[ARC] Risk Parameter Recommendations for Aave V2 ETH (2022-11-22)

Can it be just done to all assets that they cannot be borrowed (but can be used as collateral), or it cannot be done in Aave v2?

2 Likes

Generally agree with the proposed changes, which should provide immediate mitigation of risk from long tail assets outweighing impact on UX.

For certain stable assets, I think there may be mitigating factors that reduce the need for freezing reserves. GUSD and USDP are redeemable/mintable for fiat, which should nearly eliminate the risk of significant price deviations. LUSD can be redeemed for ETH with a 0.5% fee, and can be minted against ETH at 110% collateral ratio, which effectively soft pegs the price within $0.995 to $1.1, also limiting risk. These assets are not accepted as collateral which further reduces risk. Given these mitigating factors I think it could be suitable to unfreeze these assets in the near future. (sUSD and RAI also have strong stabilization incentives, but in the short run don’t have as strong of liquidity effects which could leave them vulnerable to manipulation)

On the other hand, it could make sense to freeze reserves for SNX and ENS in the future as well due to limited liquidity.

Lastly, it could be possible to reenable certain assets if other risk conditions improve (eg lower maximum liquidation thresholds across other assets such as DAI/USDC/ETH, lower total borrow and supply of long tail assets, improving market liquidity).

3 Likes

Although the risk profiles of LINK and UNI are lower than the assets in AIP 121, the community may elect to pause LINK and UNI borrowing depending on risk preference. We have published AIP 122 and AIP 123.

Sorry if this is a noob question, but what risk does an asset disabled as collateral, such as LUSD pose in such a scenario?

If the risk is minimized by disabling collateral (like it is already on LUSD), then switching the other concerned assets to borrowing-only might be preferable.

While I understand the need to take serious action, I am also worried the community might be overreacting. I think that taking the same actions against 15ish tokens listed on Aave is a good tell of that: the better path forward is probably more aware of the specificities of each token, as @monet-supply was highlighting in his last reply:

1 Like

Hi all,
I am a bit surprised by the excessive decision. While emergency measures have to be taken, the problem has been accurately identified (LTV too high for some long tail assets) and lowering LTVs should be enough. I believe this is especially valid for the stablecoins mentioned above.

Unless, Gauntlet believes there are other systemic risks cause by these assets, but we would need more context to make such decision.

I’d like to add that in the current market, disabling all these long tail assets will just play into other lending protocol’s game, and lower Aave’s leadership.

5 Likes

From my perspective, it is a bit concerning the usage of the mechanisms of the v2 protocol following the approach of killing flies with bazookas.
Yes, it is clear (and really important that the community knows) that v3 is the most straightforward solution. But even if this past event is painful, that doesn’t mean we should boil down to irrationality.

It is important for the community to understand that the issue causing the CRV event is almost not because of CRV itself, it is because of the USDC Liquidation Threshold and Bonus configurations, which have been raised in previous periodic risk governance proposals.
A reaction of generalized freezing cuts that risk obviously, but sounds completely generic, as the main point is, in front any doubt, to cut borrowing of volatile assets.


  • CRV has a 61% Liquidation Threshold and an 8% liquidation bonus. That means it can absorb collateral important shocks, being quite healthy liquidity-wise (I think it is clear from yesterday, right?).
    In addition, there is no reason to think there could be any problem with infinite minting or similar in CRV, that is clear I assume.
    Removing the supply side of CRV makes 0 sense, just shows no confidence in the 61% Liquidation Threshold.

  • On GUSD, I don’t really see the rationale, it is supposed to be backed, no? In addition, it is only enabled as a borrowing asset.

  • LUSD freezing makes no sense, given what @TokenBrice mentions of his usage as only-borrowing (pretty healthy usage I would say, even if the size is not so big), and checking the fundamentals described HERE

  • sUSD is an only-borrowing asset, with a quite strong system of peg control behind it. Not sure which is the rationale, even assuming a price manipulation on the borrowing side, given the tremendous arbitrage that would be open.

