Risk Management in DeFi

Transcript

all right guys we are gonna get started uh my name is David Garfunkel uh this is Andrew Jones we both work at index Cooperative um I'm head of D5 Partnerships so we've both been around for about three years since index Co-op started uh we're gonna talk about risk management today uh not the sexiest topic but uh incredibly important I wish there were more talks like this at ECC or in general uh we go to a lot of conferences most of these people showing their products we're not going to do that today we're going to talk about how we build our products talk about the protocols we built on top of I think we have some of our co-workers here they know how we build our products you have any questions let us know but uh yeah we're gonna get after it

um you can find me at funkmasterflex.heath most people know me in the crypto ecosystem as funkmasterflex uh but yeah I work on D5 Partnerships that's everything from wallet Integrations custodians building on top of other protocols things like that um you used to work in tradfi and Equity Capital markets uh built renewable energy uh Power structures and things like that before I came here uh and now I work doing fun D5 stuff oh yeah my name is Andrew and my pseudonym on Twitter is Mr madilla and yeah I work on product design side at index Coupe and my previous history was in Trad five for about 10 years working in Investment Banking custodial Banking and asset management

[Music] uh so index Cooperative index Co-op index Coupe as as many of us say uh it started about three years ago which is all in D5 terms uh word Dao um that can mean a lot of different things but we vote with our token we vote to launch different products we started in 2020 at the end of 2020 in October uh with the D5 pulse index DPI you guys may know it it's one of our biggest products it was our first product uh in my opinion it was like one of the first D5 money Legos one of the first ways to build on top of the crypto ecosystem our goal and Mission and strategy and focus is simplifying access to risk and returns we call this the new

Financial system internet Financial system D5 crypto for us like it's super complex like there's so many things to do there's there's so many things and protocols within crypto uh for us like we want to make that easy for users to get into and users could be not necessarily people in this room but users are people walking into coinbase wallet have no idea what to do so we hope to make that a little simpler so like I said we launched DPI in 2020 uh crypto in 2020 Define 2020 was a bit different uh Ave was still called Heath lens there's no uniswap token um really there wasn't much to do in D5 there was you could lend on compound there are a few assets it was mainly

just Ethan and a couple Stables um but we started at a point where it was like how do we make this a little simpler how do we make this a little safer more particularly for users and that was what we tried to get at so DPI has been around for three years we rebalanced it every quarter but the main goal back then was let's make it a little easier and as I said I think of it as the first money Lego money Lego is like a term a lot of people in defy use uh I think it's used incorrectly uh pretty often but yeah we build on top of all these default money Legos so for DPI an example just one little token on top of all those um so an important thing that I think we get lost in is like why are we building

these things in defy um to me like and to Andrew like both of us coming from a traditional Finance backgrounds like it was relatively obvious why we needed some of these things uh it's relatively opaque the traditional Finance world like to us it's super important that things are on chain things are most of the time permissionless sometimes not but uh it was it was important that this like new Financial system we're building is is one all about ownership and self-custody uh to us like if if you're not actually holding your your keys to your crypto you obviously don't own it I think we've seen that with C5 in the past year or so it's been super disappointing for us working in D5 to get compared to FTX and

possibly Luna and others and and these C5 yield services for us it's incredibly important that when you say you're getting five six percent yield on whatever asset like it's actually there there it's not just made up because because that's really what it was in the past couple years it was made up yields uh and to us that's incredibly risky uh the opaqueness of that is is very harmful to the actual industry so for us like when we talk about some of these products like you can check on chain like it you shouldn't trust us when we say our products are great or anything like that check chains see what you think about the products you always know you're going to own it most importantly um so obviously we're in France uh are we building the future of France I honestly don't think so thus far

um as you can see there there's quite a bit of of money uh that's lost seemingly every couple weeks there was a couple weeks with sturdy Finance we like the sturdy Finance team but they're just things that need to be safer um as I said like we worked in traditional Finance like three four years ago we'd get laughed out of the room talking about Bitcoin and ethereum uh now it's it's a different story but it's still the same question like how is it that 200 million dollars are lost seemingly every couple weeks uh that's a that's a big concern and if we're not thinking about risk management first if we're not thinking about how these products are safer for the end user whether it's an institution or someone using C5 or retail customer if we're not making it

safer for those people all the way across the board then we shouldn't be doing this so at index Cooperative like it's incredibly important for us that we start at that risk management layer and try to build something that's actually a bit safer um a few of these on these on this list like we like as as users of D5 like even compounds on there winner meets an investor in us I don't want to call them out but but people make mistakes and if we don't Rectify some of these issues it's going to be a major problem as we try to get into institutional Finance uh I think a lot of people in D5 say they have institutions coming and it's certainly just a lot like it's it's not true uh if we did the the prices would be a lot different um so I think when that time does come

