D3M Risk Assessment


Users who borrow cryptoassets from third party lending protocols can face unpredictably high interest rates during periods of high demand. Users are unsure how interest rates will vary, and hence what their borrowing liability will be.

The Direct Deposit DAI module (D3M) is designed to solve this problem. The D3M is a new way for the Maker Protocol to interact with third party lending and borrowing providers by adding additional liquidity to balance out periods of high demand, and remove liquidity in periods of low demand. The implementation of the D3M will allow users of third party lending protocols to benefit from more predictable and stable interest rates.

The Maker Governance process will decide an appropriate target variable borrow rate. This will ensure that incentives are aligned while offering a competitive DAI borrowing rate on selected third party lending protocols. The technical implementation of the D3M is explained by @hexonaut in MIP-50.

The D3M is designed to interact with any third party lending protocol that Maker Governance decides to work with. However, the first implementation of the D3M will work specifically with Aave v2. Hence, this report will assess the risks related to collaborating and implementing the D3M with the Aave Protocol.

For the first implementation with Aave, the D3M will mint, and directly deposit DAI into the Aave v2 protocol. In return, the D3M vault receives an equivalent amount of aDAI, a redeemable deposit certificate pegged 1:1 with DAI. The aDAI smart-contract continuously adds to the balance of all aDAI token holders, including the D3M vault, to reflect the interest accrued in the Aave DAI pool.

The key benefits of the D3M for MakerDAO are: (i) it provides an additional mechanism to help stabilise the DAI peg, (ii) it increases DAI attractiveness for borrowers, by offering more competitive rates compared to other stablecoins, and (iii) additional aDAI interest will generate new revenue streams.

Solvency Risk

Aave Risk Mitigation Mechanism & Risk Parameters

The Aave protocol consists of four different markets: Aave v1, Aave v2 (main), AMM market and Polygon market. Aave uses several mechanisms which prevent under-collateralization across these markets. However, in some cases risk parameters and mechanisms differ between them. Some of these mechanisms are not automatic, but instead depend on Aavenomics, where Aave governance has the option to spend certain funds to cover protocol deficits.

The first mechanism in place is the collateralization requirement for the borrowed debt, as well as the liquidation system that is triggered if a collateral ratio drops below a required minimum level. Aave has an initial collateral requirement (Maximum Loan-to-Value) and a liquidation ratio (Liquidation Threshold) at which a position will be liquidated. These are defined for each respective collateral asset. If the maximum LTV in Aave is set to 75%, and the liquidation threshold is 80% for a specific asset, then this would correspond to a 133% initial collateral ratio and a 125% liquidation ratio. After an initial position is built, users can withdraw collateral and lower their collateral ratio further than originally allowed. This means that the feature can be played. Aave markets also use cross-asset collateralization, which means different collateral assets can be used to collateralize different borrowed assets in the same position.

The Aave v2 platform offers several assets. However, not every asset can be used as collateral. In addition, AAVE tokens cannot be borrowed. Out of the 8 fiat stablecoins available, only USDC, DAI and TUSD can be used as collateral. All ERC-20 tokens (19) available on the platform can be used as collateral, except for RenFIL. Because of the significant number of assets available, and the cross-asset collateralization mechanism, positions can become relatively complex. In comparison with Maker, Aave generally offers lower collateral requirements on the majority of their assets, with the exception of YFI. ETH and WBTC liquidation ratios are at 121.21% and 133.33% respectively, which is considerably lower than ETH-A and ETH-B on Maker, which are set at 150% and 130% respectively. Hence, Maker would be able to sustain much larger sudden price drops before becoming undercollateralized. In addition, Aave does not incorporate a supply and debt ceiling. However, these may be added in future versions. Aave does not have the ability to lower the exposure on specific assets, other than lowering the liquidation threshold and increasing the reserve factor. Another consideration is that Aave does not have a dust parameter in place. In theory, this may result in the risk of a niche attack vector where large positions can be divided into many small ones during low gas fee periods. It can also result in a situation where small positions are not profitable to liquidate due to higher gas costs.

It is worth noting that Aave and Maker credit risk can differ significantly, as Aave allows users to build particularly unique types of exposure. For example, synthetic short positions (e.g. LINK collateral, ETH debt) and normal short positions (e.g. DAI collateral and LINK debt). Even though at present, a few such positions are present in the protocol, the option to create them remains open. This means that Aave is not only exposed to general cryptoasset market crashes, but also high volatility between listed assets, or even high price increases, in case of a large percentage of short sell exposure.

