DCTDAO will be the first Quantum Proof Cross-Chain DEX, including Polkadot, Moonbeam and more.

DEOR will be providing oracle support for their future exchange and use DEOR’s flash loan bot to test all future pools on the DCTDAO Dex for exploits, whereby identifying the attack vectors before they can be exploited. DEOR will also be adding liquidity and listing on DCTDAO when the exchange goes live.

https://github.com/dctdao
https://dctdao.org/
https://t.me/dctdao

Flash loan attacks have been one of the worst attacks DeFi platforms could experience and many platforms have lost a significant amount of assets from these attacks.

What is a flash loan?

A flash loan is a loan that’s given to an individual or entity that is completely uncollateralized, meaning there is no backing for this loan. A flash loan consists of three major steps. In step one, the loan is taken, in step two that loan is used and in step three, the loan is paid back. If this all happens within the same transaction, it’s called a flash loan.

Even though the loan has to be paid off within the same transaction that the money was lent out, the second step of a flash loan is the dangerous part. A flash loan could just be a normal part of a financial settling process that’s completely benign, but if it’s used with malicious intent and the objective is to drain assets as a result of manipulation then it’s a flash loan attack.

Let’s take a look at one of the most famous examples: the two flashing attacks that happened on bZx.

In the first attack, around 10 million dollars worth of ETH was lent out on the DeFi platform dydx and that money was split in half. Half of the ETH was used as collateral to gain more wrapped BTC on Compound and then the other half of the money was used to pump the price of wrapped BTC on kyber network. kyber network uses Uniswap to fulfill the orders and because the liquidity on Uniswap was not very high, the price pumped very quickly. The person who had leveraged their ETH on Compound, as well as the wrapped BTC that they got from the kyber network, was able to dump the wrapped BTC for a much higher price and made a profit of over 1000 ETH which was drained out of bZx.

The second attack was a little bit more complex. A coin with much less liquidity was targeted this time, specifically sUSD, which is synthetic US dollar, a stable coin. The attacker flash borrowed 7500 ETH from bZx, took a portion of that money and pumped the price of sUSD on kyber network, whose oracle is used on bZx. Since kyber didn’t have that much sUSD, it did not require too much to manipulate the price, and the price doubled. A stable coin that should have gone for one dollar (which was actually going for one dollar in other places) jumped to two dollars on kyber, simply because kyber didn’t have that much liquidity. The attacker then used the remaining portion of the money as a collateral to gain a large amount of sUSD on the open market, which still valued sUSD at one dollar. With this large amount of sUSD that had been acquired, the attacker did a collateralized borrow of ETH against sUSD on bZx.

If sUSD was still valued at one dollar, they would have just gotten the ETH equivalent of their assets, but because bZx relies on the price oracle of kyber (which was reporting a price of two dollars for sUSD) suddenly the sUSD that the attacker bought at one dollar was worth twice as much, so the attacker repaid the loan and made over 2300 ETH, all of which was drained from the bZx protocol.

An article on Hacking, Distributed shows us each step in the transactions in detail:

Other protocols like yearn finance, Balancer, Harvest.finance etc. also suffered from similar flash loan attacks. The problem is that these attacks leverage the differences between various protocols and these protocols don’t communicate with each other. They are very isolated and they all rely on separate oracles on sampled populations, so they don’t reflect the real world data. This is really the crux of the issue. As long as DeFi continues to work in silos and the oracles reflect those individual silos, attackers will be able to manipulate the oracles from which the smart contracts rely on.

Flash loan attacks are not a disease of DeFi, they’re a symptom of a much more serious issue: The centralized oracle issue.

How does DEOR help?

To really understand how DEOR makes a change here and also provides an extra layer of security against these sort of attacks, it is important to understand how DEOR works.

DEOR is a data aggregation oracle. When a smart contract requires information, it pulls data from multiple independent oracles and in the end, DEOR provides an aggregated result to a smart contract. When data is aggregated from multiple independent sources, you no longer have the problem of silos, which are local platforms or localized pools that can be manipulated. With DEOR, even if one single pool is manipulated, other oracles from other pools still reflect true data and this way the negative impact of a single manipulated oracle is diluted.

Even if multiple oracles were to be affected due to some black swan event, DEOR’s voting mechanism can also dynamically adjust the weights and reputation of oracles within the aggregator. This provides a very rapid way of determining which oracles are behaving properly and which aren’t.

The reputation system for DEOR records and publishes user ratings of oracle providers and nodes, allowing users to evaluate oracle performance holistically. The following metrics will initially be used the reputation system:

• Total number of assigned requests: The total number of past requests that an oracle has agreed to, both fulfilled and unfulfilled.
• Total number of completed requests: The total number of past requests that an oracle has fulfilled.
• Total number of accepted requests: The total number of requests deemed acceptable by calculating contracts compared with peer responses.

