Summary
LlamaRisk supports this proposal, emphasizing that, if parameterized right, integrating Chainlink’s Smart Value Relay (SVR) can create a valuable new revenue stream for Aave by recapturing Oracle Extractable Value (OEV) that would otherwise go to MEV extractors. This enhancement complements Aave’s upcoming protective mechanisms against price manipulation risks.
The proposed mechanism leverages a specialized Chainlink SVR DON to submit aggregated price updates via Flashbots’ MEV Share auctions, with a fallback system ensuring the reliability of on-chain price feeds if auction delays occur. However, this creates a critical synchronization challenge: when collateral and borrowed asset prices move in opposite directions simultaneously, price update auctions may resolve at different times, creating situations where liquidators execute based on incomplete price information, potentially reducing liquidation efficiency and increasing bad debt risk.
A phased roll-out is recommended to mitigate these risks, starting with assets where SVR would only affect a loan’s collateral or borrowing side, not both simultaneously. Historical data analysis shows that during rare but significant market volatility, the timing of price updates becomes critical. LlamaRisk advises keeping SVR delays under 5 blocks and gradually expanding coverage while monitoring whether the expected OEV recapture rates (30-50%) materialize in practice.
For implementation, LlamaRisk may recommend parameter adjustments, including liquidation bonuses and deviation thresholds, with specific values tailored to each asset’s volatility profile and market depth. Manual override capabilities should also be implemented, allowing guardians to switch between SVR and standard feeds when necessary. Umbrella’s automated slashing mechanisms could be calibrated to address potential shortfalls from SVR-related delays, creating an integrated approach to protocol safety.
Mechanism design
Chainlink SVR DON
Price feed updates are submitted by specialized Decentralized Oracle Networks (DONs), which calculate the asset’s price off-chain based on multiple aggregated sources and submit these changes to on-chain Chainlink price feeds. The values returned by these price feeds are then referenced by Aave’s protocol to price the assets.
The proposed SVR mechanism would implement an SVR-specific DON, simultaneously submitting changes to on-chain fallback price feeds and an MEV Share auction. This network possesses the same decentralization properties and would use the same sources for aggregate price computation, uniquely modifying the price relaying part.
MEV Share
MEV Share is a system developed by Flashbots that enables Ethereum users and searchers to capture a portion of the Maximal Extractable Value (MEV) that their transactions create. Instead of broadcasting transactions directly to the public mempool, users send them to the MEV Share system. Searchers then analyze the encrypted transactions and propose execution strategies that extract value. Multiple searchers bid by proposing a modified transaction bundle that extracts MEV while sharing some profits with the user. The winning searcher successfully extracts MEV as the chosen bundle is executed.
In the SVR architecture, SVR DON would be the “user” submitting a price feed update transaction to an MEV Share auction. The liquidators could then bid to extract the most value by bundling the price update transaction with a liquidation action. This auction would then end with an executed price update, which would be forwarded to the SVR price feed.
SVR Price Feed
The final component is the SVR price feed, which receives the price updates from the SVR DON via the MEV Share auctions. This price feed also has a default fallback functionality, which, in case of SVR report stalling for longer than a pre-programmed delay, would fall back and report the price of the standard (fallback) price feed. This dual mechanism helps to ensure that the SVR feed is never out of sync (by more than the fallback threshold) and does not stall indefinitely.
SVR and fallback price feeds are designed to function separately from the current traditional price feeds, making the SVR mechanism opt-in. Additional synchronization logic is also applied to ensure that the SVR feed is never ahead of the fallback feed, eliminating MEV opportunities on the fallback feed updates.
Risks
To enable OEV, the SVR mechanism adds more layers to the current price reporting mechanism. This introduces additional risks reflecting Aave’s protocol and markets using the SVR feeds. We aim to evaluate these risks and build upon the analysis provided by Chainlink.
Dependency Risk
Chainlink’s Price Feeds
Aave’s protocol is critically dependent on Chainlink’s price feeds. The functioning of these oracles has consistently been stable, providing price data aggregated from liquid sources and evading sharp temporary deviations reported by other oracle providers. This is enabled by DONs, which continue to become more decentralized by increasing the number of underlying data providers and oracles. While DONs reside off-chain, decentralization helps to minimize the risk of manipulation while expanding price source coverage.
Source:
Chainlink’s BTC/USD feed, March 7th, 2025
As mentioned above, implementing SVR would not change the properties of the price feeds. Therefore, the decentralization and data source properties would be maintained.
Flashbots MEV Share
SVR introduces an additional dependency on the Flashbots infrastructure, the functioning of which directly impacts the latency of price updates. Historically, ~95.5% of all MEV Share auctions have been resolved with transactions included under 3 blocks. Moreover, 2% of transactions took longer than 6 blocks to resolve.