The Aave v2, AMM and Polygon markets have a parameter called the Reserve Factor, which is applied on the borrow interest rate for each asset and collected in the collector contract in the form of aTokens (Ethereum & Polygon). According to Aave’s documentation, the Reserve Factor serves as a risk premium for each asset. Assets with higher risk have a higher Reserve Factor. The assets accrued in collector contracts serve for the compensation of protocol contributors and do not automatically play a role in Aave’s solvency risk management. In the case of a deficit event that cannot be covered by the Safety Module, Aave governance has the ability to decide if these assets should be used to compensate for the deficit. This is similar to the Surplus Buffer in the Maker system, except that assets collected in Aave are not used to offset possible deficits automatically. This feature was implemented in Aave v2, and is not available in v1. Currently the asset size of the Ecosystem Collector, including both collector contracts, amounts to approximately $9.14m out of which $7.75m is in fiat stablecoins. The exact distribution is shown in the chart below.

The table below contains the main risk parameters for assets included in the Aave v2 and Polygon markets, as well as a comparison of collateral requirements with Maker. The exact methodology for determining these parameters can be found here. It consists of smart contract, counterparty and market risk assessments.

Shortfall Protection

The Safety Module (SM) is the second mechanism that can protect against solvency risk. The SM serves as the primary mechanism for offsetting protocol deficit, or in Aave’s terminology, a “Shortfall Event”. The Shortfall Event is defined as an unexpected loss of funds which can occur due to: (i) smart contract risk, (ii) oracle failure risk or (iii) failure/poor performance of the liquidation system. AAVE holders can deposit their tokens into the SM and, in turn, earn incentives. Deposited tokens can be in the form of AAVE tokens or Staked Balancer LP (Smart pool contract) tokens, consisting of AAVE-ETH 80-20. In both cases, users receive a staked version of the asset (stkAAVE or stkABPT). In total, these contracts currently amount to $990.25m ($61.5m in ETH and the rest in AAVE tokens). In the case of a deficit, the SM uses 30% of the assets deposited and auctions them in the market against the specific assets needed to mitigate the deficit. In such an event, the SM will only allow users to withdraw tokens 10 days after the initial withdrawal request. This prevents unsustainable withdrawals. If the SM is not able to cover all of the deficit, Aave Governance can trigger a so-called Recovery Issuance event, where AAVE tokens are issued and sold in an open auction. Considering that Aave governance holds AAVE tokens in the Ecosystem reserve, these tokens would likely be used before new tokens would be issued. The AMM market is not covered by the SM.

In conclusion, in the case of a Shortfall Event, or deficit, the probable steps needed to cover the deficit are as follows:

  1. 30% of funds locked in the SM are used to cover the deficit. The current value of locked assets is $990.25m ($61.5m in ETH, and the rest in AAVE), meaning $297m assets are available to cover any deficit.
  2. Aave Governance has the option to spend Ecosystem Reserves (consisting of $625m of AAVE tokens), or the funds held in the collector contracts (consisting of roughly $9.14m in mostly (85%) fiat stablecoins), before the Recovery Issuance.
  3. The Recovery Issuance is enabled and the protocol issues new AAVE tokens and sells them in an open auction.

This means that the vast majority of assets available to cover the potential deficit are AAVE tokens. Considering that such an event would likely produce a negative slippage on the token price of AAVE, and possible negative sentiment around the protocol, some holders that are not locked in the SM might further increase the selling pressure. It is worth noting that there is currently one particularly large position in Aave v2, currently worth approximately $764m. This position consists primarily of AAVE collateral (82% of all supplied AAVE, and 11.86% of total circulating supply). This position is highly collateralized. However, in the case of liquidation, it would produce a large slippage on AAVE. Below is an estimated AAVE/DAI slippage curve based on on-chain venues, aggregated by the 1inch dex aggregator on July 1, 2021.

Aave Loan Book Positions & Collateralization Metrics

We took a snapshot of the largest 1406 accounts in Aave v2 on June 30, 2021. They represent the vast majority of assets in the Aave v2 protocol. The main focus of the loan book analysis was to examine positions that include DAI. Based on the positions of these users, we sorted them into three categories: (i) recursed leverage farmers, (ii) supply only, and (iii) users that use the protocol to build either long or short positions.

Recursive leverage farmers are users who supply an asset which can be used as collateral (e.g. USDC, DAI, TUSD, WBTC, ETH). They then borrow the same asset and supply the proceeds of the loan back to the protocol. The recursive leveraged positions maximise the liquidity mining yield on assets exposed to the protocol. Hence, without the liquidity mining rewards, this would be unprofitable and makes no economic sense otherwise. This process can be done several times, as each cycle adds new collateral which can be borrowed again. Users can either build such positions manually in several cycles, or build the position in one transaction using a flash loan. Instadapp is a popular application to build such a position with one transaction. We defined recursive leverage farmers as users that supply more of the same asset as they borrow, excluding supply only positions. Long positions include volatile collateral and borrowed fiat stablecoins, while short positions consist of borrowed volatile assets and either stable or volatile collateral asset types. Finally, the “supply only” category consists of users that only supply assets and do not borrow.

