Managing Risk in DeFi

Transcript

yeah cool yeah hey everyone my name is Hugh cup I'm the the founder of the Nexus mutual we do alternative to insurance for the D fire risks or smart contract risks so there's a tiny bit of stuff on Nexus here but this is mainly just more general presentation about understanding risks in defy and and what that actually means and and how his users we can understand things a bit better and hopefully take action and and I guess be a bit safer or at least more aware of what's going on so I firstly start with I know something that I find

fascinating maybe other people find it quite boring but in 2001 which is a long time ago but Russia brought down the MIR space station and they crashed it into the Pacific Ocean and before they did that they took out two hundred million of insurance coverage on the chance that it might take out Tuvalu or maybe land somewhere in Auckland if they got things really bad and so no no this fascinated me cuz I was a student at the time and I kind of got one I think it I guess it fascinated me because it's a new type of risk no one had ever done this before

and someone had to work out how to actually provide coverage for it and and how to do it and make the whole space safer but it was a new thing it needed to be done and then but then there's a way of kind of managing risk and everything turned out relatively okay it just crashed into the ocean and all those alright so so yeah so this I guess the point is there's always new risks every time we do something new there's there's always something that we need to be aware of and we can often just go ahead blindly but sometimes it takes I make some sense to take a step back and understand things first and then you can decide what you want to do from there

but understanding is kind of the first point and and so I kind of walk through a kind of rough framework that that I've kind of well I've kind of come up with a bunch of it but honestly it's just based off standard risk management techniques that a whole bunch of people in the finance industry use and so I don't have to reinvent the wheel on everything and but this is just kind of specifically applied to risks in Indy five so the first thing to do is kind of understand what could cause a loss what events could cause a loss and I mean you can come up with an endless list of things but I tend to categorize things into these three categories and then you can

kind of work through the details of the specific use case that you're that you're thinking about the first the first one is technical smart contract risk so this is basically the fact that the developers may have coded something but it wasn't fun correctly or their intentions weren't exactly correct and they missed a missed something mister check or did did something weird like you know so like the parity bugs or busy acts recently I guess is a good example then the the second the second risk is external race so this is kind of I guess a wider category of risks but external to the smart contracts and that could be things like Oracle's or or governance processes things that can influence the

like basically if you're putting money into a smart contract and something could influence it someone at there's an admin key or there's an Oracle or something like that anything that's external to the smart contracts that could be attacked to the influence how they work and potentially cause a loss and then and then there's kind of a also another broad category of economic incentive failure and that could be something like I guess one of the most obvious ones is if the maker interest rate mechanism doesn't actually managed to make the peg hold or for example if you've got money in one of the lending pools and then you can't get your money out because because there's a

like there's not enough liquidity on the other side or something like that so there are those types of risks so but that's kind of that's kind of how I think about the the categorization and it helps just identify things and there's not necessarily meant to be completely exhaustive but I think this kind of covers them most of the things and of course you I guess the other point is you're never going to be able to think of everything there's always going to be the unknown unknown stuff and I'm trying not to quote Donald Rumsfeld so the next step once you've kind of understood what the risks are is to kind of go through each one and this is a bit laborious but I think it helps

is go through each one and think about them in two in two dimensions so first the likelihood of it happening and then what the potential consequence is if it does happen and so like something could be quite quite likely to happen but it may not cause much loss or you know you've got the converse and things like that so and it's important to categorize those things and once you think through it you can get a much deeper understanding of where things are so I mean for example you might think that compound having a technical smart contract bug still after being kind of padl tested for quite a while is

actually relatively low but the consequence of it but if something does happen the potential consequence of that actually occurring could be quite catastrophic it may not be maybe there's only a but maybe I need small amount of funds maybe lost but it turns what the bug is but it has the potential for all the funds to be lost so then you do boring miss risk matrix stuff and you just kind of put it into a low medium high stuff and I mean this is nothing new this is just some things that the financial world used pretty regularly and it just helps you categorize ends it's not this is not it's supposed to be like overly scientific it's just supposed to give

