White-Whale-Defi-Platform / v1-contracts

MIT License
41 stars 12 forks source link

[System] Systemic dependence on Anchor may impede the ability to stabilize the UST peg via arbitrage during bank run cycle [2] #133

Closed kerber0x closed 2 years ago

kerber0x commented 2 years ago

The litepaper explains how bank run cycles can be a threat to the UST peg. If systemic risks materialize in the form of an event that has an impact on the whole Terra ecosystem, this will likely impact Anchor as well. In addition, a malfunction of Anchor or a bank run on Anchor might trigger substantial corrections in the Terra ecosystem. The fact that only a fixed amount of UST – i.e. the stable_cap – is meant to remain in the vault will decrease the ratio of UST/aUST in the vault with increasing liquidity in the vault. With a growing amount of liquidity in the vault, the ability to stabilize the UST peg via arbitrage will depend more and more on Anchor being seamlessly working, which is not guaranteed during a bank run cycle.

Moreover, there is no validation when setting the stable cap in contracts/stablecoin-vault/src/contract.rs:770 via set_stable_cap, meaning that the value could be set unrealistic values accidentally.

Recommendation

We recommend that the stable peg is the maximum of a minimal stable_cap and a percentage of the vault that is able to ensure arbitrage in favour of the UST peg. Alternatively, the team could diversify the funds across multiple asset classes that are not correlated with aUST. In addition, we would like to highlight that the stable_cap should be validated when set via set_stable_cap to be within an adequate range – i.e. the percentage of the vault should be in the interval of (0, 1).

CyberHoward commented 2 years ago

We can't diversify the UST vault holdings as this would change the underlying product.

The proposed solution to keep a % amount of assets liquid seem inefficient. We will change the amount based on the average arb size. In a worst-case scenario we can limit the arb-bot trade size to the stable_cap amount. This way arbs will still happen.