Based on this categorization and snapshot, the fiat stablecoin assets (USDT, TUSD, USDC and DAI) in the protocol are deployed as follows;

  • Recursive leveraged positions: 73% of total assets (borrow market)
  • Long positions & short positions: 27% of total assets (borrow market)
  • Supply only positions: 22% of total assets (supply market)

Almost 75% of fiat stablecoins that we observed were borrowed for the purpose of recursed leveraged farming activities. USDT has the smallest usage in recursed leverage, as it cannot be used as collateral. Users normally use some other collateral type to sustain the position, such as large amounts of WBTC, but the position is still clearly built for yield exposure and will likely be unwind when liquidity mining ends. USDT is however the most used asset for organic borrowing as it is much more likely to trade with a discount than a premium.

Based on the same categorization and snapshot, positions consisting of DAI are deployed as follows:

  • Recursive leveraged positions: 86% of total assets (borrow market)
  • Long positions & short positions: 14% of total assets (borrow market)
  • Supply only positions: 22% of total assets (supply market)

As the data above suggests, a large amount of open interest in the protocol consists of recursed leveraged farming positions, which are in general not exposed to market risk. If poorly managed, they could get liquidated due to accrued interest, which would lead to zero slippage, and potential deficit liquidations. By implementing the D3M, Maker is potentially exposed to the overall credit risk of the Aave protocol. On the other hand, Maker is specifically exposed to credit risk of the Aave DAI market, where users borrow DAI collateralized by long crypto asset positions. In our analysis, we found that approximately 14% of the borrowed DAI consists of long positions. The chart below shows collateralization of organic DAI borrow positions. These are mostly collateralized by ETH, WBTC, AAVE and LINK. Please note that Aave allows for cross-asset collateralization and allows for different assets to be borrowed. Organic DAI borrow positions can therefore consist of additional assets borrowed, which makes it hard to determine the exact assets and the amounts used to collateralize DAI borrow. Because there are only a few users that use larger amounts of LINK and AAVE as collateral, we were able to confirm that in this snapshot, DAI collateralized by them is much smaller than the chart below suggests. A majority of organic DAI borrow is therefore collateralized by ETH and WBTC. The DAI debt weighted health factor of organic DAI borrow positions is 204.26% (272.85% collateral ratio by Maker’s metrics), which is a healthy collateralization level. The DAI market is currently in a healthy state and the DAI credit risk is therefore relatively low.

Assets used as collateral in organic DAI borrow positions ($1.64b total collateral)

Despite the current healthy state of the credit risk in the protocol in general, and the DAI market in particular, the situation can change when opportunities in DeFi markets change. General activity could shift from predominantly yield farming activities, to leveraged long positions. In addition, there are blockchain-specific risks where DAI supplied by the D3M could be in danger due to congestion in the network, or by price oracle malfunction. High network congestion can lead to miss priced AMM markets if arbitrage and liquidations in lending protocols are not efficient enough. Price oracle malfunction could lead to situations where positions are not liquidated due to internal price differing from spot prices, or by an unexpected exploit, which subsequently could lead to protocol deficits.

Liquidity Risk

Aave v2 DAI Rate Curve

Aave has been historically successful at managing liquidity. This is achieved by increasing rates significantly after 80% borrow utilization. For example, at 80% DAI borrow utilization, the borrow rate is 4%, while the borrow rate rises to 75% at 100% DAI borrow utilization.

The highest utilization of the Aave v2 DAI market was reached in February 2021, at 94%. It took approximately one week to adjust back to the 80% level. A high interest rate, a) forces borrowers to repay their loans, and b) attracts additional suppliers. In the example mentioned, and on average, high interest rates mostly attract new suppliers to push the utilization level back to an equilibrium of around 80%.

The chart above illustrates how volatile DAI rates were at Aave v2 before they introduced liquidity mining in late April, 2021. Liquidity mining attracted additional supply to DAI and other stablecoin Aave markets, which lowered stablecoin rates considerably. Prior to the introduction of liquidity mining, DAI borrow rates were very volatile, and moved on a weekly level in a range between 4% and 30%. If Aave turns off liquidity mining incentives, or if Aave token incentives decrease in dollar denominated value, high rate volatility may resurface. This rate volatility could be protected by the D3M, depending on the parameters chosen, which we address at the end of this assessment.

