bitpro가 원문에서 글자만 모은 내용이에요. 표·그림·수식은 빠지거나 깨질 수 있어요. 전체 1쪽 중 1쪽
Curve stablecoin design
Michael Egorov, Curve Finance
October 9, 2022
Overview
The design of the stablecoin has few concepts: lending-liquidating amm algo-
rithm (LLAMMA), PegKeeper, Monetary Policy are the most important ones.
But the main idea is in LLAMMA: replacing liquidations with a special-purpose
AMM.
Figure 1: Overall schematic
1
40
30
20
10
0
Price drop relative to liquidation threshold [%]
0
2
4
6
8Relative loss [%]
Losses during a dip
range_size=0.20
range_size=0.05
Figure 2: Dependence of the loss on the price shift relative to the liquidation
theshold. Time window for the observation is 3 days
In this design, if someone borrows against collateral, even at liquidation
threshold, and the price of collateral dips and bounces - no significant loss hap-
pen. For example, according to simulations using historic data for ETH/USD
since Sep 2017, if one leaves the CDP unattended for 3 days and during this
time the price drop of 10% below the liquidation theshold happened - only 1%
of collateral gets lost.
AMM for continuous
liquidation/deliquidation
(LLAMMA)
The core idea of the stablecoin design is Lending-Liquidating AMM Algorithm.
The idea is that it converts between collateral (for example, ETH) and the
stablecoin (let’s call it USD here). If the price of collateral is high - a user
has deposits all in ETH, but as it goes lower, it converts to USD. This is very
different from traditional AMM designs where one has USD on top and ETH
on the bottom instead.
The below description doesn’t serve as a fully self-consistent rigurous proofs.
A lot of that (especially the invariant) are obtained from dimensional considera-
tions. More research might be required to have a full mathematical description,
however the below is believed to be enough to implement in practice.
This is only possible with an external price oracle. In a nutshell, if one makes
a typical AMM (for example with a bonding curve being a piece of hyperbola)
2
Figure 3: Behavior of an “AMM with an external price source”. External price
pcenter determines a price around which liquidity is formed. AMM supports
liquidity concentrated from pricespcd to pcu, pcd < p center < p cu. When current
price p is out of range betweenpcd and pcu, AMM is either fully in stablecoin
(when at pcu) or fully in collateral (when atpcd). When pcd≤ p≤ pcu, AMM
price is equal to the current pricep.
Figure 4: AMM which we search for. We seek to construct an AMM wherepcd
and pcu are such functions ofpo that when po grows, they grow even faster. In
this case, this AMM will be all in ETH when ETH is expensive, and all in USD
when ETH is cheap.
3
and ramps its “center price” from (for example) down to up, the tokens will
adiabatically convert from (for example) USD to ETH while proving liquidity
in both ways on the way (Fig. 3). It is somewhat similar to avoided crossing
(also called Landau-Zener transition) in quantum physics (though only as an
idea: mathematical description of the process could be very different). The
range where the liquidity is concentrated is calledband here, at the constant
po band has liquidity frompcd to pcu. We seek for pcd(po) and pcu(po) being
functions ofpo only, functions being more steep than linear and, hence, growing
faster than po(Fig. 4). In addition, let’s define prices p↓and p↑ being prices
where p↓(po) = po, and p↑(po) = po, definining ends of bands in adiabatic limit
(e.g. p = po).
We start from a number of bands where, similarly to Uniswap3, hyperbolic
shape of the bonding curve is preserved by adding virtual balances. Let say,
the amount of USD isx, and the amount of ETH isy, therefore the “amplified”
constant-product invariant would be:
I = (x + f ) (y + g) . (1)
We also can denote x′≡ x + f and y′≡ y + g so that the invariant can be
written as a familiarI = x′y′.
However, f and g do not stay constant: they change with the external price
oracle (and so does the invariantI, so it is only the invariant while the oracle
price po is unchanged). At a given po, f and g are constant across the band.
