Celo Reserve Liquidation Mechanism

Governance
1

Hi folks, I’ve been involved in this forum for almost a year now, and am building Celo.Tax .

Summary

  • I see a risk that Celo stables get undercollaterised in the case of a market crash.
  • Adding an automated reserve liquidation mechanism would provide significantly increased security for cStables.
  • I would like to consider proposing a CGP to direct efforts towards how such a mechanism might be implemented (or even better, propose a CGP to add automated reserve liquidation - it’s just I need technical help to come up with a concrete proposal).

Big Picture on Celo
My three biggest technical concerns with Celo are:

  1. Rising gas fees if/as transaction volumes go up. [I’m assuming things will get clogged like Ethereum is now, although I know things like Narwhal are in the pipeline].

    I don’t see this as a near-term (12-month) issue

  2. Risk of a network attack as there are relatively few validators.

    I think (although I don’t really know) that validators are generally community aligned right now, and so this is more of a medium/long term risk.

  3. Celo stables lose their peg because the reserve gets undercollateralised.

    This is my biggest short term risk because all it might take is a crypto market crash.

Background on Celo Reserve

  • At the time of writing, the Celo Reserve has a collateral ratio of about 5-6 times the issued amount of cStables. (63% of this collateral is Celo, the rest is mostly Bitcoin and Ether).
  • If crypto prices dropped to March 2020 levels (or worse, 2017 levels), it’s conceivable that stables would become undercollateralised.
  • There are mechanisms that kick into play as the reserve drops (such as a Tobin tax on transactions to replenish the reserve). My view - and I understand others may disagree - is that there is no assurance these mechanisms would stop the slide of CELO price, which ultimately underpins the reserve’s collateral.
  • As I understand, there is no automatic liquidation of the reserve as the value of reserve tokens drops below a safe threshold.

The value of a liquidation mechanism

  • This is a technical area beyond my full understanding, but I know that MakerDAO (DAI) automatically liquidates collateral if the collateralisation ratio falls below a set threshold. [Maker does this on a vault by vault basis, so the analogy here is to think of the CELO reserve as a single Maker vault.]
  • Provided the liquidation mechanism happens quickly enough (and provided there is not a strong step jump in the price of the collateral), then liquidations protect the peg of DAI.
  • Today, Celo stables can get undercollateralised if the reserve value falls sufficiently and the Tobin Tax replenishes the reserve at a slower rate than prices fall. Once this happens, it may be difficult for the cStable pegs to recover. (It’s also possible the cStable pegs might survive even if the reserve is undercollateralised - perhaps somewhat like Tether. Not an example to aspire to imo!).

How a liquidation mechanism would improve the security of Celo
This requires more thought, but here is one way this could work.

  1. The CELO reserve maintains a reserve safety threshold level of collateralisation, whereby the non-CELO portion of the reserve should be at least 125% of the outstanding value of cStables.
  2. If the reserve falls below this level, then non-CELO reserve assets are auctioned for cStables (e.g. the reserve sells some of its Bitcoin in exchange for cUSD, which it then can burn).

This gives the reserve has a way (provided liquidations can be done quickly, and there are no large price jumps in reserve asset valuations) to get ahead of falling crypto prices and avoid becoming undercollateralised. If crypto prices are falling rapidly, the liquidiation mechanism would start to sell Bitcoin/Ether once the reserve safety threshold is crossed. By selling Bitcoin (and buying back cUSD) the value of outstanding stables reduces and the collateralisation of the reserve is improved (versus the level of collateralisation that would exist if Bitcoin price falls further).

In short, if the liquidation mechanism works (and there are no reserve asset price jumps greater than 20% [the difference between 125% and 100% collateralisation]) then there is no way for cStables to become undercollateralised. This significantly reduces reserve undercollateralisation risk and adds a big safety layer versus what we have now.

If the liquidation mechanism does fail (in which case we we just default back to the current design), then the holdings of CELO in the reserve are the last resort for the protocol. (Side note: This is analogous to MKR tokens being the last resort for MakerDAO).

