A proposal to create and add treasury funds to a new Rari Fuse pool that allows lending and borrowing YAM was approved with YIP-77. This proposal was never implemented due to other more pressing issues. After further discussion, @THEVDM1, @Snake, and I, as well as other contributors, now believe that creating and providing treasury liquidity to this Fuse pool is a risk for the treasury. This is due to a lack of liquidity in our Sushiswap YAM/ETH pool, which would serve as the price oracle for the pool.
Before deploying funds to a YAM Fuse pool, we should work to shore up the liquidity in the YAM/ETH sushiswap pool.
Yam Fuse Pool Key Risks
It is clear that the YAM/ETH Sushiswap pool has been suffering declining liquidity over the past few months and as such it provides a much weaker oracle pricing point, which is acutely relevant to the proposed Fuse pool.
YAM/ETH pool quarterly liquidity
January 2021 $4,932,433 March 2021 $8,789,833 June 2021 $2,470,756 September 2021 $2,096,900 December 2021 $1,436,171 Now (January 2022) $1,046,178
With declining liquidity, price impact of trading has greatly increased and this is what attackers would use to their advantage: they have the ability to greatly influence price if they are reasonably well capitalised.
Slippage percentage on varying size USDC-YAM trades:
Trade Size Start Price End Price Price Move $100,000 $0.2833 $0.356 26% $500,000 $0.2833 $0.584 106% $1,000,000 $0.2833 $0.870 207% $5,000,000 $0.2833 $3.154 1013%
To illustrate the risk a simulated attack is described below:
Buy $1M of YAM (price up 106%)
Buy across its 3 markets to remove risk of arbitrageurs (Sushi, Huobi, Gate.io) (Optional)
Deposit YAM into Fuse as collateral
Buy another $5M YAM (price moves up 1013%) collateral now worth >$10M
Wait 15 minutes for the Fuse TWAP to trigger
Borrow 50% against this YAM collateral as USDC and other tokens ($5M) at the artificially inflated price.
Sell $5M YAM price back to where it was before the large buy (collateral now $1M) but debt remains at $5M
Liquidator bots don’t have enough time to liquidate to retain pool solvency so the pool is effectively drained. Attacker forfeits collateral of $1M but walks away with $5M pool borrowings netting $4M
All of this can be achieved in less than 20 minutes, giving the few YAM whales any opportunity to sell the artificially high price down.
Fuse Liquidator Bots also suffer from low YAM/ETH liquidity:
It is also worthwhile mentioning that liquidator bots would need to buy YAM in order to liquidate undercollateralized borrowers, and high slippage in doing so is a problem.
If a user deposits $200k USDC into Fuse to borrow $100K YAM (to farm with/or go short) that would mean that if that borrower was liquidated a liquidator would have to buy $100K YAM on the open market to return to Fuse in order to claim the defaulters collateral for the liquidator reward. The liquidator reward needs to be set very high to make this economically feasible for the liquidator as the YAM buy alone moved the market price up 26%. And if the liquidator reward is set below this amount such as 5-15% (typical liquidation reward level) this causes a problem as liquidators have no incentive to liquidate (who would pay 26% above liquidation TWAP to earn 5-15%?) leaving a pool with poor liquidation bot coverage. This rewards can be set higher (e.g liquidation reward of 35%) but then borrowers are taking on more and more risk to borrow, decreasing the attractiveness of the pool to borrowers.
- Various protocols suffered such attacks in 2021. Venus & Cream are good examples.
- Venus’s attack used no flash loan so is the more relevant of the two
- The deeper the Yam liquidity the more capital you need to manipulate the market. Our liquidity is already too low to safely avoid this kind of attack and it is declining (becoming even easier to influence price)
- If the Fuse pool is low liquidity yes there is less incentive to drain it but it is still entirely possible.
Money markets such as Fuse are gas intensive. This prices out smaller users. Gas analysis is done below to prove the point that even if we were to deploy this pool, the user base would be limited to sizable borrowers/lenders only. If the liquidity issue is to be addressed above it is recommended that a whitelisted Fuse fork: Markets.xyz is used on Polygon/Fantom (current deployments) to recreate the pool and its parameters in the future.
*Rari Fuse is also launching on Arbitrum imminently
Units of GAS needed to call Fuse related functions
Action Units Gas Approval/Allow Collateral 50,000 Mint collateral token 225,000 Redeem collateral token 250,000 Borrow token 300,000 - 435 000 Repay token debt 200,000
Round trip of deposit, borrow and repay will cost around 1,145,000 units of Gas. Assuming ETH of $2500 and 100 Gwei that’s $286. When ETH was at it’s recent ATH of $4800 this was $550.
Do not launch the YAM Fuse Pools initially planned as the low liquidity of the YAM/ETH pool imposes too much risk for the utility the pool would have given users.
- Risk of attack through price manipulation causing a loss in treasury assets and user funds
- Risk of poor liquidation bot coverage due to high price impact on liquidating large borrowers
- Utility constrained by gas intensive functions required to use the pool
Thanks to @THEVDM1 for this very thorough write-up.
There is little that needs to be done to implement this proposal. No further work will be done on the Fuse Pools and no funds will be transferred until a new snapshot vote supercedes this one. In the mean time, contributors should continue to consider ways to improve the liquidity in our YAM/ETH pool.
Poll to Measure Sentiment
Snapshot vote has been posted: Snapshot
Vote ends February 7th at 00:00 UTC (midnight)