Source:
Dune Analytics, March 7th, 2025
Transaction resolution time does not correlate with the market’s volatility. Instead, we can observe that the delays have become less prominent since early 2023, with the 95th percentile of resolution times decreasing from 7-10 blocks to 2-3 blocks.
Source:
Dune Analytics, March 7th, 2025
The underlying reason is the share of validators connected to the Flashbots infrastructure. While the auctioning process is generally finalized in less than a second, most of the delay stems from the waiting time for a transaction to be included in the block. As outlined by Chainlink, the probability of delay of $d$ blocks dependent on the share of connected validators $f$ can be modeled as a geometric distribution:
Over the past year, this share has consistently been at 90%, meaning that the probability of a delay larger than or equal to 3 blocks is 0.1%. This is largely consistent with the observed historical figures.
Source: Chainlink’s OEV Risk Analysis, March 7th, 2025
If validators connected to Flashbots experience disruptions or changes in participation rates, it could impact the auctioning process and introduce delays in Oracle updates. If the validator participation rate dropped to 60%, we could expect the probability of a delay equal to or larger than 3 blocks to reach 8%. Therefore, it is important to consistently monitor the participation metrics and be able to switch back to standard feeds if the SVR updates become inefficient.
Pricing Risk
The initial consequence of MEV Share auction delays is price volatility risk. We can quantify the Value at Risk (VaR) by inspecting the most aggressive historical price movements over block delays. Here, we reference Chainlink’s findings, which cover the most aggressive increases and decreases (0.01/99.9th percentile) in WETH, BTC, and AAVE prices for the observation period starting January 1st, 2022.
Source: Chainlink’s OEV Risk Analysis, March 7th, 2025
It can be observed that the price fluctuations throughout 5 blocks are contained within the 0.6% threshold for the larger, more liquid WETH and BTC. Nonetheless, more volatility is observed for smaller-sized assets, whereas for AAVE tokens, the most aggressive price fluctuations over 5 blocks reached 0.83%.
These values closely present the incremental pricing risk that Aave’s protocol would incur when using SVR price feeds. These results also imply that SVR implementation should be considered on a per-asset basis. Factors such as sufficient liquidity and abundance of different trading venues for an asset should be monitored even after deploying the SVR feeds.
It is also important to consider that the SVR price feeds, similarly to classical feeds, also have a deviation threshold parameter, which specifies the relative deviation of the asset’s price before an update to the on-chain price feed is initiated. For instance, the ETH/USD price feed has a deviation threshold of 0.5%, while the AAVE/USD feed has a threshold of 1%. This means that the maximal change that an asset’s price would undergo before an on-chain price update happens (and consequently a liquidation is initiated) would be defined by the deviation threshold and secondary market price change over maximal SVR oracle delay d at any given block t:
The additional pricing exposure could be mitigated by adjusting the SVR feeds’ liquidation bonus and the deviation threshold parameter. We will cover these measures in a separate risk recommendations section.
Bad Debt Risk
As outlined, incremental bad debt risk stems from the delays introduced by the SVR feeds. We can quantify the bad debt amount as a function of maximal price changes. Liquidations (state where LTV > LT) can be triggered in two ways:
Value of collateral asset decreases
In this case, bad debt occurs only if the liquidation does not happen until the depreciated USD value of the collateral becomes smaller than the USD value of the loan. When the collateral asset is not the same as the borrowed asset, the amount of bad debt due to the delay d is:
Value of debt asset increases
Conversely, in this case, bad debt occurs only if the liquidation does not happen until the appreciated USD value of the debt becomes larger than the USD value of the collateral. When the collateral asset is not the same as the borrowed asset, the amount of bad debt due to the delay d is:
Combined scenario
While, in general, bad debt risk is two-sided and applies in both scenarios, collateral-only assets are impacted by the price decrease scenario and, therefore, could be assessed using one-sided analysis only. On the other hand, an important consideration is that when SVR feed is enabled for both collateral and borrowed assets, the incremental amount of bad debt would be impacted by the combination of two scenarios, leading to a more aggressive overall spread between the collateral and debt values:
Delay synchronization
The sum of deviation thresholds with current price feeds limits the impact of the asset price co-movements. However, the implementation of SVR would be combined with individual delays in each feed. To illustrate the issue of update delay synchronicity, let’s consider the following situation:
- A maximal SVR delay of 5 blocks is set, and a deviation threshold of 0.5% is configured for all SVR feeds.
- ETH is supplied, and BTC is borrowed at 92% LTV.
- At time t, the price of ETH decreases by 0.5%, initiating the SVR feed update.
