[RFC]: Mitigation of potential risks associated with TetuBAL Stable Pool settings

[Xeonus]

We are excited that projects are building on Balancer. One such project is Tetu with its newly added TetuBAL pools and strategies.

However, it came to our attention that the TetuBAL Stable pool (tetuBal-BPT-80BAL-20WETH Stable Pool) has some configurations set that might cause issues and involves risks for traders interacting with those tokens.

What is the issue / risk?

Trading of correlated assets at Balancer is done via Stable pools. Stable pools operate with a given set of parameters. The most important parameter is the amplification factor (see dev docs for explanations). In short, the amplification factor needs to be set at a specific range to allow optimal operation of a given pool. In the case of the tetuBAL pool, the amplification factor is set to 500 which many believe is outside a healthy range. Check out the pool contract here: StablePool | Address 0xb797adfb7b268faeaa90cadbfed464c76ee599cd | PolygonScan

If the amplification factor is set too high then

• when there is depeg of tetuBAL with 80BAL-20WETH, IL will be accelerated for LPs
• it would take much more capital to to return to peg (make it harder)
• users are therefore at risk of losing (some) funds to the above mentioned scenarios

Additionally, as of writing this RFC, the pool is already heavily tilted towards tetuBAL.

Another concern highlighted to us was bot trading activity happening on this pool as seen in this tx: Polygon Account (Invalid Address)

The entity is

• Taking a flash loan from Aave
• Making a 80/20 BAL-WETH BPT
• Depositing into tetuBAL pool
• Selling for a little less 80/20 BPT, covering the small loss
• Return the flash loan

Because the Amp factor is set to 500, this is a reasonable strategy for accelerating the accumulation of voting power.

What actions could be taken to mitigate that risk?

We would like to propose to reduce the amplification factor from 500 to 50, which would be in line with the auraBAL:80BAL-20WETH pool on mainnet. With this change we would make sure that LPs aren’t exposed to IL and that there remains exit liquidity for users wanting to swap tetuBAL for 80/20 BAL-WETH BPT tokens. Additionally, raising the swap fee to 0.6% (from 0.3%) would mitigate the bot trading activity significantly while protecting LPs.

Next steps

We would like to get clarifications / foster discussion on following points

• What was the rationale in setting the amplification factor to 500?
• What does the community think of setting the factor to a healthier 50?
• What would be the best action moving forward (e.g. leave as is, change, introduce a group to monitor such issues in general)?

We as Maxis want to protect our users while being fully transparent about our intentions. For this reason, this forum post was created to foster discussion around this security risk. As context, Curve has a risk team that would step in and protect its users in such situations. We would highly appreciate it if the relevant parties involved would shed light on the given situation and questions raised and if we can define a strategy moving forward that fits all parties involved.

References

https://docs.balancer.fi/concepts/math/stable-math
https://blaize.tech/article-type/amm-types-differentiations/
https://atulagarwal.dev/posts/curveamm/stableswap/

[ZenDragon]

Some quick math I did on my side. If a large scale user wanted to nearly drain this pool with its current Amp factor (500), of all 80/20 BAL/WETH BPT it would cost them roughly 133,000 tetuBAL to take out 98% of the BAL/WETH BPT.

If A = 50, they would need roughly 351,600 tetuBAL. If A = 5000 they would need 100,800 tetuBAL to drain the same amount of tokens from the pool. Point being the peg is fragile at any amp factor, but the higher it is the more dangerous the circumstance is for Balancer users / LPs. I believe a compromise can be met where both parties feel secure in the liquidity mechanics just wanted to shed some light on the situation. This is dynamic of course as the pool balances change.

[Andrea81]

Hello @Xeonus @ZenDragon my dear friends!

Message received. The Tetu team has different opinions regarding the A factor and I apologise if I can’t bring you an answer with this same post.

All I can say is that they are looking into it and will revert back with a reasonable answer so we can all move forward.

Regarding “LooptetuBAL” which is what you’ve mentioned as “entity” taking the flash loan: this was done by some valuable member of the Community but the intent is not malicious. A deep investigation was done from our end to make sure all was in good shape. We were happy with the liquidity depositing after that. (This is why there has been a deposit → withdrawal → deposit in the tetuBAL-BALWETH pool which I suspect it raised some eyebrows).

Please reach out to me directly or to any of the valuable members of the Tetu team if you have any additional concerns you would like to discuss.

[belbix]

Hey guys, thanks for your care about this question.

I made a huge post with an explanation of the reasons behind the higher A factor but I realized that it is no point for discussion.

