Leech Protocol

Farming tips

Ways To Earn In DeFi

Home | News & Insights Ways To Earn In DeFi The main difference between DeFi (decentralized finance) and traditional finance is that DeFi provides trustless interaction between subjects. The role of an intermediary is played by a smart contract. This is the main difference that makes all the ways of earning in DeFi possible, which we will talk about below. Today we will consider various ways of earning. The categorization is tentative, but we hope it makes it easier to understand DeFi’s capabilities. Some earning techniques may be repeated, but the mechanics will vary depending on the site/application. It is essential for us to understand the DeFi applications we are using, as different protocols earn money and allow us to profit in different ways. Let’s dive in. DEXs Decentralized exchanges (DEXs) are protocols that allow us to exchange one token for another. Trading on centralized exchanges is implemented through an order book. It correlates counter bids to buy and sell an asset. This is a good technology, but it requires a lot of resources. Making a fast, efficient, decentralized order book on a blockchain is difficult. So to solve the problem of exchanges in DeFi, another solution was found — Liquidity Pools and Automatic Market Maker algorithms (AMMs)¹. Liquidity Pools are liquidity buffers for making exchanges (there are many different types of liquidity pools, but the easiest to understand are pools containing two assets), and AMM is the name of the algorithm that defines the price of assets (without an order book or intermediaries). Now, let’s see how you can earn with these liquidity pools. Providing Liquidity On DEXs In order to make an exchange through a liquidity pool, there must be sufficient liquidity. In DeFi, any user can become a liquidity provider by adding his tokens to the pool and getting LP tokens in return, which will represent his share of the pool’s total liquidity. Let’s take the ETH/USDT pair as an example. The liquidity provider (which could be you) brings $1,000 to the pool. To put that into the pool, you would need $500 worth of ETH and $500 worth of USDT. If the current price of ETH is $1,250, that would be 0.4 ETH and 500 USDT. In this situation the liquidity provider creates a liquid pool of assets so that anyone can come and trade ETH for USDT or vice versa. In exchange for using this liquidity to trade, the trader pays a small fee (0.5% in our case) to the liquidity pool, which is distributed pro rata between everyone providing liquidity to that pool. A list of Liquidity Pools at uniswap.org. Next to the name, you can see the trading fee of that pool displayed as a %, as well as the TVL or Total Value Locked (how much liquidity is in the pool), and the trading volume over the last 24 hours, and 7 days. Providing liquidity is the most basic way of earning on DEXs (keep in mind that some portion of the trading fees goes to the protocol itself). It is worth noting that Liquidity Providers are subject to a specific risk, called Impermanent Loss². When assets inside the pool are volatile in relation to each other, liquidity flows in favor of the cheaper asset. This is a controversial term, but before providing liquidity, you should definitely learn more about Impermanent loss. Here are three main factors to consider when deciding whether to provide liquidity to a pool: Farming on DEXs Any new DEX protocol faces the problem of low liquidity and trading volumes. Exchanges with very low liquidity struggle to attract trading volume for many reasons. In order to attract liquidity providers to the DEX, protocols launch liquidity mining programs, which usually involve issuing the protocol’s own token. This strategy tends to work well, as it usually results in liquidity pools that can supposedly provide astronomical reward rates, such as 100,000% APR. This is effectively a marketing campaign, where the protocol dilutes itself in order to encourage liquidity providers to bring liquidity to the DEX. The liquidity providers then earn from trading fees and the liquidity mining program incentives. This method of earning is generally referred to as farming. The main problem with farming is that the price of the rewarded token usually plummets. Almost every DEX token has a steep downward price graph, since the token has no significant value other than being sold. As a result, the real APR tends to be quite low, even if the website shows a high APR. As an example, let’s look at the new DEX camelot.exchange, where yields are calculated primarily by GRAIL/xGRAIL tokens at the current price. The xGRAIL token has a minimum lock-in period of 15 days, and it has fallen in price from $250 to $210 in recent days. The real APR here will be much less than what is shown in the interface. But even considering this, the protocol can for some time give returns higher than the average of their competitors. Yield Farming aggregators, such as Leech Protocol, help users farm more efficiently. Farming is usually short-term and situational, and involves more risk, whereas income from trading fees is easier to predict and associated with the medium to long term. Lending Lending protocols open up the next layer of profitability in DeFi. These protocols offer you the ability to borrow various tokens against the collateral of other tokens, sometimes even NFTs. Here are the main things to know about borrowing from lending protocols: A model of the interactions with a Lending protocol. Providing Liquidity On Lending Protocols This is the most obvious way to make money from lending protocols. You can earn just by depositing an asset and not borrowing anything. Here, unlike liquidity pools, you only have to provide one asset to the protocol, and when that asset is borrowed, the protocol will share the loan’s interest payment with you. You may also be able to find liquidity mining programs on lending protocols, which provide additional rewards to both depositors