if we're not ready if we don't have 30 page risk reports uh We're Not Gonna We're not gonna get that Capital um I don't know about you injury but like like you probably had arrest reports you had to read for for days and days when you were in your old job yeah certainly so one of the um departments I worked in was um stock line and and so one of the biggest risks there was counterparty risk and so um particularly when kind of Lehman's went under and there was a big scramble to find out you know how much collateral was online uh to Lehman's um so risk management in treadfy uh got turned up to 11 after the Lehman's moment previously it had been on two and and so yeah there was a massive

um kind of cultural shift and risk management but it became like a massive thing in Trad fire um as well to manage that counterparty risk and yeah lots of reporting and and new metrics came online and entire department and were spun up and even kind of inside other departments new risk departments were spun up then um so I became a big thing yeah I was 10 years old in 2008 when when the banks crashed uh so so for me it was like starting at a point where like regardless of of how old you may be like crypto's incredibly new system and you know you can I I went to Prince University like I studied economics and finance there it's like

they don't teach you like what actually went wrong in many of those cases and I think crypto takes a clear look at like what what's some of these things are and and what we need to fix um like we go by Mr medulla on Funkmaster Flex but that doesn't mean we don't care about these important key issues in risk management and and to us they're incredibly important um but yeah like I said I was I was 10 years old and people didn't tell us what what happened I had to figure out for myself I had to go to college and and figure out how to do these things but for us like what we do is is on chain and it's and it's proven so if if we don't put out a 30 page risk report like you can see on chain what we're getting into and how

decentralized the protocol is and and for us it's incredibly important as we build on top of these protocols that we know each and every piece of of what we're building on top of um so we're hopefully going to go over some of those things today um this is not a beautiful presentation uh our design team is standing right in front of me uh so I I won't say it's it's beautiful or perfect um this is a like a curve you see often like crossing the chasm try to get into this majority and late majority and get into this like real world of people we're certainly in this innovator area people would say we're in the early adopter area unlikely um I still think we're very much on this

left side of the curve um people talk about this as like an adoption thing to me it's it's very much about risk um as I said I work in D5 Partnerships like when we talk to institutional teams like they're so far away from this that like they need to understand why this is safer why this is better it's not to them like okay I love eth as an asset like that that doesn't matter to them they care about if they're going to lose all their money and they care about if they're going to lose their business so to them risk is certainly more important and I think as we talk about like the new billion users uh into crypto into web3 if we don't think about their risk profile and how they think

about crypto uh we're certainly going to be at a loss because we can talk about crypto with people in this room but if you go ask your friends after this or you go home for Christmas or Thanksgiving like you say crypto and people like automatically get a little scared and if we're not able to talk about why this is possibly safer if we're not able to talk about a 30-page risk report they're always going to be scared about these things uh and as someone who works on like the growth side of of index Cooperative if we don't like build that trust we're never going to get these next billion users or whatever we want to say um so some goals of this talk like generally some goals of of like Risk

Management and D5 um we really need to standardize some of these things so there's a lot of different risk management practices there's a lot of different teams that work on risk management uh we're going to have someone from from Gauntlet here later on uh Paul's in the crowd already um but there's so many different standards and like if you if you look at a s p or Moody's like there's no it's not subjective they say this is the risk score this is what it is even even with defy yield like Andrew looks at millions of LP positions it's even hard to calculate where where these yields are coming from if it's even true so for us for me like I've been saying this for the three years I've I've worked in the

next Cooperative like if we don't come up with standard risk practices we're just we're just going to have a hard time um standard risk practices are different from standard scoring systems like I said if we have s p and Moody coming on top and saying okay this is the risk rating this is the credit rating or we're going to give this protocol or whatever it may be certainly helps us uh there was actually a protocol or a team that came out over the weekend uh I'm going to forget the name the Blue Chip Blue Chip uh yeah we try to sell Blue Chips um it's a rating Agency for stable coins to me that's incredibly important that like shows so much maturity in the space something we haven't had in the past couple years it's something we certainly

need uh we hope there's more of them I know Andrew is super excited about that we try to build Diversified products that use all these different stable coins and we just haven't been at a point where we already know what what's what's less riskier or more risky um so I'm about to show a slide that that may be controversial to me it's like a huge turning point in crypto I was very excited for this to happen the headline doesn't sound as good as it is um this was incredibly important to me uh this is about a year ago um compound got a B minus rating for for their compound Prime uh B minus is better than some countries uh so to me like this was this was a good

sign uh this is a Bloomberg article so someone in Trad five probably saw this and went oh my God I'm never going to use crypto again um but at least they rated at least they gave compound a rating like to me that was incredibly important I don't know if we'll ever be at the level of AAA rated bonds or anything like that but um this was like an incredibly important turning point for the ecosystem uh hopefully we have more of these uh I don't know if you'd ever be able to invest in a B minus uh bond in your past life but this was incredibly important to me at least uh yeah I mean like there was still plenty of funds in tradable yeah investing in junk credit um high yield um bond funds are definitely a thing and and ETFs as well

