(In)Stability for the Blockchain: Deleveraging Spirals and Stablecoin Attacks
((In)Stability for the Blockchain: Deleveraging Spirals andStablecoin Attacks ∗ Ariah Klages-Mundt † Andreea Minca ‡ June 5, 2020Original release: June 2019
Abstract
We develop a model of stable assets, including noncustodial stablecoins backed by cryp-tocurrencies. Such stablecoins are popular methods for bootstrapping price stability withinpublic blockchain settings. We derive fundamental results about dynamics and liquidityin stablecoin markets, demonstrate that these markets face deleveraging feedback effectsthat cause illiquidity during crises and exacerbate collateral drawdown, and characterizestable dynamics of the system under particular conditions. From these insights, we sug-gest design improvements that aim to improve long-term stability. We also introduce newattacks that exploit arbitrage-like opportunities around stablecoin liquidations. Using ourmodel, we demonstrate that these can be profitable. These attacks may induce volatilityin the ‘stable’ asset and cause perverse incentives for miners, posing risks to blockchainconsensus.
In 2009, Bitcoin [19] introduced a new notion of decentralized cryptocurrency and trustlesstransaction processing. This is facilitated by blockchain, which introduced a new way for mis-trusting agents to cooperate without trusted third parties. This was followed by Ethereum [22],which introduced generalized scripting functionality, allowing ‘smart contracts’ that execute al-gorithmically in a verifiable and somewhat trustless manner. Cryptocurrencies promise notionsof cryptographic security, privacy, incentive alignment, digital usability, and open accessibilitywhile removing most facets of counterparty risk. However, as these cryptocurrencies are, bytheir nature, unbacked by governments or physical assets, and the technology is quite new anddeveloping, their prices are subject to wild volatility, which affects their usability.A stablecoin is a cryptocurrency with an economic structure built on top of blockchainthat aims to stabilize the purchasing power of the coin. A true stablecoin, often referred to asthe “Holy Grail of crypto”, would offer the benefits of cryptocurrencies without the unusablevolatility and remains elusive. A more tangible goal is to design a stablecoin that maximizesthe probability of remaining stable long-term. If one can establish guarantees for the stabilityof such a stablecoin, this would be a significant step toward forming a robust decentralizedfinancial system and facilitating economic adoption of cryptocurrencies. ∗ We thank David Easley, Steffen Schuldenzucker, Christopher Chen, Sergey Ivliev, Tomasz Stanczak, andSid Shekhar for helpful discussions. All errors are our own. AK and AM are funded through NSF CAREERaward † Cornell University, Center for Applied Mathematics ‡ Cornell University, Operations Research & Information Engineering a r X i v : . [ q -f i n . T R ] J un ryptocurrency volatility Cryptocurrencies face difficult technological, usability, and reg-ulatory challenges to be successful long-term. Many cryptocurrency systems develop differentapproaches to solving these problems. Even assuming the space is long-term successful, thereis large uncertainty about the long-term value of individual systems.The value of these systems depends on network effects: value changes in a nonlinear way asnew participants join. In concrete terms, the more people who use the system, the more likelyit can be used to fulfill a given real world transaction. The success of a cryptocurrency relieson a mass of agents–e.g., consumers, businesses, and/or financial institutions–adopting thesystem for economic transactions and value storage. Which systems will achieve this adoptionis highly uncertainty, and so current cryptocurrency positions are very speculative bets on newtechnology. Further, cryptocurrency markets face limited liquidity and market manipulation. Inaddition, the decentralized control and privacy features of cryptocurrencies can be at odds withdesires of governments, which introduces further uncertainty around attempted interventionsin the space.These uncertainties drive price volatility, which feeds back into fundamental usability prob-lems. It makes cryptocurrencies unusable as short-term stores of value and means of payment,which increases the barriers to adoption. Indeed, today we see that most cryptocurrency trans-actions represent speculative investment as opposed to typical economic activity.
Stablecoins
Stablecoins aim to bootstrap price stability into cryptocurrencies as a stop-gapmeasure for adoption. Current projects take one of two forms: • Custodial stablecoins rely on trusted institutions to hold reserve assets off-chain (e.g.,$1 per coin). This introduces counterparty risk that cryptocurrencies otherwise solve. • Noncustodial (or decentralized) stablecoins create on-chain risk transfer marketsvia complex systems of algorithmic financial contracts backed by volatile cryptoassets.We focus on noncustodial stablecoins and, more generally, the stable asset and risk transfermarkets that they represent. Noncustodial systems are not well understood whereas custo-dial stablecoins can be interpreted using existing well-developed financial literature. Further,noncustodial stablecoins operate in the public/permissionless blockchain setting, in which anyagent can participate. In this setting, malicious agents can participate in stablecoin systems.As we will see, this can introduce new economic attacks.
The noncustodial stablecoins that we consider create systems of contracts on-chain with thefollowing features encoded in the protocol. We refer to these as
DStablecoins . • Risk is transferred from stablecoin holders to speculators. Stablecoin holders receivea form of price insurance whereas speculators expect a risky return from a leveragedposition. • Collateral is held in the form of cryptoassets, which backs the stable and risky positions. • An oracle provides pricing information from off-chain markets. • A dynamic deleveraging process balances positions if collateral value deviates too much. • Agents can change their positions through some pre-defined process. ‘Leverage’ means that the speculator holds > × their initial assets but faces new liabilities. There are also other non-collateralized (or algorithmic ) stablecoins–fora discussion of these, see [4]. We don’t consider these directly in this paper; however, we discussin Section 7 how our model can accommodate these systems as well.
Contract for difference
Two parties enter an overcollateralized contract, in which the spec-ulator pays the buyer the difference (possibly negative) between the current value of a riskyasset and its value at contract termination. For example, a buyer might enter 1 Ether intothe contract and a speculator might enter 1 Ether as collateral. At termination, the contractEther is used to pay the buyer the original dollar value of the 1 Ether at the time of entry. Anyexcess goes to the speculator. If the contract approaches undercollateralization (if Ether priceplummets), the buyer can trigger early settlement or the speculator can add more collateral.
Variants on contracts for difference
DStablecoins differ from basic contracts for differencein that (1) the contracts are multi-period and agents can change their positions over time, (2)the positions are dynamically deleveraged according to the protocol, and (3) settlement timesare random and dependent on the protocol and agent decisions. The typical mechanics of thesecontracts are as follows: • Speculators lock cryptoassets in a smart contract, after which they can create new sta-blecoins as liabilities against their collateral up to a threshold. These stablecoins are soldto stablecoin holders for additional cryptoassets, thus leveraging their positions. • At any time, if the collateralization threshold is surpassed, the system attempts to liqui-date the speculator’s collateral to repurchase stablecoins/reduce leverage. • The stablecoin price target is provided by an oracle. The target is maintained by adynamic coin supply based on an ‘arbitrage’ idea. Notably, this is not true arbitrage asit is based on assumptions about the future value of the collateral. – If price is above target, speculators have increased incentive to create new coins andsell them at the ‘premium price’. – If price is below target, speculators have increased incentive to repurchase coins(reducing supply) to decrease leverage ‘at a discount’. • Stablecoins are redeemable for collateral through some process. This can take the form ofglobal settlement, in which stakeholders can vote to liquidate the entire system, or directredemption for individual coins. Settlement can take 24 hours-1 week. • Additionally, the system may be able to sell new ownership/decision-making shares as alast attempt to recapitalize a failing system – e.g., the role of MKR in Dai (see [17]). Intuitively, these are like collateralized debt obligations (CDOs) with the important addition of dynamicdeleveraging according to the rules of the protocol. As we will see, it is critical to understand deleveragingspirals as they affect the senior tranches. Intuitively, this is similar to a forward contract except that the price is only fixed in fiat terms while payoutis in the units of the underlying collateral. r i c e ( U S D ) h V o l NuBits Charts
Jan '15 Jul '15 Jan '16 Jul '16 Jan '17 Jul '17 Jan '18 Jul '182015 2016 2017 2018 $0$0.500000$1.000
Zoom 1d 7d 1m 3m 1y YTD
ALL
From Sep 24, 2014 To Dec 12, 2018
Market Cap Price (USD) Price (BTC) 24h Vol coinmarketcap.com (a) NuBits trades at cents on the dollar. P r i c e ( U S D ) h V o l bitUSD Charts
17. Sep 1. Oct 15. Oct 29. Oct 12. Nov 26. Nov 10. Dec2016 2018 $0.600000$0.800000$1.000
Zoom 1d 7d 1m
1y YTD ALL From Sep 12, 2018 To Dec 12, 2018
Market Cap Price (USD) Price (BTC) Price (BTS) 24h Vol coinmarketcap.com (b) BitUSD has broken its USD peg.
Figure 1: Depeggings in decentralized stablecoins.
DStablecoin risks
DStablecoins face two substantial risks:1. Risk of market collapse,2. Oracle/governance manipulation.Our model in this paper focuses on market collapse risk. We further remark on oracle/governancemanipulation in Section 7.