- Simultaneously, the BTC price increases by 0.5%, prompting an SVR feed update.
- Both price update auctions take 5 blocks to resolve, and during this period, the price of ETH lowers by another 0.5%, and BTC price increases further by 0.5%.
- After the price updates are made available on-chain at time t+5 blocks, the new LTV of the loan becomes 93.85%.
In this situation, the liquidators could initiate liquidations with both updates and whichever liquidation call is included will first be executed. The problem in this situation arises due to the issue that between time t and t+5 blocks, liquidators would only be able to execute one of the two price changes (BTC only or ETH only), lowering their potential gains due to the liquidation bonus. For example, if the ETH price update is executed first, Aave would still price BTC at the pre-update price, which is ~1% lower than the effective market price at t+5 blocks.
Nonetheless, from an aggregate perspective, since liquidations are triggered by specific price updates, the timing and order of these updates determine which users are affected. If both ETH and BTC updates occur in the same block, some users will be liquidated on the ETH update, others on the BTC update, and some only after both updates are processed. This staggered execution means liquidations do not uniformly reflect the final post-update market state but instead depend on the sequence of price propagation, therefore impacting liquidator profits.
Adjustments in liquidation bonuses and deviation thresholds would again be the suitable solution to mitigate the potential bad debt risks arising from the abovementioned situations. Nonetheless, the exact changes would depend not only on the individual assets but also on borrow distribution, and inter-asset correlations would need to be considered when activating particular SVR feeds.
Recapture rate
Chainlink defines the notion of total and realized Oracle Extractable Value (OEV). Based on the market size and liquidation bonus parameter, the total OEV represents the maximal possible profit that could be extracted based on the liquidation events during the observation period of January 1st, 2024 - December 3rd, 2024.
Source: Chainlink’s OEV Risk Analysis, March 7th, 2025
The estimates show that OEV opportunities differ greatly per asset, mainly due to market size and volatility differences. Nonetheless, the realized OEV would be lower based on the competition of the liquidators, execution efficiency, and costs. This value is also greatly dependent on the liquidation sizes, supposing that with greater amounts, the execution efficiency reduces. The top 10% of liquidations represent roughly 80-90% of the WETH, WBTC, and AAVE liquidation volume. These size discrepancies mean the realized OEV for large liquidations should be calculated with a larger, more conservative discount.
Source: Chainlink’s OEV Risk Analysis, March 7th, 2025
According to real-life market efficiency simulations, Chainlink estimates that 50% of total OEV would be captured for smaller liquidations. In comparison, larger (top 10%) liquidations would capture 30% of total OEV. While this is a conservative estimate, the real recapture rate would only be observable after deploying SVR for pilot assets. Initially, the OEV capture rate could be lower due to the need for searchers to adapt to SVR auction opportunities and perform efficient bidding.
Historical Analysis
To quantify the risk of bad debt under the delays introduced by the SVR price feeds, we cover the historical price movements under the current Chainlink price feeds used on Aave’s Core market.
Oracle updates
We begin by inspecting the operation of current Chainlink price oracles, where we can observe that the price feed update frequency corresponds to the sharpness of volatility. The price feeds have two sensitivity parameters: 1) the deviation threshold at which the update is triggered and 2) the heartbeat, which automatically updates the price feed if the deviation is not reached for a longer predefined period.
Source: Dune Analytics, March 7th, 2025
The historical update frequency for ETH/USD indicates that most updates happened when triggered by the heartbeat. This result is rational given that the volatility episodes are generally of short duration. While even during high volatility, the updates were spaced out, we can still observe 10 instances where the price updates happened after 5 or fewer blocks after the last price update. This represents 0.03% of all price updates and indicates the tail risk for the operation of SVR price feeds.
Source: Dune Analytics, March 7th, 2025
The reported price changes are heavily centered around 0.5%, the deviation threshold of the ETH/USD price feed. In addition, more extensive price changes have been observed, ranging between +2% and -4.3%.
Source: Dune Analytics, March 7th, 2025
In particular, some of these largest changes happened within 0-5 blocks after the previous price update and corresponded to the 10 instances in the charts above. Nonetheless, almost all of these short-duration price changes were in different directions, compensating for a sharp price decrease with an increase or oppositely. Also, no more than 2 price update transactions were observed within a 5 block window. These findings indicate intricate co-movements during periods of extreme volatility and, therefore, require particular attention when optimizing the risk parameters of the SVR integration.
Source: Dune Analytics, March 7th, 2025
Similar observations and properties were confirmed with AAVE/USD [1] [2] and BTC/USD [1] [2] price feeds.
