Risk Management for Institutional-Grade Yield Farming | Alessandro Buser -Dialectic

[Music] ready to go yeah hey so um I'll give a presentation about risk management and decentralized finance uh this may be a topic that's a bit less sexy than what we had on the stage earlier today um but I feel that it's very important for both people allocating capital in defi but also people building protocols and building uh liquidity pools to kind of get the point of view on the asset manager side and on the liquidity provider side so what this presentation will be about is to kind of give an overview of how sophisticated LPS and sophisticated asset allocators look at the risk in defi so brief uh background on myself in dialectic so dialect is a Swiss asset manager um we execute three main strategies so we have an early stage Venture Capital fund that invests in Defi and infrastructure and gaming and all sorts of uh companies in that space and more importantly for this presentation uh we do run two uh defi yielding Vehicles one being stable coin denominated and the other one being e denominated so we have been doing this for three years now basically since defi Summer started and so we had a lot of time to refine the risk Frameworks and to um refine the way that we look at risk and that we measure risk and the way that we allocate liquidity across defi I myself am the CTO and I'm portfolio advisor on the E denominated yielding book um so I've built out a bunch of the software that we use to manage the risk as well as provided some input to the investment team around the risk management framework and how we look at that we also work quite closely with protocols and ecosystems to provide specific liquidity to key pairs um so many of the big ecosystems that are launching now they require liquidity on stable coin pairs or different eth pairs and they found it um rather efficient to work with professional parties like us to provide liquidity in very specific pools uh on specific conditions so um why do we care about risk I mean most of you are aware that defi is a rather adversarial environment uh some people call it a large financialized PVP game because on the one side we have the users who hold their assets and who want to get some yield on their assets so they deploy it into liquidity pools but then on the other side we have a set of users that is highly adversar and that is actively trying to exploit the protocols and steal the liquidity and basically wreak havoc and Defi and we even have like state level actors such as Lazarus group from North Korea who was responsible for some of the largest TXS that we had in the space and so it's very important to understand that anyone can access defi anyone can play with Defi and anyone can try to exploit the different protocols and steal the liquidity and this is why um for someone like us who has like large amounts of capital deplo deployed across defi um having a very strict and coherent risk framework is the only way that you can really do yield farming at a large scale so the meat of the presentation will be around the risk framework and all of the different categories of risk um and then I'll also have a couple of slides about risk mitigation that will kind of go through some ways to do this in a in a sustainable and safe way so the way that we look at risk is that we break it down into five main categories so we have the chain risks which are all of the risks associated with the infrastructure layer so this would be like the economic security and approve of stake Network it could be things around uh like centralization of Keynotes and things like sequencers and here we mainly care about the conent Es as well as as the liveness um because even like liveness if a chain is down for a prolonged period of time uh that may cause some problems for oracles and Landing markets that don't have upto-date price feeds um so that's everything that has to do with the infrastructure layer and the chain layer after that we need to look at the bridge risk so anytime we are deploying assets that are not on the ethereum main net we need to bridge those asset to the chain that we are deploying on and so we do have some exposure to the to the bridge that is issuing those assets and if the bridge were to get hacked or drained the bridged assets would deeg their value would go to zero and we would have a loss on that um then going down the stack we reached the smart contract risk level this is actually probably the biggest risk in defi like historically speaking if you look at the assets lost in defi due to exploits big part of that was smart contract exploits and it's a very difficult thing to manage because smart contract systems can get quite complex and as we'll see in in aate there's a lot of dependencies and things to to consider um so yeah smart contract RIS is a big one and a rather difficult one to assess and mitigate but then even if the smart contracts are fully written correctly and it's all safe and sound most of the protocol have some economic mechanisms that could get compromised so in the case of lending markets for example we need to look at the collateral type we need to look at the LTV what the liquidation procedures are and all things related to that then many protocols rely on oracles so they need some external price feed to price the assets um and oracles can be manipulated so all of those types of risks we