Existing DStablecoins
Examples of noncustodial stablecoins include Dai and bitUSD (aswell as other BitShares Market Pegged Assets). In Steem Dollars, Steem market cap is essen-tially collateral. Steem dollars can be redeemed for $1 worth of newly minted Steem, and soredemptions affect all Steem holders via inflation. Notably, unlike custodial stablecoins, Daiis not currently considered as emoney or payment method subject to the Payment ServicesDirective in the European Union since there is no single issuer or custodian. Thus it does nothave AML/KYC requirements.In an academic white paper, [5] proposed a variation on cryptocurrency-collateralized DStable-coin design. It standardizes the speculative positions by restricting leverage to pre-definedbounds using automated resets. A consequence of these leverage resets is that stablecoin hold-ers are partially liquidated from their positions during downward resets–i.e., when leverage risesabove the allowed band due to a cryptocurrency price crash. This compares with Dai, in whichstablecoin holders are only liquidated in global settlement. An effect of this difference is that,in order to maintain a stablecoin position in the short-term, stablecoin holders need to re-buyinto stablecoins (at a possibly inflated price) after downward resets. Of the many designs, it isunclear which deleveraging method would lead to a system that survives longer. This motivatesus to study the dynamics of DStablecoin systems.Noncustodial stablecoins have faced surprising levels of volatility and failure. As discussedin [11], Nubits has traded at cents on the dollar since 2018 (Figure 1a), and bitUSD and SteemDollars have broken their USD pegs periodically (Figure 1b). Since releasing the original formof this paper, massive liquidation events around Black Thursday in March 2020 resulted in asubstantial depegging in Dai [16]. Despite these problems, there is a large interest to developnew noncustodial stablecoins. For instance, Basis raised $133m in 2018 (although it has sinceclosed down), two other projects raised $32m each, and many other projects raised severalmillion [4]. 4 .2 Relation to prior work
Stablecoins are active cryptocurrencies, for which pre-existing models do not understand howthe collateral rule enforces stability and how the interaction of different agents can affect sta-bility.With the notable exception of [5], rigorous mathematical work on noncustodial stablecoinsis lacking. They applied option pricing theory to valuing tranches in their proposed DStablecoindesign using advanced PDE methods. In doing so, they need the simplifying assumption thatDStablecoin payouts (e.g., from interest/fee payments and liquidations from leverage resets) areexogenously stable with respect to USD. This may circularly cause stability. In reality, thesepayouts are made in volatile cryptocurrency (ETH). From these ETH payments, stablecoinholders can1. Hold ETH and so take on ETH exposure,2. Use the ETH to re-buy into stablecoin, likely at an inflated price as it endogenouslyincreases demand after a supply contraction,3. Convert the ETH to fiat, which requires waiting for block confirmations in an exchange(possibly hours) during times when ETH is particularly volatile and paying costs for fiatconversion (fees, potentially taxes). Notably, this is not available in all jurisdictions.To maintain a DStablecoin position, stablecoin holders need to re-buy into DStablecoins ateach reset at endogenously higher price. Stablecoin holders additionally face the risk that thesize of the DStablecoin market collapses such that the position cannot be maintained (and soends up holding ETH). As no stable asset models exist to understand these endogenous effects,the analysis can’t be easily extended using the traditional financial literature. Our focus inthis paper is complementary to understand these endogenous stable asset effects.[14] studied the evolution of custodial stablecoins.In the context of central counterparty clearinghouses, the default fund contributions, marginrequirements and participation incentives have been studied in, e.g., [6], [1], and [8]. Thecritical question in this area is understanding the effects of a liquidation policy of a member’sportfolio in the case of a significant event. The counterpart of this in a decentralized setting isunderstanding the impact of DStablecoin deleveraging on system stability.Stablecoin holders bear some resemblance to agents in currency peg and international financemodels, e.g., [18] and [9]. In these models, the market maker is essentially the government butis modeled with mechanical behavior and is not a player in the game. For instance, in [9],devaluation is modeled by a simple exogenous threshold rule: the government abandons thepeg if the net demand for currency breaches the threshold and is otherwise committed tomaintaining the peg. In contrast to currency markets, no agents are committed to maintainingthe peg in DStablecoin markets. The best we can hope is that the protocol is well-designedand that the peg is maintained with high probability through the protocol’s incentives. Therole of government is replaced by decentralized speculators, who issue and withdraw stablecoinsin a way to optimize profit. A fully strategic model would be a complicated dynamic game–these tend to be intractable and, indeed, are avoided in the currency peg literature in favorof a sequence of one period games. We enable a more endogenous modeling of speculators’optimization problems under a variety of risk constraints. Our model is a sequence of one-period optimization problems, in which dynamic coupling comes through the risk constraints. A secondary issue with their continuous model is that these systems are inherently discontinuous due tothe discrete nature of incorporating blockchain transactions into blocks. Thus resets can occur beyond the setthresholds.
We develop a dynamic model for noncustodial stablecoins that is complex enough to take intoaccount the feedback effects discussed above and yet remains tractable. Our model can beinterpreted as a market microstructure model in this new type of asset market.Our model involves agents with different risk profiles; some desire to hold stablecoins andothers speculate on the market. These agents solve optimization problems consistent with awide array of documented market behaviors and well-defined financial objectives. As is commonin the literature on market microstructure and currency peg games, these agents’ objectivesare myopic. These objectives are coupled for non-myopic risk using a flexible class of rules thatare widely established in financial markets; these allow us to model the effects of a range ofcyclic and counter-cyclic behaviors. The exact form of these rules is selected and self-imposedby speculators to match their desired responses and not part of the stablecoin protocol. Thuswell-established manipulation of similar rules as applied to traditional financial regulation isnot a problem here. Our model goes largely beyond a one-period model. We introduce thismodel with supporting rationale for design choices in Section 2.Using our model, we make the following contributions: • We derive fundamental results bout dynamics and liquidity in our model (Section3). • We demonstrate that stablecoins face deleveraging feedback effects that may cause illiq-uidity during crises and exacerbate collateral drawdown (Section 3.3). • We characterize stable dynamics of the system under certain conditions that guaranteeno liquidity crash (Section 4) and show instability can occur in simulations outside of thissetting (Section 4.2). • We simulate a wide range of market behaviors and find that speculator behavior has alarge effect on realized volatilities, but that stablecoin failure times are largely determinedby underlying asset movements (Section 5). • We describe new attacks that exploit arbitrage-like opportunities around stablecoin liq-uidations (Section 6)We relate these results to historicla stablecoin events, apply these insights to suggest designimprovements that aim to improve long-term stability. Based on these insights, we also sug-gest that interactions between multiple speculators and attackers may be the most interestingrelationships to explore in more complex models.6
Model
Our model couples a number of variables of interest in a risk transfer market between stablecoinholders and speculators. The stablecoin protocol dictates the logic of how agents can interactwith the smart contracts that form the system; the design of this influences how the marketplays out. Many DStablecoin designs have been proposed. We set up our model to emulate aDStablecoin protocol like Dai with global settlement, but the model is adaptable to differentdesign choices. Note that our model is formulated with very few parameters given the problemcomplexity.Our model builds on the model of traditional financial markets in [2] but is new in design byincorporating endogenous stablecoin structure. In the model, we assume that the underlyingconsensus layer (e.g., blockchain) works well to confirm transactions without censorship orattack and that the system of contracts executes as intended.
Agents
Two agents participate in the market. • The stablecoin holder seeks stability and chooses a portfolio to achieve this. • The speculator chooses leverage in a speculative position behind the DStablecoin.Stablecoin holders are motivated by risk aversion, trade limitations, and budget constraints.They are inherently willing to hold cryptoassets. In the current setting, this means they arelikely either traders looking for short-term stability, users from countries with unstable fiatcurrencies, or users who are using cryptocurrencies to move money across borders. In the future,cryptocurrencies may be more accepted in economic exchange. In this case, stablecoin holdersmay be ordinary consumers who face risk aversion and budgeting for required consumption.Speculators are motivated by (1) access to leverage and (2) security lending to borrowagainst their Ether holdings without triggering tax incidence or giving up Ether ownership.In order to begin participating, speculators need to either have confidence in the future ofcryptocurrencies, think they can make money trading the markets, or face unusually high taxrates (or other barriers) that make security lending cheaper than outright selling assets. Themodel in this paper focuses on the first motivation. We propose an extension to the model thatconsiders the second motivation.
Assets
There are two assets. For simplicity, we give these assets specific names; however,they could be abstracted to other cryptocurrencies or outside of a cryptocurrency setting. • Ether : high risk asset whose USD market prices p Et are exogenous • DStablecoin : a ‘stable’ asset collateralized in Ether whose USD price p Dt is endogenousNotably, a large DStablecoin system may have endogenous amplification effects on Etherprice, similarly to how CDOs affected underlying assets in the 2008 financial crisis. We discussthis further in Section 7 but leave formal modeling of this to future work.There are several barriers for trading between crypto and fiat, which motivate our choiceof assets. Most crypto-fiat pairs are through Bitcoin or Ether, which act as a gateway to othercryptoassets. Trading to fiat can involve moving assets between a number of exchanges and cantake considerable time to confirm on the blockchain. Trading to a stablecoin is comparativelysimple. Trading to fiat can also trigger more clear tax incidence. Additionally, some countrieshave imposed strict capital controls on trading between fiat and crypto.7 odel outline At t = 0, the agents have endowments and prior beliefs. In each period t :1. New Ether price is revealed2. Ether expectations are updated3. Stablecoin holder decides portfolio weights4. Speculator, seeing demand, decides leverage5. DStablecoin market is cleared The stablecoin holder starts with an initial endowment and decides portfolio weights to attainthe desired stability. The following table defines the agent’s state variables.
