Billy Rennekamp ~ Good Trades Take Time: Grieving Frontrunners with Batched Bonding Curves Clovers

[Music] everyone thanks for coming today I'm gonna be talking about batched bonding curves which is a solution to front-running which is rampant on all on chain exchanges it is a big problem and hopefully this is a good solution so my name is Billie Rena Kemp I'm involved in a number of projects the one closest to my heart is clovers network I also said that I'd mentioned that another talk I almost gave instead of this one was on refundable tokens which is an EIP I'm working on so if you're interested in that concept come talk to me afterwards clovers network is being built by Ben Ben studio I've also been part of meme Lords curation market for memes ans nifty a tool for converting ENS domain names to non fungible tokens I work for cosmos network the Internet of blockchains and for gnosis building prediction markets today I'm going to talk about some background research on the topic front running in general then go over the three implementations of batch bonding curves calling them patched ordered match and fill common clearing price then some links to documentation there's some live code and a more in-depth article on this topic and then if there's any questions and discussion I welcome it so background and research most of this work was done on behalf of gnosis with regard to continuous organizations but just for a little bit of background on bonding curves in general I want to go over the concept typically you think of it as a contract who's willing to mint to new tokens or burn tokens based on some price algorithm this image right here could be kind of thought as price equals supply squared may be familiar with this quadratic looking graph the x-axis is the token supply and the y-axis is the price that area underneath that graph can be kind of thought as the collateral that's being held inside the contract that money is used for buybacks basically so every time you mint new tokens the money you use cement them it is held in the contract and every time somebody wants to burn their tokens basically sell them that collateral is used to buy them back and that price will adjust according to the number of tokens in circulation a typical way to think about it like I was saying is price equals supply squared or MX plus B sort of a slope graph they're all familiar with another implementation is from Bank war and that uses something called a reserve ratio or a connector weight so under that line you can see price is defined as balance divided by supply times reverse reserve ratio there is a ratio is the balance divided by the market cap and the market cap is the price times supply so those are the two different paradigms but thinking about this and I go in now to continuous organizations this is typically thought of as some kind of organization that uses a bonding curve for minting and burning shares so those shares would be the tokens that locked collateral that's used for buybacks part of that is used as working capital for an organization with the idea that token holders would receive some form of dividends from profit from this company the details of how all those are implemented sort of vary across different descriptions I mentioned that I was doing research on this on behalf of gnosis they recently built a new decentralized exchange called the Dutch X and they're giving control of that on chain exchange to a dhow called the DX Dao and so there's some talk about maybe making this DX Dao a continuous organization a lot of the ideas also are being written by Tebow Fabra around the continuous organization Sea Org real interesting ideas about regulating these and turning them into reg C corporations so that this is kind of the crowdfunding regulation so you don't need to be an accredited investor but you can kind of crowd fund up to a million dollars and have the token buyback still take place also apiary through Aragon which is a project from Luke Duncan being built by Pando and for Eyre and others and giveth from Jeff Emmet and company so all of these situations suffer from front-running if you guys are familiar with maybe this book that came out flash boys sort of high-frequency trading this is rampant or at least exists and traditional trading and it's it's illegal it's it's considered illegal activity and trading but front-running in general is kind of a form of insider trading it's where you see a transaction coming in and you jump in front of it based on the knowledge of that transaction following you can sort of capitalize in that position and with on chain exchanges basically all trading is insider trading because of this you know when you have a public ledger and you can see all of these transactions in the men pool you really open yourself up there are a few methods for trying to remedy it none of them are 100% perfect successful but again sort of to go over what for earnings about you can you can think of it as being possible whenever there's a guaranteed price movement so the buy order was coming in you could sandwich that order with another buy order as soon as that original buy order is executed that price would have gone up and you can sell from that so you have a guaranteed price movement up you basically take the wind out of the sails of that legitimate purchase similarly the sell order say you already have some of these tokens but you see a sell order coming in you could get a sell order in front of those so that when you knew that they guaranteed to move the price down you could buy back in you would basically increase your current holding with zero risk similarly this concept of dividends in this continuous organization if you see basically a dividends transaction