Post Vyper Exploit - CRV Market Update and Recommendations

Situation Overview

In light of the recent Vyper zero-day exploit, volatility within Curve markets has notably escalated. Our attention is particularly focused on a substantial position, comprised of a loan exceeding $60 million in USDT.

Moving Forward

We are diligently exploring potential resolutions and drafting a proposal for the community’s consideration. We’re focusing on proposals that can have material impact in resolving/mitigating the solution. Our efforts are amplified through cooperation with other Aave contributors, including @bgdlabs, @MarcZeller, @Gauntlet, @WintermuteGovernance, @AaveLabs, @lbsblockchain, amongst others. Further updates and a proposed plan of action will be shared shortly.

23 Likes

As discussed, we will await your analysis to ensure alignment with ours and then seek a broader community review and input.

10 Likes

Background

Due to the CRV position’s concentrated nature, it has proven challenging to draw statistically significant trends or data for a comprehensive analysis. As such, any recommendations we put forth are primarily informed by the recent on-chain behavior of the position holder, coupled with Aave’s optimal interests within the present circumstances.

Continued LT Reductions

We’ve previously outlined, and began executing a strategic plan entailing a series of LT reductions, specifically targeted at the gradual wind-down of the V2 CRV market. However, the execution of the most recent proposal in this series was aborted due to the unexpected Vyper Zero-Day exploit, which substantially altered the liquidity landscape and the anticipated impact of our proposed change. Despite this, we still believe that given the current circumstances and risk levers available on V2, this is the most effective course of action to mitigate Aave’s exposure to the CRV markets. We intend to proceed with the planned series of reductions.

Ethereum and Polygon V3 → Disable Borrowing

Turning our attention to V3, we recommend disabling CRV borrows on the Ethereum and Polygon V3 deployment (by setting the borrow caps to 0) to minimize the potential of shorting CRV or borrowing CRV to dump and further impact price.

LTV → 0

The LTV 0 proposal has surfaced by @Gauntlet We don’t categorically object to the idea; we question its efficacy, given that it can be circumvented in V2, as previously raised here.

CRV Market Freeze, Against

Similar to our analysis and approach here, we do not view a freeze of the CRV market as a productive measure given the current circumstances. In addition, given the debtor’s track record of loan repayments and maintaining a healthy position—most recently repaying a significant portion of the loan, freezing the market could lead to a premature liquidation of the position, given the user’s inability to top up utilizing CRV.

Disclaimer

Chaos Labs has not been compensated by any third party for publishing this ARFC.

Copyright

Copyright and related rights waived via CC0

14 Likes

Current risk conditions

  • Current CRV price is 0.598. The Aave v2 oracle for CRV is CRV / ETH | Chainlink - with a deviation of 2% and a heartbeat of 24 hours.
  • Effective liquidation price for 0x7a16ff8270133f063aab6c9977183d9e72835428 is 0.368
  • 267.4m CRV, 54.2m USDT borrowed for HF of 1.64
  • CEX liquidity levels continue to show $1m+ within -2% of depth
  • DEX liquidity levels show ~$70000 within -2% of depth
  • The account has repaid ~37m CRV, 9m USDT on Aave v2 since yesterday
  • The account has begun to reduce other CRV exposure outside Aave
  • These positions continue to add risk to Aave

Recommendations

  • We continue to recommend setting CRV LTV → 0 to impede further stablecoin borrowing
  • We recommend freezing CRV to prevent further buildup of CRV position.

Additional USDT borrow and continued buildup of CRV position adds increased risk, as we have analyzed here - Gauntlet recommendation to freeze CRV and set CRV LTV -> 0 on Aave v2 - #41 by Gauntlet

On lowering CRV LT on v2

  • We do not recommend lowering LT, as this would increase the effective liquidation price. Due to deteriorated liquidity conditions, the chance of cascading liquidations increases during high volatility.

On disabling CRV borrowing on v3 Ethereum and Polygon

  • We put out a post to lower borrow caps for v3 Ethereum here previously. We would suggest moving forward with a separate AIP for this recommendation.

Immediate Next Steps:

We welcome community discussion and feedback for the next couple of hours. Only if there is agreement will we propose a single recommendation AIP to set CRV LTV → 0 on v2 Ethereum.


Additional levers considered:

  • Reduce borrow cap on v3 to reduce short potential (we already proposed this in forums)
  • Stop stablecoin borrowing (extreme)
  • Raise stablecoin borrowing rates (too extreme and not necessarily useful)
  • Toggle liquidation bonus. The counterfactual situations are very murky to get an accurate reading on this
    • The tradeoff is position removal vs speed towards insolvency in the event of liquidations, depending on stabilized CRV price that will facilitate increased liquidation volume.
    • Upwards - intent is to incentivize more liquidations, but tradeoff is increasing downwards pressure on CRV price during CRV depreciation past liquidation point (more impact during low liquidity) + higher insolvency price point, which leads to faster realized insolvencies if CRV price stabilizes at too low of a point
    • Downwards - reverse of the above. Tradeoff is that liquidation volume may be lower, should price stabilize above effective insolvency point

Disclaimer

Gauntlet has not been compensated by any third party for publishing this ARFC.

