Daos Ex Machina: An In-Depth Timeline of Maker’s Recent Crisis
On March 12th, MakerDAO faced its single worst day in history. Against a global cascading monetary crisis, the value of ETH plummeted over 50%. This tipped off a cascade of liquidations across trading venues, DeFi protocols, and resulted in massive network congestion. MakerDAO, most of whose collateral is in ETH, had the unbelievable task of somehow having to liquidate 10x more loans in 24 hours than it had seen in its entire lifetime.
To understand how Maker made it through this crucible, we must first walk through this series of events and peel apart each layer of the stack.
1 AM PT, March 12th. ETH @ $171. Liquidations begin.
As the price of ETH began to slowly draw down, liquidations proceeded as normal on the MakerDAO platform. A drawdown in collateral price is no big deal. Some ETH investor or Maker vault holder panic aside, it’s important to remember that the MakerDAO protocol was intentionally designed to withstand massive drawdowns in the value of the collateral. In fact, it survived the 90%+ drawdown of ETH in 2018 with DAI only barely drifting from its $1 peg! Because every loan on MakerDAO must be substantially overcollateralized (at least 150%), there’s ample buffer for liquidators to step in and seize risky loans, keeping the system solvent. This system is covered in great details in my previous post on liquidators.
Of course, liquidating undercollateralized loans is unexceptional. Centralized and decentralized exchanges alike do this routinely with ease. The question is: what happens when the value of the collateral drops so quickly or becomes so toxic that the loan becomes undercapitalized? That is, the value of the collateral falls below the value of the loan, meaning the borrower is better off just walking away, leaving the lender in the red.
Centralized exchanges generally cover such a loss through insurance funds or socializing the loss across market participants. But what happens in a decentralized protocol? While some protocols such as Compound mimic centralized exchanges and keep an on-chain insurance fund, Maker takes a different approach. If the system becomes undercapitalized, Maker recapitalizes by printing and auctioning off new MKR, the governance token. This MKR is sold off for DAI, which is burned until the system is recapitalized. Bidders can submit lower and lower amounts of MKR they’re willing to accept for a fixed amount of DAI, until the highest bidder wins and the system debt is repaid.
Maker’s auction mechanism was designed knowing that system debt was possibility. But this auction makes a few assumptions: that bidders will make reasonable bids during reasonable market conditions to plug reasonably small holes. In the abstract, that all sounds fine. But the panic of Black Thursday threw those assumptions into stark relief.
5 AM PT, March 12th. ETH @ $130. The system debt starts.
Things begin to go off the rails as the drop in ETH price accelerates.
Instead of liquidation prices closely tracking the market price of ETH, they start to fall and fall and fall with no backstop holding them up. Instead of simply repaying borrowers the value of their collateral minus a small penalty, many lucky liquidators walk away with free ETH as they win auctions with $0 bids, leaving borrowers with nothing other than the Dai they’ve withdrawn. Worse yet, these heavily-discounted liquidations are leaving holes in Maker’s balance sheet — it is starting to have less ETH in collateral than it should to fully back the Dai that’s been minted. For the individuals unlucky enough to have been liquidated this way, panic starts to set in via community message boards.
To understand why these $0 bids are happening, we need to first take a look back through Maker’s history. For those familiar with the old “Single Collateral Dai” Maker system, you may know that Maker previously implemented a 13% penalty on liquidations. That is, liquidated borrowers received back 13% less than what was deposited, with 3% going to the liquidator and 10% going back to the Maker system. However, this system is relatively inflexible and potentially underly (or overly) punitive, and was replaced with a collateral auction (“flip”) in Multi-Collateral Dai. This new flip auction takes place in two parts:
1.Minimum Satisficing Value Phase
In the auction, liquidators bid a larger and larger amount of Dai for a fixed amount of ETH until a minimum amount of Dai is hit.
These bids:
- must come within a fixed time window of the previous bid
- must be larger than the previous bid by a fixed amount of Dai
- must come in before the auction is over
Once someone comes up with the minimum satisficing value, the second phase begins.
2. Value Maximization Phase
In the second auction phase, liquidators bid on a smaller and smaller amount of ETH that they’re willing to trade for the amount of Dai set in the phase. With similar mechanics as above, bidders continue to bid until the auction expires, when the winner walks away with some discounted ETH!
In theory, this system works better than a fixed penalty, by letting the market dictate the value of the liquidated collateral, allowing it to expand and contract based on overriding market conditions. But as we’ve seen time and time again, black swan events can force markets to go off the rails, as was the case on Thursday.
Maker’s flip auctions were no exception. Winning flip auction bids were always a bit lower than market due to volatility, but started to bottom out in the afternoon. Winning bids trended lower and lower below market ETH price until finally, in the blackest of all swans, liquidators started winning ETH collateral with $0 bids, effectively walking away with free ETH. Borrowers were unable to redeem their DAI and get their vaults back. Maker system’s debt began to grow, ballooning to over $5MM.
