[ARFC] sUSDe and USDe Price Feed Update

Overview

This proposal suggests hardcoding the USDe price to match the USDT price in Aave’s pricing feeds. By linking USDe’s value directly to USDT, we align the sUSDe oracle with USDT pricing, ensuring seamless integration and avoiding disruptions caused by transient price fluctuations in USDe.

This proposal has been co-authored in collaboration with @LlamaRisk, and we thank them for their support and analysis.

Motivation

Aave’s current pricing oracle for sUSDe integrates Chainlink’s USDe/USD market price feed. This setup exposes the sUSDe-backed positions to USDe’s secondary market price deviations. While the setup adopted by Ethena for USDe makes this volatility unlikely, if it were to happen, it would present liquidation risks for Aave users and the protocol itself.

Modeling indicates that a USDe price deviation of 5% could render approximately $300M of USDe-backed positions eligible for liquidation. However, with market liquidity constrained to support liquidations of only $6M within a 4% price impact (equal to the liquidation bonus), the majority of these liquidations would likely not be executed as unprofitable for liquidators, potentially causing bad debt to Aave.

Historical data suggests that USD redemptions act as a stabilizing force during such depegs, quickly restoring USDe’s peg and reducing liquidatable positions. Despite this stabilizing mechanism, the reliance on USDe’s secondary market price feed introduces unnecessary risk to Aave’s users.

Mint and Redeem Functionality

The minting and redeeming of USDe are facilitated through EthenaMinting contracts, which ensure atomic transactions exclusively for whitelisted addresses. These users, businesses or individuals who have passed KYC, interact with Ethena’s API to request a price quote and signature, verifying the validity of each order. The atomic process ensures smooth execution but grants Ethena the ability to deny requests that could harm the asset’s backing or if significant price fluctuations occur before execution. The contracts support a limited selection of assets, including stETH, ETH, WETH, mETH, DAI, USDT, USDC, and wBETH, with USDT dominating minting activity, accounting for over 84% of transactions since July.

The process handles daily outflows of up to $100 million without issues. With its withdraw patterns aligning with downward deviations in USDe’s price. Ethena maintains a withdrawal buffer of $30M USDT in the Mint/Redeem contract, replenished promptly after significant outflows. Over the last 100 instances of the buffer dropping below $28M, the median replenishment time was 36 seconds or 3 blocks. In addition to the quick replenishment, there is currently a 2M$ per block redeem limit. The combination of the two parameters ensures that that the Ethena team has sufficent time to perform market operations and close the short hedges.

During a notable stress test on September 2, 2024, Abraxas Capital Management redeemed $100M USDe in 20 minutes through consecutive maximum-value transactions. This drained the reserves temporarily, but the buffer was restored to $30M within 25 minutes, demonstrating the system’s robustness.

Following the event, we have found Ethena to be proactive to funding rate changes by increasing the share of USDe backing held as USDT available for withdraws. In the following chart, its possible to see the increase in Cash at hand following the drop in funding rate on Binance for ETH and coinciding with an increase in USDe redeems

Fees for minting and redeeming average 0.1% for amounts exceeding $10,000, incentivizing arbitrage when USDe prices deviate below $0.999 or above $1.001.
For assets below a certain threshold, the fee seems to be fixed to a nominal amount, making small redeems inefficient and costly.

The outliers visible after the 100,000$ mark are derived by changes in quote prices rather than fees.

The redeemer whitelist includes 180 addresses, with over 50% of activity attributed to three addresses. Notably, the biggest address frequently conducts arbitrage operations, executing multiple transactions per minute with an average size of $500K USDT. Recently, another address emerged as a key player, averaging $109,640 USDT per redemption via CowSwap whenever USDe dips below $0.999, aligning precisely with arbitrage expectations given fee structures.

Funding Rate Dynamics

Historically, ETH and BTC’s funding rates have displayed a strong positive bias, with only 10.34% of days yielding negative funding when incorporating stETH yields.