you a broad understanding so yeah and so in that compound example you know you might end up with a medium rating or something like that because it's really maybe it's rare that it could happen but the potential outcome news is severe and so then you end up in the in the bottom right hand corner and you have immediate reading okay great then then you can do that okay so once you've done that across all the risks and things like that it's important to then workout now you have a bit more understanding of what the risks are and what the potential outcomes might be you're never quite sure exactly what's going to happen of course but then you can use that to potentially take action

and this is like just a pretty basic thing that helps to kind of understand what you might be a reasonable response if if you're talking about risks that have low low likelihood and low consequence and you can basically ignore them it's not too much not so much for you if you're talking about something that's got a high likelihood and a high potential consequence then you probably should just not do it in the first place I know they're a bunch of gamblers head here with d5 stuff so you know maybe you would do it anyway but this is all relative to your how risk-averse or not you are and then then there's are two interesting categories which is manage all kind of insurer and and if you've

got this high likelihood event but it has a low outcome then it's more likely that you should it's more going to be cost effective to manage that and so that might be something like I don't like it's more of a trading strategy so basically you know if the the risk of the price dropping 20% then and you worried about that then you can hedge it with a financial derivative or something like that you know but that but that approach might might work well if it's a if you've got that low likelihood event but high consequence then you're in that situation where you could potentially not handle the bad outcome if it was to happen you don't have the either the money or the it puts you in a really bad position so that that's when you should

potentially look at insurance type options if they exist yeah so I think that that's that's what I think this is one of the most important things to to do to understand it gives you a hopefully pretty simple way of responding and thinking about things I'll try and go through a specific example and I'll note that everything I say here is like just my personal opinion on the ratings and stuff and different people depending on how they view things would come up with different ratings and this is more about demonstrating the process and and how it and how it can work and and what you might do from there so so say you're

wanting to save dying compound so the first thing to note is you're taking two risks here you you've got the diarist so you've got to make it our risks and then you've also got the compound risks and so I've kind of just classified there I mean into the buckets and given them some ratings so on the technical risk both hopefully pretty rare that something's going to happen but the consequence could be severe so you end up with medium ratings on on technical risk external risk you know you can you can debate all of these things by the way external risk on compound you could argue that's rare maybe you're not beat

don't know but the consequence could be severe again like maybe that if they admin Keys get compromised in some fashion then someone could run off with the money in in die maybe that's slightly more likely don't know you know there's obviously some discussions about being potentially able to co-op the the governance framework and stuff you know I don't know some changes going through but you know again all of these are completely debatable maybe the outcomes modest for the other day but basically you can end up end up with some ratings medium economic incentive failure interestingly on compound this one's a this one's a just perspective I guess the most likely outcome if you've got economic incentive

failure on compound or one of the lending protocols is that you can't actually get your money out for some period of time it's a bit less likely that you you may not get all of your money back but so that's a personal decision if that's a critical issue for you or not for some people they're quite happy to wait another month or something but maybe that's actually pretty cool for you so read it how you how you wish so yeah so then you then you come up with these these ratings and etc and then all I've done is given a score of one for low two for medium three four five four four

very high and then stacked them on top of each other so not scientific at all but illustrative for the purpose and so if you've got if you got dyeing compound then you're taking the platform risk of aetherium then you're taking level two risk which is kind of maker then you're taking compound risk on top and so and these are in a different categories etc so and that says nothing about the risk you're taking about managing your own private keys and all the rest of it so but the point being that they're a bunch of risks here and there they're layered on top of each other so then I did it for a select different different ones in D Phi this is and everything could go on

