Allow to stake $SWISE as protection against slashing

Ideas
1

Nobody likes to think about the possibility of slashing, but it often pays to be prepared for the worst. StakeWise team would like to introduce the idea of allowing $SWISE token holders to “insure” the protocol against slashing risk by staking $SWISE in a Security Module.

Motivation

When it comes to the risks associated with ETH2 staking, the risk of slashing occupies the top spot. Ever since its first testnet appearance in May 2020, the StakeWise team spent countless hours on polishing the protocol’s infrastructure setup in order to minimize slashing risk. To further protect our stakers, we have an idea to implement staking functionality for $SWISE that would allow DAO members to offer an extra protection layer against slashing risk to the protocol’s users.

Letting DAO members “insure” slashing risk through the staking of $SWISE could make the StakeWise protocol safer to use and add utility to the token. It could also offer additional revenue streams to the DAO members who stake $SWISE, and act as a deflationary force for the $SWISE supply.

Specifications

This additional layer of protection could work via the following mechanism:

  • Users stake $SWISE in the safety module contract
  • StakeWise DAO Treasury allocates rETH2 rewards to the contract
  • In the absence of slashing events, users claim rewards proportionately to their share of staked $SWISE
  • In case of a slashing event, the safety module contract initiates an open market auction for staked $SWISE, aiming to compensate StakeWise users for any slashing-related losses with the proceeds from the auction
  • Any $SWISE remaining in the safety module contract after the auction can be claimed by its owners proportionately to their share of staked $SWISE

There are several variables in this mechanism that require the DAO’s input:

  • The amount and type of rewards to be allocated to the safety module contract

The DAO’s Treasury could allocate up to 100% of the staking fees it generates (earned in rETH2) towards this purpose. In addition, the DAO may elect to allocate $SWISE rewards from its reserve to encourage participation in the safety module.

  • The duration of $SWISE withdrawal delay

Once staked in the safety module, $SWISE should not be available for immediate withdrawal to prevent users from front-running the auction and avoiding the sale of their $SWISE. Hence, the DAO must choose the minimum withdrawal delay that would prevent front-running yet be sufficiently short to maintain flexibility of staking $SWISE. A delay would be applied from the moment $SWISE staker decides to withdraw their tokens.

  • Auction triggers (i.e. definition of a slashing event)

A slashing event that triggers the auction must be clearly defined in terms of % of the funds slashed. Alternatively, the DAO may elect to control the trigger manually.

  • Auction parameters

Variables like the minimum bid, auction type, place of the auction etc. could be clarified in advance for the safety mechanism to function properly. Alternatively, the DAO may elect to control these parameters ad-hoc.

On top of these variables, the DAO could decide whether it would like to allocate additional voting power to the staked $SWISE tokens as means to incentivize $SWISE staking and buyers’ participation in the auction.

Drawbacks

The news of a slashing event could propagate through the Ethereum ecosystem and impact the $SWISE price before the auction even begins, potentially reducing the effectiveness of the safety mechanism. One way to counteract this effect is to mint more $SWISE tokens to be sold in the auction, using a process similar to Maker DAO’s Flopper mechanism.

Another way would be to hold off on conducting the auction until a full post-mortem has been done and appropriate actions to fix the source of slashing have been taken. This would give the market sufficient time to digest the news and restore confidence in the protocol based on the DAO’s response to the slashing event.

This idea is one of the heaviest conceptually and requires input from as many DAO members as possible. What are your thoughts, folks? :face_with_monocle:

11 Likes
2

Generally its a good idea to mitigate risk.
Could we elaborate this a bit more? To get a better understanding.
Lets say i have 1.200 SWISE.

  1. I deposit a fraction or the full amount into a safety module contract? So thats locked.
  2. A fraction of the daily rETH2 rewards are allocated? I can’t stake those. So i trade of compound interest for risk mitigation?
  3. After what amount of time can i reclaim the rETH2 in the absence of slashing? A Month?
  4. How is the open market auction done? Whos buying/selling? How big is the order book? How volatile is the process?

Again, great idea.

3

I do not have an opinion formed on all the points to be discussed, but I think this (the quoted part) is the path to go. The protection is there, but the compensation (either full or partial) comes a litle later. And the response of the DAO is the key to a successful auction.

6 Likes
4

Agree with pablo, I think this would be the equivalent of a black swan event, in that we will not know how it happened or what the fallout will be, and so while we want to be sure that the community knows what the response will generally look like I do not think we want to automate it.