Concluding thoughts

  • Adding a liquidation mechanism is technical and would need to be done very carefully to avoid attack/arbitrage. Still, many protocols have these mechanisms and I think the CELO community has the expertise to be able to design something simple and effective.
  • I am particularly a fan of CELO because of the wide range of cStables (and the low fees, at present). As a builder, adding a liquidation mechanism would greatly improve my confidence in using cStables and I think should be a high priority for the community.

Technical note: In the short term, Bitcoin and Ether could easily be sold by using cBTC or cETH forms (as a first step). In the long term it would be better to use more decentralised bridged forms of BTC and ETH.

Tagging random people I’ve had good discussions with on other topics: @sep @0xhuman @Patrick @thezviad @Yaz @maria @tim @Tobi @willkraft @marek

3 Likes
2

I believe that advancing a multi-collateral Mento (MCM) with on-chain liquidation is an absolute necessity within the next year – both from a risk and innovation standpoint. Right now, the stability mechanism is de facto single-collateral, as you can only use CELO to swap for cStables. Implementing MCM with the liquidation backstop you’re describing would ease risk considerably (but of course requires simulation efforts to see how much).

One general Q for anyone:
Are there any public roadmaps available describing the future of Mento?

1 Like
3

This is a thoughtful suggestion. Specifically, how it would put guardrails in place to increase the collateralization ratio without putting downward price pressure on CELO. Both ETH and BTC can better withstand sell pressure since those assets have deeper liquidity relative to CELO. I would like to see this explored more.

cc: @MarkusBerlin

1 Like
4

@papa_raw we have not yet fully created one. We are in the process of figuring this out. Happy to take any input / suggestions like the one you had.

2 Likes
5

@Pinotio.com great post, this is very much top of mind for all of us. There are lots of things to unpack on this post, so will do my best to reflect how cLabs is thinking about this.

#Big Picture

  1. Agree, we are working very closely with Mysten, but we are also doing a bunch of improvements to ensure we are not the victims of our own success. Things like: Rollups, maximizing block size, having better HW … which brings to 2.
  2. We have the goal of increasing the number of validators, (see roadmap post) while this won’t solve all problems, it will some. Ideally we will be at ~200 by year end, this of course will have to be approved by the community.
  3. Agree, we have been asked many times why are we so collateralized, but those as you said are also exposed to other crashes.

#Celo Reserve
We have been talking about improving our Oracles and having a better decentralization of the reserve mechanisms (like liquidation).
We are prioritizing a set of features over the next few months to have a much more stable mechanism.

We can arrange a community call on this topic and have folks chime in, I am sure all of us together can solve this.

2 Likes
6

Thank you @Pinotio.com, @papa_raw, @Patrick, @alberto for this thoughtful discussion. Based on the thoughts that came up, also in the previous stability community calls, we have started to work on how a future Mento could look like. The ideas we are discussing and analyzing include:

  • features like a liquidation mechanism, potentially separated from a base reserve
  • adding features that create community involvement, allowing users to provide additional liquidity and stability, e.g. adding borrow&loan to the Mento features
  • adding a gifting to the reserve policy
  • increasing the nature backed assets allocation and further diversifying the reserve
  • oracle resilience

We currently also work on agent-based and scenario based simulations of these features. When we have a first consistent draft of the design, we would love to get community feedback and iterate over design aspect with all of you. We are also looking deeper into the proposals in this forum, and will set up a community call to gather further feedback.

3 Likes
7

:raised_hands: looking forward to your draft design – will happily circulate it around the Climate Collective once it’s ready!

1 Like
8

Greetings @Markus @papa_raw @Patrick @alberto:

Issue Segregation
I see three core topics here: a) Multi-collateral Mento, b) Nature-backed assets/Reserve Composition, c) Reserve Liquidation Mechanism.

I see all three as related, but each deserving of their own initiative/thread/CGP.

On Multi-collateral Mento
The proposal to put in place a Reserve Liquidation Mechanism has the goal of avoiding under-collateralisation of the reserve.

