Torgin Mackinga - Oracle-free DeFi

Transcript

[Applause] thank you very much you guys can hear me yeah um so hello my name is Toran uh I work at chain security uh where the clickers don't work do we have another interface oh yeah now it works okay so I work at chain security uh where we work together with a bunch of D5 protocols um you might know some of them uh but today I actually want to talk about one that you probably haven't heard of uh so I recently did an audit um for a project

called Franken coin and I found it super interesting and um it's a bit different from what you might know so I thought I would make a presentation about it um so the way we're going to do this is first I'll give you a quick recap of how collateralized l Works um such as in a for example which you might be familiar with um then in those solutions that kind of already are around uh usually we use oracles and I'll discuss some of the problems that oracles bring and uh why we want to avoid them and then I will talk about uh Oracle free liquidations and how we can actually have a collateralized lending system without needing an Oracle and I will be using Franken coin as an example um

there's a couple different ones out there but this is the one that I know the best so that's why we're going to use that one cool so first of all collateralized lending uh right this is something uh that you might be familiar with uh there's protocols such as liquidy or a or maker they all use very similar uh methods for Lending and uh usually the way it works is you put in some collateral so here we have some eth as collateral and then you borrow a different token so for example LUSD and um the way this usually works is we have over collateralized loans so the amount that we borrow always has to be less than the amount that we put in and this is great because this means that we don't have to have any trust in the

borrower right like if you're a bank and you want to give someone a loan you need to do some due diligence and see if that person is trustworthy but if the person just gives you more money than you give them then it doesn't matter right this is kind of the nice thing how we can have permissionless uh loans on the blockchain because they're over calized now these collaterals they are usually very volatile right so we have eth and as we all know the eth price today is not the same as it will be tomorrow so if e goes down um then at some point this position will no longer be over collateralized and then we have a big problem so to avoid that we need to do liquidations so if the price of the collateral Falls uh enough then we

liquidate it which means we sell the collateral and repay the loan um for the person and then the person just loses the collateral but they keep the The Borrowed assets that they never paid back but as long as this liquidation mechanism works we actually don't have any problems if the person just puts in collateral borrows and then is never seen again um now the tricky part is we need to know when to liquidate these positions right and in general smart contracts don't know the prices of things such as eth right a smart contract cannot know the price of eth so somehow we need to figure out when it's time to sell this and usually we use uh a price Oracle which is basically a

contract where people post uh some price to and then your contract reads that contract and and that's the price um and the most popular one of these uh is chain link so in chain link a bunch of chain link nodes um go and try to figure out what the price of something is and then they aggregate their answers and they post it on chain um so here you have one problem which is that you have uh points of trust right so first of all you're trusting these nodes that the majority of those nodes are actually uh giving you the correct price and otherwise um you know you might get get incorrect prices and then also there is the contract upgradeability right so these

nodes they post the price to a contract on chain but that contract actually is upgradeable so there's a um an owner multisig controlled by chain link and if enough of uh the signers they signed they can upgrade this contract that the nodes post to uh to do anything that they want so for example they could upgrade it so that all of the chain link nodes are ignored and instead it always returns a price of zero right that's something that they could do and so here we have another point of trust and because we're in crypto we're actually kind of trying to reduce the points of trust so if we could get rid of this that would be amazing um the other one is that oracles actually have a fundamental limitation

which is your price Oracle can only give you the price right it's kind of obvious but um what if the price is just manipulated right so here from 2021 we actually have an example where there was a token uh called Venus which was trading on binance it was like a fairly liquid market and um yeah I mean it traded on binance so it's bigger than most tokens actually um and here there was a buyer who just bought this token and he increased the price to 50% higher than it was before uh over a couple hours and this was the major Market the biggest one and so the oracles they all reported this Price Right which was

correct because this is the market price but there weren't actually real buyers at that price right there was just this one guy who was pushing up the market um but you wouldn't be able to sell a large amount of tokens at that price and this is kind of the limitation where you your Oracle it tells you a price but it doesn't tell you how much liquidity uh the market has to sell into um and so what happened here is that this guy then went and took a loan out with the these meus tokens as collateral and he stole a bunch of money right and that's exactly what we're trying to avoid um so basically what oracles can tell us is the price of some collateral token is currently X but that's not what we care about what we