coming in you know that all token holders are about to accrue a little more money so you can jump right in between it and buy and benefit from that movement and sell alternately the opposite say some of working capital is about to be removed that might affect the price as well so you can sell right before that working capital transaction and then buy back in again afterwards you would increase your holdings for free so I don't know if you saw this talk from Phil Diane at DEFCON 4 but it's a really great talk I recommend checking it out and he has some really amazing statistics he's been working with a group sort of studying this problem and back in 2017 only on ether Delta there was potential for $4,500 of profit just front running on ether Delta alone if you remember that's kind of a while ago and crypto terms and there's a lot more on Shane exchanges and a lot more opportunity for that this graph on the right shows when they published a study on this concept and then started tracking transactions which were front running transactions and they just basically exploded similar attacks are available on bank or uni swap they estimate that 30% of all blocks contains some kind of program in a programmatic arbitrage transaction which is a front running transaction most the time one method for trying to prevent this is a min return which is used on Bank war so if you make a bi transaction you can say I expect I should get this many tokens in return if I don't get that many tokens I want this transaction to fail so if somebody jumps in front of you you know that price would increase and you wouldn't get as many tokens as you expected that transaction would fail it's a pretty bad user experience when you have to kind of expect that your transactions will fail because this activity's rampant uni swap uses a timeout parameter which means sort of talking about another way for miners to front run which is that they hold on to your transaction they don't include it to the men pull until the they decide that it's like a good time to move in or move out they kind of can control the ability to go in this is sort of the extreme version of front-running in which it's not about other users just pumping up gas prices to get in front of you but it's actually the miner itself who can order those transactions and take advantage of ordering those transactions so enter batch bonding curves like I'm missing a slide so I have three implementations proposed like I mentioned earlier one is batched and ordered one is match and fill and another is common clearing price [Music] the basic concept stands on all three and that's where over a certain span of blocks you collect all the buy orders and you collect all the sell orders and then after that span you allow withdraws of those tokens or of that collateral based on a common clearing price or some grouped clearing price so this span of blocks could be as little as one blocks a could be as long as ten blocks or more if you do it say as short as one block you kind of open yourself up to another problem which is block stuffing somebody could just fill that block with a lot of high gas transactions that push the other people into the next block and they're able to capitalize on the same sort of front-running method so the first method batching ordered is kind of the simplest one it's where you would take all of the buy orders and then all the sell orders you group them together so it's basically one big transaction one big sell transaction you keep track of how much people you know put into each of those but then you execute all of them at once and then all of the other ones at once a problem with this is that it really favors one party over the other so say you were the buyers you were buying orders and yours were executed first you would push the price up which is great for the sellers you know they really want a high price when they're selling so if you're part of that first group you lose out compared to the second group is really capitalizing in this new position alternatively if the cells were executed first the price would be pushed down and that's really great for these buyers who were able to buy at this low price and push the price back up so you could say this is a feature not a bug and just say you know I'd like to really prioritize my buyers over my sellers I think the sellers are sort of leading the ecosystem they're not doing anything for my token the buyers are contributing you know they're pushing the price up so I'm gonna give them a better deal out of this whole scenario this is similar to the idea of having a different curve for buys and different curve for sells excuse me so you can take that as a as a feature and actually implement that because it's something you want to see inside of your your situation another attribute is that if you execute the side the cells first there's gonna be an overall increase in the price per token compared to executing the buys first so again that sort of moves the price of your token up if that's part of your scheme and you want that the next one is matching I have to thank Martin Kopelman for noses for this one and so with the bonding curve you always have an exact price at that moment however as soon as you start executing orders that price gets moved either up or moved down but if you have a group of buys and a group of sells we're waiting you can use that exact price as basically a match price so you will execute as many as possible of those buys and sells together at that price and you'll end up clearing one whole half there is like one chance that you have the exact same amount of buys sl's and they'll just even each other out and then you're done with it but most likely you're going to have a