[ARC] Aave ETHPoW Fork Risk Mitigation Plan

Thanks @stani @Primoz @eboado @monet-supply @MarcZeller @sakulstra @Emilio @Llamaxyz for your thoughts. Below is a summary of what has been discussed so far, what we know vs. what we don’t know, and the tradeoffs we as a community are facing.

Below are the distilled pros and cons of pausing ETH borrow. We dive deeper into the factors that impact these elements below.


  • Pausing ETH borrowing mitigates the risk of high utilization by immediately preventing additional borrow. It is difficult to quantify the benefit of this in preventing bad debt.


  • Pausing ETH borrowing may increase the likelihood of ETH withdrawals for various reasons, thus increasing the risk of high utilization. It is difficult to quantify the downside here as it relates to the increased chances of bad debt.
  • Timelines: how long will the speculative behavior last and when will Aave unwind back to its normal state?

What We Know vs. What We Don’t Know

One thing we as a community need to be quite careful of analyzing in this thread is the separation between making an assumption (or a set of assumptions) and ex ante analysis performed after assuming such assumptions. Such analysis might not be transferrable or comparable between different assumptions. In the thread, we’ve seen a lot of analyses where one author claims, “if X is true, Y will happen” whereas someone else says, “if Z is true, Y will not happen”, yet we cannot reconcile if there is a relationship between X and Z or not. Just to be extremely clear, it is very important to describe in a cogent and coherent manner what the set of assumptions being made are and how some of the analyses in this thread make claims based on certain assumptions. While Gauntlet has been conducting research to formulate a risk mitigation plan, community members have presented their own plans/scenarios here that make stronger assumptions with large uncertainty, so we have been looking at consolidating these assumptions into a framework to get to a better equilibrium.

Commingling assumptions made with implied correlations does not necessarily correspond to a causal prediction (especially for a rare event like the merge). For instance, in both the OP’s analysis and @eboado’s analysis, there is no separation between assumptions regarding different types of liquidity in the system (e.g. supplier liquidity vs. external market liquidity). Instead, there are implicit claims that effectively imply that supplier liquidity (within Aave) is positively correlated to external market liquidity (for liquidations). For some assets (e.g. stETH) this is true due to the recursive incentives that exist, but for other assets, this is absolutely not true empirically. Implicitly correlating assumptions like this can lead to bad analysis as one implicitly causes cointegration (also see: Granger Causality test).

Given that most of the posts in this thread have signposted on particular correlated assumptions without separating them out into atomic, independent components, we should take a step back and do the epistemic work of laying out the assumption space. Only then can we distill what we know now versus what we are assuming and using this to make causal predictions. But how should we characterize the space of assumptions that are made here? First, let’s consider what we can actually compute as a coherent risk measure.

One of the most important things to consider is that the ultimate goal of any analysis done is to compute something in the form: “change in conditional risk (i.e. conditioning on assumptions made) relative to change in assumption”. This allows us to systematically search the assumption space before we assign probabilities (which are necessarily subjective for the merge) to each portion of the set of assumptions. For instance, understanding how Value-at-Risk (VaR) changes as a function of how utilization changes provides a mechanism for measuring how changes to stETH/ETH borrow demand impact net protocol risk around the merge.

Given that the sets of assumptions that need to be made are a) high-dimensional and b) non-smooth, computing such a measurement is a delicate simulation task. In an ideal world, whereas assumption is described by a continuous parameter X, we really aim to describe the conditional expectation:

Screen Shot 2022-09-04 at 9.31.20 PM

This form of conditional Value-at-Risk is the best we can do given the relatively inhomogeneous space that needs to be explored.

Assumption Space Definition

To be more specific and to peel back some of the assumptions being made within the thread, categorize them, and then try to understand how the relationships between these variables impact the trade-offs that AAVE holders are making when deciding whether to pause the market. While we present more formal notation here, the key takeaways can be seen at the bottom.

Screen Shot 2022-09-04 at 9.32.43 PM
Screen Shot 2022-09-04 at 9.33.01 PM
Screen Shot 2022-09-04 at 9.34.32 PM

Every single claim within the set of posts so far can be described as a set of constraints on these variables. Let’s go through a few to demonstrate this:

Screen Shot 2022-09-04 at 9.38.50 PM

Screen Shot 2022-09-04 at 9.46.39 PM

Screen Shot 2022-09-04 at 9.47.20 PM

Screen Shot 2022-09-04 at 9.48.35 PM

Note that all of these responses implicitly cointegrate particular assumptions — which is fine, but this means that all of the analyses cannot be used in an apples-to-apples comparison. Moreover, these assumptions aren’t all consistent with each other (so expectations over random variables assuming different sets of these assumptions aren’t apples-to-apples comparable). Instead, one effectively needs to say, “conditional on these assumptions, here is what the best unbiased estimate of VaR is” and then search over the assumption space. This is what we’ve spent quite a bit of time trying to tease out from borrower data (akin to what the OP has done), constantly retuned agent-based simulations based on adjustments to real data, and doing our best to estimate how much VaR changes (e.g. E[dVar/dX | assumptions] as a) assumptions vary and b) real borrower behavior changes.

Summary: Tradeoffs the Community Is Facing

Where do we arrive after trying to delineate the assumption space? If we make particular correlation assumptions on, say, Screen Shot 2022-09-04 at 9.51.46 PMas both @eboado and @primoz have, then we can reason about the outcomes from pausing borrowing.

The decision of whether to pause ETH borrowing boils down to the following decision trees:

If we pause ETH Borrowing, we have the benefits of mitigating spikes of both borrow demand and utilization into the merge and reducing uncertainty in the market [0], but the limitations are that it does so while potentially reducing supply (e.g. if Screen Shot 2022-09-04 at 9.57.06 PM), and it comes at the risk of reducing supply appetite in the future (though this is potentially mitigated by turning on ETH borrowing quickly post-merge). As stated, Gauntlet is supportive of pausing ETH borrowing given the limited downside relative to the potential risk that comes from all the uncertainty.

If we do not pause ETH Borrowing, we have the benefit of allowing the market to price the merge, but the limitations are the heavy reliance on arbitrageurs through the merge (even when this might be expensively prohibitive for on-chain traders during and shortly after the merge), and it comes at the risk of increased cascading liquidations (especially for recursively borrowed assets) and withdrawal difficulty for users at maximum utilization.

Assessing the expected value of these two decision trees can only be made based on subjective probabilities assigned to assumptions. We look forward to seeing the voting results here which implicitly assign probabilities to the assumptions outlined above — this is almost like futarchy (see Vitalik’s post on this from 2014)!

Note: Our role in the community

One other thing we wanted to clarify — our goal as risk managers is to provide the best possible options to the AAVE community for balancing risk and capital efficiency. Along with the OP and some other community members, Gauntlet’s analysis is that the benefit is not commensurate to cost. In the end, the community of AAVE token holders controls the protocol, and we want to make the tradeoffs available and presented in as clear and thorough of a manner as possible.

[0] There’s one less thing people need to worry about with a paused ETH borrow market since the ETH utilization only depends on the supplier withdraw. However, we also recognize the fact that pausing withdraw does affect the UX significantly for normal users and assume that this will not happen and/or be tenable via governance.