🏠 Home

Attack Modeling & Simulations

I wanted to know what it actually costs to break a small stablecoin. Can a $372K stablecoin be profitably attacked with just $100K in capital? We modeled economically viable attacks on three interconnected DeFi protocols.

Critical Finding: We discovered a profitable attack that existing security measures fail to prevent. Defense cost: $5K-10K. Attack profit: $8K-31K.

Something I came to believe: vulnerabilities don't get exploited because they're possible, they get exploited when they're worth it. Once economics change, attacks emerge.

← Back to DeFi Research
Marcelo Silva · Stealing Crypto infrastructure without harming funds

Why Optimism?

Mature ecosystem with recent precedent: Sonne Finance $20M exploit (May 2024), SVB crisis (March 2023). This provides real-world validation for our attack models.

The Three Protocols

Mento Protocol

Celo | $372K cReal market cap

Type: Hybrid stablecoin

Attack surface:

  • Oracle manipulation
  • Reserve depletion
  • Small market vulnerability

Sonne Finance

Optimism | Proven exploit history

Characteristics: No audits, 2/3 multisig

Attack surface:

  • Known vulnerabilities
  • Governance capture
  • Historical precedent

Velodrome Finance

Optimism | $128M TVL

Type: Critical infrastructure

Attack surface:

  • Liquidity nexus
  • Cascade risk
  • Ecosystem dependency
The Fragile Web

All three protocols share: USDC/DAI foundation, Chainlink oracles, Velodrome liquidity. Cascade risk: Sonne exploit → Velodrome panic → Mento depeg → System-wide instability.

Key Finding: Efficiency creates fragility through correlated failure modes.

Adversary Profiles

We modeled realistic adversaries with actual capabilities, not theoretical "all-powerful" attackers. Each profile reflects real-world constraints and incentives.

Nation-State (DPRK)

Budget: $500K-5M | Capabilities: DeFi expertise, flash loans, MEV infrastructure, sophisticated tooling | Motivation: Sanctions evasion, state funding

Circuit Breaker Vulnerability

Mento's circuit breakers have a blind spot:

This enabled three attack scenarios, ranging from immediately profitable to catastrophic.

Adversary Profile: PCC (Primeiro Comando da Capital)

The Party represents something DeFi protocols have never modeled: a $27B annual revenue organization with zero extraction pressure and complete offramp infrastructure already embedded in legitimate Brazilian capitalism. This is not a hacker group. Not a cartel in the traditional sense. PCC operates as a parallel state with corporate governance, diversified revenue, and financial infrastructure that rivals mid-size banks.

Every DeFi threat model assumes adversaries need to exit. PCC doesn't. They already control the exit.

Revenue & Operations

Annual Revenue: ~$27B USD — Federal Revenue estimate via Small Wars Journal

Structure: 40,000 lifetime members + 60,000 contractors. Not a gang. A workforce. Independent squads run day-to-day operations. The Party provides governance, dispute resolution, and financial infrastructure.

Revenue Breakdown

Drug trafficking: $2.8B/year

Fuel sector: $11.3B/year through 1,000+ gas stations

Tax evasion: $1.4–1.6B/year (2020–2024)

Controlled assets: $5.7B portfolio

Infrastructure Advantage

PCC's financial layer is the threat. Between 2020 and 2024, $10B moved through fuel distribution alone. Not criminal infrastructure—registered businesses generating legal revenue.

Financial Infrastructure

Investment funds: 40+ funds managing $5.7B

BK Bank: $9B moved (2020–2024)

4TBank: allegedly $1.5B laundered through fintech

Business penetration runs deep. Organized crime has infiltrated Brazil's financial sector through legitimate investment vehicles, registered companies, and compliant banking relationships. The line between PCC capital and Faria Lima capital is deliberately blurred.

Geographic Reach

Present in all 26 Brazilian states and 16+ countries. PCC controls an estimated 50%+ of cocaine flowing from Brazil to Europe, with 1,000+ associates operating in Lisbon alone.

The European network runs through a partnership with 'Ndrangheta, giving PCC access to Southern European financial systems. Portugal has become a key hub for cocaine entering Europe—and for capital flowing back.

This is a transnational financial network with documented risk profiles that most DeFi compliance frameworks have never encountered.

Critical Vulnerability Discovery: Liquidity Control Attack

Why Traditional Models Fail

DeFi security models threat actors as external agents who exploit, extract, convert, and offramp. Compliance teams watch for offramp activity. Chain analysis flags extraction patterns. Circuit breakers trigger on rapid withdrawals.

