Title: Why DeFi needs decentralized cover (and how optimistic oracles fit in)

Author: UMA Project

Compiled by: ChainCatcher

Tl;dr: As DeFi evolves, the demand for decentralized cover is increasing. Although the decentralized cover space is relatively small compared to the scale of the DeFi market, some projects have come up with useful ways to provide protection for users. These projects often rely on a claims resolution process, highlighting the value of optimistic oracle mechanisms like UMA.

Key Points:

• There are risks in the DeFi space, which creates a demand for protection.
• As DeFi has developed, projects like Nexus Mutual, Sherlock, and Cozy Finance have paid out millions in claims.
• In the decentralized cover space, token holders typically vote on claims, creating an important use case for optimistic oracles like UMA.

DeFi is the largest success story of blockchain to date. Since MakerDAO launched as the first project on Ethereum to serve as an alternative to traditional finance in 2015, the ecosystem has expanded dramatically, peaking at a total value locked of $250 billion by the end of 2021. Groundbreaking projects and primitives have emerged across multiple blockchains. To date, over 7 million unique addresses have interacted with DeFi at least once.

Despite a cooling off in DeFi in recent years alongside a broader downturn in the crypto market, it remains a primary use case for blockchains like Ethereum, Avalanche, and Solana. However, the space is still immature. When someone chooses to interact with DeFi, they face risks such as smart contract vulnerabilities and hacks. Thanks to the endless hacks in DeFi, crypto has been dubbed "the wild west of finance."

This environment creates a demand for insurance-like products to protect users. DeFi relies on other supporting pillars such as security audits, white-hat hacking, and protected tokens, but decentralized protection can arguably be its most effective shield. While only a small portion of the $55 billion currently locked in DeFi is protected, some solutions have emerged that adopt innovative approaches to make the ecosystem safer. This feature reveals how decentralized cover works and the role optimistic oracle mechanisms can play in this space.

Euler Finance's $200 Million Hack and Lessons Learned in the Space

DeFi suffered its latest blow on March 13, 2023, when the Ethereum lending protocol Euler Finance was exploited for $200 million in a flash loan attack.

While $200 million is an astonishing figure, nine-figure hacks like this have become commonplace in DeFi. The scale of the Euler incident is not unique but is rather a result of events that followed. Euler Labs took all the steps that teams typically take after an attack, including contacting law enforcement, offering a 10% bounty to the hacker, and launching a $1 million campaign for information leading to their capture. However, on April 4, Euler Labs announced that the attacker had returned all the stolen funds to the Euler DAO treasury. The attacker, identified as "Jacob," also sent an apology message on-chain.

The return marked one of the largest recoveries of stolen funds in crypto history. More importantly, after Jacob converted the stolen assets into ETH and DAI, the amount they returned was greater than what they had stolen. The Euler team announced a plan to reimburse users on April 5; some claimants lost part of their investment, while others profited, depending on their activity on the protocol.

While hackers rarely engage with victims, let alone return stolen goods, DeFi teams often attempt to negotiate with attackers after hacks. In fact, a 10% bounty has become standard for such attacks. After Jacob returned the funds, Euler was relatively unscathed. However, it is clear that DeFi needs to do more; sending an on-chain message and offering a bounty after an incident is insufficient to maintain a healthy ecosystem.

Before the March 13 incident, some Euler users had already insured their DeFi activities with on-chain insurance. Cozy Finance is a DeFi protection protocol on Ethereum and Arbitrum that reimbursed users after launching insurance for Euler in February. Sherlock also directly paid the project $4.5 million. The largest cover protocol on Ethereum, Nexus Mutual, paid out $2.4 million; the project's DAO later contacted Euler to request a $2 million refund, as it had already compensated policyholders for their losses, which were later returned. According to CoinDesk, Nexus Mutual stated that it might take legal action if the funds were not returned. Cozy and Sherlock used UMA's optimistic oracle as a layer for payment resolution, while Nexus Mutual has its own internal resolution system for making payment decisions.

