[ARFC] Adjusting WBTC Parameters to Address BitGO Transition Risks

Title: [ARFC] Adjusting WBTC Parameters to Address BitGo Transition Risks
Author: @LlamaRisk
Date: 2024-09-18

Summary

We recommend reducing WBTC LTV to 0 and lowering supply and borrow caps on Aave markets due to concerns about BitGo’s custody transition for WBTC, while aiming to maintain stability for existing users.

Motivation

Our analysis of the BitGo WBTC custody transition began with an initial brief, followed by confidential discussions under NDA. Although we continue to be in communication with BitGo to establish clarity about BIT Global’s compliant status, we remain unconvinced about the outlook for this partnership and its implications for WBTC transparency standards and user assurances going forward.

While we recommend proactive measures based on our concerns, we do not believe there is an immediate threat to WBTC; Aave has the benefit that it can take gradual, measured actions to mitigate protocol exposure, and this improves the ease of reversing course if trust is later established in the new custody arrangement. In anticipation of custodial changes which may cause a period of turbulence (e.g. proposed WBTC offboarding from Maker/SparkLend starting October 3rd), LlamaRisk recommends a cautious approach that prioritizes stability for existing Aave users while mitigating additional exposure to WBTC during the transition period.

Specification

  1. Reduce WBTC LTV to 0 on all V3 instances (Ethereum, Arbitrum, Avalanche, Harmony, Optimism, & Polygon), preventing additional borrowing against WBTC collateral without affecting the positions of existing users.
  2. Reduce supply & borrow caps to a level 5-10% higher than current utilization, limiting additional exposure to WBTC while allowing some flexibility for users to adjust their positions.

We do not recommend an LT reduction at this time, prioritizing user stability. However, we may propose gradual LT reductions as the situation develops, after consultation with stakeholders and with advance notice.

Disclaimer

LlamaRisk has not been compensated by any third party for publishing this ARFC.

Next Steps

  1. Following community feedback, submit the ARFC for a snapshot vote for final approval.
  2. If consensus is reached, submit an Aave Improvement Proposal (AIP) to implement the proposed updates.

Copyright

Copyright and related rights waived via CC0

Read additional details below

Links

What we know

  • WBTC Transition: BitGo is transitioning to a tri-party management with BIT Global. BitGo CEO provided verbal agreement details, including technology, fee-sharing, and warranties.
  • Ownership and Regulation: Justin Sun is said to hold a minority stake in BIT Global. A BIT Global corporate registry excerpt publicized by Protos lists five corporate shareholders, all based out of the same address in the British Virgin Islands. BIT Global has a TCSP license but lacks an HKMA Authorized Institution status and/or an SFC virtual asset trading license.
  • Regulatory Guidance: Digital assets custodianship may fall under HKMA or SFC regimes.
  • Key Sharing Scheme: The new system employs a 2-of-3 cold-storage multi-sig arrangement. Each of the three participating entities - BitGo Inc., BiT Global, and BitGo Singapore Ltd. - secures one key. The master keys are geographically distributed, with one each located in the United States, Hong Kong, and Singapore.
  • Expected timeline: Maker is likely to begin offboarding WBTC in phases, starting around October 3rd, 2024. WBTC custody transition will potentially take place by October 8th, 2024 (as per the original partnership announcement).

What we don’t know

  • Joint Venture Details: Specific rights, obligations, and full agreement details between BitGo and BIT Global.
  • BIT Global’s Status:
    • Extent of Justin Sun’s influence
    • Specific licensing for digital asset custody in Hong Kong
    • Internal regulatory compliance procedures
    • Legal opinion on compliance with applicable laws
  • Due Diligence: Scope and details of BitGo’s due diligence on BIT Global (financial, legal, compliance).
  • Market Impact: Potential effects on WBTC’s liquidity and peg resiliency during and after the transition.

Based on the considerations above, the following questions need to be addressed:

  • Has BIT Global obtained explicit permission or licenses to safeguard digital assets?
  • What specific guidelines, reporting requirements, audits, or other regulatory obligations is BIT Global required to adhere to?
  • What was the scope and extent of the counterparty due diligence that BitGo conducted before entering into the joint venture with BIT Global?