  • USDP is reserves-backed and, from what I know, regulated/oversight by the NYSDFS (New York State Department of Financial Services). An only-borrowing asset too. If the rationale is its small size, it is an option. In terms of risk, I see 0 reasons. Because by this rule we should freeze USDC too.

  • 1INCH, 50% liquidation threshold, fairly liquid. Should not be enabled to borrow if so, the supply side doesn’t seem problematic.

  • BAT is already not enabled to borrow, fairly liquid on supply side (collateral) risk, depending on what your simulations show @Pauljlei

  • DPI, is not enabled to borrow already. And as mentioned multiple times already on the community priced on underlying

  • ENJ, should not be enabled to borrow and probably lower the liquidation threshold. then, about the fundamental value of it in the protocol, I question it.

  • ENS, should not be enabled to borrow, 60% Liquidation Threshold, which sounds perfectly ok.

  • LINK disabling borrowing sounds legit, same for UNI.

  • MANA, is probably too high a Liquidation Threshold; disabling borrowing sounds legit, removing the supply side, not sure.

  • MKR, is similar case to MANA, but with 1) stronger fundamentals in my opinion (kind of clear) 2) both an important partner and a really big historic size. Removing borrowing makes sense, removing supply does not.

  • RAI, agree with freezing, should have been done before.

  • SNX borrowing?

  • renFIL. Clear freezing, but for different reasons than the market.

  • UNI, following others’ approach, disabling borrowing is clear.

  • xSUSHI, borrowing is disabled and priced based on SUSHI, so freezing is debatable (there have been good numbers of xSUSHI historically, and still are).

  • YFI, borrowing should be disabled, but supply side I’m not fully sure, probably the main issue is having Liquidation Threshold a bit too high, but on this no opinion.

  • ZRX, I think freezing is acceptable, as there have been some past price manipulation attempts.

It is not the first time that this happens: some event shows substantial risk in the protocol, and the reaction is to try to throw everything out of the window. This is not really acceptable, because I expect a bit more “surgical precision” (disabling borrowing of every volatile?) from the entities participating in risk on the community, or at least, having though more before increasing the liquidation threshold of stablecoins on a pool like Aave, which only and exclusive use case at the current moment is to basically attack the protocol via really aggressive shortings.

Right now, the community has 2 options:

  1. Try to act fast and accept the proposed freezing, with the policy “well, it is something”
  2. Not agreeing with the proposal, but risking no-action adding any risk to the protocol.

Obviously, 2) is kind of a forced decision.

9 Likes

Re GUSD, right now it is possible to buy GUSD from the DAI’s PSM, but not the other way around? Is $0.5B the hard cap for GUSD PSM?
This means that as a debt asset GUSD is very liquid, right? And it will be very expensive to pump it’s price.

Fiat redemption/minting might take long time, and chainlink oracle might get updated long before the process is completed.

1 Like

Great step especially with the market conditions and v3 around the corner. All for it.

1 Like

Also, I’d like to ask the Aave governance to ponder one of the key driving components in this attack: the absolute preferential treatment given to USDC, both in terms of Liquidity Mining when it was a thing, but also in the collateral parameters.

The CRV scenario we saw yesterday is primarily due to USDC’s very permissive LTV (87%) - so if we want to take broad measures to risk off the Aave Protocol, I’d start by lowering USDC LTV.

The current setting means that only a ~11% increase of the borrowed token price is enough to go into bad debt territory (assuming USDC collateral and max borrow). Every % we can grab here would have a massive impact.

So if we are worried about a scenario like yesterday unfolding again, I think the most immediate and effective measure we can take is to lower USDC and other stablecoins collateral ratios: 80% should be the upper bond until the additional guarantees offered by v3 are available.