Copyright

Copyright and related rights waived via CC0

8 Likes

Thanks @ChaosLabs and @Gauntlet for the quick response and analysis of the situation. We side with those worried about the potential of bad debt to the protocol caused by CRV-collateralized borrowing by the user in question. Note that this position has been detrimental to the TVL in Aave as stablecoin lenders have been withdrawing capital from the affected market. Therefore, we side with a measured approach to de-risking.

We are against drastically lowering the liquidation threshold (LT) at the current stage (although this should be done later, gradually) and against freezing the CRV market, to avoid a liquidation of the position in question. We support the proposal of setting CRV LTV to 0 to avoid further borrowing.

The main reasoning for our decision is that while the account in question reduced their position size, the key risk to the health of their position across protocols remains Fraxlend, where the interest rate grows exponentially at high utilization. We suspect that, similar to a set of transactions from the previous morning (view screenshot below), the account could shift the position over to Aave, increasing the risk to the protocol.

image

4 Likes

One interesting data point that supports this recommendation would be how much CRV is being vested daily (and potentially deposited as additional collateral):
image

7 Likes

The market should be freezed. Don’t understand the rationale on why ppl could be against this measure.

2 Likes

The recent days demonstrated the growing concern about the possibility of a potential increase in the exposure Aave has to CRV, and Gauntlet’s proposal is addressing this concern.

However, at the end of the day it is really up to the Aave community to determine on how concerning the situation is, as the last day also demonstrated the commitment of the borrower to repay his debt.

In retrospect, freezing CRV would mitigate some of the CT fud, and would not trigger a liquidation. But forward looking, this observation is not meaningful.

I think the community was provided with all the possible information, and at this point any mathematical model will have hard time to accurately predict the outcome of any of these decisions. It is now up to the community to take the hard decisions of:

  1. Are the advantages of freezing CRV market outweigh the disadvantages.
  2. Likewise for reducing LT for CRV.
5 Likes

Considering the current circumstances, we support reducing the LTV to 0 in order to ensure that there is no more stablecoin borrowing.

4 Likes

We appreciate the active surveillance of the CRV lending market situation by risk managers. We agree with setting $CRV LTV to 0. We’ve noted that the wallet in question is actively reducing its exposure to Fraxlend and Aave. In the past nine hours, this particular address has withdrawn 37.5M $CRV from Aave [1]. In the meantime, 20.25M $CRV has already been OTC swapped at a rate of $0.4 [2]. This $CRV is subject to a 6-month lock-up period, with a portion already staked in Convex [3].

Given this, we anticipate that this address may not have much motivation to continue supplying more $CRV on Aave. If all the OTC-traded $CRV ends up locked, there would be a limited spot supply in the secondary market. Meanwhile, it’s challenging to understand the motivations and accurately forecast the actions of on-chain entities. Setting the LTV to 0 would indeed assist Aave in preventing undesirable scenarios from unfolding.

Concurrently, we align ourselves with Penn’s perspective in opposing further reductions in the LT as it would likely evaporate liquidity and heighten market apprehension.

[1] https://etherscan.io/advanced-filter?tkn=0x8dae6cb04688c62d939ed9b68d32bc62e49970b1&txntype=2&fadd=0x7a16fF8270133F063aAb6C9977183D9e72835428

[2] https://etherscan.io/advanced-filter?tkn=0xD533a949740bb3306d119CC777fa900bA034cd52&txntype=2&fadd=0x7a16ff8270133f063aab6c9977183d9e72835428

[3] Ethereum Transaction Hash (Txhash) Details | Etherscan

4 Likes

Hello,

Morpho Labs is in favour of at least reducing the maximum LTV of CRV to 0.

Paul

5 Likes

We appreciate all the community feedback thus far. As an update, we have published an AIP to set LTV to zero - voting begins in 1 day. As always, we are available 24/7 to answer any questions.

4 Likes

We’re receiving various questions regarding the proposals within this thread. For clarity and transparency, we’ll post a summary here.

What Does LTV → 0 Accomplish?

Regrettably, setting LTV to 0 isn’t a silver bullet for preventing exposure. It can be bypassed in V2 through flash loans, as elaborated here.

LTV->0

A sophisticated user can still deposit an asset and increase borrows, meaning our ability to diminish increased CRV exposure is not absolute.

Again, we’re not against this adjustment; however, it is crucial to comprehend the level of protection it can and cannot provide.

LT Reductions

We’re leading an initiative to progressively lessen exposure to V2 assets, particularly those with risk profiles that have intensified significantly over the past year due to thinning liquidity and market cap. Our latest proposal to reduce CRV LTs received approval; however, we refrained from execution as the implications and risk of such a reduction expanded considerably. In the intervening period between the governance vote approval and the AIP execution, the Vyper Zero Day vulnerability was identified and exploited in various Curve pools. Given the current market volatility, we intend to await stability, re-evaluate the market circumstances, and subsequently propose additional reduction plans.