Specific documents should be provided:

  • Copies of all licenses and permits obtained by BIT Global related to digital asset custody and operations;
  • Details of internal policies and procedures that ensure adherence to regulatory guidelines;
  • A formal legal opinion prepared by qualified legal counsel affirming BIT Global’s compliance with applicable laws and regulations.
  • Details of the due diligence reports compiled by BitGo concerning BIT Global or risk assessments, including financial, legal, and compliance evaluations of BIT Global.

Joint Venture Agreement

We emphasized the need for a comprehensive understanding of the agreement between BitGo and BIT Global, particularly regarding the rights and obligations of each party involved. This is a critical aspect of assessing the viability and operational structure of the joint venture. We encouraged BitGo to provide a memorandum or similar documentation detailing each participant’s specific commitments and expectations in this venture.

In response, the CEO highlighted certain provisions of the agreement, including mutual consent to maintain the current technology framework for WBTC operations and custodianship.

However, despite the importance of these points, no further specifics were shared, nor were any supporting documents presented to substantiate the verbal outline. As a result, we remain unable to independently verify the details of the joint venture agreement or review any corresponding memorandum.

Ownership Structure

In light of growing interest surrounding Justin Sun’s potential influence, we sought clarification regarding the extent of his direct and indirect control over BIT Global. While it is assumed that Sun holds a minority stake in the company, we could not verify the ownership structure independently, as the Hong Kong corporate registry is not publicly accessible.

Furthermore, it is worth considering a potential scenario where, despite his minority shareholding and absence from the board or as a representative, Sun could exert influence over the company’s decisions through other shareholders, board members, or representatives. This hypothetical yet plausible dynamic raises questions about governance and the extent of his sway within the corporate hierarchy. This issue warrants attention, given the opacity of the current ownership disclosures.

Licensing Status

Although BitGo’s regulatory status remains unquestionable, our attention shifted to understanding the specific licensing requirements for custodians operating within Hong Kong. To this end, we consulted the Hong Kong Monetary Authority’s (HKMA) Guidance on Provision of Custodial Services for Digital Assets, which targets Authorized Institutions (AIs) engaged in providing custodial services for digital assets.

The guidance stipulates that, about virtual assets, an AI may delegate or outsource its custodial functions only to (i) another AI (or a subsidiary of a locally incorporated AI) or (ii) a virtual asset trading platform licensed by the Securities and Futures Commission (SFC).

Virtual asset trading platforms under the SFC purview are subject to extensive regulatory requirements. These encompass the secure custody of assets, stringent Know-Your-Client (KYC) procedures, rigorous anti-money laundering and counter-financing of terrorism (AML/CFT) measures, avoidance of conflicts of interest, prevention of market manipulation and abusive activities, adherence to high standards in accounting and auditing practices.

The operators are mandated to implement comprehensive risk management systems, with a significant emphasis on cybersecurity measures to protect the integrity of their operations. The SFC stipulates that 98% of client virtual assets must be stored in cold storage solutions.

Upon conducting an inquiry with the HKMA’s Registry of Authorized Institutions, we found no registration details for BIT Global, indicating that the company does not appear to operate as an AI in Hong Kong. We extended our inquiry to the SFC’s Register of Licensees to explore the possibility of BIT Global managing a virtual asset trading platform. However, no relevant records were found there either.


Source: HKMA, September 9th, 2024


Source: SFC Public Register of Licensed Persons and Registered Institutions, September 9th, 2024

The only publicly verifiable registration data relates to BIT Global’s Trust and Company Service Provider (TCSP) license. Thus, their legal standing and capability to provide custodial services in Hong Kong hinge upon a legal opinion addressing their compliance with relevant regulatory frameworks or a similar document affirming the entity’s licensing status. This gap in verifiable information requires careful consideration before conclusions about BIT Global’s custodial legitimacy can be drawn.

According to the elaboration provided by BitGo’s legal team, an extensive legal analysis was conducted in collaboration with a reputable Hong Kong-based law firm. This analysis led to the conclusion that custodians in Hong Kong may obtain a Trust or Company Service Provider (TCSP) license to provide virtual asset custody services. However, a copy of this analysis has not been furnished for our review; therefore, we rely solely on the written statements provided by BitGo’s General Counsel.