2 Likes

Glad to see to community active and discussing this proposal.

there’s an element of time sensitivity in current situation, as there’s some debate alongside this proposal would the community consider the following:

  1. Quick AIP to mitigate risk :
  • USDC LTV 78% LT 80% rest unchanged
  • DAI LTV 78% LT 80% rest unchanged
  • disable CRV borrowing; rest unchanged

publish this small-scope AIP in the immediate term

  1. Continue this productive discussion here over the next few days and fine-tune a larger scope AIP including more assets risk parameters updates.
5 Likes

Given the uncertainty in the market, I think all scenarios should include disabling borrowing of all volatile assets apart from WETH and WBTC, because disabling CRV at the moment is arbitrary, given that the risk is not created by CRV itself, but by stable collaterals.
Then, about reducing LT, if applying the previous disabling of borrowing, it is not even so urgent. The system is not exploitable anyhow. We should really be mindful of potential liquidations by reducing aggressively LT though.

3 Likes
  1. Given the attack vectors, is it worth considering ultimately incentivizing a move to V3?

  2. Why are only some of the assets subject to more risk than others?

  3. Is there a way to speed up governance to quickly jump on these types of changes in the face of exploiters like Avi Eisen? It seems that this proposal process and waiting on Gauntlet to make these proposals takes too long and renders Aave as potentially vulnerable to future exploits.

Hi @Pauljlei,

Thank you for presenting a proposal on the forum so quickly.

We appreciate in moving quickly, with an abundance of caution, that a rather conservative proposal has been presented whilst recognising that is can be walked back in parts at a later date. Llama supports the general direction of the proposal, however feels it leans into the abundance of caution a little to much. This is mostly like due to the need to act swiftly.

As we read through the comments, the conversation is pivoting towards a more token by token review. LTV and Liquidation threshold parameters require amending, this is beyond the initial proposal here as reducing the LTV can lead to governance decisions trigger liquidation of user positions and requires further analysis.

The below table summaries the key differences and views expressed on the forum. Would it be possible for a new AIP to be submitted that reflects the discussion to date ? If Gauntlet is encountering any constraints, please let us know, we are here to help.

Status Gauntlet eboado Llama
YFI Borrowing Enabled, Collateral Enabled Freeze Disable Borrowing Disable Borrowing
CRV Borrowing Enabled, Collateral Enabled Freeze Disable Borrowing Disable Borrowing
ZRX Collateral Enabled, Borrowing Disabled Freeze Freeze Freeze
MANA Borrowing Enabled, Collateral Enabled Freeze Disable Borrowing Disable Borrowing
1inch Borrowing Enabled, Collateral Enabled Freeze Disable Borrowing Disable Borrowing
BAT Collateral Enabled, Borrowing Disabled Freeze No Change No Change
sUSD Borrowing Enabled, Collateral Disabled Freeze No Change No Change
ENJ Borrowing Enabled, Collateral Enabled Freeze Disable Borrowing Disable Borrowing
GUSD Borrowing Enabled, Collateral Disabled Freeze No Change No Change
AMPL Borrowing Enabled, Collateral Disabled Freeze - Freeze & RF to 99%
RAI Borrowing Enabled, Collateral Disabled Freeze Freeze Freeze
USDP Borrowing Enabled, Collateral Disabled Freeze No Change No Change
LUSD Collateral Enabled, Borrowing Disabled Freeze No Change No Change
xSUSHI Collateral Enabled, Borrowing Disabled Freeze No Change No Change
DPI Collateral Enabled, Borrowing Disabled Freeze No Change No Change
renFIL Borrowing Enabled, Collateral Disabled Freeze Freeze Freeze & RF to 99%
MKR Borrowing Enabled, Collateral Enabled Freeze Disable Borrowing Disable Borrowing
ENS Borrowing Enabled, Collateral Enabled - Disable Borrowing Disable Borrowing
REN Borrowing Enabled, Collateral Disabled -
LINK Borrowing Enabled, Collateral Enabled Disable Borrowing Disable Borrowing Disable Borrowing
UNI Borrowing Enabled, Collateral Enabled Disable Borrowing Disable Borrowing Disable Borrowing

We were about to submit a freeze proposal for renFIL and are well placed to move quickly on an AIP if there is a need. As always we are here to help community. Well done to Gauntlet for getting something on the forum so quickly.