yeah certainly uh especially these days um okay so these are some categories we think about again this isn't a beautiful presentation um but these are some categories that we think about when it comes to defy risk you guys could certainly shout out a million more risks that come up um we hope that we can bucket some of these risks into these areas um you guys can read that on your own but we're going to go through each one of these sort of talk about how we came up with these um so Andrew here and Alan who's also in the crowd owner Team Works on our product team uh came up with this risk framework that we use to pick these products to to build some of the indices we we make um we go through each of these we sort of build out a risk score for each of

them and then also a relative risk score could you talk about a little bit about like the relative versus indicative risk framework yeah I think just just before we get into that you mentioned um like the s p ratings and for certain Structured Products I think they're much more easy to put quantitative measures against those and they don't have to deal with a lot of the risks that we're seeing up here like smart contract risk hack risk stuff like that and so really they can give quantitative scores based off of volatility and things like that whereas in D5 we're not really at that stage yet and it's still there's there's

some obviously quantitative measures that you can put in but there's at the moment as well we have to rely on some qualitative uh kind of yeah metrics as well um which some of these definitely are certainly and because of that some of these risk Frameworks and risk scores will be a bit subjective you may disagree with some of these there are other ratings agencies that may have different scores um but yeah this is what we think of uh we're going to bring Paul on in a bit to talk about how Gauntlet thinks about risk um but yeah let's start with with Asset Risk um very broad refers to the quality of an asset this is how we think about it um what I have on screen is the die backing this was last week if we wanted

to get a live version you certainly could I think it's diesupply.com this is all Unchained so when we go to a protocol and this is a concern of mine when we talk to someone we're trying to partner with if they don't have these stats like live or they don't have a dashboard that's ready to go that's a huge red flag in my opinion like if if this stuff isn't readily accessible like it means maybe they're hiding something or if not they're just being complacent so uh one of so when we talk about let's on this screen we're talking about stable coins here but this could be about a stake teeth asset this could be really about anything um so when we talk about Asset Risk you could compare dye to frax you could Bear Dodge Su susd you could pair dye to

curve USD or go that just came out yesterday um the collateral backing is like a very specific part of stable coins you may look at uh node count for stake teeth providers for example um but yeah Asset Risk is is probably the first thing we look at um I don't know if you want to talk about any specifics there but when we think about Asset Risk like it's a very broad spectrum and it's very subjective so like this is the first thing we're looking at and and we may not come up with an exact answer but it's it's how we sort of start the conversation yeah and one of the reasons we really started to talk and think about risk as well is in the early days of um of the Dao there are lots of product ideas and everyone's like very excited

um about the returns so you can get in D5 but nobody was really thinking about the risks um so it was like you know comparing something that's getting five five percent yield versus ten percent yield and nobody was asking well is it double the risk um and if it is more than double the risk then it's not worth it on a risk-adjusted return and and so very quickly we started to think about okay because we're in this for the long term we want to be fairly conservative and especially at the beginning I think we are fairly conservative and and we want to build sustainable products and also we manage our own treasurers as well and we do so in a conservative way and we don't want to lose all that Capital obviously and so we had to think about

that in much the same way we do with our products and so yeah Asset Risk was one of the first um uh yeah like the the one of the first obvious ones and and Funk was just saying they're about like going and checking on chain and so for some stable coins and such as die obviously you can go and actually look um at the contract and you can see the backing of the collateral for die but it's not just the collateral we're looking at as well we will also look at the Smart contracts to say okay you know is there a other risk in there like you know can somebody essentially rug it um via multi-sig and things like that and so uh yeah we'll probably get onto that in a

moment but um a lot of the time we use proxies as well for for risk and and so what I mean by that is uh we all tend to look at what the ecosystem is using to measure risk and and so for protocol risk um we tend to look to uh company or protocol called defy safety and they don't it's not quite audit level depth and they will do like a holistic um kind of look at protocols um and talk about their audits um their multi-cigs their governance things like that they will give them a score and we will include that in our Asset Risk as well and for ones that are

built on top of protocols yeah Andrew said a risk adjuster returns sadly that's not said often enough um so protocol risks could be thought of a smart contract risk it's it's really anything uh as as you talk about like how this product is built how it's like automated through smart contracts um Andrew talked about D5 safety there's there's a couple uh risk scores the defy safety puts up there um this is not something that every person can go in and say oh I'm just going to audit this code like I think that's something that everyone says oh it's open source like you can check like you really do have to trust others for this like I'm certainly not going to go in and and audit any of

these smart contracts um but really like you you need the backing of audit teams you need the backing of smart contract teams and security teams so for example like Ave V3 had six different smart contract Audits and they probably said that wasn't even enough they probably wanted to get more but there probably aren't more than six reputable security agencies to actually do this um so to us that's really important like we would never use a product that didn't have multiple audits we would never launch one of our products that wasn't audited multiple times um on top of this there's also bug bounties we can talk about a bit more about that later but once you do launch a protocol or product like continually making sure uh

