PoolTogether Community Podcast #23 with Torgin from PoolTogether

This is the Pool Together Community Podcast. Pool Together is the world's number one no-loss prize savings account. You can visit pooltogether.com to deposit. You're listening to the Pool Together Community Podcast. I'm Hot Mike, aka Tim, aka Hot Pocket, and I'm here with Torgan, community OG. Torgan, thanks for being here and making some time.

I'm very happy to be here. I've been waiting a while. I always wanted to be on the podcast.

Yes, and now is the perfect time. I feel like all of the stars are aligning, everything in crypto that's happening. It's funny, like right before this podcast, you're like, are you just like trolling my Twitter? Because I'm going through your Twitter preparing for the podcast, liking everything I see. And then I liked so many things that I turned on the bell. I have very few notifications on for people, Torgen, but you are now one of them because of the gold in your Twitter. So we'll have to link to that in the podcast notes. But I think just based on everything that you're doing, you do security audits, right? You do, you had some based tweets about oracles with Chainlink. So I'm excited to talk to you about all of that. But first, Torgen, so we can have a basis, a good foundation for this podcast. Could you tell me your crypto origin story?

Yeah, sure. So basically back in 2017 is when I started. That was between me finishing high school and starting university. I took like a year, a gap year, and I was working a little bit in an internship, but also I had a lot of free time. So I like needed something to do that was more useful than just watching Netflix all day. So I thought, you know, I'd maybe look at some interesting financial things and then I saw like Bitcoin was up, I don't know, 7,000% in a year, which, you know, catches your eye, of course. So basically I started learning a little bit about it and that was like my first Financial investment, right? Because I had just started working for the first time. And yeah, so I, I started just buying a little bit of Bitcoin and then kind of got drawn into, to more of the, the rest as well in terms of trading. So like I became a pretty active day trader kind of by accident. I joined a really good trading Slack back then where everyone was just trading all day. And that was a lot of fun. I think I learned a lot there as well. And I also then had a trading bot that I wrote, which basically did some arbitrage on a stablecoin, which actually, funnily enough, that stablecoin back then, it was called Nubitz. worked very similarly to Luna or UST, and it also collapsed, but already back in 2018. So, you know, I guess history just repeats itself. Yeah. And then the bear market came in 2018 and trading got a little bit less interesting. So then I started my computer science degree and kind of did that. And then 2 years ago when DeFi Summer started, I saw DeFi and like all the stuff that was possible about with it and especially flash loans. Like when I saw what a flash loan was for the first time, that just totally blew my mind. And I was like, oh my God, this is the coolest thing ever. And this is like something fundamentally new that you can only do in DeFi and not in traditional finance. Yeah, so basically like that was kind of the catalyst for me to really get back into it. And since then I've been much, much less on the trading side, like basically just passively holding and not trading at all and just getting super deep into the technicals and all the fundamentals and like trying to understand every part, how it works, what the limitations are, What the trade-offs are, stuff like that. Yeah. And then I, for my bachelor's thesis at university, I wrote a paper about the Uniswap Oracle, which maybe we can talk a little bit about what that means later. And now I'm, I recently started working at Chain Security, which is a smart contract auditing firm. Where basically if a crypto project writes Solidity code and they want to put it on mainnet, then first they give it to us. We make sure that there's no bugs or exploits in it. We're kind of like, I guess you can think of it as white hat hackers. Yeah. And just make sure that there's no exploit, which of course is the worst thing that can happen to any DeFi protocol.

And then how'd you get connected with PoolTogether?

Right. So when I started learning about DeFi, I also saw a video about a prize savings account in traditional finance and thought that that idea was really cool. And then since I have been learning about like Compound and Aave, Before that, it really just like clicked in my head and I was like, oh my God, you need to make a price savings account in DeFi. So basically I was actually thinking about that before I even knew that PoolTogether existed. And I was planning on building something like PoolTogether myself, like founding my own startup. I even talked about it with 2 of my— 2 students from my year in university. We were like keen on doing it and started doing research on it, on how exactly we would make it happen. And then during that, we found Pull Together and they had basically like already built everything that I wanted to build exactly the way that I had imagined it. So that was just perfect. And then I joined the Discord, you know, first as like opposition research to see what they were doing. But then I pretty quickly switched to like just being fully immersed into the Pull Together Discord as a contributor and just helping out here. And yeah, basically stopped working on the competitor project and just tried to contribute to PoolTogether and make it the best thing that it can be because it just like was already on the right track.