Note that Aave v1 utilization of the stablecoin markets was much more volatile, and frequently reached 100% (see graph below) utilization rate. This was further accelerated by the liquidity mining hype, when people made sudden huge borrows of particular stablecoins to farm on high APY liquidity mining venues. A similar scenario is less probable now, since the farming hype has cooled down, and because liquidity on Aave v2 markets is much higher. Nevertheless, this is still a concern and could negatively impact the D3M in terms of bank run risks.

“Run on bank” at Aave is theoretically possible, which may result in suppliers (including the D3M) not being able to withdraw their collateral from Aave for an uncertain period of time. Suppliers could in theory trade aDAI to other a-tokens on Curve to withdraw capital. However, liquidity is not very high and the only available pairs are aUSDC and aUSDT, which can suffer from similar withdrawal issues.

Curve Aave pool on July 1, 2021 (aDAI, aUSDC, aUSDT):

Source: Curve.fi

D3M Exposure Simulation

We have made a simulation to see how the D3M would perform historically, or in other words, what the D3M exposure to Aave would be at different parameters. The D3M essentially has two governance-determined parameters: bar (target Aave v2 DAI borrow rate) and line (debt ceiling of the D3M). We have simulated for different bar values, which ultimately will be determined by governance.

Based on the results of the historical simulation, a rate lower than 4% would lead to very high exposures for the D3M. This is due to the formula in the Aave v2 DAI borrow rate curve, where a significant increase in rates is triggered after 80% utilization. For example, over $300m on certain days, and up to 30% of all DAI deposits would be generated by the D3M if a 3% target borrow rate was chosen in the historical simulation.

For that reason, a bar higher than 4% is proposed by us. It is worth noting that this would likely have a limiting impact on the usage of the D3M. At the same time, we believe this would enhance confidence in the DAI borrowing markets on Aave compared to other stablecoin borrow alternatives. Users would have greater confidence that the D3M would help cap the DAI borrow rates at Aave. Note, however, that another significant factor for capping the DAI borrow rate to target value, is the debt ceiling of the D3M. This will be governance determined and relates to the overall risk exposure governance is willing to take towards the Aave Protocol.

Oracle Risks

The Aave Price Oracle was previously owned by 0xb9062896ec3a615a4e4444df183f0531a77218ae, a proxy multisig contract that could be activated by 3/5 signers. In May, 2021, the ownership of the price oracle contract was moved to the Aave governance short executor, as can be seen here. This means that Aave governance is now in control of the Aave Price Oracle proxy provider contract. Aave Price Oracle uses Chainlink price feeds for their price discovery mechanism. According to Aave documentation, if the price from the Chainlink feed for any reason returns a value below or equal to zero, Aave’s so-called “fallback price oracle” is called. The fallback price oracle is currently maintained by the Aave team. However, in the future Aave governance will manage the selection of sources for the fallback price oracle.

The Chainlink DAI/ETH price feed oracle fetches data from 16 oracle node operators. The Chainlink DAI/ETH oracle price is calculated based on a minimum of 11 oracle answers. The oracles are run by: Alpha Chain, Blocksize Capital, Chainlayer, Framework Ventures, Inotel, Kytzu, Newroad Network, Omniscience, P2P.org, Prophet, Simply VC, Staking Facilities, SyncNode, T-Systems, Validation Capital, and XBTO. A price update is activated when either (i) the off-chain price moves more than the deviation threshold (1% for the DAI/ETH oracle), or (ii) 24h has passed since the previous on-chain price update.

Aave’s Price Oracle setup gives rise to a number of potential risks for Maker:

  1. Reliance and trust: By adopting the D3M module, Maker will become directly dependent on Aave’s price oracle setup. Maker will become reliant on, and place trust in both Chainlink oracle price feeds, as well as the Aave fallback price oracle.

  2. Dependence on fallback oracle: The Aave fallback oracle was first introduced by the Aave team as a soft protection against Chainlink failure. The fallback oracle has never influenced the Aave protocol. Hence, the Aave fallback oracle can be seen as a redundant function. However, the fallback oracle gets periodically updated in the case of a failure in Chainlink oracles. The Aave team controls the address with permission to submit prices to the fallback oracle. Hence, by adopting the D3M, Maker will become reliant on Aave team members to fetch the correct price information in the event of a Chainlink oracle malfunction.

  3. Reduced decentralisation: The Maker Oracles currently has 25 feeds, with a quorum of 13. By contrast, Chainlink’s oracle price feed for DAI has 16 node operators, with a quorum of 11. Adopting any oracle, with fewer price feeds than those currently offered by Maker, implies a reduction in decentralisation and hence a centralisation risk. It is also worth noting that Maker Oracles are entirely controlled by Maker Governance. There is no multisig control, hence sybil guarantees are assured, meaning that no single individual can exert malicious behaviour. In addition, the risk of a third party managing to compromise the keys of multisig signatories is not the case with Maker Oracles. However, all of these risks are potentially present when there is multisig ownership of oracle price feeds, as is the case with Chainlink.