PCC breaks every assumption in that model. They don't need to extract. They don't need to convert. They already own the offramp.

Traditional Threat Actor

Step 1: Exploit protocol vulnerability

Step 2: Extract funds to controlled wallet

Step 3: Convert through mixers/bridges

Step 4: Offramp to fiat

Gets caught at steps 3–4.

PCC Threat Model

Step 1: Accumulate liquidity position

Step 2: Control pool dynamics

Step 3: Transact through owned infrastructure

No extraction. No offramp bottleneck. No flag.

Strategic Distinction: Squads vs. The Party

Independent PCC squads run street-level operations—drug sales, extortion, local territory. These operators look like conventional organized crime and behave like it. Chain analysis can flag them. Compliance tools can catch them.

The Party is different. The Party manages 40+ investment funds, runs 1,000+ gas stations, and moves capital through banking infrastructure that processes billions annually. The Party doesn't need to hack anything. It needs liquidity pools to exist.

The Liquidity Domination Model

Objective: Control enough liquidity in a pool to dictate pricing, slippage, and exit conditions for every other participant.

Method: Deposit capital from legitimate business revenue into DeFi liquidity pools. No exploit required. No suspicious transactions. Revenue from fuel distribution ($11.3B/year) enters the financial system through registered businesses, then flows into DeFi as "institutional liquidity."

Economics: For a protocol with <$50M TVL, controlling 30–40% of liquidity requires $15–20M. PCC's $5.7B asset portfolio makes this a rounding error. The cost of dominating a small protocol's liquidity is less than what BK Bank moves in a single week.

The Security Boundary Illusion

DeFi protocols draw a security boundary around their smart contracts. Audits check code. Monitoring watches transactions. Governance guards parameters.

PCC's Faria Lima infrastructure sits outside that boundary but controls what happens inside it. When organized crime has infiltrated the financial sector, the offramp isn't a suspicious exchange withdrawal—it's a quarterly dividend from a registered investment fund.

Protocol compliance tools scan for sanctioned addresses and flagged wallets. They don't scan for capital originating from a gas station network that evaded $1.4–1.6B in taxes over four years while operating as a legal business.

Protocol Binding

Once PCC controls dominant liquidity in a pool, every other participant is bound to PCC's position. Traders pay PCC fees. LPs compete against PCC capital. Protocols depend on PCC liquidity for their TVL metrics. Governance tokens accumulated through LP rewards shift voting power.

The protocol doesn't get hacked. It gets captured. And the capture looks identical to organic growth.

Economic Analysis: Protocols Under $50M

Attack Economics

Capital required to control 40% liquidity in a $30M TVL protocol: ~$12M

PCC annual legitimate revenue available for deployment: $27B

Ratio: 0.04% of annual revenue

Detection probability: Near zero (capital enters as legitimate business deposits)

Extraction required: None (revenue earned through LP fees, governance capture, and business-layer transactions)

Defense Implications

Protocols cannot defend against this with smart contract audits, transaction monitoring, or circuit breakers. The attack vector is economic, not technical. Defense requires:

The attack surface isn't the protocol. It's the assumption that controlling liquidity requires extraction. PCC accumulates until everyone else does business with them. The greatest money laundering vulnerability in DeFi isn't technical—it's that protocols assume adversaries need to exit.

Scenario 1: "Slow Bleed" Attack (Work at small scale)

Attack Parameters

Target: Mento cReal ($372K market cap)

Method: 50-100 wallets, micro-redemptions over 2-4 weeks

Why it works: Stays below circuit breaker velocity thresholds, evades vAMM slippage through distribution

Economic Analysis — Five Simulations

Simulation Market % Buy Price Profit ROI Success Rate
Micro 10% $0.16 $2.8K 8.3% 60-70% ✓ WORKS NOW
Lean 20% $0.155 $8K 12.1% 50-60%
Deep Depeg 25% $0.14 $11K 14.1% 40-50%
No Offramp 25% $0.155 $10K 15.4% 55-65%
Patient 30% $0.15 $31K 40.4% 60-70%

Profitability Zones

Profitable: Buy at <$0.155

Highly Profitable: Buy at <$0.145

Critical Insight

Attack scales with market cap. At $3M (8x growth), profit becomes $248K—justifying sophisticated attacks from nation-states and organized crime.

