Oct 2, 2024
Introduction
This research explores the critical importance of Liquid Staking Token (LST) pricing mechanisms, particularly within major lending protocols. Incorrect pricing (whether from reliance on secondary market rates or internal exchange rates) can have severe consequences: liquidations may not occur when they should, leaving the protocol exposed to bad debt, or conversely, unexpected liquidations could happen, disrupting user experience and platform stability.
Our analysis covers:
The fundamental concepts behind LST tokenomics
A detailed look at various pricing mechanisms, including internal exchange rates, market rates, and hybrid models
Comparative studies of how leading platforms like Aave, Compound, and others approach LST pricing
An evaluation of the trade-offs between different methodologies
Case studies of innovative solutions like Aave's CAPO and Killswitch mechanisms
This research aims to highlight the critical importance of LST pricing strategies and to identify potential improvements for DeFi lending, ultimately to better protect protocol solvency while supporting positive growth trends.
Section 1: Pricing Mechanisms
Choosing an LST pricing mechanism for lending markets involves navigating complex trade-offs. Platforms employ diverse strategies, from simple oracles to custom solutions, balancing factors like accuracy, stability, liquidity, and manipulation risks. This section overviews LST pricing approaches in DeFi lending, highlighting key considerations influencing pricing strategy decisions.
1.1 Key Tokenomics Concepts
Before exploring LST pricing mechanisms in DeFi lending platforms, it's essential to understand two key token designs in liquid staking:
1.1.1 Rebasing tokens
LST supply changes algorithmically to reflect underlying asset fluctuations due to staking rewards or consensus penalties (e.g., slashing, inactivity). 1 LST always equals one underlying asset (e.g., 1 stETH = 1 ETH), with staker balances auto-adjusting to maintain proportionate shares. Their dynamic supply makes rebasing tokens challenging for DeFi integration, often prompting integrators to wrap rebasing tokens as rewards-bearing tokens.
1.1.2 Repricing tokens
Supply remains constant, but token redemption value increases over time (barring penalties) to reflect staking rewards— for instance, 1 wstETH is expected to be redeemable for an ever-increasing quantity of ETH (assuming the staking rewards exceed penalties and fees). The exchange rate between the underlying and staked assets is determined by the collateral deposited into the staking platform plus accrued rewards minus penalties and fees to node operators and the protocol.
1.2 Internal Exchange Rate
The internal exchange rate for LSTs is a valuation based on the internal redemption rates for an asset (i.e., the value/rate at which an asset can be redeemed or exchanged within that protocol's ecosystem). This data is either:
Sourced from a balance variable in a protocol's contract that is increased/decreased as assets are deposited/withdrawn or
Sourced from the consensus layer of Ethereum using a set of Oracles (since EIP-4788, one can verify consensus layer information through a Merkle proof trustlessly).
The rate reflects the fundamental value of the LST, typically derived from the staked asset's rewards and potential slashing penalties. For example, in the case of wstETH, the exchange rate represents the amount of ETH each wstETH token is worth, adjusted for staking rewards and penalties. This method assumes trust in the protocol's reporting and the security of its underlying mechanisms. Internal exchange rate-based pricing oracles are generally used for rewards-bearing tokens.
ChainLink's Internal Exchange rate feeds for ETH LSTs. Source: Chainlink, September 11th, 2024
The management of the internal rate updates have unique attributes for each LST/LRT protocol, including the frequency, the counterparties, and checks to mitigate against failure modes. For instance, Lido's Oracle network requires 5 of 9 oracle daemons (operated by a whitelisted set of node operators) to reach quorum on a 24 hour schedule to successfully execute a rate update. It has sanity checks that cap the max APR at 27% and the max drawdown of 5%. When relying on internal rate pricing mechanisms, it is essential to understand the trust assumptions and limitations involved which may cause the rate to not accurately reflect the secondary market price or the true protocol TVL.
1.3 Secondary Market Price
1.3.1 Off-chain Oracle Providers
The market price is based on real-time price updates, typically through volume-weighted aggregated market prices (this is the methodology preferred by Chainlink, the preeminent price feed oracle provider). Multiple nodes source data from various data providers and aggregate market data, sourcing pricing information from centralized and decentralized exchanges to accurately represent an asset's market-wide price. Numerous providers, such as Chainlink or Redstone, offer market price feeds. To protect their users and ensure protocol solvency, it is paramount that DeFi protocols supporting LSTs/LRTs market price feeds are assured this data is accurate and securely delivered on-chain.