Variable Definition ¯ n t Ether held at time t ¯ m t DStablecoin held at time t w t Portfolio weights chosen at time t The stablecoin holder weights its portfolio by w t . We denote the components as w Et and w Dt for Ether and DStablecoin weights respectively. The stablecoin holder’s portfolio value attime t is A t = ¯ n t p Et + ¯ m t p Dt = ¯ n t − p Et + ¯ m t − p Dt . Given weights, ¯ n t and ¯ m t will be determined based on the stablecoin clearing price p Dt .The basic results in Section 3 hold generally for any w t ≥ w t could be chosen, e.g., from Sharpe ratio optimization, mean-variance optimization, orKelly criterion (among others). In Sections 4 & 5, in order to focus on the effects of speculatordecisions, we simplify the stablecoin holder as exogenous with unit price-elastic demand. Inthis case, DStablecoin demand is constant in dollar terms. The speculator starts with an endowment of Ether and initial beliefs about Ether’s returns andvariance and decides leverage to maximize expected returns subject to protocol and self-imposedconstraints. The following table defines variables and parameters for the speculator.
Variable Definition n t Ether held at time tr t Expected return of Ether at time tσ t Expected variance of Ether at time t L t Total stablecoins issued at time t ∆ t Change to stablecoin supply at time t ˜ λ t Leverage bound at time t Parameter Definition γ Memory parameter for return estimation δ Memory parameter for variance estimation β Collateral liquidation threshold α Inverse measure of riskiness b Cyclicality parameter8 .2.1 Ether expectations
The speculator updates expected returns r t , log-returns µ t (used for the variance estimation),and variance σ t based on observed Ether returns as follows: r t = (1 − γ ) r t − + γ p Et p Et − ,µ t = (1 − δ ) µ t − + δ log p Et p Et − ,σ t = (1 − δ ) σ t − + δ (cid:16) log p Et p Et − − µ t (cid:17) . (1)For fixed memory parameters γ, δ (lower memory parameter = longer memory), these are ex-ponential moving averages consistent with the RiskMetrics approach commonly used in finance[15]. For sufficiently stepwise decreasing memory levels and assuming i.i.d. returns, this processwill converge to the true values supposing they are well-defined and finite. In reality, specula-tors don’t outright know the Ether return distribution and, as we will see in the simulations,the stablecoin system dynamics occur on timescales shorter than required for convergence ofexpectations. Thus, we focus on the simpler case of fixed memory parameters.Note that γ (cid:54) = δ may be reasonable. Current cryptocurrency markets are not very priceefficient, and so traders might reasonably take into account momentum when estimating returnswhile using a wider memory for estimating covariance.We additionally consider the case in which the speculator knows the Ether distributionoutright and γ = δ = 0. This is consistent with a rational expectations standpoint but ignoreshow the speculator arrives at that knowledge. ∆ t The speculator is liable for L t DStablecoins at time t . At each time t , it decides the number ofDStablecoins to create or repurchase. This changes the stablecoin supply L t = L t − + ∆ t . If∆ t >
0, the speculator creates and sells new DStablecoin in exchange for Ether at the clearingprice. If ∆ t <
0, the speculator repurchases DStablecoin at the clearing price.Strictly speaking, the speculator will want to maximize its long-term withdrawable value.At time t , the speculator’s withdrawable value is the value of its ETH holdings minus collateralrequired for any issued stablecoins: n t p Et − β L t . Maximizing this is not amenable to a myopicview, however, as maximizing the next step’s withdrawable value is only a good choice whenthe speculator intends to exit in the next step.Instead, we frame the speculator’s objective as maximizing expected equity: n t p Et − E [ p D ] L t .In this, the speculator expects to be able to settle liabilities at a long-term expected value of E [ p D ]. The market price of DStablecoin will fluctuate above and below $1 naturally dependingon prevailing market conditions. The actual expected value is nontrivial to compute as itdepends on the stability of the DStablecoin system. For individual speculators with smallmarket power, we argue that E [ p D ] = 1 is a an assumption they may realistically make, as wediscuss further below. This is additionally the value realized in the event of global settlement.We suggest that this optimization is a candidate for ‘honest’ behavior of a speculator as itis consistent with the speculator acting on perceived arbitrage in mispricings of DStablecoinfrom the peg. In essence, the speculator expects to increase (reduce) leverage ‘at a discount’when p Dt is above (below) target. This is the typically cited mechanism by which these systemsmaintain their peg and thus how the designers intend for speculators to behave. However, this9ssumes that p Dt is sufficiently stable/mean-reverting to $1 and so this behavior may not infact be a best response. Aggregate vs. individual speculators
In our model, the single speculative agent, which isnot a price-taker, is intended to reflect the aggregate behavior of many individual speculators,each with small market power. In a normal liquid market, an individual speculator would beable to repurchase DStablecoins at dollar cost and walk away with the equity. By maximizingequity, the aggregate speculator considers its liabilities to be $1 per DStablecoin. This may turnout to be untrue during liquidity crises as the repurchase price may be higher. In our model,speculator’s don’t know the probability of crises and instead account for this in a conservativerisk constraint.
Formal optimization problem
The speculator chooses ∆ t by maximizing expected equityin the next period subject to a leverage constraint:max ∆ t r t (cid:16) n t − p Et + ∆ t p Dt ( L t ) (cid:17) − L t s.t. ∆ t ∈ F t where F t is the feasible set for the leverage constraint. This is composed of two separateconstraints: (1) a liquidation constraint that is fundamental to the protocol, and (2) a riskconstraint that encodes the speculator’s desired behavior. Both are introduced below.If the leverage constraint is unachievable, we assume the speculator enters a ‘recovery mode’,in which it tries to maximize its chances of returning to the normal setting. In this case, itsolves the optimization using only the liquidation constraint. If the liquidation constraint isunachievable, the DStablecoin system fails with a global settlement. The liquidation constraint is fundamental to the DStablecoin protocol. A speculator’s positionundergoes forced liquidation at time t if either (1) after p Et is revealed, n t − p Et < β L t − , or(2) after ∆ t is executed, n t p Et < β L t . The speculator aims to control against this as liquidationscan occur at unfavorable prices and are associated with fees in existing protocols (we excludethese fees from our simple model, but they can be easily added).Define the speculator’s leverage as the β -weighted ratio of liabilities to assets λ t = β · liabilitiesassets . The liquidation constraint is then λ t ≤ The risk constraint encodes the speculator’s desired behavior into the model.
We assumeno specific type for the risk constraint in our analytical results, which are generic.
For oursimulations, we explore a variety of speculator behaviors via the risk constraint. We firstconsider Value-at-Risk (VaR) as an example of a constraint realistically used in markets. This We propose to relax this simplification in follow-up work by considering the interaction of many speculatorswith longer term strategic thinking. We choose this definition to simplify the model. The alternative definition λ (cid:48) = assetsassets − β · liabilities describesthe same idea scaled from 0 to ∞ . I.e., λ (cid:48) = − λ is monotonically increasing in λ for 0 ≤ λ (cid:48) <
10s consistent with narratives shared by Dai speculators about leaving a margin of safety to avoidliquidations. We then construct a generalization that goes well beyond VaR and allows us toexplore a spectrum of pro-cyclical and counter-cyclical behaviors encoded in the risk constraint.Manipulation and instability resulting from similar externally-imposed
VaR rules is a well-known problem in the risk management and financial regulatory literature (see e.g., [2]). Thisis of less concern here as the precise parameters of the risk constraint are selected and self-imposed by speculators to approximate their own utility optimization and are not part of theDStablecoin protocol. Further, we consider constraints that go beyond VaR . We instead needto show that our results are robust to a variety of risk constraints that speculators could select.