The currency (cReal) is paradoxically protected by being "too small to care about" — but this protection disappears as adoption grows.

Scenario 2: "Flash Crisis" (Failed attempt)

Attack Parameters

Target: Mento cUSD ($16.9M market cap)

Method: Oracle manipulation + flash loans + single-block redemption

Why it DOESN'T work: Circuit breakers specifically designed to prevent this

Defenses That Win

Economic Analysis

Theoretical profit: $120K-200K
Actual probability: 0-5%
Expected value: Strongly negative

Strategic Recommendation: NOT VIABLE

Exclude from realistic attack portfolio. Circuit breakers are effective against flash attacks.

Scenario 3: "Systemic Cascade" Attack

Attack Parameters

Target: cReal

Method: Amplify Brazilian - USA crisis into contagion

Why it works: Organic crisis + coordinated attack + shared dependencies = unstoppable momentum

Six-Phase Cascade (Theory)

Economic Analysis

Profit potential: $5M-20M (short positions + direct arbitrage)
Success probability: 70-80% IF catalyst occurs
Historical precedent: SVB crisis (March 2023), Sonne exploit (May 2024)

Strategic Recommendation: Maximum Threat

Most profitable scenario for patient, well-capitalized adversaries. Requires external catalyst but offers extraordinary returns. Cannot be prevented by protocol-level defenses alone—requires ecosystem coordination and stress testing.

Strategic Assessment

Attack Hierarchy

🔴 Immediate Threat: Scenario 1 "Micro" — works NOW, $2.8K profit, 60-70% success

💰 High-Profit Threat: Scenario 1 "Patient" — wait for $0.15, $25-35K profit

💥 Maximum Threat: Scenario 3 "Cascade" — $5M-20M potential, catalyst-dependent

✓ Non-Viable: Scenario 2 "Flash Crisis" — circuit breakers prevent, <5% success

Why "Too Small" for Sophisticated Actors

Absolute returns ($8K-31K) are insufficient for nation-states or large teams with operational overhead. However, these attacks are viable for:

  • Individual security researchers
  • Small opportunistic teams
  • Phase 1 of larger, multi-stage attacks

Critical threshold: Once cReal reaches $1-2M market cap, attacks become viable for sophisticated adversaries with professional infrastructure.

Defense Recommendations

What's Working

Critical Vulnerabilities

1. Zero Trading Limits in the currency smartcontract → Unlimited drain possible

2. External Price Blind Spot → Circuit breakers don't watch DEX prices

3. Low Liquidity → $28K TVL for $372K market (easy to manipulate)

Immediate Actions (High Priority)

Priority 1: Trading Limits | Cost: $5K-10K

RENDERS ALL ATTACKS UNPROFITABLE

  • L0: $50K per 6 hours
  • L1: $150K per 24 hours
  • LG: $300K global weekly cap

Priority 2: External Price Monitoring | Cost: $10K-15K

  • Monitor Velodrome, Uniswap, CEX prices
  • Pause if external price <90% of oracle for >1 hour
  • Detects attacks in accumulation phase

Priority 3: Pattern Detection | Cost: $15K-20K

  • Wallet clustering analysis
  • Timing anomaly detection
  • Volume spike alerts

Medium-Term (6-12 months)

Long-Term (12+ months)

Key Insights

1. Economic Viability ≠ Technical Feasibility

Defense should prioritize making attacks unprofitable, not impossible. Scenario 2 is technically possible but economically non-viable — this is good defense design.

2. Slow Attacks Evade Fast Defenses

Circuit breakers detect rapid changes. Sophisticated attacks are slow (weeks-long, distributed, multi-phase), staying below velocity thresholds. Defense must account for patient adversaries.

3. Small Markets Are Deceptively Vulnerable

Lower defense budgets + easier manipulation. Attack costs scale DOWN with market cap, while defense costs scale UP. Critical lesson: Implement defenses BEFORE growth.

4. Defense ROI is Asymmetric

$5K-10K investment (trading limits) prevents $8K-31K+ in attack profit. Small defensive investments have massive returns. The best security spending has extraordinary ROI.

Responsible Disclosure

No attacks were executed. All analysis is theoretical/simulated. This research was conducted to improve protocol security, not to exploit vulnerabilities.

Full Research Document

For complete attack simulations, detailed economic models, and technical vulnerability analysis, reach out to @MarceloReFi on X or connect on LinkedIn.