1 Like
5

I think this is a great idea that kills two birds with one stone - insures the protocol against its greatest foreseeable threat, and also provides an incentive to lockup SWISE instead of selling it to market. I would be in favor of having two pools, to that end - one that is locked up for long enough to provide insurance, gets significantly more rewards as a result, and provides greater voting power (1.25x? 1.5x?) vs. one that can be freely entered, gets fewer rETH2 rewards, and allows you to vote with no multiplier. If you do not have SWISE in either of the two pools, you do not have a governance vote.

1 Like
6

I think protection vs slashing is necessary to provide a quality product. I’d like to see if we can find a way to generate revenue other than market selling our governance token, which as mentioned in the original post can be taken advantage of by market players.

So are there resources we can use to generate income from SWISE? Can we have an option for staking SWISE that has some similarities to yield baring vaults?
Some ideas:

  1. vanilla staking: no frills, you put your tokens in the contract they accrue their rewards due for protection vs slashing. SWISE staked here will be market sold in the event of slashing.
  2. yield baring staking: when staking here SWISE is deposited in AAVE and leveraged for stable coins. Those stable coins are deposited in a yield aggregator (many options to choose from.) The interest accrues in the SWISE treasury and is used to protect slashing rather than the SWISE token. The yield is not owed to the staked SWISE, however staked SWISE still accrues rewards for protection vs slashing.

I think the rewards for doing either can be equal, however you choose to secure the protocol you’re earning your cut.

So the second option offers more protection for SWISE users and for longer term. The absolute worst case scenario is that we market sell all the SWISE in the staking contract and this still isn’t enough to cover our users’ losses. We’d be left saying sorry we can’t do anything for you. In the second option we have a way to recover, we have an income stream and we have a reason to rebuild because stakers can see there is hope of recovering some value to their SWISE tokens.

Closing thoughts:
Sustainable slashing protection is absolutely necessary, and market selling SWISE shouldn’t be our first choice.

2 Likes
7

Thank you for the discussion here guys!

@George my thoughts:

  1. A fraction of the daily rETH2 rewards are allocated? I can’t stake those. So i trade of compound interest for risk mitigation?

I think the DAO could decide how often to allocate rETH2, but it would be up to you when to collect it. Think this also applies to (3).

  1. How is the open market auction done? Whos buying/selling? How big is the order book? How volatile is the process?

The auction would be done only in case a slashing event has occurred (as defined by the DAO, manually or automatically). Staked $SWISE would be sold in the auction, and a buyer could be anyone on the market. Order book, volatility - good questions, I don’t know and find it hard to predict. That’s the reason I quite like the idea of the DAO handling an auction manually should the slashing even occur.

@pablo @Quijote I also consider the manual process a better alternative - it gives the DAO more control over an uncertain situation.

@Quijote to your points:

I would be in favor of having two pools, to that end - one that is locked up for long enough to provide insurance, gets significantly more rewards as a result, and provides greater voting power (1.25x? 1.5x?) vs. one that can be freely entered, gets fewer rETH2 rewards, and allows you to vote with no multiplier.

This is close to the direction in which the team was thinking - to allow locking of $SWISE for fixed periods of time to get a boost to the voting power. The key question is whether to also modify the share of rETH2 received for this action.

While naturally it does make sense to give the “committers” a higher rate, we should consider the APR implications for this insurance mechanism. In the extreme scenario that all of the $SWISE supply is staked, the APR is ~0.25% when token’s FDV = 3x TVL. For a consistent ~2.5% APR, only 10% of the supply must to be staked. Considering the premium on rETH2 vs ETH (could be up to 4x in my opinion), I believe achieving ~5-10% APR on 10% of the supply staked is possible. The amount of $SWISE staked and the premium on rETH2 will be determined by market forces, so the eventual APR on providing insurance is hard to predict. However, my bet is that it won’t ever exceed 10%.

Now suppose we introduce tiers with boosts of voting power and rETH2. Assume we have 2 tiers: boost 1.5x for the “higher tier” and keep 1x for the “lower” tier. Three questions come to mind:

  1. How will this affect the earnings of both tiers?

I foresee several scenarios - i) everyone just keeps $SWISE in the higher tier for a max 10% APR, ii) a mix between higher/lower tiers exists where the lower tier likely earns <5% APR, and iii) staking only happens in the lower tier for a max 10% APR.

  1. How will this affect the $SWISE allocation in the higher tier?

Does voting power boost come from earning extra $SWISE, or from a multiplier? If it is the former, the DAO must vote to allocate some supply to it; if it is the latter, no action is needed.