The necessity to obtain additional licenses or regulatory approvals is not entirely disregarded. Such requirements may be necessary for providing custody services to SFC-supervised virtual asset trading platforms or licensed firms registered with or authorized by the SFC or HKMA. However, the merchants who would participate in BIT Global’s WBTC program are not considered entities under the mandatory licensing regime. Consequently, additional licenses or regulatory approvals are not required for the WBTC program.

Nonetheless, the legal theory outlined above should be substantiated by evidence demonstrating the cited exemptions applicable to merchants participating in BIT Global’s program—either through a legal analysis based on existing laws and regulations or via an exemption letter from the competent authority. We have formally requested the provision of such documents from BitGo.

7 Likes

Recognizing you may be hampered by an NDA, could you help walk through the reasoning?

There seems to be a straight line drawn from “the custody arrangements are not what we are comfortable with” all the way to “let’s reduce exposure”. Given the size of Aave’s exposure (vs the more modest exposure at Maker), can you walk us through a worst case scenario? Say we wake up one morning to crypto twitter saying some of the WBTC backing is missing or that redemptions have been halted. What kind of depeg/price drop results in unacceptable losses for Aave?

Let’s also run this same question by a bunch of other asset-backed collateral on Aave: weETH, USDT, USDC, USDe, cbETH, etc. How does the custody arrangement of those collaterals compare to the custody arrangements you’re seeing in your due diligence? While I am not someone who has done diligence on WBTC’s new setup, I find it perplexing what could be unacceptable about the new setup while something like USDT (unclear creditor rights) or USDe (unclear creditor rights) or weETH (4/7 msig) or many other assets.

This isn’t a knock on your analysis, just a real question. What are you seeing in this asset that prompts you to off board while all these other assets over here have pretty poor trust assumptions, too?

Disclosure: I am not affiliated with Aave, BitGo, or any other asset named here, and have no holdings in any of them except a small amount of USDC.

6 Likes

This doesn’t really make sense, BitGo has already proposed the changes after community feedback:

Current model at BitGo: (single jurisdiction)
• Only BitGo USA entities
• 2 of 3 cold-storage multi-sig
• All 3 master keys in the United States

Previously proposed model: (3 jurisdictions, 2 institutions)
• Partnership between BitGo Inc. and BiT Global
• 2 of 3 cold-storage multi-sig
• BitGo Inc. secures 1 key
• BiT Global secures 2 keys
• Master keys located in the United States, Hong Kong, Singapore (1 per location)

New model: (3 jurisdictions, 3 institutions)
• Partnership between BitGo Inc., BiT Global, BitGo Singapore Ltd.
• 2 of 3 cold-storage multi-sig
• BitGo Inc. secures 1 key
• BiT Global secures 1 key
• BitGo Singapore Ltd. secures 1 key
• Master keys located in the United States, Hong Kong, Singapore (1 per location)

Which means that even if Justin Sun rugs BiT Global - it would not affect WBTC.

BitGo has veto rights to any/all future changes in the key management structure - not BitGlobal.

I’d like to see you guys do more scrutiny of cbBTC before aping into that:

No Proof of Reserve
No audits
Any U.S. government subpoena could seize all your BTC
Is completely centralised

There is no clarity on who the people actually are that can mint/burn cbBTC - the only insight Coinbase gave is “…protected by Coinbase’s key management systems and usage requires approval from a number of people in different functions, including security, engineering, and finance”

So basically “Trust me bro”.

2 Likes

Hello, We thanks @LlamaRisk for this analysis.

As said earlier, wBTC users are legitimate users of the aave protocol.

The @ACI will not support any scenario hurting them beyond absolute necessity. We are in favor of including diversity (if governance approves it, cbBTC and tBTC will join Aave on Monday) and, if needed, creating incentives to migrate positions by both push and pull factors.

The proposed plan is too harsh, and we will not vote for it.

We do echo the part about limiting wBTC growth with a supply cap cut.

2 Likes

Hi, I’m generally always in favour of protecting user and the protocol. I think for WBTC we need a solution somewhere in the middle. So I definitely support lowering supply and borrow caps but setting LTV to zero would again hurt user if the market is going down.
Does it make sense to set LTV simply lower to allow user still depositing but making it unattractive for the moment? And maybe after cbBTC and tbtc are added these user are switching to alternatives. Or in the end wbtc will still be fine and Aave will offer 3 different wrapped BTC assets thus more diversity.