In a few words:

• the higher A factor is better for Tetu (we control more tetuBAL at the same point of time)
• the lower A factor is better to tetuBAL users - more exit liquidity, higher possible “discount” to enter the pool

Simulations with A=500 and A=50

tetuBAL info

I think tetuBAL holders should decide which is better. We will make a proposal.

[belbix]

After intensive discussion, simulations and brainstorming of all possible cases, our community decided to keep the A factor as is.
https://snapshot.org/#/tetubal.eth/proposal/0x003e0f0ef6cbaff13c26076a7a3d1ec58524219554938bc3db8c0ef29182e2b2

[Tritium]

That’s nice, but the purpose of balancer is to function as an AMM. The A-factor and fees are managed by the a Balancer Committee. The goal is to maintain optimal function of the Balancer AMM/protocol. To ensure that the tokens available to trade are as tradable as possible, and that optimal revenue is being made for both the DAO and token hodlers?

Creating a stableswap pool with a very high a-factor is a valid thing to do, but IMO it comes with a responsibility for the DAO that created it to work to defend the peg. Do you have buyers lined up, or a plan to bring this pool back to balance? Unless there is a clear plan, lowering the A-factor seems like a good approach. Does the Tetu community have such a plan?

Is Tetu here to extract the most out of balancer, or to create a healthy ecosystem whereby DAOs on polygon can better participate in veBAL?

[adamb0123]

@Tritium

Do you have buyers lined up, or a plan to bring this pool back to balance?

I believe there is. I will alert the relevant parties of the discussion here and hopefully they can chime in.

[Zarigis]

We’ve had a lot of discussion around this internally before making this decision, which I’ll try to summarize here to try to get everyone on the same page.

The core concern of Balancer, as far as I understand it, is that the high A factor makes the liquidity pool risky for liquidity providers as it is relatively cheap to essentially drain the pool of the majority of the exit liquidity (i.e. BALWETH). This would effectively trap the remaining users with tetuBal that they are unable to sell back to BALWETH unless they are willing to do so at a high cost.

This risk is, of course, common to all liquid-staked assets, but amplified by a pool with a high A factor simply because the pool does not start to significantly change the price until the asset proportion has significantly diverged.

By decreasing the A factor you are requiring that much more BALWETH exist in the pool in order to ensure that enough always exists for users to exit by selling their tetuBal.

The problem with this approach is that a high A factor is extremely inefficient from the perspective of both the platform and the users themselves: the more biased the pool is towards tetuBal the more income overall that is earned by the pool. This simply because more of the pool is doing “useful work” as staked veBal, rather than simply sitting idle as BALWETH.

The core difference between a pool like this and a normal stable pool (e.g. between pegged stablecoins) is that there is a “preferred” weighting between the two assets in favor of the liquid staked token. Keeping the pool at exactly 50/50 is wasteful for the reasons stated above. The vast majority of the time you only need to support enough exit liquidity to support the usual traffic from users entering and exiting the pool.

The high A factor is a cludge that effectively allows us to declare what our preferred weighting is. At the moment the pool keeps the price close to 99% up to about 75/25, which we view is a decent compromise between capital efficiency and having a reasonable buffer for exiting. Ideally there would be a better way to make this weighting more explicit (i.e. a weighted stable pool), but this solution is sufficient for now.

An additional point that we considered is that the vast majority of the liquidity in that pool is owned by a single user. Regardless of whatever A value we set, this user could very easily pull most of the liquidity in that pool and leave the remaining users “trapped” in tetuBAL (the A value simply determines the cost of such an action). Currently, however, there remains approximately enough BALWETH in that pool for all of the other users to exit into BALWETH with the majority of their initial deposit.

To mitigate such a “whale” attack, we’ve decided to take an alternative approach to defending the peg if necessary. The details are still in progress, but roughly the strategy is to take a small portion of the yield that would go to the LP and instead use it to build a platformed-owned buffer that can be strategically deployed in order to defend the peg as necessary. This approach gives us some flexibility to respond intelligently to black swan events, rather than only relying on the LP.

Finally, it’s important to note that the mechanics of tetuBAL are different to other liquid-staked tokens, in the sense that it is possible to recover the voting authority of the underlying veBAL by withdrawing it from the LP. This approach gives tetuBAL inherent value and utility that users can still take advantage of regardless of where the peg is at; and therefore more likely that any significant discount offered by an imbalanced LP would likely be quickly bought up again.

[Zarigis]

@Tritium

Do you have buyers lined up, or a plan to bring this pool back to balance?

Is there an expectation that a stable pool should necessarily strive for a 50/50 balance between the assets? At the moment the tetuBAL pool is at 70/30, which is in line with both auraBAL and cvxCRV.

