Here's a proposed risk model for Fuse. This could guide future discussions and proposals on setting parameters for Fuse pools. DAO-managed pools might follow this more closely whereas custom-managed pools can use it as a guideline. This proposal is non-binding and purely informatory. Looking to engage in discussion, criticism and fine tuning.
This model can guide selection of collateral factors, liquidation incentives, reserve and other fees, and interest rate curves as desired.
Pool has n assets, hence nC2 pairs (unless some are disabled). Each pair (A/B) has a collateral asset A and a borrowed asset B. We need to check the safety of all nC2 pairs separately.
Liquidation is required when market price (of A measured in B) reduces below
p0. Oracle is called periodically - once in 15 min. Liquidator takes delivery when the market price is
p1, they take delivery at the price
Protocol bears the cost of
p0 - twap(p0,p1). Protocol has a margin of
1 - cf - liq incentive to bear this. Liquidator bears the cost of
twap(p0,p1) - p1, slippage and gas costs. Liquidator has
liq incentive to bear this. Liquidator will not engage if this incentive is insufficient. The difference between price and twap is called shock and roughly estimates the maximum possible price drop (of A measured in B) in 15 min.
Since we do not know who will bear the majority of the shock,
p0 - twap(p0,p1) and
twap(p0,p1) - p1 will have similar values in their respective worst cases (maximums).
For convenience we measure all terms as a percentage of collateral to be liquidated. Max collateral is bounded by a max deposit or borrow limit. We ignore gas costs for max collateral. Min collateral is bounded by a min borrow limit. We ignore slippage for min collateral. Safety is checked for both max collateral and min collateral.
Borrowers can hold the lender's collateral hostage at 100% utilisation - they pay max borrow rate. Paying max borrow rate they effectively repay the debt in (100%/max borrow rate) time. Lenders should be able to foresee their own safety for this wind-down period, or atleast for some fraction of this wind-down period.
Pseudocode to analyse most adverse liquidity and price circumstances in some historical period.
liq_uni[t] = uniswap liquidity at time t, measured in A
liq_sushi[t] = sushiswap liquidity at time t, measured in A
price[t] = uniswap price at time t, price of A measured in B
twap(t1,t2) = [sum(price[t]) for t in (t1,t2)] / (t2-t1)
twap_fuse_period = twap period using in Fuse = 15 min
twap_fuse(t) = twap(t, t + twap_fuse_period)
cf = collateral factor (in decimal)
liq_incentive = liquidation incentive (in decimal)
collateral_cap = cap on collateral asset A, measured in A
// use arbitrary high cap that has low odds of occurring
// if Fuse doesnt have a cap yet
gas_hop = gas per uniswap hop = 140000
gas_liq = gas for liquidation call = ?
no_hop = number of uniswap hops for liquidation of that pair. if CEX-listed, can be zero
gasprice_worst = worst gasprice in gwei = 600
min_borrow = minimum borrowable amount in ETH = 1
wind_down_period = 100%/(borrow APR @100% util)
lookback_period = wind_down_period / 3
// divide by 3 is arbitrary choice
liqgas_worst = (gas_liq + no_hop*gas_hop) * gasprice_worst * cf / min_borrow * 10^9
// @ gas_liq = 0, no_hop = 1, gas_hop = 140000, gasprice_worst = 500 gwei,
// cf = 0.5, min_borrow = 1 ETH => liqgas_worst = 0.035 => 3.5% of collateral
hist_liq_worst = min (liq_uni[t] + liq_sushi[t]) for t in (now - lookback_period, now)
hist_slippage_worst = 2 * collateral_cap / hist_liq_worst
// lazy approximation, for exact value use CFMM formula, calculate new price then slippage
shock(t) = (twap_fuse(t) - price[t]) / price[t]
hist_shock_worst = max (shock(t)) for t in (now - lookback_period, now)
hist_shock_worst = 0 if hist_shock_worst < 0
liq_incentive > max(liqgas_worst, hist_slippage_worst) + hist_shock_worst
1 - cf > liq_incentive + hist_shock_worst
Estimate probability of following statements failing to hold true, because
slippage in future are higher than historical values. Lenders should be able to foresee their own safety for some fraction of the wind-down period.
liq_incentive > max(liqgas_worst, slippage) + shock
1 - cf > liq_incentive + shock
shock is max (fractional) gap between 15 min twap and market price (of A measured in B). Reasons shock could increase:
- A price drops fast due to rugpull, or broken peg, or any news leading to higher volatility
- B price goes up fast due to bullish news, or any news leading to higher volatility
- Less liquid pairs tend to have higher shocks
- Liquidity can also be lost over time, leading to potentially higher shock
slippage depends on liquidity for A and B. Reasons liquidity could decrease:
- Significant price drop in A or B
- Loss of community attention/ interest in the asset leading to loss of trading volume. This in turn leads to liquidity being pulled.
- Liquidity incentives being removed.
- Whales may push down price of A or push up price of B to trigger liquidations
- They may also pull liquidity to increase the ease of doing this, as well as increase liquidation slippage
- Less liquid pairs are easier to manipulate
- Pairs without bots trading on them are easier to manipulate
It is assumed that any such inorganic price activity will be reverted by rational traders within a 15 minute timeframe. For instance if price goes down, others will buy. If liquidity is pulled, others will add liquidity. If 15 minutes is too short, a longer timeframe may be needed for twap.
Assign safety score
- margin with which safety conditions held true historically
- subjectively estimated probabilities of conditions not holding true in future
Disabling of collateral
If A goes down sharply, anyone lending to a person who is using A as collateral assumes this risk and may not get fully repaid. If B goes up sharply, anyone who lends the asset B may not get fully repaid.
If pool does not wish to bear risk of an asset (A) going down sharply, that asset can be disabled as collateral. Pool must bear risk of all borrowed assets (B) going up sharply, current Fuse implementation cannot disable borrowing of an asset. Disabling all assets besides B as collateral is an indirect way to disable borrowing of B, then B becomes the only collateral in the pool but it cannot be borrowed.
If liquidation of A is not possible due to illiquidity in the pair A/B, anyone lending to a person who is using A as collateral may not get repaid. If pool does not wish to bear this risk, A can be disabled as collateral.
Reserve fees allow for slow derisking over time. Early users are charged fees which help protect later users.
80% util rates
Borrow rate at 80% utilisation isn't relevant to risk, however it should be set to slightly higher than the maximum that borrowers might be willing to pay for likely borrow use cases under normal circumstances. If demand is less than this, negotiation occurs in the 0-80% region. Region beyond 80% should exist primarily to pressurise aggressive borrowers to close positions, not negotiate normal supply and demand.