forever and again might just my ratings but it gives you some idea of what's going on so if you put the if die in DES are dying comp pound USD seeing compound it's got a different risk framework you know then maybe you've got like curve as an example it's built on top so there's another there's like a level there's another level of risk on top of things so you know this is the kind of the money Lego thing about being built on things being built on top of each other and rich accumulating etc and and I guess the the challenge here is to this gets pretty complicated pretty quickly I think that's one of the main points and I'd argue that well most users aren't

going to do this for status but and so therefore it's probably up to us to kind of help I guess explain educate but also help them manage the risk you know and a more appropriate way so you know maybe insurance is part of that but also I think there's a whole bunch of other things week that we can do but the first step is education and hopefully this is a step along that path so then what you can do these this is based on the returns that right now were there a few days ago I just got from the various sources and say you can you can then

plot them on this risk return type matrix and then you can have an idea about where your so the classic economic theory thing you do then is you create a utility curve which is like basically the your equivalent version of like how risk-averse you are and that that will give you what's equivalent on a low risk low return and high risk high return for you and then you can decide which ones and ones that above the curve better and ones that are on the curve are all equal and ones below the curve or worse and so that kind of gives you a your own view about the relative trade-off between risk and reward so you know as an example if you you know you're putting

money in curve from die years they see this says nothing about the four curve version with the y tokens and cetera which probably has another two layers of risks on top of it but and someone said to me last night that it was 130 percent APR but you know I haven't checked that one so it'll be kind of off the scale on this but still it's another option and and these are these are kind of some options right and I've plotted a few there we've you know with Nexus obviously promoting our stuff but which is basically the idea that you can reduce some risk for reduce risk reduces returns a bit to pay the cover price but it isn't it provides you another option

on the on the curve which works with some people or may not work for others coming to the end hopefully hopefully got a lot of questions yeah so I think yeah that's kind of my summary right now my name Lego is awesome but we just need to be a bit careful and hopefully we can take it a bit more slowly I think I think building code poseability is a superpower and so we should definitely use it we should definitely innovate we should definitely keep pushing stuff forward but we also need to make sure we

do things in a bit more unknown controlled fashion not go not put massive amounts of money and stuff that it's only been on there for a few days or weeks or something until we see what happens it's it's hard and especially when you've got new people doing some stuff with good intentions and then something goes wrong and then everyone piles on all these expectations of that so we've lowered the barriers to entry to doing new new innovative stuff by a massive amount which is really cool and then we'll get heaps of innovation out of it out of the back of that but we also need to take in mind that there is risk to what we're doing and you know some people are perfectly willing to gamble

on this stuff and that's fine but other people have different expectations on the level of security that they're that they're taking so you know educating users is is a good first step so yeah but we've we've got a bit more we've got a bit more to do in my mind so my goal is to not say don't do the panic one but take it a bit more slowly and and understand things and educate and reduce the risks so that that that construction of five or six different protocols does not require panic in the future but yeah

take take it basically walk before we can run is kind of I guess where I'm coming from yeah so very very short hopefully gets it back on time but hopefully that was that was useful and I just think we're we're doing some really cool things just thing to be a bit more aware of the risks were taking and hopefully yeah hopefully that keeps everyone bunny a bit safer than it has been so yeah thank you hello so you are ensuring risks for companies and products that evolve all the time I'm

thinking about maker Dow introducing the new died and ESR I'm thinking about compound now introducing the comp token for governance how do you manage to evolve your insurance product all the time do do your actuaries get any sleep yeah so I guess firstly let's make a full disclaimer we're not actually insurance and we're not regulated we provide discretionary cover but having said that same thing the questions still perfectly valid the way the way Nexus works is anytime there's a new smart contract or a new system basically we require members of our mutual to stake

financial value against it and the more that's staked the lower the price and for a newly deployed contract it's basically we don't provide cover unless there is taking so that's basically how it works it's kind of when when a newly deployed contract comes out it starts the clock again and then you need some staking to to bring it down into a comfortable range if if the contracts being on Manor for a while it's been battle tested it hasn't been then you can it can provide cover without staking but staking still helps hi framework you provided to compare different defy products is great but do we have any flavor that allows us to compare defy