  4. Transparency and data guarantees: Maker Oracles query data directly from exchanges and use a Data Model to process the data in a transparent way. With Chainlink, on the other hand, node operators fetch data from data aggregator endpoints. Both methods have advantages and disadvantages. Some of the advantages with Maker’s system were highlighted in an analysis by Nik Kunkel, which can be found here. The advantages include:

  • MakerDAO oracles do not have to trust external data services. There is no risk of API service failure or intentional censorship. The Maker Protocol does not have to trust external data services that could potentially provide malicious data.
  • The Maker Protocol can process data using the exact data model determined by Maker Governance. Iterations and adjustments can be made quickly depending on market circumstances. This gives Maker Governance more flexibility and control compared to having to request external service providers to change their API’s to suit Maker’s needs.

By adopting an oracle which does not include the advantages outlined above, there is a risk of compromising full transparency and data guarantees on the oracle price. As well as a diminished flexibility and agility to respond to unexpected market circumstances.

Liquidation Risks

Liquidation can occur after a borrower’s health factor drops below 1. The health factor is defined as the value derived from a position’s assets used as collateral, multiplied by the individual liquidation threshold, and divided by the value of borrowed assets. For example, the DAI liquidation threshold is 80%. Hence, for 1000 DAI in collateral, less than 800 DAI can be borrowed. The internal valuation of assets, to determine the health factor, is done in ether. Unlike Maker, in Aave the health factor can drop below 1 due to assets increasing or decreasing in value, which depends on which assets are used as collateral and which are borrowed. In the instance of liquidation, up to 50% of the borrower’s debt is repaid (in case of multiple borrowed assets, each asset can be repaid up to 50% individually). This value and liquidation bonus is taken from available collateral. In the case of multiple collateral assets used, the liquidator can only claim a single collateral asset, meaning that liquidations are always trades of one asset for another asset, where the liquidation bonus is the incentive. The liquidation bonus differs between assets. Fiat stablecoins and ether have a liquidation bonus of 5%. A majority of other assets have a bonus of 10% and few exceptions have a higher bonus of 15%.

In comparison with Maker, the liquidation bonus is not collected by the protocol, meaning Aave receives nothing from liquidations. Maker collects liquidation penalties into the surplus buffer, which also acts as a defence for covering bad debt. The benefit of this system is that users can potentially self liquidate their positions and not lose funds other than gas fees, in the case where other liquidators are not faster. In addition, Aave is using a live Chainlink price feed while Maker is using 1h delayed price feed, meaning that users in Maker have much more comfortable position management, where they know in advance if they are eligible for liquidation or not. Considering that Aave’s collateral requirements are much lower than Maker’s, (LINK is at 133% CR and ETH at 121.2%) with the addition of a liquidation bonus (10% LINK and 5% ETH), a live price feed may be required as a relatively small price drop could potentially produce bad debt.

As mentioned in the solvency risk section, despite high TVL (total value locked) metrics at Aave, credit risk is much smaller in nominal terms, since stablecoin borrows collateralized by volatile collateral measure “only” about $1.2 billion. This means that the “risk weighted” loan book of Aave is about 50% smaller than Maker’s loan book.

However, because Aave does not use 1h oracle delay as Maker does, liquidations are more intensive as users don’t have 1h “grace period” to protect their vaults. On May 19, 2021, when ETH dropped by 46% intraday, stablecoin loans liquidations at Aave amounted to $152m, whereas those at Maker amounted to $41.3m. Note however that Aave’s liquidation system allows for partial liquidations of collateral and therefore are usually less capital intensive compared to Maker.

DAI based loan liquidations amounted to $23.6m and only about 2.4% of DAI borrows were liquidated, which confirms that DAI loans carry lower credit risk at Aave (up to 90% of outstanding DAI loans are recursive DAI leverage). Approximately $19m of DAI loans that were liquidated were mostly collateralized by ETH and WBTC (80%) and LINK & MKR (10%), which is a positive observation - see chart Liquidations at Aave v2 on 19th May 2021.

According to Gauntlet there is currently approximately 60,000 USD worth of insolvent debt in the Aave protocol, which is a promisingly low amount.

We believe that liquidation risks are low at Aave v2, but that the liquidation system is probably missing a configuration that protects against oracle dependency and auction throughput limitation in a tail event scenario.

