Research Summary: Liquidity risks in the decentralized finance protocol Aave

TL;DR

  • AAVE is a protocol for loanable funds (PLF) that uses multiple token asset pairs as collateral for loans, and safeguards staked assets using an economic model that uses incentives and variable parameters to reach “a [trustless] optimal equilibrium and overcollateralization.” Under certain conditions, however, there can be signs of illiquidity.

  • This paper proposes a game theoretical hypothesis to analyze the behavior of Aave participants in response to various incentives. It evaluates potential points of failure during a bear market, mechanisms for the migration of illiquidity in the Aave protocol, considers the diversification of assets in the safety module to increase the efficiency of the safety module and decrease the risk of illiquidity in the protocol.

  • The paper shows that even during a sudden market drop, the Aave protocol model held up without activating the safety module.

Citation

Core Research Question

  • How can we mitigate liquidity risks in the Aave platform?

Background

  • Protocols for Loanable Funds (PLFs): Protocols that facilitate lending between participants. PLFs use pools to act as the lending market for participants, as opposed to keeping track of transactions in an orderbook. In these pools participants can deposit assets and earn interest, or they can borrow from the pool, paying interest. These pools are implemented as smart contracts, which are Turing complete programs running on the blockchain.
  • Lending Pool (LPs): Financial applications which create a market of crypto-asset loans, providing incentive mechanisms to equilibrate the market.
  • Collateral: Tokens which can be seized if a user does not adequately repay a loan.
  • Collateralization: The ratio of deposited collateral value over the borrower’s total loan value.
  • Liquidation: When user A’s collateralization falls below a minimum threshold it is under-collateralized In this case, a user B can repay a fraction of A’s loan in return for a discounted amount of A’s collateral seized by B.
  • LP-minted token: Liquidity providers can provide their tokens to the lending pool and receive an LP-minted token in return. This token can be staked in a yield optimization protocol such as Yearn.finance or can determine the appropriate levels of collateralization based on token prices given by the price oracle as LP-minted token collateral.
  • Flash loan: A flash loan is an instant loan with one condition — it must be repaid within a single Ethereum block, which is mined in intervals of roughly 13 seconds. These loans require no upfront collateral and happen almost instantly. They are smart contracts capable of interacting with other smart contracts that have been deployed on the network protocol. A borrower can request funds from Aave, but they must pay back those funds, plus a 0.09% fee, within the same block. If the borrower doesn’t do this, the entire transaction is canceled, so that no funds were ever borrowed.
  • Flash loan attack: A smart contract exploit where an attacker takes out a flash loan from a DeFi protocol, uses the capital they’ve borrowed, and pays it back in the same transaction. For example, a flash attack might use borrowed funds to spike the price of an asset, sell those assets, and use the profits to repay the interest on their loans.
  • Flash loan risk: A flash loan has to be repaid to the protocol in its entirety in the same transaction. The size of flash loans can, theoretically, entail the entire pool. By creating large imbalances with a sizable flash loan, one can profit from these self-created imbalances through arbitrage.
  • Illiquid state: A state in which one is not able to borrow or redeem their deposited assets.
  • Bank run: A bank run occurs when many clients believe a bank may cease to function in the near future and withdraw their money.
  • Agent: The trader or contract who wants to make a profit.
  • Agent behaviors: Agents try to execute the most profitable transactions, such as flash loans, borrowing funds and lending different tokens as interest rate arbitrage.
  • Liquidation threshold: A liquidation threshold refers to the percentage at which a loan is defined as undercollateralized.
  • Safety module: A mechanism-locked AAVE token that will be used as a mitigation tool to prevent an illiquid state during a bank run or other emergency.
  • Oracles: A third-party service that provides data from off-blockchain sources to on-blockchain smart contracts with verification and randomness. They also provide service level agreement contracts to ensure information is both equal and fair.
  • Deflationary spirals: Deflationary spirals occur when many users attempt to withdraw their assets from the protocol during a short period of time. This can trigger collateral illiquidity, and if users then reduce the price of their assets to liquidate them, it can cause other users to attempt to withdraw their assets, putting further downward pressure on prices.

Summary

  • This paper examines PLF markets that suddenly suffer a large price drop, such as “Red Wednesday” when Ethereum’s price fell by 43% between 11 May 2021 and 23 May 2021. In this situation a deflationary spiral could occur, which might have caused an illiquid state and activated the safety module selling stakeholders’ AAVE tokens to mitigate illiquid state.

