Executive Summary
Supply caps were introduced in Aave V3 to mitigate the exposure to any particular token. Leveraging Chaos Labs’ agent-based simulation environment, we introduce a new stress-testing framework for setting the supply cap for each token.
Stress testing is a technique used to evaluate the performance and resilience of a system under extreme or adverse conditions. Its objective is to identify potential weaknesses or vulnerabilities that may not be apparent under normal operating conditions. It is widely used by traditional financial institutions to stress test risk capital requirements: refer to pages 46 & 47 of the Basel III publication.
Aave’s supply cap determines how much a token can be supplied to the protocol and, therefore, how much of it can be used as collateral. As the amount of debt collateralized by this token increases, the liquidity risk associated with this token increases. That is, in the event of a severe token devaluation, liquidators must sell the collateral token in exchange for the debt token. If liquidations are not profitable - e.g., due to large slippage on DEXes - liquidators might be unwilling to liquidate the underlying position, and the protocol may accrue bad debt.
Our goal with stress testing is to leverage Chaos Labs’ agent-based simulation environment to measure the potential accrual of bad debt in these situations. As we increase the amount supplied as collateral in our simulations, the slippage incurred by liquidators increases monotonically. Accordingly, the protocol’s potential bad debt also increases monotonically:
We stress-test each token against appropriate stress scenarios based on historical data, which are described below. We binary search for optimal supply caps, limiting protocol losses to some target loss K. Initially, we propose capping potential protocol losses to 0.1% of the safety module’s funds, which currently equates to $400K U.S. dollars. In case this figure limits future supply cap increases, the community could decide on a different threshold.
We find that a comprehensive and transparent stress testing suite provides a valuable resource for the Aave protocol. We may continue to leverage these stress tests for other protocol risk parameters, using them in conjunction with our existing Value at Risk simulations.
As we continue to iterate on this stress testing framework by designing more comprehensive stress scenarios such as governance token auctions (i.e., MKR’s black Thursday) or short-seller attacks (i.e., CRV’s exploit in November of 2022), we will ensure Aave is more and more resilient to any hypothetical stress event.
Stress Scenarios
Our stress scenarios are motivated by the various severe devaluations observed in 2022. As discussed in our paper, we bias our stress scenarios in favor of more recent events, given that price and liquidity trajectories within Crypto evolve rapidly.
Similar to the Dodd-Frank Act Stress Testing framework, we define Moderate and Severe stress scenarios. We further distinguish between stablecoins and non-stablecoins, given their unique price and liquidity profiles. The price and liquidity trajectories used in our simulations are gleaned from Reference Events: historical examples of the stress scenario we are testing for. These are outlined below, with some example tokens. Notice that the example tokens in the Severe category below are just illustrative examples.
We first define the lookback window for the reference event - e.g., May 7th to May 15th for the LUNA crash. We gather liquidity trajectories by considering all major on-chain liquidity venues for the referenced token:
Given the price and liquidity trajectories of these referenced tokens, we then scale the current price and liquidity of the test token:
We simulate liquidations under these prices and liquidities given the current borrow and supply of the test token. We then set supply caps such that protocol losses are capped at K.
Sensitivity Analysis
We further perform some sensitivity analyses on the price and liquidity trajectories. Specifically, we subject each token to a stress test against a predefined reference price and liquidity trajectory. We then simulate protocol losses against scaled price and liquidity trajectories to examine the sensitivity of protocol losses to the speed of price and liquidity depreciation. This allows us to distinguish between riskier and safer assets and allows the community to express its risk appetite for different tokens.
Suppose governance considers FRAX and CRV to be riskier assets, whereas USDC and LINK are safer. That is, we are willing to take more liquidity risk on USDC and LINK, given their expected utility to the protocol. We may then simulate protocol losses using each token’s respective stress scenario and select the supply caps accordingly
Tokens with no Collateral
Tokens that are not used as collateral have negligible liquidity risk since they will not experience liquidations under duress. To ensure we still set sensible supply caps, we simulate protocol losses as if 25% of the token’s supply is used as collateral, although this is not strictly necessary. In fact, we floor the “collateral usage” of all tokens at 25%, to ensure that we do not set overly liberal supply caps for tokens that aren’t yet used as collateral - given that collateral usage may fluctuate significantly over time.
New Asset Listings
To set supply caps for new listings, we plan to use the supply and borrow distribution from a similar asset or set of assets as a starting point for our simulations. Given a similar supply and borrow distribution, we then use the target asset’s on-chain price and liquidity to run our stress tests.
Additional Considerations
LSDs
For LSDs, two primary scenarios are distinguished when running simulations for supply caps:
- For LSDs with calculated price feed (e.g., MaticX), only the positions of LSD collateral against non-underlying asset borrows are considered, as no risk exists in the LSD/underlying asset positions. In this case, it is still recommended to set an upper bound on the supply cap at 50% of the total circulating supply of the LSD to prevent extreme counter-party exposure, even when no explicit risk is identified.
- For LSDs bearing counter-party risk, for which oracles are calculated with market price, a depeg scenario including E-Mode positions is simulated (e.g., cbETH).
For more information, please refer to the Chaos Labs - LSD Methodology Update
Concentration Risk Mitigation
To prevent over-concentration of a token’s on-chain liquidity on Aave, we recommend capping the supply of each token at 50% of its total circulating supply on a given network.
Price Manipulation
For every asset, we measure the cost and feasibility of price manipulation attacks which are considered in our recommendations for setting supply and borrow caps.
For more information, please refer to the Chaos Asset Protection Tool post
Conclusion
Chaos Labs has developed a generalized stress testing framework for setting Aave’s supply cap, which may be extended to other stress scenarios (e.g. specific LSD de-pegs, short-seller attacks, etc.) and used for other risk parameters.
We will continue to update the community on new additions to the stress testing suite to ensure the community that the protocol is resilient to a variety of adverse conditions.