Corn (Yearn Finance) on the Evolution of DeFi Protocols (EP. 691)

We also touched on the state of cybersecurity for on-chain products, as well as what it's going to take to get non-crypto native institutions comfortable interacting with DeFi. Without further ado, here's my conversation with Corin from Urine Finance.

someone from URN was in a telegram chat with me and they knew that I did a lot of technical selling and the IT space was starting to slow down because especially in healthcare Every time someone deployed Epic for their medical record system, they had to go and buy a ton of hardware. Upgrading to Epic was definitely their biggest capital expense like a hospital ever goes through.

Epic made the transition to be a web app. The customers don't need to buy storage area networks. They don't need to buy all new. Cisco switching and stuff like that. So I saw that space starting to slow down and getting involved with URN back then, we had over six billion dollars of deposits. We were

in the top five for our DeFi projects and we had a hundred and twenty five contributors, I think, back then. It was a big project and there was no way that I was gonna say no to that opportunity. So I took it and I'm still doing for urine today. I'm responsible for all of the customer experiences that we have. We have a B2B approach still. We want to get people to build on top of Urn Vaults and consume the tokenized strategies that we have. And if people are not getting answers really fast,

They feel unsupported, they'll go to one of the other nine million Vault projects out there. So my responsibility is to make sure that they're happy, make sure they're coming in the door. We get a lot of inbound requests for strategies to be made still because they know that if they get a year in strategy made

Someone from the urine security team is gonna have to do due diligence on it. They're gonna have to do at least something of like a light audit on the code base and make sure that it's safe. it's my job to also qualify those opportunities because there are a lot of them and I can't bring every single one of them to the curation or like security team to vet. I have to make sure that they've gone through my filter before I pass it on to them.

Those come in all the time for like strategies, for collaterals, for our curation arm. It's always been busy ever since I joined four years ago. Even if we're not churning out all these strategies, we're definitely evaluating them.

to my knowledge, was around even before then. What's kind of like the history of DeFi protocols and how they've evolved through 2021 and all the craziness and then maybe all the way up to today in in your experience?

was like a former urine contributor. It was so perfect. And we had fifty other people who had made strategies and every single one of them was very low quality. And and The truth is today, like if you build something on urn and we think it's really good, we will seriously consider hiring you. but we had to be more selective about who we're onboarding as time went on. The bar kept getting higher and higher and that's a really good thing. We started out that way back then and when I

first joined, we had all this money, we were making a hundred million dollars in profits in twenty twenty one, I think it was. And then the first thing that happened was UST, the yields were 20%. everyone was like, You gotta make a strategy for US T or you're gonna lose deposits and guess what? We started losing a ton of deposits and we refused to make a strategy for it because it was not a

structurally sound project. We knew that something was going to happen. We knew that it was like a bit of a pond.

There was a pending bear market. It was definitely on the way. We saw that DeFi yields started to go down. The way that we get most of our yields is from supplying to lending markets. And when people are not borrowing, the yields are going to go down. What happened was we started to lose even more TVL for people going and wanting to get that risk free rate. And it's understandable, a hundred percent.

Urn, however, was not going to bend in our culture, in our values, and we were not going to start onboarding risky RWA yields and we need to have everything on chain and that's how it is for us. We need everything to be like verifiable. This was also a significant headwind coming into twenty twenty two for us.

curates these strategies that involve other DeFi protocols, maybe infrastructure that Urine's built, maybe infrastructure that Ave or Morpho or other lending protocols have built, and kind of in a risk managed way derive a Structured product on chain, maybe you could say, that gives the end user a yield for their stablecoin that they started with. Is that the right way to think about it?

DeFi vaults within them. Then we can start to talk about the events of about a month ago, October tenth, there was this mass liquidation event across crypto and in the past week or two, some bodies have started to float to shore within DeFi on the higher risk end of the spectrum when it comes to vault management and tokenization.

I think it was a talent drain. As I was trying to get people to build on top of Urn Vaults, I was getting the feedback that what you built, the Urn Vaults V3, is clunky, hard to use, difficult to understand. But truth be told, it is because everything that we were doing is programmatic and on-chain, and you have to be a pretty good developer to bring something to market that's not going to get hacked.

