[ARFC] Pyth to support AAVE on Optimism as a secondary oracle

Governance
1

Title: [ARFC] PYTH TO SUPPORT AAVE ON OPTIMISM AS A SECONDARY ORACLE

Author: @KemarTiti - Contributor, Pyth Data Association

Date: 7/24/2023

Summary

This ARFC proposes Pyth to become AAVE’s secondary oracle on Optimism. Following a successful TEMP CHECK, this proposal allows Aave to have a fallback oracle on Optimism at no extra cost.

When / if approved by the Aave community, the Pyth Network oracle will be integrated in Aave as the secondary (or fallback) oracle and the Pyth Data Association will operate (for no less than three months) a price scheduler that will regularly update Pyth’s on-chain price on Optimism for all assets supported by Aave.

Motivation

Incorporating Pyth as a secondary oracle will yield clear and material benefit for AAVE, its participants, and the wider community. These benefits are rooted in three core principles: resilience, efficiency, and decentralization. For more details and thorough explanation of these benefits, you can refer to the successful TEMP CHECK here.

Specification

High-level Integration with Aave

Based on initial discussions with BDG labs, we have determined that a push-based integration is the most straightforward. The AAVE protocol already has a notion of a backup oracle provider that Pyth can fit into with minimal development work. In this integration, Pyth will adapt to the contracts’ interface of the AaveOracle smart contract — reading on-chain prices for any of the supported assets, in a similar way to any other integrated oracle.

In order to support this integration, the Pyth Data Association will commit to regularly update the Pyth on-chain price for all assets supported by Aave (DAI, USDC, USDT, AAVE, LINK, OP, BTC, ETH, stETH) on Optimism. This design allows Aave to natively read the Pyth prices on Optimism at no extra cost. The Pyth Data Association will update all the following assets prices on Optimism: DAI, USDC, USDT, AAVE, LINK, OP, BTC, ETH, stETH, at a frequency matching Chainlink Data Feeds (usually every 20 minutes or 0.2% price deviation ; whichever is faster).

The Pyth Data Association will update Pyth prices on Optimism for a trial period of no less than 3 months. At the end of this period, the Aave DAO can decide on the best path forward — to continue using Pyth push updates, or an alternative. Note that, since Pyth price updates are permissionless, Pyth can be useful as a backup oracle even if the Pyth Data Association is not pushing updates. If the primary oracle is down, any Aave user can update the Pyth backup to restore protocol functionality.

Simulating a push-based Pyth over April 2023 with updates every 1200s or during any 15bps deviation—Chainklink’s current parameters—Pyth performs well with strong price-robustness and accuracy.
Untitled (2) Untitled (1)

Technical Integration for Aave

The technical integration for Aave consists of three parts:

  1. The Pyth Data Association developed a contract that implements the getAssetPrice function in the IPriceOracleGetter.sol interface. This contract adapts the existing Pyth oracle contract to satisfy the Aave backup oracle interface. The contract will maintain a mapping from Aave assets to Pyth price feed ids. When queried for the price of an asset, the contract will relay that query to the Pyth contract, convert the resulting price into the format expected by Aave, and return it.
    For simplicity and security, this contract will be immutable. If Aave decides to add new assets, a new version of the contract can be deployed with the new asset to price feed mapping.
  2. The Pyth Data Association will operate a price scheduler for Optimism. This service monitors both the Pyth price and the on-chain price, then submits a price update transaction whenever certain time or price conditions are met.
  3. The Pyth Data Association will create a Aave governance proposal. This proposal will simply call AaveV3Optimism.ORACLE.setFallbackOracle() to set the optimism fallback oracle to the address of the deployed contract in (1).

Disclaimer

The authors of this proposal are members of the Pyth Data Association. The Pyth Data Association is a Swiss association founded by Pyth Network participants to advance the development of the network. This proposal was created and put forward without any compensation from any third party.

Next Steps

  1. If consensus is reached, submit the ARFC to a Snapshot vote for final approval.
  2. If consensus is reached, submit an Aave Improvement Proposal (AIP) to integrate Pyth as Aave’s secondary oracle on Optimism

Copyrights

Copyright and related rights waived via CC0.

5 Likes
2

As some will already know, TokenLogic voted NAY on the TEMP CHECK and the below explains why we will be voting NAY on the [ARFC] Snapshot.

Firstly, similar to BGD’s comments, we do not see much value in this proposal given the fallback oracle would only be called if a Chainlink feed returns a negative or zero value. However, with the minimum threshold for Chainlink feeds configured to ensure a positive value above zero is returned, we don’t see a situation where the fallback would ever be called.

While we believe oracle security is extremely important to Aave’s robustness, we don’t believe this proposal provides any additional meaningful improvement over how Aave currently operates today but in fact, introduces additional resources to be accounted for. For example, while the proposal offers a grant to cover the costs of publishing Pyth data on Optimism for three months, it’s unclear who’s expected to cover the costs after this period and if this responsibility will fall to the DAO. We don’t see the benefit in spending valuable time and resources to do the integration work only to pay later for something that won’t be used.