1 Like

Summary

We want to thank the community for the feedback received so far. Our only objective is to keep Aave safe. As such, we believe action is required. We want to emphasize the following points:

  • This recommendation is not to offboard WBTC, nor to reduce current exposure.
  • This proposal seeks to prevent additional loan origination from WBTC during the transition period while minimizing the impact on existing users.
  • This is a temporary measure that may be relaxed or constrained as needed in light of the transition’s completion.
  • Setting LTV to 0 does not prevent existing WBTC-collateral borrowers from topping up their account to improve their health factor. We’ve validated this point with @bgdlabs and through this test.

Why we are cautious about WBTC

We believe caution is warranted due to the controversial nature of the upcoming partnership and unresolved questions about BIT Global’s status, joint venture details, and BitGo’s due diligence. While BitGo claims BIT Global cannot divert reserves, the original agreement involved transferring 2/3 of the keys without fully disclosing BIT Global’s licensing status. WBTC has been transparent with public reserves and BitGo’s fiduciary responsibility against rehypothecation. This is promised to continue, but we lack evidence of BIT Global’s custodial legitimacy.

Our previous assessments of Justin Sun-associated assets reaching, at times, multi-billion dollar market caps have revealed an alarming pattern of transparency lapses in major products. These include our risk assessments of TUSD, stUSDT, and USDD. While WBTC isn’t immediately at risk, we lack confidence in maintained standards under the new arrangement.

Implications of setting LTV to 0

Not everyone is expected to immediately grasp the implications of setting LTV to 0. Contributors have diverse priorities, and this is a highly technical detail. We acknowledge our failure to communicate its implications clearly. For clarity, please expand the section below for a worked example. You’re also welcome to join our discussion 2024-09-20T18:00:00Z on Leviathan News.

Example for setting Loan to Value (LTV) to 0

Imagine you are borrowing USDT against WBTC. Your health factor is at 1.2, so you’re not at risk of liquidation. Suddenly, the bitcoin price decreases, and your health score goes to 1.08, which is too low for your liking. You add more WBTC (or other) collateral without any issue. Your health score is now 1.2 again. You’re not at risk of liquidation.

The price of WBTC rises, so your health score is now 1.35. You decide to borrow more against your WBTC, so your health score is now back to 1.2

After some advanced warning, WBTC Loan To Value is set to 0. This only affects the amount of debt you can take against WBTC collateral.

The price of WBTC goes down. Your health score goes back to 1.08. You can add more WBTC collateral to make the health score 1.2 again. You could also add other collateral to improve your health score (and borrow against it as you wish; only WBTC is affected).

Then, again, the WBTC price rises, and your health score goes to 1.35. You cannot borrow more against your WBTC this time because LTV is set to 0. New users also cannot borrow debt against new WBTC deposits. More WBTC can be supplied to Aave but cannot be borrowed against.

This is the key change under LTV 0. You cannot create new debt. Existing positions can be further collateralized to the original (pre-LTV 0) health score with WBTC collateral.

Alternative options

We modeled options like reducing the liquidation threshold (LT) and supply caps. However, these had greater potential adverse effects on users. For example, lowering LT from 78% to 76% on mainnet would significantly increase liquidation risk, especially for small WBTC price drawdowns:

  • A 5% WBTC drawdown results in an additional $301,588 of positions eligible for liquidation.
  • The impact is proportionally more pronounced for smaller drawdowns.

Additionally, supply caps would prevent users from adding WBTC to “top up” their loan positions. We concluded that LTV 0 is the lightest touch solution that adequately addresses the risk.

image
Source: LlamaRisk, September 18th, 2024

Proposed way forward

We will continue to iterate on this recommendation and address the best way forward. To expedite the governance process, we initiated discussions with various service providers and submitted the ARFC before reaching a full consensus. We encourage community members to continue this discussion and welcome any feedback.

4 Likes

First of all, thanks to @LlamaRisk for the analysis, trying to communicate as well as possible quite technical organisational/legal information that can be quite complicated sometimes to take conclusions from.