Yeah, it's so, I just had a conversation with a friend who's not in crypto at all, and I told him about this podcast, about PoolTogether, and the thing he latched onto, he's like, oh, prizes? I like prizes. Can I do this? Like, that was the thing, was just the prizes was his favorite thing. So I thought that was awesome. So, Targut, I want to pause and ask you something related to what you said for newbies, for noobs, for normies is, I feel like when I've been getting into crypto since I dabbled in 2019 and dabbled in 2020, I've been full-time in it since 2021, November. And I don't, I'm not a coder. I have experience with like HTML, CSS. I've done a little bit of intro Python, that sort of thing. But I feel like this space, you have to be able to read smart contracts. You have to be able to, there's some level of coding or some level of technical acumen that you need to have to be able to flourish here right now, at least. So do you have any tips on that for even just for me of like what I should do to wet my whistle, wet my technical whistle?

Yeah. I mean, I think basically Solidity is the same as like any other programming language, right? Like the, the very basic syntax is like the same as Java or, or C# or anything like that. And I think even if you just know any other programming language, you can read the code and like roughly understand what is going on. I think if you've never programmed before, then like there's not really that much you can do. Like you just need to take an introduction to programming in like any language. But I think after that, just go out and read some code, right? Like all the GitHubs are public, everything is open source. So just find some project that ideally you already know a little bit how it works, right? Like, so in your case, maybe the PullTogether GitHub. And try and see like if you can figure out how the stuff maps onto the smart contracts and like how the documentation relates to, to the actual code. And yeah, just, just try it.

Okay. So how did you then go from security with, what is it? You said it, chain security to, so white hat hacking to now you're leading great, or yeah, you're, you're, you're on grants at PoolTogether. How did that position work out? Because I would think that you'd be on security or treasury or something like that, but like grants is your baby. Can you tell me about forming grants and like how you came to know and love that position?

Yeah. So, I mean, I've been at PoolTogether Grants for longer than I have been doing smart contract audits. So PoolTogether Grants was founded actually pretty much one year ago today. And so I've only been at Chain Security for about 2 months. So the order is actually different. But yeah, basically, like at some point, the community just decided that it would be useful to have a grants program because we had tons of cool ideas bubbling up everywhere, but like not really a defined way of how to fund them. Right. And if maybe someone wants to do something cool and needs $5,000 to do it, then the only way that you could do that before was to make a PTIP, a pull-together improvement proposal, but that has a lot of overhead for it to go through. So just one proposal per week, but probably even less than that. So basically we saw that in, or not we, it was actually at the very beginning of this, I was not directly involved. It was some other people that started it, including Taliskai, I think, and Chris Crypto. But basically, there exist these grants committees for other protocols already. So for example, Uniswap or Compound, had them and we kind of modeled our grants committee after that. Yeah. And so basically at this point, the idea of the grants committee is to fund like potentially smaller initiatives without the full overhead of doing a PTIP. And then that basically removes some of the friction from governance. Because it's also a problem if you ask governance to decide too many things because people just start getting apathetic, right? So instead, you want to give governance a couple big, high-impact things to think about where they can really, like, where it's worth devoting their time because a lot of different people are going to be looking at the PTIP. And then for smaller things, we basically have the grants committee, which is myself and 5 other people right now. And there we are kind of in charge of looking at the proposals that we get and seeing if we think that it's useful for the PoolTogether protocol and then deciding if it should get funded or not.

So you, I don't know how to pronounce it, like DDoSing governance is not, this is kind of like preventing that. And, uh, that's, this is so, so now you guys get all the spam, right? You get, right. Cause you have the, the accessible money. So you probably get a lot of people that are like, ooh, grants. I've never heard of Pull Together ever before in my life, but you got grants money. So I'm going to pitch something. Yeah. So how do you handle that?

It happens quite a bit that people basically just send us their VC pitch decks. Uh, and sometimes like Pull Together is not even mentioned in the application once, right? It doesn't say how their thing is ever gonna bring value to PullTogether, and it's just like a new NFT market platform or something like that. So we do get those quite a bit. And basically, like, if they don't even state how their thing is related to PullTogether, then that's usually just an auto deny. And then if they're building something that could bring direct value to PoolTogether, then usually we talk to them. But also it's often the case that it's like very early stage things where basically the only thing they have is an idea. And then in those cases, we're usually very cautious. We'd rather like have them come back later when they actually have a product, and then we could maybe facilitate them integrating the product with PoolTogether. So for example, there's a mobile wallet called Orange Wallet, and there we did exactly that. So we gave them a grant for them to integrate PoolTogether into Orange Wallet. And now if you are an Orange Wallet user, you can deposit into PoolTogether. really easily. It's like really neatly included into their UI. There's a DeFi panel and within 2 clicks you can deposit into PoolTogether, which is actually a better user flow, I would say, even than using the PoolTogether app itself. And especially considering that it's on mobile.

So the Discord wants to know, Torgan, what's your favorite grant that has been administered today?