people are coming in and checking that everything's working it's incredibly important um so as Andrew said defy safety is right here they have a few different risk levels and risk measures that they look at um it's certainly not the gold standard I don't know if anyone from D5 safety is here but but it's there's certainly much more we can do um this is just one example of a rating agency I don't know if it's on the level of s p or Moody's but uh it's certainly important it's certainly something we use but again we would never like if Ave av3 came out a couple months ago and had one smart contract audit we'd be a bit scared about that and would certainly be reluctant to use it um Andrew you're also not auditing the smart contracts but do you

think there's like a certain number we should have or anything like that and I'm certainly not since I would say I'm I mean as many as possible I'm from Red principal names and we know that there are some witnesses out there that consistently are being highlighted and when protocols Get Wrecked and so that uh kind of anecdotal trust or lack of trust will build over time reputationally and just out of interest does anybody here like manage Dow treasuries or anything like that hands up for any doubt treasury no okay cool just us um so uh yeah I saw someone doing a

Morpho t-shirt as well but I think they've left but yeah Morpho are obviously doing well um top of the top of the pile in this in this list yeah we like Morpho um okay so this may make a bit more sense when we talk about like the strategy um this could be lending versus lping this could be uh just just the general like strategy being used underneath um this is from defy llama like obviously you look at this and go okay this one has a sixteen thousand percent apy that sounds great like maybe maybe I should buy this I'm in yeah but but that's two years ago if you said that like people will go okay yeah like maybe they just got a lot of

rewards to hand out uh when we talk about risk adjuster return you literally shouldn't even put these two things on the same screen um but you know like there were um Forks up until a year ago that promised apys like this and people went oh like maybe maybe that's real maybe maybe I have time to to get that before it goes away um if you were to show defy Lama to an Institutional Investor I don't think they'd ever like want to come into the space uh I think stuff like this certainly scares people um it's certainly tough to say like like even UST with Luna it's like if you're offering 20 and everyone else suffering five percent like you're wrong

like it's there's there's no like it's not like oh maybe maybe they found some cool new mechanism uh it's just that doesn't exist so if if you're not comparing some of these yields to what other platforms are offering uh you're in for a lot of trouble because either they're doing something fishy or you're the last one in and you're not going to be able to get out um so this is example of of a staking position on Lido versus some crazy LP position um but these strategy risks can can differ from lending to lping uh one thing that's really important to us and it's the reason we build some of these products is you could have like a curve three pool that has three different stable coins in it

um if one of those stable coins goes to zero the whole pool goes to zero so it's like you could say like lping is is less risky but it's not less risky than three lending positions or three different LP positions once you sort of start bundling all these LP positions and everyone can say it's happily efficient and all this stuff and oh we we have this new mechanism that makes it so efficient and all this most of the time that's just adding extra risk so uh we recently built a money market index on top of Morpho Avan compounds and notional Finance uh to us it's very very important that the overall value at risk which we'll talk about a second is not

100 so when it goes too much into an LP position and you say you're Diversified into multiple different assets you're you're probably not uh so we haven't built an LP product at this point we probably will but that's one of the reasons it's it's a bit a bit scary to us when if one of them goes to zero at all goes to zero when you're building Diversified products uh certainly can't have that yeah or you're relying on kind of emergency governance to step in and phrase the pawn and but yeah when you see like massive kind of fields like this I think the simplest thing to do is ask yourself where does the yield come from and if somebody can't explain it to you in a tweet then it's uh probably not legit that's how I do it anyway

yeah certainly if they can't explain it and hopefully a sentence there's probably something wrong um traditional markets use a 30-day average SEC 30-day average yield uh something we should certainly adopt it's it's what index cup uses but but if you're to look at like the yield of a product if you don't look at it over a Time Horizon you're not looking at the right thing because NLP products could have a ton of fees in one day and then have zero fees the next day so uh to us it's super important that you're looking at the average yield over a time span most people don't do that they're probably just advertising their best yield during a time span which is which is very very risky

um so economic risk is is relatively simple to think about um the biggest way to think about it this is just volatility in crypto so this chart's like pretty silly but obviously like the Bitcoin price is volatile USD price is is not as volatile um when we think about that in crypto when we think about that in crypto especially when we use borrowing and lending markets uh when you have a when you have a barring position and uh this example was used restaurant panel I was on uh during like 2020 black Thursday uh each price went down like 40 in a day that doesn't happen in traditional markets like there aren't there aren't mechanisms to figure out how to how to de-lever when when things