Ethena’s Insurance Fund further enhances the safety of this system, stepping in to cover instances of negative funding. While the Insurance Fund does not currently grow from a share of the accrued yield as described in the docs, the current size of $60M is sufficent to witstand over 70 days of the bottom 10 percentile funding rate with the current TVL.

While the negative funding rate poses a risk to USDe backing, it also acts as an incentive for the protocol to remain healthy and automatically adjust its size following the market’s demand for leverage. This is because in scenarios of negative funding, USDe redemptions are triggered, causing a contraction of short positions that pushes funding rates back up. This feedback loop minimizes prolonged negative funding periods and protects the protocol’s reserves.

Solution

To mitigate these risks, Chaos Labs and Llamarisk propose an improved pricing mechanism. The new mechanism would replace the USDe/USD secondary market price feed with a USDT/USD feed. By decoupling sUSDe pricing from USDe’s short-term market fluctuations, this proposal aims to reduce liquidation risks for all sUSDe-backed positions significantly.

To mitigate the risk associated with a USDe depeg event of unnecessary liquidations, we propose hardcoding USDe’s price to USDT. While utilizing a Proof of Reserve oracle would have been preferable to hardcoding, this solution still presents significant advantages without increasing the protocol’s risk.

Thanks to the presence of Ethena’s $60M insurance fund and the need for a prolonged negative funding event to affect USDe backing, Aave is presented with a significant time buffer to mitigate risk following a negative funding event properly.

In the case of persistent negative funding, Aave retains the option to adjust risk parameters, such as reducing LT. This proactive measure will force liquidations, which in turn will weaken the sUSDe peg, which is likely to cause redemptions. As previously explained, significant USDe redemptions increase funding rates and hence stabilize the USDe peg and demand without compromising the protocol’s safety.

The following chart demonstrates the correlation between the sUSDe in the unstaking queue and the sUSDe price deviation. The unstaking process length is 7 days, during which the asset does not earn any yield.

Specification

USDe

To implement this change, the USDe pricing feed should be replaced with USDT’s price feed. The sUSDe oracle should similarly implement it in place of its BASE_TO_USD feed, ensuring consistent pricing across the protocol.

sUSDe

To implement the proposed changes, it is required to modify the sUSDe oracle to incorporate the new pricing logic.

The sUSDe price will be determined using the following components:

  • sUSDe/USDe exchange rate, as currently and enhanced by the CAPO adapter.
  • Chainlink’s USDT/USD price feed to determine the final USD value of sUSDe.

Disclaimer

Chaos Labs has not been compensated by any third party for publishing this ARFC.

Copyright

Copyright and related rights waived via CC0

2 Likes

This disclaimer should include that Chaos Labs was hired to help Ethena design its risk frameworks prior to launch, and that LlamaRisk is on Ethena’s Risk Committee, which is compensated.

9 Likes

Hardcoding the USDe price to USDT price sounds a bit risky given USDe isn’t really intended to be a stablecoin.

What’re the edge case risks involved?
What’s the worst case scenario?
Are there previous examples of hardcoding prices to other assets that have presented issues previously?

9 Likes

This is a disappointingly low quality ARFC from two service providers without digging into any potential conflicts.

Frankly, this can be said of every non-hard coded asset listed on the Aave protocol. And here we are explicitly recommending that sUSDe backed positions are exposed to USDT secondary market price deviations. Why not just code USDe to $1.00? This would not expose the asset to any secondary price deviations. It seems silly to stop there, why not do the same for USDC, USDT, DAI, USDS, PYUSD? If anything, a goal of these other stablecoins is to remain at $1.00 while, as @Hazbobo points out, is explicitly not a goal of USDe, with the Ethena team stating that USDe is not a stablecoin.

This sounds like a reasonable case could be made to both increase the liquidation bonus and/or decrease the TLV of sUSDe. Has this been considered? Likewise, if there are questions about the ability of sUSDe to handle a modest amount of sell pressure without causing $300M of liquidations and bad debt maybe a more in depth analysis should be provided to the community and DAO?

