search

makerdao / spells-mainnet

Staging repo for MakerDAO weekly executive spells
GNU Affero General Public License v3.0
108 stars 45 forks source link

Assess adding LITE-PSM-USDC-A to `LINE_MOM` #421

Open amusingaxl opened 3 weeks ago

amusingaxl commented 3 weeks ago

While LITE-PSM-USDC-A is added to MCD_IAM_AUTOLINE: autoline-config it is not currently added to LINE_MOM: line-mom-config

Due to the fact that LitePSM holds pre-minted Dai, setting its line to zero is not enough to prevent users from calling sellGem until it runs out of Dai. After that, no more Dai can be pre-minted because fill() is restricted by line.

For that reason, we built and deployed LITE_PSM_MOM, which can completely halt swaps in any or both directions through an emergency spell.

We need to decide whether we add LITE-PSM-USDC-A to LINE_MOM.

Arguments in favor:

  1. Not adding it breaks the implicit assumption that "everything on AutoLine is configured on LineMom".
  2. An emergency spell that wipes all ilks on AutoLine will miss LITE-PSM-USDC-A. The spell crafter need to take special care of this ilk.

Arguments against:

  1. LineMom is not very effective for LitePSMs. It can only prevent further Dai from being pre-minted, but there is nothing it can do to prevent users from selling gems into it.
  2. It can be confusing for stakeholders to define which MOM they should use in case both are enabled, depending on the case.
SidestreamColdMelon commented 2 weeks ago

I think MOMs have two main reasons to be called: 1) dramatic market situation that needs immediate reaction 2) exploit / vulnerability found in the relevant MakerDAO module. Currently, LITE_PSM_MOM mainly protects from (1), as the risk of (2) is minimal. But, in the end, inclusion of LITE-PSM-USDC-A ilk to LINE_MOM is about weighing (2) against the downsides: complexity and confusion coming from having two different MOMs controlling one "module". Therefore, I think the decision should in the end be done together with BA labs, who would access the risks of both.

But, if we're to add LITE-PSM-USDC-A to LINE_MOM, I would also highly advice to amend the emergency spell to trigger both MOMs (LINE_MOM and LITE_PSM_MOM) to reduce complexity of the decision that needs to be taken, remove dependency on the technical knowledge that is otherwise required to make this decision and, more importantly, reduce possibility of making incorrect decision (calling LINE_MOM without calling LITE_PSM_MOM).