I mean, I think the, the fact that I just brought up Orange Wallet definitely shows that I, I really liked that one. I think I loved the Christmas cards as well. So we had a Christmas card that was designed by Oops, our, our favorite Pull Together artist, with a fat Santa that was ledging into a hot tub. Very, very on brand. And basically we sold those as NFTs for, I think like $70 or something. And if you had one of those NFTs, then you could actually redeem those for a physical Christmas card, which Gabor sent out to people. And that Christmas card had a wallet on it that was preloaded with 50 USDC that were deposited into PullTogether. And that meant that you could get one of these Christmas cards and gift it to one of your family members, like your mom, for example. And even if she had no idea how to use a crypto wallet or like had no idea how PoolTogether works exactly, she could still partake. And yeah, it's basically like was a great onboarding tool, which was also like a fun way of introducing people to crypto, I think, maybe sparking some conversation about crypto and PoolTogether at the Christmas table, which I think that was really awesome. And then also it was the first time Where we used the delegation feature in a really big way. So one of the VCs that invested into PoolTogether, their name is Maven 11. They sponsored $100,000 in delegation for that Christmas thing. So over 8 weeks, every week, one of the Christmas cards got chosen at random to receive $100,000 delegation that week. So then that person would have the winning chances as if they had $100,000 deposited, which I think is also like a really awesome thing, especially for people that were like newly onboarded, right? To have that experience of winning every single day because with that amount deposited, it's basically guaranteed to win every day.

Yeah, winning every day is the best. That's, that was, I love that. I thought that was so powerful and I did buy I bought one Christmas card and then I like got FOMO. I was like, wait, I need to get more. And so I think I bought, ETH went up or something. And so it went from like $60 to like $100 and I even bid lower, but then I felt bad for bidding lower because I think we were giving the money to charity or there's something very generous about it. And then I felt bad, so I just bought it double when the price doubled. And it's been a really helpful way. And even with like the smaller amounts, I was able to delegate to those people that I got on board with those Christmas card things. So now I'm in the chat, I'm like, ooh, we should do something more with those Christmas cards. That was so good. It was so good. So, but yeah, that's a, that was a very good, that was my first pull-together NFT experience. And now we've got so many pull-together NFTs, but thanks for doing that. There's no question there. Just, just me excited about Christmas card. Maybe we'll have to, we gotta like, We gotta make a better one this year for Christmas. We gotta do something else anyway.

Yeah. I mean, actually this was the second Christmas card. Gabor already made a Christmas card the year before. Uh, but it, it wasn't quite as, uh, popular back then. And NFTs were also really new. Gabor was super early to the NFT train. Uh, he, he tried to also push some more NFT pull-together stuff. Yeah. Um, unfortunately it never really worked out, but, uh, yeah.

But now it's working out. I mean, we've got pool, we got NFTs everywhere now, all over the pool. So Gaber, thanks for your, for your leadership there. That's really great. Um, but Torgan, when you said you have, you, you have 2 years or 2 months of, uh, in, I mean, not of security experience, but 2 months at Chain Security now, but you had this tweet that kind of echoed across the Twitter The crypto Twitters, where you pointed out that Chainlink, as it, the oracle, the Chainlink oracle had, it was on a multisig wallet with a 3-of-20 multisig sort of thing. And then I had to go look up what an oracle was, and then I had to like, then I got really scared. So can you explain like how that happened, how you happened upon the Chainlink fiasco and what has resulted out of that tweet? Any conversations you've had or anything?

Yeah, for sure. So I guess maybe first, like, what is an oracle is, or specifically a price oracle in this case. So a price oracle is something that tells you the price of an asset on-chain, right? Which seems pretty simple, but actually it's not. So for example, a smart contract doesn't know anything about the real world, right? It doesn't know how much 1 ETH is worth, for example. So it needs an oracle to tell it how much 1 ETH is worth, if that is part of the system. And there are different ways to do this. And one way is that you just take the price feeds from centralized exchanges, which are off-chain, right? So like Coinbase, Binance, Crypto.com, they all have a price for ETH. And this is basically what Chainlink does. So Chainlink is a way to get these price feeds that are off-chain and you read them and then you aggregate them and you post that result on-chain. And then a smart contract can go read the Chainlink price feed and then can find out how much 1 ETH is worth. And for example, if you have a lending protocol like Aave, there it's super important that the smart contract knows exactly how much the different assets are worth. And if the oracle reports prices that are very wrong, then basically all funds can be stolen. In the worst case. So it's super critical that these oracles are correct and that they can't be manipulated. And so as I mentioned before, that's— this oracle problem is something that I've also actually done formal research on. So my bachelor's thesis, which I turned into a paper afterwards, that I actually published a couple weeks ago was on the Uniswap Oracle. And in doing work for that, I of course also looked at the Chainlink Oracle. So that's kind of why I'm interested in oracles. But there I was mostly looking at like how the Chainlink Oracle system works. And that is actually totally separate from this thing that I pointed out with the multisig. Because basically Chainlink has built this huge protocol that is supposedly a decentralized oracle system where they also have like staking and whatever to make it work. And all of that rests on top of a base smart contract on the Ethereum blockchain, right? Everything is basically built on top of a root contract. And that root contract has a field which is called owner. And what that owner can do is upgrade this code in that root smart contract, which basically means you can replace any functionality in that smart contract In any way that you want. And so that means that if that owner is compromised, then anything that you have built on top doesn't matter at all because you can just replace the stuff that's built on top with like your own malicious version of it. So it's super important that this upgradability is not easily exploited.