go down 40 50 but it's something we have to be very cognizant of um index group builds uh uh leverage management positions so we have a eth2x leverage position that uh automatically would de-lever some of these during super super uh volatile markets to us that's incredibly important like crypto moves so fast that if if you're just to sit there with an Ave position open for I don't know a couple weeks and and you don't check it every day unless you're like continually refreshing the page like it's very unsafe and it's and it's not something traditional Finance experts are used to um so I know Andrew holds many of our LP positions sorts of sort of rebalances them but uh you're often like re-uh

reading the word uh repositioning uh recentering all of our LP positions and and they can change in an instant and if you don't have a full team looking at this you should probably have that automated and if you're just trying to sit in in an Ave position by yourself or you're sitting in and compound by yourself uh you're going to be in for trouble when that day comes when when the price goes down 40 or or conversely when the price goes up forty percent uh you still have to think about like how these things are actually going to move in practice um okay so value at risk is is an incredibly important one uh this is something we think about often this is like one of the main risk measures that uh someone like uh Gauntlet would put

together what I have on screen is the curve three pool and it's the example I gave of an LP position if one of the things goes to zero at all goes to zero so you could say all right I'm in curve three pool that is DC usdt it's like if if the example here this was not very long it was a few months ago like usdt's 73 of this pool that to us that's one not Diversified but it's it's totally out of balance and and you may get a lot of fees during Crazy markets like this but you're certainly at a high high risk and this happens whenever there's there's a deepeg this happens when there's when there's very very crazy market conditions but this happens very often so if you're not aware that you're now 73 in tether a centralized asset uh you may want to

rethink uh why you're actually investing in this pool for example yeah and uh the amplification Factor on these pools is set by curve as well so they can increase them and decrease them and that can also affect the behavior of the pool especially around volatile times um but yeah it's definitely a scary one when you think um yeah if anyone of these were to fail you're going to lose um 100 of your of your capital yeah so this example here the value at risk for for this LP position is 100 percent when we try to build Diversified products we need to know that if one of these pools goes to zero one of these stable coins goes to zero like what's actually going to happen so like I said

we have a money market index that has compound notional uh Ave and and uh Morpho positions if one of those goes to zero like you still have this whole entire portfolio um so for example like a year ago if you were 100 UST like you lose all your money but if you are in five different stable coins you only lose 20 of your money so when there's only a couple options in D5 like for the past couple years there's really only been those those three stable coins you could say there's others but on a risk adjuster return those those are probably the only three in the past couple years um you could say or Diversified but but if if you're not really Diversified in the strategies if you're not Diversified in in where these assets are going uh

you're gonna you're gonna end up wrecked maybe not an exploit like like rec.hq but it's still tough um you can read this little snippet I also think it's from a Bloomberg article but uh contagion risk is is a is a difficult one to quantify but you kind of know when you see it um like I think when after FTX everyone was like okay where's all the bad debt it's it's the same example Andrew gave with Lehman in 2008 it's like where's all this money going who owes who what uh this can sort of cascade so for example like after FTX happened it was like okay uh what happened to Genesis Oh you mean

Genesis on the back end of of Gemini uh okay well I have money in Gemini what do I do and you kind of have to wait for for the pieces to fall um if you're using a real D5 product that's not going to be the case there's no one like custodying these assets or someone backing up these these specific uh products you're not dependent on a market maker um so yeah this this can get bad there's certainly other examples in this article they say that FTX was was sort of a cascading effect from the contagion of of the Luna crash um but this is certainly something that happens from nutritional markets uh certainly something that's happened in crypto in the past uh I think D5 tries

to get away from this as much as we can but it's certainly still a risk we talk about these money Legos and and money Legos while interesting and while taking advantage of all the cool parts of D5 uh you can sort of have this cascading effect if you have money in multiple protocols sort of all relying on each other yeah one thing that I find quite interesting about this is obviously um in the off-chain world whether it be FTX whether it be tradify systems is it's so opaque nobody knows where the risk is concentrated or where this bad debt is concentrated but yeah on in crypto you can scroll through your Twitter feed and someone's like hey somebody's got a really large like

I'm not going to mention that the token but a really large position on curve and this is actually getting so large now that this is now a risk to Ave and then uh you'll often get oh they kind of take a governance measure and to like close that particular market and and that's all yeah thanks to the power of um kind of transparent um blockchain technology and which I think is uh I think is really huge for the first time ever and people are able to publicly audit it and uh yeah a few people on Twitter just like to do it for fun um but uh yeah it definitely sends out a big red flag and this is all part of the kind of evolutionary process um of D5 and it's why it's happening at

such a fast pace and because yeah people like have that self-interest they're going monitor it and allow people do it and you can audit things in real time it's not a monthly quarterly Capital call where you go oh okay maybe maybe all my money's actually gone because they finally did a capital call at the end of the quarter it's like no no you need to look now you need to look how things are going to be tomorrow not not a quarter from now um so yeah this we we all like feel this example uh but it's it's super important to understand like what's going to be the next example of this and like you you have to know where your funds are and where everything is on the back end if if you actually want to be away from this risk