The reputation score also affects the rewards for true voting oracles. New oracles will get a reputation level of 5. It will be relatively easy for an oracle to reach level 4, but it will get harder and harder to reach higher reputation levels. Details on how the reputation score limits are calculated for each reputation level is explained in our whitepaper.

In case of a large massive blockchain devastating event, where multiple oracle systems are targeted, DEOR provides an extra layer of protection, because in addition to its aggregation, DEOR also uses a randomizer function, which randomly assigns oracles to an aggregation. This way, not every aggregation instance uses the exact same oracles and not all oracles are in every aggregation. The randomizer function will be explained in detail in a future article.

In summary, flash loan attacks have drained significant funds from DeFi protocols and if left unchecked they form a major liability to the growth of DeFi.

DEOR solves this problem by introducing data aggregation from multiple independent sources, a randomizer function and a dynamic reputation system where DEOR holders can vote on the reputation of oracles and determine which oracles are suitable and have valid data.

A smart contract acts as a digital, objective third party that completes a task upon the completion of a set of conditions. To phrase another way, a smart contract is a hard coded program that upon the completion of conditional statements, executes pre-defined clauses. A smart contract is typically used to store some sort of information on the blockchain. The advantage of a contract stored on the blockchain instead of in a centralized fashion (i.e. handled by a company with servers like GoFundMe, or even a physical third party like a bookie or lawyer) is that a smart contract is immutable, decentralized, and resilient to censorship by attribution to the blockchain it is on. A crowdfunding or sports betting operation can easily be shut down by an authority who deems it should not exist. But it becomes much harder to ban such a process when it is stored on the blockchain in all of its iterations. The applications of smart contracts certainly don’t stop there, either. There are far-reaching applications in the legal world, financial sector, and beyond. Everything from census taking to lease agreements have the potential to be revolutionized by this exciting new and disruptive technology. A huge variety of real world information and outcomes can be represented with smart contracts.

How does an oracle facilitate smart contracts?

“But wait”, you say. This is all well and good, but how does a smart contract know whether its real world conditions have been satisfied or not? How can simple code determine the temperature, score of a football game, or other such real world metric without referencing some authority of the outside world? It independently cannot, and to properly function, a smart contract needs this information fed to it by a reliable source called an Oracle. The truth is though that these Oracles are not always 100% reliable. See our previous article https://deor.medium.com/-8c05c2f8472b for examples of how singular centralized Oracles have failed in the past. A smart contract lives and dies by the quality of data that is fed to it. If it lacks information or receives manipulated information and executes on it, that is a permanent mistake forever chiseled into the blockchain. It is this inherit unreliability in the old smart contract to oracle communication model that the Decentralized Oracle DEOR token remedies. By establishing a reputation system among several oracles, DEOR effectively removes what was previously a single point of failure in the system resulting in a much more robust model of smart contract implementation.

Website: https://www.deor.io/

Twitter: https://twitter.com/deor_io

Telegram: https://t.me/DecentralizedOracle

YouTube: https://www.youtube.com/channel/UCZ1EtarhQuu3vfGSrZeSXBQ

GitHub: https://github.com/computercybersecurity/DecentralizedOracle/

Whitepaper: https://github.com/computercybersecurity/DecentralizedOracle/blob/master/DEOR.pdf

https://hubs.mozilla.com/HWKSRpk/deor-hub

important links
https://t.me/StrudelFinanceOfficial
https://t.me/DecentralizedOracle
https://t.me/NERDPriceChat

Today we will take a look at DEOR and how it offers a decentralized solution to the oracle problem.

What is DEOR?

DEOR is a decentralized oracle system that aggregates data from multiple oracles to ensure that the information provided to a smart contract is correct in a completely trustless fashion.

DEOR is actually the very first project to solve the oracle problem, allowing smart contracts to safely get correct real world information.

What is the oracle problem?

A blockchain is composed of individual blocks that contain transactional information. Let’s say wallet A transfers an asset to wallet B, so the balance of wallet A needs to go down and the balance of wallet B needs to go up. Over time, these blocks are added together and that forms a chain. Blockchains are isolated networks by design and cannot interact with the real world.

The only way to get real world information onto the chain is by using third-party devices or entities known as oracles.

Some examples of real-world information include market prices, temperature or individual data queries from a data set.

Particularly in the case of a smart contract, oracles are absolutely crucial because a smart contract is a digital agreement between two parties that can execute in a completely trustless fashion based on a certain condition . Most often, this condition is based on real world data, so oracles have to provide that information. Based on real world information, the contract executes or not. This provides a high degree of control over smart contracts because the results of an oracle essentially dictate the outcome.