In summary, this reads as an aggressive growth proposal aimed to onboard more e-mode (sUSDe) borrowing, disguised as a risk suggestion. If that’s what the AAVE delegates want, that’s fine, but depositors should be aware. Longtime (pre-chaos / llama risk) readers of this forum will remember the many discussions regarding tradeoffs between primary and secondary price oracles for collateral assets which are worth revisiting. Unfortunately, this ARFC invokes none of those insights.

8 Likes

Some thoughts on the proposal (Disclaimer: I have discussed the topic with Chaos Labs and LlamaRisk due to my involvement in Aave via @bgdlabs. Aside from the context of being an asset listed on Aave, I have no other direct/indirect relation with Ethena):

  • Before entering into the topic, I would like to highlight that I have no doubt about both Chaos Labs and LlamaRisk making the recommendation based on what they believe is worth it to at least discuss on Aave, without any type of conflict of interest. For example, LlamaRisk precisely proposed a sUSDe derisking proposal in December, very clearly for the interest of Aave HERE. And it really makes no sense that same doesn’t apply to Chaos.

  • In regards to pricing itself, I’d say there are 2 important routes of analysis:

    • Oracle vs redeemability. In DeFi lately, we tend to simplify the pricing strategies in assets with redeemability/primary market as “hardcode” the price vs secondary market oracle. The core issue (definitely the main one here) is edge cases decoupling the secondary market versus the real underlying demand for buying the asset at a discount, and boils down to just one question: is there strong economic dynamics on the asset for any price deviation from a reference (e.g. $1) to be purely temporarily? If the answer is yes, “hardcoding” the price to the reference is a safer approach for all depositors of Aave (of the tokens borrowed against sUSDe). If the answer is no, the only option is secondary market pricing, as it is, and iterating with additional protective measures around, like what follows.
      To be clear, no matter that Aave uses secondary market pricing, it is already trusting the security of USDe, assuming no permanent loss of ~8-15% happens (with the 92% LT and assuming some positions not going full leverage)

    • Being stricter on liquidation situations. The Aave protocol has some high-level principles to risk that should always be respected:

      • When borrowing assets, protecting/guiding the borrower to not put his position at risk, with measures like keeping a spread between LTV and LT, or even others like capping oracles on the upper side, to avoid price squeezes.
      • When liquidations happen, the full priority protecting the suppliers, and with them everybody in the protocol. This means that if you are a borrower who assumed enough risk in your position, and a liquidation situation arises, the priority of the system will not be anymore not hurting your position, but protecting everybody.

      In terms of configurations, this could be reflected in a risk configuration like:

      • Slightly lower LTV and LTV, to open the spread of overcollateralisation (currently between 92% and 100%).
      • Increasing the LB. Exact parameters are more suitable for the risk providers to recommend, but definitely, the 4% sounds very conservative, potentially even 5 or 6.

      Still, these configurations will matter mainly on very edge scenarios of depeg of USDe from $1, and the question is actually how effective they will be then: meaning no LB will help if the asset depegs 10% for a long period, only users deleveraging and strong redeemability. (And we are back in ground zero, concluded $1 recommendation).

  • I agree with previous comments that using USDT as a reference is slightly unnatural, simply because even if not substantial at all, it adds risk from USDT. I assume it is due to what is explained in the post of the minting/redeeming activity being USDT-dominated, but generally on Aave we don’t really consider so granularly pairing of liquidity, only size and assets paired being or/and 1) liquid enough 2) correlated with the “origin” token.

  • A substantial consequence of hardcoding to $1 is that different to currently, there will be no protection against borrowing whenever a depeg happens on the secondary market (e.g. secondary market reporting 0.97, while Aave 1.00 and people borrowing).
    This strategy doesn’t seem economically sound until a low enough threshold is reached, but still, given that currently we have Risk Stewards in place, I would definitely say that a simplified version of a killswitch just setting the LTV of the asset to 0 whenever a let’s say 2-3% is detected on secondary market is appropriate.

  • In my opinion, for an asset like sUSDe, the Chainlink oracle should consider more granularly the redeeming dynamics and consequent pricing. Hardocoding to $1 is basically a proxy strategy to consider redeeming liquidity as the sole source, without considering at all gap risk.

