Insuring against the risk of stablecoin runs

Hello Celo Community :wave:,

My name is Ezechiel (or Zeke for short) and I lead the public sector research and development efforts for cLabs.

The implosion of TerraUSD (UST) has sent shockwaves throughout the crypto market, as well as the broader financial system. As we start to think about what this means for Celo and the potential impact of cStables issued on the network, I have been heartened by the level and thoughtfulness of discourse on the Celo Forum. The discussions around both the Proof of Deposit proposal and the Upcoming CGP have been particularly timely and important given current events, and I would encourage everyone to check them out.

I would also like to share an idea I have been thinking about for quite a while that could help bolster public confidence in the stablecoin market and would love feedback from this amazing Celo Community. Specifically, I want to talk about the idea of creating a stablecoin insurance program that could be modeled after the Federal Deposit Insurance Corporation (FDIC) in the U.S.

Perspective and Motivation
I certainly understand that the idea of creating a federal stablecoin insurance program might seem implausible and perhaps anathema to the Web3 ethos. Before diving into the details of this idea, it might be helpful to better understand my background and the perspective I have on cryptocurrencies.

I am not a “crypto native”. In fact, although I would typically be classified as “Gen X”, it’s likely most people here might refer to me as a “boomer”! :rofl: Importantly, most of my career has been spent working for or with central banks around the world. During the Great Financial Recession, I was working at the Federal Reserve Bank of New York, where we were constantly trying to come up with new policies and programs to help blunt the economic crisis that was unfolding. Although it’s fair to say that not everything we did was successful, we believed that “the best idea wins” – no matter who proposed it or where it came from.

Indeed, that’s why I joined cLabs to help work on Celo – I believe that Celo’s mobile-first blockchain solution is the best idea and I think stablecoin technology is the future of money. Unfortunately, there is still a lot of confusion about stablecoins among the general public (and especially with regulators) – and the recent collapse of UST has only exacerbated the situation. But if we think of UST as having experienced a “run” similar to what banks experience when people lose confidence in them, then applying the concept of deposit insurance to the stablecoin market might not be such a crazy idea and could help bolster confidence in stablecoins, including those issued on Celo.

Outline of a Stablecoin Insurance Program
Although I’m planning to publish an article shortly with more details on my idea, I wanted to at least share an outline here that will hopefully start to generate some debate about the usefulness (or not) of this idea.

Optional and Risk-Based
Similar to deposit insurance, the program could be managed by an entity like the FDIC in the U.S. and the idea would be that any provider that wanted to issue a stablecoin covered under the insurance program would need to specifically opt-in and provide documentation on the stablecoin’s stability mechanism, reserve portfolio, etc. Each stablecoin would be evaluated based on its specific risk profile and assigned to a corresponding risk classification.

Tokenizing Insurance
The FDIC, or similar institution, could issue a Stablecoin Insurance Token (or SIT) and only allow access to SITs to stablecoin providers that have completed a risk assessment. The price of each SIT would be based on the risk classification assigned to the stablecoin. [Note: although it’s impossible to know right now what those prices would be, the current fees for deposit insurance, which might serve as a helpful guide, can typically range from 10-60 basis points]

Building a Reserve
The money collected from the sale of SITs could be placed in a Stablecoin Investment Fund (again similar to the Deposit Insurance Fund) to maintain public confidence and resolve failed stablecoin projects that participated in the program. Those stablecoins that decide not to join would be ineligible, thus helping to mitigate potential moral hazard problems.

Limiting Exposure
Ideally, the program would be structured to protect ordinary consumers, and not “crypto whales”. Thus, there would likely be a cap imposed. Although there are still lots of questions that need to be answered, it’s likely that in the beginning such an amount could be kept relatively low (such as $500-1,000) and still be effective.

Feedback Requested
One of the things I love about this community is the passion people have for Celo, and the willingness to offer honest, thoughtful feedback. And I’d certainly love to hear your thoughts and constructive feedback on this idea. I will be sharing more details later, but in the meantime, please feel free to join the debate. Thanks!