Personally, I think the following:

  • High-level (in the whole DeFi), I feels the alarmism created against WBTC is too excessive. WBTC has been in the market since the very early days of DeFi, and for what I’m aware of, have not had any type of event strongly diminishing its credibility. Good testimony of it is the approximate $9.7b size of the asset.
    Definitely, and specially assets with important centralisation on the custody backing, deserve more detailed scrutiny from the side of Aave, as transparency and organisational resilience is a must for the protocol. But being realistic, it doesn’t really seem so rational for WBTC to turn into a completely wrong direction in terms of both substance and narrative.
  • Second, the WBTC asset has been an important listing on asset since the very beginning, with currently approximately $3b supplied across all the instances. Its criticality due to its size is very clear, with Aave being ~1/3 of the whole WBTC on-chain, but I would like to point out in a different direction.
    Apart from a DeFi protocol that obviously should care about security and seriousness first, it is very important in my opinion to tackle the situation trying to treat WBTC and Bitgo/Bitglobal in a friendly manner. Let’s not forget that assets listed on Aave are part of the Aave community, and if we want to really appear as such, community members should be treated with the highest respect and standards. For example, the way Bitgo/Bitglobal was treated on other communities by some actors was totally inappropriate, no matter the context. And to be clear, I don’t think it is the case of @LlamaRisk here at all, but I think important to highlight.
  • With the previous being said, there are certain points that as an AAVE voter I think Bitgo/Bitglobal needs to tackle immediately on this Aave forum:
    • I understand that signing NDAs regarding structuring is normal practise, but let’s be clear, Aave is a decentralised community, and no NDA would help in a governance proposal to start reducing LT on WBTC and start proper off-boarding. The previous is just a radical example, but my point is that leadership of WBTC/Bitgo/Bitglobal should take very very serious being transparent with the risk providers of Aave (in this case @LlamaRisk), because in this context they represent Aave.
    • As an Aave community member 1) I don’t want our risk provider being forced to try to find out by themselves consequences of re-structuring under the hood, I want Bitgo/Bitglobal to simply outline the risk of the structure (no matter if they will materialise or not) and especially how different are from before. 2) I would recommend Bitgo/Bitglobal itself sharing in “layman” terms here any type of potential consequence arising from the changes, complementary to the independent analysis of our provider.
  • Regarding suggested off-boarded strategy, I’m relatively skeptical, but it is quite dependant from my previous points. Let’s not forget that 1) WBTC has a pretty sizeable tradable secondary market and general liquidity 2) Aave prices WBTC based on that.
    If secondary market clearly indicates changes (doesn’t seem so), probably some risk updates are needed. But LTV0, even if being a relatively “soft” measure, is problematic for holders of WBTC as they will have certain limitations like being “forced” to withdraw WBTC before any other collateral (non LTV0).

*Probably needless to say, but I have no personal interest on WBTC apart from it being part of Aave, not even holdings of the asset.

5 Likes

Thank you @LlamaRisk for taking the lead on this initiative.

The credit worthiness of their collateral has changed, therefore the set of actions they should be able to do with that collateral should also change. This is the entire point of @LlamaRisk’s proposal

Let our risk providers do their jobs. They are incentivized to assess the ramifications of this restructuring. BitGo/BitGlobal have their own set of incentives.

It is worth considering how much you expect this to continue to be the case. Liquidity has declined materially since the original custody change announcement. Let’s also not forget that when there is $3bil worth of collateral being provided, that amount of liquidity cannot just be moved at any moment - actions need to be taken well before the secondary market liquidity conditions change against us. It is good that our risk provider @LlamaRisk understands that reality.

2 Likes

To be clear, @LlamaRisk did an outstanding work. What I think we additionally need is also Bitgo/Bitglobal transparently disclosing everything required from their side. Or simply giving as much access to LlamaRisk as they request, given they officially represent Aave.

It is possible I missed that data (liquidity declining), but I simply didn’t see it in this thread.

3 Likes

We thank @LlamaRisk for providing the analysis. We also thank the people who shared their opinions.

Saucy Block thinks that the best path forward is to increase the diversity of Tokenized BTC within the Aave Protocol while protecting WBTC users. Therefore, we recommend limiting the supply cap of the WBTC Pool on all markets and increasing the Reserve Factor of the WBTC Pool by 5-15% on markets where other Tokenized BTC options exist.

2 Likes

Summary

A proposal to adjust WBTC’s risk parameters.

Motivation

After discussions with the Llama Risk team, we have merged our previous post with this one and consolidated our proposal to present a unified specification for the Aave community’s consideration.