[solarcurve]

tldr, your strategy will deter any other entity with large capital from entering tetuBAL pool because tetu will ensure there’s no exit liquidity, thus protecting humpy’s emission farming. which is all fine with me really if that’s how you want to run your protocol.

[Tritium]

Yes. That tends to be the expectation around stable swaps… that they remain stable. If you want a 70/30 pool, balancer also offers those.

The general rule of thumb around stableswap pools is that one lowers the A-factor/runs on a low a-factor if the pool is off peg.

The cvxcrv stableswap has a A-factor of 50
The auraBAL stableswap has an A-factor of 50
The sdBAL stableswap seems to have an a-factor of 15, which in my mind is more fitting for a permalocked stableswap.
The yCRV stableswap from yearn has an A-factor of 50

Maybe I missed a wrapper or two, but as you can see 50 is most certainly the “industry standard” for this kind of a pool.

All of the pools above except yCRV are off peg at the moment and offering a significant discount for people to bring them closer to 50/50 while charging a similar premium for those who want to exit. By virtue of having a lower A-factor these pools all allow reasonably deep trading at a discount (which should be possible as it’s a permalocked token and people are usually willing to pay to get out) . An A-factor of 500 just creates a doom cliff where everything seems fine until suddenly the pool is so off peg, it’s hardly worth it for anyone to swap.

Something like an a-factor of 500 is something I’ve only seen used for a fully redeemable, fully collateralised stablecoin. Can you find any examples anywhere of a functioning permalocked stableswap pool with an 3 figure A-factor?

Tetu is exploding into the ecosystem rather fast. Does Tetu want to participate in Balancer as a protocol that plays by the same rules as everyone else? It seems to me like pushing back against common sense and rules of thumb isn’t the best way to be well received in the Balancer ecosystem going forward. It also pushes other veBAL wrappers to increase their A-factor to complete, which adds much more fragility to the entire environment and makes everything feel so much more ruggy.

At risk of repeating myself, most of these pools are uneven at the moment, they’re also offering a reasonable discount for people to buy in, incentivising the pool to be return to balance over the minting of more permalocked tokens. This is the way it should be. I’m not sure if you’ve followed any of the Curve conversations around the setting/changing of A-factors, but abusing this parameter is not viewed as a responsible/user focused way to run a coin/protocol.

I’d ask you to consider a bit more moving to a Pool2 pool with whatever ratio you all think is appropriate, or rethinking your decisions around A-factors.

[humpydumpy007]

I am in favor of a reduced amp factor for this pool but did not have voting power to vote for.
Due to the fact that the looper is able to transfer much liquidity from A to B, at very minimal cost.

[Zarigis]

An A-factor of 500 just creates a doom cliff where everything seems fine until suddenly the pool is so off peg, it’s hardly worth it for anyone to swap.

I understand this point, but I would argue that such a “doom cliff” essentially always exists regardless of what A value you set. Once the pool starts to seriously de-peg and hits, for example, a 10-20% discount, people are going to start panic dumping and draining the pool regardless. In the case of tetuBAL, the single user owning the majority of the liquidity could always simply pull it at a moment’s notice and leave the rest of the pool stranded - the A value just determines how expensive that would be.

All of the pools above except yCRV are off peg at the moment and offering a significant discount for people to bring them closer to 50/50 while charging a similar premium for those who want to exit.

I’d like to distinguish the terms “off peg” and “50/50” for the purposes of this conversation, since they seem to be used interchangeably but aren’t exactly the same thing. Those pools are currently imbalanced with approximately a 70/30 weighting towards the liquid locked token. This is a fundamental property of the pool that is a consequence of more people exiting than entering. Somewhat independently, the A factor of 50 on those pools means that a 70/30 weighting causes the liquid locked token to be offered at approximately 5% off.

Something like an a-factor of 500 is something I’ve only seen used for a fully redeemable, fully collateralised stablecoin. Can you find any examples anywhere of a functioning permalocked stableswap pool with an 3 figure A-factor?

I would argue that this is somewhat circular reasoning - everyone uses because it’s seen as the industry standard, which is only the case because everyone uses 50. Are there examples where liquid locked tokens failed as a direct result of setting a high A value on their pool? As a counterpoint, tetuQi had the majority of its liquidity in a Univ2 pool (simulating an extremely low A value) and still became completely de-pegged when the market turned and there was panic selling. Tetu then worked to restore that pool to a 50/50 balance in order to fix the peg. To me, this is evidence that no amount of tuning pool parameters can account for fundamental market forces.

