Newsletter: Unhedged
The most important market trends and how Wall Street’s best minds respond to them. Delivered every weekday.
A small crypto asset trading platform called DeversiFi received a shock last week when it erroneously paid out a $24m fee.
A glitch in some little-tested software code left the London-based exchange wearing the charge when a user made an unremarkable $100,000 deposit.
On the blockchain, transactions are instantaneous, irreversible and anonymous. Market participants have no recourse to a deposit scheme or regulator to try to recoup funds. This incident highlights the vulnerabilities that implies.
But within days, the recipient paid it all back. To true believers in the emerging arena of decentralised finance – or DeFi – the return of the fee shows a generous ethos a world away from Wall Street and the City.
“In the decentralised finance space there is a real desire across teams and communities to build and co-operate for mutual benefit,” said Will Harborne, chief executive of DeversiFi. “But having survived Monday I wouldn’t personally recommend to anyone else that they rely on the goodwill of strangers on the internet to return their $24m.
“If we had not been able to recover the funds [that] would have presented a major challenge for us as a company,” he added.
Numerical flubs and human errors — collectively known as ‘fat fingers’ — are a fact of life in all areas of old and new finance. In traditional markets, some errors are reversed over a handshake; some are not.
Infamous past examples include the transaction that wiped 80 per cent off the value of conglomerate Jardine Matheson in Singapore in 2019. Deutsche Bank once wired $6bn to a hedge fund client by mistake. More recently, Citigroup sent $900m of its own money to creditors of cosmetics group Revlon.
DeversiFi’s faulty bill shows crypto, where “code is law”, is equally vulnerable to costly slip-ups that have no formal resolution mechanism.
“Right now, most of the users of DeFi are true believers in the technology and its potential, and so confidence may persist regardless of these events,” said Hilary Allen, professor of law at the American University Washington College of Law.
“But if DeFi is more broadly adopted by people less committed to the technology, confidence will become more vulnerable – and the potential for panics that can come with damaged confidence should give us pause,” she added.
Harborne’s company acts as a network for buyers and sellers to trade digital tokens automatically without going through a centralised exchange. It aims to skip intermediaries like banks and exchanges and also perform checks and reconciliation on transactions.
Transferring deposits generates a fee, known in industry jargon as a “gas fee”, because users must compensate miners for the amount of computing energy they need to verify a transaction on blockchain. But this particular transaction, through a wallet controlled by exchange Bitfinex, generated gas fees of $23.7m, six times larger than intended.
The only option was to persuade the miner to pay it back.
In its analysis of the incident, DeversiFi disclosed that it could see, through the blockchain, that the recipient was one of the top 10 miners of the cryptocurrency ethereum and had periodically deposited Ether tokens at another exchange, Binance.
“This led us to hope that although they were anonymous they might have significant holdings and not be tempted to keep the funds of someone who had been the victim of extreme misfortune,” said Harborne.
DeversiFi said it contacted Binance, which it said passed on the platform’s email addresses to the miner. Within hours the money was on its way back to DeversiFi.
Tim Swanson, founder of technology advisory firm Post Oak Labs, said the refund suggests miners are generally inclined to help with rebates. “Miners want to be perceived as good actors so they can earn more on other investments,” he said.
That ethos may not endure. Allen pointed out that the consequences for losing are money much greater. “This is why finance is so highly regulated. At a minimum, regulatory structures that require developers to test for bugs in their DeFi applications are needed.”
Without a safeguard, a polite request is one of the few options available. Compound, another DeFi project, said on Friday that it had accidentally handed tokens worth $90m to its users. With the assets gone and without the option to track down a single miner, its owner publicly threatened to report the new owners to the US tax authorities, before realising the shortcomings of the plan.
“This was a bone-headed approach,” chief executive Robert Leshner tweeted. “That’s on me . . . I appreciate your ridicule and support.”