Competitive Risks

On the one hand, Aave and MakerDAO are not direct competitors, as MakerDAO’s main objective is to issue the decentralized stablecoin, DAI. Aave does not issue their own stablecoin. On the other hand, the two protocols are competitors in regards to borrowing over-collateralized debt. The Maker Protocol has some clear advantages over Aave, such as the internal fixed price of debt to 1, price delay of collateral assets, and stable interest rates for a period of time that does not depend on utilization (this is generally favourable for larger positions, which has been the case historically). The Maker system is also more risk-averse, as the protocol maintains higher collateral requirements and has a more developed system in the case of the creation of bad debt (e.g. automatic debt auctions).

The two protocols, however, still compete to some degree. Specifically to capture smaller value positions, where Maker may want to maintain relatively equal interest rates. Aave has historically had higher interest rates, due to their highly utilizatised markets. By implementing the D3M, Maker will help lower Aave’s DAI borrow rates to the extent allowed by the module’s debt ceiling (line). This will likely increase their competitiveness as they will be able to offer lower rates. For Maker, on the other hand, one of the key advantages of the D3M is the ability to increase the total DAI supply on the open market. This will combat current pressures of a DAI premium, and potentially even decrease our exposure to USDC via the PSM. In addition, Maker may be able to obtain some positive cash flow from the additional supply. In our opinion, the advantages of the D3M for MakerDAO outweigh the potential competitive losses the protocol may experience.

Current competitive position

For both Aave and Maker, the two collateral assets that are used the most are ETH and WBTC. The Aave ETH market requires a minimum collateral ratio of 122%, and has been yielding an average of 0.75% over the month of June (including liquidity incentives). Normalizing the value of borrowed funds (multiplying deposit yield by liquidation ratio), the yield on required collateral effectively reduces borrowing costs by 0.95% per year. Aave’s WBTC market offers a 133% liquidation ratio, and 0.95% yield on collateral. This amounts to a 1.35% reduction in annual borrowing costs. In addition, the DAI market offers liquidity incentives to borrowers of circa 1.5% per year.

In aggregate, the yield from collateral and liquidity incentives amounts to approximately 2.5% per year for ETH, and 3% for WBTC. These figures will vary based on the AAVE token price and lending volume. However, they have generally stayed within a 2-3%/yr range since Aave’s liquidity incentive program began in April. Assuming that Maker targets a 4% DAI borrowing rate to match Aave’s optimal rate model, this would imply an effective maximum borrowing cost of 1.5% for ETH, and 1% for WBTC. This is slightly below Maker’s 2% proposed borrowing cost on the ETH-A and WBTC-A vault types. Compared with the current rates of 3.5% for each vault type, this represents a significant discount.

Borrowers on MakerDAO benefit greatly from the factors described above. For example, the OSM liquidation delay and the fixed price of debt. This may explain why a greater amount of debt has not migrated to Aave, despite the low rate environment. However, given the ability to change rates and liquidity incentives, it will be important to monitor relative debt exposure of stablecoin backed facilities (e.g. PSM-USDC-A), the D3M, and Maker’s primary crypto collateral vaults. If the D3M begins to replace core collateral types, Maker may consider increasing the spread between the D3M target rate, and vault stability fees.

Governance Risks

Aave uses an on chain governance system to enact changes to the protocol. These changes include updating market parameters, liquidity incentives, and accepted collateral types. Governance decisions made by Aave holders can have an impact on the risk profile and market dynamics of the D3M module.

Key decisions are typically discussed in the Aave forum, before being submitted as an on chain governance proposal. Voting lasts for 3 days (19,200 Ethereum blocks), and at least 2% of Aave voting power must participate with yes votes exceeding no votes by at least 0.5% of total voting power. Assuming the proposal meets these criteria to pass, it goes through a 1 day timelock delay before it can be executed in the protocol. In total, the governance process requires at least 4 days to make changes to the protocol.

Aave governance decisions can impact risk of MakerDAO’s D3M in a few areas:

Risk parameters - Loosening liquidation ratios for existing collateral assets increases the risk of loans becoming undercollateralized or insolvent during a market downturn. For stablecoin assets, increasing borrowing limits also allows for higher recursive leverage, which could push up market utilization and interest rates.

Interest rate models - Aave can adjust the target utilization ratio and interest rate for assets. Currently stablecoin markets including DAI and USDC target a 4% borrowing rate at 80% market utilization. Changes to rate models could lead to large increases or reductions in usage of the D3M module; for example increasing the optimal interest rate above MakerDAO’s target interest rate could lead to a rapid increase in borrowing and exposure to the Aave market.

New assets - Aave governance can add support for new collateral assets. Even assuming the onboarding process is sound, each new asset marginally increases risk of loss to other markets. If a low quality or excessively risky asset is added as collateral, it could be used to drain liquidity from other markets including the DAI market, causing losses to Maker. Losses in any part of the Aave protocol (e.g. the Polygon market or newly introduced markets) could lead to a drop in AAVE token price, which could have an indirect impact on the v2 market through AAVE tokens used as collateral.