  1. What would a tiered system achieve for the protocol and $SWISE holders?

In my opinion, it is better for the protocol and slightly worse or neutral for the $SWISE holders. Looking at point 1, a two-tiered approach would likely achieve the locking of $SWISE for longer in exchange for the same amount of rewards as before, benefitting the protocol. For $SWISE stakers, it is likely to be a worse deal than the one originally proposed, since locking the token for longer would be required to achieve the same outcome.

If you do not have SWISE in either of the two pools, you do not have a governance vote.

I think this requirement would depress APR from staking $SWISE quite significantly, but that mgiht be offset by the positive effect on the price of $SWISE. Example:

  • Many people stake $SWISE to have a vote in the protocol → APR strongly declines → $SWISE supply declines + token price and FDV/TVL rise → farming incentives get better → TVL grows + APR picks up → FDV/TVL normalizes

The two key assumptions, of course, are that a reduction in $SWISE supply causes a price increase, and that a sufficient boost to TVL can be achieved as a result. How realistic is that? You tell me.

So bottom line: I’d say that since we’re trying to optimize for the protocol, a tiered system could work, but definitely requires better specification than outlined in my example. I would explore the tiered idea further, but I am not sure about limiting voting to only those who stake $SWISE.

@Sebastian_Bach I love the idea of utilizing staked $SWISE for additional revenue-generating opportunities. This is capital efficiency at its finest. My only concern is that if we use $SWISE as collateral to borrow stables, a potential slashing event could cause an automatic liquidation of collateral because $SWISE is likely to negatively react to the news about slashing, initially at least.

Of course, the devil is in the details - what is the chosen collaterization ratio, what is the price reaction etc. While we could probably model these out, we need to be prepared to make this someone’s full time job, considering the potential size of this float, a dynamic environment and the consequences of negligence.

One alternative would be to stake not $SWISE, but the LP tokens of $SWISE/ETH liquidity pool somewhere, and use them as collateral in a lending protocol. The drawback, of course, is that the capital requirement for insuring the protocol doubles, yet the advantages are 1) we significantly mitigate the risk of undercollaterization of staked $SWISE, and 2) we create an abundance of liquidity for the token. I also think that the proceeds from borrowing and putting proceeds into yield aggregators should also accrue to $SWISE/ETH LP token stakers, as means of compensating them for the increased capital requirement.

The $SWISE/ETH liquidity pool could potentially also be awarded more $SWISE by the DAO, attracting opportunistic ETH into the Pool, which would imply buying $SWISE by these LPs.

I’d want to model this out before authoritatively saying whether this could work or not, but on the surface it sounds doable.

Let me know what you think guys, and I’d also greatly appreciate some help with the modeling :slight_smile:

3 Likes
8

The $SWISE/ETH liquidity pool could potentially also be awarded more $SWISE by the DAO, attracting opportunistic ETH into the Pool, which would imply buying $SWISE by these LPs.

I think this is a good idea, perhaps somewhat less than the sETH2/ETH pools (to incentivize staking/keeping the peg) but still rewarded with $SWISE to incentivize the LP as well.

I believe achieving ~5-10% APR on 10% of the supply staked is possible. The amount of $SWISE staked and the premium on rETH2 will be determined by market forces, so the eventual APR on providing insurance is hard to predict. However, my bet is that it won’t ever exceed 10%.

I would not expect most of the supply to be staked though, most users just trade or hold unless staking incentives are extremely attractive.

Now suppose we introduce tiers with boosts of voting power and rETH2. Assume we have 2 tiers: boost 1.5x for the “higher tier” and keep 1x for the “lower” tier.

Out of curiosity, has this been implemented in other popular dApps? seems interesting but I wonder what effect it would have on the users’ choices.

Overall though, the idea to stake $SWISE as protection against slashing seems like a really innovative one to me. Not sure if something similar has been done before for other staking protocols but I like it.

9

This seems tablestakes. You don’t want FUD to crash the price of the token, otherwise in the event of a failure we’re risking a large amount of governance capability to be fire-sold for cheap.

Selling a governance token due to slashing sounds like good long-term incentives too. The negative can be thought that a slashing event may crash the price and allow people to buy SWISE for the cheap, therefore accumulating large voting powers for cheaper than the rest of the community. But this also makes some sense, because you want to have a long-term mechanism that allows the governance community to recycle itself if the previous one did not do things well enough to result in slashing. That being said, the current set of governance members don’t have any control over how we control the validators.