Live Chainlink's market rate feeds for some ETH pairs. Source: Chainlink, September 11th, 2024
1.3.2 DEX Pricing Strategies
DEX Liquidity pools can incorporate price feeds, which must be designed strategically to prevent manipulation of the oracle price. Their resiliency can be further ensured by aggregating prices across multiple DEX pools and/or centralized exchanges, as described previously with off-chain oracle service providers. Selecting an appropriate pricing mechanism often involves a trade-off between stability and responsiveness.
Time-Weighted Average Price (TWAP)
TWAP is a simple and intuitive method that calculates an asset's average price over a designated period, giving equal weight to each time segment. It smooths out price data by mitigating the influence of sudden price fluctuations, making it ideal for stabilizing long-term trends.
Advantages:
Simplicity: The straightforward nature of TWAP makes it easy to understand, implement, and integrate into decentralized protocols. It requires minimal computational resources and is widely adopted across DeFi platforms.
Stability: By evenly distributing weight across all time segments, TWAP ensures that short-term volatility has less impact on the overall price. This improves the TWAP's resiliency against oracle price manipulation by making the cost of an attack prohibitively expensive.
Disadvantages:
Lag: TWAP's stability comes at the cost of being slower in responding to rapid market movements. This inherent lag can result in missed liquidations, potentially making it less effective in highly volatile or rapidly changing markets.
Equal Weighting: TWAP's uniform approach to time weighting may not accurately capture recent market dynamics. By treating all periods equally, it fails to emphasize the most current price movements, which can be crucial during periods of significant market shifts.
Exponential Moving Average (EMA)
Unlike TWAP, EMA is a more dynamic method emphasizing recent price data. This makes it highly responsive to short-term price fluctuations while still smoothing out long-term trends. EMA calculates the average price by applying exponentially decreasing weights to past prices, meaning more recent prices have a stronger influence.
Advantages:
Responsiveness: EMA quickly adapts to new price information, making it ideal for capturing short-term trends and reflecting current market conditions. Its sensitivity to recent movements allows DeFi platforms to react more swiftly to market changes.
Relevance: EMA accurately reflects the current market sentiment by giving more weight to recent prices. This makes it a valuable tool for scenarios where rapid adaptation to market shifts is critical.
Disadvantages:
Complexity: EMA requires more sophisticated calculations than TWAP, as it involves continuously adjusting the weight of past prices. This computational complexity can decrease the inference speed, which is crucial for some use cases.
Volatility: Due to its sensitivity to recent price changes, EMA can be more volatile than TWAP. This means it might overreact to short-term price swings, introducing instability in scenarios where consistency is desired.
1.4 Combined Rates
Market Rate and Internal Exchange Rate Feeds play crucial roles in various DeFi use cases, particularly for Liquid Staking Tokens (LSTs) and Liquid Restaking Tokens (LRTs). These feeds can be used independently or in combination to achieve different objectives:
1.4.1 Pricing Repricing Tokens
This method calculates the current price by multiplying the exchange rate of a rewards-bearing asset (LST/LRT) with the market rate of its underlying asset. It helps reduce pricing volatility risks associated with lower-liquidity repricing assets.
Aave, for example, uses different pricing methods depending on the asset type and liquidity profile. For most assets, it directly references Chainlink Market Rate Feeds. However, Aave calculates the price for LSTs by multiplying the underlying asset's market rate by the LST's on-chain internal exchange rate.
For instance, the price of wstETH is determined by multiplying the USD price of ETH by the internal exchange rate between wstETH and stETH (assuming a 1:1 peg between ETH and stETH). To provide additional protection, Aave implements ratio caps to guard against significant exchange rate deviations.
1.4.2 Enhancing Liquidity Pool Performance for Rewards-Bearing Assets
In many LST/LRT liquidity pools, Liquidity Providers (LPs) often lose underlying token rewards to arbitrage traders due to suboptimal 1:1 swap pricing on Automated Market Makers (AMMs). To address this issue, exchange rate feeds can be utilized to adjust swap parameters programmatically. This approach prevents the continuous siphoning of rewards and improves overall liquidity pool efficiency.
By leveraging these combined rates, DeFi protocols can create more robust and efficient systems for handling LSTs, LRTs, and other rewards-bearing assets.