Disabling $CRV Borrowing on Ethereum and Polygon V3

We recommend disabling CRV borrows on the Ethereum and Polygon V3 deployment to minimize the potential of shorting CRV or borrowing CRV to dump and further impact price. It seems there is consensus to do this, and we are preparing a proposal.

Market Freeze

This constitutes the most significant aspect of our ongoing discussion. Hence, we propose moving forward with a vote involving two options:

  1. No Market Freeze
  2. Market Freeze

As always, we’re available on all channels. Don’t hesitate to reach out if you have any questions or need clarification.

10 Likes

The idea to progressively phase out the V2 CRV market has my full support. Even if the unanticipated Vyper Zero-Day exploit caused a snag, I still think that lowering Aave’s susceptibility to CRV was the appropriate choice. It makes sense to disable CRV borrows on Polygon V3 and Ethereum. Let’s reduce the likelihood of shorting CRV or borrowing to dump and maintain that price.

7 Likes

In times of crisis, it’s natural to feel a strong urge to react and “do something”.

As delegates and service providers, we often feel obligated to form an opinion and propose clear actions, regardless of what they might be. We face pressure from the community to do so and are subject to criticism no matter what course we take.

However, sometimes the best course of action is counter-intuitive and may even seem unacceptable to some: doing nothing.

Setting the LTV to 0 on V2 doesn’t prevent anything. It will affect the user interface experience, but the user in question is one of the most skilled developers on the planet. They have the full ability to figure out that they can deposit and withdraw, and this will absolutely not prevent more borrowing.

Using the LT as a lever in a violent manner is not a viable strategy, as it will create the harm & consequences we are all trying to avoid.

Disabling CRV borrows is not expected to have a significant effect. it’s already the case on V2 and has well-designed caps on V3. CRV is a strategic asset for the Aave treasury in the context of GHO, and eliminating CRV revenue does not seem like an optimal strategy.

A market freeze will prevent this user from adding collateral and reducing short-term liquidation risks. It will do more harm than good.

The ACI sticks to its vision for this particular position. We are firmly committed to the DeFi ethos and supports only a gradual reduction of the CRV LTV & LT on V2 while continuing off-chain coordination to reduce this debt to 0 on V2 over time by encouraging repayment & migration.

The ACI is considering casting a NAY vote on this proposal designed to have little to no added value.

13 Likes

This user is taking advantage of AAVE V2’s parameters and prioritizing his debts on FraxLend. If there are some ongoing off chain conversations to pay his debts; they should be communicated to the community ASAP. This type of uncertainty is not sustainable and is damaging AAVE (CT FUD, AAVE price, outflow of AAVE stakers, etc.)

4 Likes

Given the current circumstances, we believe that the LTV for CRV should be set to 0. If further updates are shared, other parameter changes or a complete freeze should be considered.

2 Likes

Thanks @Gauntlet and @ChaosLabs for the recommendations.

We are in favour of setting LTV → 0 and freezing CRV.

While there has been some repayment to Aave, Aave came last out of Fraxlend and Abra
most likely due to Aave offering more favourable conditions.

We also doubt that this will be the last time the large CRV position gets tested and the protocol is on the verge of adverse liquidations.

We are not privy to any of the off-chain communication and understand that the protocol was used as designed. But maybe the current position was an edge case that was rather hard to foresee (or at least estimated to be extremely unlikely) and everything was okay until it wasn’t.

On freezing CRV - this is particularly important and places an upper limit on the protocol’s exposure to CRV. It reduces Mich’s optionality and forces him to pay back his debt instead of adding to his collateral position and further increasing Aave’s exposure to CRV. It’s evident from the recent OTC sales that managing this CRV position is becoming increasingly difficult. We fully support the freezing of CRV.

Edit:

We are also in favour of reducing/ disabling the borrow caps of CRV on Ethereum and Polygon V3, reducing is more favourable given you can still earn yield on CRV.

5 Likes

We are in favour of setting LTV to 0 even though we think that this may not be the most effective lever given that it can be bypassed on v2.

We are in not in favour of freezing the market at the moment since it will not allow the user to top up his position with collateral in deteriorating liquidity conditions, the user has a good track record of loan repayments and maintaining a healthy position, and will get liquidated if there is a steep price drop which is very possible. However, we do take @WintermuteGovernance’s position into account, and think that over the longer term if LT/LTV reductions do not prove to be good enough incentives for the user to pay his position back, a freeze of the market may be necessary to make sure the position is paid back.

We think LT reductions should be paused for the moment until there is more stability and market conditions are reevaluated. We also agree with Chaos Labs in disabling CRV borrows on Ethereum and Polygon v3.

3 Likes

As others have stated, setting LTV to 0 does nothing and so should be avoided. There is no worse action in a time of perceived crisis than a meaningless gesture which adds confusion to the market about what can or can’t be done.

Its important market participants feel they can rely on AAVE to be a credibly neutral market. Making sudden large moves targeted against specific addresses is unbecoming of a protocol, and influences the decisions of future market participants against reliance on such a market. Any change should be done gradually

2 Likes