Well, is that bad design in the first place that you could have like God mode unlocked with the root smart contract?

So it's a trade-off. If there is some critical bug that you know about and you want to fix, then of course the God mode is super useful, right? In order to respond quickly to that, to that bug. I would say you definitely have to be super careful with how you handle the access to God mode. And, you know, I think there is a point to say that maybe the God mode shouldn't exist at all. But I think in like fairly early stage projects, it usually makes sense as long as you have like good checks and balances on it. And then eventually you probably want to remove the god mode entirely. But now the—

Go for it.

So that this, like, keeping your god mode safe, that is exactly where the thing that I pointed out comes into play. So this god mode is controlled in Chainlink by a multisig, which is a 3-of-20 multisig. So that means there's 20 authorized signers, which nobody really knows who they are, as far as I can tell. And as long as 3 of them sign, then you can replace the smart contract implementation, meaning you can like do anything you want. And that is of course a big risk because if 3 of those people are either evil or get compromised or anything like that, then the oracles can report incorrect prices and then anything using those oracles will fail. So that especially includes Aave, which has multiple billion dollars inside of it, and all of those could be stolen if the Chainlink Oracle is manipulated.

This is where you tell me that everything was fixed after your tweet because everybody's like, oh yes, we should not have this. Chainlink saw the light and they fixed it, correct?

You would think so, but no. So apparently Chainlink has been aware of this for many months. There's another smart contract auditor. His name is Mudit Gupta. He mostly works on Polygon. He said that he has brought this up multiple times to the Chainlink team over the past couple months and nothing ever happened, basically. And there's also no public announcement by them acknowledging it. And it's also not very well documented in their documentation.

So that affects a lot, right? I mean, it's, it affects PoolTogether and where we put our pool. It affects many things. So has this made you more wary of Ethereum, basically of doing any business on Ethereum?

Yeah. I mean, basically if that fails, all of DeFi collapses, or like, let's say 90% of DeFi. And then also there's a lot of secondary effects, right? If one thing collapses, other things collapse because weird conditions happen and stuff like that. I'm not super scared of anything happening immediately. And I also think that it will get fixed eventually. It's definitely a risk. I would say it's probably still a low probability of it going wrong. Yeah, but it, it could definitely happen. I mean, we have seen cases like this before. So specifically the Ronin bridge hack, which was the Axie Infinity chain, that bridge was also controlled by a multisig. And there, the smart contracts all worked exactly the way that they should. But those signers, and in that case it was a 5-of-9 multisig, 5 of those signers got compromised just by a normal, like, cyberattack where someone hacked into their servers that were controlling those keys. And then $600 million worth of ETH went missing, right? Which is the biggest crypto hack of all time. And that was exactly a multisig attack, which is like the same type that could happen to Chainlink potentially.

Okay. All right. Well, let's move on. So you wanted to talk about Uniswap oracles. I mean, and I know, so I know a little bit 'cause I watched some videos, but it's like an automatic market maker and they have this really elegant formula for pricing. And I think that Compound, Protects itself. Somebody was saying that they use Chainlink. Yes. But then they also cross-refer, they use, I think, Uniswap or something as a check. So if, if the Chainlink oracle's off, then they'll, then they'll default to the Uniswap oracle, but, or Uniswap using this very simple equation. Can you tell me more about Uniswap and, and their, and their AMM?