little left over on one side so once you've done that you take that left over and you execute it with a normal bonding curve and then you combine those prices of the bonding curve price and the match one for whichever group is larger and you let them clear at that combined price so that results in a different price from the buyers and the sellers similar to the first scenario but those prices are gonna be a lot closer together and they're gonna actually reflect you know whichever group was larger in that moment which could be a you know more equitable way to price those transactions the third one is kind of the holy grail and it's this find a uniform price for all buys in all cells however the the math to sort of execute that is really not practical on the theory and virtual machine and so thanks to Tom Walter also from gnosis we came up with sort of a method for finding this clearing price and a schema for implementing it even when you don't need to actually calculate that price on chain so the way it works is you basically have this goal of finding some universal price P and you can think of all of the cells and all of the buys as being a change in tokens a total change in tokens and a total change in collateral that's as Delta X and Delta C so when you're selling some amount of X tokens these are all the cells this is gonna result in the removal of some amount of collateral which is gonna be that universal price times those number of tokens being sold you can also think of the Delta collateral being all of this collateral coming in from the buys with the addition of that collateral divided by some universal price number of tokens so rewritten another way you have Delta X equals negative X those are the tokens being sold plus collateral divided by price those tokens being generated by the bys Delta collateral is going to be the collateral coming in from the bys minus the collateral that is extracted from those cells so one way to calculate the purchase return on one of these bonding curves is by taking the integral of the price formula so here you can see purchase equals M over n plus 1 this is sort of with the price formula in mind of M X to the N we can use this mechanism for calculating a purchase and substitute our Delta C and our Delta X as you can see in the bottom part and this will give us a formula that has this universal price P however if you look at this formula it's it's a level of polynomial that's it's quite difficult to solve I was really hoping that Wolfram Alpha will be able to just give me a P equals but it doesn't really happen that way so what you end up doing is substituting all of the variables that you have in a certain situation and you get usually three different answers sometimes you get an imaginary number as an answer sometimes you get a negative number sometimes you get a number that doesn't change the token balances at all and so you kind of go through this process of elimination to find out which price makes the most sense and this this like I mention this process is is rather difficult it's a high level mathematics it's just not practical on the EVM but what is practical on the EVM is verifying the solution so this is a similar tack that's being taken by gnosis on their diffusion exchange which is different from the Dutch X uses EK snarks and a sort of true bit style verification process where you know you don't need actually calculated on change but if there's a challenge to the solution that you have you can actually verify the solution without having to do it from the beginning so you can easily take a price and work backwards from that so you've got all these bodies you go to these cells the spans have passed and then nobody can withdraw their tokens until somebody provides the price that will clear them you can verify that that price is correct pretty easily because you just execute the orders and you make sure that the slope hasn't changed and then you're allowed to withdraw at that price so this is also kind of a bad UX experience where you have an asynchronous sort of withdrawal all of these situations actually have this where now you put in your buy order but you have to wait till it clears and then you have to withdraw Oh would be rather trivial to add a fee to this transaction that fee could be paid out to a third party who's willing to execute the withdraw function so that you could sort of set it and forget it and somebody else would be incentivized to actually deliver that money to you after the the price is cleared that same mechanism could be used for rewarding whoever finds that clearing price could be done with a bot or whoever so I've built implementations of all of these batch bonding curves they're available on github if you wanted to take a picture this QR code it should pull up I also today published an article on medium that outlines all these scenarios it also links to an observable which is kind of a Jupiter style notebook so it has all of the different code and math and implementations and it also lets you sort of change the different variables to see what say more buys or more cells would result in with each of these different batch bonding curve scenarios so that is good trades take time oh I have to give a shout out to gnosis again that's actually the slogan for the Dutch X where the inspiration for all this took place from this is the only on chain exchange that's not fron runnable at this point they have a six-hour reverse Dutch auction that just restarts with another batch of tokens after that six hours takes place and so you know this sort of idea that slows things down don't allow front-running and asynchronously withdraw your tokens afterwards is a way to prevent front ring from taking place it's where it all