Does Tetu want to participate in Balancer as a protocol that plays by the same rules as everyone else?

I’m trying to understand what are “rules” vs. “guidelines” vs. “best practices” as these have all been mixed together a bit in this conversation. We are trying to take an alternative approach to other liquid locked assets in a number of different ways. The fact that so many liquid staking protocols “struggle” with the asset ratio in their LPs indicates to me that perhaps the conventional wisdom surrounding them needs to be reconsidered. Our approach is to simply allow the LP to be imbalanced, while simultaneously building a fund to be used exclusively for maintaining the peg in extreme market situations.

I’d ask you to consider a bit more moving to a Pool2 pool with whatever ratio you all think is appropriate, or rethinking your decisions around A-factors.

As far as I understand it is not possible to have a 2Pool that uses stable math, which is what we would want. Specifically we would want to explicitly declare the “optimal” asset ratio range where the pool keeps the price close to 1:1. This is effectively what we have done with our current A parameter setting.

they’re also offering a reasonable discount for people to buy in, incentivising the pool to be return to balance over the minting of more permalocked tokens. This is the way it should be.

Why is that the way it should be? I agree there exists a point where adding exit liquidity should be preferred over minting more locked tokens, but why is that necessarily when the LP is at a 50/50 asset ratio? Users want to pile into these LPs to get maximum yield (i.e. due to gauges or platform emissions, or whatever else), but at a 50/50 ratio it means half of their assets are basically doing nothing useful.

I want to be clear that I understand Balancer’s position of wanting to protect users entering the LP from being “trapped” as a result of too much tetuBAL existing vs. the total exit liquidity. Ultimately my point is that this risk always exists for liquid staked assets - if too many people want to exit at once the LP will get drained regardless of the A value, in particular because of the cascading effect from people exiting the pool and then dumping the tetuBAL from their LP into it. Even at a 50/50 asset ratio, all of that “exit liquidity” BALWETH can disappear in an instant if everyone withdraws their liquidity at the same time.

In my opinion, there is significant room for innovation in this space, and the LP should not be the only mechanism by which the peg for a liquid-staked asset is maintained. By building a protocol-owned withdrawal buffer, Tetu can give itself the flexibility to respond intelligently to the market, rather than simply relying on a single LP parameter to save us.

[adamb0123]

@Tritium

they’re also offering a reasonable discount for people to buy in,

Just to pick out this specific point… last time I checked, the main Aura deposit page encourages users to wrap their BPT or BAL to receive auraBAL. It does not route them through the discounted pool. Am I mistaken?

[Tritium]

@Zarigis

I understand this point, but I would argue that such a “doom cliff” essentially always exists regardless of what A value you set. Once the pool starts to seriously de-peg and hits, for example, a 10-20% discount, people are going to start panic dumping and draining the pool regardless. In the case of tetuBAL, the single user owning the majority of the liquidity could always simply pull it at a moment’s notice and leave the rest of the pool stranded - the A value just determines how expensive that would be.

At lower A factors, the cliff is less of a cliff and more of a gradual slope. Sure on the very edge case where everyone, or a majority investor wants to withdraw, the A-factor isn’t going to matter much, but for the most part the goal is to have the “depegging” happen slowly and to allow a reasonable amount of swapping to occur as it happens. This is less of an issue in fully redeemable tokens, as users have the ability to redeem instead of swap out if the pool ends up too far off peg. So the A-factor determines how fast swapping out gets more expensive. This is well demonstrated by the shape of the 2 curves @belbix shared in his sheet:

@Zarigis

I’d like to distinguish the terms “off peg” and “50/50” for the purposes of this conversation, since they seem to be used interchangeably but aren’t exactly the same thing. Those pools are currently imbalanced with approximately a 70/30 weighting towards the liquid locked token. This is a fundamental property of the pool that is a consequence of more people exiting than entering. Somewhat independently, the A factor of 50 on those pools means that a 70/30 weighting causes the liquid locked token to be offered at approximately 5% off.

Stableswap pools were designed by Curve with the explicit intention of allowing stableswap to happen near 1/1. If you look at Curve/Convex governance, there is a LOT of thinking, consideration and debate that goes into determining the A-factor and it is determined by governance. A pool2 pool doesn’t have the concept of peg and is designed to have a floating price, so we tend not to talk about peg so much there.

