Risks of Anchor protocol - mitigation and potential solutions

Alan Au

Published in

Coinmonks

8 min readApr 5, 2022

Anchor Protocol Risks and Mitigation

UST depeg risk for all players in the system. Mitigation: a. build up Bitcoin reserve, b. buy insurance, c. hedge Luna price crash.
Lower deposit APR for depositors. Mitigation: a. governance vote to lower deposit rates, b. attract more borrowers, c. expand collaterals options.
Smart contract risk. Mitigation: buy insurance.
Oracle risk. Mitigation: buy insurance.
Liquidation risk for borrowers. Mitigation: hedge collateral price downside.
ANC price risk. Mitigation: a. hedge, b. buyback.
Impermanent loss for ANC liquidity provider. Mitigation: dynamic hedging.

Ideal world

To start, let’s imagine an ideal world where the borrow demand catches up with deposit. We provide a break-even scenario below to illustrate how Anchor can operate sustainably in this ideal world. Assume there is still $10 billion deposit in the protocol. Borrow demand catches up to reach $5 billion. Assume LTV ratio stays at 0.5 i.e. collateral value of $10 billion. Using the utilization rate of 50% (borrow / deposit), we come up with borrow rate of 23% (50% x 0.42 + 2% base rate =23%). If we assume 8% staking yield for the collateral, we calculate that Anchor generates $1.95 billion annual revenue from the borrowing side ($5 billion x 23% + $10 billion x 8% = $1.95 billion). On the deposit side, APY remains at 19.5% and Anchor pays out $1.95 billion as an expense, perfectly offsetting the revenue

Net Income = collateral x staking yield + borrow x borrow rate (borrow demand impacted by ANC price) -deposit x APR

Now the question is how likely we can get to this ideal world. As of the time of this writing (3/27/2022), borrowing value is only at $2.8 billion implying a utilization rate of merely 0.25. When utilization rate is low, borrowing rate is set to be low further exacerbating the bleeding. What can Anchor do to improve its net income profile? There are basically 3 ways to achieve this and each way faces its own challenge.

1.Strong ANC token price is needed. Borrowers are incentivized with ANC tokens. The higher the ANC price, the higher the incentive and the distribution APY. This is however the tricky part. ANC price is determined by market supply and demand. As we discussed previously, total supply of ANC tokens will be increased from ~400 million as of today to 1 billion in the next 4 years. The oversupply situation will continue to dominate the market sentiment and hence suppress the price. Anchor introduced a buyback program to offset the supply but the total amount of buyback has been minimal so far (only 14 million buyback vs total ANC market cap of nearly $700 million). Can Anchor increase the buyback amount? To answer this we need to understand where the buyback money comes. Essentially it comes from the 10% of protocol fees which is the sum of bAsset staking rewards, excess yield and collateral liquidation fees. bAsset staking rewards correlates with total collateral and borrow demand. Excess yield is not achievable so we can assume it is zero for now. Collateral liquidation fees depend on total collateral value and market conditions (the more volatile the crypto asset price the higher chance of collateral liquidation). Below we provide a simple calculation to estimate the total buyback amount which is very close to the actual number. Unless Anchor changes the buyback mechanism, it is unlikely to increase the buyback amount. Recently we saw ANC lose more than half of its value to as low as $2.5, which has significant impact on borrowers’ incentives. Since the beginning of March, total deposit has increased by more than $2 billion while total borrow & collateral value hardly changed. Part of the reason was the weak ANC price.

Here we are witnessing a negative feedback loop: (1) lower ANC price -> (2) lower borrowers incentive -> (3) less demand in borrowing and lower collateral -> (4) lower borrowing rate -> (5) lower revenue from borrowers, and lower staking revenue -> (6) faster yield reserve depleting -> (7) unsustainability of 19.5% deposit APY.

2.Higher staking yield is needed. Other liquid staking derivatives need to get onboard to attract more borrowers into the ecosystem and potentially generate higher staking yield with different tokens. The problem is the other staking derivatives may not have the same amount of liquidity as Luna or ETH hence limiting the value of collateral to be posted. Post Ethereum 2.0, ETH staking yield will likely double meaning more revenue for Anchor. For now ETH % of total collateral is still below 20% so Anchor needs to attract more ETH owners to the ecosystem.