Allowing multi-collateral Mento cannot avoid under-collateralisation. What it can do is better maintain a target allocation % of each reserve asset. It can also, by allowing cStable exchanges with any reserve asset, hedge the risk of a failed price oracle on one or more (but not all) of the reserve assets.

What multi-collateral-mento cannot do is institute a buy-back of cStables when the reserve falls below a threshold level of collateralisation. It is this specific feature that would allow us to stop Celo from being undercollateralised as crypto market prices fall (provided this buy-back/liquidation mechanism functions quickly enough and is robust to step changes in collateral prices).

So, I think Multi-collateral Mento is worth a CGP/thread, but it does not achieve the more urgent goal of stopping the reserve from being under collateralised in a market downturn.

Importance of adding a Reserve Liquidiation Mechanism Now
At the time of writing, Celo has $150M+ of cStables outstanding, but no reserve liquidation mechanism to stop the reserve getting under collateralised in a market crash. I don’t believe this is widely understood amongst users or builders on CELO.

At the same time, we are in the fortunate position that the Celo reserve is currently well collateralised (although the collateralisation ratio has fallen significantly since the start of the year, and will tend towards 1 over time as more and more stables are issued [because the issuance of $1 of cStables only adds $1 of collateral to the reserve]). The reserve is even over-collateralised on a non-Celo basis. So, it is critical that we do this now because if prices do crash, it will be too late. [EDIT 14DEC2021: This comment on collateralisation tending towards 1 as there is increased issuance of cStables assumes that the price of reserve assets remains constant over time. If reserve assets appreciate versus cStables, then collateralisation would improve, and vice versa.]

A comment against modelling
I recommend against relying on modelling here because I believe risk is best managed on a scenario basis (e.g. is CELO robust if there is a large market crash in crypto?) rather than based on models that aim to project the future based on the past (e.g. let’s assume this buying and selling behaviour and this volatility in prices etc, and let’s see if CELO is safe).

Quite simply, no matter the type of market crash (even if 99%), if we had a liquidation mechanism in place (absent smart contract and oracle issue), the reserve could not become undercollateralised as the liquidation would keep the level of outstanding stables below the collateral in the reserve. That is a big difference to where we are now. No modelling required. This is the key point to understand.

On the use of BTC/ETH for liquidations
@Patrick , your point on the superior liquidity of BTC and ETH (versus CELO) is the reason I suggested that we have a collateralisation threshold for the reserve that is baased on non-CELO holdings (n.b. which is effectively BTC and ETH holdings right now).

My inclination is that it would be best for liquidations (in a market crash) to be done from BTC + ETH reserve holdings as well. That said, my thinking on this choice has gaps and I am open to something more like a pro rata liquidation mechanism.

4 Likes
9

For clarification, this is what I mean by modeling, or simulations whenever I discuss them. The idea is not to project into the future with “business as usual” conditions, but to figure out at which point the system breaks, and design appropriate rails around crisis scenarios.

I think the generalized version of this is merely a mechanism that preferentially liquidates certain tiers of cryptoassets prior to other tiers, or dynamically switches between tiers to minimize liquidity impact. I don’t have any mathematical formulations on hand regarding such a mechanism but I’m sure there’s plenty to borrow from the traditional banking sector (and perhaps other stable-protocols – we were evaluating Olympus’ smart contracts and they have a “two-tier” system…)

3 Likes
10

Hi folks, following up on this post with some specific ideas around how liquidations could be done. Ideally, I would think we want:

  • A quick liquidation mechanism (ideally within seconds, if not minutes). The quicker liquidations can be done, the smaller the risk of the reserve getting under-collateralised because of a step jump in reserve asset prices.
  • Market depth during liquidations - to reduce slippage.
  • A decentralised mechanism, if possible (challenging to implement for non-CELO reserve assets).
  • Consideration of gas fees. In the case of a crypto price crash, it’s possible that gas fees rise (transaction fees on Bitcoin, gas on Ethereum). This should be factored in.