Secondly, we have some general concerns around Pyth’s incentive design as an oracle provider, specifically their close ties with historically predatory and opaque market makers, such as Alameda/FTX and Jump. These relationships pose a clear conflict of interest, where the entities reporting the market price of crypto assets are also actively involved with crypto market trading activity and therefore could be profit-motivated against the interests of Aave users.

2 Likes
3

Price feeds serve as the backbone of the Aave protocol, making their selection and integration a crucial decision for governance. While we remain open to diversifying our oracle providers, the absence of significant community support and a clear demonstration of added value for this proposal leads us to a decision. In alignment with other delegate platforms, the Aave-Chan Initiative will cast a ‘NAY’ vote on the Snapshot.

4

Echoing the sentiments previously expressed, we generally regard any technology that can enhance the resilience and augment the overall functionality of Aave favorably. Nevertheless, this proposal falls short of adequately delineating the potential impact areas for the Aave community.

Additional Resourcing and Costs

The OP states that adopting Pyth incurs no additional costs to the DAO.

We want to underscore that integrating additional pivotal infrastructure, such as an Oracle, is not devoid of additional costs. A substantial segment of our risk frameworks relies on Oracle Risk and Safety audits. Factors such as Oracle architecture, data integrity, historical performance, uptime, and methodology for published price consolidation are integral to our consideration frameworks when listing and maintaining markets.

Optimal Approach for a Multi-Tiered Oracle System

Finally, concerning the suggestion of a secondary Oracle serving as a fallback mechanism, we perceive this as a formidable challenge that is not as straightforward as implementing redundancy, similar to launching auxiliary microservices to aid systems in periods of heightened congestion or traffic peaks. Redundant services exhibit their potency when identical and can be interchanged seamlessly. However, since Pyth proposes a distinctive architecture and methodology for sourcing prices, it necessitates meticulous consideration. Should a Chainlink Oracle malfunction or experience augmented latency, impairing pricing precision and instigating a circuit-breaking signal that activates a fallback, do we possess assurances that the Pyth Oracle would not be similarly affected? Perhaps, in this case, a circuit breaker may be preferred. This is a nuanced topic, and we welcome the opportunity to delve deeper should the community define this as a priority and fully comprehend the optimal approach to a fallback. We are committed to ensuring that introducing new infrastructure contributes an added layer of protection and is a net positive.

2 Likes
5

Michigan has been supporting integrating Pyth as the secondary oracle for the following two reasons, and we would love to hear the community’s thoughts / critiques.

  1. The >=3-month trial has no financial cost to Aave, and is a chance to evaluate Pyth’s performance relative to the primary oracle. If, after the trial, the community considers engaging Pyth in a longer-term arrangement, that would be a completely different proposal with its own specifications that will be debated when the time comes.

  2. With regard to @TokenLogic concern about Pyth’s affiliation with Jump, we don’t think we should rule out a service provider just because of potential but unproven conflict of interest. Our understanding is that data providers send their prices onchain to Pyth Net, so the process is transparent. It seems any manipulation would be visible onchain?

Lastly, we agree with @ChaosLabs that a deeper study is needed to determine the optimal approached to a long-term fallback oracle. As more players join the oracle space, the DAO should have better understanding of the design and risks of the oracle providers, and perhaps have guidelines / metrics of evaluation. Michigan would be happy to contribute to a study if others are interested as well.

2 Likes
6

Thank you very much for all the replies — we much appreciate the feedback and questions.

Community Support

Working on this proposal has lead us to engage with many Aave stakeholders who have generally expressed an interest in having Pyth being tried out as a secondary oracle for Aave.

  • The initial forum post received 10+ positives replies, both from prominent Aave stakeholders (Flipside, LBS Blockchain, Index Coop, Wintermute, and Michigan Blockchain) and significant Optimism actors (Synthetix, OP Labs and Lido).
  • Which then translated in a positive snapshot vote with 66.9% For, 30.6% Abstain and 2.5% Against.

Cost and Benefits

We understand and value the work done by Chaos Labs for Aave on oracle risks and safety and would definitely dedicate time and resources to help them in their evaluation of the Pyth oracle. In regards to the general concerns around additional costs to be accounted for such integration, none of the financial costs will be bore by Aave. From the engineering work, to the amount of gas needed to make Pyth prices available on Optimism for Aave (for at least three months), all would be covered by the Pyth Data Association.

In addition to this cost free trial, one important aspect to have in mind is the, likely, long-term benefit (or cost saving) such solution will bring to Aave. In the Synthetix case, a switch from Chainlink to Pyth has resulted in $10mm+ returned to the community and treasury.

Towards the end of the three months, the Pyth Data Association will work to provide with:

  • A comparison of the Chainlink and Pyth prices made available on-chain
  • A cost aggregate to update the Pyth price feeds

Depending on those two factors, Aave DAO will then be able to make a final decision on whether or not it is worth continuing subsidizing the Pyth price feeds as a secondary oracle on Optimism. Note that these benchmarks collected for Aave on Optimism would be, in the case of the Pyth feeds, be easily applicable to any other Layer 2 (or any of the 24 other chains Pyth is deployed on).