Section 2: Aave's CAPO & Killswitch
Aave introduces a hybrid pricing model with the CAPO and Killswitch mechanisms to create a system that reacts swiftly to market conditions and safeguards against extreme events. By combining the stability of exchange rates with the responsiveness of market rates, the hybrid model can provide a more balanced and accurate valuation. For example, during periods of high market volatility, the system could rely more heavily on exchange rate metrics to minimize the impact of short-term price swings while using market rate feeds to ensure reliable liquidation processing.
2.1 Correlated-Asset Price Oracles (CAPO)
Aave enhances safety for highly correlated assets like LSTs and stablecoins with the Correlated-asset price oracle (CAPO). This mechanism uses Internal Exchange Rate pricing that limits rate increases within reasonable bounds. While Aave's pricing mechanism uses Chainlink feeds or a combination of Chainlink and on-chain data, CAPO provides an additional layer of protection.
The CAPO concept is based on the principle that LST/LRT rate increases should not exceed predictable thresholds. For example, wstETH's exchange rate typically grows by 3-5% annually, allowing for a maximum price increase to be established over a given period.
CAPO applies a custom price adapter to eligible assets using configurable parameters:
A ratio provider contract to track the current exchange rate
A reference ratio for comparison
The timestamp of the reference ratio
A maximum yearly growth percentage
The adapter compares the current ratio with a pre-calculated maximum ratio when queried. If the current ratio exceeds this limit, the system returns a price based on the maximum ratio instead of the actual ratio, preventing inflated prices due to market anomalies.
The maxYearlyRatioGrowthPercent needs a margin to account for yield volatility and periodic updates to the ratioReference are necessary to adapt to changing growth rates.
Full list of parameters for a PriceCapAdapter. Source: weETH PriceCapAdapter contract, September 11th, 2024
CAPO does not protect against downside risks associated with the LST/LRT's solvency. A slashing event, for instance, can cause a sharp drop in the exchange rate between the LST and its underlying asset, potentially justifying liquidations due to the sudden reduction in underlying value. However, the updates may not be timely or reliable, causing the lending platform to have no programmatic means to facilitate timely liquidation.
2.2 Killswitch Mechanism
A key risk to consider, even when using Internal Exchange rates, is the possibility of price dislocation in secondary markets. If the market price of an LST asset falls below its loan-to-value (LTV) buffer while the Internal Exchange rate remains unaffected, the protocol may be used as an exit liquidity venue. In this scenario, the discounted asset could be deposited into a lending pool at an inflated collateral value, allowing borrowers to withdraw other assets as exit liquidity. For instance, if the LTV is 85%, a depeg exceeding 15% would create such a situation.
Therefore, in addition to CAPO, the Killswitch system is designed to protect the protocol during extreme dislocations in the market price of LSTs relative to their base tokens. This system is still under development and has not yet been rolled out, but it is expected to complement CAPO for LSTs pricing.
When activated, the Killswitch system automatically freezes LST markets. It reduces Loan-to-Value (LTV) ratios to zero if the market price deviates by more than 2.5% from the Internal Exchange rate. This freeze prevents users from opening new risky borrowing positions, thus limiting the risk exposure of the protocol.
As voted for by the Aave governance, the Killswitch mechanism is intended as a temporary measure to safeguard the protocol during market instability. The system resumes normal market functions once market conditions stabilize and the price deviation falls below the 2.5% threshold.
The Killswitch elegantly complements the CAPO framework by ensuring that market deviations are seamlessly integrated into the protocol's risk management strategy. CAPO is designed to maximize capital efficiency while maintaining protocol solvency, and the Killswitch enhances this by actively responding to abnormal market events. This dynamic response ensures that, when deviations occur, high-risk positions are mitigated early, reducing the likelihood of bad debt accumulating and protecting the protocol from being used as an exit liquidity venue.
2.3 Scenario Analysis
Many LST dislocation scenarios induced by different factors are possible. The following table presents how CAPO + Killswitch would be employed in various cases:
This analysis shows two dislocation scenarios where the reaction of CAPO and Killswitch would not lead to the desirable outcomes that safeguard Aave from bad debt but ensure liquidations when needed.
2.4 Strengths and Limitations
2.4.1 Strengths:
Responsive pricing: The CAPO mechanism ensures that the price feed quickly adapts to market conditions, reducing mispricing risk.