Yeah. So yeah, it's correct. Compound uses Chainlink and Uniswap Oracle. So Uniswap is by far my favorite DeFi protocol out of anything that exists because it's so decentralized. It's just a smart contract that has this simple trading function, and it is non-upgradable, and there are no admin functions. And basically, like, Uniswap will be running the same way that it is today forever, as long as the Ethereum blockchain is running. So I think that's really awesome, and it also mitigates a lot of risks. And specifically what you can do on Uniswap is it's a decentralized exchange, so you can swap any token for another token without any counterparty risk, right? Like if you were using Coinbase, for example, to do your trades, then you need to deposit your tokens onto Coinbase, then trade there, and then withdraw them back. to your wallet. But in this case, everything happens on-chain and it's all implemented in smart contracts. So there is no risk that like Coinbase goes bankrupt while they hold your coins, for example. 'Cause in that case, you would probably not get them back. So that is like one big risk that Uniswap avoids. And then in terms of the oracle, The Uniswap Oracle is really cool because it's a price oracle that doesn't get its price data from off-chain, but instead it gets it from on-chain because the Uniswap market is a market, right, which trades tokens against each other that's fully on-chain. So you can just go and see what the price of a token is on Uniswap. And then take that as your price. So if you like want to know the dollar price of ETH, you just look at the ETH/USD pair on Uniswap. And that avoids the problem of having to bring things from the untrusted off-chain environment to on-chain because the data is already on-chain. Now, the big question In terms of is Uniswap a good oracle is will that Uniswap price always be the same as the price on other exchanges like Coinbase? Because if not, then it's a lousy oracle, right? Because you don't care about the price of ETH on Uniswap, you care about the price of ETH like overall. And in theory, Uniswap should always be very close to the other exchanges because if not, then there is an arbitrage opportunity, which basically means like if on Uniswap the price was lower than anywhere else, for example, then you could just go buy ETH on Uniswap for cheap and sell it for more on another exchange, which is free money. So as soon as an opportunity like that exists, someone takes it and then the prices even out. And so that is why Uniswap generally has very similar prices to other exchanges, which also like gives the idea that a Uniswap oracle could work. Now, the actual implementation that is mostly used for the Uniswap oracle is that you don't just look at the current price. of an asset, because that could be pretty easily manipulated, right? You can just go ahead and buy a bunch of tokens on Uniswap and making the price too high for this exact moment. And then you go read the oracle price and it'll give you that price, which is too high. So instead, what you usually do is you take an average over some time. So you could say, for example, the average price on Uniswap over the last 30 minutes, and then that is your oracle price. And the idea is that that is more difficult to manipulate because it gives more time for people to do these arbitrage trades and bring back the price to the actual price. And if you want to keep manipulating it, then it gets really expensive. For you. And that cost of manipulation is what I analyzed in my paper. And basically I showed that there are some ways in which you can attack the oracle that make it cheaper to attack. So that, that the oracle is not basically as good as had been assumed before. And especially one specific thing is that if you can control multiple blocks in a row, then the attack becomes really cheap because you can manipulate the price in the first block, but then you also control the order of transactions in the second block. So that would be like if you were the miner of the second block, for example, and then there you can ensure that you then push the price on Uniswap back down to the correct level and that nobody else can do that. And if, if you were able to do that, then the manipulation becomes basically free. Yeah.

So, Tzvargan, you actually had a paper on this or a presentation for ETH Zurich, right? You just presented maybe last month on something similar where you were talking about the cost of, you know, manipulating these market makers, correct?

Yeah, exactly. So I presented this at the IEEE blockchain conference a couple weeks ago.

What was the response? Did you get a standing

ovation? Yeah, I mean, I've had a lot of good responses. Of people that found it interesting. And then also specifically, I had a Twitter thread a couple weeks ago where I highlighted that when we switch to proof of stake on Ethereum with the merge, then these multi-block attacks where you need to control the next block actually become a lot easier to do. Because the way that you would do it now in proof of work is you would have to do what's called selfish mining, where you mine a block, but then you don't publish it. And instead you keep mining on your block without telling anyone. And that has a pretty high opportunity cost. But in Ethereum's proof of stake, it becomes a lot easier because there you will know up to 12 minutes ahead of time who the block producers are going to be in the future. So for example, if you were an Ethereum staker, you could know whether or not you will be producing the next block. And producing the block here just means deciding which transactions get included into that block.

Why do, why is that necessary to know who the validator or the, is it the validators? Or no? Well, why is it necessary to know who those are 12 minutes before it happens?

Yeah, so the validators is like the pool set, and then for each block, one of those validators becomes the proposer who builds the block. And just because of the way that the proof of stake system works, you need to have a leader and basically you need to, like, it needs to be known ahead of time whether you are the leader or not, or like who, who is supposed to be the leader. Yeah, it's just how, how the system works requires having that.

But you, but you in your tweets, when I was stalking you moments ago, said that validators are actually not needed. Why is that?