@Zarigis

I would argue that this is somewhat circular reasoning - everyone uses because it’s seen as the industry standard, which is only the case because everyone uses 50. Are there examples where liquid locked tokens failed as a direct result of setting a high A value on their pool? As a counterpoint, tetuQi had the majority of its liquidity in a Univ2 pool (simulating an extremely low A value) and still became completely de-pegged when the market turned and there was panic selling. Tetu then worked to restore that pool to a 50/50 balance in order to fix the peg. To me, this is evidence that no amount of tuning pool parameters can account for fundamental market forces.

The point about non-redeemable stableswaps with high A-factor is that it creates a situation where everything is 100% fine until it quickly becomes a total rug. This reflects badly on the industry. I actually think Terra/UST was a pretty good example of a protocol abusing a high A-factor/keeping a lot of pools way off balance, leading to a particularly nasty collapse/rug resulting in a lot more damage than necessary being done to the entire ecosystem/industry.

This was very bad for curve, so it makes sense why a protocol would want to ensure that their tokenomics is not used to set such a trap that is too complex for many people to wrap their head around. For the most part, and baring the UST exception noted above, curve/convex governance has done a very good job of policing the A-factor on pools such that these failures don’t exist. I think the fact Balancer doesn’t show the A/Amp factor in the UI nor discuss it when approving gauges is an oversight, and I hope this conversation will be a catalyst to change that.

@Zarigis

In my opinion, there is significant room for innovation in this space, and the LP should not be the only mechanism by which the peg for a liquid-staked asset is maintained. By building a protocol-owned withdrawal buffer, Tetu can give itself the flexibility to respond intelligently to the market, rather than simply relying on a single LP parameter to save us.

I’m super excited about this work/innovation you are doing too and fully support Tetu in developing it. Introducing, proving and making ideas like this more common in how DeFi protocols think about non and/or semi-redeemable wrappers is a big win. I just think this solution works a lot better when the A-factor is lower and/or more in line with industry best practices based on the advice of Curve, who are the big brains that made this math in the first place.

Interestingly, a large investor in tetuBAL has commented that they would rather see the A-factor be lower and the looper pay more tax to change the pool balance. So it seems to me like the high A factor is materially allowing someone from the Tetu community (likely a large TETU hodler) to rug TetuDAO’s biggest depositor based on the fact that they don’t have enough $dxTETU to prevent it.

It would be much better if we could all come to an agreement about what is healthy and work forward from that. Otherwise, I suppose I’d like to see this go to a vote of Balancer governance, as it is the Balancer and Aura tokens that are being used to lure people into a trap which is actively being operated, at least as I see it. I don’t think that was anyones intention, but that’s kind of what is happening and I’d encourage the Tetu team/community to try to take some different perspectives when thinking about this whole situation.

@adamb0123

Just to pick out this specific point… last time I checked, the main Aura deposit page encourages users to wrap their BPT or BAL to receive auraBAL. It does not route them through the discounted pool. Am I mistaken?

I tend to agree that AURA should at least do what Convex eventually did and post a message stating that the pool is off peg and it would be cheaper to swap then buy on/around the minting option. It creates better far better UX, which I think is of paramount importance to the future of DeFi. That being said, I think setting up a trap with high a-factor and rugging LP depositors by looping their liquid BPTs for something permalocked while paying a very small cost to bring the pool off balance is far worse than not having a notice reminding people they can buy instead of mint. I suppose this is just a matter of opinion though.

I’ll bring this up with AURA none the less. What do you think @adamb0123. If Aura changed it’s A-factor from 50 to 500 and then looped through most of the liquid capital in the pool in order to mint more auraBAL, but put a notice up offering people to buy when the pool was off peg (which would be a very hot/cold situation at an A-factor of 500) would that be better/worse more/less honest?

Can we figure out how to see things on the same page here, or does it make sense to figure out how to take this to balancer governance to make sure they agree with Tetu HODLers about how their tokens should be used to incentivise stableswap?

[adamb0123]

@Tritium

If Aura changed it’s A-factor from 50 to 500 and then looped through most of the liquid capital in the pool in order to mint more auraBAL, but put a notice up offering people to buy when the pool was off peg (which would be a very hot/cold situation at an A-factor of 500) would that be better/worse more/less honest?

The point is moot, because Aura already has a 25% share of total veBAL. How much AuraBAL was minted while the swap ratio of AuraBAL to 80BAL-20ETH was < 1? I know I got caught out by this, after it had been reported by multiple users:

In all seriousness - I know your intentions are noble, and I don’t mean to engage in “whataboutism”.

Aside from this minor point about Aura, I think there is a lot to meditate on. I know I need a day or two to digest, but let me think about all of this. I feel like maybe we are missing the forest for the trees.

[humpydumpy007]

Increasing swap fee would help mitigate things. 0.6% is fine by me.