Gearbox - How to Treat Stables as Collateral

[Music] from gearbox and CTR and I'm responsible for the technical part so smart contract development all staff related to the technical side some advices to front-end back-end and so on and I'd like to introduce my friend Jeron from risk Dao euron is working on gearbox from the East side but I think here on you can talk a little bit what you're working on yeah so risk though is a framework or collaborative framework for risk management and risk advisement to Landing markets stable coins and yeah we work a lot in helping also gearbox help avoiding you know like bad events bad depth bad liquidations Etc yeah oops um so what we talked today in terms of stable Summit uh just a short story about gearbox it was designed in uh on S Global hackathon in the winter of 2021 we delivered the first version in the December of 2021 and it's more related for margin Trading uh then we decided that maybe it's a great possibility to go to leverage farming and we released the V2 in November of 2022 here oops sorry and the main point what we are focusing was leverage farming and of course people like to use stable coins to make it possible to make possible to use LP Stables escalatorial we learned a lot how to make price feed because when you build a protocol which use some stable coins and they'll pick coins as collateral you should device check what's going on and how we can consider each asset because we have like a nightmare and I will talk a little bit about that later so why we sleep not well after launching coffee too it's a pretty easy the tvl skyrocketed to 125 million now it's slower but it was for a long time and leverage farming when we started was very very very very very popular especially for stables and of course we have something like a nightmare when someone could really attack our price feed or try to fool it and later in presentation I discuss that maybe it's the mainly hack yesterday I was on deaf Summit and it was one presentation and one guy showed us a slide when the price fit attack was has the highest top place in case how people try to steal money so basically it's a big problem and for all working on gearbox we consider different cases of different attacks and price feeds is the most significant part we should protect from different manipulation because as you know you can really find Auditors who check your source code you can definitely believe there is no different attacks like I don't know re-entrance and so on and so on but when we consider real Market we changed every time when we start to focus on liquidity problems and different stuff and gearbox itself works with different protocols it could be some losses so let's talk what we did but before we go just a short five sentence is how we work so basically the idea of gearbox based that gearbox is two side protocol as you can see on the left side there are liquidity providers people who provide their money to the pool just to get high interest rates so this is passive investors their idea to provide their money and forgot and just get high yields and on the right side you can see moreover so these people are Risk Takers they know how to make money in defy they need leverage to earn more so they go and open credit account this is our defy primitive in the center they provide initial funds when they open credit account and immediately got margin loan from the pool for example you open credit account in ease you provide 10 es and you take a loan of 90es from the pool so you have 100 Ease on this credit account and credit account behave like a smart contract wallet so you can do different transactions with this wallet we have some limits of course the first part you can't withdraw this money into the pocket because it will be so easy you open credit account still mine and that's all yeah and another part after each transaction done we check that account has enough collateral so if you want for example you have 100 ease you go to UNI Swap and it's fully nature of uni swap uni swap do not know that it's gearbox or not you just Swap this 100 is to usdc for example then you go to curve and deposit this usdc and 3 Series pool and you get three series then you go to another curve pool deposit this 3 Series into frax3 series to convex and so on so it's up to you it's only very open things and you shouldn't have some predefined strategies everything up to you it works like a wallet and of course the main reason why it's very dangerous if someone could fool our system on the latest step when we check collateral it means that you can try to steal money and we can got hacked and it's a problem and how we solved so basically when we compute collateral after each transaction the best representation of credit account is like such a table we have a list of different assets we have quantities and prices which we got from the price feeds what I'm talking this year on today so basically by multiplication we can compute the total value and compare it with your depth in some simple way if this amount bigger than that the account could be considered healthy correct because it has much more acid than depth and you can't steal them so basically in terms of liquidation we can sell everything from this list and get dabbed back it's clear guys perfect yes so this is the form of how we can do this and of course it's a pretty simple if you can pump the price if you can for example make hour 10 times more it means you will get more time as total and you can steal money pretty simple why price feeds attack is very very dangerous for us and here you can see for example I open diecredit account I borrow 850 and provide my my own 150 die on it so here I have a 1000 die and it has a USD value of 1 000. that's a quite stable token with a large amount of liquidity it's hard to manipulate but you can find some token a you can swap die to token a let's consider it's also some stable so it's one by one we keep 500 here and you got 500 token a then you pump the price from one to two pretty good stable two dollars yeah