Guide from Hacken: How to choose a secure yield farming platform?

Guide from Hacken

Home | News & Insights Guide from Hacken: How to choose a secure yield farming platform? The quest for the best yield farming platform is underway. You have already studied the light papers and know the average APYs across the market. The next big step is to look into security. So many questions. Where to start, and what’s essential? How to calculate the risks? Where to get objective data? How long would it take? With a little bit of expert help, you can easily perform your own accurate and time-efficient Due Diligence to get ahead of the curve. We teamed up with a leading blockchain cybersecurity company Hacken to get the answers. We chose Hacken because they are industry experts in smart contract audits and know everything about blockchain security. CoinMarketCap and CoinGecko recognize Hacken’s audit reports, which speaks volumes about their industry recognition. Hacken is at the forefront of industry-wide smart contract audit standards as they are one of the contributors to EthTrust Specification. With five years of experience, 180 partners, and more than 1,000 protected clients, Hacken is among the top blockchain security auditors. Here’s a step-by-step guide from Hacken’s cybersecurity experts on how to choose the most secure platform for yield farming. Step 1. Check Scope and Relevance of Smart Contract Audit It’s impossible to overestimate the importance of smart contracts for yield farming platforms. A Smart contract is a code that governs and automates transactions. It typically consists of multiple functions, such as staking, withdrawing, lending, etc., that power up a DeFi platform’s operations. Secure smart contracts work as intended every time without any loophole for manipulation. Unfortunately, smart contracts are rarely without vulnerabilities. The most common are: All these vulnerabilities enable data breaches or private key leaks. The good news is that yield farming platforms can address these vulnerabilities with an external audit. An external audit is basically a thorough code review to ensure that all functions of the smart contract code work as intended without any hidden loopholes. Writing perfect code is almost impossible because developers are only humans who occasionally make errors. This is especially true when devs are constrained by time and resources. Smart contracts are vital for secure yielding platforms, but not all audits are created equal. Relevance and coverage are two main questions you must consider. The audit must be relevant and cover the entire project. Web3 projects typically have multiple smart contracts to ensure all of their features work as intended. All contracts (not just one) must be audited. Checking audit relevancy and scope with an example Step 1. Locate Public Audit Let’s take a look at one of Hacken’s clients, Zharta — a lending platform. Notice “Auidited by Hacken” badge on their website. Conveniently, Hacken website provides a list of all the public audits it has completed. We can easily locate Zharta’s audit here. Step 2. Locate a codebase repository First, let’s head to the “Scope” section on Page 4. We have a link to the repository and commit. The repository here matches the codebase that Hacken audited. Step 3. Check audit relevancy Once in their GitHub repository, notice the date of the last commit for ./protocol-v1/contracts/ (highlighted in red). The date of the last commit matches the date of Hacken’s audit. As a result, the audit is 100% relevant (as of the day of writing). Step 4. Check audit scope Inside the same folder (protocol-v1/contracts/), we have counted the number of key files — 12 smart contracts in the Vyper programming language. Inside the protocol-v1/interfaces folder, we count 11 contracts. Noooow, let’s compare this number with what’s inside the audit report. Go to Hacken’s audit report once again, and locate the Audit Scope section for the Fourth review scope. The audit by Hacken reviewed 12 contracts in the ./contracts folder and 11 contracts in the ./interfaces folder. Zharta’s codebase is powered by the same number of contracts. Therefore, the audit covers close to 100% of the key on-chain functionality. Step 5. What about vulnerabilities? It’s finally time to look at found issues inside the report. Hacken found 2 critical issues, 16 high, 5 medium, and 4 low. Three iterations later, Zharta developers resolved almost everything. You can read more about each found issue and how it was fixed in the report. Also, the final audit score is 8.4 It’s time for conclusions The Zharta landing platform has almost perfect audit coverage and relevancy with a very high score of 8.4. However, not all audits are this diligent. Unfortunately, we have hundreds of crypto projects with low coverage and a codebase that is no longer relevant. Again you can check Audit Relevancy and Audit Scope metrics at CER.live, but not all projects are listed there yet. Step 2. Is the Blockchain Protocol Safe? A protocol audit is different from a smart contract audit. Yield aggregators can interact with one or more blockchains. Leech, for example, works across 12+ blockchains. Some chains, such as Ethereum or Avalanche, are well-established with minimal security concerns. New chains are less recognized and don’t enjoy the same level of trust. DefiLlama lists 290 yield farming protocols working across more than 50 chains in total. You cannot assume that each one is safe. A new chain can earn trust by having an external blockchain audit. To verify whether a blockchain is audited, go to its website and check for the security page. Alternatively, information about the audit can be retrieved from the project’s repository on CoinGecko’s Security tab. Step 3. Background Check The significant purpose of a background check is to minimize the risk of a rug pull. Not all founders have the best intentions in mind. Some are growing their yield farming business with the sole goal of running off with users’ and investors’ assets. You’ll never see them again, and no one will return your money. Rug pulls happen almost monthly, so stay clear of fraudulent projects. Reputation is everything in a trustless environment. Look for LinkedIn pages, video interviews, and other valuable information about the platform’s founders. Who are they? Are they DeFi experts with a proven track record or amateurs with risky ideas and no