Example: VaR-based constraint
The VaR-based version of the risk constraint is λ t ≤ exp( µ t − ασ t ) , where α > a,t be the a -quantile per-dollar VaR of the speculator’s holdings at time t . This isthe minimum loss on a dollar in an a -quantile event. With a VaR constraint, the speculatoraims to avoid triggering the liquidation constraint in the next period with probability 1 − a ,i.e., P (cid:16) n t p Et +1 ≥ β L t (cid:17) ≥ − a. To achieve this, the speculator chooses ∆ t such that (cid:16) n t − p Et + ∆ t p Dt ( L t ) (cid:17) (1 − VaR a,t ) ≥ β L t . This requires λ t ≤ − VaR a,t , which addresses the probability that the liquidation constraintis satisfied next period and implies that it is satisfied this period.Define ˜ λ t := exp( µ t − ασ t ). Then ˜ λ t is increasing in µ t and decreasing in σ t . Further, thefatter the speculator thinks the tails of the return distribution are, the greater α will be, andthe lesser ˜ λ t will be, as we demonstrate next. VaR constraint with normal returns
If the speculator assumes Ether log returns are( µ t , σ t ) normal, then VaR a,t = 1 − exp (cid:16) µ t + √ σ t erf − (2 a − (cid:17) . Defining α = −√ − (2 a − a , the VaR constraint is λ t ≤ − VaR a,t = exp( µ t − ασ t ) . VaR constraint with heavy tails
If Ether log returns X are symmetrically distributedwith finite mean µ t and finite variance σ t , then for any α >
1, Chebyshev’s inequality gives us P ( X < µ t − ασ t ) ≤ α . For the maximally heavy-tailed case, this inequality is tight. Then for VaR quantile a , we canfind the corresponding α such that a = α . The log return VaR is µ t − ασ t , which gives theper-dollar VaR a,t = 1 − exp( µ t − ασ t ). Then the VaR constraint is λ t ≤ exp( µ t − ασ t ). Generalized risk constraint
Similarly to [2], we can generalize the bound to explore aspectrum of different behaviors: ln ˜ λ = µ t − ασ bt , where α is an inverse measure of riskiness and b is a cyclicality parameter. A positive b meansthat ˜ λ t decreases with perceived risk (pro-cyclical). A negative b means that ˜ λ t increases withperceived risk (counter-cyclical). 11 .3 DStablecoin market clearing The DStablecoin market clears by setting demand = supply in dollar terms: w Dt (cid:16) ¯ n t − p Et + ¯ m t − p Dt ( L t ) (cid:17) = L t p Dt ( L t ) . The demand (left-hand side) comes from the stablecoin holder’s portfolio weight and assetvalue. Notice that while the asset value depends on p Dt , the portfolio weight w Dt does not.That is, the stablecoin holder buys with market orders based on weight. This simplificationallows for a tractable market clearing; however, it is not a full equilibrium model.We justify this choice of simplified market clearing with the following observations: • The clearing is similar to constant product market maker model used in the Uniswapdecentralized exchange (DEX) [23]. • Sophisticated agents are known to be able to front-run DEX transactions [7]. As specula-tors are likely more sophisticated than ordinary stablecoin holders, in many circumstancesthey can see demand before making supply decisions. • Evidence from Steem Dollars suggests that demand need not decrease tremendously withprice in the unique setting in which stable assets are not efficiently available. SteemDollars is a stablecoin with a mechanism for price ‘floor’ but not ‘ceiling’. Over significantstretches of time, it has traded at premiums of up to 15 × target.In most of our results, the time period context is clear. To simplify notation, in a giventime t , we drop subscripts and write with the following quantities: Quantity Sign Interpretation x := w Dt ¯ n t − p Et x ≥ y := w Dt ¯ m t − − L t − y ≤ | y | = ‘free supply’ in DStablecoin market z := n t − p Et z ≥ L := L t − ∆ := ∆ t ˜ λ := ˜ λ t w := w t With ∆ > y , which turns out to be always true as discussed later, the clearing price is p Dt (∆) = x ∆ − y . As the model is defined thus far, stablecoin holders only redeem coins for collateral throughglobal settlement. However, this assumption is easily relaxed to accommodate algorithmic ormanual settlements.
We derive tractable solutions to the proposed interactions and results about liquidity andstability. This said, DEX mechanics differ slightly from our specific formulation. To make the model more realistic,stablecoin holders could issue buy offers in token units instead of weights at the expense of greater modelcomplexity. .1 Solution to the speculator’s decision We first introduce some basic results about the speculator’s leverage optimization problem.
Solving the leverage constraintProp. 1.
Let ∆ min ≥ ∆ max be the roots of the polynomial in ∆ − β ∆ + ∆ (cid:16) ˜ λ ( z + x ) − β ( L − y ) (cid:17) − ˜ λzy + β L y. Assuming ∆ > y , • If ∆ min , ∆ max ∈ R , then [∆ min , ∆ max ] ∩ ( y, ∞ ) is the feasible set for the leverage constraint. • If the roots are not real, then the constraint is unachievable. [Link to Proof]
Setting ˜ λ = 1 gives the expression for the liquidation constraint alone.The condition ∆ > y makes sense for two reasons. First, if ∆ < y then p Dt <
0. Second, aswe show below, the limit lim ∆ → y + p Dt = ∞ . Thus, if we start in the previous step under thecondition ∆ > y , then the speculator will never be able to pierce this boundary in subsequentsteps. We further discuss the implications of this condition later. Solving the leverage optimizationProp. 2.
Assume that the speculator’s constraint is feasible and let [∆ min , ∆ max ] ∩ ( y, ∞ ) bethe feasible region. Define r := r t , let ∆ ∗ = y + √− yrx , and define f (∆) = r ∆ x ∆ − y − ∆ . Then the solution to the speculator’s optimization problem is • ∆ ∗ if ∆ ∗ ∈ [∆ min , ∆ max ] ∩ ( y, ∞ ) • ∆ min if ∆ ∗ < ∆ min • ∆ max if ∆ ∗ > ∆ max [Link to Proof] The next result describes a bound to the speculator’s ability to maintain the market. Thisbound takes the form of(a lower bound on collateral) - (capital available to enter the market),which must be sufficiently high for the system to be maintainable.
Prop. 3.
The feasible set for the speculator’s liquidation constraint is empty when (cid:16) ˜ λ ( x + z ) − β L w D (cid:17) < β ˜ λ L xw E Link to Proof]
In Prop. 3, β L w D ≥ λ ∈ [0 , x + z ≥ < y implies that the case of the negative difference does not work. Limits to the speculator’s ability to decrease leverage
The next result presents a fun-damental limit to how quickly the speculator can reduce leverage by repurchasing DStablecoins,given the modeled market structure. Note that this limit applies even if the speculator can bringin additional capital. The term − y = L (1 − w D ) represents the ‘free supply’ of DStablecoinavailable for exchange, which can be increased by a positive ∆. Prop. 4.
The speculator with asset value z cannot decrease DStablecoin supply at t more than ∆ − := zz + x y. Further, even with additional capital, the speculator cannot decrease the DStablecoin supply at t by more than y . [Link to Proof] Deleveraging affects collateral drawdown through liquidity crises
The result leadsto a DStablecoin market price effect from leverage reduction. This can lead to a deleveragingspiral , which is a feedback loop in leverage reduction and drying liquidity. In this, the spec-ulator repurchases DStablecoin to reduce leverage at increasing prices as liquidity dries up asrepurchase tends to push up p Dt if outside demand remains the same. At higher prices, morecollateral needs to be sold to achieve deleveraging, leaving relatively less in the system. Sub-sequent deleveraging, whether voluntary or through liquidation, becomes more difficult as theprice effects compound.Whether or not a spiraling effect occurs will depend on the demand behavior of stablecoinholders. The action of the stablecoin holder may actually exacerbate this effect: during extremeEther price crashes, stablecoin holders will tend to increase their DStablecoin demand in a ‘flightto safety’ move. Table 1 illustrates an example scenario of a deleveraging spiral in a simplifiedsetting with constant unit demand elasticity and in which the speculator’s risk constraint isthe liquidation constraint. Similar results hold under other constant demand elasticities. Thesystem starts in a steady state. the Ether price declines trigger three waves of liquidations,forcing the speculator to liquidate her collateral to deleverage at rising costs.If Ether prices continue to go down, the deleveraging spiral is only fixed if (1) more moneycomes into the collateral pool to create more DStablecoins, or (2) people lose faith in thesystem and no longer want to hold DStablecoins, which can cause the system to fail. There isno guarantee that (1) always happens.This liquidity effect on DStablecoin price makes sense because the stablecoin (as long asit’s working) should be worth more than the same dollar amount of ETH during a downturn Ether price decline can further be facilitated by feedback from large liquidations, as discussed earlier. p Et ∆ t L t p Dt n t .
583 0 .
994 1 .
81 83 − .
115 97 .
468 1 .
026 1 . − .
105 93 .
363 1 .
071 1 . − .
57 88 .
793 1 .
126 1 . M a r k e t C a p P r i c e ( U S D ) h V o l Dai Charts
14. Nov 18. Nov 22. Nov 26. Nov 30. Nov 4. Dec 8. Dec 12. DecJan '18 May '18 Sep '18$50M$60M$70M $0.960000$1.00$1.040
Zoom 1d 7d
3m 1y YTD ALL From Nov 12, 2018 To Dec 12, 2018
Market Cap Price (USD) Price (BTC) Price (ETH) 24h Vol coinmarketcap.com (a) (b)
Figure 2: Model Results explain data from Dai market. (a) Dai deleveraging feedback in Nov-Dec 2018 (image from coinmarketcap). (b) Dai normally trades below target with spikes inprice due to liquidations (image from dai.stablecoin.science).because the stablecoin comes with additional protection. If the speculator is forced to buy backa sizeable amount of the coin supply, it will have to do so at a premium price.One might think the spiral effect is good for stablecoin holders. As we explore in Section 6,this can be the case for a short-term trade. However, as we will see, the speculator’s ability tomaintain a stable system may deteriorate during these sort of events as it has less control orless willingness to control the coin supply. Deleveraging effects can siphon off collateral value,which can be detrimental to the system in the long-term.This suggests the question: do alternative non-custodial designs suffer similar deleveragingproblems? We compare to an alternative design described in [5]. In this design, the stablecoinis restricted to pre-defined leverage bounds, at which algorithmic ‘resets’ partially liquidateboth stablecoin holder and speculator positions at $1 price. While this quells the price effect oncollateral, it shifts the deleveraging risk from speculator to stablecoin holder. The stablecoinholder is liquidated at $1 price but, if they want to maintain a stablecoin position, they haveto re-buy in to a smaller market at inflated price. Of the many designs, it is unclear whichdeleveraging method would lead to a system that survives longer.