Emergency safeguards: The Killswitch provides a robust defense against extreme market dislocations, protecting the protocol from potential insolvency.
Flexibility: The hybrid nature of the model allows for different responses to various market scenarios, balancing accuracy and stability.
Automated risk management: The system can automatically adjust risk parameters (like LTV) in response to market conditions, reducing the need for manual intervention.
2.4.2 Limitations:
Complexity: The hybrid model introduces additional complexity, potentially leading to unforeseen interactions or edge cases.
Potential for false positives: The Killswitch mechanism might activate unnecessarily in short-term, non-threatening market volatility cases.
Dependency on external data: The model relies heavily on the accuracy and timeliness of external price feeds and oracles.
User experience impact: Frequent activations of the Killswitch could negatively impact user experience by limiting platform functionality.
Edge cases: As highlighted in the scenario analysis, there are some edge cases where the model might not produce the most desirable outcome.
2.4.3 Additional Considerations
Based on the examples, a few edge cases and important considerations still need to be addressed. Considering them would help ensure greater balance and risk mitigation for the lending protocol. These points include the following:
It should be assumed that Killswitch would react to both upward and downward market vs. internal exchange rate dislocations. On the contrary, if Killswith would only respond to secondary market depegs, in scenarios 1 and 3, the Killswitch would not be activated.
There is debate over whether LST borrowing and collateral should be turned off if a downward manipulation or bug affects the internal exchange rate. A similar question arises regarding whether liquidations should be allowed. On the one hand, a consensus layer oracle could be queried to determine if the internal exchange rate drop is due to slashing or inactivity. If neither is detected, manipulation or a bug could be assumed, and the system could revert to the previous stable exchange rate to protect users from liquidations. If the manipulation persists, the market rate could eventually decline, activating the Killswitch. On the other hand, allowing liquidations during such an event could severely damage user debt positions, especially if the manipulation or bug is short-lived.
If the internal exchange rate reduces for any reason and Killswitch is activated, it is safe to assume that market price will soon follow and Killswitch will be deactivated shortly. This would not prevent users from opening positions for an extended period, keeping LST borrowing/lending on Aave attractive.
If Killswitch is not deployed at all, scenarios 6, 7, and 8 would make the Aave protocol vulnerable to be used as exit liquidity.
These points indicate that the Killswitch mechanism would become closely embedded and necessary considering LST slashing and inactivity risks. While we acknowledge that CAPO would be activated with Killswitch in some cases, and implementation could be more problematic, we believe the benefits outweigh the implementation efforts. In addition, a system that would query the consensus layer oracle would help mitigate undesirable outcomes in the defined scenarios by detecting the problems (consensus layer penalties) in advance.
2.4.4 Killswitch Parameters Considerations
While CAPO already has clearly defined rules and mechanisms, Killswitch would require additional manual oversight:
Risk providers or governance should be able to turn Killswitch on/off for specific LST assets if needed. This would help mitigate unnecessary and prolonged Killswitch effects that hurt Aave's attractiveness for LST lending.
The deviation threshold (currently at 2.5%) should be adjustable by the DAO to ensure that the system would adapt to edge cases and different scenarios.
The Killswitch should raise LTV gradually without causing borrow and supply rate shocks.
Some simulations for the Killswitch mechanism were previously performed by Aave's previous risk provider (Gauntlet). Nonetheless, Killswitch should be back-tested and simulated on different scenarios before implementation and deployment.
Section 3: Evaluating Pricing Methodologies
There are important trade-offs in selecting an LST/LRT pricing methodology in lending platforms such as Aave. The methodology chosen may be informed by the priorities of the platform and its users and may also be determined by review of the specific asset's risk profile. Attributes of the LST's technical and counterparty risk, as well as its market maturity, may play a role in preferring a particular pricing strategy for a given asset.
3.1 Major Lending Platforms
The following table shows how major DeFi lending protocols implement pricing models for LST/LRT tokens. While it presents the dominant pricing models, there may be exceptions or variations for specific assets within each platform.
It can be observed that while most protocols choose to use Internal Exchange Rate only, they are aware that such a system possesses multiple drawbacks. Therefore, teams are working to implement or have deployed safeguards to combine with the exchange rate pricing. In addition, novel pricing systems are being implemented, completely switching from market/exchange rate pricing.