risk to traditional finance risk well you can go through the same framework I guess the point being that but the framework is exactly the same it's just this starting point it's different potentially like so you're not talking about that there are different categories of risks that you have to write and so basically from once you understand what could cause a loss then you can go through exactly the same framework as before and compare them the the difference is understanding what those the ways you could lose money but is there any like guidance how to compare tourism technical risk in traditional finance compared to default it's a

totally different concept so I don't think the technical risk is actually gonna be a thing necessarily like you've what you're really talking about that is if something goes wrong what are the what are the fail safes in place after that so you can take legal action against the company then you've got the courts then you've got government regulation what safety nets are in place and that it's more gonna depend on your jurisdiction than anything else for example you know do you have FDIC insurance or is this an unregulated product is this regulated product those those types of things so you you're more gonna be it's going to be harder to understand exactly what the failure modes perhaps but it's more going to be understanding what the what actions you

can take if something were to happen what are you covered for and what are you not covered for hey great talk here talking like hey how are you ensuring the Nexus contracts good one we are yeah but you could take some measures like going in to verify ability of the contracts or maybe adding a legal layer to it is that something you're looking at yeah yeah we Nexus is actually a dhow itself but it's actually a legal entity in the UK so it's like a legally linked del whatever the I guess on that side we don't really have any options right now

because the irregular insurance industry isn't covering this stuff which is kind of one of the reasons we build Nexus in the first place to cover crypto risks because we can't get cover from the regular insurance industry right now but I think from a from a user perspective you and you say you're putting money on compound and then you get some cover in the Nexus like if the worst-case outcome is basically if both of those things both compound and the exes fail at the same time if as long as that doesn't happen then you're going to be okay because either you if you lose your money of compound goes down you get the cover you get the claim power if Nexus goes down you lose your cover cost but

that's a relatively low cost so you know not ideal but not a massive critical failure and you can pull your money out of compound so the worst-case outcome is if they both fail at the same time so you've still increased you are still reduced to risk quite a lot but agree nothing nothing's 100% yeah you could get we have kyc so high here I always a fan in regards the last speaker Badri said you know you could you know he

warned against doing an uber and just going all out and screwing their check you know forgetting about their regulatory risks and and becoming popular so with defy which one would you pick safe but not used by anyone really or quite unsafe but used by a lot of people what would be the financial strategy for the next year one two three well yes you're an insurance man so yeah like this is obviously a spectrum and it depends on the particular situation and some things are higher risk than others blah blah but I guess if you're not if you don't have any users what's the point so to me we have to work out ways to to do this and I think I'd also do it

more generally I didn't I'd encourage us to self-regulate somehow like all regulations in the regular world come from good intentions like they're trying to protect people from stuff and so we shouldn't like absolutely dismiss them but we can we can actually construct things in a different way like that to give a specific example like Insurance Regulation that I know of basically insurance regulation exists primarily to address two key risks the first one being that you essentially as a customer trusting the insurance company to look after your money appropriately and making sure that they have enough money if the claims were to

happen to pay them out so there's a is an agency risk there and the second one is the asymmetry of information between the insurer and the insured in which case you're trying to the insured is trying to establish how safe that particular insurer is and so both of those things can be fundamentally cut addressed using aetherium into my contract so you can take you can you can take away the custody issues you can the transparency is is there and and so that doesn't mean that the regulations are going to change but we're actually dealing with the core issues of what the regulations are there in the first place

for so I guess I'd encourage more pushing the boundaries where we're dealing with the underlying issues in a in a different way because then if something bad happens is you've got a very strong argument with the regulators look we're not trying to be Cowboys and you know cause harm to people this is genuinely a different new way of doing things that has significant benefits and so I think you know but that type of situations entirely different - I know doing and I picked Martin darknet market with I don't know mixes and stuff I don't know you know there is there's a spectrum another question

thank you all right thank you [Applause]