actually care about uh with liquidations is can I sell the collateral token that I need to sell for at least the amount of borrowed tokens that I need to close the loan right that's the the question that we're actually asking um and this has to include the price impact and or the price oracles just don't really give us enough information to answer that question so um now let's talk about this kind of new approach of if we don't want to use an oracle how else could we uh solve this so we have a couple things that we need so first of all we need to know when to start a liquidation um the second thing is we need to know what price to sell at and the third one is we

want to make sure that there's no incorrect liquidations right we don't want to liquidate someone who shouldn't be liquidated um so usually we solve all of these things by just using an Oracle and and trusting it but um these uh two protocols I've listed here Franken coin and asna they have very similar ideas and the way that it works there is um we don't use an oracle but instead we have some role uh that triggers a liquidation so it says now there should be a liquidation uh then we use a Dutch auction right so we hold an auction where we start with a high price and then we reduce the price over time until somebody buys it and that's how we find our price and the third one is that if this price that we found is uh too high

kind of then we can punish um the person who said that the position should be liquidated even though that was not true um yeah so let's take a look at how Franken coin specifically implements this so Franken coin it's very similar to uh like liquidy what I showed before you put in some collateral and then you mint a uh stable coin um against that position and it's over collateralized um and then the borrower sets a liquidation price for themselves uh that is defined in Franken coins um and so for example here we could have a liquidation price of 1,000 uh Franken coins per eth and if the price is lower than that then you can get

liquidated um and so now what we have in Franken coin is that anybody can come and challenge this position and say this should be liquidated and in order to do that they have to put in some collateral as well so here if the collateral is eth then the Challenger also has to put in eth and then um we can take a look at what happens so here in blue I have the true price of uh whatever the collateral is that we're trying to liquidate and this is of course unknown to the contract right this is kind of what we're trying to figure out what the true price is but we don't know it um and so as soon as the true price goes under the liquidation price somebody should come and start a challenge and say hey we

need to sell this and so what will happen then is there will be an auction that has two phases in the first one which I have in green here is the price will just be constant at the liquidation price um and if somebody wants to buy the token at that price then they can now in this case the liquidation price is above the market price so nobody will do it so then after some time um we will get to phase two which is the Dutch auction where we start decreasing the price that we're willing to liquidate at um over time and yeah it just goes linearly uh from the liquidation price to zero eventually and so then at this point that I pointed out with the arrow here that's when the true price of the asset goes lower than the Dutch auction

uh price so at this point it's profitable for somebody to buy this asset in the Dutch auction because it's actually worth more than what we're selling it at right so there will be some small Delta but essentially we will be selling at almost the market price even though we didn't know it right we just know that it's the market price because someone's willing to pay that much um so this is kind of the the first case where we have like successful liquidation and we sell the collateral um in this auction without using an oracle now there's another case which is if the true price Falls and somebody starts an auction but then the price goes up again right this auction takes some sometimes so the price might change um so in this case uh we will be selling

in this first part where the price is constant and we'll be selling at the liquidation price so if we sold at the liquidation price that means that the asset must must be worth more than that otherwise nobody would buy it right and so in this case we actually don't liquidate the position because the collateral is worth enough and uh so in this case you remember I said the Challenger he also has to put in some eth so here we would actually be selling the Challenger's eth instead of the position's eth um so the position is untouched and the Challenger would probably have a small loss in this case but if there was a successful liquidation then we would pay a fee to the Challenger um where he would make money right so he sometimes makes money

and sometimes loses money um now the big reason why we need this is the third case so this is a third case where the real price is actually higher than the liquidation price but anybody can be a challenger right so anybody can just come and say hey we need to liquidate this position so what happens then is a challenge starts and then again we're in this green phase first where we sell at the liquidation price and the liquidation price is lower than the real market price so somebody will instantly go buy this right because this is very profitable you're buying the asset as at a discount and so then we have a challenge that starts and immediately the collateral gets sold but at a lower price and so in this case the Challenger the the