The Euler incident highlights the importance of due diligence audits and effective handling of events when they occur. But it raises an important question: Is there a way to make DeFi safer (what if the funds are returned later)? Security audits and effective crisis management can play a crucial role here, but clearly, protection is also vital.

DeFi and Risk

Interacting with cryptocurrencies involves risk factors. Users need to assess risks and then make decisions about purchasing assets, how much to invest, etc., based on their conclusions. Interacting with DeFi increases this risk and presents users with a series of new questions: Is this protocol safe? How much can I earn? What portion of my portfolio should I put into this smart contract?

Similarly, DeFi projects must weigh risks with their own questions: Is the code safe? Can we trust our audits? What is our plan if we get hacked?

DeFi protection is a direct response to risk, aimed at helping users and projects answer the above questions. When projects offer coverage, they are essentially saying, "This technology is experimental and risky, but our product can give you peace of mind by protecting your assets."

Protection in DeFi

Like DeFi users, projects like Cozy and Sherlock face the challenge of pricing risk through the insurance they provide. Protection options vary depending on the relevant projects and activities. But generally, they target several different types of users:

• Farmers looking to earn by depositing assets into protocols. They need the rates they pay for protection to be lower than the returns they can earn; otherwise, purchasing it makes no sense.
• Borrowers wanting to withdraw assets from their holdings. They pay to protect their collateral and pay interest on borrowed funds.
• Lenders hoping to earn premiums by providing protection to other users. They can earn high interest on their held assets, but they may lose a significant portion of their deposits in triggering events like hacks.

Once DeFi protection projects provide coverage for users, they need to determine whether to make payments in the event of an incident. In the traditional world, insurance companies typically decide whether clients will receive payouts based on a set of predetermined terms and conditions. In some cases, insurance companies exploit loopholes to avoid payouts.

DeFi protection works differently. Projects typically rely on a resolution process to determine payouts, which can provide transparency and eliminate bias. Token holder communities vote and are rewarded for participation, rather than a single party deciding who receives payment. This is where UMA's OO can serve as a useful tool for protection projects.

Cozy uses UMA's OO as part of its security layer to trigger payments. After a hack, the oracle answers the question, "Did a hack occur?" Then it pays users who took protective measures with Cozy. In most cases, Cozy users are typical DeFi users.

Cozy Finance launched its protected service for Euler Finance users in February, utilizing UMA's optimistic oracle to trigger payments.

Sherlock operates differently from Cozy, as it targets the protocol directly rather than the users. When the project agreed to pay Euler $4.5 million, it did so because Euler had already taken cover. Sherlock uses a group of experts known as "Watsons" to price risk and provide insurance accordingly. Like Cozy, Sherlock uses UMA's OO to trigger payments, but with the premise of decision escalation. When projects cannot reach an agreement, Sherlock asks $UMA token holders to assess payouts, aiming to eliminate third-party bias. This is because $UMA token holders are incentivized to vote honestly, and they should not gain or lose anything from Sherlock's payment decisions.

Sherlock's current asset value is approximately $16.5 million.

Nexus Mutual launched in 2019 and remains the largest on-chain protection service in the crypto space. According to its own website, it has insured $5 billion worth of coverage and paid out $17 million in claims to date. According to OpenCover data, it is also the only DeFi insurance protocol with a loss ratio below 1 (with premium income of $23.9 million and claims payouts of $17.8 million). In March 2023, Nexus Mutual launched its V2 product, transitioning to a "risk management layer" for various businesses. Nexus Mutual can now cover a range of risks, including crypto-related risks such as smart contract failures and hacks. While the project currently does not use UMA's OO, it relies on a resolution process that has some similarities to UMA's data verification mechanism. Members holding $NXM vote on claims and are rewarded for honest voting. Meanwhile, those who vote fraudulently may lose their staked tokens. Claims are typically reviewed within three to six days. Where $UMA token holders participate in the game and stake their tokens to verify any truth, $NXM token holders stake to reach an agreement on claims payments.