3.2 Trade-offs Overview
When valuing Liquid Staking Tokens (LSTs), DeFi protocols must carefully weigh different pricing methodologies to balance accuracy, stability, and risk. As discussed above, the two underlying pricing mechanisms employed are Secondary Market Price and Internal Exchange Rate, each offering distinct advantages and vulnerabilities. Understanding their trade-offs and performance in past crises helps inform their application within decentralized lending and staking protocols.
3.2.1 Market Rate: Pros and Cons
Unopinionated Price: The market rate is derived from on-chain (DEXes) and off-chain (CEXes) sources, reflecting the asset's real-time trading value. For instance, a price feed such as the stETH/USD Chainlink feed aggregates prices across multiple sources to deliver a live view of current market conditions.
Liquidity vs. Volume Based: The accuracy of the market rate is highly dependent on liquidity and trading volume. Assets with deep liquidity tend to have more stable pricing, while thinly traded assets can be prone to slippage and price volatility. As LST liquidity shifts to other venues, such as restaking protocols and lending markets, price stability on traditional exchanges may weaken.
Manipulation Prone: Market prices can be susceptible to manipulation in low-liquidity environments. Coordinated trades or flash loans can artificially inflate or depress prices, leading to potential risks for protocols that rely on these prices for collateral valuations. This issue is exacerbated when assets like LSTs have fragmented liquidity across different platforms.
Susceptible to Short-Term Depegs or Volatility: Market rates can diverge significantly from fundamental value during periods of market stress. For example, the stETH/ETH depeg incident showcased how a sharp market dislocation could lead to cascading liquidations and risk exposure for protocols solely reliant on market prices.
Protocols could favor market prices because they reflect the asset's true liquidation price that may more reliably preserve protocol solvency and avoid potential liquidity crunches due to short-term depegs. However, the risks associated with sudden price dips, particularly for less liquid assets, can lead to cascading liquidations that negatively impacts user experience and limits the protocol's growth potential.
3.2.2 Internal Exchange Rate: Pros and Cons
Proof-of-Reserve / Fundamental Value: The exchange rate is anchored to the protocol's internal reserves and staking mechanics, reflecting the fundamental value of the staked asset. For instance, the LST/ETH exchange rate is based on the amount of ETH that can be redeemed per unit of LST held, offering a transparent view of the asset's intrinsic value.
Assumes Trust in Protocol: Exchange rates rely on the protocol's ability to report reserves and staking performance accurately. Any inaccuracies in reporting or breaches in trust can result in misaligned exchange rates that do not reflect the underlying asset's true value.
Calculation Might Not Account for Slashing: The internal exchange rate may not immediately factor in penalties like slashing events or inactivity penalties. This is because the exchange rate is updated by a consensus layer oracle every 12 to 24 hours. During this delay, there can be temporary mispricings where the market price differs from the exchange rate until the contract fully reflects the penalties.
Discrepancies with Market Rate: Arbitrage opportunities emerge when the market and internal exchange rates diverge. Traders may exploit these differences for profit, destabilizing the market and exposing lending platforms to risk. A sudden influx of depegged assets could strain liquidity and lead to solvency challenges.
Higher Capital Efficiency Without Immediate Liquidation Risk: Exchange rate pricing allows platforms to offer higher LTV ratios, enhancing capital efficiency.
While internal exchange rate pricing protects against sudden market dips and cascading liquidations, it introduces tail risks associated with the specific LST/LRT and global staking dynamics. This pricing strategy implies an assumption that the secondary market price will mean revert to the internal rate and places higher trust in the solvency of the underlying asset. Excessive network-wide redemption demand may greatly increase the unstaking queue, making lending protocols the preferred avenue for exit liquidity and leaving them vulnerable to periods of illiquidity.
3.3 Secondary Market Rate: wstETH Case Study
Many of the considerations discussed in previous sections highlight the risk of LST depegs on the secondary market. While such scenarios are historically rare, several adverse scenarios have resulted in further discussions about LST pricing mechanisms and possible safeguards.
The stETH depeg scenario in 2022 provides a case study for evaluating pricing mechanisms. During this event, the price of stETH deviated significantly from ETH, leading to substantial market disruptions. Note that this scenario took place before staking withdrawals were activated, a critical component for peg stability assurances.