Okay. Yeah. So that's a very, very different conversation, which we can have as well. So in what I was referring to there is that, so we have these consensus models or mechanisms like proof of work or proof of stake, right? And a lot of people think that if you control the majority in that consensus model, so let's say Maybe let's take proof of work because most people are more familiar with it. So in proof of work, you have these 51% attacks, right? If you control more than 50% of the hash power, then you can fork the network and you can do double spend attacks, for example, where, where you would like spend the same ETH in 2 different forks. And you can switch forks because you have the majority of hash power. So that is a really bad thing to happen. But most people assume that if you control the majority of the hash power, that then you can do anything on the chain, right? So for example, you could give yourself just a million ETH and nobody can do anything about it. And that is not true. So what I was referring to is that for correctness, you actually don't need these consensus mechanisms because let's say that someone has even 100% of hash power, so then they can build any blocks that they want and they can make sure that that becomes the longest chain. And now they put this transaction into a block that gives themselves a million ETH, but that is actually not a valid transaction according to the rules of Ethereum. So what would happen is they would create this block that includes that transaction, and then they would send it to All the other nodes in the network. And then what that, what those new nodes do is they run all the transactions in the block themselves and see if they are valid transactions and if they fulfill the rules of Ethereum. And they would see that the transaction doesn't. And then what they would do is they would just drop that block and pretend as if it had never happened. Right? So that means that for all the normal full nodes in the system, which are not compromised, that are like the honest people, to them, it would just look as if the chain wasn't producing any blocks anymore because all of those blocks that the malicious miner is producing are all invalid. And so even though the miner thinks he's actually mining a chain, Nobody is considering that chain as being correct.

I, who was I talking to? I was talking to somebody that, oh, I was talking to somebody at Permissionless and they were saying that they did one of these play-to-earn games like Crabida or something with crabs. And I got crabs, it's called something, I don't know. And then they created a bot to run their crab game and I'm just like, Oh, is that what this is now? Like with crypto, I just need to make bots. And then, and then we're even talking about, I mean, you need arb bots. Like you actually need, with Uniswap, you, it relies on volume and it relies on like bots to, to actually make the thing work, the pricing work. And so I feel like a little left outta the game. Like, oh, I maybe I need to, and I know that there are these certain apps that you can make your own bots and things like that, but they're not, To this level. Is ETH2 going to be, I mean, it's gotta be bot heavy. There's not, no, I just feel left out with the bots. Okay, Torgan, but can you, let's talk about ETH2 and then also if you want to make me feel better about not being able to bot, 'cause, oh, this was my question though. So I want to talk about ETH2, but you, you were in day trading and then like now you're like security building that, that builder person, right? You're not, do you go ever go back with the bots and that sort of thing and try to do some arb stuff or? Or try to make money that way?

Yeah, so this like bot stuff generally is also referred to as MEV searching. So MEV stands for miner extractable value, and that is the value that miners can get from ordering blocks. So like deciding which transactions go into blocks in which orders. And so basically in MEV, you have these 2 roles. You have the miners, right? Which have the power to decide the orderings. And then you have the searchers, which are the people that write these bots. And if you write a bot and you find something that is profitable, then you go and pay the miners to include you into the block so that your transaction goes through. And ideally that your transaction even goes through as the first transaction in a block. Because otherwise maybe someone else has written a bot that does the same thing, but only one of you two can actually benefit from that, right? And it's just going to be the person that goes into the block first. So this whole MEV thing is a super competitive thing. And I have definitely thought about getting into that game just for fun. And also because it can be very lucrative if you actually do end up finding something that's maybe not too crowded, that not too many other people are doing. Yeah, it's, I think it's definitely super interesting. I think it's not something that like non-technical people or Uh, like it, it's not something for everyone. It's if you're willing to get super specialized and you're already a pretty decent programmer, uh, then I think it, it can be interesting.

So then there isn't, there, there's another version of this that's like e— it's not EVM, but there's another like, like a shady one where you're trying to front run transactions. As well, or is that the same thing? Is that MEV? The one that's—

Yeah, that's the same thing.

That's the same thing. Okay. Front-running transactions. Okay. Uh, one thing before we, uh, I have a couple more questions, especially from the chat. Uh, one of 'em is, what is the best MEV bot? I guess it's like the ones that you build yourself, right? There's not like you can go snipe somebody's bot.

Yeah. I mean, basically all, all the best MEV bots are hidden and you can't find them online.

Yeah.

Maybe you can find some really outdated ones and just use those as reference. But anyone trying to sell you an MEV bot is definitely scamming you.

And then, and then also people don't like MEV, right? Because they're, it's not, it's not very, it makes the price go up. Yeah. It's not a fun thing.

I think there's, there's a very good long conversation to be had about the pros and cons of MEV. I think, uh, there's There's definitely not a way to get rid of all MEV. MEV is inevitable. It exists. There are better and worse kinds. I think it's important that all of it gets extracted efficiently. And yeah, I think it's probably not something we have the time to go into right now, but it's not all as bad as it seems. And it is important for the stability of all the the protocols and the network that this MEV gets extracted, because if not, it just builds up and then some really bad things can happen. So for example, if there was too much MEV in one single block and not much in others, then it could even be worth it for miners to fork the chain in order to re-mine that block so that they get the MEV in that block. Instead of whoever initially mined it. And then that would basically like lead to reorgs in the chain. And that's bad for, for stability.