bucket in the economic risk category and then lastly uh we have governance risk now this is important because most Protocols are upgradeable and so when we do a due diligence on a protocol or an asset we are basically looking at a snapshot in time and if the protocol is upgradeable it could be upgraded and that could introduce some vulnerabilities or some extra risks that that that the users are exposed to so we need to analyze who can update the protocol how the protocol can be up upgraded what's the time lock situation and all things like that so once we define the five risk categories we need to understand that defi is highly composable and when we look at a specific pool so the example here is this uh dollar for xpp pool which is a curve pool and uh curve LP token a Stak and convex we don't just have exposure to a single protocol but we actually have exposure to a bunch of underlying dependencies as well and what we're trying to do so the end goal here is to basically get to a risk score for each one of the pools in defi that is coherent and that allows us to compare the risk of different pools so in this specific example we would have a chain risk on the ethereum Chain which is basically very low we don't have any Bridge risk because all of the assets are native to ethereum so we're not exposed to any Bridges but then on the smart contract economic and governance side we do have exposure on multiple levels to multiple protocols so we have exposure to convex curve and then dollar the stable coin is issued by inverse Finance which is its own protocol which is with its own set of smart contract economic assumption governance model and so on and the same for Frapp so this is kind of one way to visualize it um and the way that we then get to a quantitative risk score for any specific pool is by basically compounding the risk of all of the dependencies and for each one of the dependencies we compound the risk of the individual categories so um in the in the previous slide here we would have like a risk score for convex which is made up of the chain risk of convex the bridge risk of convex smart contract economic and governance risks and so basically if we know the risk score for the underlying dependencies we can compute a risk score for the pool as a a whole and the above uh formula here assumes that all of the risks are weighted equally um which is not really the case um usually something like a chain risk would be much lower weighted than smart contract risk because as I said it's much more common for funds to be lost in defi because of smart contract exploits rather than a chain going down or some issues with the chain so basically a way that we can represent defi pools is with a dependency graph so here on the left we have the example of the dollar fra PP pool from before and we see that there is a node uh which is the pool and then this pool lives on a chain that is ethereum the pool belongs to a protocol that is convex convex operates on curve and then the Assets in the pool um are forx PP which is basically just usdc and fra and usdc is issued by Circle and fra is issued by fra and and so on um so we can see that it gets uh a bit more complex than what you would think um at first glance and then here on the right we have an even more extreme example and um let me just close this okay so here on the right we have a more extreme example which would be the E USD Hy USD pool on curve so this LP token is sted on Stak Dow so again we have exposure to curve we have exposure to Stak Dow but then e USD and Hy USD are both tokens issued by Reserve protocol and Hy USD is actually uh collateralized by a bunch of yield bearing stable coins so Hy USD is collateralized by uh Morpho usdt so we have exposure to Morpho it also contains some exposure to flux Finance through FUSD it has exposure to SII so maker and as as you can see if any one of the underlying dependencies would be compromised then that would have a chain reaction that causes the Hy USD token to dpeg which would cause the curve pool uh to get unbalanced and that could ultimately result in in a loss on the final position in Stow so I think this is um a very nice and elegant way to represent defi um composability and it makes it very clear and intuitive what all of the dependencies are um and it's just very cool to see um like defi pools represented this way um okay so now that we rather uh should have a good understanding about the different risk categories and how they compound and all of the dependencies that matter we can start to look a bit about um how to mitigate the risks and so rather obviously the the first big step that you have to do is to do a full due diligence on everything that you have exposure to so in this chart down here we would need to do a full due diligence on each one of the underlying protocols the underlying assets to get to that risk score that I showed before and so the the way that this due diligence also needs to be done is that it needs to be very coherent because if we apply different um methodologies to score the risk on the different pools and we have human bias and things like that then we can't actually use the risk score to compare the different um the different pools one to the other so the due diligence needs to be very coherent and very deep and analyze all of the things that are relevant but then even when we did the due diligence and we know roughly