it's like a bank note so the next five will be up and then of course because it's considered as one thousand you pump the price on the price Oracle you can withdraw this die as a result you withdraw 500 die and your profit is 350. and because gearbox already passed the check we consider this account as healthy on the next stage when the price comes back someone could liquidate it but at the end we have a bad debt it's why we called it price Oracle attack and in our master class we will discuss how to eliminate possible risk what we learn from our history and we talk a little bit about some unexpected cases how to solve it so basically this is our code and the gearbox supports different price feeds which really has a program interface like chain link because initially we work with chain link mippers I'm personally talked with other technical team and other protocols about different Oracles and there are a lot of ideas but tuning is number one still in the industry so basically of course many others come to the scene but still you can if you want to have similar protection like other and other holds billions of dollars and they have only one source of price data which is chain link so we decided that it's a good way to understand that this battle tested thing works for us as well because if ah it works for our it works for us because our never work hard with this price Oracle and let's consider in today our Workshop three different price feed which we use in gearbox related to stable coins and the first one is chain link prices I also mentioned about how we use it we trust and our so my first question guys what do you think is it safe to use chain link directly as a good source of price fit for stable coins what do you think no why it's it's included so basically uh thanks it's a really good point it's called a deviation because you have a current market price but if you go a little bit deeper you can understand there is no way to measure current market price of course it's also some aggregation and chilling did this job really well but still any other option is it safe to use chain link you have just imagine you have 120 million you go to sleep you close your eyes and say okay is it okay to use shinling or I can be awakened for someone and say hey guys no money in gearbox get up you should decide and find the answer for this question it's it's real yeah okay so I think Jaron will be like a bad policeman who can talk how to hack chain link so you're on your time uh yeah yeah first of all I think in general right and gearbox does just changing for you know like most assets but of course you know it's always best to put some sanity checks and constraints on top of it uh so yeah so that's like the here the talk was originally about stable coins as collateral so this is an example uh on how you know price sometimes can be easily manipulated or at least cheaply manipulated and it's happens to be an example with a stable coin but it's also why it is possible to do by a stable cone it's not coincidence it is because stablecoin liquidity is very largely dominated by a curve uniswap formula which is either either balancer or other places but eventually it's the unit swap formula and uni swap formula is highly asymmetric and LUSD so these are historical numbers these are not the current numbers but LUSD is notoriously known to be traded a bit above over the peg and as an holder you know you might not really care if it's traded like two or three percent over the peg but it has like huge consequences on the liquidity and here what we see at the time this snapshot was taken LUSD was traded at about 1.03 USD as a result you could sell a lot of LUSD and it barely moved the price however on the converse Direction it was enough to buy only 6 million of LUSD and it would already you'll get a slippage of five percent which means you will pump the price by at least 10 percent which means that with 10 million dollars you can likely even Pump It by 20 30 percent so this is something very highly asymmetric and you know at certain point the numbers here were even lower even three million dollars or enough to pump the price by over 10 percent it should be noted that LUSD in theory has some mechanisms that should somehow make sure the price doesn't pump too much over 1.1 the thing is that we never see it actually happening in the wild uh LUSD was traded a bit a bit higher than 1.

1 for few blocks these mechanisms were never applied here it's also likely that you know if LUSD were to trade higher than after maybe you know 10 20 minutes it will go back down because of this mechanisms but this scenario there's really no way to know how chain link will continue to quote the price and yeah and that this is why price manipulation was a real concern one yeah it's thanks for this explanation euron told us about this potential problem because basically of course a lot of us trust for things because it's easier with rather's ERC token works as usual and if you make a transfer they transfer token all time but keep in mind they are all smart contracts and they could have some internal logic we believe that stable coins are usually stable but as you can see LUSD and some Stables with lower liquidity could be simply manipulated and of course some malicious actors could find the way how wait until the moment comes and try to manipulate so to eliminate such case we fix the Oracle by adding a price cap so basically we limit LUSD with the value like 1.02 or 1.04 and if the price is higher it looks like manipulation and it's a good point because in stablecoin we believe that the price should be around 1. correct if LUSD costs two dollars it's something unexpected and of course for our purposes if we consider that if it could be done on a long time we can of course update the system and find the way but if it time for one block it's enough for even for arbitragers who builds this Mev Bots to really take a lot of money from gearbox and we have this cap so LUSD never could be more than one point I think one zero I think 1.1 1.

