[BIP-364] Enable TruMATIC / bb-a-wMATIC Gauge [Polygon]

BAL Gauges
1

PR with Payload:

Summary:

This proposal is to create a gauge for truMATIC/bb-a-wMATIC on Polygon.

The pool shall use the ComposableStablePoolFactory-v4 which addresses the reentrancy vulnerability disclosed during February 2023.

This gauge is uncapped, and would enter as a “core pool” under BIP-19. This means 65% of 50% of yield generated by this pool is to be used for bribing for votes on it via Hidden Hand. The remaining 35% goes to Balancer DAO as revenue.

References/Useful links:

Protocol Description:

TruFin builds institutional-grade DeFi primitives, that can be used as the foundational building blocks for complex digital asset strategies to reduce risk, generate rewards, securely on-chain. TruStake is a MATIC staking vault which provides access to MATIC staking on the Ethereum network.

TruMATIC is the liquid staking token users receive when they deposit MATIC into the TruStake vault. It is an ERC-20 token like MATIC and has all the same basic functionality. As soon as you deposit MATIC on the TruStake smart contract, you receive newly minted TruMATIC, based on the exchange rate at the time of staking. As MATIC staking rewards accrue, the value of TruMATIC increases (with reference to MATIC).

Motivation:

This proposal aims to add a veBAL gauge for truMATIC/bb-a-wMATIC on Polygon.

One of Balancer’s strategic objectives is to attract more yield bearing liquidity. Incentivizing the yield bearing token TruMATIC through a gauge proposal presents an opportunity to deepen Balancer liquidity. Balance is to become the main liquidity destination for TruMATIC. Launching a bb-a-wMATIC pool will provide additional yield for Liquidity Providers (LPs) after fees and bribes, relative to other pool types. This is due to the Aave v3 wMATIC reserve generation 218 bps of deposit yield.

Specifications:

  1. Governance:

See white paper here.

  1. Oracles:
  1. Audits:
  1. Centralization vectors:
  • TruFin Governance, see here
  1. Market History:
  • truMATIC is new and not yet integrated into Coingecko.
  • bb-a-wMATIC has a long successful history within Balancers protocol.
  1. Value:
  • This pool is a Core Pool and therefore will generate revenue for the DAO via truMATIC and bb-a-wMATIC derived yield plus swap fees.

Pool Details

Link to Pool: 0xb266ac3b7c98d7bcb28731dac0ef42dba1b276be
Link to Gauges: 0x6f06b425e1bc11FC486C308c22e503d188525F06

The Balancer Maxi LM Multisig eth:0xc38c5f97B34E175FFd35407fc91a937300E33860 will interact with the GaugeAdderv4 at 0x5DbAd78818D4c8958EfF2d5b95b28385A22113Cd and call the addGauge function with the following arguments:

gauge(address): 0x6f06b425e1bc11FC486C308c22e503d188525F06
gaugeType(string): Polygon

Disclosure:

This proposal is the work of @Llama contributor, @Matthew_Graham, via the legal entity TokenLogic and @MattTF of Trufin.

2

As the composableStable pool is still under investigation for the protocol fee collection issue, it might make more sense to consider the gauge request after the investigation is settled.

3 Likes
3

Agree with the above, no need to activate this gauge until we know if a new pool factory will be required anyway. If no new factory, can move forward as is, but best for us to wait for an update on the ongoing issue.

1 Like
4

That’s no problem from our side. We’re happy for the pool + guages to be deployed at the best time do so.

1 Like
5

https://snapshot.org/#/balancer.eth/proposal/0xfc9caac6422b4bf9d3534a16a9cd48e2f9e9a078323b2923707261d93f6048a3

1 Like
6

The TMReceiver (Rate Provider on Polygon):

It receives data from the TMSender on Ethereum, which:

The TMSender’s data is fetched directly on chain from the TruStakeMATICv2 contract, which:

  • Is upgradeable by the same 5-of-7 multisig as the TMSender
  • Is susceptible to donation attacks

The TruStakeMATICv2 contract’s price computation also pulls data from a system of contracts (ValidatorShare, StakeManager) which:

  • Are all upgradeable

  • By a 5-of-9 multisig

  • With a 2-day minimum timelock (not very long)

Conclusion:Before trusting this rate provider, I would want to make sure I know who the 4 signers are on the TMReceiver multisig. A 2-of-4 is pretty weak, but if I were willing to trust the specific signers, then I might feel better.It would also be important to understand who all the other multisig signers are throughout the system. The raw numbers look okay, but ultimately there could be 5 addresses controlled by a single person. The 2-day timelock duration does not inspire enough confidence (in my personal opinion) to blindly trust those signers, and it only exists in one part of the system.

(from Integrations team)

7

Hi @solarcurve , thank-you for the feedback from the Integrations team. Please see below for a response to the questions/concerns raised.

Concern #1: Is susceptible to donation attacks
Response #1: The minimum amount that a user must stake via the TruStakeMATICV2 contract has been increased to 1MATIC, to eliminate the risk of donation (inflation) attacks. Users are also not able to leave values of <1 in the vault.

Concern #2: There is currently 2-of-4 multisig for the TMReceiver (Rate Provider on Polygon)
Response #2: The multisig for the TMReceiver has now been updated to a 4-of-6

Concern #3: 2-day minimum timelock on the TruStake contracts
Response #3: This relates to the unbonding period on Polygon which is 80 checkpoints, equivalent to 2-3 days depending on network usage. There is currently no timelock in place for the other TruStake contracts.

Concern #4: Unknown identity of signers
Response #4: The TMReceiver signers are as follows:

  1. Internal - Founder
  2. Internal - Senior TruFin Contributor
  3. Internal - Senior TruFin Contributor
  4. Internal - Senior TruFin Contributor
  5. Internal - Senior TruFin Contributor
  6. External - Independent Advisory Committee Member

All wallet addresses for the internal team are hardware wallet based, with no 2 keys for 1 person

Hopefully this helps to answer the questions raised. Let us know if there’s any additional information needed from our side that would be beneficial.

1 Like