If the goal is to have an insurance fund for small holders ($500 - $1000), then that’s quite easy for me to build. Example:

  • I build a very robust market monitoring
  • I build a smart contract that everyone give allowance to (and the contract is only allowed to draw funds when oracle price is x% below peg)
  • when I see cUSD depeg beyond safety threshold, my system automatically swap everything out to DAI / USDC (think of it as robot assisted trades to minimize slippage running out the door)

If the goal is to provide escape hatch for nimble small retail holders, then yeah, I can build this pretty easily.

This design does NOT work when you try to protect whales, cus you can’t offload whale positions without heavy slippage.

Do you want me to build this? You wouldn’t need to have separate fund / token / etc… cus it’s just automated liquidation for small wallets on depeg.


In principle a “retail escape hatch” is perfect for Celo and completely in line with the values of this community.

Crypto whales should be holding black swan risk – not real-world communities who are trading with cStables.


This sounds really interesting and I generally share the view that we should build some sort of retail insurance that protects the most vulnerable end-users.

Regarding this concrete proposal, I would like to understand a couple of things better though - especially around how trusted this setup would be. The options I am seeing here are that the smart contract you are proposing is either

  1. swapping into bridged DAI/USDC on-chain or
  2. simply forwards the cUSD to your off-chain trading engine and then basically folks have to trust you in executing on their behalf and returning the proceeds. Both options come with risks - bridge risks (how safe are these funds in the absolute worst case of the whole market collapsing?) and trusted off-chain setup (single-point of failure).

Additionally, do you have ideas around where the on-chain cUSD/USD rate would come from? Currently, this rate is not available on-chain.

1 Like

Swap to bridged is easier to build but there’s only so much liquidity there.

It’s just transferring the depeg loss to the swap LP by getting the small wallets onto the first set of life boats off the titanic.

On a depeg, it’s a game of musical chairs, who gets the chair is usually the smart money who have automated liquidation systems and are keeping an eye on the overall protocol health.

1 Like

Celo foundation need to set up official SortedOracles for every cStable:real world stable.

It should be part of bringing online new cStables to have official oracle reporting on the peg.


Thanks. I’d definitely be interested in learning more about how this could work, as I’m not entirely sure how your proposal would be funded.

For example, the idea I’m proposing is that all the stablecoin providers that want to take part would buy the SITs and the money from the sale of SITs would basically go into one large pot (e.g. Stablecoin Investment Fund) and those proceeds would be invested and accrue returns.

In the event that one of the insured stablecoins breaks the peg and triggers a pay-out event, then the proceeds from the investment fund would be used. The idea is that all of the stablecoins involved would pool their risk into one centralized (and in this case, government-run) program.

In the case of FDIC insurance, all participant banks pay into the Deposit Insurance Fund, and the fund is required to hold assets worth 2% of the value of insured deposits. Now, I’m not entirely sure what happens if the total bankruptcy related payouts equal more than what’s in the fund – perhaps the government is on the hook for this? (I need to do more research on this).

As I understand your proposal, it would be decentralized and specific only to holders of cStables. Again, this is an interesting idea that we should continue to explore, but some questions I would have are:

  • How much would insurance cost per 1 unit of cStable?
  • Would all holders of the cStable be required to pay for the insurance, even if their total holdings were more than the cap?
  • What percentage of holdings would be covered under the insurance scheme?
1 Like
  • How much would insurance cost per 1 unit of cStable?
    It should be free cus the cost is just the ongoing infra to do market monitoring and trigger the escape hatch on depeg. Foundation can cover the infra cost, but that’s a fixed overhead, not a cost that scales with the amount of wallets opted into the contract.

  • Would all holders of the cStable be required to pay for the insurance, even if their total holdings were more than the cap?
    No, it’s voluntary. If you want to give allowance to the contract, great, if you don’t, no biggie. Giving allowance != paying a fee, allowance just says contract can liquidate on ur behalf when boat is sinking.
    The smart contract will also cap the amount liquidated, so even if you have 1M to auto-liquidate, its only gonna do robot assisted liquidation for the first $1000.
    At the end of the day, its just a smart contract + a keeper to trigger.

  • What percentage of holdings would be covered under the insurance scheme?
    I give no guarantee, cus on a depeg, it all depends on how fast you can run out the door and how much liquidity exists in the stable swaps + UniV3 stable coin pools.
    It’s literally the same as Titanic sinking and there’s only enough life boats to cover some people.
    I’m just leveling the playing field for people in first class vs third class.