6 Likes

@bgdlabs is it possible to get more color on the timing of v3?

While I know this is difficult to estimate, it would be helpful for the community to decide which measures are best in the current situation - and how extreme this proposal does / doesn’t feels.

Can we “freeze” Gauntlet’s deal and find a better service provider?

1 Like

The pending items regarding Aave v3 Ethereum at the moment are:

  • The security providers of the community (Certora and SigmaPrime) are already reviewing the 3.0.1 changes that need to be applied to the v3 codebase pre-deployment, with a timeline of 1-2 weeks.
  • The Aave IPFS user interface should be verified to understand if it will properly support Aave v3 Ethereum (we will coordinate with @AaveCompanies, the maintainer, on it). This should be doable in the following 2 weeks too.
  • Once/if the proposal about initial listings HERE is approved, we will do an extra review on all of them (e.g. oracles). We expect this to be possible in the following 2 weeks too.
  • The Aave governance proposal payload for the activation/deployment of the system needs to be built, among other things, connecting all the components together. This depends on all previous points, but standalone is not time-consuming for us.
11 Likes

Thanks, @eboado @MarcZeller @fig @Llamaxyz @VonNeumann @yaron @A_J @AaveCompanies @monet-supply and all. We completely agree that to totally eliminate the specific risk of replicating the CRV situation on other assets, disabling borrowing of the long-tail volatile assets is enough.

However, this proposal is more broad in scope. We should have provided more context in the forum post, but in the interest of time, we wanted to get out the proposal ASAP and offer more context / respond to questions async. We will follow up with more retrospective analysis on CRV, but to clarify:

  • This proposal is not aimed at just eliminating the specific risk of replicating the CRV situation on other assets. This is a broader proposal to derisk Aave V2 ETH across many different market risks and potential attack vectors and help position the community for V3 ETH migration. These risks include 1) insolvency risk from liquidation cascades, 2) price manipulation “Mango squeeze” exploits, 3) traders using Aave to avoid high slippage costs and instead borrowing stables against a volatile asset, 4) risk of high utilization (coming from demand to short assets) impeding atomic liquidations, 5) replicating the CRV situation.
  • Many factors contribute to our recommendation for this broad approach to derisk Aave V2 ETH. First, from the CRV situation, it is now apparent that traders are indeed willing to risk substantial amounts of their own capital, which, although may not turn out to be profitable for them, can cause insolvency on Aave. This data should change the security threshold that is incorporated into recommendations. Second, we have received feedback that the community’s risk preference on V2 may now be lower than in the past. Third, the community has begun to consider migration towards V3, and there are now clearer timelines for V3 ETH deployment.
  • This is not a shotgun approach to derisk Aave V2 ETH. Rather, we analyze the risk profile of specific assets and their usage. Our platform continues to assess the risk profile of these assets.
    • This is why assets like LINK and UNI were not initially included in our proposal. This is because our analysis shows they are at lower risk than the other assets in the proposal. However, if the community’s risk tolerance is such that they would like to pause borrowing for these assets, then Gauntlet is supportive in order to further derisk V2 and prepare for V3 migration.
    • This is also why we include low-usage assets like ENJ and USDP in the proposal, where the benefits of keeping these assets on V2 are ambivalent.
  • Thanks for bringing this up. There is a broad misunderstanding that the recent increases of USDC LT (85% to 89% over the last year) were the driver behind insolvency. This total insolvency size depends on factors like the oracle updates, liquidator behavior, and size of the position. The fundamental driver behind the insolvency was allowing a user to put on a short position of significant size relative to the circulating supply of the asset. Would a lower USDC LT have reduced insolvency? Absolutely - but the LT reduction would have to be substantial - much lower than the 85% it started at.
  • In de-risking V2 ETH, we value user experience and want to best balance the tradeoffs between user experience and risk/V3 migration. @eboado provided valuable feedback on different paths for encouraging migration. We try to keep this in mind and would note that freezing assets do not meaningfully impact existing user positions (users are not immediately liquidated, they can pay back their borrow positions as normal, etc.). Freezing these assets that contribute to ~5% of Aave V2 ETH’s total TVL that contribute to a significant amount of risk on the protocol is a tradeoff we recommend for the protocol.