Some folks decided to make an easy button for vaults. And that easy button is turning your vault into a multi-sig. And basically, you have this.

product where all of this capital flows into and you have a bunch of different people who can decide to build transactions, to send your money wherever they want, whenever they want. This is banking but worse, basically. That's our perspective on it because This gives people the opportunity to still be anonymous, but to also have full control over your funds and for you.

to have no visibility into the decisions that are going on or or even where your funds are going to be going to if they're going to deposit those into a black box, like a centralized exchange or something like that. There's a lot of structural issues with those multi sigfi projects. Even more so, they were able to align stakeholders better than we were. Originally when Urn took off, everybody knows about Wi-Fi token. That's Andre's baby. What that meant was people could farm wifey tokens.

I was working on this project. Now it's called Catana Chain, Polygon brought to market along with us. Last year in 2024, I was going around and talking to a lot of like VCs and liquid funds about coming on board Katana with us. And it was like a really good experience for me to jog my memory and just see how many people were involved in urn. Way back then, these VCs, like a lot of them still say, we got into crypto.

because of URIn. Urn was one of the projects that we invested our time and focus in way back then. That meant that they had wifey token. They had stake in our success. And when the bear market came, token prices went down, they dumped their bags and Yarn does not have a token print. We have a finite amount of tokens.

Those are the incentives that these new multi-sig projects started to bring to the table and started doing raises, and now you have these liquid funds and VCs more aligned with the success of those products. compared to using urn. This is headwind number three that started to hit us, and we're still experiencing that right now.

It's hard to think about this problem because is someone gonna come to market with a new competitor every single time and reload the incentives? The mercenary money's just gonna float into that new project. Is this gonna be the cycle forever?

from this token that they're a newer protocol, so they have a newer token and they're giving it out to people as sort of incentives. That's not, you know, necessarily a web three native idea. Every time I open my Lyft app, there's some new reason why they're gonna pay me five dollars to use Lyft instead of go to Uber, but it's just more invasive, it feels like, within crypto.

That's sort of what is happening here and you have these things that are somewhere between what you say sort of opaque banking opportunities and unregulated hedge funds really, where people were depositing their stable coins into sort of a black box for a group of

three people that were claiming to be a DeFi protocol to just go and loop into risky strategies. And the way those strategies would be represented on the market is in a token. So let's use one of these tokens that has recently blown up in the last couple of weeks, X USD. And one of the problems with a lot of these is that the value of them gets pegged to a dollar and this sort of rebase the yield on top of it. So

If it's a twenty percent APY strategy, it'll start at a dollar and the value of that token will grow as the yield accrues to it. Even if these protocols aren't calling their product a stable coin, so to speak, just by including the letters USD in the name or pegging it to a dollar. I I think sometimes it gives users probably a false sense of security that what they're putting their money into is

not volatile or not risky and really under the hood there are risky things happening. What we saw with XUSD, I guess you'll have better info on this than me, is that the value of the token completely collapsed once people realize that the curators or the managers of this protocol had lost a lot of the money. So what kind of happened there?

We saw that it did not match up. We asked them why and they said at the time that they were depositing into hyperliquid some sort of carry trade strategy. at that point we would definitely not touch it. It is a black box and we said to them, This is super risky. You can't just have people

trusting that there's backing to this when you cannot prove it at all. They ended up copying and pasting those private messages and posting them in their Discord and dunking on me over and over back in May. I did not appreciate that.

To us, there was no way that everyone from stream finance got out of those strategies without taking losses. And we knew that there was a hole there. There just had to be. Schlag started digging more into the on-chain data, found all of this daisy chain of looping, recursive lending, and curators offering up liquidity from user deposits in order to like fuel all of this.

we found that even though they had grown from like 160 million dollars of deposits into five hundred million, that there were really no net new deposits coming in. This was just a scheme going on on the back end. And when we asked them about it, there was no proof of anything. Like nothing that they were doing was verifiable and it's just a huge red flag.

Truth be told, if this all did not happen on ten ten, if this ball didn't get started rolling, they would still be looping more right now. They would still be accepting user deposits right now. knowing that they had a hole. they had to have known on the back end and it would have just kept on getting bigger and bigger and bigger. I'm glad that things shook out the way they did. It was not an easy few weeks to deal with all of this stuff, but here we are.