Why did this happen?
Under normal market conditions, any rational actor should see the winning $0 bid sitting there and be willing to bid $1 (at the least) to scoop up some extremely cheap ETH. But two key factors exacerbated a system already under stress on Thursday afternoon.
Blockchain Network Congestion
Blockchain transaction bandwidth is a shared resource, and its price is set by supply and demand. Network congestion on Thursday caused transaction prices to spike to >10x their normal cost, creating price drift on exchanges as arbitrageurs could not quickly arbitrage price mismatches. It became infeasible for low value transactions to get mined in a timely manner. In the case of Maker, some users tried to enter counter-bids against $0 bidders, but they did not get mined in time due to the congestion, which let the auction end prematurely. We can see that at one point, the average winning bidder paid almost 1000 gwei, or 100x the standard Ethereum tx fee, to get mined. Even average users were stuck trying to resubmit their interface over and over again on clunky interfaces just to save their vaults.
All of this congestion actually slowed the liquidation process because price updates from the Maker oracles weren’t getting mined. Interestingly, this probably prevented an even worse scenario because it acted as a kind of circuit breaker on ETH liquidations. As a result, several liquidations took place much later than they should have.
Dai Illiquidity
Dai can be acquired in one of two ways: by committing ETH in a Maker vault and minting Dai as debt against it, or by purchasing some Dai on an exchange. Normally, this works fine — one can go on Coinbase and trade USD for Dai with minimal slippage, or just purchase Dai via Uniswap. However, on Thursday, Dai liquidity began to dry up as more and more Dai was redeemed and burned for ETH collateral in auctions. Additionally, fewer and fewer users willing to place down ETH to mint Dai for risk of being liquidated amid all the volatility. As a result, the floating Dai supply dwindled and became extremely scarce, trading at a peak of $1.12. This meant that even for liquidators who were willing and ready to liquidate, they simply could not source enough Dai to purchase and use for the liquidation.
We can see bids shrinking starting at 3 PM, with fewer and fewer liquidators being able to participate, until finally only three liquidators remained. Each of those liquidators won several $0 bids and left the Maker system $5.3MM below its target collateralization threshold.
6 PM PT, March 12th. ETH @ $100. The $5.3MM Fix.
At this point, the hole in the Maker balance sheet was significant and growing. Maker went into crisis mode. The Maker team called an emergency meeting with the community to discuss potential solutions, split into two workstreams:
- How do we plug the leak and prevent this hole from getting bigger?
- How do we most effectively fill this hole?
Plugging the Leak
Dai Liquidity
The biggest problem causing these $0 liquidations was the lack of Dai liquidity. Dai’s illiquidity made it harder to maintain the Dai peg and created greater slippage for liquidators trying to source Dai. The Maker risk team ultimately proposed two separate changes to address this:
- Reducing the Dai Savings Rate (DSR) to 0%, which would reduce demand for Dai and hopefully lower its price, bringing it closer to the peg.
- Adding USDC as collateral for Maker, allowing Dai to be minted in an extremely low-risk way in times of extreme illiquidity.
For DeFi purists, this last proposal sounds sacrilegious — USDC, a centralized stablecoin, would now deflower the immaculate splendor of MakerDAO! Many talking heads claimed this change would be the death knell for Maker. In reality, this move — adding real-world assets as collateral, including USDC — has been foreshadowed by the Maker core team for many months, and Thursday’s situation simply accelerated the timeline.
These arguments have sown widespread confusion around the purpose of USDC in MakerDAO. USDC is not intended to be a core piece of collateral on Maker. After all, why would I want to take out a USD-denominated loan against my… USD? Instead, USDC is intended to strictly serve as a utility to help mint Dai for liquidators in need of liquidity and to help keep Dai pegged to $1 when it floats above it. Savvy traders can take out a Dai loan, sell it for USD, and buy back Dai when it settles back to a dollar. The fact that USDC-backed loans in the Maker system have an extremely high interest rate of 20%, 40x higher than the 0.5% levied against ETH loans, is a testament to this.
Auction Robustness
The other core issue that caused Thursday’s debt was the auction mechanism itself. Had the auction run longer or other parameters been tweaked, additional bidders may have been able to scrounge up some Dai and raise the price of the collateral auction, but the auctions were too short in duration. Due to network congestion, single bidders were able to win the auction before competitors could counter-bid. In order to make these collateral auctions more resilient to the face of network congestion, two changes were proposed by the Maker risk team:
- Increase the time from the last bid to auction close from 10 minutes to 6 hours, allowing additional bids to enter when the network is congested.
- Increase the auction size in ETH from 50 ETH to 500 ETH to reduce the number of transactions and consolidate bidders. Now, instead of bidders placing 10 bids on 10 different auctions, they can place 1 bid on 1 auction for a consolidated pool of collateral.