As many people on this thread have rightfully said - V3 has much better tools for managing risk. We look forward to using those to support assets when that is launched. We hope this helps clarify the proposal’s rationale and risk/reward tradeoffs and welcome community feedback.

8 Likes

As we have seen during the 2 different rounds of liquidations, this is not really true, almost certainly.
In the first round, liquidations even if in relatively not so big size, push the HF above 1. This was supported in good part by the price of CRV pushing down while the liquidation happen.
On the second important round (leading to bad debt), the price while liquidating was not bouncing down in parallel, but slightly going up, kind of expected from buy pressure. What happened then is that the over-collateralization percentage was progressively going down, until the position started to be undercollateralized and, luckily, remain in controlled levels (due to CRV’s price not getting out of control, which shows a pretty healthy liquidity market).
So, if the Liquidation Threshold would have been lower, especially on the strategy that was executed by the shorter, the margin on top of over-collateralization would have been 4% higher (to put things in perspective, the bad debt at the end is on the order of 1.something% of debt position of the shorter just pre-liquidation).
Liquidation Bonus is another aspect that could have helped, but this is more sensitive. If it would have been slightly higher, it is possible (but no certainty) that on a critical moment at the start of the second round of liquidations, the size of debt getting liquidated would have pushed again over 1 the HF, in practice “calming” the price up-trend, same as with the first round. This didn’t happen as we know, as it is understandable that liquidators can’t simply go in size if the bonus doesn’t cover their hedging.
Still, Bonus is complicated, because if that critical moment would have failed with higher, once undercollateralized, the growth of bad debt would have been accelerated.

In a more fundamental layer, the issue is not that 1 year ago the LT was 85%, the issue is that maybe it should not have been.

I find pretty problematic this line of reasoning. Sure, I understand that quantitative there is clear trade-offs, but it is not only about quantitative measures. The Aave protocol strategically has always been both strict and secure on listings, together with welcoming new communities, if the asset is healthy.
Freezing assets that were only enabled to borrow (stables) I assume because of some risk on the upside price on borrowings, doesn’t look good to me.




If there is no alternative proposal submitted in the following hours, it is pretty obvious that people should support proposal 121. But it is extremely concerning that we are in the situation of doing this kind of decision.
I’m deeply involved via BGD on the movement forward of Aave v3 Ethereum, and of course, I agree that a full v3 ecosystem is Aave’s future. But I completely disagree with the policy of “we have Aave v3 upcoming, let’s just freeze almost everything to be on the safe side”.
For sure it is something that de-risks, but I expect a bit more effort.

3 Likes

Chaos Labs supports the proposal made by @eboado and @llama, to disable borrowing of volatile assets on v2, reflected in the table above.

Given the current market conditions and the current level of risk parameters, this is a risk-off and prudent approach. However, this is a temporary mitigation and not a long-term solution.

It would be our preference not to completely prevent users from borrowing these assets, but unfortunately, major changes in LTV & LT would be necessary for adequate risk protection. For example, reducing USDC/DAI liquidation thresholds will trigger liquidations of currently healthy positions and cause unnecessary harm to users that do not pose a risk to the protocol

Reducing Liquidation Thresholds

The proposal to reduce liquidation thresholds for USDC and DAI effectively mitigates the risk of high liquidation thresholds. However, this is a significant change and we wanted to present data to quantify and visualize the effect of such reductions on protocol users. Specifically, we want to surface data around the liquidations this would trigger as some are sizable and warrant a discussion of how these should be handled. We’re focusing on 3 LT levels:

  • Decrease LT by 3% → as voted upon as the Rate of Change Consensus.
  • Chaos identified LT → This is a reduction in LT that aims to find a balance between minimizing fund loss while still reducing LT in a significant manner.
  • LT = 80% → This significantly reduces protocol risk but incurs liquidations and user fund loss.