  • This paper analyzes liquidity risks and makes three points:

    • A game theoretic model of agent behavior in PLFs (used on Aave) is given.
    • A theoretical deflationary spiral is presented.
    • Aave’s safety module is empirically analyzed.
  • Every market pool has its own parameters such as liquidation threshold and interest rate per pool. If a trading pair pool has very few borrowers and a very high amount of deposits, resulting in very low borrow interest rates and vice versa, the variable borrow rate vbi is given by:

  • R0 is the base rate.

  • Rslope1 the multiplier below optimal utilization.

  • Rslope2 the multiplier above optimal utilization.

  • U is the current rate.

  • Uoptimal is the optimal utilization rate.

  • Equation 1 shows that the borrow rate vbi is equal to two conditions set per market pool:

  • If current rate (U) is lower than (Uoptimal) then (R0) + (U) / (Uoptimal) *(Rslope1).

  • If current rate (U) is higher than(Uoptimal) then (R0) +(Rslope1) + ( (U) - (Uoptimal)) / (1 - (Uoptimal)) *(Rslope2)

  • Condition 2 is riskier than condition 1 because it is a higher borrowed fund and has lower collateral at the market pool.

  • The Aave mechanism is shown in Figure 1. First, every market pool in Aave protocol receives the price feed of the associated asset from Chainlink. Second, agents interact with each market pool through functions such as deposit, redeem, borrow, and repay. Third, agents’ collateral may liquidate because the value of collateral is less than the liquidation threshold. Fourth, agents who stake AAVE in the safety module may share in the profit and risk of the Aave protocol.

Method

Aave protocol’s model focuses on preventing an illiquid state and defines three terms: pools, agents and the health of the PLF. This paper outlines variables in Tables 1 and 2, and then makes a connection between the variables and the notable entities in a PLF. The model is based-on the Aave white paper and A stochastic model of stablecoins. This model gives the methodology to formalize agent incentives and strategies.

Below are odel variables (Table 1) and agent actions (Table 2)

Variable Interpretation
ai Agent i
(ai, dj) Deposited assets of agent i into pool j
(ai, bj) Borrowed assets of agent i into pool j
ci Asset i
pi Price of asset i
pli Pool i
tbi Total borrowed for pool i
tdi Total deposited for pool i
si = tbi + tdi Total size of pool i
dpii Deposit interest of pool i
vbi Variable borrow rate for pool i
uit Utilization ratio for pool i
Optimal utilization 80%
Liquidation threshold 80%
Loan to Value (LTV) 80%

Tabel 2 Agent actions

Variable Interpretation
Dp (ai, ci) ai deposits ci
Rdm (ai, ci) ai redeems ci
Bor (ai, ci) ai borrows ci
Rpy (ai, ci) ai repays their loan of ci
Liq (ai, cj) ai liquidates the loan of aj
Stk (ai, cAAVE) ai stakes their AAVE asset in the safety module
UnStk (ai, cAAVE) ai unstakes their AAVE asset from the safety module
Idle (ai) ai does nothing

Definition 1 is to define the utilization of each market pool. For any pool pli (pool i), its utilization at time t, i.e. the fraction between total loans of the pool, tbi(total borrowed for pool i), and the deposits of the market, tdi(total deposited for pool i), is calculated as:

Definition 2 is to define the health factor ratio of each agent. For any agent i(ai), its health factor, i.e the ratio between the sum of its deposited assets multiplied by a diminishing factor (liquidation threshold) divided by the sum of its outstanding borrows, is calculated as:

With this equation you can quickly know the health of any agent in a PLF. Whenever an agent’s health factor(hi) < 1, their deposited collateral may be liquidated by any other agent.

To calculate the parameters which would require initialization at t = 0, for all agents, assets and pools, and all the parameters noted in Table 1. Subsequently, at every t:

  • Chainlink, an oracle service, provides the value of each asset.
  • Aave updates the assets’ values.
  • Each agent chooses a strategy (Table 2).
  • Aave updates the market’s parameters.

In equation 4, there is an assumption that agents are presumed to be economically rational agents, wishing to maximize their total assets, so the agent will choose the strategy which maximizes:

i.e. the sum of all deposited assets of agent i into pool j (ai, dj) multiplied by the price of the asset j (pj) plus the earned interest on this deposit ((ai, dj)*dpij) minus the interest that has to be paid for any outstanding loans ((ai, dj)*vbij). In this equation, the variable interest rate is used to calculate the profit instead of a stable interest rate.