1 maybe so we believe it's impossible and it really protects fans on gearbox of this price manipulation and for Stables it works you could not make the same rule for ease because you never know is start their Journey from 0.01 over now it's around 2K and we have seen 4.5 and we definitely believe it will be more than 10K so we could not make a cup it's a bad news for all of us but if you can consider stable coins it's a good way so perfect what's about LP price token it also highly manipulatable and here you can find any chain link or other price Oracle who can definitely give you a price for earned position for example yeah so the problem with yarn it could be also computed pretty pretty simple because what we do we just get price per share it's a data from your own smart contract and multiply it to underlying price for example if you have something like usdc we get this price from chain link and we believe now it's safe because we have no ideas how of course we know that usdc is not always one yeah we have also good case when I was awakened by Ivan and he said it's totally rack usdc going down yeah of course could we could not of course expect this but still the system would work because as you can see we get this price from chain link and when usdc going down a lot of people made money on gearbox who really have a depth in usdc and provide it to curve and curve has a few uh tokens in 3C review for example so basically the price of the curve token uh moving down much slower than usdc and there are some people who made a lot of money in gearbox so it was really fun when people using leverage farming not only save their money as they really get a lot of income but if we consider this formula like a price per share multiplying to underline price could it be safe or not what do you think about yeah sure yes yeah but but it's okay because let's consider we have some parameter which is called liquidation threshold it really always less than one so when we compute collateral we multiply this two things by liquidation threshold and it could be like 0.8 and this liquidation threshold already take into account chain link deviation between real price and delayed price through the chain link however I think there is much more technical problem with urine and maybe you have seen or maybe you've read some articles about hacks related to this approach and how we can really protect assets there in terms of getting price sorry yeah yes correct so basically here if we trust this formula we make an assumption that yarn could not be never get hacked and in terms of hack I talked not only about real hack when people could take money I talk about the case which is not considered by your team policeman could also talk a little bit a good example how people hacked another protocol based on your price it was uh this cream protocol I think maybe some of yours know about this hack I think it was two or three years ago it's not related to gearbox because you could not really we have no pool in urine token or similar so it could not be but it's a good example if you trust 100 of the data you get from external protocol how it could be your own please yeah yeah so so again here the setup is a bit philosophical because the short answer is that it's not necessarily you had any alternative with the Oracle but it's more about how you know putting some sanity rate limits around the Oracle could mitigate you know scenarios no one would ever expect and near the scenario was simply that someone donated a lot of money to earn right and and then like on the face of it you know okay if I decide to donate to someone how can I actually make profit out of it okay and this is something that cream Finance didn't expect you know now now it sort of became the standard but this is part of uh gearbox decision to put some you know sanity bounds around the prices in order to mitigate such unexpected scenarios the technical details here is that you had some young you know think of iron world is just you know like a pile of money you can put money inside and the value is just the amount of money there between Finance did the catastrophical mistake of letting people borrow uh borrow this Vault and then if you can borrow this world and you know you can also deposit it back and borrow again eventually you can build a position of this world which is actually bigger than the entire circulation of these volts so think you know maybe think of gold as an example if you can hold more gold papers than the actual gold circulations a circulation of gold so so in this in this case you know the attacker hold had a bigger exposure to these assets than the entire circulation and then it just donated some money to these walls which pumped you know so he lost by the donation uh because you know we hold only a relative amount of these assets but he had exposure which is bigger than 100 percent uh so he had the huge profit out of it as well and then of course he borrowed something against this uh over inflated position and just yeah run away with the money yeah thanks for get explanation and at this point of course when such happens with other protocols and we can learn from that it's okay because until it's not our protocol involved and to mitigate this risk we also use the similar way for bounding so here you can see it's not maybe well good in the code but here we have a reverse Zone if the price is lower than bound we just reverted because if you can provide very very low price you can liquidate all people who have position in gearbox which is not good and it's also another way how we can be attacked and if you go more than upper bound we just use the upper bound as a cap and of course this solution is not ideal but from my point of view in crypto usually if a simple solution works much better than complex because you could not really find a way we know how Yorn was hacked with this idea of sending directly money but we could not really talk you that we are 100 warrant that there is nothing that people could invent more when we use these cups it creates some good thing when we can really trust for old LP tokens so basically it's not