Title: [ARFC] Adjusting WBTC Parameters to Address BitGo Transition Risks
Author: @LlamaRisk
Date: 2024-09-18
Summary
We recommend reducing WBTC LTV to 0 and lowering supply and borrow caps on Aave markets due to concerns about BitGo’s custody transition for WBTC, while aiming to maintain stability for existing users.
Motivation
Our analysis of the BitGo WBTC custody transition began with an initial brief, followed by confidential discussions under NDA. Although we continue to be in communication with BitGo to establish clarity about BIT Global’s compliant status, we remain unconvinced about the outlook for this partnership and its implications for WBTC transparency standards and user assurances going forward.
While we recommend proactive measures based on our concerns, we do not believe there is an immediate threat to WBTC; Aave has the benefit that it can take gradual, measured actions to mitigate protocol exposure, and this improves the ease of reversing course if trust is later established in the new custody arrangement. In anticipation of custodial changes which may cause a period of turbulence (e.g. proposed WBTC offboarding from Maker/SparkLend starting October 3rd), LlamaRisk recommends a cautious approach that prioritizes stability for existing Aave users while mitigating additional exposure to WBTC during the transition period.
Specification
- Reduce WBTC LTV to 0 on all V3 instances (Ethereum, Arbitrum, Avalanche, Harmony, Optimism, & Polygon), preventing additional borrowing against WBTC collateral without affecting the positions of existing users.
- Reduce supply & borrow caps to a level 5-10% higher than current utilization, limiting additional exposure to WBTC while allowing some flexibility for users to adjust their positions.
We do not recommend an LT reduction at this time, prioritizing user stability. However, we may propose gradual LT reductions as the situation develops, after consultation with stakeholders and with advance notice.
Disclaimer
LlamaRisk has not been compensated by any third party for publishing this ARFC.
Next Steps
- Following community feedback, submit the ARFC for a snapshot vote for final approval.
- If consensus is reached, submit an Aave Improvement Proposal (AIP) to implement the proposed updates.
Copyright
Copyright and related rights waived via CC0
Read additional details below
Links
- Chaos Labs
- https://dune.com/llamarisk/aave-lt-change
- Chaos Labs - wBTC BitGo Custody Update - #5 by LlamaRisk
What we know
- WBTC Transition: BitGo is transitioning to a tri-party management with BIT Global. BitGo CEO provided verbal agreement details, including technology, fee-sharing, and warranties.
- Ownership and Regulation: Justin Sun is said to hold a minority stake in BIT Global. A BIT Global corporate registry excerpt publicized by Protos lists five corporate shareholders, all based out of the same address in the British Virgin Islands. BIT Global has a TCSP license but lacks an HKMA Authorized Institution status and/or an SFC virtual asset trading license.
- Regulatory Guidance: Digital assets custodianship may fall under HKMA or SFC regimes.
- Key Sharing Scheme: The new system employs a 2-of-3 cold-storage multi-sig arrangement. Each of the three participating entities - BitGo Inc., BiT Global, and BitGo Singapore Ltd. - secures one key. The master keys are geographically distributed, with one each located in the United States, Hong Kong, and Singapore.
- Expected timeline: Maker is likely to begin offboarding WBTC in phases, starting around October 3rd, 2024. WBTC custody transition will potentially take place by October 8th, 2024 (as per the original partnership announcement).
What we don’t know
- Joint Venture Details: Specific rights, obligations, and full agreement details between BitGo and BIT Global.
- BIT Global’s Status:
- Extent of Justin Sun’s influence
- Specific licensing for digital asset custody in Hong Kong
- Internal regulatory compliance procedures
- Legal opinion on compliance with applicable laws
- Due Diligence: Scope and details of BitGo’s due diligence on BIT Global (financial, legal, compliance).
- Market Impact: Potential effects on WBTC’s liquidity and peg resiliency during and after the transition.
Based on the considerations above, the following questions need to be addressed:
- Has BIT Global obtained explicit permission or licenses to safeguard digital assets?
- What specific guidelines, reporting requirements, audits, or other regulatory obligations is BIT Global required to adhere to?
- What was the scope and extent of the counterparty due diligence that BitGo conducted before entering into the joint venture with BIT Global?
Specific documents should be provided:
- Copies of all licenses and permits obtained by BIT Global related to digital asset custody and operations;
- Details of internal policies and procedures that ensure adherence to regulatory guidelines;
- A formal legal opinion prepared by qualified legal counsel affirming BIT Global’s compliance with applicable laws and regulations.