As mentioned before, we denotep↑ as the top price of the band andp↓as the
bottom price of the band. We defineA (a measure of concentration of liquidity)
in such a way that:
p↓
p↑
= A− 1A . (2)
The property we are looking for is such that higher pricepo should lead to
even higher price at the same balances, so that the current market price (which
will, on average, followpo) is lower than that, and the band will trade towards
being all in ETH (and the opposite is also true for the other direction). It is
possible to find many ways to satisfy that but we need one:
f = p2o
p↑
Ay0, g = p↑po (A− 1) y0, (3)
where y0 isa p0-dependentmeasureofdepositsinthecurrentband, denominated
in ETH, defined in such a way that when current pricep, p↑ and po are equal
to each other, theny = y0 and x = 0 (see the point atpo = p↑ on Fig. 4). Then
if we substitutey at that moment:
I = poA2y20. (4)
Price is equal todx′/dy′ which then for a constant-product invariant is:
4
p = dx′
dy′ = x′y′ = f + xg + y . (5)
One can substitute situations wherepo = p↑ or po = p↓ with x = 0 or y = 0
correspndingly to verify that the above formulas are self-consistent.
Typically for a band, we knowp↑ and, hence, p↓, po, constant A, and alsox
and y (current deposits in the band). To calculate everything, we need to find
yo. It can be found by solving the quadratic equation for the invariant:
( p2o
p↑
Ay0 + x
)( p↑
po
(A− 1) y0 + y
)
= poA2y20, (6)
which turns into the quadratic equation againstyo:
poAy20− y0
( p↑
po
(A− 1) x + p2o
p↑
Ay
)
− xy = 0. (7)
In the smart contract, we solve this quadratic equation inget_y0 function.
While oracle pricepo stays constant, the AMM works in a normal way, e.g.
sells ETH when going up / buys ETH when going down. By simply substituting
x = 0 for the “current down” pricepcdor y = 0 for the “current up” pricepcu
values into the equation of the invariant respectively, it is possible to show that
AMM prices at the current value ofpo and the current value ofp↑ are:
pcd = p3op2↑ , p cu = p3op2↓ . (8)
Another practically important question is: if price changes up or down so
slowly that the oracle pricepo is fully capable to follow itadiabatically, what
amount y↑ of ETH (if the price goes up) orx↓ of USD (if the price goes down)
will the band end up with, given current valuesx and y and that we start also
at p = po. While it’s not an immediately trivial mathematical problem to solve,
numeric computations showed a pretty simple answer:
y↑ = y + x√p↑p , (9)
x↓ = x + y√p↓p. (10)
We will use these results when evaluating safety of the loan as well as the
potential losses of the AMM.
Now we have a description of one band. We split all the price space into
bands which touch each other with pricesp↓ and p↑ so that if we set a base
price pbase and have a band numbern:
p↑ (n) =
( A− 1
A
)n
pbase, p ↓ (n) =
( A− 1
A
)n+1
pbase. (11)
It is possible to prove that the solution of Eq. 7 and Eq. 5 for any band gives:
5
p (x = 0, y > 0, n) = pcd (n) = pcu (n− 1) , (12)
p (x > 0, y = 0, n) = pcu (n) = pcd (n + 1) , (13)
which shows that there are no gaps between the bands.
Trades occur while preserving the invariant from Eq. 1, however the current
price inside the AMM shifts when the pricepo: it goes up whenpo goes down
and vice versa cubically, as can be seen from Eq. 8.
LLAMMA vs Stablecoin
Stablecoin is a CDP where one borrows stablecoin against a volatile collat-
eral (cryptocurrency, for example, against ETH). The collateral is loaded into
LLAMMA in such a price range (such bands) that if price of collateral goes
down relatively slowly, the ETH gets converted into enough stablecoin to cover
closing the CDP (which can happen via a self-liquidation, or via an external
liquidation if the coverage is too close to dangerous limits, or not close at all
while waiting for the price bounce).
When a user deposits collateral and borrows a stablecoin, the LLAMMA
smart contract calculates the bands where to locate the collateral. When the
price of the collateral changes, it starts getting converted to the stablecoin.