Challenger's collateral will be sold right because we're still in the first phase and so now the Challenger made a loss because he incorrectly said that a position should be liquidated even though that was not the case cool so let's recap what we wanted was we wanted to know when to start a liquidation right so here we have a challenger who puts down some collateral and says hey I want uh we should liquidate this now and if he's correct then we pay him something for it the second one is we need to know what price to sell at so here we have our Dutch auction that's split into two phases first we have this constant price and then we have the declining price um and then the third one is how to avoid incorrect liquidations right and so here we do the thing where if it's sold in

the first phase we actually don't liquidate the position but instead we liquidate the Challenger collateral and uh if it is sold in the second phase then we know that we had to liquidate the position uh and then we do that cool so let's talk about some pros and cons of this design so one pro of course is we have no external dependencies we don't have an oracle or anything that uh could go down for example or could be malicious or whatever uh we just have Market forces now of course what that means is we need Market participants right we need people to be watching uh these auctions and bidding in them competitively otherwise it doesn't work right for example if there's nobody that bids then the price will just go down to zero right and that's bad

um now one of the cons of of having no external dependencies is actually we cannot um have a hard Peg to anything external so the Franken coin wants to be a Swiss frank stable coin but this mechanism that I just explained doesn't explicitly Peg it to the Swiss frank because it can't know what the Swiss frank Price is Right so what the mechanism ensures is that uh the Franken coin is always over collateralized um but in theory the price could be different from one Swiss frank so for example if we have a liquidation price of 1,000 Franken coin but one Franken coin is worth two Franks then the liquidation price will be 2,000 Franken

coins uh will be 2,000 Franks so because it's a self referential system we cannot have hard Peg to something that's outside of the system um but we know that it's always over collateralized right so we kind of have a lower bound on how much uh this coin should be worth um then the next cool thing is that here the price impact is taken into account in our liquidations right I said before that this is a limitation of oracles is um we don't know the liquidity of the market we just know the current market price but here we had some position right you can imagine this was a huge position maybe and we found the market price for it by doing an auction for that position so we know

that somebody was willing to buy buy that amount of tokens at that price because they just did right so we know for sure that this gets taken into account and so for example if there was a huge position uh maybe somebody would even start a challenge before uh the kind of market price goes below the liquidation price because they're predicting that you won't be able to sell this huge amount um at the market price right you you kind of have to predict the price impact of it and then um if it does clear below the liquidation price then you will be rewarded for making this uh this prediction correctly now the downside is um our liquidations take time right we have this um first period where kind of

nothing happens it's like a sanity check and then we have our Dutch auction which also takes time so during that time of course the collateral value can go down more so if the collateral value goes down by more than the over collateralization then we have bad debt just like in any other other uh system um yeah and because our system takes time we kind of need to have uh like bigger buffers if we have liquidations that take a long time than if they were uh very quick um the other thing that is really cool about this system is that all the roles are permissionless right so anybody can borrow these tokens anybody can be a challenger you don't need any uh permissions also the contracts don't need any uh permissions there's not like an admin or something

that um can uh decide what happens to the contract it's not upgradable there is a governance system that's also very interesting but kind of out of the scope of this talk U but in case you're interested in that kind of stuff I recommend uh looking into it as well um now the downside of having these permissionless challenges is that we need a lot of collateral for the challenges right so if you're trying to liquidate a 100 e uh position you need to put up 100 eth as collateral to challenge it um or you can put a partial collateral but then it will only be a partial liquidation right so you could for example put up 10 e liquidate and then do it again right but then you're multiplying the time again that it takes

to liquidate this stuff right you would have to do 10 Liquidations in a row and again in that time maybe the the collateral has gone down in value so I think this is actually the the biggest limitation of the system cool so in summary first of all oracles suck this was kind of what I tried to uh illustrate in the first half the second one is we can avoid oracles actually right this is actually not something that's necessarily intuitive that we can even have a system like that without oracles at all um but it comes with trade-offs of course right so we just talked about the trade-offs I think the biggest one is really this that it takes a long time to to do this whole process and you need a lot of