MakerDAO (and in particular the Risk core unit) will need to monitor Aave governance discussions and on chain proposals to address these risks. Given our current 2 day proposal timelock period (from the governance security module) and Aave’s 4 day governance timeline, Maker could have as little as 2 days to organize and pass a proposal to react to adverse governance changes. We can minimize governance risk by engaging with the Aave community and expressing any concerns before proposals are put up for a vote.

Summary of Notable Risks / Red Flags

  • The DAI loan book at Aave v2 carries lower solvency risk than initially observed, due to the high share of recursive DAI leverage on the platform and lower amounts of organic leverage (crypto collateral used for stablecoin loans). However, there is a high likelihood of a sudden increase in credit risk, due to the following two reasons:
    • Aave v2 does not use a debt ceiling concept
    • LTV ratios are considerably higher than those implemented at Maker for similar assets
  • Assets locked in the Safety Module consist primarily of Aave tokens. These tokens risk trading at a high discount, and becoming illiquid, in shortfall events. 30% of funds locked in the Safety Module are used to cover any potential deficit. The current value of locked assets in the Safety Module amounts to $990.25m, out of which only $61.5m is in ETH. There is also about $9m worth of stablecoins available to cover against shortfall events, as part of the Ecosystem Collector funds. In addition, new Aave tokens can be minted, a decision which can only be made by Aave Governance. Compared to Maker, the overall protection is not much lower, considering the lower outstanding organic loan amounts. However, the amount of available stablecoin protection may be lacking.
  • Liquidity and bank run risks are mitigated by the fact that a majority of the DAI loan book consists of DAI recursive leverage. Out of the 1.1 billion DAI total borrow amount, approximately 165 million DAI is organic DAI leverage, collateralized by volatile crypto collateral. If Aave liquidity mining incentives are disabled, the total DAI market risks being reduced by a factor of 4 to 5, and borrow utilization, as well as liquidity risk, may increase. However, Aave has historically been successful at mitigating liquidity risk by making use of an aggressive rate curve, triggered after the 80% utilization mark.
  • By adopting the D3M, Maker would become directly dependent on Aave’s Oracle setup. This includes dependency on Chainlink oracle price feeds, as well as Aave’s fallback oracle, in case Chainlink for any reason would malfunction. It is, however, probable that Maker is already vulnerable to Chainlink malfunctions, since the value of collateral assets that rely on Chainlink is tied to the performance of Chainlink Oracle price feeds. Nevertheless, the D3M implementation would mean greater dependency on Chainlink Oracles. The Chainlink dependency would increase in relation to the debt ceiling amount for the D3M.
  • Governance risks are mostly related to DAI Rate Curve change and other risk parameter changes of the Aave v2 protocol. If the DAI rate curve changes, Maker might need to react before the changes are implemented. The same goes for overall monitoring of risk exposure at Aave and potential changes to:
    • Adding new collateral that we see as too risky
    • Improper configuration of risk parameters such as low LTVs
    • Changes to the liquidation system
    • Newly introduced Aave markets increasing overall protocol risks which negatively affects funds available in the Safety Module
  • Liquidation risks appear to be reduced by the fact that most of the organic leverage on the DAI market is built through liquid tokens, such as WBTC, WETH and LINK. The liquidation system at Aave v2 also appears to be very efficient. So far, only $60,000 worth of insolvent debt has been generated. The part of the system that is considered more at risk is the direct dependency on auctions of oracle prices, and no auction throughput limitations, which Maker has implemented.
  • While Maker has some advantages over Aave (OSM liquidation delay, unconstrained liquidity amounts, fixed price of debt, etc), Aave offers liquidity incentives and in the current low demand environment can offer borrowers highly competitive rates. If the effective borrowing rates on Aave fall too far below Maker, we may see users migrate their debt away from our core vault types (ETH, WBTC, etc). This reduces the benefit of the D3M, which is intended to support net new borrowing demand not already served by Maker and reduce exposure to stablecoin vaults and the PSM.
  • Finally, we believe that the D3M has one additional weakness that the community needs to evaluate for themselves. The D3M cannot interpret or analyse risks on the Aave v2 DAI markets by itself. It can only react to DAI borrow rate values. This means that in a tail event scenario, where more funds than normal are withdrawn from the Aave DAI pool, the module would try to increase both utilization and the DAI borrow rate. Instead of protecting Maker from additional DAI losses, the D3M would mint and deposit more DAI into Aave to lower the DAI borrow rate to the target rate. Based on our analysis, the only protection against such a scenario would be the debt ceiling. This is why we propose a lower value initially, along with implementing an Instant Access Debt Ceiling Module (IAM-DC). We are, however, aware that keeping the debt ceiling too low may constrain the D3M, and potentially impact the key objective of signalling lower and less volatile DAI borrowing rates versus other stablecoins on Aave.