The question is, how do we know that the information being provided to the oracle is correct? The answer is, you don’t; trust is required. This is the heart of the oracle problem because smart contracts (which are meant to be trustless digital agreements) have to trust that the input from oracles is correct because the outcome of the contract is dictated based on that input.

Centralized oracle solutions have failed in the past. This is really problematic because oracles can go offline. As an example, in March of 2020, due to gas prices skyrocketing, Chainlink transactions became so expensive that the oracle stopped updating and went offline, which wreaked havoc in the DeFi space.

In another incident, MakerDAO lost 4.5 million dollars worth of ETH when their oracle just stopped updating. Many flash loan attacks have also happened in the DeFi space. One of the first ones that gained notoriety was the bZx hack. bZx was using the oracle of kyber for a particular stablecoin. In this case, the hacker was able to manipulate the price of that stable coin on kyber because the pool on kyber was very small. Then bZx used this data as the general price because it relied on one single oracle of kyber network and consequently it was hacked.

Even more than individual reasons, oracles by design seem to be a central point of failure and can be targeted because everything is contingent on the result of an oracle. This is where DEOR comes in to solve all of those problems.

How does DEOR solve the oracle problem?

DEOR is just like any other oracle; it interacts with a smart contract like any other use case, but what it does uniquely is that it pulls information from multiple oracle systems and then this information is aggregated internally. The aggregated result is thenprovided to the smart contract. This means that the influence of any single pool is mitigated or averaged out across multiple pools.

It is important to note that not all oracles are equal. Some have been in the space for a longer period of time and are better maintained. Others may be more adept at a specific task (for example a project that only exists on Uniswap might get more accurate price results if you ask the Uniswap oracle).

In addition to aggregating the results from the oracles, DEOR implements a reputation score and a voting system. As a simplified example, we will demonstrate four different oracles pouring information into DEOR.

We can see that weights have been assigned to these four oracles. 50% of the weight goes to oracle one, 25% of the weight goes to oracle two, 12% of the weight goes to oracle three and 13% of the weight goes to oracle four. If we imagine a scenario where we request the US dollar price of a particular asset, let’s assume that oracle 1 gives a price result of 1.312, oracle 2 gives a result of 1.7, oracle 3 gives a result of 1.313, as does oracle 4. In this example it’s very easy to see that oracle 2 is an outlier, so there’s something wrong with the results being provided from this oracle. The impact of that incorrect response was diluted as a result of the multiple oracles providing data for aggregation.

Additionally, DEOR holders also engage in voting. When they see the discrepancy between the result of oracle 2 and the rest, they vote to increase the reputation of oracles 1, 3 and 4 and thereby increasing the weights, while oracle 2 gets downvoted, so its reputation goes down, as does its weight in the aggregation.

Based on the reliability of the data, the weights will change and in this case, more weight is given to oracles that provide the correct answer. This of course is constantly shifting as a result of the votes, which creates a really resilient extra layer of security for results from an oracle.

The DEOR token

The DEOR token has two main use cases:

1. The voting on the reputation and weight of the oracles as shown in the previous example.
2. Paying for aggregated oracle services using a single token.

Let’s look into the second main use case. DEOR also provides a unique advantage for developers and project owners to pay for aggregated oracle services. A project typically has to pay for its oracle services in the form of one token, because most projects use a single token. If they try to add an extra layer of security by including multiple oracles for example, they have to pay multiple tokens. With the DEOR customized oracle, you get all the advantages, with a single token, without having to be liquid in multiple projects, which means that DEOR tokens can also be used to pay for these services.

In summary, DEOR solves the oracle problem by aggregating data from multiple oracle systems and by implementing a reputation score and a decentralized voting mechanism. Because the real world data is also fully decentralized, systems that use DEOR have enhanced security over ones that use traditional centralized oracles. The impact of one wrong or faulty oracle is diluted since results are aggregated and there’s a dynamic shifting of weights based on reputation and the good behavior of the oracle.

The DEOR token is a very versatile token and can be used to vote on the reputation of the oracles included in the aggregation and also to pay for services from DEOR (like customized oracle services and contract upgrades).

This article is not meant to cover the full details the full technical details of DEOR. There’s a lot of features that were not explained in this very quick introduction (e.g. the randomization of the oracles in the pool, the contract upgrade services, etc.).

In future articles we’ll go over the technical points in more detail, so don’t forget to follow us. For more details, feel free to check out our whitepaper.

Website: https://www.deor.io/

Twitter: https://twitter.com/deor_io

Telegram: https://t.me/DecentralizedOracle

YouTube: https://www.youtube.com/channel/UCZ1EtarhQuu3vfGSrZeSXBQ

GitHub: https://github.com/computercybersecurity/DecentralizedOracle/

Whitepaper: https://github.com/computercybersecurity/DecentralizedOracle/blob/master/DEOR.pdf