came from so you can find me my username on most things is okay with me or just my name Billy Rooney camp send me an email if you'd like studio at Ben dot am yeah I feel like I went through that pretty fast do we have any questions or comments anything out there to pass the time Thanks okay no questions anybody feel like getting up here and telling jokes I think you have like 20 minutes of the next talk all right thanks a lot oh sorry sorry please unfortunately we don't have a wireless mic to bring round to you so if you come up here for questions okay so in the case of ether Delta you can front-run by pumping your gas and bidding higher to get the order help me understand why that's such a problem so you have zero risk as a trader in that situation you're basically free riding on somebody else's genuine idea of making a purchase and you're also taking a little bit of the power out of their purchase you're basically stealing from a person in that scenario everyone has the equal opportunity to do it right everyone has an equal opportunity so how is it stealing it sounds like more like a competition equal opportunity is an interesting way to put that I mean you do need a level of sophistication to sort of watch them in pool and there's actually from this same Phil Dyan talk really interesting sort of documentation on the competition that's begun between different frontrunners so they both start pumping up their gas to get in front of the other and so it's really interesting to see in this you know 15 seconds that takes place during a min pool how they change their gas price over and over again to beat each other and how actually miners aren't even paying attention to it so they'll stop watching and just take whoever's like in front half way through that block clearing price you can see that those front runners don't know that so they keep bumping their gas price even more afterwards so that miner would have been able to make a lot more money and fees it has been paying attention but you're already seeing basically a competition of front runners front running each other but this is not really the competition that you think when you think about a marketplace marketplace should be the intention of people who are actually buying the asset and want to return from that and if you have somebody else who's basically able to suck money out of their transaction without contributing anything that's just stealing okay all right I think I understand we're coming from but it's a shame because it's difficult to do some people have an advantage so they're stealing I mean yeah when you say it's an equal opportunity everyone has the ability to write about and do that but obviously not everyone has the actual actual ability to do that and I mean I don't think that we should be encouraging a fair place where everyone can front-running each other cuz all that does is just say like oh well he has a gun so he can steal better than everybody else but maybe we should give everybody guns so we can all steal better okay I think right also sort of defeats concern about reducing volatility in the market by reducing activity overall and is that you mean with batch bonding curves always front running it's not taking out arbitrage opportunities the markets still will move but it'll move based on actual people who are making real buys and sells instead of being moved by people who are just you know chipping away at somebody's real order terms of slowing down and being like a feature of a normal market where it's moving rapidly I don't know I mean that kind of points to markets being sort of gambling in my opinion so I don't I don't know if I would say that that's a good feature of a marketplace or not it's probably be desirable for some but that's depends on your strategy I guess do you know what the situation now is with front-running and how extensive it is currently and how far is this being off being implemented so I think there's a website called front run me which is also associated with this group that Phil died in as a part of whose I think done the most research around it and the sort of reports coming in is that it's just massively rampant and sort of increasing all the time and so I do believe this is a real problem that needs to be addressed as soon as possible I think that a lot of crypto projects sort of beat themselves up solving problems that don't exist yet in the hopes of like having it solved before you get to the point that it's a problem I would actually hope that we do more of that with a specific topic and this work is done within the last week or so so it's not implemented on any project that I know of I was kind of thinking about forking uni swap and trying it out I mean I love uni swap and I love the 6x it's having I'm just worried that like you get too many people who are using a version of it that's pret runnable it'd be hard to transfer all of that money into one that's not so yeah if you know anyone whose be interested in implementing it on their exchange I highly recommend you to send them my way or to send them to the documents and I'd love to see it in the real world and how do you stop miners from does this solve the issue for - so the minor problem can be mitigated from the timeout parameter which is implemented on uni swap it basically says I'm submitting a trade if it doesn't get executed in the next 15 seconds it's gonna fail which would you know partially mitigate a minor being able to hold on to your transaction and stick it in a block later it doesn't fully they can still reorder the current ones this does solve that because as long as it's in that span of blocks it's gonna have the same price no matter what the order is going twice alright thanks very much [Applause]