When the system is “underwater”, useralready has enough USD to cover the
loan. The amount of stablecoins which can be obtained can be calculated using
a public get_x_down method. If it gives values too close to the liquidation
thresholds - an external liquidator can be involved (typically shouldn’t happen
within a few days or even weeks after the collateral price went down and side-
ways, or even will not happen ever if collateral price never goes up or goes back
up relatively quickly). A health method returns a ratio ofget_x_down to
debt plus the value increase in collateral when the price is well above “liquida-
tion”.
When a stablecoin charges interest, this should be reflected in the AMM,
too. This is done by adjusting all the grid of prices. So, when a stablecoin
charges interest rate r, all the grid of prices in the AMM shifts upwards with
the same rater which is done via abase_price multiplier. So, the multiplier
goes up over time as long as the charged rate is positive.
When we calculate get_x_down or get_y_up, we are first looking for
the amounts of stablecoin and collateralx∗ and y∗ if current price moves to the
current pricepo. Then we look at how much stablecoin or collateral we get ifpo
adiabatically changes to either the lowest price of the lowest band, or the highest
price of the highest band respectively. This way, we can get a measure of how
much stablecoin we will which is not dependent on the currentinstantaneous
price, which is important for sandwich attack resistance.
6
It is important to point out that the LLAMMA usespo defined as ETH/USD
priceasapricesource, andourstablecoincouldbetradedunderthepeg( ps < 1)
or over peg (ps > 1). If ps < 1, then price in the LLAMMA isp > p o.
In adiabatic approximation, p = po/ps, and all the collateral<>stablecoin
conversion would happen at a higher oracle price / as if oracle price was lower
and equal to:
p′o = po
√ po
p = po
√ps. (14)
At this price, the amount of stablecoins obtained at conversion is higher by
factor of 1/ps (if ps < 1).
It is less desirable to haveps > 1 for prolonged times, and for that we will
use the stabilizer (see next).
Automatic Stabilizer and Monetary
Policy
When ps > 1 (for example, because of the increased demand for stablecoin),
there is peg-keeping reserve formed by an asymmetric deposit into a stableswap
Curve pool between the stablecoin and a redeemable reference coin or LP to-
ken. Once ps > 1, the PegKeeper contract is allowed to mint uncollateralized
stablecoin and (only!) deposit it to the stableswap pool single-sided in such a
way that the final price after this is still no less than1. When ps < 1, the
PegKeeper is allowed to withdraw (asymmetrically) and burn the stablecoin.
These actions cause priceps to quickly depreciate when it’s higher than1and
appreciate if lower than1 because asymmetric deposits and withdrawals change
the price. Even though the mint is uncollateralized, the stablecoin appears
to be implicitly collateralized by liquidity in the stablecoin pool. The whole
mint/burn cycle appears, at the end, to be profitable while providing stability.
Let’s denote the amount of stablecoin minted to the stabilizer (debt) asdst
and the function which calculates necessary amount of redeemable USD to buy
the stablecoin in a stableswap AMMget_dx as fdx(). Then, in order to keep
reserves not very large, we use the “slow” mechanism of stabilization via varying
the borrow r:
ps = fdx(dst)dst , (15)
r = r0· 2− p−1h , (16)
where h is the change inps at which the rater changes by factor of 2 (higherps
leads to lowerr). The amount of stabilizer debtdst will equilibrate at different
value depending on the rate atps = 1 r0. Therefore, we can (instead of setting
manually) be reducing r0 while dst/supply is larger than some target number
7
(for example,5%) (thereby incentivizing borrowers to borrow-and-dump the sta-
blecoin, decreasing its price and forcing the system to burn thedst) or increasing
if it’s lower (thereby incentivizing borrowers to return loans and pushingps up,
forcing the system to increase the debtdst and the stabilizer deposits).
Conclusion
The presented mechanisms can, hopefully, solve the riskiness of liquidations for
stablecoin-making and borrowing purposes. In addition, stabilizer and auto-
matic monetary policy mechanisms can help with peg-keeping without the need
of keeping overly big PSMs.
8프로젝트로 돌아가기