Great googly moogly. That's bad. And then one other question that I skipped over is when good oracle?

Yeah, I mean, I think there's not really a good answer. That was just mostly referring to that the Uniswap oracle is not perfect. Chainlink is not perfect. And those are basically like some of the best ones we have at the moment. I'm looking forward to maybe some better solutions coming along or ideally just protocols that don't need oracles at all, right? Like something like Uniswap works without an external oracle. You also asked about ETH2 before. So ETH2 is not going to change Really anything from a user perspective. ETH2 is going to be to a user exactly the same as ETH1. And the only thing that changes is that in the backend, proof of work gets replaced with proof of stake. And that's pretty much it. I think some people have very different expectations and might be Um, underwhelmed when the merge happens, kind of be like, oh, that's it. I thought this was going to like solve all the problems in the world. Um, but it really just does that one thing of replacing proof of work with—

But from the chat, are you going to build something, Torgan? What are you doing? What's your, what's your next get? What's your, what's your startup that you're going to do now that PoolTogether did the price savings account that you wanted to do? What's the next big project that you're thinking about that you're dreaming about? We won't tell anybody.

Now, for now, I'm just auditing other projects, right? Like at Chain Security, we have some ongoing contracts with some of the bigger DeFi protocols, like Maker, for example, has retainers where we continually audit their stuff. And then also there's just a bunch of other cool projects that come and want audits from us. So I think that that's actually a really great way of seeing a bunch of different audit, uh, a bunch of different projects. Because basically every 3 weeks or so, I just get to see a new codebase and, um, try and figure out what the problems with it are. And I think that's even more fun to me than actually building something myself.

And do you go through like a list, like a checklist of like, we got to make sure that all of these things are buttoned up first, because these are typical errors that you see in code? that have kind of like, you know, copy and pasted their way down the chain? Do you have that checklist and then you go for the more creative stuff like, oh, I've never seen this before, there might be something interesting there? What's your process when you audit?

Yeah, exactly. That's basically one part of it is we have a big checklist of stuff, but then most of it is actually just really going through the code line by line and making sure that you understand every single part of it and why everything is exactly the way that it is. And then trying to just come up with weird situations where, where something could go wrong. Yeah.

And you've been doing it for 2 months, 'cause my, I would be like, oh, well, have you audited something? And then somebody found something past that, but you, it's not a lot of time. 2 months is, well, I guess it is a lot of time in crypto, but—

Yeah, I'm, I'm definitely, I haven't done very much myself, but the, the company has done a lot. of audits and actually somewhat surprisingly, I think there has never been a major bug that slipped past them. So that's, that's actually really cool to have a kind of spotless track record like that. I think there's not a lot of audit firms that have that.

It's really great. So when you look at the landscape for 2020, as grim as it seems, as sad as we are, what do you see out in the landscape that you're excited about as far as projects, as far as NFTs, as far as tokens, as far as new tech, new innovation? What do you see out there, Torgan? Or maybe even things that you want to see that aren't there?

So I think the biggest things are layer 2s. I mean, the ones that are ready right now are Optimism and Arbitrum. Those are just going to like bring much cheaper transactions that still retain basically the same security as Ethereum itself. So I'm super excited for the ecosystem to keep growing on those. Of course, PoolTogether launching on Optimism soon, I have heard. And yeah, I think that just opens a lot more possibilities when the fees are rather cheap without having to make any big security trade-offs. And then a little bit further down the road, the zero-knowledge rollups such as zkSync and StarkNet are going to be coming as well. So those are like, they even have some more benefits over optimistic rollups. And I think that that's going to be super awesome. And a bit further down the road, I'm not sure what exactly the timeline is, maybe like a year or 2, we're going to have data sharding in Ethereum, which that should again boost the throughput of these rollups by maybe another 50 to 100x. And at that point, we're going to have like really massive throughput on those optimistic rollups with really low fees. So I think that will just enable way more stuff to be built than is now without needing to sacrifice security, which I think some of the other alternative L1s that claim to have cheap fees do.

When shard? When sharding? This year?

No, no, definitely not this year. I think the merge, the merge is happening first, which could be like around September, October. And then probably around 6 months after that, they're going to have the cleanup fork, which is going to allow unstaking of the staked ETH. And then the next thing they're going to work on after that is going to be the data sharding.