Results explain real market data
A preliminary analysis of Dai market data suggeststhat our results apply. Figure 2a shows the Dai price appreciate in Nov-Dec 2018 duringmultiple large supply decreases. This is consistent with an early phase of a deleveraging spiral.Figure 2b shows trading data from multiple DEXs over Jan-Feb 2019: price spikes occur inthe data reportedly from speculator liquidations [21]. This provides empirical evidence thatliquidity is indeed limited for lowering leverage in Dai markets. Further, as discussed in thenext section, Dai empirically trades below target in many normal circumstances.Since releasing the original form of this paper in June 2019, massive liquidation eventsaround Black Thursday in March 2020 provide additional evidence of deleveraging effects inthe Dai market. Figure 3a depicts a ∼
50% ETH price cash on 12 Mar. 2020, which precipitateda cascade of cryptocurrency liquidations. Figure 3b depicts the price effects of these liquidations15 a) (b)
Figure 3: Black Thursday in March 2020. (a) ∼
50% ETH price crash (image from On-ChainFX). (b) liquidation price effect on Dai DEX trades (image from dai.stablecoin.science).on Dai prices on DEXs. Speculators deleveraging during this event had to pay premiums of ∼
10% and face consistent premiums >
2% weeks into the aftermath. See [12] for furtherdiscussion of this event.
We now characterize stable price dynamics of DStablecoins when the leverage constraint isnon-binding. For this section, we make the following simplifications to focus on speculatorbehavior: • The market has fixed dollar demand at each t : w Dt A t = D . This is consistent with thestablecoin holder having unit-elastic demand, or having an exogenous constraint to put afixed amount of wealth in the stable asset. • Speculator’s expected Ether return is constant r t = ˆ r >
1. This means they always wantto fully participate in the market and is consistent with γ = 0.This is like setting x = D and y = −L . Now the DStablecoin market clearing price is p Dt = DL t . The leverage constraint (assuming L + ∆ >
0) becomes − β ∆ + ∆(˜ λ ( z + D ) − β L ) + L (˜ λz − β − β L ) ≥ . The speculator’s maximization objective becomes ˆ r ∆ DL +∆ − ∆ , which gives∆ ∗ = −L + √LD ˆ r. While we prove a stability result in this simplified setting, we believe the results can beextended beyond the assumption of constant unit-elastic demand.
Prop. 5.
Assume w Dt A t = D (DStablecoin dollar demand) and r t = ˆ r (speculator’s expectedEther return) remain constant. If the leverage constraint is inactive at time t , then the DStable-coin return is p Dt p Dt − = (cid:114) LD ˆ r . [Link to Proof] D ≈ L (i.e., the previous price was close to the $1 target) and the constraintis inactive, Prop. 5 tells us that the DStablecoin behaves stably like the payment of a couponon a bond.Consider estimators for DStablecoin log returns ¯ µ t and volatility ¯ σ t computed in a similarway to Ether expectations in Eq. 2.2.1. When the leverage constraint is non-binding, DStable-coin log returns remain ¯ µ t ≈
0, the contribution to volatility at time t is ln p Dt p Dt − − ¯ µ t ≈
0, andthe DStablecoin tends toward a steady state with stable price and zero variability. The nexttheorem formalizes this result to describe stable dynamics of price and the volatility estimatorunder the condition that the system doesn’t breach the speculator’s leverage threshold.
Theorem 1.
Assume w Dt A t = D (DStablecoin demand) and r t = ˆ r (speculator’s expectedEther return) remain constant. Let L = D and ¯ µ , ¯ σ be given. If the leverage constraintremains inactive through time t , then L t = D ˆ r t − t , ¯ µ t = (1 − δ ) t ¯ µ − δ (1 − δ ) t − − t − δ ) − ln ˆ r, if δ (cid:54) = 1 / − t (cid:16) ¯ µ − t ln ˆ r (cid:17) , if δ = 1 / σ t = (cid:80) tk =1 (1 − δ ) t − k δ (cid:16) (1 − δ ) k ¯ µ − (1 − δ ) k − − k +1 (1 − δ )2(1 − δ ) − ln ˆ r (cid:17) + (1 − δ ) t ¯ σ , if δ (cid:54) = 1 / − t (cid:80) tk =1 − k − (cid:16) ( k/ −
1) ln ˆ r − ¯ µ (cid:17) + 2 − t ¯ σ , if δ = 1 / Further, assuming the constraint continues to be inactive and that δ ≤ , the system convergesexponentially to the steady state L t → D ˆ r , ¯ µ t → , ¯ σ t → . [Link to Proof] Notice that if the leverage constraint in the system is reached, we can still treat the systemas a reset of ¯ µ and ¯ σ when we reach a point at which the constraint is no longer binding.While the system subsequently remains without a binding constraint, we again converge to asteady state starting from the new initial conditions. Interest rates and trading below $1
A consequence of Theorem 1 is that the DStablecoinwill trade below target during times in which Ether expectations are high. This is empiricallyseen in Figure 2b. An interest rate charged to speculators can balance the market (the ‘stabilityfee’ in Dai). This can temper expectations by effectively reducing r in Theorem 1. In the stablesteady state, setting the interest rate to offset the average expected ETH return will achievethe price target. However, this is practically difficult as r changes over time and is difficult tomeasure accurately. It also depends on holding periods of speculators. It is an open questionhow to target these fees in a way that maintains long-term stability. When the speculator’s leverage constraint is binding, DStablecoin price behavior can be moreextreme. We argue informally that this can lead to high volatility in our model. The proba-bility distribution for the leverage constraint to be binding in the next step has a kink at theboundary of the leverage constraint. In particular, it becomes increasingly likely that the lever-age constraint is binding in a subsequent step due to deleveraging effects described previously.Note that feedback of large liquidations on Ether price, if added to the model, will add to thiseffect. 17 −2 −1 D e n s i t y DStablecoin Returns by Constraint ActivityActiveInactive (a) Histogram of DStablecoin returnswhen leverage constraint is binding vs.non-binding with constant ˆ r . V o l a t ili t y ( D a il y ) DStablecoin Volatility vs. Memory ParameterEther volatility70 percentile95 percentile (b) Heat map of volatility under differentspeculator γ = δ memory parameters. Figure 4: DStablecoin volatility, 10k simulation paths of length 1000.We show such instability computationally in Figure 4a in simulation results. In this figure,the shape of the inactive histogram reflects the speculator’s willingness to sell at a slight discountwhen the leverage constraint is non-binding due to the constant ˆ r assumption.We relax this assumption in Figure 4b, which shows the effects on volatility of differentspeculator memory parameters. This figure is a heat map/2D histogram. A histogram over y -values is depicted in the third dimension (color: light=high density, dark=low density) foreach x -value. Each histogram depicts realized volatilities across 10k simulation paths using thesimulation setup introduced in the next section and the given memory parameter ( x -value).Horizontal lines depict selected percentiles in these histograms. The dotted line depicts thehistorical level of Ether volatility for comparison.In Figure 4b, volatility is bounded away from 0 even in non-binding leverage constraintscenarios; the distance increases with the memory parameter. This happens because r updatesfaster with a higher memory parameter. As the speculator’s objective then changes at each step,the steady state itself changes. Thus we expect some nonzero volatility, although it remainslow in most cases.In not-so-rare cases, however, volatility can be on the order of magnitude of actual Ethervolatility in these simulations. As seen in Figure 5, this result is robust to a wide range ofchoices for the speculator’s risk constraint. This suggests that DStablecoins perform well inmedian cases, but are subject to heavy tailed volatility. We now explore simulation results from the model considering a wide range of choices for thespeculator’s risk constraint. Unless otherwise noted, the simulations use the following parameterset with a simplified constant demand assumption ( D = 100) and a t-distribution with df=3 tosimulate Ether log returns. Cryptocurrency returns are well known for having very heavy tails.This choice gives us these heavy tails with finite variance. Note, however, that this doesn’tcapture path dependence of Ether returns. We instead assume Ether returns in each periodare independent. We run simulations on 10k paths of 1000 steps (days) each. This is enoughtime to look at short-term failures and dynamics over time. The simulation code is availableat https://github.com/aklamun/Stablecoin_Deleveraging .18 arameter Value Rationale n
400 4x initial collateralization > typical Dai level r . µ . σ . γ = δ . ∼ Recommended value [15] β . α ∼ .
28 Value assuming normal distr. + a = 0 . b We compare DStablecoin performance under the following speculator behaviors encoded in therisk constraint.
Name Speculator risk constraint
VaRN.1 VaR using a = 0 . a = 0 .
01 + normality assumptionVaRM.1 VaR using a = 0 . a = 0 .
01 + heavy-tailed assumptionAC1 Anti-cyclic constraint, b = − . α = 0 . b = − . α = 0 . aRN.1 VaRN.01 VaRM.1 VaRM.01 AC1 AC2 RN Speculator Risk Management V o l a t ili t y ( D a il y ) DStablecoin Volatility vs. Risk ManagementEther volatility70 percentile95 percentile (a) Ether returns ∼ t-distr(df = 3 , µ = 0) VaRN.1 VaRN.01 VaRM.1 VaRM.01 AC1 AC2 RN
Speculator Risk Management V o l a t ili t y ( D a il y ) DStablecoin Volatility vs. Risk ManagementEther volatility70 percentile99 percentile (b) Ether returns ∼ t-distr(df = 3 , µ = r ) VaRN.1 VaRN.01 VaRM.1 VaRM.01 AC1 AC2 RN
Speculator Risk Management V o l a t ili t y ( D a il y ) DStablecoin Volatility vs. Risk ManagementEther volatility70 percentile95 percentile (c) Ether returns ∼ normal( µ = 0) Figure 5: Heatmaps of DStablecoin volatility for different speculator risk management behav-iors.if there are multiple types of speculators, for instance some that are cyclic and others that arecountercyclic.Figure 4b further suggests that a higher speculator memory parameter (lower memory)tends to increase volatility in typical cases. This makes sense as high memory parameters canlead to noise chasing on the part of the speculator. Note that keeping the speculator’s expectedEther returns and variance constant is equivalent to setting a static risk constraint.