what the risk exposure of a specific pool is we need to keep monitoring it in real time because as I mentioned before most Protocols are upgradable and so if someone does an upgrade to a protocol that may drastically change the risk profile of this um and a small point of the on on on this is that when a protocol gets updated we need to do a full reassessment of the risk on the protocol so if there is no time lock and the update just gets shipped to the live smart contract then we are usually forced to withdraw liquidity from the pool do a full due diligence on the changes and then redeploy if it's safe um this is usually a problem for the protocols that we work with and that we provide liquidity to because when you are doing a big protocol upgrade then it's usually because you're shipping a new feature new protocol version so a bunch of liquidity leaving the protocol after you do a update is usually not ideal um so here uh for the people building protocols please use time locks please use time locks that are more than a couple of minutes um and be very uh open and transparent about upgrading the smart contract so that all of the LPS have enough time to assess the changes and get comfortable with them and don't have to react quickly and withdraw liquidity um so then once we did do diligence and we have our monitoring up to date we can do some diversification because ultimately diversification is the best way to manage risk that's how risk is managed in in trefi most of the time and we can actually use a lot of the trfy methodologies and portfolio construction methods to build well Diversified portfolios and to actually properly diversify a portfolio as said we need to have sound risk course so we need to understand what the risk is on all of the different opportunities um and these risk scores need to be coherent and comparable one to the other um but we also need to understand what the correlations are between the different risks so if we deploy into 50 different pools on on convex um on the surface it may look Diversified because we are in 50 different pools but then if they all depend on the same smart contracts if they all rely on curve then it's not actually Diversified and um and so yeah and so once you have like a full risk overview of all of the opportunities and you have a return overview of all of the opportunities you can uh use things like efficient Frontiers to build optimal risk adjusted portfolio you can say this is the level of risk that I'm willing to take what's the optimal portfolio that gives me the highest return given that amount of risk and to properly diversify you need to basically see as many pools as possible so we build a bunch of software that tracks a lot of defi pools so we have close to 15,000 pools that we're tracking and those are spread across 1,400 different protocols in defi that's all evm chains and and so we can have a very broad overview of all of the pools that exist in dii and we can score the risk for all of these pools with the uh methodology explained before and then with such a big universe of opportunities you can actually do some very good diversification so you can really go Broad and allocate funds in a very broad way so that if anyone of the specific protocols as an issue it shouldn't cause uh a sizable loss at a portfolio level and then the last thing that you can do to kind of mitigate risk is more of the real time automation so we use Smart contract wallets most of the funds are deployed through smart contract wallets and what this allows us to do is to basically react in real time to any changing conditions so if for example a stable coin was about to deeg and we see that there is some threshold that gets passed we can uh automatically withdraw the liquidity and like avoid getting uh getting rugged on on some stable coin D pegging or something like that um and this also goes for for smart contract exploits there's different providers in the space that have real time alerting on Smart contract exploits so you can also integrate that and then um and then yeah and then then you can just get out of the position get your funds back to safety if something catastrophic is is going on so the conclusion here is is for D LPS and for the people allocating capital in defi it is a highly lucrative business I mean especially right now that the yields are coming back and the returns are very high there is a lot of good returns to be made by allocating funds to defi with the caveat that the risks needs to be managed because if you're getting 50% APR on a farm but then you get drugged uh you're still probably down a bunch and for the people building protocols um as liquidity is getting more scores and as the competition for liquidity increases it's very important to understand how dlps uh perceive your protocol from a risk perspective because it's usually not enough to just throw a bunch of incentives and liquidity rewards onto the pools because if the LPS think that the risk that they're taking by deploying capital in the pool is higher than what you're paying them then you won't get any liquidity so understanding a bit how dlps look at the protocols and how risk is assessed I think is very important especially moving forward into an environment where liquidity is is more scarce and more competitive so uh thanks so much for listening this was it from my side I'll be down there if anyone has questions