- Details of the due diligence reports compiled by BitGo concerning BIT Global or risk assessments, including financial, legal, and compliance evaluations of BIT Global.
Joint Venture Agreement
We emphasized the need for a comprehensive understanding of the agreement between BitGo and BIT Global, particularly regarding the rights and obligations of each party involved. This is a critical aspect of assessing the viability and operational structure of the joint venture. We encouraged BitGo to provide a memorandum or similar documentation detailing each participant’s specific commitments and expectations in this venture.
In response, the CEO highlighted certain provisions of the agreement, including mutual consent to maintain the current technology framework for WBTC operations and custodianship.
However, despite the importance of these points, no further specifics were shared, nor were any supporting documents presented to substantiate the verbal outline. As a result, we remain unable to independently verify the details of the joint venture agreement or review any corresponding memorandum.
Ownership Structure
In light of growing interest surrounding Justin Sun’s potential influence, we sought clarification regarding the extent of his direct and indirect control over BIT Global. While it is assumed that Sun holds a minority stake in the company, we could not verify the ownership structure independently, as the Hong Kong corporate registry is not publicly accessible.
Furthermore, it is worth considering a potential scenario where, despite his minority shareholding and absence from the board or as a representative, Sun could exert influence over the company’s decisions through other shareholders, board members, or representatives. This hypothetical yet plausible dynamic raises questions about governance and the extent of his sway within the corporate hierarchy. This issue warrants attention, given the opacity of the current ownership disclosures.
Licensing Status
Although BitGo’s regulatory status remains unquestionable, our attention shifted to understanding the specific licensing requirements for custodians operating within Hong Kong. To this end, we consulted the Hong Kong Monetary Authority’s (HKMA) Guidance on Provision of Custodial Services for Digital Assets, which targets Authorized Institutions (AIs) engaged in providing custodial services for digital assets.
The guidance stipulates that, about virtual assets, an AI may delegate or outsource its custodial functions only to (i) another AI (or a subsidiary of a locally incorporated AI) or (ii) a virtual asset trading platform licensed by the Securities and Futures Commission (SFC).
Virtual asset trading platforms under the SFC purview are subject to extensive regulatory requirements. These encompass the secure custody of assets, stringent Know-Your-Client (KYC) procedures, rigorous anti-money laundering and counter-financing of terrorism (AML/CFT) measures, avoidance of conflicts of interest, prevention of market manipulation and abusive activities, adherence to high standards in accounting and auditing practices.
The operators are mandated to implement comprehensive risk management systems, with a significant emphasis on cybersecurity measures to protect the integrity of their operations. The SFC stipulates that 98% of client virtual assets must be stored in cold storage solutions.
Upon conducting an inquiry with the HKMA’s Registry of Authorized Institutions, we found no registration details for BIT Global, indicating that the company does not appear to operate as an AI in Hong Kong. We extended our inquiry to the SFC’s Register of Licensees to explore the possibility of BIT Global managing a virtual asset trading platform. However, no relevant records were found there either.
Source: HKMA, September 9th, 2024
Source: SFC Public Register of Licensed Persons and Registered Institutions, September 9th, 2024
The only publicly verifiable registration data relates to BIT Global’s Trust and Company Service Provider (TCSP) license. Thus, their legal standing and capability to provide custodial services in Hong Kong hinge upon a legal opinion addressing their compliance with relevant regulatory frameworks or a similar document affirming the entity’s licensing status. This gap in verifiable information requires careful consideration before conclusions about BIT Global’s custodial legitimacy can be drawn.
According to the elaboration provided by BitGo’s legal team, an extensive legal analysis was conducted in collaboration with a reputable Hong Kong-based law firm. This analysis led to the conclusion that custodians in Hong Kong may obtain a Trust or Company Service Provider (TCSP) license to provide virtual asset custody services. However, a copy of this analysis has not been furnished for our review; therefore, we rely solely on the written statements provided by BitGo’s General Counsel.
The necessity to obtain additional licenses or regulatory approvals is not entirely disregarded. Such requirements may be necessary for providing custody services to SFC-supervised virtual asset trading platforms or licensed firms registered with or authorized by the SFC or HKMA. However, the merchants who would participate in BIT Global’s WBTC program are not considered entities under the mandatory licensing regime. Consequently, additional licenses or regulatory approvals are not required for the WBTC program.
Nonetheless, the legal theory outlined above should be substantiated by evidence demonstrating the cited exemptions applicable to merchants participating in BIT Global’s program—either through a legal analysis based on existing laws and regulations or via an exemption letter from the competent authority. We have formally requested the provision of such documents from BitGo.