Main Insight

While a liquidation threshold of 80% is the most effective in de-risking the protocol it incurs large liquidations across USDC and DAI. Updating the USDC LT to 84% and DAI to 83% respectively, present a significant LT reduction while minimizing user losses (if the DAO is willing to consider this as an option) and give users the ability to incrementally top up or wind-down positions as we aim to move LTs to 80% ultimately.

USDC Effects of Reducing Liquidation Thresholds

$USDC LT = 86% LT = 84% LT = 80%
Accounts Liquidated 168 174 331
Liquidation Value ~1.15M USDC ~2.2M USDC ~18.3M USDC
User loss (penalty) ~50K USDC ~100K USDC ~790K USDC

DAI Effects of Reducing Liquidation Thresholds

$DAI LT = 87% LT = 82% LT = 80%
Accounts Liquidated 11 18 34
Liquidation Value ~$1.3K DAI ~$20K DAI ~$890K DAI
User loss (penalty) ~50 DAI ~800 DAI ~$35K DAI

Note → We’ve queried this data from the officially maintained Aave v2 subgraph. There are several known discrepancies with data returned from v2, similar to issues we’ve discovered and fixed for v3. If the community agrees with this as a next step, we can validate all the data via an on-chain simulation and follow up with a targeted governance proposal. An incremental reduction can give users the opportunity to top up or unwind positions.

Looking Forward

We are eager to reactivate these markets with sensible supply and borrow caps on V3 (like the supply caps proposed yesterday) to be accessible to users while maintaining a high-security threshold against potential exploits. However, since the current priority is finding a sustainable solution for these assets on V2 we believe that after disabling borrowing of risky assets, the DAO should address incrementally decreasing risk parameters until they reach acceptable levels. The goal for new parameters for these more volatile assets would be to reactivate them for borrowing more aligned with prevailing market conditions and liquidity.

We are concurrently reviewing all v2 markets to confirm whether or not we view any other assets at risk or if there are opportunities to simply reduce liquidation thresholds and associated parameters instead of disabling borrowing, but may prefer that to be a second-stage decision when reactivating markets as to not impede the near term protection of the protocol via more conservative measures.

TL;DR -

  1. Chaos Labs supports disabling borrows, as suggested by eboado in the above table.
  2. Follow up with community investigation into how to:
    1. incrementally decrease risk parameters to enable borrowing without triggering liquidations of currently healthy positions
    2. utilize parameter changes (and potentially treasury incentives) to sunset v2 markets and move positions to v3 in short order
9 Likes

If the bank has bad debts, will it close the bank and not lend to others? If we fall when walking, will we not walk after the fall?Directly closing these virtual currency loans will cause the following problems:

  1. Reduce the number of people using AAVE. It is difficult for people to come back after they leave. When V3 comes online, can you ensure that these people who have left come back? People who do not know the situation will think that there is something wrong when they see the decline of AAVE deposits? Cause herd effect.
  2. The influence of AAVE in DEFI is reduced
  3. Recently, there have been so many events of centralized exchanges. Now, in this event of AAVE, everyone is waiting for the solution of AAVE and the decentralization of DEFI to be better than the traditional centralized exchanges. If this solution is to close the loans in these currencies, then it is easy to understand that our AAVE project is not good, and DEFI is not good either?

Each of the above points is more important to the AAVE project than the loss of 1.6 million dollars. If it is not handled properly, the price of AAVE tokens will plummet, and if it is handled well, the price will soar.

The problem is simple: there are too many other virtual currencies that can be lent out by mortgage, which makes it impossible to quickly complete the liquidation when the market fluctuates sharply.

The solution is simple: reduce the proportion of mortgage loans, that is, reduce LTV.
If the problem is solved well, everyone will rebuild their confidence in decentralization and DEFI

Use your brain to solve problems, not your emotions.

1 Like