Liquidation of BTC/ETH via a CEX
Idea: Somehow the reserve would have to hold an account at a CEX like Kraken that allows trading of BTC/ETH for cStables.
Speed: Fast.
Risks: Centralised.
Overall feasibility: This method would be quick, but requires a centralised approach that would have to be managed via a multi-sig. [Side-note: as I understand, reserve BTC and ETH holdings are currently centrally controlled, not controlled by reserve smart contracts.]

Liquidation of BTC/ETH as cBTC/cETH
Speed: Slow
Risks:

  • cBTC could start to unpeg from BTC as liquidation starts.
  • cBTC is centralised, as I understand and also slow to unwrap =>

Liquidation of BTC/ETH as wBTC(optics) / wETH(optics)
Speed: ~10 mins with optics v2.
Risks:

  • wBTC is custodial and unwrapping is slow
  • the optics bridged tokens could start to unpeg from their underlying equivalents during a rapid fall in prices. Still, optics v2 settles a lot quicker than other bridges, so this depeg might stay fairly small.
  • the reserve takes on optics bridging risk

Liquidation of BTC via submarine swaps
This doesn’t exist today, but there is a project in the mobile hackathon to build a submarine swap solution to go from Bitcoin Lightning to CELO. You can read about Bitcoin Lightning to Bitcoin submarine swaps here. In theory, this could be built out for going from BTC to cStables or ETH to cStables. A further implementation could involve Uniswap v2 style pools based on submarine swaps - this would be totally experimental (and I’m sure there are holes in this that I don’t understand). [EDIT 14Dec2021]: This is likely difficult to do in pooled way due to the hot/live nature of Bitcoin Lightning nodes/wallets.]

Speed: Submarine swaps are quick and decentralised (although they do require liquidity providers).
Risks:

  • Swap liquidity may dry up in a price crash.
  • This doesn’t even exist right now as an architecture.

Overall remarks and recommendations

  • The options above are highly imperfect. The simplest option I see is to implement a liquidation mechanism solely based on optics bridged Ether tokens in the Celo reserve.
  • We should research what other protocols like Avalance, Near, Solana etc. are doing on this front. I haven’t read anything on them yet.
  • We should tag people here in the Celo community that would have better ideas.

@thezviad , @bvl , @Markus what are your ideas?

2 Likes
11

Hi folks, some updates on latest thoughts here:

TL;DR - Based on further thinking and learning, I’m less certain on the net benefit of a liquidation mechanism. Some miscellaneous additional points follow:

Feasibility of BTC/ETH liquidation via a CEX
Non-CELO reserve holdings are currently managed by a (private, for safety) multi-sig and traded via CEXes. So, it would technically be feasible - although not ideal from a decentralisation standpoint - to have a centrally controlled liquidation mechanism.

Reserve mandate in the case of cStables being sold to Mento for CELO
There is already a mandated target allocation for the reserve. So - if CELO in the reserve were to be depleted - there would automatically be a mandate to sell reserve BTC/ETH for CELO via CEXes.

On the risks of a liquidation mechanism
It’s possible that having a bad liquidation mechanism may be worse than having none at all. With a bad liquidation mechanism (i.e. one that liquidates only slowly and after price drops), the effect would be to sell collateral at the worst possible time (i.e. when prices are lowest). One case study is Black Thursday for Maker DAO, where liquidations resulted in collateral being sold off for zero cost - although it’s worth noting that there were specific issues caused by spiralling fee costs on Ethereum that led to slow Oracle price updates for the liquidation mechanism.

I think that a better mechanism is possible than what MakerDAO had, so I don’t think this should rule out consideration of a liquidation mechanism, but it highlights the risks.

The case of no liquidation mechanism
If we are to consider a liquidation mechanism, it makes sense to consider what it means not to have one (which is the case right now).