ideal in terms of decentralization because of course our whole goal is to build the full automatic way to manage prices it still requires some humans and risk down people who control that in gearbox though how to manage this but it's really create at least trust that no one could pump it too much or really dropped and manipulate and the last part but not least it's a very good example about uh curve stable LP token because cure of pools are very very different believe me we work with many of them each time when you open this Viper code you can find something new new types new interfaces different contracts and so on so it's hard to compare but for stables and maybe it's one of the most uh noun pull like 3 Series when the curves start it also have an initial idea how to design price feed and it's also a good point just to keep in mind if you want to design price fit some Initial Ideas could be wrong so here just check this is a simple idea so what we can do we can really open curve pull contract curve pull contract has a method which called balances and it will provide you clear value how much usdt usdc and die are in the pool yes so the first idea is how to compute the price of LP token is just to multiply each of this balance to its price which we can get safely from chilling so it this part could not be manipulated and then divide them to Total Supply because we have in a curve pool some three different coins yeah so I compute their value in USD and then divide to Total Supply this approach looks very very natural correct because we know how much money we just divide to Total Supply and it should work so basically here you can see an example but I want to ask Jaron why it doesn't work so simple we really believe that it work but it doesn't work while you're on Yeah so basically this this approach Works only when we are in a you know sort of equilibrium or you know situation where everything is balanced and static the problem here is that like in any smart contract you know this can be invoked in the middle of a transaction right and then we don't have any guarantee that this is a stable situation so like more specifically what can be done here is that the inventory can be manipulated right so we have an example here where us this usdt was almost nothing so of course if you want to inflate and pump the value of the pool you know let's just buy a lot of usdt out of the pool we will put you know a lot of usdc into the pool usdc numbers one USD usdt was less so we take a flash loan of you know say usdc then inject in this example 44.5 million to the pool in return we get 99 million of usdt where the average price is half a dollar uh because of course buying more pumps the price and then we end up with an intermediary intermediary step where okay we have a balance of 45 million of usdc we look at China and qsdc now was once one dollar okay we also have some usdt leftovers but it's pretty small anyway and combining with the die we had before now we have 46 million dollar of total value the total Supply didn't change because we didn't mean to burn anything and the bottom line is bottom line is that the price pumped by 4X and now you can say okay but you know we overpaid a lot for usdt but then after like at this point we are you know we took a flash loan now we can you know manipulate air do the attack on gearbox and then after the attack we can just sell back all the usdc selling back and forth in almost every automated Market maker will give you everything you put in it will give it to you back minus some Fe which is you know much smaller than what we made profit by attacking gearbox uh so yeah so overall everything here was manipulated uh and yeah and this is why like the best practice here uh is not just to take the sum of everything but actually making sure you take the minimum price of each of these repairs which also allow you for a nice flexibility in case that you know okay if at certain point you know usdt is kind of permanently got depicted so yeah okay either delist it or you know have some time to find different solutions and see what to do thanks and it's another way why people sometimes asked gearbox though why when we can see how much money we have as collateral this sum is usually lower than we have and sometimes it's creates something unexpected why just provide my die and now I have like a minus something as a p l because when we use our chain link prices we use this formula which is safe and you can see it underestimate so for major cases we a little bit underestimate LP price but it's much safer and basically what I really want to talk today about these prices and we talk about how monitor them but the basic idea never trust your assumption if you assume that we have one conversation with one protocol I do not want to disclose who it was but it was one of the biggest one yeah and we talk about usdc and they said why you really spend gas to get usdc price because usdc price is always one you can simple hard-code it and save the guess and I said no let's let's spend a little bit it's not so big guest spending when you ask chaining price Oracle to get and when it was a usdc depict we were really happy that we didn't follow this advice to consider usdc as one dollar but it was like assumption in a market around two years ago then we have an assumption that basically you can simply consider how many tokens in any LP token just divide the total Supply and get the price data it also doesn't work be careful with these assumptions and even though if you believe that you did your job well if you believe that you design your smart contract and we talked with Michelle igoro from curve to prove our Mass related to all our price feeds it's not enough and another part which we want to discuss about risk modeling and how we control the system continuously because it's not enough to build the system and forget you should continuously monitor and understand what's going on to be the first person who knows that potentially it could be a problem to for decision making and here on it's your job so please tell what you do to protect gearbox from these risks yeah so risk