3.3.1 Context
Let's first cover the events that led to the stETH depeg that lasted from May 2022 to the Ethereum merge update in September 2022:
As stETH could not be redeemed for ETH until after the merge, the primary way to obtain liquidity on large stETH positions was through Curve liquidity pools
During the Terra collapse (May 7-16, 2022), the main liquidity pool on Curve lost more than half of its TVL (3AC and Celsius alone withdrew almost $800m combined), resulting in a classic liquidity crunch as reflected in the pool's imbalance which left the stETH price vulnerable
Given the poor market backdrop post-Terra's collapse, both pool imbalance and liquidity on Curve for stETH failed to recover; the drying up of liquidity meant that there was no other avenue for significant stETH holders such as Celsius to cover their positions
Source: Dune Analytics, 12th of September, 2024
3.3.2 Risk on Aave
At that time, Aave protocol was using a market pricing mechanism. Therefore, significant position health drops and liquidation stress were observed. In response to that, Aave's risk providers initiated governance-wide discussions and raised the stETH liquidation threshold (LT) from 75% to 81% to limit potential insolvencies and liquidations.
Estimated liquidations with an LT of 75%. Source: Aave Governance Forum, 14th of May, 2022
Estimated liquidations after LT increased to 81%. Source: Aave Governance Forum, 11th of June, 2022
This manual oversight and risk parameter change was mostly successful in limiting the potential extent of liquidations on Aave markets, with $9.4M of stETH collateral liquidated during this three-month depeg period. It is also important to mention that the extent of stETH's depeg never reached more than 6%, which was also a stress-limiting factor. Since the overall market tone was negative, other collateral assets suffered more in liquidation.
Source: Dune Analytics, 12th of September, 2024
3.3.3 Implications
While secondary market price oracles continued to be the only viable solution to effectively price assets before redemption of LSTs opened, starting from May 2023, BDG Labs proposed to switch to internal exchange rate pricing:
Additionally, before the risk teams evaluated the risk associated with the pricing of LSTs better, it was not completely clear if the "primary market" exchange rate of the assets should be used. Both following discussions of the community, activation of withdrawals in some LSTs, and after checking with Gauntlet and Chaos Labs, it seems legitimate to unify all pricing methods to use "official" (and non-manipulatable) exchange rates on all generalized price syncs.
Later, the development and activation of CAPO and a proposal for Killswitch followed. The rationale is that extended secondary market depegs of LSTs can only happen if/when they are not redeemable. Subsequently, after the native exchange is opened, these assets stabilize. This scenario was also the case for a more recent ezETH depeg event, another situation where the absence of staking withdrawals from the protocol inhibited peg stabilization.
3.4 Internal Exchange Rate: Aave's Exposure
As outlined above, internal exchange rate updates are not instantaneous, they happen in granular time intervals which differ by LST protocol. If the internal exchange rate update fails to reflect the consensus layer penalties in a timely manner, the lending protocols would be exposed to temporary mispricing of the assets and could incur bad debt. We cover the update frequency details and prevalence of internal safety mechanisms for the main LSTs/LRTs currently supplied on Aave:
3.4.1 stETH
stETH rebases happen daily (once every 24 hours) when the Lido oracle reports the Consensus Layer balance update.
Oracle network includes 9 independent oracles, oracle daemons hosted by established node operators selected by the DAO. As soon as five out of nine oracle daemons report the same data, reaching the consensus, the report goes to the Lido smart contract, and the rebase occurs.
The accounting oracle has sanity checks on both max APR reported (the APR cannot exceed 27%) and total staked amount drop (staked Ether decrease reported cannot exceed 5%).
In case oracle daemons do not report Consensus Layer balance update or do not reach quorum, the oracle does not submit the daily report, and the daily rebase doesn't occur until the quorum is reached.
Oracle daemons only report the finalized epochs. In case of no finality on the Consensus Layer, the daemons won't submit their reports, and the daily rebase won't occur.
stETH Consensus Layer updates passed once every 24 hours. Source: stETH Accounting Oracle, September 29th, 2024
3.4.2 eETH
The Oracle report is necessary to rebase eETH token balance. The report occurs at least once daily (usually 4 times per day but within varying time intervals of 3-10 hours).
In order for the consensus to be reached and the oracle to be updated, 2 out of 3 nodes (committee members) must submit and approve the update.
No additional sanity checks for the updated values are performed.
eETH internal Oracle updates. Source: ether.fi Oracle, September 29th, 2024
3.4.3 rETH
The rETH/ETH exchange rate is updated approximately every 24 hours based on the Beacon Chain rewards earned by Rocket Pool node operators.