Pyth Data Publishers

The Pyth Network was designed as a first-party publishers from day-1 in an attempt to solve some of the limitations third-party oracles face (not all data is public and accountability). First-party publishers (85+) own, and contribute their private data to the Pyth oracle — centralized exchanges publish prices based on their orderbook ; while market actors publish prices derived from their fills.

Pyth Data Publishers Market Coverage

Among the network of publishers you find various types of companies: US accredited exchanges: CBOE, IEX, MEMX, LMAX ; publicly listed companies like Virtu or DMM like GTS, or Wintermute, DRW and QCP for crypto. This varied cohort of publishers enable the Pyth Network to support price feeds for crypto assets as well more traditional assets too (Equities, ETFs, US Rates, FXs, Commodities) which may become of interest to the Aave protocol faster than expected.

Pyth Price Aggregation and Reliability

To reduce any potential attack (or involuntarily bug), the Pyth Network relies on a thorough reliability testing to spot correlated errors from publishers as well as a simple but robust price aggregation algorithm.

It does so by by giving each publisher three votes — one vote at their price and one vote at each of their price plus and minus their confidence interval — then taking the median of the votes as the Pyth aggregated price.
In other words, as long as the majority of Pyth publishers are accurate, the Pyth price feed will remain accurate. For a price feed like ETH/USD that has 30 publishers, it would mean that, at least, 16 publishers would need to be wrong (willingly or not) at the same time. Thus an individual or a small cohort of potential malicious publishers would not impact a Pyth aggregated price.

Indeed, the Pyth aggregation algorithm is designed to deliver three properties: robust to manipulation, appropriately weight data sources with different levels of accuracy and reflect the variation between publishers’ prices. While being robust to manipulation (voluntarily or not), the Pyth prices have shown to track the broader market prices with a great accuracy. You can also compare Pyth prices against major exchanges here.

Untitled (1)

Conclusion

We think that Aave to adopt the Pyth price feeds as a secondary oracle on Optimism will (in case of Aave DAO approval) open the door for:

  • An increased reliability of Aave infrastructure
  • A cost efficient oracle solution for Aave DAO
  • An efficient solution, especially when timely liquidations are needed (long term adoption of the pull model)
  • A faster expansion capability. Pyth price feeds are available on 25 chains, the latest being Mantle and Linea — and cover many RWA
7

We echo the opinion of @Michigan_Blockchain here. We don’t see any harm running a trial and but do think there is a need for a deeper study around oracles and the benefits/disadvantages of backups.

8

Seems like theres no real reason not to take this Trial offer.

9

Pyth is planning to serve as a secondary oracle solution on Aave v3 Optimism. While it’s understood that initiating a three-month free trial is low-risk, it’s also recognized that it might not provide any substantial value for Aave.

As discussed, BGD claims that the fallback oracle has never been utilized and is unlikely to be used in the future. For it to be activated, the primary price feed (Chainlink) would have to return 0 or a negative value, an event considered to be an extreme edge case. As such, implementing Pyth as a secondary oracle on Aave is seen as a low-risk, low-cost move but is unlikely to support Aave significantly, and could potentially remain unused.

Currently, the CSPA solution on Optimism includes:

According to the proposal, Pyth will set up wstETH/USD and rETH/USD oracles, but we will not be able to implement CSPA without wstETH/ETH or rETH/ETH oracles.

Furthermore, Pyth could be used as another lever for our LST E-Mode Killswitch methodology. Specifically, Pyth claims that their aggregation algorithm calculates the median of all the votes received from data publishers about the price of an asset. In this system, each publisher votes three times: once at their perceived price of the asset, and once at each end of their confidence interval. The median vote becomes the aggregate price.

If we are able to obtain the confidence interval from Pyth, then we could potentially check the Chainlink price against the Pyth confidence interval and trigger the “market price depeg” killswitch lever in the case that the CL price is not contained within the interval. This would additionally require constant access to the fallback oracle, even when no malicious updates occur on the primary Chainlink oracle. At the current moment in time, we do not recommend incorporating Pyth as a secondary oracle.

10

We have spoken with the Chainlink team and learned that the Chainlink oracle would never give a price of 0 (see code reference below). Therefore, our updated perspective is that onboarding a secondary oracle is not meaningful, not because Aave does not need a secondary oracle, but rather because, under current configuration, a secondary oracle would be used only when the Chainlink oracle returns 0, which is hardcoded to never happen.

We do not think returning 0 or below should be the only instance of needing a secondary oracle, and would appreciate an explanation of the current setup. For example, if true price is 5 but the primary oracle returns 1, input from a secondary oracle could be valuable in this case.

Overall, we reiterate our previous post that, given the importance of oracles, a comprehensive comparison of oracle providers and designs is needed.

Chainlink code :

return s_transmissions[s_hotVars.latestAggregatorRoundId].answer;

Also, each price feed also has a minAnswer, which is configured to be >0.

11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.