Other considerations
Improvement upon Oval
Chainlink’s proposed SVR mechanism presents an alternative to previously proposed UMA’s Oval for capturing OEV within Aave. The SVR design addresses concerns regarding centralization by utilizing existing Chainlink DONs for price updates and maintaining the established decentralization level. While it introduces a dependency on Flashbots MEV Share, this infrastructure is widely used and possesses a degree of distributed operation.
The potential for block delays, a concern for both Oval and SVR, is addressed by Chainlink through a detailed analysis of delay probabilities and a fallback mechanism to standard price feeds, aiming to mitigate risks during volatile periods. Historical data suggests selecting lower delays significantly lowers the risks.
The SVR’s integration with existing Chainlink infrastructure is intended to minimize the introduction of unproven components. The proposal also aligns with the preference for direct integration with the price provider, as it is developed and offered by Chainlink. While Chainlink’s relationship with the Aave DAO differs from that of a native contributor, the SVR mechanism is designed to enhance the Aave ecosystem. The implementation allows for a phased rollout, enabling the Aave community to assess the mechanism’s impact.
Synergies with Umbrella Update
In addition to classical risk parameter management, integrating Chainlink’s SVR mechanism and Aave’s Umbrella update presents an opportunity to manage the incremental risks introduced by OEV capture. By quantifying potential price volatility and delay-induced bad debt through historical analysis and simulations, as facilitated by SVR’s design, the needed Umbrella coverage could be estimated to adapt the SVR feeds. Umbrella’s automated slashing and token utilization can then be employed to address any identified shortfalls arising from SVR-related delays. This synergy allows for a proactive, data-driven approach to risk management, ensuring that SVR’s enhanced OEV capture capabilities do not compromise the protocol’s overall safety.
Risk Recommendations
After reviewing the proposed implementation, we believe the system does not present critical risks and would result in increased revenues for the DAO. Nonetheless, the adoption of SVR should be rolled out incrementally, and risk parameters should be managed and optimized as more observations on the system’s functioning are made. If this system is adopted, we also invite Chainlink to release public status reports covering what has been learned and the results of the new implementation.
As a risk provider, we will recommend changes to the risk parameters per asset whenever a new SVR adoption is proposed. In addition, we present a list of general risk considerations.
General Considerations
- Given the more complex scenarios apparent when the SVR price feed would be adopted to both borrow and collateral side assets, it is preferential to initially deploy assets where SVR would not be fully exposed to price both sides of the loan.
- Initial SVR feed delay should not exceed 5 blocks, as longer delays would result in more aggressive risk parameter changes. The maximal delay of 3-5 blocks is enough to expect efficient MEV Share auctions and keep the risk of bad debt minimal.
- It is important to continuously monitor the system’s efficiency and ensure that the efficiency of the searchers participating in the auctions is sufficient to enable higher recapture rates. The recapture rate is expected to increase with maturity. However, initial recapture targets of 30-50% should be maintained.
- The dependency on the Flashbots infrastructure prompts continuous monitoring. If the share of connected validators unexpectedly decreases, the system’s efficiency would drastically lower, increasing the risk of bad debt in the protocol.
- Manual price feed switch via guardians (or specialized risk stewards) should be made possible. The ability to switch between classical and SVR feeds, especially in the pilot phase, is crucial to ensure the uninterrupted functioning of Aave’s protocol.
- It remains to be discussed whether there is a preference to cover part of the risk via the protection of the upcoming Umbrella update vs. covering the risk via the asset parameter changes.
Parameter Changes
Implementing the risk parameter changes with the adoption of SVR is to keep the risk of bad debt unimpacted. As explained above, this can be achieved by increasing the liquidation bonus based on the most extreme deviations within a maximal SVR feed delay. An additional measure would be lowering the deviation threshold of the SVR price feeds, making them lower than the deviation threshold of the classical feeds.
Liquidation Bonus should be adjusted upwards at the VaR of the observed 0.1% top observed deviations. For example, given a 5 block maximal delay, this would result in:
- An increase of 0.61% in the LB for assets using ETH/USD market price feed
- An increase of 0.48% in the LB for assets using BTC/USD market price feed
Price Feed Deviation Threshold could be adjusted downwards to compensate for part of the increase in the liquidation bonus. This would achieve earlier initiation of the MEV Share auctions, potentially reducing the total discrepancy between the no-delay price feeds by 1-2 blocks when the volatile price movements start to take effect.
Liquidation Threshold is not to be adjusted unless the minor change in LB requires a larger buffer. Most assets on Aave’s Core market would not require that as the Liquidation Thresholds are sufficiently conservative.
Any parameter changes would still be treated on a per-asset basis, aligning with the historical price movements and liquidity metrics.
Disclaimer
This review was independently prepared by LlamaRisk, a community-led decentralized organization funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