On 3/20/2022, sAVAX (staking token in Avalanche ecosystem with staking yield of ~9.5%) was whitelisted as the 3rd collateral to further broaden borrowers’ options. If sAVAX collateral can grow in size, it will help mitigate the protocol’s burning rate. As of today, Anchor has attracted $10 million collateral to the protocol vs total staking AVAX amounts of $220 million.

3.Deposit rate needs to go down. The will require governance vote. The owners of ANC tokens are mostly borrowers who receive ANC as incentives. Those borrowers are depositors as well and it is unlikely they vote to change to a lower deposit APY. Poll 18 was such an effort to adjust deposit rates lower but got rejected by a huge margin.

(While I was writing this post, a new proposal Poll 20 was passed to implement a semi-dynamic Earn rate. Basically under the new rule, the deposit rate will be reduced by a maximum of 1.5% each month starting from May 2022 if the yield reserve continues to decline by more than 1.5% each month. The minimum deposit rate is set at 15% (minimum earn rate can be adjusted through governance proposals) which will be likely to be reached by July 2022. The new rule will help reduce the daily burn rate by $1.4 million post July 2022 using the most recent $11.5 billion deposit value.)

Borrowers and Oracle Risk

In our previous post we discussed briefly how the oracle mechanism works in the Terra blockchain. The oracle price feeds down to the Anchor protocol as well to facilitate liquidation process when it happens. Can oracle price be manipulated or be inaccurate due to some systematic issue? Can the oracle mechanism be attacked? Let’s look at the oracle issue happened on 12/9/2021. On that day, Anchor oracle price feeder registered a bLuna price of almost 10% lower than the price reported in off-chain exchanges, which led to $27 million bLuna liquidation that was not supposed to happen. Over 240 borrowers were impacted and $8.6 million was reimbursed to them. Anchor team has since implemented a fix to replace Anchor oracle price feeder with sourcing directly from Chainlink (bLuna/Luna).

While this demonstrates the transparency of the protocol and the prompt response from the Anchor team, it also shows the vulnerability of oracle price feeding mechanism. Oracle price voting is the critical component of Terra ecosystem. Oracle votes did not have priority over other transactions in the block and it was easy to be attacked via a DDoS (distributed denial-of-service). On 9/23/2021, such an attack targeted Terraform Labs’ full nodes causing the network to be congested. As a result of the attack, price data failed to be updated. Luckily it didn’t cause too much pain as it happened on Friday and Terraform Lab team responded swiftly to address the issue. Imagine if this happened during the most extreme sell-off environment, the amount of inaccurate collateral liquidation could significantly hurt the borrowers and the on-chain UST/Luna swap could fail to operate to depend the 1:1 peg.

Mitigation and Insurance

Are there any ways to mitigate the aforementioned risks? There are actually various insurance products available to protect the depositors and borrowers. Nexus mutual covers events such as small contract hacks, oracle or governance attacks. Protection buyers pay 2–3% per year to cover these kinds of protocol risk but UST de-pegging isn’t part of it. Unslashed (another insurance provider) covers UST de-pegging event but only when UST trades below 0.87 and you pay 2–3% per year. Both Nexus mutual and Unslashed are decentralized protocols and protection buyers should study the terms first before buying.

Terra also introduced its own insurance product called Ozone to cover risk events such as users not being able to withdraw money from UST savings accounts in the Anchor protocol. It was taken over by Ethereum-based DeFi risk management market place Risk Harbor in November 2021. As of this writing the AUM in Ozone is about $10 million.

Final thoughts

To recap we provide a table below to summarize the risks and solutions from each player’s perspective.

Buying insurance could be one way to mitigate the risk but it also exposes users to additional insurance protocol risks. The insurance premium is driven by supply and demand and when the demand is high it quickly becomes a very expensive solution. As we show in the below table the most significant risks faced by depositors and borrowers are related to Luna price crash. In order to help you sleep well while investing / borrowing in the Anchor protocol, one feasible way (also straightforward way) is to simply hedge out the downside price risk of Luna either through futures or options. This is what we do at AlgoTune — identify & mitigate risks.