Rocket Pool makes use of an oDAO composed of a whitelisted subset of node operators. These oracles push updates about system balances that update the rETH/ETH exchange rate.
No additional sanity checks for the updated values are performed.
The lags in update frequencies, along with differences in security details, means that the internal protocol exchange rates cannot always be relied upon as the definitive source of truth. In the unlikely event of slashing, the exchange rates may fail to reflect the accurate, up-to-date balances of LST assets, leaving protocols vulnerable to bad debt during a period until the rate update is executed.
3.4.4 Aave's Exposure to Internal Exchange Rates
Aave has substantial exposure to assets that use internal exchange rate pricing. The exchange rates are mainly used in LSTs as outlined before, however, fixed-rate pricing assumptions are now also being used for more recently onboarded tokenized BTC assets, namely cbBTC and tBTC (both using a BTC/USD price feed). It is important to point out that these BTC assets do not have CAPO integrated, meaning they are always assumed to trade at parity with BTC and cannot be updated to reflect the solvency of the specific tokenized BTC.
The following graph outlines that for Aave v3 Mainnet market, the assets that use internal exchange rate pricing (including fixed BTC/USD pricing) make up 31% of total supplied collateral. Note that the queries below account for wstETH, weETH, rETH, cbETH, ETHx, osETH, cbBTC, and tBTC. Therefore maximal risk exposure is distributed across several protocols.
Source: Dune Analytics
Moreover, focusing on the protocol's borrow-side exposure, internal exchange rate-priced assets have a maximal borrowable exposure ( calculated as e-mode max LTV * max supply) of over $5B. This maximal exposure assumes that all borrow positions are an e-mode enabled asset where applicable (e.g. borrow ETH against wstETH). This applies to LST tokens which currently have an e-mode loan-to-value of 93%. In other words, it indicates the total potential value that would become vulnerable in case of consensus penalty lags or exploitation of the internal exchange rates.
Source: Dune Analytics
All of this underlines that addressing the edge case risks and pain points of internal exchange rates should be prioritized to make the systems more risk-isolated. In particular, Consensus Layer update lags could be addressed with a solution that would directly monitor the consensus layer and mitigate the risks if penalties are observed.
Section 4: Future Directions and Conclusion
4.1 Addressing Current Limitations
As Aave and other lending protocols address inherent trade-offs in LST/LRT pricing strategies in search for optimal pricing mechanisms, the future of LST pricing and inherent risk management will depend on the following:
Continued development of hybrid models, such as Aave's CAPO and Killswitch, combining various pricing methodologies to enhance accuracy and stability.
Growth in decentralized oracle networks that provide reliable and tamper-proof price feeds across multiple chains.
While these developments will further reinforce the resilience of different lending protocols and help mitigate incoming risks, a significant shift away from internal exchange rate pricing is not expected to occur soon. Exchange rates will likely play a foundational role in determining LST prices due to their reliability and the challenges of implementing alternatives at scale.
However, solutions must become available to address the tail risks, including potential slashing events, protocol exploits, and unforeseen market dynamics that precipitate in excessive staking withdrawal demand. It may be tempting for lending protocols to discount the probability of black swan scenarios in favor of the convenience offered by internal rate pricing, but such events could be catastrophic without the implementation of adequate emergency preparedness mechanisms in place.
4.2 Recommendations
Following this research, we want to underline the importance of continued efforts to improve the risk-resilience of lending platforms. With a significant focus on safeguard systems, the existing exchange rate pricing for LSTs could be reinforced. As Aave's risk provider, we propose to work on the following points:
Continue discussions regarding Killswitch implementation and structure with different Aave entities. This would ensure the development efforts are coordinated well and avoid a large delay in the system's rollout.
Focusing on the LST/LRT slashing and inactivity risks, proposing a consensus layer oracle monitoring mechanism that could detect these events before they are reflected in the internal exchange rate of a contract. Such a system would also predict incoming liquidations and enable risk providers to preview and mitigate associated liquidity risks if needed.
Performing simulations and back-testing the pricing system on different stress scenarios.
We will continue advocating for proactive risk management and working with our protocol partners, including Aave service providers, to develop and implement improved pricing strategies. Our goal is to preserve the competitive edge made possible by the reliance on internal rate pricing while improving the assurance of protocol solvency and liquid markets in all conditions.