Supply and Borrow Caps

We propose decreasing supply and borrow caps for all WBTC markets to a level 15% higher than current utilization.

Liquidation Threshold

We propose decreasing the LT of all markets by 1 percentage point, finding a middle ground between increasing the buffer in case of liquidations and reducing the health of existing positions.

LTV

We propose reducing LTV to 70% for all markets where it is currently higher than this value.

Reserve Factor

We maintain our Reserve Factor recommendation included in the previous proposal.

Specification

Given these observations, we recommend making the following changes, with the new recommended value following the arrow:

Version Asset Chain Reserve Factor LT Potential Liqs. LTV Supply Cap Borrow Cap
V3 WBTC Arbitrum 20% → 40% 78.0% → 77.0% $1.40 73.0% → 70.0% 5,000 → 3,800 1,115 → 260
V3 WBTC Optimism 20% → 40% 78.0% → 77.0% $277 73.0% → 70.0% 1,200 → 650 250 → 48
V3 WBTC Polygon 20% → 40% 78.0% → 77.0% $55.40 73.0% → 70.0% 3,100 → 1,900 851 → 85
V3 WBTC Ethereum 20% → 40% 78.0% → 77.0% $1,700 73.0% → 70.0% 43,000 → 42,000 28,000 → 3,250
V3 WBTC.e Avalanche 20% → 40% 67.0% → 66.0% $50 0.0% 2000 → 175 1,100 → 7
V2 WBTC Ethereum 80% 82.0% → 81.0% $1,400 72.0% → 70.0% 0 0
V2 WBTC Polygon 99.99% 75.0% → 74.0% $1,100 70.0% 0 0
V2 WBTC.e Avalanche 75% 70.0% → 69.0% $0 0.0% 0 0
3 Likes

Thank you @ChaosLabs. We endorse the revised parameters proposed above.

While @LlamaRisk and @ChaosLabs initially differed on the specifics, we both agree that the current situation warrants parameters adjustment. The revised LT reduction is very moderate and limits potential adverse effects.

We encourage the DAO community to vote to enact these changes while we continue the dialogue with BitGo & BitGlobal.

3 Likes

Thanks for aligning @ChaosLabs and @LlamaRisk. Are you considering further LT reductions after this goes through? Or waiting until after this passes to reassess?

the proposed aligned plan seems a good consensus between not hurting our users beyond necessary and nudging them towards available alternative at their own pace.

we welcome this collaboration between our both Risks teams.

At the ACI, we want to support a smooth transition, we think a key aspect of this would be to maintain wBTC borrow caps as they are and increase the RF factor as high as possible.

3 Likes

As someone who had a position in SoBTC (Sollet BTC held by FTX) and got out just in time, I strongly caution you people to take a much more serious approach here.

These adjustments have made virtually no change. The time to take action is now, not after the rug is over.

The rug will not take place slowly over a period of time. It will take place in an instant.

If WBTC gets rugged (almost certain to happen IMO), there will not be a slight depeg to .90. It will be worth 0 immediately and Aave will be insolvent instantly and probably never recover. Again, this is almost guaranteed to happen IMO.

Reduce the borrowing power and supply cap of WBTC significantly and immediately before it’s too late.

1 Like

Alright, fine. I’ll switch to cbBTC - as an Aave user I think some work on the UX of unwinding or migrating wBTC positions should be done by a service provider or grant. It is a very large asset that has been a staple of Aave & defi on Ethereum for years now. I agree that if the DAO’s risk providers think users & the protocol will be “safer” by migrating into other forms of wrapped BTC, the parameters should be adjusted to begin that process. However, considering the popularity & size of wBTC backed loans on Aave I think the DAO should ensure users can easily migrate their positions without having to utilize a third party product like DeFiSaver/Instadapp (both are amazing products&teams, but charge service fees for migrations, geared towards power users, not easily accessible to “normies” + whales prefer to “just use Aave” & may feel uncomfortable using to manage sizable positions).

I understand that recent security issues with the “switch” contracts causes some issues here - but it shouldn’t be easier for me as a user to go to the Fluid “Refinance” or Morpho “Migrate” tabs on their UIs to adjust collateral rather than the standard Aave UI for a migration as significant as wBTC.