We've talked about curators a little bit here. Maybe if you could unpack that term, what's the role of a risk curator in DeFi? You have the people depositing. On one side, you have the DeFi protocols on the other side where the actual lending and borrowing happens. And then in the middle, there's these actors that are putting together these vaults. They also live directly on some of these protocols like Euler and Morpho and set the parameters of you want to borrow against this asset.

we deem this ASCII to be risk averse enough that you can borrow at a ninety five percent LTV instead of an eighty five percent LTV. And so what's the role and maybe the fault of the risk curators in some of these scenarios?

a terribly good business. And right now, for a lot of the stuff that we do, we even have fees turned off because it just doesn't matter. We want to have competitive rates and the profits that we bring in the door are just really small. It's our job as a curator to make sure that we're using sound collateral that matches the risk that people assume is going on in that vault. We also need to make sure that we have good automation, that things are being replenished when they need to. If there's

borrowers who have a big appetite, we need to make sure that there's liquidity in that vault for them to borrow. We need to understand the interest rate curves. We need to make sure that we're being reactive to like everything in the market. So there is a lot of work that has to be done. We also have to meet the needs of demand for people offering up new collaterals or wanting to borrow in the first place. We need to make sure that there's enough deposits.

What urine is doing right now is we have this parent level vault, and this goes into deposits into all of these different lending markets. So even as a curator, we can pull money from like YV USDC and throw it into something that we're curating on Morpho if it needs liquidity. we have a like a multi tiered business where not every curator has that open to them right now. We want to discourage degenerate recursive looping. We want to make sure that

Everything that we're doing is really safe. To us, reputation is everything and we're completely blind to accepting short-term incentives. We don't do any side deals or anything like that. Whenever people ask us to like build products that just farm points, we usually say no because we know that the amount of work that goes into building and supporting strategies is probably not going to be worth the effort.

in fees or deposits. So there's a lot of stuff that we say no to. And I think it just makes our ability to like make it through tough economic conditions that much more strong. Survival's everything. It's pretty clear to us now that Some curators are going to take big risks and they're going to damage their reputation and we'll be here to survive and to be strong and safe and get those deposits when people eventually come back into DeFi. Because they will.

similar to Uniswap was just hacked for over a hundred million dollars. GMX earlier this year, a decentralized perpetuals protocol similar to hyperliquid. Both have been around since twenty twenty, probably be before, I think. was also hacked for a significant amount. I think those two especially caught people off guard of

No one's safe. There's this idea in cryptoness of lindiness where, okay, something that's been around for four, five, six years, I feel safe putting my money in this protocol and Balancer and GMX. broke that model a little bit. A lot of these protocols, they tout their audits that they've done, they tout the security partners that they're working with. Our code is safe, but are those tools enough? What else needs to exist to stop another balancer from happening?

So one of the things I did with URN also is I started an audit company. It's called Electisec right now, formerly Y Audit and Y Academy. We're actually changing the name back to Y Audit pretty soon, but From this experience, I can say that code quality has definitely gone up. No question. The amount of safety that teams are taking into account right now is

Not slowing down. I think we've done seventeen engagements with Euler. They're not taking their foot off the gas for security. They're always gonna be auditing their code bases. This is a time in the market thing for code that is immutable, where you don't really know where the dangers could be. People need to just build their code as simply as possible, leave out tons of complexity where they can, and that's going to help reduce the amount of vulnerabilities. But also

Security is a journey. Just because you launch your code base does not mean that there are no vulnerabilities in it. Just because you've been in the market for a year doesn't mean that there's anything wrong with it. Do contests. have big, meaningful bug bounties. Urn has paid out bug bounties before for stuff that people have caught. It's worked out well. Participating in bug bounties works. So do it. I think the combination of all these things and like a layered security approach.

along with time in the market will get us the safety that we need for glow risk DeFi, but It's gonna take constant improvement for a long time.