We define the DStablecoin’s failure (or stopping) time to be either (1) when the speculator’sliquidation constraint is unachievable or (2) when the DStablecoin price remains below $0.5USD. In these cases, a global settlement would be reasonable, leaving DStablecoin holders withEther holdings with high volatility in subsequent periods.Figure 6 compares the effects on failure time of these behavioral risk constraints. The stop-ping time distributions appear comparable across a wide range of selections for the speculator’srisk constraint. They are additionally comparable across the memory parameters studied above.Figure 7 depicts relative mean-squared difference of simulated stopping times for the differentrisk management methods vs. a risk neutral speculator. In calculating the mean-squareddifference, we only include cases in which the failure is realized within the simulation. Themean-squared difference is small (1-2 orders of magnitudes smaller than for volatility), provid-ing additional evidence that the stopping time is largely independent of the speculator’s riskmanagement. In particular, a large proportion of failure events would not have been preventedby different speculator risk management within the model.20 aRN.1 VaRN.01 VaRM.1 VaRM.01 AC1 AC2 RN
Speculator Risk Management S t o pp i n g T i m e ( D a y s ) DStablecoin Stopping Time vs. Risk Management20 percentile5 percentile (a) Ether returns ∼ t-distr(df = 3 , µ = 0) VaRN.1 VaRN.01 VaRM.1 VaRM.01 AC1 AC2 RN
Speculator Risk Management S t o pp i n g T i m e ( D a y s ) DStablecoin Stopping Time vs. Risk Management5 percentile1 percentile (b) Ether returns ∼ normal( µ = 0) Figure 6: Heatmaps of DStablecoin failure times for different speculator risk managementbehaviors.
100 VaRN.1 VaRN.01 VaRM.1 VaRM.01 AC1 AC2 R e l a t i v e M S D v s . R N ( l o g s c a l e ) Speculator Risk ManagementSimulation Mean-Squared Difference vs. Risk-Neutral
Vol, tdistr( μ=0)
Vol, tdistr( μ= r0)Vol, normal( μ=0) Stop, tdistr( μ=0)
Stop, tdistr( μ= r0)Stop, normal( μ=0) Volatility Outputs Stopping Time Outputs
Figure 7: Relative mean-squared difference (MSD) of simulated volatility and stopping timefor given speculator strategy vs. risk neutral strategy. Different lines represent different output(volatility or stopping time) and different return distribution assumptions for the simulations.DStablecoin failure probabilities appear to be dominated by Ether returns as opposed tospeculator behavior. The results suggest that DStablecoins may not be long-term stable, evenunder comparatively ‘nice’ assumptions for Ether return distributions. To avoid failure, theywould essentially rely on more speculator capital entering the system during downturns.
Attacking a stablecoin is different than traditional currency attacks. The focus is not onbreaking the willingness of the central bank to maintain a peg. It instead involves manipulatingthe interaction of agents. We show that stablecoin design can enable profitable trades againststability that attack the system. These come from the existence of profitable trades aroundliquidations and the ability of miners to reorder and censor transactions to extract value.21 p Et δ + ε D t ∆ t L t p Dt n t .
583 0 .
994 1 .
81 85 +1 101 0 .
502 101 .
085 0 .
999 1 . − .
716 92 .
369 1 .
093 1 . − .
083 99 .
917 92 .
369 1 .
082 1 . We consider an expanded model under the fixed outside demand setting of the previous section.In the expansion, we consider an attacker, who can speculatively enter/exit the DStablecoinmarket. The attacker can buy δ dollar-value of DStablecoin at some time t with the goal ofselling it at a later time s for δ + ε . These occurrences change the demand structure: D t = D + δ , D s = D − ( δ + ε ). Table 2 illustrates an example scenario for a profitable bet on liquidations. The attacker injects δ = 1 in demand at t = 1, which acquires 1 . p D . In t = 3, after theliquidation, the attacker is then able to extract δ + ε = 1 .
083 from selling the DStablecoin.This yields a return of 8 . δ, ε to maximize ε subject to δ + (cid:15)p D ≤ δp Do . Choosing δ = 4 . , ε = 0 .
59 (not optimal) yields a return of 13%. The attacker could also spread out δ over a longer period of time to achieve lower purchase prices.From a practical perspective, the optimization is sensitive to misestimation of demandelasticity. While Dai has hit prices as high as $1.37 historically (source: coinmarketcap), ithasn’t typically reached prices above $1.09. Thus smaller bets (relative to supply) may besafer. Regardless, these can be large opportunities in large systems. In addition, outside of thismodel, real implementations create arbitrage of 5 −
13% to automate liquidations.
Attack 1:
An attacker bets on an ETH decline and manipulates the market to trigger andprofit from spiraling liquidations. This uses the short squeeze-like trades in the previous ex-ample. It can also be supplemented with a bribe to miners to freeze collateral top-ups. Theattacker could also enter as a new speculator at the high DStablecoin prices after the attackand thus leverage up at a discount. Outside of the model, the attack may have a negativeeffect on the long-term DStablecoin demand due to the induced volatility. This can be furtherbeneficial to the attacker, who can then also deleverage in the future at a discount.
Attack 2:
The attacker is also a miner and forks and reorganizes transactions in the last partof the blockchain following an ETH decline to trigger and profit from spiraling liquidations. Inthe fork, the attacker creates a new timeline that inherits the ETH price trajectory (via oracletransactions). The attacker can then censor speculator transactions (e.g., collateral top-ups)to trigger new liquidations and extract profit around all liquidations, which are guaranteed inthe timeline. If the stablecoin system is large, the miner extractable value can be large (and22s additive with other sources of extractable value). This creates the perverse incentive forminers to perform this attack if the attack rewards are greater than lost mining rewards. Thisis similar to the time-bandit attack in [7].In Attack 1, the attacker takes on market risk as the payoff relies on a future ETH declineand liquidation. It is a speculative attack that can induce volatility in the stablecoin. InAttack 2, the attacker’s payoffs are guaranteed if the attack fork is successful. These payoffsincentivize blockchain consensus attack. A possible equilibrium is for miners to collude andshare this value.These attacks occur in a permissionless setting, in which agents can enter/exit at any timewith a degree of anonymity. While in traditional finance, market manipulation rules can beenforced legally, in decentralized finance, enforcement is only possible to the extent that itcan be codified within the protocol and incentive structure. We leave to future study a fullexploration of these incentive structures in a game theoretic setting based on foundations forblockchain forking models set in, e.g., [3].
Mitigations
We discuss some preliminary ideas toward mitigating attack potential. Liqui-dations could be spread over a longer time period. This could potentially lessen deleveragingspirals by smoothing demand and increase the costs to a forking attack. However, it presentsa trade-off in that slow liquidations come with higher risks to the stablecoin becoming under-collateralized. We also suggest tying oracle prices and DEX transactions to recent block historyso that a reorganization attack can’t easily inherit price and exchange history. Practically, how-ever, this may be difficult to tune in a way that’s not disruptive as small forks happen normally.
In general, it is impossible to build a stablecoin without significant risks. As speculatorsparticipate by making leveraged bets, there is always an undiversifiable cryptocurrency risk.However, a stablecoin can aim to be an effective store of value assuming the cryptocurrencymarket as a whole is not undermined. In this case, it is conceivable to sustain a dollar peg ifthe stablecoin survives transitory extreme events. That is, to achieve long-term probabilisticstability, a stablecoin should maintain a high probability of survival.
Failure risks
DStablecoins are complex systems with substantial failure risks. Our modeldemonstrates that they can work well in mild settings, but may have high volatility outsideof these settings. As we explore in this paper, the market can collapse due to feedback effectson liquidity and volatility from deleveraging effects during crises. These effects can exacerbatecollateral drawdown. Surviving these events may rely on bringing in increasing amounts ofnew capital to expand the DStablecoin supply during such crises. In these events speculatorsmay not always be willing and able to take these new risky positions. Indeed, there are mayexamples of speculative markets drying up during extreme market movements. As we explorebelow, continued stability during these events additionally relies on new capital entering thesystem in a well-behaved manner as profitable attacks are possible.As suggested by our simulations, stablecoin holders face the direct tail risk of cryptocurren-cies. If the market loses liquidity, there is no guarantee that forced liquidation of speculators’collateral will be possible within reasonable pricing limits. Further, volatile cryptocurrencymarkets can, in unlikely events, move too fast for speculators to adapt their positions. In thesecases, stablecoin holders can only truly rely on the cryptocurrency value from global settlement.23 emark on oracle risks
The DStablecoin design also relies on trusted oracles to provide realworld price data, which could be subject to manipulation. In MakerDAO’s Dai, for instance,oracles are chosen by MKR token holders, who vote on system parameters. This opens apotential 51% attack, in which enough speculators buy up MKR tokens, change the system touse oracles that they manipulate, and trigger global settlement at unfavorable rates to stablecoinholders while pocketing the difference themselves when they recover their excess collateral. Ahint of manipulation in oracles or large acquisitions of MKR could potentially trigger marketinstability issues on its own.Note that Dai has protections from oracle attacks. First, there is a threshold of maximumprice change and an hourly delay on new prices taking effect. This means that emergencyoracles have time to react to an attack. Second, at current prices 51% of MKR is substantiallymore expensive than the ETH collateral supply. However, this second point does not have tobe true in general–at least unless Dai holders otherwise bid up the price of MKR for their ownsecurity. The value of MKR is linked to expectations around Dai growth as fees paid in thesystem are used to reduce MKR supply. At some point, the expectation may not be enoughto lift MKR value above collateral on its own. This raises the question of whether fees shouldbe used to reduce MKR supply at all. Alternatively, MKR value could be completely based onthe potential value of a 51% attack, which may also grow with Dai growth, and the value offees could be put to different uses, as we discuss further below.