Definition 3 is to define market illiquid state. A market is liquid if any amount of assets can be traded at any time during market hours. These trades should also be able to be completed rapidly and with minimum loss of value at competitive prices. An illiquid state occurs when one is not able to borrow or redeem their deposited assets. Preventing illiquidity is done through incentives.

A potentially illiquid state can show itself in two conditions:

  • If Asset i (ci) utilization ratio for pool (uit) is close to or equal to 1, then some agents will not be able to borrow additional assets as total deposits for pool i (tdi) are loaned out.
  • If the utilization ratio for pool (uit) is greater than 1., it may result in some agents being unable to redeem their collateral assets. They may also be unable to borrow additional assets or withdraw assets. Condition 2 carries more risk than Condition 1 and is similar to a bank run.

If both potential illiquidity state conditions are reached, the potential deflationary spiral would result in constant depreciation of the deposited collateral. The price given by the Chainlink oracle network to the protocol at t + 1 is less than the price given at t, namely pi,t > pi,t+1. For example, if the price of ETH suddenly dropped 20%, then the agent who used ETH as collateral, needs more collateral to supplant the 20% drop in ETH, but the price given by Chainlink at t + 1 second is less than 20% of the price.

There is another situation that would happen when both of the two potential illiquidity state conditions are reached: . Depreciation, which means a collateral asset is valued at a discounted price. At t = x, Chainlink will report pi,x, which by the above assumption is less than pi,x−1. This means that net worth of agent j is worth less, in terms of deposited assets than that of agent i into pool j (aj, di) multiply price of asset i (pi).

Depending on the situation, an agent might choose a strategy such as liquidating the loan, redeeming, or borrowing etc., shown in Table 2. This will result in the increasing depreciation of the asset i (ci) in relation to the agent’s collateral. For example, when an oracle price of a token suddenly drops a larger price amount on a single pair, it may cause the collateral rate to be higher than the usual rate. This situation means that the value of the collateral pool suddenly decreases. A vicious cycle occurs, which reinforces itself causing a deflationary spiral.

Figure 2. A deflationary spiral is aggravated through liquidations and withdrawal of liquidity.

If the vicious cycle in Figure 2 is upheld long enough, it can cause a state of under collateralization, in which total borrowed i > total deposited i (tbi > tdi). This means that the loans are not fully backed up by the underlying collateral. If this happens, some participants will not be able to redeem their assets as there are no assets in the pool to be redeemed. The debtors have no incentive to pay their outstanding loans.

There are several potential factors which can make the situation even worse:

  • Participants of the protocol can vote on protocol wide parameters with their governance tokens. Since a high amount of the liquidity and governance tokens are in the hands of a few addresses, voting is biased.
  • If the health factor of the agent drops even more than the point of under collateralization then liquidations actually push the protocol and agent even closer to bankruptcy.
  • A high utilization ratio is seen in the historical data of Aave. For example DAI utilization rations seen in Figure 3 are also seen in other PLFs. This shows that protocol incentives are not always sufficient to reach optimal utilization.

Figure 3. Historic utilization in the DAI pool.

Aave designed a token economy stake incentive to prevent participants from unstaking in times of downfall periods called the safety module. The stakeholder benefits by earning interest on their staked AAVE. But they also bear the risk that their AAVE could be slashed to provide liquidity, if outstanding debts are at risk of becoming unprofitable at liquidation. The protocol has set up a cooldown of 10 days, after which one can unstake their AAVE from the safety module.

Figure 4. Architecture of AAVE safety module

Source: AAVE safety module

Observations

  1. Equation 4, the assumption that agents are presumed to be economically rational agents, wishing to maximize their total assets, still holds with the addition of the safety module. Even during Red Wednesday, an agent has incentive to stake AAVE assets and earn interest in order to maximize their profit. However, unstaking is always a possibility. Simulated runs from PLFs become illiquid in as little as 19 days, and since the AAVE cooldown period is 10 days, agents could unstake their assets just when the protocol needs them the most.
  2. The correlation of AAVE with the underlying protocol is highly positive (0.77) with Ethereum, and ETH is the most used collateral in the protocol (84.9%). This means that the asset meant to function as backup collateral in times of prolonged deflation of the collateral, will actually drop in conjunction with said collateral.