Proposed Parameters

There are four governance parameters needed to be set for the D3M:

  • IAM-DC parameters: line, gap and ttl
  • bar as Target Borrow Rate at Aave v2 DAI market

As mentioned in the liquidity risk section, we believe that a borrow target rate below 4% is not practical, unless the D3M debt ceiling is set at a very high level, in the hundreds of millions. However, in a scenario with a very high debt ceiling, and a lower target rate (e.g. 3%), the share of DAI deposits made by the D3M in the Aave DAI pool would reach between 20%-30%. This is very high, considering the liquidity and bank run risks.

Note that the 4% Target Borrow Rate implies 3.16% APY earnings for the D3M, in addition to Aave rewards for supplying DAI to Aave v2, which at the time of writing is approximately 1.16%. This means that a 4% target rate would generate a total APY of 4.32%.

All things considered, we do not suggest setting bar below 4%. From a risk perspective, we believe that a 4.32% APY (including Aave rewards), is sufficient to cover the credit and solvency risks addressed above. The other factor that governance needs to consider when choosing an appropriate bar, is the competitive angle. We do not provide detailed suggestions for this in this assessment.

The main parameter that protects Maker against Aave exposure is the D3M debt ceiling. Even though the DAI market loan book looks healthy, there are still many risks associated with Aave, which we have addressed in the Summary of Notable Risks section.

We suggest implementing a module with a debt ceiling of 10m initially and then increase it up to between 2x - 4x of Maker’s Surplus Buffer, which at the time of writing amounts to 49m DAI. Alternatively, Maker could limit its D3M exposure to between 10% to 20% of the DAI supply at Aave v2, which would be in the range of 120m to 240m DAI. Or limit exposure to about 30% to 50% of available DAI liquidity (392m DAI currently), suggesting up to a 200m debt ceiling. Both of these “share of DAI deposits” limitations would decrease liquidity and bank run risks. This needs to be appropriately monitored, and changes to the Aave liquidity incentive program should be taken into consideration.

Ideally, an IAM-DC should also be implemented to protect Maker from the tail risks addressed in the Notable Risks section. However, this can restrict the efficiency of the D3M, as it might react too slowly to rate increases over the Target Borrow Rate. We suggest implementing a combination of gap and ttl that limits the increase of exposure to Aave for 48h until Maker governance can react.

Proposed parameters for the D3M

bar = 4% initially, later depending on competitive risks and dynamics related to Aave protocol risk and liquidity mining

line = 10m initially, later up to 200m

IAM-DC gap = 10m

IAM-DC ttl= 12h

Authors: @Primoz @rema @monet-supply @Sean



I don’t think I had appreciated just how vast a majority of Aave’s backstop is their token. They have very little cash on hand. I knew they offered liquidity mining, but it seems like their token is the only real cushion on both the front and back end. Basically they don’t have a SB to speak of?

I also don’t think that I would have guessed that nearly three-quarters of Aave’s activities are around recursive leverage.

Given how 3% skews the Y-axis, can you give us a couple ballpark numbers for exposure at 4%, 5%, etc?

Is there a way to mitigate at least some of this? Presumably on our end, D3M would use our own oracles when it comes to making decisions to add/remove DAI?

@Primoz thank you for such an extensive report. I’m likely to be back with a few more questions after I’ve read it again and let it sit.

I’d appreciate seeing some more granularity here. Could we break this down to the quarter of a percentage point level?

IE, what would the historical levels of exposure been at 3.25%, 3.5%, 3.75% and does this differ significantly from 3%?

I understand how it could be a really discrete change based on the Aave rate curve, but I’m curious how much effect minor changes have. Is 3.1% significantly different from 3%?


Out of non-Aave token protection they have about 10m of stablecoin capital and there’s staked 80/20 AAVE/ETH pool that includes $70m ETH.

See columns AC to AE here, but essentially it would go up to 44m at 4% target borrow rate.

D3M uses only Aave v2 DAI borrow rate to determine whether exposure is increased or decreased. Aave oracle risks are indirect, affecting credit or liquidity risks of DAI market and therefore D3M DAI deposits.

Good call, see below. I think exposure would still be manageable down to 3.75% Target Borrow Rate or maybe even 3.5%, but supply rate D3M would earn would decrease to 2.5% (excl. Aave rewards), which would represent similar compensation as Maker will have with new ETH-A rates, but more severe risks explained in the report.


This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.