A good fee mechanism may quell deleveraging spirals
Dai imposes fees on speculatorswhen they liquidate positions (e.g., liquidation penalty, stability fee, penalty ratio). These can amplify deleveraging effects by increasing deleveraging costs and disincentivizing new capitalfrom entering the system during crises. An alternative design with automatic counter-cyclic feescould enhance stability by reducing feedback effects. For instance, fees could be collected whilethe system is performing well, but these fees could be removed (or made negative) automaticallyduring liquidity crises in order to limit feedback effects and remove disincentives to bringingnew capital into the system.Speculators in Dai can pay back liabilities at any time and come and go from the system,which raises concerns about herd behavior in crises. A herd trying to deleverage can triggera deleveraging spiral. Dynamic fees tuned to inflow/outflow could additionally disincentivizeherd behavior to deleverage at the same time.
An alternative ‘collateral of last resort’ idea in Dai
In Dai, MKR serves a certain ‘lastresort’ role in addition to governance. If there is a collateral shortfall, then new MKR is mintedand sold to cover Dai liabilities making up the shortfall. This may not always be possible asthe MKR market can similarly face illiquidity and the market cap may not be high enough tocover shortfalls. In some settings, MKR holders might actually have an incentive to trigger aglobal settlement early before MKR would be inflated. A Dai shutdown would have some effecton the price of MKR, but the cost may be small if MKR holders expect a successful relaunchof Dai after the crisis. An early shutdown is not ideal for Dai holders, as they will want tohold the stable asset for longer during extreme events. In addition to incentive alignment beingunclear in MKR’s ‘last resort’ role, the invocation of the role only helps cover the aftermath ofa crisis (an existing shortfall) as opposed to quelling the effects that cause the crises.We propose an alternative ‘last resort’ role of governance tokens that instead aims to quelldeleveraging spirals. This could be achieved by automatically positioning the MKR supply assystem collateral against which Dai can be minted to expand supply in crises. To illustrate, if Though it is notable that most MKR is reputedly held by just a few individuals within the MakerDAOteam.
Uses of limited fee revenue
Dai produces limited fee revenue, most of which rewards MKRinvestors. There is additionally a Dai savings rate that rewards Dai holders using fee revenueand serves as another tool to balance the Dai market (e.g., to boost demand for Dai whenthe price is below target). There is an inherent trade-off in using fee revenue, however. ADai savings rate uses this revenue to improve stability in relatively normal settings in which ahigher fee itself serves to balance the market. Alternatively, fee revenue can be channeled to anemergency fund that lessens the severity of crises–for instance as suggested above. These feesand their potential uses can be incorporated into our model to compare the effects of differentdesign choices.
Stablecoin risk tools
Our results suggest tools and indicators that can warn about volatil-ity in DStablecoins. We can find proxies for the free supply, estimate the price impact ofliquidations, and track the entrance of new capital into speculative positions. We can connectthis information with model results to estimate the probability of liquidity problems given thecurrent state. This information is also useful in valuing token positions in these systems (e.g.,Dai, MKR, and the speculator’s leveraged position).Some exchanges have bundled select stablecoins into a single market that ensures 1-to-1trading (e.g., [10]). In this case, exchanges are essentially providing insurance to their usersagainst stablecoin failures. These arrangements could lead to a run on exchanges in the eventthat some stablecoins fail. It is unclear if these exchanges are subject to regulation to protectusers against this, and it is further unclear if such regulations would be sufficient to accountfor risks in stablecoins. Our model provides insight into the risks (to exchanges and users) ifsuch arrangements in the future include noncustodial stablecoins.
Future directions
We suggest expansions to our model to explore wider settings. • Incorporate more speculator decisions, such as locking and unlocking collateral and hold-ing different assets, accommodating speculators with security lending motivation. Thismakes the speculator’s optimization problem multi-dimensional. In this expanded setting,speculators may make more long-term strategic decisions considering whether tomorrowthey would have to buy back stablecoins and at what price. • Consider multiple speculators with different utility functions who participate in the DStable-coin market. In this expanded setting, we can consider the conditions under which newcapital may enter the system and formally study the economic attack described aboveand the effects of external incentives. • Incorporate additional assets, such as a custodial stablecoin that faces counterparty risk.This would allow us to study long-term movements between stablecoins in the space andlearn about systemic effects that could be triggered by counterparty failures. This isfurther relevant in evaluating systems like Maker’s multi-collateral Dai. However, thiscomes with a trade-off of a new counterparty risk that is very hard to measure. Inparticular, it’s not just custodian default risk, but also risk of targeted interventions oncentralized assets. Such interventions (e.g., from a government who wants to shut down25ai) could be highly correlated with cryptocurrency downturns as that is when the systemis naturally weakest. • Incorporate endogenous feedback of liquidations on Ether price, which becomes relevantif the DStablecoin system becomes large relative to the Ether market.Additionally, our existing model can be adapted to analyze DStablecoins with different designcharacteristics. For instance, • DStablecoins with more general collateral settlement, in which stablecoin holders canindividually redeem stablecoins for collateral. This is possible, for instance, in bitUSDand Steem Dollars. In this case, the stablecoin acts as a perpetual option to redeemcollateral, and stablecoin volatility will be additionally related to the settlement terms. • DStablecoins without speculator agents (e.g., Steem Dollars, in which the whole market-cap of Steem acts as collateral). In these systems, stablecoin issuance is automated withthe rest of the protocol. Our model can be adapted by removing speculator decisions andmdoeling the growth of collateral from block rewards and growth of stablecoin from otherprocesses. • Some non-collateralized algorithmic stablecoins. We believe this setting can also be in-terpreted in our model by thinking of ‘synthetic’ collateral that ends up describing userfaith in the system. The underlying mechanics would be similar, simply recreating ‘out ofthin air’ the value of the underlying asset as opposed to building on top of the value of anexisting asset. The stability of the system ultimately still relies on how people perceivethis value over time similarly to how perceived value of Ether changes.
References [1]
Amini, H., Filipovi´c, D., and Minca, A.
Systemic risk and central clearing counter-party design.
Swiss Finance Institute Research Paper , 13-34 (2015).[2]
Aymanns, C., and Farmer, J. D.
The dynamics of the leverage cycle.
Journal ofEconomic Dynamics and Control 50 (2015), 155–179.[3]
Biais, B., Bisiere, C., Bouvard, M., and Casamatta, C.
The blockchain folktheorem.
The Review of Financial Studies 32 , 5 (2019), 1662–1715.[4]
Blockchain.com . The state of stablecoins. Tech. rep., , 2019.[5]
Cao, Y., Dai, M., Kou, S., Li, L., and Yang, C.
Designing stable coins.
Duo Net-work Whitepaper, https: // duo. network/ papers/ duo_ academic_ white_ paper. pdf (2018).[6]
Capponi, A., Cheng, W., and Sethuraman, J.
Clearinghouse default waterfalls:Risk-sharing, incentives, and systemic risk.
Incentives, and Systemic Risk (August 30,2017) (2017).[7]
Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach,L., and Juels, A.
Flash boys 2.0: Frontrunning in decentralized exchanges, minerextractable value, and consensus instability. In , pp. 566–583. 268]
Duffie, D., Scheicher, M., and Vuillemey, G.
Central clearing and collateral de-mand.
Journal of Financial Economics 116 , 2 (2015), 237–256.[9]
Guimaraes, B., and Morris, S.
Risk and wealth in a model of self-fulfilling currencyattacks.
Journal of Monetary Economics 54 , 8 (2007), 2205–2230.[10]
Huobi . Announcement on the launch of husd solution on huobi global. https://huobiglobal.zendesk.com/hc/en-us/articles/360000170601 , 19 Oct. 2018.[11]
Klages-Mundt, A.
The state of stablecoins–update 2018. https://link.medium.com/8rZUYg1c16 , 14 Dec. 2018.[12]
Klages-Mundt, A.
Insights from modeling stablecoins. https://link.medium.com/FLOZ5dbd16 , 6 Apr. 2020.[13]
Klages-Mundt, A., and Minca, A.
While stability lasts: A stochastic model of sta-blecoins. arXiv preprint arXiv:2004.01304 (2020).[14]
Lipton, A., Hardjono, T., and Pentland, A.
Digital trade coin: towards a morestable digital currency.
Royal Society open science 5 , 7 (2018), 180155.[15]
Longerstaey, J.
Riskmetrics—technical document. Tech. rep., J.P. Morgan., 1996.[16]
MakerDAO . Black thursday response thread. https://forum.makerdao.com/t/black-thursday-response-thread/1433 , 12 Mar 2020.[17]
MakerDAO . The dai stablecoin system. Tech. rep., https://makerdao.com/whitepaper/Dai-Whitepaper-Dec17-en.pdf , 2017.[18]
Morris, S., and Shin, H. S.
Unique equilibrium in a model of self-fulfilling currencyattacks.
American Economic Review (1998), 587–597.[19]
Nakamoto, S.
Bitcoin: A peer-to-peer electronic cash system. Tech. rep., https://bitcoin.org/bitcoin.pdf , 2009.[20]
O’hara, M.