So when mass adoption, this is the common issue with everything right now. And when we're trying to grow scale, even with PoolTogether, it's when are the normies coming and do we want the normies to come? And what does that look like even with gaming? I mean, gaming is so basic right now, at least in my experience of just like, you know, in Lenster we were looking at, I'm looking at like the social protocols using Web3 stuff and it's just like, I gotta pay a transaction to like something. I gotta pay a transaction to post something. Yeah. When mass adoption, what do you think needs to happen to where my mom, With her pulled together Christmas card comes on.

I think like the solving thing, the scaling thing, I mean, is pretty much like, I'm very optimistic that that's gonna work out. And then I think it's really just a question of user experience, right? Like it's so hard right now to use these things for normies. I think really, Like we get mass adoption at the point where people don't even realize that they're using Ethereum when it's just another app on their phone that they installed. You know, maybe some of them will decide to do self-custody. Some of them will even not custody their own funds and instead have it connected to, I don't know, their Google account or something. And basically like at the point where you cannot tell that you're using the blockchain, that is when we get the mass adoption. And I think that is like a really big thing that needs a lot more investment to just like make all of the interfaces easy, hide all of the complexity, and then we can get going on a really big scale.

So we have Coinbase and Robinhood trying to do this whole Feeless thing where they, to my under— it's my, my understanding, they comp the fees that they, because they get to organize their own blocks or something, or they get to pump, pump everything together, it makes it cheaper for them. So they're just like, you know what, forget it. You don't have to pay gas for these things. And you actually don't need a wallet apparently with Coinbase. Like you can just use Coinbase, the app itself, and integrate with dApps. Your thoughts, your feelings. On that.

Yeah. I mean, that's basically the Robinhood model already, right? Like trading stocks on Robinhood is free, but they front run you on all of your orders, right? And that is where they make their money. So it's basically the traditional MEV and they're going to do the same thing here. I think it's probably fine, like depending on how hard people get screwed. I think, of course, like if people get screwed too hard, they're just going to stop using it, right? So there's a balance there. I think I'm generally optimistic in just like trying out new stuff. You know, maybe the user flow is actually going to be easier this way. I think it'll be important that this kind of thing doesn't become a monopoly and that it's not the only option, but that it's just a choice for people to use if they want to use it. And then I think it's probably something positive.

Boom asks for you to talk, Torgon, about alternatives to staking pools. That's the request from the chat.

Yeah. I mean, so basically the, the, the reason why that question is coming is because there's been recently this discussion About the APE token, which is the Bored Ape Yacht Club staking, because they introduced what they call staking, which is basically where you can just lock up your APE tokens in order to, in order to get more APE tokens over time. And that is really like not the initial Meaning of the word staking, right? Staking originated in the proof-of-stake protocols, like the Ethereum proof-of-stake, where you stake your tokens and you put them at risk. And if you do something bad, then the tokens can get taken away from you.

Right. In this case, it sounds like, like locking it up in a Ponzi. You just, you just keep it in the system. That's the way, that's the new staking.

Exactly. So basically in this like ApeCoin staking, there is really no reason to have staking except for like Ponzi-nomics, I guess. I'm, I'm always like careful to, to use the word Ponzi because some people take it as meaning like the worst thing in the world. Whereas in crypto, we use it pretty casually every now and then. But yeah, like in proof of stake, you stake because you provide security to the network. And in this case, you just stake for rewards and there's no real, not really a reason for that staking to exist. And then I was talking with Deboom earlier that the pool pool that we have in PoolTogether is kind of the same thing. Right there, you can put in your pool tokens and you can get more pool. And there's not really a reason for that to exist. Like it doesn't have real, yeah, it doesn't have a use. Like there's no reason why people need to stake. The main use case so far has been the snapshot voting, which allows people to vote without spending gas. If they're in the pool pool, which I think is definitely something useful. But of course it also comes with some drawbacks in terms of decentralization because it's not a fully decentralized voting system.

Gotcha. Okay. Well, Torgan, it's been, it's been, that's our time. So I want to be respectful of your time, but thank you so much for joining us and spending an hour with your friends, your pool friends, your poolers. So thank you so much. Anything else that we need to talk about that you, that we didn't hit? We had so much. I was so excited.

Yeah, no, I think, uh, we, we got some good stuff. I, I hope that I explained stuff, uh, in a way that is understandable, cuz some of these topics were like super, super technical, right? So if someone didn't understand all of it, that's totally fine. Like some of these concepts. take years to really understand. But that's exactly what makes them so interesting to me.

No, I mean, and you, when I tell people when they get into crypto, I say that you can either invest/trade, you can build, you can explore. And I think education is a huge piece that you just helped us with today. This is giga brain stuff on the podcast. So thank you so much, Torgen.

Yep. You're very welcome. You're welcome. And thanks for having me on.

Thanks for listening to the PoolTogether Community Podcast. You can visit pooltogether.com to deposit, and we'd love to hear what you thought about today's episode. So visit the PoolTogether Discord and let us know.