4 Likes

Would be good to use “pegging” instead as a terminology here, as hard coding can lead to different interpretations. The way I see is that the risk providers are proposing to peg the price of sUSDe and USDe into USDT price feed from ChainLink.

I would also mention that given the contract upgradability this would mean that any strategy can be updated later to other solutions or rolled back (when there is close correlation, and limited affect on liquidations on existing positions), so there is some flexibility. This is something I’ve seen in other protocols, where sUSDe is fixed to 1 USD, meaning that the protocol takes full credit risk upon a depeg.

Overall the question here is who should bear the risk based on enhancement of the user experience on liquidations. Secondary market price puts the risk on borrowers (some extend to the protocol if the risk parameters are not carefully configured to withstand the liquidity risk), pegging to USDT price feed moves the credit risk to the protocol.

As mentioned above in terms of risk management, only adjusting LTV/LT or LB is something that can mitigate risks of these choices, and from/risk reward perspective (if more of the risk is borne by the protocol due to this decision) the expectation is that the DAO should earn from this particular trade via borrows. Currently there is no way to monetize directly on the collateral users are supplying into Aave, hence that limits the risk tooling for this particular asset strategy (Aave V4 will introduce Risk Premiums that woll allow directly to capture premium the trade based on user’s risk composition, thus collateral).

While I do think that the borrower experience could be improved by avoiding temporary unnecessary liquidations by improving the oracle price feed, hardcoding to 1 USD similar to other protocols is not the right way, neither I am yet satisfied with the pegging to USDT approach here, even if the strategy can be changed depending how sUSDe settles in the future (i.e. having more USDC buffer than USDT etc.).

There must be more tailored approach towards this particular asset, until Aave V4 and hoping that this proposal could evolve a bit more to explore more tailored approach.

4 Likes

Following extensive discussions with @ChaosLabs and our independent review, we support the proposed sUSDe price feed change to use USDT as reference. This recommendation stems from USDe’s strong operational ties to USDT through Ethena’s perpetual positions and redemptions.

Each pricing method presents distinct advantages and tradeoffs, detailed below. The guardian and steward roles retain protective powers to safeguard users when necessary. In our view, this proposal represents the optimal solution currently available for the DAO and its users.

Motivation

Aave sUSDe’s price oracle combines the internal sUSDe/USDe exchange rate, a CAPO adapter, and Chainlink’s USDe/USD secondary market price feed. Therefore, the LTV of sUSDe-backed positions (~1B sUSDe) is mainly exposed to short-term USDe secondary market price fluctuations. We have recently noted that around 1/4 of all sUSDe collateral on Aave would be liquidated if USDe price deviated by 2.5%, presenting an elevated risk of unexpected liquidations to borrowers. In the last two weeks, the situation did not improve, especially since USDe has started to trade slightly (~20 bps) below the peg.


Source: LlamaRisk, January 1st, 2025

This risk of liquidations is substantiated by low secondary market USDe sell-side liquidity, which in times of high USDe redemptions may fail to sustain secondary market sell-offs, causing temporary USDe price discounts until whitelisted minters absorb the overflow and redeem USDe for underlying collateral. Full USDe collateralization (currently at 101.2%) means that these temporary fluctuations are purely due to stablecoin utility changes, not attributed to changes in the risk profile of the stablecoin.

In addition to the risk of unexpected liquidations, low sUSDe liquidity may pose a risk of bad debt. Our research has found that a USDe de-peg could trigger a prolonged sUSDe de-peg in high redemption scenarios. While Ethena’s reserve fund could help restore USDe’s peg, sUSDe’s recovery would be slower due to high stake ratios and cooldown periods. This creates a risk window where sUSDe-backed loans could become liquidatable, but liquidations might be unprofitable if sUSDe’s market discount exceeds the liquidation penalty, potentially resulting in bad debt. This behavior was recently observed when the weekly yield of sUSDe decreased, lowering sUSDe’s utility and triggering sUSDe unstaking and larger USDe redemptions.


Source: Chainlink, 1st of January, 2025

The downturns of USDe were reflected and amplified for sUSDe, where the price discount reached up to 1.5%, compared to a discount of 0.2% for USDe. These larger downturns can also be observed in the volatility of daily returns.