Market microstructure theory . Wiley, 1997.[21]
Rowe, K. https://twitter.com/kennyrowe/status/1098639092332412929 , 21 Feb2019.[22]
Wood, G.
Ethereum: A secure decentralised generalised transaction ledger. Tech. rep.,Ethereum project yellow paper, 2014.[23]
Zhang, Y., Chen, X., and Park, D.
Formal specification of con-stant product (xy= k) market maker model and implementation. Tech.rep., https://github.com/runtimeverification/verified-smart-contracts/blob/uniswap/uniswap/x-y-k.pdf , 2018.
A Derivation of Results rop. 1 Proof.
In each period t , we determine the leverage constraint by setting ˜ λ = λ and solving for∆. Using the formulation of p Dt from the market clearing, we have the following equation for∆: ˜ λ (cid:16) z + ∆ x ∆ − y (cid:17) = β ( L + ∆) . Given ∆ > y , this transforms to the quadratic equation for ∆ − β ∆ + ∆ (cid:16) ˜ λ ( z + x ) − β ( L − y ) (cid:17) − ˜ λzy + β L y = 0 . This is a downward facing parabola. The speculator’s leverage constraint is satisfied whenthe polynomial is positive. The roots, if real, bound the feasible region of the speculator’sconstraint. Due to the requirement that ∆ > y , the feasible set is given by [∆ min , ∆ max ] ∩ ( y, ∞ ). When there are no real roots, the polynomial is never positive, and so the constraint isunachievable. Prop. 2
Proof.
By Prop. 1, [∆ min , ∆ max ] ∩ ( y, ∞ ) is indeed the feasible region. Incorporating the marketclearing, the speculator decides ∆ in each period t by solvingmax r (cid:16) z + ∆ x ∆ − y (cid:17) − L − ∆s.t. ∆ ∈ [∆ min , ∆ max ] ∩ ( y, ∞ )This optimization is solvable in closed form by maximizing over critical points. Maximizingthe objective is equivalent to maximizing f (∆) = r ∆ x ∆ − y − ∆ . We first consider the case of ∆ approaching y from above and show that this boundary isnot relevant in the maximization. The limit is lim ∆ → y + f (∆) = −∞ . To see this, note that L t − = ¯ m t − ≥ w Dt ¯ m t − , and so in order to have L t = w Dt ¯ m t − , we must have ∆ <
0. Thusthe sign of the term that tends to infinity is negative. The limit is −∞ because the price forthe speculator to buy back DStablecoins goes to ∞ .To find the critical points of f , we set the derivative equal to zero: dfd ∆ = − ∆ − y + y ( rx + y )(∆ − y ) = 0Assuming ∆ (cid:54) = y , the solutions are the roots to the quadratic ∆ + − y ∆ + y ( rx + y ) = 0.Notice that the axis of this parabola is at ∆ = y . When there are two real solutions, thenexactly one of them will be > y . Given y ≤ x ≥ r ≥
0, a real solutionalways exists and the relevant critical point is∆ ∗ = y + √− yrx. If it is feasible, ∆ ∗ is the solution to the speculator’s optimization problem. If ∆ ∗ is notfeasible, then we need to choose along the boundary. The possible cases are as follows.28uppose ∆ ∗ < ∆ min . Then ∆ min is feasible since ∆ ∗ > y implies ∆ min > y . Since f ismonotone decreasing to the right of ∆ ∗ , f (∆ min ) > f (∆ max ), and so ∆ min is the solution.Suppose ∆ ∗ > ∆ max . By our assumption that the constraint is feasible, we have that∆ max is feasible. Since f is monotone decreasing to the left of ∆ ∗ on the feasible region, f (∆ max ) > f (∆ min ), and so ∆ max is the solution. Prop. 3
Proof.
The speculator’s leverage constraint is unachievable when the quadratic has no realsolutions or when all real solutions are < y . The first case occurs when (cid:16) ˜ λ ( z + x ) − β ( L − y ) (cid:17) + 4 β ( − ˜ λzy + β L y ) < . Noting that y = − w D L and L − y = L (2 − w D ) and expanding and simplifying terms yields β ˜ λ L (cid:16) zw D + 2 x (2 − w D ) (cid:17) − ( β L w D ) > (cid:16) ˜ λ ( x + z ) (cid:17) Completing the square by subtracting 4 β ˜ λ L x (1 − w D ) from each side then gives the result. Prop. 4
Proof.
Setting z = − ∆ p Dt = − ∆ x ∆ − y gives the lower bound ∆ − := zz + x y > y .Note that ¯ m t = L t , and so y = L ( w D −
1) = − w E L ≤ . The term w Dt ¯ m t − presents a lowerbound on the size of the DStablecoin market in the next step from the demand side, and sothe speculator can’t decrease the size of the market faster than y , even with additional capitalbeyond z . As shown above, ∆ → y + coincides with p Dt → ∞ . The speculator pays increasinglylarge amounts to buy back more DStablecoins as liquidity dries in the market. Prop. 5
Proof.
With inactive constraint, L t = √LD ˆ r , p Dt = D√LD ˆ r = (cid:113) DL ˆ r , and p Dt p Dt − = √ DL ˆ r DL = (cid:113) LD ˆ r . Theorem 1
Proof.
It is straightforward to verify L t = D ˆ r t − t by induction using L t = (cid:112) L t − D ˆ r . Then p Dt p Dt − = (cid:114) L t − D ˆ r = (cid:115) D ˆ r t − − t − D ˆ r = ˆ r (cid:16) t − − t − − (cid:17) = ˆ r − − t . And so ln p Dt p Dt − = − − t ln ˆ r . 29ext, as ¯ µ t = (1 − δ )¯ µ t − + δ ln p Dt p Dt − , it is straightforward to verify by induction that¯ µ t = (1 − δ ) t ¯ µ − δ ln ˆ r t (cid:88) k =1 − k (1 − δ ) t − k . Case I: δ = 1 /
2. The series in ¯ µ t becomes t (cid:88) k =1 − k (1 − δ ) t − k = t (cid:88) k =1 − k − ( t − k ) = t (cid:88) k =1 − t = t t . Then we have ¯ µ t = 2 − t (cid:16) ¯ µ − t ln ˆ r (cid:17) . The first term → ≤ δ <
1. The second term → µ t → t → ∞ .The contributing term to volatility at time t , after substituting and simplifying terms, isln p Dt p Dt − − ¯ µ t = t/ − t ln ˆ r − − t ¯ µ . Then DStablecoin volatility evolves according to¯ σ t = (1 − δ )¯ σ t − + δ (cid:16) ln p Dt p Dt − − ¯ µ t (cid:17) = t (cid:88) k =1 (1 − δ ) t − k δ (cid:16) ln p Dk p Dk − − ¯ µ k (cid:17) + (1 − δ ) t ¯ σ = t (cid:88) k =1 − ( t − k ) δ (cid:16) k/ − k ln ˆ r − − k ¯ µ (cid:17) + 2 − t ¯ σ = t (cid:88) k =1 − ( t − k ) δ − k (cid:16) ( k/ −
1) ln ˆ r − ¯ µ (cid:17) + 2 − t ¯ σ = 2 − t t (cid:88) k =1 − k − (cid:16) ( k/ −
1) ln ˆ r − ¯ µ (cid:17) + 2 − t ¯ σ . The second line follows from straightforward induction. As t → ∞ , the series converges fromexponential decay. Then both terms → − t . Thus ¯ σ t → Case II: δ (cid:54) = 1 /
2. The series in ¯ µ t is a geometric progression t (cid:88) k =1 − k (1 − δ ) t − k = t (cid:88) k =1 (1 − δ ) t (cid:16) − δ ) (cid:17) − k = (1 − δ ) t (cid:16) − δ ) − − − t − (1 − δ ) − t − (cid:17) − − δ ) − = (1 − δ ) t − − t − δ ) − µ t = (1 − δ ) t ¯ µ − δ (1 − δ ) t − − t − δ ) − ln ˆ r , which converges to 0 as t → ∞ .30he contributing term to volatility at time t , after substituting and simplifying terms, isln p Dt p Dt − − ¯ µ t = (1 − δ ) t ¯ µ − (1 − δ ) t − − t +1 (1 − δ )2(1 − δ ) − r. The DStablecoin volatility evolves according to¯ σ t = t (cid:88) k =1 (1 − δ ) t − k δ (cid:16) ln p Dk p Dk − − ¯ µ k (cid:17) + (1 − δ ) t ¯ σ = t (cid:88) k =1 (1 − δ ) t − k δ (cid:16) (1 − δ ) k ¯ µ − (1 − δ ) k − − k +1 (1 − δ )2(1 − δ ) − r (cid:17) + (1 − δ ) t ¯ σ . Note that because (1 − δ ) ≥ /
2, we have | (1 − δ ) t − − t +1 (1 − δ ) | ≤ (1 − δ ) t + 2 − t +1 (1 − δ ) ≤ − δ ) t . Thus we have¯ σ t ≤ (1 − δ ) t t (cid:88) k =1 δ (1 − δ ) k (cid:16) (1 − δ ) k ¯ µ + 2(1 − δ ) k − δ ) − r (cid:17) + (1 − δ ) t ¯ σ = (1 − δ ) t t (cid:88) k =1 (1 − δ ) k δ (cid:16) ¯ µ + 22(1 − δ ) − r (cid:17) + (1 − δ ) t ¯ σ t . As t → ∞ , the series converges from exponential decay. Then both terms → − δ ) t . Thus ¯ σ t →→