DeFi
Two booming DeFi protocols have released similar code. Was it copied? – DL News
- Riding the hype surrounding EigenLayer, fluid restoration protocols are growing at a rapid pace.
- The code released by two liquid restoration protocols, Renzo and Kelp DAO, appears similar.
- One of the protocols told DL News that its code had been copied.
Nearly identical lines of code released by two protocols that sit atop Ethereum’s sparkling liquid catering business have raised questions about their authorship amid a long-running debate over open source development culture of cryptography.
A DL News Analysis and interviews with developers not involved in the situation revealed identical “comments” nestled in the code of both protocols – a sort of note left by the developers – which suggest that one team copied it from the ‘other.
The code, published by competitors Renzo and Kelp DAO, enables what is called native restoration.
This feature allows users to bypass deposit caps that limit access to EigenLayer, the multi-billion dollar protocol that pioneered reinvestment on Ethereum.
It’s a heady time for the liquid restocking industry, and the protocols that leverage EigenLayer are ride the hype. Several have debuted in recent weeks, and older protocols, like Renzo, Ether.Fi and Kelp DAO, are growing rapidly.
Renzo has offered native recovery since December, while Kelp DAO teased its own native restore feature last week.
Not yet open source
“Kelp DAO’s native recovery solution is not active and the final code repositories are not yet open source,” a Kelp DAO spokesperson said in an emailed statement.
“Multiple intermediate versions of the code are used for testing/R&D before mainnet launch. Developers should use the final codebase deployed to mainnet as a reference.
Join the community to receive our latest stories and updates
Kelp did not respond to a request for additional comment on the similarities.
Meanwhile, James Poole, Renzo’s chief technology officer, said DL News that the Renzo code was protected by a license which prohibits competitors from using it “in production”.
“There is no doubt that sections of Renzo’s code were copied into the Stader/Kelp DAO source code,” Poole said.
“If there are any questions about where our code base comes from, we would be happy to share our full GitHub repository with a third party for review.”
Comments and timestamps
The suspicious code was posted to GitHub, an online platform that allows software developers to create, store and share their work.
Timestamps on GitHub show that some of the native Kelp DAO rollback code was added in January, several weeks after Renzo released similar code.
But developers can backdate their additions. Additionally, Renzo’s code was, somewhat unusually, added in a few massive chunks, while Kelp DAO’s is showing steady “organic” growth, according to developers who spoke to DL News.
That’s because Renzo developed his software in a private repository, Poole explained.
“Many projects in the field follow the same model for reasons of competitiveness and optics,” he said. “Developing code can be a complicated process. »
Given the limits of publicly available data and the ease with which some GitHub data can be falsified, it’s difficult to prove who copied who, said Molly White, a software engineer and affiliate at Harvard’s Berkman Klein Center for Internet & Society . DL News.
But one Audit of Renzo code released in December by crypto security firm Halborn suggests that Renzo did not backdate his additions, White said.
“The Halborn audit and the verifiable timeline of it makes me lean much more strongly toward taking kelp from Renzo rather than the other way around,” she said.
Kelp did not respond to a request for comment regarding White’s conclusion.
Like Uniswap v4, Renzo’s code is covered by a Business Source license, which protects the code in question from third-party use and profit for a certain period of time.
But that shouldn’t prohibit its use for testing, according to Moish Peltz, an intellectual property attorney at the New York law firm Falcon Rappaport & Berkman.
“My interpretation of BSL is that it allows for non-production use,” he said. DL News. “But the details will depend on the actual code involved.”
The code for Kelp DAO’s native staking functionality is protected by the more permissive GNU General Public License, or GPL, which allows commercial use by competitors provided their copy also uses the GPL or a similar license.
The open source debate
It’s the latest example of a problem plaguing an industry that touts open source development: To what extent should projects borrow or use someone else’s code, or tolerate a direct competitor doing so?
“If you’re just looking to pull the rug out or make a quick buck, it’s likely to cause an argument. And you’re an asshole.
Copying or borrowing another project’s code is generally encouraged in crypto, according to Matias Nisenson, CEO of DeFi Wonderland, a developer collective.
“It’s all about the value you bring to the ecosystem and the original developers,” he said. “If you’re just looking to pull the rug or to make some quick money, it will probably cause an argument. And you’re an asshole.
But developers who copy others’ code in good faith, believing they can improve on the work of the original developers, are often praised, provided they comply with licenses that govern how the code can be used, he said. for follow-up.
There are myriad examples in action: Reflexer, the team behind the experimental RAI project and HAI stablecoins, encourages forks. Spark protocol copied code from Aave lending protocol and now send Save part of your income.
“It’s always welcome to check with the developers first and see what they think of your ideas,” Nisenson said.
“The opposite scenario could also be true: someone wants to add value to an ecosystem and the original developers aren’t open to their ideas, so you develop them and build your vision. It’s fair game.
Still, crypto’s borrow-at-will philosophy sometimes causes friction. The problem flared up several times last year.
Open source advocates have criticized DeFi titan Uniswap for announcing a new iteration of its decentralized exchange under a Business Source license, effectively suspending its commercial use by competitors for four years.
Executives at crypto lending protocol Maple Finance complained that Circle was using their code without attribution. Circle says DL News at the time, he had not copied Maple’s code.
And Stader Labs, the parent company behind Kelp DAO, defended himself against accusations its liquid staking protocol was a “fork” or copy of competitor Rocket Pool.
Stader said the code in question was only a fraction of a much larger product built by Stader.
“Incorporating open source elements is a very common practice in software development, and even more so in the open source blockchain ecosystem,” Stader wrote in a blog post.
Aleks Gilbert is DL News’ DeFi correspondent in New York. Do you have any advice? Contact him at aleks@dlnews.com.