Source: Chainlink, 1st of January, 2025

To offer more flexibility to Aave’s users and safeguard them from unexpected liquidations, we propose an improved pricing mechanism to replace the USDe secondary market price feed with a USDT secondary market price feed. This would result in sUSDe being priced via sUSDe/USDe exchange rate (+CAPO price adapter), fixed 1:1 rate for USDe/USDT, and USDT/USD secondary market price feed provided by Chainlink. Such changes would have implications for both Aave’s DAO and users and, therefore, need to be covered in detail.

Pricing Tradeoffs

Switching from the current USDe/USD secondary market rate to alternative pricing that eliminates exposure to USDe means that borrowers would no longer bear the implications of Ethena’s solvency as this risk would be shifted to Aave’s protocol. This requires an assumption of full USDe collateralization. Nonetheless, fixing the USDe price to a constant 1:1 ratio is undesirable as it neglects broader market systematic risks.

To mitigate this, USDT market price feed could be used. While not evident, USDe has a dependency on this stablecoin via Ethena’s exposure to USDT-denominated linear perpetual. These positions are expected to be the majority of Ethena’s perpetual positions as the Open Interest of inverse perpetuals is smaller. Moreover, part of USDe collateral is held in stablecoins, and USDe redemptions are serviced in USDT. While failures in Ethena’s protocol may arise due to multiple factors, a systematic failure leading to USDT’s depeg would reflect on USDe’s solvency. This leads to USDe being systematically correlated to USDT and allows to relate the pricing of USDe to a 1:1 ratio with USDT.

The risk-related tradeoffs between each pricing mechanism option are summarized in the following table:

Price Feed Liquidations Risk Bad Debt Risk USDe Solvency Risk
USDe/USD market price (current) Possible unexpected liquidations due to temporary USDe secondary market price deviations Bad debt risk if sUSDe’s market discount exceeds the liquidation penalty Users bear all USDe solvency risks via USDe market rate
1:1 USDe/USD rate No liquidations due to USDe market price fluctuations Bad debt if USDe under-collateralization results in an (effective) LTV>1 USDe solvency risk is fully assumed by Aave’s protocol
1:1 USDe/USDT rate + USDT/USD market price Independent of USDe but relying on USDT secondary market peg Bad debt if USDe under-collateralization results in an (effective) LTV>1 but USDT peg is stable USDe solvency risk is mainly assumed by Aave’s protocol, only partially by the users (with USDe’s implicit dependence on USDT)

In addition, switching to pricing USDe at 1:1 with USDT would make the USDT borrow positions using sUSDe as collateral even less susceptible to liquidations as the exposure to USDT price deviations would be removed. In that case, the LTV of such borrows would only depend on sUSDe/USDe exchange rate. Currently, 42.8% of all borrows using sUSDe as collateral are made in USDT, and this change is expected to increase this ratio further.


Source: Chaos Labs Risk Dashboard, 1st of January, 2025

Chainlink’s market price feeds indicate that USDe and USDT price movements have been closely related, with the largest negative price spread for USDe reaching up to 20 bps. We can also observe the recent USDe secondary market sell-off triggered by lower sUSDe yields, which led to a sharp increase in redemption volumes (80M USDe redeemed on December 19th, 2024).


Source: Chainlink, 1st of January, 2025

Safety Mechanisms

Notably, Ethena employs safety mechanisms that help to ensure the stability and full solvency of USDe collateral:

  1. The main safeguard is the protocol’s reserve fund, which comprises highly liquid (yield-bearing) stablecoins and RWA tokens that could be employed to cover unexpected USDe collateral losses. This way, the over-collateralization of USDe is maintained at 101.2%. The capitalization of the reserve fund constantly increases as recommended by a specific reserve fund methodology.
  2. A stablecoin buffer is kept. It changes according to funding rate fluctuations, safeguarding from negative funding rate yields and enabling the swift service of USDe collateral redemptions. This buffer was as low as $200M during recent high funding rate yield conditions. In the face of high redemption rates and lower funding rates, it is now back to the $600M-$700M level.