analysis in general you know it's very open-ended question but recall that the main task here is to Define liquidation thresholds that will protect us from a price the decrease and will give Liquidators enough time to handle that so typically like for normal volatile asset you know you just see how it behaves and try to predict you know how quickly it will go down and of course for stable assets this is much harder problem because typically the history is such that you know nothing moves nothing moves nothing moves and then you know USTA crashes to zero uh so different stable coins have different you know properties and modeling what we consider is liquid is LUSD which is a very good example because it's relatively a pure uh decentralized asset without any governance and without any multi-sikh decisions that you know could affect the mathematical modeling so LUSD is basically backed by is okay and as long as there's enough is to back LUSD we can then assume that LUSD will never go below one because also on top of it it has like very nice Redemption mechanisms Etc so basically let's consider a scenario where we actually deposit early USD and then wants to borrow usdc against it then the way we look at it is that actually someone deposited is and not LUSD and then he wants to borrow usdc however this person who held a lot of is and actually deposit it in LAUSD and then the bad event that we want to predict is not that East will go down only but that is will go down enough and then liquidity will fail to liquidate it and it will continue to go down such that eventually the price of LUSD will also go down and only then our Liquidators will liquidate it so for this to happen we need all the backing uh ratio of liquidity to First go down you know below one and you know this this value is publicly available on chain and we can query it and only after this amount and then you know this value is typically around two also only after all this price drop then we need our Liquidators to fail which of course gives you know very attractive liquidation threshold uh to LUSD versus other stablecoin uh yeah so another example here where you know typically centralized and so like the more complex the token is the Sable coin is and the more centralized it is it's really harder to model it mathematically uh here this slides is mostly to illustrate uh like the key factor that curve is stable swap formula play a both in the analysis but also in the dynamic of liquidity and liquidations this is the famous USD CD Peg around mounds of merch March and and what we see here is that you know even if the price got depicted only by 10 percent which is you know still not the end of the world the tax liquidity was you know almost completely drained because of how unusual care stable stop formula build so you see in yellow is the balance of a usdt which was like the only token that was still was one at the time and almost all the balance is now die in a US dollar a usdc that got the peg we also see you know specifically in this time you know it was during a weekend then you know we follow it closely also gearbox followed closely ER the lack on gearbox was that most of the base assets or either die or usdc which you know actually went down so all the debt assets also went down but there was some interesting relationship between Dai and usdc and we say that like at certain point the deviation you know at certain point die deviated less than usdc then the deviation returned to be the same and actually there was an interesting Dynamic if you see like the spike on the right hand this is just because uh the PSA model by maker Dao got triggered again and you know like another one billion a chip die fled into the market and then price got the big yes and uh one I think we also take some time more but just the latest word uh that why it's significant to monitor as I said there are some possible Vector of attacks as you know gearbox has a lot of complex things and what we really want to do gearbox itself was designed as a Dao from the zero day protocol we have like a credit account Mining and we're really happy that we have a strong Community who help us to Monitor and develop the protocol and here you can see we built a website which is called risk gearbox foundation so you can go there and you can check all Oracle prices comparison and risk events so our goal to make all this stuff not only related to oracles all possible risk fully transparent for all contributors and you can really understand that the big difference between protocol and some centralized exchange who want just to make money like a binance just provide a paper we have enough assets and this is some signature you should not trust no contributor in gearbox please prove yourself go to risk gearbox Foundation you can find all deviation from market price you can find all notification and here is an example of risk Dao about liquidity changes and so on to make the most transparent and I believe this Security in price oracles and all other stuff depends on people who use the protocol who contribute to it and so on so maybe the best way is to be work together as a Dao to achieve this stuff never trust's first assumption as I said in here continuously Monitor and make these things doable for everyone and we really have a very very great support for Community thanks for that and I think together with gearbox risk framework we can really deliver much faster because we provide a lot of tools for Community to test what's going on and how for example price fits works and so on so basically if you can find something you can immediately contact devs on Discord and so on and we will start to fix but I believe our design and a lot of infrastructure help us to cover these cases and this is an example for example I think I pick it today so the biggest deviation now is 166 person from the market price but you can go to series gearbox foundation and check so thanks very much it was our experience we want to share today if you have any time for Q a or it's all yeah sorry it's all sorry thanks so much thanks for this session thank you it was a pleasure to talk with