Results

  • This paper gave a taxonomy of PLFs and ways to measure and provide the best incentives to motivate agents to participate. Using this model, PLF has to find a balance between competitive returns and the safety of assets. Even during Red Wednesday, when there was a larger than normal amount of liquidation, illiquidity didn’t occur.
  • When the AAVE protocol is liquid, outstanding debt can be provided to everyone, but when a described deflationary spiral occurs, agent strategies can lead to an illiquid state and the inability to provide lending services. This paper describes a model that can examine the illiquid state.

Discussion & Key Takeaways

  • Diversification of assets in the safety module. The AAVE asset used as reserve in this safety module is strongly correlated with Ethereum (0.77), the collateral used the most in AAVE (84.9%). Is staking multiple tokens the future of the safety module mechanism?
  • Should AAVE tokens be available to be borrowed and lent from AAVE protocol? Currently, they aren’t available for either.

AAVE tokens borrowed and lent as of 2021/8/2.

Implications & Follow-ups

  • Future Aave safety models could reserve multiple assets as vault mechanisms to prevent deflationary spirals. Doing so may also encourage more participants to stake AAVE tokens.

Applicability

  • Aave has created an AMM liquidity pool market which allows liquidity providers on other protocols to use their LP tokens as collateral in the Aave protocol.The PLFs model could examine the Liquidity Provider tokens in the model variable shown in Table 1 and Table 2.
  • This model has created health factors that can check a DeFi protocol’s ability to verify the liquidity risks of a protocol’s associated borrow and lending pools.
3 Likes

@Sean1992076 thank you so much for contributing this piece. You mention Red Wednesday a couple of times in the summary and I remember the original idea for this piece was to talk about how the protocols fared during the sudden collapse in the price of Ethereum. Would you be able to give us some context about the event and other near catastrophes in the market? During past events did protocols experience bank runs? What about smaller protocols during the drop?

3 Likes

The Red Wednesday means that major of the cryptos crash significantly, ETH suddenly falls 43%.


11 Dec, 2021 Retrieved from Coinmarketcap

AAVE’s liquidity actually is rising during the Red Wednesday shown below. This means a sudden fall doesn’t occur bank run. On the contrary, AAVE seems active safety model to boost liquidity.


11 Dec, 2021 Retrieved from aavewatch

3 Likes

@Sean1992076 Thank you so much for presenting this wonderful summary for us. It’s interesting and helps me a lot, particularly with some protocol knowledge and inference.
Regarding the framework that it proposed to explain the liquidity risks, do you think there is any facet that it didn’t consider but also important? In your opinion, is there any other risks analysis framework that is more reasonable or realizable? Could you give a simple comparison of their characteristics to us?
Thanks!

2 Likes

This is a very interesting conversation. May I ask if your explanation to the growing liquidity shown in the screenshot is supported by the paper? If not, what is the basis to believing AAVE’s active safety model is the reason to the boost of liquidity?

3 Likes

@Sean1992076 could you explain Aave’s security module? How does it compare to other protocols? Are they mostly forks of one another or do they all have different approaches to maintaining liquidity in a crisis?

1 Like

@Astrid_CH In this paper risk analysis is based on the game theory hypothesis. Every agent wants to reach the most profitable action to achieve an illiquid state, but in the real world, it may likely have a normal distribution.

@Twan This screenshot is the real data from the official AAVE’s aavewatch. The goal of the safety model is to prevent a short period of time’s liquidity. I may not record in daily data.

@jmcgirk I think the question could be divided into four parts:

  1. Security risk
  2. Governance risk
  3. Oracle risk
  4. Market risk

The security module in Aave V2 holds security at its core with audits by Consensys Diligence, CertiK and Certora as detailed in Security & Audits.

I think AAVE is the original one that doesn’t fork from another protocol. Geist is fork from AAVE on the Fantom blockchain.

2 Likes

What might a black swan event that could actually trigger the safety module look like?

Sorry to double-post questions @Sean1992076 – I noticed that in the recent crash, MakerDAO came close to a major liquidation which was averted at the last moment. How has Aave fared during the recent collapse in prices?

@Larry_Bates and I are hosting a discussion about this topic on Thursday 1/28 at 1:30pm PT, anyone is welcome to join us. If you’re interested, please send me a note on our discord (check out the banner above for an invitation)

3 Likes

@Sean1992076 it seems that Aave fared relatively well compared to other DeFi protocols during the recent market crash. Based on your understanding of the risks, do you have any insights as to what might have prevented Aave from being completely wiped out? Do you think it was just a crash that wasn’t bad enough to take out the larger platforms; or was there some mechanism or some aspect of the protocol that prevented the liquidity from being wiped out?

3 Likes