When $1 Isn't $1: Hidden Risks of Shared Assumptions in Stablecoin Infra

Transcript

All right. Hello everybody. I hope everybody had coffee because we're going to go through some of the hacks or mishaps that had happened over the last several years through stable coins and through the assumptions that we make when we hardcode something to be equal to one. Um generally I go through this talk and I through this talk talking or focused on layers of security and how we need to need all of these layers to actually secure anything. So and it starts with your definition and your implementation and ultimately it ends with your social your social social layer. But today I'm really going to focus on the data definition because that's basically

where this assumption falls in. It's whenever you hardcode your stablecoin to be equal to one you're making that data definition very straightforward. That's where your your assumption lives. And then how you implement it into your protocol can have some repercussions like we've seen in the last couple of years. Um so the three places where we see this assumption play out is directly by telling your oracle to provide that or hardcoding it straight into your smart contract. Uh through a swap contract which can be a little bit harder to find but that's something that it's implemented on Sky and uh Maker DAO in the past when it was that and it's called the peg stability module and

we'll talk about that a little bit more length in just a second. And then and then the third place is through off-chain approval of minting logic. This is when a key or a fund manager has permissions to just say we have these funds and we're going to mint X amount of our stablecoin or token. And that has happened in the past. So how did it did all of this begin? It began at at the beginning. We all thought it would be very safe to assume that Circle's um USDC and Tether could be, you know, just hardcoded at

one. We don't need to an oracle that could potentially be manipulated, right? We trust these entities. They're centralized. They're regulated. They're well-known. You know who to sue, right? If something goes wrong. So, a lot of people started with off with that. They started including collateral from them and they instead of using an oracle and making that trade-off where something could be manipulated, they just hardcoded it to one. And so, that's how it started. How it's going? Well, people expanded this definition to other assets just because they were accepting these assets at these underlying assets as collateral for other assets that they were creating.

Um and we ended up with a lot of losses. Mainly or the biggest one happened last year at the end of last year where Stream Finance and Elixir pretty much ceased to exist. And right now they're in litigation. The losses or the estimates for losses range between 285 million to 700 million. And and the thing is that this type of assumption is not actually stopping. These are only the warnings of a broader systemic risk that we could be facing in the future we continue to just do this blindly and not test and stress test our assumptions or have guardrails around them so that we can actually do something when something happens.

So, I'm going to go through the first time that this happened which was unintended. It was a real mix-up. I think what happened in in 2023 had nothing to do with anything that happened on chain. But money and politics are very very very closely related. And in the US and during that time it was like operation choke point 2.0 or something and all those these crypto banks were facing a lot harder regulatory requirements but also um the the theory that I read online somewhere was like a lot of founders that were and banking with Silicon Valley Bank were just taking a lot of their money out or

using it because we were in a bear market and eventually Silicon Valley Bank became um illiquid or and they had to shut down. They were holding about 300 or 3.3 billion of the USDC reserves at the time. And when they shut down even though they were only representing 8% of the Circle's supply um they still had a depeg. They they they caused this depeg. So everybody panicked and started selling their USDC thinking they could never get back to a dollar even though it was only 8%. We all panicked. We all caused this.

And the thing is that because other uh coins Maker DAO um uh one of them that was one of the biggest one affected them and Frax um had accepted USDC as collateral. They also experienced a depeg. And they the way that they did it was not through a the oracle. They actually had a peg stability module or contract that allowed people to swap one to one for die. So what ended up happening during the during the depeg. So this is how it was supposed to work. Everything works great when the swap is one to one and everything is valued at one to one. But

when that breaks which happened in 2023 and granted their assumption assumed this would never happen because it had never really happened and this was something that wasn't even on chain and people still you know this still happened. So what people were doing or arbitragers were doing they would buy USDC cheap because it was on sale right? So for 87 cents they went and bought it and then they went to Maker DAO switched it for one DAI sold the DAI and made a profit of 12 cents and then they did that over and over and over again until they depleted that and then DAI eventually depegged as well.

And I call this and remember this because we're going to see it again in a second. Oh, no. I'm out of time. Okay. So Elixir did something very similar they did they did um them and Stream Finance they had this relationship this incestuous relationship with where they were investing or they were minting their tokens of each other and and holding both of their collaterals so when one of failed they both depegged and that caused that big that big issue. In this slide is I call it the instability module. Please do not ever do this. Do not do this recursive loops. The way that they ended up doing creating 524 million was through basically investing

their own coins again and again through each other. They did this three times so from 168 million dollars they ended up minting or creating 524 so when they went down everything went down with them. So in their case if USDC failed if Stream Finance failed or Elixir Finance failed they were all doomed and that's what happened. And with that I really run out of time unfortunately there's a lot of other examples. um And you just have to see another talk from me but they're all super interesting and they just here to keep you safe but anyway thank you so much.