But given this risk of unregulated black box hedge funds out there acting as tokens, given this risk of a hack to the protocol, is that Increase from the risk-free government treasury rate enough to make DeFi interesting to people outside of crypto.

that some of the people who I met with are new to crypto. They're representing their companies push for DeFi products. They don't understand the difference between multi-sig five and programmatic vault. It's something that I've had to explain to them. I'm totally happy to do it. I want to do it more, but I need to convince them that there is a big difference. And just because you can

manipulate your vault share price, that is not a good thing in many cases. Having full control over that also brings in additional risk into the equation. It's really good that talent and attention is coming into crypto from that side of the fence. I don't think that's going to stop, but they're very hesitant to use true, verifiable DeFi for sure.

rebuild Wi-Fi as a still locking it to get a distribution of profits, but doing like a more short-term lock. So that's what we're going to be doing right now. I think it's like a one-month lock period and then you get a share of all the profits that we are going to be distributing. This is the time that URN has to go and turn the fee switch on too. So we're more focused on generating profits than we once were.

which of these things are securities and which of them aren't. But you still have to give people reasons to hold these tokens for the long term, rather than to just think of them as points or air miles that you can receive and spend right away.

We worked for a long time on the Katana L2. Polygon was not the only group who was evaluating using yarn vaults as pre-deposit vaults. they uh were the only group to pick yarn as their pre deposit fault though. And the reason why is because David Silverman and Mark Boyron over at Polygon fully understood the risk of

using a multi-sig where price per share could be manipulated. And they wanted to do stuff that was fully on-chain. And I love them for that. And we ended up doubling our TVL this year because of that. Urn vaults are deeply embedded into Katana Chain and it's just been a real pleasure to work with people in DeFi who really align with our own values of safety and being verifiable.

Here's a good example. If you're in just a staked ETH position or like an LRT and you're earning yield that slightly outperforms our own WET1 vault. First of all, as the price of ETH goes up, the withdrawal queue is not gonna go down. It's only gonna get longer. If you're also faced to exit your position at a time when those pools are unbalanced, you could wipe out six months or a year of your yield instantly.

And if you're using a urine vault, it's always liquid all the time and it's a cash equivalent product. So even though your yield will be slightly less, you will get to keep it. People don't seem to really understand that yet. But part of my discovery in New York last week, talking to some of these traditional finance firms and hedge funds, is that there is an audience for a cash equivalent yield-bearing product.

It is the director of a treasury. They could be the director of treasury of like a hospital or a university, a pension, but they need to earn yield on their deposit. but also have them be liquid all the time. They might have their CFO ask them, You need to liquidate this because we need to go and make a payment for something or buy a building.

If they can exit that position that they were earning yield on without losing that yield or without taking on additional risk and being able to do it whenever they want, if your time in the vault is unpredictable, you're involved to the product that you should be using. You should be using something that is cash equivalent. I got my hands on this huge database of all these treasury managers and I'm gonna give it a shot of going down and seeing who has an appetite

to at least learn about what verifiable DeFi is and what we're bringing to the table. I'm not expecting to get a huge amount of yeses, but even getting a few and making those connections is where we need to start.

decentralized. It's kind of decentralized and name only, especially when you we talk about these multi sig fi products, these on chain, off chain hedge funds, where it's just a couple of guys YOLOing your positions into high risk yield. Where do you think We are today on this spectrum of centralization to decentralization within DeFi and crypto and are we headed in the right direction, especially as more TradFi people come on chains, more payments move to stable coins.

A lot of people, DeFi purists, even will stick their noses up at stable coin sometimes as USDC may be on Ethereum on a decentralized blockchain, but you're still trusting circle, the company. to mint you the USDC and buy and custody the treasury asset that's underlying it and redeem it when you ask for it. There's still a level of trust involved there. So where are we on that spectrum? Are we headed in the right direction in your opinion?

there's always going to be people who will prefer USDC because it is backed by the government of somewhere Or the like the bank is backed by the government. I think that that product will always be out there for a good reason too. At least for Ethereum's vision, low risk DeFi is a great North Star and that does not involve these centralized entities in that equation at all. It just establishes a base rate of yield. Even these centralized parties will sometimes fall back on that.

For instance, I think at the peak T VL of Athena, only thirty percent of their funds were in the carry trade strategy going on between all these centralized exchanges. The rest of it went into Ave to get the Ave yield, which is exactly what we do. You need a base rate of yield and if it's there and it's robust can like take giant deposits, then people are definitely gonna use it.