um so Cooperative risk uh this is probably the most unique one to crypto uh if you were to ask S P they'd probably say this is why uh compounds got a junk bond rating just because they don't understand the mechanisms of governance I don't think many of us understand the mechanisms of governance to be honest um but but really this comes down to like are you dependent on others to make sure your protocol runs correctly um there's governance in defy there's some governance that's on chain there's some governance that off that's off chain if you're relying on others to perform the final function if you're if you're relying on uh a specific person to maybe

liquidate your assets rather than the protocol doing it you can be in trouble uh we like Aragon Aragon's a good project but uh people take took over their their treasury basically and and they had to come in and and manually sort of like restart uh that's super concerning uh there are other examples of this I won't highlight a bunch of them but uh governance attacks are like part of the the reason like people really don't understand crypto in my opinion um I don't think we've really been at a point yet where like major money comes in buys up half the supply of a token and then performs a governance attack that might have been what Citadel de talluna who knows but uh like it's it's it's certainly a risk that like

we haven't seen come to full fruition yet and and it's a scary one in my opinion uh luckily no one's selling our our index token to one individual but uh it could be relatively easy to sort of go under the radar buy a bunch of these tokens and and do whatever you want uh Aragon's example of this that I put up just because it happened recently um but yeah governance risk is is relatively scary uh lots of um teams use like compounds like open source governance framework for for on-chain voting um I'd recommend something like that but but even then like if you have a large percentage of tokens you can kind of do whatever we want so

we built this we built this like framework where where users own these systems but if users own these systems and they're bad actors uh it's sort of heightens the potential risk of these things um so to me this is a scary one to me this is why compound was given that that junk bond rating by s p um and it's really one of those things like we need to be more transparent about how our governance systems work index group is not fully on chain with with every single vote so there's there are some risks there and and we understand that we're trying to fix them but it can't be the mentality of oh we'll decentralize later if there's not a road map for many of these protocols to fully decentralize they need to think

of one now and and if not your your users are at risk so yeah and I guess just to give a an example of uh Pro school that's completely the opposite um of ones that are dependent on governance one would be liquidy big fans of liquidy and yeah they're protocol with their V1 protocol and is uh imitatable and so there's no risk of governance attack so that's one example of uh really um safe quite unquote safe and practical I totally agree and that's why liquidity has a 97 score on defy safety because there there is no there's no Vector of of governance attack uh I I can pull up T5 safety live after this but uh

liquidity is a great example if you're worried about those risks in stablecoin maybe that's the right one for you if you're worried about adding Bad Assets on top of a stable coin backing uh that might be the right one for you but yeah uh I'm glad you brought up that example uh there's there's a few other like governance risk uh uh teams that I guess are working trying to make this this world more decentralized uh what I would say is you have to be moving to an on-chain governance system and if you're not you're you're probably going to be left behind um most of the protocols we work with are on top of

um most of what they do is is on-chain governance they have some things that are off chain unit swap is a good example of this though uh uniswap has like snapshot voting which is off chain but when unusual V3 launches like no one's changing it so that that code is like set in stone uh that's like incredibly good in my opinion because it gets rid of the risk of someone coming in and saying oh I know how to rebuild unit swap V3 it's like well if you know how to rebuild unusual V3 build it in unusual before and then if you want to fix it again build a new swap E5 so that's really important like immutable code is really important if you're in a dow and you decide hey I want to completely change how this

product works that's that's very risky and and if users don't know that uh they're probably gonna be left in the dust um so I talked a bit about uh bug Bounty programs Andrew talked a bit about just like the legitimacy of of some of these smart contract Auditors uh won't name any names but there's like a meme that I love that probably should have put it on here it's like guys like checking with a wand and it's just like eyes are closed like not even checking anything uh you could pay a hundred thousand dollars for for a smart contract audit and they say oh it's perfect we found nothing uh there are other ways to do it uh what's the what's one were they like competing against each other and there's like kaifu Arena yeah code Arena uh

that's super interesting it's like you get a bunch of Auditors in one room they all compete against each other I actually saw a quote yesterday I have someone on the CC event saying oh code Arena's not great well the quote came from someone who owns an auditing company so uh I mean obviously subjective but uh so like for example index Coupe would hire like code Arena we'd also hire a traditional audit firm [Music] but you really have to like get deep into the code and if and if you're just sort of putting the hand wave over and and saying oh this is probably good because compound V1 was good compound V2 is probably going to be fine as well that's not a good way to go about this so like I said when you have a team like

