Meanwhile in cryptoHere’s a trade you can’t do: Find a small publicly traded bank. Say it’s a bank with $10 billion of assets, with an equity market capitalization of $1 billion. (These are realistic numbers; the market value of a bank’s stock will generally be much lower than the value of its assets, because most of those assets are in effect owed to its depositors. 8 ) Buy 51% of the stock for $510 million or whatever. Vote out the board, vote in a new board and make yourself the chief executive officer. Take the $10 billion in the vault and send it to yourself, making $10 billion on your $510 million investment. Smirk “what, I own the bank, I take the money, that’s how it works.”That’s not how it works, you can’t do this, 9 if you did do it you would go to prison, but you’d be stopped well before that point. But in its outlines it is a tempting and elegant trade, and we have talked about variations that work a little better. (The guy we talked about did go to prison, though he did get the money first, so his version worked only a little better.) window.__bloomberg__.ads.enqueue("in-article-4-RAJT3KDWLU6A01"); {"contentId":"RAJT3KDWLU6A01","position":"in-article4","dimensions":{"mobile":[[5,19],[300,250],[3,3],[1,1],"fluid"]},"type":"In Article Flex Native Ad","positionIncrement":1,"targeting":{"position":"in-article4","positionIncrement":1,"url":"/opinion/articles/2022-04-18/twitter-has-a-poison-pill-now"},"containerId":"in-article-4-RAJT3KDWLU6A01"} window.__bloomberg__.ads.enqueue("desktop-in-article-8-RAJT3KDWLU6A01"); {"contentId":"RAJT3KDWLU6A01","position":"desktop-in-article8","dimensions":{"large_desktop":[[300,250],[5,4]],"small_desktop":[[300,250],[5,4]]},"type":"Desktop in article Native Ad","targeting":{"position":"desktop-in-article8","url":"/opinion/articles/2022-04-18/twitter-has-a-poison-pill-now"},"containerId":"desktop-in-article-8-RAJT3KDWLU6A01"} The basic idea of the trade is that there exist in the world some very large pots of money — banks, insurance companies, asset managers, etc. — that are controlled by relatively small companies. It takes a smaller amount of money to buy control of the company, and then you get to decide what to do with the larger pot of money that the company manages. In the world of traditional finance, this is a well-known problem, and those pots of money tend to be very carefully regulated to guard against some opportunist taking control of them on the cheap and draining the money from the pot.In crypto, etc. etc. etc. etc. etc. you know how this is gonna go. Here’s Anthony Lee Zhang on Twitter:Beanstalk, a moderately popular new algo-stable protocol, just got attacked for $80MThis one is a very interesting hack: rather than exploit a bug in the code, it was a "governance attack". My understanding is that holders of beanstalk equity token holders can vote on changes to the protocol: literally, chunks of code that are added to the protocolThe way an algo-stable works, there's an equity layer and a debt (stablecoins) layer, and possibly a bunch of reserves, so the equity layer effectively has control over a bunch of "stuff" that the protocol ownsHence, a fairly simple attack:1. Propose a piece of code to the protocol that says "send the entire treasury to my address A"2. Buy a bunch of equity tokens and vote the change in3. Send the entire treasury to your address AAnd here is CoinDesk’s summary:The attacker took out a flash loan on lending platform Aave which enabled them to amass a large amount of Beanstalk’s native governance token, Stalk. With the voting power granted by these Stalk tokens, the attacker was able to quickly pass a malicious governance proposal that drained all protocol funds into a private Ethereum wallet.Various crypto pots of money are controlled by governance tokens, and the market capitalization of the governance token is often a lot lower than the value in the pot, for basically the same reasons that the market capitalization of a bank is generally much lower than the value of the bank’s assets. And the governance token can, by majority vote, decide what to do with the pot. (Sometimes — many pots are better designed than this!) And in crypto, you can often do a series of transactions as a single integrated transaction, in which you take out a flash loan to buy all the governance tokens, vote the governance tokens to give yourself the pot of money, use some of the pot to repay the flash loan and keep the rest for yourself — all at once. And so someone did. window.__bloomberg__.ads.enqueue("desktop-in-article-9-RAJT3KDWLU6A01"); {"contentId":"RAJT3KDWLU6A01","position":"desktop-in-article9","dimensions":{"large_desktop":[[300,250],[5,4]],"small_desktop":[[300,250],[5,4]]},"type":"Desktop in article Native Ad","targeting":{"position":"desktop-in-article9","url":"/opinion/articles/2022-04-18/twitter-has-a-poison-pill-now"},"containerId":"desktop-in-article-9-RAJT3KDWLU6A01"} Again: You could do exactly this trade with a bank, instead of a stablecoin, if banks were stupidly designed. But they are not!
Beanstalk governance attack