DeFi vs. CeFI
The crypto world has largely wrapped its head around “digital gold,” but the promise of a web 3.0 future with things like decentralized identity, autonomous agents, and p2p digital resource markets (e.g. storage) still feels far out. The DeFi narrative, on the other hand, has dominated the crypto conversation in 2019. It promises a future for banking that is open and permissionless. One where anyone can access various financial services, understand the transparent risks involved and have confidence their money won’t be stolen or frozen. There are killer apps that already work, too. Anyone can trade their cryptoassets on Uniswap or verify the amount of debt and related collateral in MakerDAO ($MKR).
However, encapsulating the true nature of the term “decentralized” is more difficult than it appears and a deeper look under the hood reveals many of the leading DeFi protocols aren’t as decentralized as they first appear. That’s not to say all projects working in what we refer to as DeFi have to be fully decentralized, so long as there is transparency regarding the degree of centralization. Take Compound. One of the fastest-growing DeFi protocols with over $40 million in loans outstanding. One major reason its been able to sustain this fantastic growth in its early going is that it offers a 5x improvement over centralized alternatives - 10% vs. 2% interest rates. This is a dApp that isn’t merely offering ideological benefits but easy to understand, tangible benefits to the average consumer looking to earn interest - more money is better than less money. At least for those interested in taking on the additional risk.
Of course, there’s no such thing as a free lunch. Money doesn’t actually just go into a magic protocol and spit out continuous interest while funds remain completely safe. According to leading contract auditor, Open Zeppelin, this is not the case - their recent work with Compound shows the protocol has four administrative functions which - if compromised - would allow the attacker to prevent borrowing, steal cTokens, and even drain all of the underlying staked assets. Whoops. This is obviously problematic and compromises the key-value prop of “decentralized” finance where you can be your own bank and cease to rely on third parties for these types of administrative functions. Not only are you relying on this company to play by the rules, but you also exposing yourself to the chance this third party gets compromised by an attacker.
I’d venture to say many people contributing to the $40 million on Compound are not aware of these vulnerabilities (although they might not care, and find the risk worth the reward). It does highlight the danger in referring to some protocols as “DeFi” without more standardized definitions.
This is by no means a Compound specific issue either, many of the other top projects have different centralized components.
MakerDAO has been using a group of oracles to input price feeds that - if compromised - could cause mass liquidations on the platform. The Dharma team outright paused their entire platform in order to pivot their business model and actually build on top of Compound. The point here isn’t that these projects are doing a bad job and that centralization is to be avoided at all costs. In fact, it seems foolish to decentralize entire tech stacks indiscriminately. But more work can and should be done to ensure users better understand the centralized risks they are signing up for. That knowledge could lead to social pressure on teams that get pushed further towards decentralizing key components of their product stacks. Just like we’re seeing with MakerDAO V2 oracles or Compound’s plans to move their admin access to a DAO.