2 Likes
10

Thank you for the discussion boys. To your points:

@dreth I agree with the points you make regarding usage of the token and keeping potential $SWISE rewards lower than for the sETH2/ETH pool.

Out of curiosity, has this been implemented in other popular dApps? seems interesting but I wonder what effect it would have on the users’ choices.

Time-based locking was popularized by Curve and seems to work really well there. Ours would be a blend of their approach (increase rewards depending on the duration of lock-up) and our application (slashing insurance vs voting).

@stanislavkozlovski excellent point about the recycling of the community in response to poor variable choices that led to a slashing event.

That being said, the current set of governance members don’t have any control over how we control the validators.

I would say that early-on there is indeed little control over the validators by the existing community, owing to just the core team running them. However, this will change once we as a DAO start considering other node operators for inclusion into the protocol.

Admittedly, it would still rely on the team’s success in building a fail-proof backbone for efficient decentralization (akin to the Secret Shared Validators), yet the DAO’s control over this too could be discussed/implemented if necessary.

2 Likes
11

Why would Swise stake be rewarded with rETH2, isn’t that going to require taking that from the sETH2 pool, therefore driving down the APR for stakers?

Also, I believe an auction is the wrong course of action after a negative/black swan event. If I’m on the outside looking in, and I just heard that Stakewise got slashed, I am also thinking to myself Swise is in the same boat (same protocol right). So in that situation, water levels drop on both tokens. If I am in the market, and see a token is going to auction which just had bad press, I am not going to want to pay par or a premium, I am going to want a discount, and who knows how long that “bad news” discount would be priced in. This puts the DAO between a rock and a hard place, do we sell at a discount to honor our insurance etc. I could see this spiraling out of control.

Instead, is there a way to have the staked Swise immediately swapped for a stablecoin or something else immediately following a black swan event? There may be a slight discount paid in this situation, however it mitigates anymore downward pressure, the “insurance claim” is essentially locked immediately and it no longer matters if Swise continues in a downward spiral, eventually it will hit a floor, insurance will be paid back to stakers, confidence is lifted and eventually with that the token prices rise again. Rinse and repeat.

I would think that it would have to be fairly lucrative for me to put up a stake, expecting that if shit hit the fan I may lose that stake. 10% APR is not gonna get it done. How can we get the returns much higher and still accomplish protecting statkers? Is there a way to insure the insurance? :laughing:

2 Likes
12

Can you clarify what would happen in case of slashing? Would stakers lose sETH2 or rETH2? Or both, maybe rETH2 first followed by sETH2 if there is no rETH2 left?

1 Like
13

Just wanted to make this observation, though it is one that I am sure many in the Stakewise community have already considered. sETH2 represents the original deposited ETH ( e ), plus the risk ( r ) of slashing, plus the promise of rewards ( w ). w has to be calculated with the time ( t ) one plans to hold sETH2 times the apy for the period of time sETH2 is held. Although apy may go up significantly as ETH moves into Proof of Stake, w will likely never rival the potential of r, which is up to 100%, although we all agree it is far short of 100% due to the professionalism of the Stakewise team with which we are working.

I’m sure one of you can state this better than I am here, but this means to me that the value of sETH2 looks something like:

sETH2 = e - r + w

I think this is borne out by the members of the community who have already tried to swap their sETH2. It does not seem likely that they have achieved a 1:1 ratio so far. Why is that? If you have held sETH2 from the time it was staked, you have not lost any rETH2 rewards. You made the conscious decision to value w over r. But, if someone offers to sell you their sETH2 now, you have not profited from rETH2 to date, and there is currently no additional SWISE incentivization, so the calculation has to include a lower value for w, the same value for r, and the lack of SWISE reward. So, for me, that means I actually would expect to pay a discount of 10-20% for the sETH2 at this moment. I don’t say this to be negative, but to point out the reality we are working against to achieve a 1:1 peg.

For the market in general to value sETH2 on a 1:1 peg with ETH, Stakewise DAO needs to insure against r enough that r =< w. I think that means we need to both incentivize holding sETH2 and insure against the risk of slashing. One question I have is if SWISE can be tasked with both of those fuctions (insurance and incentivization) or if an additional mechanism will be needed outside of SWISE. Perhaps a boost to rETH2 returns for staking or LP providing, or access to an auto-compounding gauge, or something the Team has already come up with or that one of you will offer as an idea.

1 Like
14

I think just the staked ETH, so sETH2, essentially, or at least what the sETH2 represents.

1 Like
15

#bump with 20 characters :slight_smile: