[UNI-V2-WBTC-ETH] Collateral Onboarding Oracle Assessment (MIP10c3-SP20)

Preamble

MIP10c3-SP#: 20
Author(s): Niklas Kunkel (@NiklasKunkel)
Contributors:
Type: Process Component
Oracle Team Name: Green
Status: RFC
Date Proposed: 2020-12-05
Date Ratified: <yyyy-mm-dd>

Specification

Introduction

This Oracle would provide the UNI-V2-WBTC-ETH/USD price as part of the collateral onboarding process for the UNI-V2-WBTC-ETH LP token.

Oracle Data Model

A smart contract utilizing Uniswap primitives and liquidity reserves to calculate the price of a Uniswap Liquidity Provider (LP) token.
The reserves of the Uniswap pool, and the supply of the Uniswap LP token are used as inputs to the model. This model utilizes MakerDAO Oracles to price the underlying assets.

This model utilizes the following base assumptions:

(1) Invariant k = reserve_x * reserve_y

(2) reserve_x * price_x = reserve_y * price_y (only holds true at steady-state)

Combining (1) and (2) allows us to derive the formulas for calculating the “normalized” reserve balances of the underlying assets given the invariant k and prices of the underlying assets.

(3) reserve_x = sqrt(k * price_y / price_x)

(4) reserve_y = sqrt*(k * price_x / price_y)

Alternatively given one calculated normalized reserve, one can calculate the other using a mutation of (1).
This is useful for optimizing gas since calculating the square root is an expensive operation.

(5) reserve_x = k / reserve_y

(6) reserve_y = k / reserve_x

Once the normalized reserve balances have been calculated the price of the LP token can be derived:

(7) price_lp = ( (reserve_x * price_x) + (reserve_y * price_y) ) / supply_lp

Substitute of (3), (4) and (7) gives us the following model for calculating the price of a Uniswap V2 LP token:

(8) price_lp = ( (sqrt(k * price_y / price_x) * price_x) + (sqrt(k * price_x / price_y) * price_y) ) / supply_lp

Oracle Supporting Data Model(s)

ETH/USD (canonical)

|    Source     |  Asset Pair   |  Feed Model  |
| :------------ | :------------ | :----------: | 
|   Binance     |    ETH/USD    |    Median    |
|   Bitfinex    |    ETH/USDT   |              |
|   Bitstamp    |    ETH/USD    |              |
|   Coinbase    |    ETH/USD    |              |
|   Gemini      |    ETH/USD    |              |
|   Kraken      |    ETH/USD    |              |

WBTC/USD (canonical)

|    Source     |  Asset Pair   |  Feed Model  |
| :------------ | :------------ | :----------: | 
|   Bitstamp    |    BTC/USD    |    Median    |
|   Bittrex     |    BTC/USD    |              |
|   Coinbase    |    BTC/USD    |              |
|   Gemini      |    BTC/USD    |              |
|   Kraken      |    BTC/USD    |              |

Oracle Address

  • Mainnet - UniV2LpOracle - TBD

Supported Tools

UniV2LpOracle - Source Code
UniV2LpOracle - Tests

Remaining Work

  • Finish internal reviews of smart contract code.
    • Currently pending incomplete PR on formatting branch
  • Update MegaPoker to poke UniV2LpOracle

Summary

This is a bespoke Oracle smart contract for determining the price of a Uniswap V2 LP token. This same contract can be used to generate an Uniswap LP Token Oracle for any Uniswap V2 pair so long as Maker Oracles are provided for the underlying assets in the pool. Deploying any new smart-contract code into production always comes with risk. As we’ve seen with the majority of DeFi exploits over the past year, Oracles are often heavily targeted. Deploying new Oracle smart contracts into production needs to be approached with an abundance of caution. At the same time, the potential of LP tokens to generate Dai is significant given that they enable Uniswap Liquidity Providers to leverage LP rewards. Therefore the Oracle Domain Team is recommending that we onboard Uniswap LP tokens as collateral using these new Oracle smart contract with the condition that we severely limit the debt ceiling initially. Over time as the community’s confidence in the new contract grows the debt ceiling can be steadily increased. Getting an audit of the code would be highly desirable, with the understanding that any green light from an audit would not include the underlying Uniswap Protocol in scope.

The decision on debt ceiling is ultimately up to the Risk Domain Team, but the Oracle Domain Team is recommending an initial debt ceiling of 3M Dai given the enhanced Oracle risk.

7 Likes

As in the other UNI-V2 post, the two links appear to be broken (to me at least).

Curious if someone could explain (or link me to a post discussing) the idea behind using LP tokens as collateral. Obviously between all the added cryptos and RWA, we’re looking to expand and diversify our ability to create DAI. However, IMO, the LP tokens are opening us up to all sorts of risk, even in a situation where our Oracles for them are preforming exactly as intended. Specifically, I’m worried about the potential of combining an attack on an LP pair with a keeper algo to scoop up all the liquidated vaults and profit off the eventual return to normalcy in the LP pair. IMO, the overall market liquidity for LP tokens is a huge problem for the platform, as keepers will have fair less incentive to run at the tokens when unloading them, especially in an event that caused their price collapse, will be so difficult. How are we looking into the risk of vault liquidation for tokens that have all this extra platform and pair risk compared to a “regular” cryptocurrency?

@prose11 I’m not sure what you mean. You can’t manipulate the price of an LP pair.

Fully agree with 3m DC and same level for both [UNI-V2-DAI-ETH] and [UNI-V2-USDC-ETH] as you proposed in other threads. It always makes sense to start lower anyway, the 10m initial DC was proposed by us since we won’t be able to increase DC if maxed out during the holidays. But then again, we aren’t really sure what kind of demand we can expect in the short term.

5 Likes

Right, sorry I didn’t articulate that correctly. The pair itself cannot be manipulated, but an oracle attack on one of the pairs could drastically decrease the value of an LP token for the pair. I think our system is pretty well situated to handle these attacks on our platform, but if someone is able to target Uniswap’s protocol we could see the value of the LP token tank for longer than an hour, leading to the liquidation event I mentioned. I guess it all comes down to taking extra currency and platform risk and I wonder how wise that is when there are already plenty of other digital assets we could be collateralizing.

@prose11 So one thing to note is that the invariant k can’t be manipulated. The invariant can only go up from trades.

Oracle attacks to manipulate the price always cost money and will make the LP token be worth more than the assumption of normalized reserve balances.

1 Like

Oh interesting thanks for clarifying @Jiecut . I was envisioning crashing the price for one of the assets in a pair via an oracle attack and then the LP token being less valuable because it claims far less assets in terms of USD. But saying that out loud it makes sense that even if that was how the value of the LP tokens was derived it would be highly unlikely for the price to be manipulated for long enough for the general market to devalue the tokens. I guess the added risk is with Uniswap’s smart contracts then? So it would follow we’ll need our risk team to review Uniswap’s code before we’d implement token collateralization?

As long as people are not able to exploit the contracts the token will always have real asset value, and by keeping it to pairs of assets we already collateralize there’s no additional currency risk. Sorry you had to lead me to the water there, pretty sure I’m drinking now. I’d support this with a low DC now, as long as the risk team keeps doing their thing.

1 Like

Yes there’s some added risk because this is a new system. So I agree with @Primoz that it makes sense to start with a conservative debt ceiling.


@prose11 To clarify some of the math behind LP tokens, assuming the actual ETH price is $600/ETH.

image

Here’s some numbers. These 3 options all have the same invariant. As you can see, if someone manipulates the uniswap price to make the pool lopsided, the value of the LP tokens goes up using the actual ETH price of $600. Manipulators can only make the LP tokens worth more. They can’t be manipulated so that the LP tokens are worth less. (And the oracle will be using the normalized value of $1200)

1 Like

@Primoz @NikKunkel So regarding the 3m DC, when would be the soonest that it could be raised?