Ave getting six different independent audits on on their Ave V3 like that that's what all these teams should be striving for and it's not cheap uh I think we spent 150 000 on our on two audits we had a couple months ago but that's one of the main risks when it comes to building these D5 protocols and if you're not like really serious about uh audits as well as bug bounties uh you're going to be in trouble so immune5 is a good example of a bug Bounty platform basically what you do is you say all right here's ten thousand dollars if someone finds a medium severity risk you're going to get that ten thousand dollars so it's uh you're

sort of uh incentivizing white hat hackers uh we've seen plenty examples of people coming in and exploiting a D5 protocol and not being able to get anything out of it or they try to put it through tornado cash R.I.P um but like you could try to exploit one of these protocols but you're not really going to be able to do much so what immuneify does is that they give rewards to people try to come in and and fix some of these problems they'll the team know and then he can go in and Patch it um but yeah I hope there are more programs like this I would recommend all D5 platforms to have something like this because it can it can have a huge impact on on like long-term safety

um so I used to work in Insurance before I I worked in in equity Capital markets uh insurance and crypto is certainly the most underdeveloped sector in my opinion within D5 Nexus Mutual I'm a huge fan uh we've built some of our risk Frameworks on top of what they built it's actually the first thing in D5 I looked at was how does Nexus Mutual like evaluate some of the risk of these protocols um next to Mutual Just Launch their V2 which is a bit more broad-based but generally like like there's there's four names here there should be 50 names here right I mean if you actually look at the percentage of of D5 that is insured it's

probably so much lower than you could even guess uh next Mutual is relatively big uh for defy insurance but it's not 100 of of D5 uh TV outlet and it should be closer to that and hopefully as we have more more uh sophisticated actors more institutional actors come into this space they're really going to demand insurance and if you don't have that ready for them uh you're going to be in a lot of trouble um so I have some B5 positions I get cover for them on Nexus Mutual uh Nexus Mutual only covers smart contracts exploits with their V1 their V2 is a bit more broad um but yeah this needs to be looked at uh

much deeper if I were an investor in the crypto space I would say insurance is is where I'd put my money just because if you look at traditional world like they're going to ensure every single one of their products uh and if they don't have insurance they're going to think something's wrong with that so I'd recommend others to look at a few of these uh Sherlock is a great example of like starting at the root of the problem Sherlock also is an auditing firm so they give Insurance to the protocols they audit I think that's incredibly novel it's actually it's actually very cool but like sort of starting at the root of the problem like I said of okay what's the risk smart contracts we need to have the best smart contract Auditors

and then we can underwrite the risk of this protocol um yeah I'm a big fan of next Mutual I'm a big fan of all these on this list I hope there are more providers families thinking about building a protocol let us know we we'd love to incorporate it in some of our and some of our products um yeah like I said it's certainly the most underdeveloped part of the D5 space yeah and I think yeah insurance I think will be a big thing in D5 as well especially when um unlike Trad fire where there's legal recourse and Protocols are going to be seen more like infrastructure um rather than kind of companies and where you know if they get a hack they're not gonna you're not gonna be able to like take them to court or anything like that and and so

um yeah as they see more like infrastructure and they're already bought more like insurance as a backup if things go wrong um so I think it's definitely a huge space and of course kind of insurance sounds kind of boring but for some of us we see it um with a bit more excitement because it also means that there's risk there and that means that there's also potential sources of yield and so in the future and these might be sources of yield for products as well as obviously covering protocols most

expensive it's okay yeah I would love to hear about it after um I so what Nexus Mutual is trying to do with their V2 is sort of open up this space and allow uh Risk Managers to come in and and give a give a view of of what this potential risk could look like but I totally agree and I mean when we talk about like the cool parts of defying crypto many of them are like about automation uh if you can automate the insurance claims process that would totally revolutionize uh some of some of what we're looking at here uh do you have do you guys have any

questions well do you mind if we do that at the end so would you mind if we do that at the end cool so a couple more slides uh uh so this is an important one to me uh when you try to get into like a money market protocol for example they're gonna be like all right what's your do you have an oracle do you have multiple oracles uh Paul can talk about this as well um but these are some of the requirements chain link has uh two million average trading volume you'd be surprised there are not many uh tokens in D5 that have two million average daily trading volume and true trading volumes so not a bunch of bots trading against each other um so you'd be surprised there aren't many uh that have this

um there are a lot of protocols coming out uh recently Andrew can talk about a few of them but that are Oracle lists um don't ask me how that works but but uh oracles are a huge huge part of of defy um basically every protocol is reliant on chain link to me that's an incredibly huge risk that there's really only one provider doing this so like I said if you're building an insurance protocol great job if you're building an oracle provider great job we need more of all of those but yeah those those are some of the requirements it's tough to get products that have truly good oracles if you don't have a good Oracle what you can do is get like

a uniswap t-wop price and that can be manipulated uh it's not ideal so the chain link requirements are very fair but again when you have protocols that are completely reliant on one provider that doesn't sound very decentralized to me and it's certainly a risk factor um okay so we went through some of like how we rate these things uh you can agree or disagree with these ratings but but this is sort of how we came up with some of these things I try to make it a little bigger if I could but basically we went through all of those areas and we put this on different assets so uh you could say uh on this list that