Source: LlamaRisk Ethena’s Risk Dashboard, 1st of January, 2025

These mechanisms are continuously monitored for and adjusted according to market fluctuations. Due to that and the exposure to the USDT market price, the risk of bad debt is partially mitigated. A sufficient LT buffer (8%) also means that Aave’s DAO would have time to step in and employ harsher measures (e.g., freezing a market) to protect Aave’s protocol from bad debt. Even with the price feed change, sUSDe’s price would still depend on the sUSDe/USDe exchange rate, which would be updated to reflect the under-collateralization of USDe.

Recommended Parameters

The sUSDe price feed change does not require immediate changes in sUSDe collateral parameters. sUSDe liquidation bonus is bound to increase from 3% to 4% as agreed via a previous proposal. The changes in borrower behavior, as well as sUSDe, USDe, and USDT price movements, will be further monitored.

Disclaimer

This review was independently prepared by LlamaRisk, a community-led non-profit decentralized organization funded in part by the Aave DAO. LlamaRisk serves as a member of Ethena’s risk committee. LlamaRisk did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.

2 Likes

Is the gist of the proposal that…

  1. USDe is a kinda risky product to be on Aave and treated like a stablecoin.
  2. The solution isn’t to limit it’s usage and update the risk profile.
  3. The solution is to simply pretend that the price “must” be pegged to USDT and to hardcode that into the protocol.

The core take away being something along the lines of if we pretend it’s as stable as USDT, that means it IS as stable as USDT and we should alter the code of the protocol to reflect this.

2 Likes

Is it possible to get some rough numbers for each scenario outlined @LlamaRisk @ChaosLabs ?
Like what would happen if…

The different tradeoffs are pretty clear and each is “bad” in its own way. We have to decide which way is the best to go for the next weeks or months.
Basically the main question is, in which scenario would the protocol accrue the most bad debt. Because that would be the amount the treasury and the safety module/Umbrella would have to cover.

5 Likes

Instead of hardcoding the USDe/USDT ratio at 1:1, would it be feasible to introduce an USDe/USDT price feed ?
This approach would allow sUSDe borrowers of USDT to avoid exposure to the USDe/USD rate. Instead, they would be exposed to the USDe/USDT price ratio, where the USDT/USD components of collateral and borrow position would effectively cancel each other out

If not, I join @EzR3aL on a need of rough number to consider the different scenarios

4 Likes

“While not evident, USDe has a dependency on this stablecoin via Ethena’s exposure to USDT-denominated linear perpetual. These positions are expected to be the majority of Ethena’s perpetual positions as the Open Interest of inverse perpetuals is smaller.”

I am surprised by LlamaRisk. I referred often to their EURS/Stasis report Asset Risk Assessment: Stasis - LlamaRisk . I personally think USDT is often treated like a DeFi MAD risk - mutual assured destruction leading to crypto nuclear winter. If Tether goes down, nice knowing y’all.

Now, some may think the solution is double down, let’s increase our nukes on both sides. More USDT everywhere. I think it would be far better to de-escalate. Tether–personal opinion–is a rot at the center of DeFi and the last thing we should do is build more infrastructure on that rot. (More than happy to elaborate if needed.)

Someone is not being forthright on what’s going on here. This comment by LlamaRisk suggests USDT is heavily connected to USDe. Ethena’s docs /suggest/ equal exposure to both USDT and USDC in the ecosystem docs.ethena.fi . A search for USDT in that documentation either only uses it as an example of what a stablecoin is, e.g. “like USDT or USDC”, or in one place that it can be used to mint or redeem, seemingly equally to USDC (Overview | Ethena Labs). I see nothing about leveraged perpetual positions in the documentation. Are all the non-inverse perpetuals in USDT? If not what are the ratios? Presumably the inverse ratios have neither USDT nor USDC, correct? I think I want to know more about how much USDT is involved vs USDC.

Were it up to me, I’d say DeFi is general also needs to stop treating USDT’s risk as a “whelp if it goes, we all go” because that’s the impression I generally get.

3 Likes