collateral um yeah uh but all of this Oracle free stuff it's really new it's really interesting um so I've really only seen it like over the last couple months uh that a bunch of projects have have started um working on something like this so I think the design space is still very big and uh we might even be able to come up with solutions that are better than this that have like nicer trade-offs than than this one um yeah so I'm excited to to see how this uh kind of evolves in the future cool I I see that we already have questions if you just give me a second

my colleague will bring your microphone there uh so I think the like the design of this system is exactly itm poent to an options Market if I make a wrong challenge where the price of the I'm speculating that the you know liquidation price will go lower but when I make the challenge it's higher than the liquidation price I've I've I've essentially written a call a call option with the strike price is the liquidation price and the liquidation time with the time to expire right so you're saying that at the time you create the yeah

challenge it's above the market uh the market price is above the liquidation price yeah yeah it it it's if equivalent to me running an options so let's say I create a contract that wraps your contract so when I create a challenge I can sell my claim my challenge claim to somebody else that challenge would be priced exactly like an option like as if I'm running an option with time to expiry being time until zero there and the liquidation price as the strike price so the problem is that uh your challenge will be immediately ended so anybody can uh buy your collateral that you put into the

challenge at this liquidation price which is below the market price right so sorry sorry I meant the other graph and yeah the one where like here so yeah it's basically an American option right yeah so here um here I think that sounds just about right yeah yeah yeah yeah yeah it's an Amic option you know like anytime that crosses I can exercise the option and it will get exercised in a rational Market as long as it's lower it's going to be priced exactly like like an option with SATA T and uh and price and a strike price P1 yeah I I think that's correct and that's also nice right because it actually means that opening these challenges is less risky because you can sell it in that it's like it's a very easy to calculate

you know you can there's already calculations I mean exactly it's standard options price any cool any it's cool I actually thought something similar to this but I never got to the point that I man I matched it to like an options market so cool yeah cool we have another question over there um by the way way if you guys want to learn more about this we have the audit report on chain security.com where we have a really detailed explanation of how the whole system works and also of course the issues that we found with it so we found a couple cool cool issues actually so if this kind of stuff interests you I can definitely recommend checking out that uh audit

report hi talk great talk do you think if it were possible to do sealed beid auctions efficiently on a blockchain you could sort of optimize the capital efficiency of the system by doing the part two Dutch auction and the part one in a single sealed bid auction of some kind can you repeat the question yeah so I give you a magical uh contract that does sealed bid auctions can you do the collateral auction both the the part and the path two together in a in a very in a more efficient manner

um yeah maybe more time efficient if that's what you mean I mean I think the Dutch auction should always find you the correct price right it just takes some time is is that what you're talking about yes yeah so if everyone bids their price at the same time then we also find the the highest correct price yes I mean that auction would also take some time right everyone needs to have time to submit their bids but yes I think so I [Laughter] think thanks for the presentation really

interesting uh I have one question to that slide uh what happens you you said the Dutch auction goes to zero yes so what happens if if the price Falls and it never like Falls to zero so what happens wouldn't you want to liquidate at the price of the like sometime like because otherwise everyone loses no well if the price of the asset is zero you can't sell it for more than zero right yeah but then maybe it would have been better to sell it before no yeah so I I mean that's a problem so if something is too volatile and goes uh down faster than the rate of the D

auction for example uh then you will be selling it at zero and then you just have bad debt in the system but I mean that's the exactly the same in any other uh over collateralized system like this like in a if one of the collateral tokens goes to zero um then it's also worthless but then maybe the obious auctions are a bit quicker right um but generally if something goes to zero immediately you can never solve that uh it's just if of course yeah yeah so basically you you should um not use tokens that can go to zero in a short time of course of course as collateral right and that's actually also something

that in Franken coin you can use any token uh as collateral in principle but of course you should only uh allow those that are um like suitable as collateral and that you can sell into a liquid market and so on and this is part of the governance system that I alluded to earlier okay thank thank you I'm afraid we don't have time for more question but I hope that Torin will be around uh a little bit longer at the event so you'll have a chance to connect with him and ask your questions and now let's just give him a round of applause for a fantastic presentation