something like usdc is is maybe riskier than binance USC it's a pretty high score from binance USD but I tend to agree um and then as well as lsds lsts liquid saving tokens um those are some of the risk ratings there uh for example we use stake teeth in some of our products uh we don't use something like coinbase Heath in some of our products for example um but these are generally how we score some of these they could be right or wrong but unless we're able to actually put some numbers on these it's difficult for us to to give actual ratings um these are ratings on some protocols we build on top of uh uh this is all like open source so you

can take a picture or we can send it to you guys um it's on our Forum gov.inocoop.com uh but this is how we this is how we think about all these protocols and if you don't go through each one of these and say this is this is how I rate this protocol uh you again could be left in the dust so this is how we think about it we could be right or wrong on these but this is how we sort of start once once we build some of these products uh this is how we rate one of our products so we take what we just did with the protocols and assets we're using uh and then we come up with a absolute risk score and a relative risk score so you could say we have some ethyl products that from the outside looking in like for a

user that doesn't know anything about G5 they go eth oh my God that's very volatile it's very risky uh to us if you're comparing apples oranges there's no point in preparing ethusd like obviously it's riskier but if you're requiring any product to another East product how do you actually weigh those so that's what we came up with relative risk scores and again it's using all of those risk factors we've talked about before and sort of trying to put some numbers on top of it um here's some examples some other risk Frameworks uh uh I don't know if anybody's in the Society of actuaries but uh if you don't start the insurance level and try to underwrite risk from there uh you're going to be in a tough spot uh

risk Dallas is a super interesting team uh they've come up with some really good dashboards as well as generally like some uh some like platform some uh dashboards that have like bad debt within the ecosystem uh again Nexus mutual as I mentioned is there um as well as Moody's they've actually done some some risk Assessments in D5 which have been very valuable so I'd recommend reading those they definitely look at it from a different lens which which I think is incredibly important um uh so these are some of the risk Frameworks that uh Gauntlet has put together so I'm gonna invite Paul up to

the stage uh if we can get him a chair cool uh yeah uh thanks for having us uh David and Andrew I'm Paul I'm the protocol lead at Gauntlet how much time do we have by the way yeah five minutes all right we'll be quick then all right cool I'll be super quick uh so yeah one of the solutions we provide is risk management to D5 protocols so our clients include aveen compound at a high level we focus on something called

Market risk we kind of talked about a variety of different kind of risk factors when we are talking about Market risk we're generally talking about uh the balance sheet exposure that lending protocols or cdps or perps have basically any protocol that enables leverage for their users they take on a certain level of balance sheet risk and essentially we're trying to quantify the amount of bad debt or insolvencies these protocols can face in an adverse Market shock um so yeah basically they're separate from Smart contract risk in the sense that we assume the contracts are working at correctly as intended but now what is the risk if there's a broad Market downturn part of that involves running a ton of agent-based simulations to

predict areas like depositor and a borrower and Liquidator Behavior to predict that hey if liquidity dries up if there's a deepeg etc will liquidations be profitable will the liquidation mechanism fail well adverse liquidations happen and then quantifying actually how much you know these protocols will lose I'm in an adverse Market shock um so yeah this is like I guess one of one of the the dashboards we have we have dashboards for for all of our clients and essentially it provides transparency into certain metrics that are related to Market risk those metrics include non-protocol specific metrics such as um you know in assets liquidity assets volatility the correlation the assets

have with each other Etc and also includes protocol specific metrics for example how concentrated is is this Market what is the amount of Supply on the market relative to circulating the liquidity um you know are the uh is a supply concentrated by a few users what is the health factor of those positions um and yeah something interesting to note is that economic risk actually has resulted in more notional dollar losses by protocols and smart contract risk however this is not very widely known because a lot of the so-called Oracle manipulations have been misclassified is not the problem of the Oracle is actually a problem of price

manipulation the Oracle is given the right price feed it's just the price is manipulated by actors so part of the challenges quantifying the risk hey like how much does it cost to manipulate this asset's price and that depends on the liquidity it depends on how many how many venues is traded on depends on um you know Market maker behavior and fading away price manipulation but yeah I guess that's an additional thing that um you know Gauntlet looks at and so we have research if you're interested in learning more about the risk methodologies and simulations and then we have these dashboards and as a part of our work we get to work with you know great delegates like index Coupe we take a very data-driven approach to making governance decisions

yeah certainly thank you Paul we're about to wrap up here uh I was hoping to ask him more questions uh generally we look at this like there needs to be more quantitative analysis there need to be simulations run like the gauntlet team does I'd recommend not going to show them but hire a risk management team if you don't have one natively on your team uh but yeah that's about it you can find us here again I'm Professor Flex David Garfunkel Andrew uh we're index cooperative and Gauntlet thank you guys thank you guys thank you guys so feel free to ask the speaker if you have any question but outside because the next conference is going to start in few minutes thank you