At present, since the BTC and ETH in the reserve are not on the Celo blockchain, they would be untouched in the case of a price crash of CELO/BTC/ETH. One might think that i) Celo might be drained from the reserve if all crypto prices crash and all cStables are sold back to Mento, ii) reverses of BTC and ETH are used to buy CELO on CEXes, which puts upward price pressure on CELO - which may or may not be sufficient to maintain overall reserve collateralisation. It’s worth asking the question of whether this is better or worse than having an automated reserve liquidation mechanism?

Side-note: That the reserve has already bought substantial BTC and ETH positions (using CELO) has been a source of downward pressure on CELO. This is a form of pain until now in order for there to be a buffer later to support CELO price if needed. (Of course if all of crypto crashes, this buffer is not so powerful).

The question of who loses out during price crashes
During a crypto price crash or a de-pegging - one would imagine that a lot of low value wallets (non-whales) would not necessarily rush to swap their cStables in Mento (or elsewhere). To some degree, putting in a liquidation mechanism may therefore benefit large active holders of cStables over smaller practical holders of CELO. For small holders, it’s possible that a temporary de-pegging might be ok, provided that the reserve collateralisation goes above unity after a short period. Potentially, at some point - enabled by identification mechanisms - it might be possible to provide some kind of FDIC type coverage up to a fixed amount per person.

3 Likes
13
Mento 2.0 Design Principles

Hey everyone, as we are working on setting up agent-based complex system simulations of possible Mento 2.0 features (@roman @Nadiem @Slobodan @bowd Nelson and me, building on a lot of previous work from @sep @asa and @Markus), let me share my perspective on some design principles I summarized out of our team discussions. We are using these as guidelines for Mento 2.0 and this is not a complete nor definitive list, rather reflections on the way.

And many of these points and questions can (and should) be debated!

  1. One of our core choices so far is to start with a complex systems approach rather than the ‘predict and control’ approach:
    “Interconnectedness, unpredictability, and uncontrolability are key characteristics of all complex dynamic systems. In dealing with complexity rather than mechanisms, the aim of science shifts from improving our ability to predict and control to aiming to better understand the dynamics and relationships of the systems we participate in so that our participation can be more appropriate.” (Daniel Christian Wahl)

  2. How can Mento 2.0 reasonably incentivize people to participate in stability (and enable people to take these incentives) without creating a Ponzi-like scheme?

  3. Maximal risk minimization for vulnerable stablecoin end-users. Transfer as much risk as possible to CELO holders, stability providers and/or other less-vulnerable users

  4. Design for surviving crisis situations, not normal times (like tether breakdown, massive crypto-wide demand shocks and liquidity crises)

  5. Design for the real-world, not economic theory.

    • Think about all costs and market rigidities: Taxes, rewards, ‘human costs’ like effort, technical knowledge and time, opportunity costs
      • Transaction costs, increasing gas prices
      • Taxes
      • DEX and CEX price and trading differences
      • Regulatory requirements and trends
      • We can not count on efficient markets and people taking incentives, we have to incorporate what classic economic theory often calls ‘irrational’ behaviour

  6. Identify and resolve coordination problems (like prisoners dilemmas) for all actors

    • Guarantee stability, liquidity, and arbitrage provision in times of market turmoil and uncertainty
      • Potential solution:
        1. Time locks (e.g. lock capital of stability providers over extended period of time) to ensure that expected average profitability is enough incentive.
        2. Ensure necessary actions of the system are triggered by employing smart contacts that can be triggered by everyone
        3. Make it easier to interact with the reserve. Currently basically no-one is arbing although a lot know how the mechanism works. So how can more arbitrageurs engage with the mechanism?

  7. Democratize as many roles as possible in the stability setup

    • Everyone should be able to become part of the reserve, part of the arbitrage trading, part of the oracles, …
    • Democratize stability and liquidity rewards as well as arbitrage profits
    • Remove special privileges like MEV if possible

  8. Minimize complexity and maximize intuitiveness

    • “Simplicity is a great virtue but it requires hard work to achieve it and education to appreciate it. And to make matters worse: complexity sells better.” (Edsger Wybe Dijkstra)

  9. Look for generalizations

    • E.g. Can IRPs (borrow&lend) be generalized to include Mento 1.0 (buy&sell)

  10. Internalize systematic risk of specific actions

    • For example large buys&sells are more risky for the system as large borrows&lends as it they more sensitive to the oracle rate - therefore buy&sell should have larger costs.

