White collar prosecution is expensive and complex, and prosecutors care about their careers. They want certain wins, preferably fast.
So the SEC are waiting for slam dunk cases to establish precedent.
In practice this means they wait for something large and obvious to implode, and prosecute months/years after the fact.
is: (1) an investment of money, (2) in a common enterprise, (3) with the expectation of profit and (4) to be derived from the efforts of others.
They're beholden to the established financial system and players and "regulating" crypto would also mean giving crypto a stamp of approval, which they seemingly do not want to do.
But this might never happen. I can launch a lending protocol completely anonymously, pump it on Twitter/Telegram, and get 7+ figures TVL overnight. It might not even be predatory (even though a lot are), but who would the SEC even go after at that point?
If it's so easy with such high rewards, why don't you try an MVP the next weekend and see how it goes?
I could also get rich knocking people in the head with bats and taking their wallets. For a little while.
It's telling some people who let their true colors show, espousing ideas like "hey if I can make good money hurting others I'll do it, and why haven't you!"
Crime is not hard, most houses are easily broken into, many people can be tricked, the human body is fragile, and society runs on a shockingly large amount of trust. Do not conflate the fact that most don't engage in the worst of crimes with the actual difficulty in doing it.
[1] https://coinscreed.com/defi-top-10-list-of-crypto-rug-pulls....
1. OneCoin: Not even a cryptocurrency, a centralized currency. https://en.wikipedia.org/wiki/OneCoin
2. Thodex: A centralized cryptocurrency exchange. https://en.wikipedia.org/wiki/Thodex
Actual DeFi cannot be rug-pulled, by design. Not even the US can taken down something like Tornado Cash. What a smart contract can or cannot do is written in open source code. How are you going to rug-pull it, if it's not coded there?
1) Create code with subtle but privately known "bug" that allows profitable behavior far outside the bounds of what you advertise to the public as your code doing.
2) Wait for liquidity pools within the contract to build up.
3) Exploit the "bug"
Yes according to "Code-is-law" you're not doing anything "unlaw(code)ful." But it's a rug pull in everything but name. De-fi is basically never introduced as "there's contract 0x343cdc.... on the blockchain, go read the EVM code as nothing will be explained" so intent in the way something is introduced is instrumental here.
But IMHO this is still a better approach. Serious contracts go through multiple audits, deploye hefty bug bounties and if you are very risk averse you can avoid a new deployed contract for certain amount of time until it's not only audited but battle-tested. As a user perhaps you don't know and shouldn't care about the specificities of the contract or its security but you can rely on the thousands of other eyeballs that do.
For instance, a few audits of Uniswap:
- https://github.com/ConsenSys/Uniswap-audit-report-2018-12/bl... - https://rskswap.com/audit.html
Bug bounty program of Uniswap (up to 0.5M USD per critical bug):
Sure, people will use VPN's and side-loaded apps, but would limit the damage quite a bit.