This isn’t a replacement for your insurance system. This is just how I personally would build the escape hatch mechanism because I don’t want to deal with complexity of a centralized insurance fund.

centralized system with more firm guarantees means that when shit hits the fan, some lawyers are gonna be chasing you on how fair the liquidation was, and etc… I don’t want to bear any of that risk…

1 Like

So in the event of a depeg, would the system basically sell all of the reserve assets and use the proceeds towards payouts (up to say $1000) until all reserves have been depleted?

If that’s the case, if this was free to users would this not have some moral hazard risks associated with it?

Obviously it depends on what is considered a “depeg” event that would trigger the asset sales and payout, but it seems to me that this might exacerbate a run on the stablecoin. If everyone knows there is only limited assets available (e.g. life boats in your example) at the first sign of danger people would likely be looking to run for exit.

1 Like

This system does not touch the CELO reserve at all.

The smart contract is literally gonna be doing batch liquidation of small wallets into the most liquid + lowest slippage onchain DEX liquidity routes into USDC & DAI (there could be two of these contracts, one for USDC life boat, one for DAI).

All of the cUSD in the small wallets will be exchanged for USDC & DAI at a discount, but since they’re the first ones out the door, they’re gonna get for example, 90 cents on the cUSD. All of the risk will be almost instantaneously transferred from thousands of small wallets to the LPs in the USDC & DAI stableswap + Uni3 pools.

You could say that I’m gonna screw the pool LPs with this mass exodus, but they signed up for the risk being LP to begin with.

If everyone knows there is only limited assets available (e.g. life boats in your example) at the first sign of danger people would likely be looking to run for exit.
This is a well known fact that I think EVERYONE is already fully aware of now given how UST played out, no? Unless they were living under a rock…

1 Like

I will let the user decide that for themselves. Not my decision to make, they set their personal depeg % trigger & risk profile, I handle carrying them onto the lifeboat as fast as robots can.

Ok, thanks. I think I have a much better idea of what you are proposing. Much appreciated.

There are a couple elephants in the room that should be dealt with.

First is that real world currencies don’t discriminate between whales and minnows.

The FDIC insurance system protects deposits from custodial failures, not systemic failures. If Bank of America failed the FDIC would make the minnows whole, if the US Dollar fails the FDIC is irrelevant.

Celo’s basic product that it wants to offer to the world is a currency akin to the USD, EUR, …, if that currency fails it’s game over for the protocol.

That brings me to elephant number two. The FDIC is only important in a fractional reserve system where the currency deposited in the institution is backed with less than a full reserve and it’s real purpose is to engender trust from the public.

So, what it seems to me that is really being argued about here with an insurance fund is to somehow find a way to be able to use less than the full reserve for the liquidation.

Elephant three. Given that if the Celo currencies fail, Celo is essentially toast, an orderly liquidation would be the right exit.

Elephant four. The CELO native asset needs to be the sacrifice, this is the natural place for the risk of the business to reside.

I’d suggest that a very public circuit breaker that simply halts Celo completely at a given reserve level that is well capable of repaying all stable coin holders and executing an orderly liquidation would engender much trust in the public and in reality add no extra risk to investors.

Halt the mento reserve trading or halt the entire network? Halting the entire network is like rugging all of the bridged assets along with celo.

By the time we might get to this threshold, I would hope that lots of other remedies had already been tried to save the protocol.

The intent is that this would happen before customer money (defined as everything in Celo Stable Coins) starts getting used to save the protocol, the circuit breaker pops and Celo enters an orderly liquidation.

How that might work technically needs to be worked out well ahead. Considering bridging and all that is important too.

The Stable coins though are a debt technically that the protocol owes and should be paid before any equity position, IMO.

The other thing this does is protect the developers reputation on apps they have built because their customers would get their money back too.

Just pause mento on circuit breaker, don’t pause the network.

Rule is never pause the network.

Pausing network in terra scenario was disaster.

1 Like

Whatever it takes to do an orderly liquidation, once the liquidation is complete the network could be turned off or whatever. Everybody would be in as good a place as possible.

Yes network has to stay up even during extreme volatility or else all CEX will halt trading and freeze wallets cus they cannot on-ramp or off-ramp.

1 Like

The liquidation budget would need to include money to keep the network going long enough to allow the bridged assets out.