  11. Design using standardized language and logic

  12. Mento as Layer 2 on Celo with possibly its own ‘stability’ token?

4 Likes
15

As nature-based, impact, ReFi reserve assets are usually real world assets, a liquidation process involving them should follow that of real world assets. The following is an extract from Green assets as collaterals for stable coins - #49 by untangled-finance where we proposed a framework for including green assets in Celo reserve:

“Typically RWAs can’t be liquidated quickly but Celo could employ a combination of strategies:

  1. Creating a safety margin: say liquidity need for a time horizon of 1 week, when the most liquid RWA can be liquidated
  2. Creating a liquidity strategy within the RWA portfolios: essentially making conscious tradeoffs among the impact/liquidity and yield
  3. Working with real world asset funding protocols to create highly liquid exposures to impact assets

1 above could be implemented with the value of the Celo token in the treasury. However it is much more sustainable to use protocol profits or surplus to fund safety margins. For this reason, celo needs to consider assets yields when making asset allocation decisions.

2 above has been covered in this post. Again all three properties and their tradeoffs should be considered.

3 above starts with selecting quality assets to form the impact reserve. The asset onboarding process needs to follow good practices as being proposed in this thread 2. It is important to note that once the asset has been onboarded the on-going monitoring is robust enough to ensure all asset risk parameters are in check. Having real/near real-time, on chain asset tracking, net value calculation and reliable oracles is important.

Even AAA assets have a non-zero probability of default. A proposer of impact assets (to be included in the reserve) should have a pre-approved liquidation process. Typically, these assets are sold under ‘true sale’ to a Special Purpose Vehicle (SPV) whereby an independent administrator or trustee is instructed to liquidate the assets (perhaps with the help of a professional liquidator) when certain conditions are met. This sort of liquidation procedure is well functioned within traditional finance/securitization. The challenge here is to create a legal structure that can work with a DAO as a DAO may not have a legal status.

Legally speaking, impact asset tokens come in two main forms:

  • token representing a claim on the actual impact asset
  • token representing a claim on the proceed of the impact asset in the event of a liquidation

Both of these are securities: equity in the former and debt in the latter. An equity token might be subject to registration with various authorities before being included in the reserve. Price discovery would need to happen on a licensed secondary market, and in the US, subject to various transfer restrictions. There is also an issue regarding custody of the token, establishing a control location for sovereignty over the custodied token and compliant liquidation mechanism.

Under the second form, assets would be sold to an SPV in the manner described above. Each of the assets are tokenized as an NFT with adequate metadata to enable oracles to price assets on an ongoing basis and in the event of a liquidation. This second form is arguably simpler as it involves less parties, at least in the US. The liquidation process is still manual as described above.”

1 Like
16

Hi @Parwan,

really great questions - some first answers/thoughts:

  1. These assets are readily available (within a few minutes).
  2. Buying cStables on CEXs would be an option even though more decentralized avenues are to be preferred I believe. cUSD is, for example, listed against BTC and ETH on Bittrex and against BTC on Kucoin. Indirect reserve trading (e.g. DAI->USDT->cUSD) would also be an option.
  3. In the long-term (medium term actually), this will work via what we call “Giga Mento”, a USDC<->cUSD StableSwap setup that can be used for burning an minting cUSD against USDC 1:1 on chain (see Proposing a new way to enable large stables mint: Giga Mento for details). Ideally, USDC is natively deployed for this on Celo but bridges like Wormhole that are live can be used in the meantime. We are right now prioritizing the work on Giga Mento and plan to launch it soon (end of October is the current estimate, cc @martinvol )

I believe that cross-chain interoperability is the main hurdle to overcome as we aim for a fully decentralized and robust liquidation engine and @Tobi is taking the lead on this work at Mento right now.

2 Likes