65217

    Harvest Finance flashloan attack post-mortem , 2020. https://medium.com/harvest-finance/harvest-flashloan-economic-attack-post-mortem-3cf900d65217

    2020

  25. [33]

    Ethereum's proposer-builder separation: Promises and realities

    Lioba Heimbach, Lucianna Kiffer, Christof Ferreira Torres, and Roger Wattenhofer. Ethereum's proposer-builder separation: Promises and realities. In Proc. ACM on Internet Measurement Conference ( IMC ) , pages 406--420. ACM , 2023

    2023

  26. [34]

    Regulatory implications of MEV mitigations

    Yan Ji and James Grimmelmann. Regulatory implications of MEV mitigations. In Financial Cryptography Workshops , volume 14746 of LNCS , pages 335--363. Springer, 2024

    2024

  27. [35]

    An Analysis of the Market Risk to Participants in the Compound Protocol

    Hsien-Tang Kao, Tarun Chitra, Rei Chiang, and John Morrow. An Analysis of the Market Risk to Participants in the Compound Protocol . 2020. https://scfab.github.io/2020/FAB2020_p5.pdf

    2020

  28. [36]

    TWAP oracle attacks: Easier done than said? In IEEE International Conference on Blockchain and Cryptocurrency ( ICBC ) , pages 1--8

    Torgin Mackinga, Tejaswi Nadahalli, and Roger Wattenhofer. TWAP oracle attacks: Easier done than said? In IEEE International Conference on Blockchain and Cryptocurrency ( ICBC ) , pages 1--8. IEEE , 2022

    2022

  29. [37]

    Sok: A classification framework for stablecoin designs

    Amani Moin, Kevin Sekniqi, and Emin G \" u n Sirer. Sok: A classification framework for stablecoin designs. In Financial Cryptography and Data Security , volume 12059 of LNCS , pages 174--197. Springer, 2020

    2020

  30. [38]

    Adaptive Curves for Optimally Efficient Market Making

    Viraj Nadkarni, Sanjeev Kulkarni, and Pramod Viswanath. Adaptive Curves for Optimally Efficient Market Making . In Rainer B\" o hme and Lucianna Kiffer, editors, 6th Conference on Advances in Financial Technologies (AFT 2024) , volume 316 of Leibniz International Proceedings i...

    2024

  31. [39]

    https://cryptonews.com/news/4th-major-defi-hack-in-a-month-origin-dollar-loses-usd-7m-8331.htm

    Origin Dollar attack , 2020. https://cryptonews.com/news/4th-major-defi-hack-in-a-month-origin-dollar-loses-usd-7m-8331.htm

    2020

  32. [40]

    Werner, Jiahua Xu, and Benjamin Livshits

    Daniel Perez, Sam M. Werner, Jiahua Xu, and Benjamin Livshits. Liquidations: DeFi on a knife-edge. In Financial Cryptography , volume 12675 of LNCS , pages 457--476. Springer, 2021

    2021

  33. [41]

    Mitigating decentralized finance liquidations with reversible call options

    Kaihua Qin, Jens Ernstberger, Liyi Zhou, Philipp Jovanovic, and Arthur Gervais. Mitigating decentralized finance liquidations with reversible call options. In Foteini Baldimtsi and Christian Cachin, editors, Financial Cryptography and Data Security , pages 344--362, Cham, 2024...

    2024

  34. [42]

    Attacking the DeFi ecosystem with flash loans for fun and profit

    Kaihua Qin, Liyi Zhou, Benjamin Livshits, and Arthur Gervais. Attacking the DeFi ecosystem with flash loans for fun and profit. In Financial Cryptography , volume 12674 of LNCS , pages 3--32. Springer, 2021

    2021

  35. [43]

    Pricing and hedging of decentralised lending contracts, 09 2024

    Lukasz Szpruch, Marc Vidales, Tanut Treetanthiploet, and Yufei Zhang. Pricing and hedging of decentralised lending contracts, 09 2024

    2024

  36. [44]

    Contagion in decentralized lending protocols: A case study of compound

    Natkamon Tovanich, Myriam Kassoul, Simon Weidenholzer, and Julien Prat. Contagion in decentralized lending protocols: A case study of compound. In Proceedings of the 2023 Workshop on Decentralized Finance and Security , DeFi '23, page 55–63, New York, NY, USA, 2023. Associatio...

    2023

  37. [45]

    Rolling in the shadows: Analyzing the extraction of MEV across layer-2 rollups

    Christof Ferreira Torres, Albin Mamuti, Ben Weintraub, Cristina Nita - Rotaru, and Shweta Shinde. Rolling in the shadows: Analyzing the extraction of MEV across layer-2 rollups. In ACM SIGSAC Conference on Computer and Communications Security ( CCS ) , pages 2591--2605. ACM , 2024

    2024

  38. [46]

    https://www.coindesk.com/value-defi-suffers-6m-flash-loan-attack

    Coindesk: Value DeFi attack , 2020. https://www.coindesk.com/value-defi-suffers-6m-flash-loan-attack

    2020

  39. [47]

    Knottenbelt

    Sam Werner, Daniel Perez, Lewis Gudgeon, Ariah Klages - Mundt, Dominik Harz, and William J. Knottenbelt. SoK : Decentralized finance ( DeFi ). In ACM Conference on Advances in Financial Technologies, ( AFT ) , pages 30--46. ACM , 2022

    2022

  40. [48]

    Towards understanding flash loan and its applications in DeFi ecosystem

    Dabao Wang, Siwei Wu, Ziling Lin, Lei Wu, Xingliang Yuan, Yajin Zhou, Haoyu Wang, and Kui Ren. Towards understanding flash loan and its applications in DeFi ecosystem. arXiv preprint arXiv:2010.12252 , 2020. https://arxiv.org/abs/2010.12252

    2010 arXiv

  41. [49]

    SoK : Decentralized Finance ( DeFi ) Attacks

    Liyi Zhou, Xihan Xiong, Jens Ernstberger, Stefanos Chaliasos, Zhipeng Wang, Ye Wang, Kaihua Qin, Roger Wattenhofer, Dawn Song, and Arthur Gervais. SoK : Decentralized Finance ( DeFi ) Attacks . In IEEE Symposium on Security and Privacy , pages 2444--2461. IEEE , 2023

    2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.