How Leech Protocol Manages Security Issues

Home | News & Insights How Leech Protocol Manages Security Issues: Security Deep Dive Outside of regulatory issues, the biggest risk facing DeFi at the moment is smart contract risk, or security risk. When real value is involved, users need to have complete confidence in a protocol’s security to deposit money into it. As one of the premiere cross-chain yield aggregator services, Leech Protocol takes security very seriously, and here we will examine the measures the team has taken to ensure safety of funds in the protocol. First, we analyzed 59 separate smart contract hacks. The team then documented the security vulnerability that resulted in each hack, so we could ensure Leech Protocol would not be defenseless against any of those attack vectors. These vulnerabilities can be divided into four groups: For each of these groups, we established various security measures. The loss of a users’ private keys Any private keys stored on our server are encrypted with several layers of protection; no one is able to access them. Additionally, all funds are stored in liquidity pools, which each have their own deposit and withdrawal address that is hashed for added security. Financial manipulation with flash loans The architecture of Leech Protocol and its heavy use of liquid stablecoins severely limit the opportunities for flash loan manipulation. Additionally, when adding new tokens to the protocol, there will be a slight delay in the accrual of rewards, preventing manipulation of the protocol using flash loans. Flaws in the smart contract code Because using Leech Protocol involves interacting with smart contracts, we have established good security measures around them. Every transaction is manually checked before being approved, and user’s deposits and withdrawals are validated through our backend server. Reward accruals occur only once in a given period using an algorithm. This does not depend on the user, and prevents flash loan manipulation, as previously mentioned. Even if a hacker exploits a smart contract, they will not be able to steal users’ funds, as funds are stored at the addresses of a particular pool, not in the smart contract. Human error We have removed the possibility for human error by ensuring that team members do not have access to the protocol keys. As previously stated, all keys are fully encrypted on our server and not accessible by anyone. Considering all of this, we are very confident in the security of Leech Protocol. We want to impress upon our community just how focused we are on our security since real value is involved, and how much attention we have given to it. What should you do next? Share: Twitter Facebook Telegram