There’s a lot more to do to make auctions simpler and more robust, but these two changes seem to be working in increasing the efficiency and competitiveness of auctions.
Filling the Debt Hole
With all these mitigations in place, there’s still the problem of the $5.3MM disparity between the amount of collateral in the Maker system and the amount of Dai issued. How could the system address this? There were three options:
- Emergency Shutdown
Maker’s nuclear option is always on the table. In an emergency shutdown, all Dai would be frozen so that it could only be used to redeem Maker’s underlying collateral. After some discussion, given that the debt hole was reasonably small, this option was ruled out.
2. Have the Maker Foundation repay the debt
The Maker Foundation could simply send ETH back into the system to repay the debt and make the system whole. While it’s true that this would have solved the problem, it in some respects violates the tacit social contract of the system.
MKR holders extract fees from the Maker system, but in exchange, they must backstop the system’s solvency. So in a situation like this, it should be on MKR holders to pay for it — after all, in normal times they are compensated precisely for taking on this risk. If the Maker Foundation simply swoops in and pays down the debt, it calls into question the purpose of MKR and whether the protocol is truly decentralized.
3. Mint and Auction MKR to repay the debt
Luckily, the Maker protocol is designed to heal itself in the event of a loss. 48 hours after debt is created, new MKR is automatically minted and sold off for Dai in a series of reverse auctions. These auctions continue until the entire debt is recouped. If the clearing price of these auctions is not similar to the market price, more and more MKR will be minted to fill the hole and MKR holders may face massive dilution.
Many realized that massive dilution was a very real possibility: amid widespread market panic, it was unlikely the auction would clear at a reasonable price. On top of this, even if there were many actors who wanted to participate, the lack of Dai liquidity would make it difficult.
As a result, a proposal was made to delay the MKR auction an additional 4.5 days until the market settled down and the Dai liquidity problem was solved.
12 AM PT, March 13th. ETH @ $120. Voting begins.
An executive vote is proposed, MKR holders are rallied, and a bundle of the proposed changes, minus USDC collateral, are passed.
March 13th — March 19th. Preparation for the auction.
Amid widespread market panic, a small group of participants begin to prepare to bid in the auction. First, bidders must gather enough Dai to make their bids. This was difficult until over $10MM USDC entered Maker’s contracts and Dai was minted against it, bringing the peg back in line and returning liquidity to the markets. Additionally, bidders must bid on MKR in lots of 50,000 Dai. While some larger funds such as Paradigm pledged $5MM to bid in the auction, smaller buyers were priced out. And then of course, there were the technical hurdles — bidders had to run their own Maker “auction keepers”, off-chain bots that monitor the auctions and place bids.
In response to these issues, a decentralized “Backstop Syndicate” popped up and announced that they would use their pooled funds to commit to being the MKR buyers of last resort, pricing their backstopped bids at $100 / MKR. Anyone could join into the syndicate, simply placing Dai in a shared smart contract and relying on a shared keeper bot to place bids in the auction. Over 350,000 Dai was deposited to “backstop” MakerDAO. While none of the last resort bids was ever hit, it underscored the grassroots support for Maker, and how crucial Maker is to the broader DeFi ecosystem.
The Maker Foundation did their part as well, building out a custom UI, which would make it easier for investors to access the auction.
7:30 AM PT, March 19th. ETH @ $126. The auction begins.
With six days to prepare, bidders were able to come out and demonstrate a good show of demand as the MKR started to sell off. We saw the price of auctioned MKR closely track MKR in spot markets, with over 30 unique bidders participating. This is likely less than the actual number of participants, as the Maker foundation volunteered to place bids on behalf of participants who were unable to do so.
While the auctions are still ongoing, we’ve so far seen 17,630 MKR minted and sold to cover $4.3MM in debt, an inflation of about 1.7%.
Where do we go from here?
Every crisis in retrospect becomes an opportunity to learn and improve. So, what can Maker learn from this crisis, and should we expect it to be more resilient in the future?
We need better risk modeling and threat analysis
Many of the problems that surfaced in Maker’s system on Thursday were not immediately apparent when the system was first designed. When these systems are exposed to an anonymous set of financially-incentivized actors, emergent properties can manifest in a way that is not immediately predictable to their creators. While it’s generally fine for Maker to have started with a first-cut design and iterated on it over time, it now has hundreds of millions of dollars at stake and unpredictable external incentives. Now, Maker needs a more rigorous approach. Eyeballing it with simple models is no longer sufficient.
Take Compound Finance, a decentralized money market, as an example: using agent-based simulation from Gauntlet, they discovered that in times of high market volatility, there might not be sufficient liquidity on decentralized exchanges to profitably liquidate risky positions, putting the entire system at risk. These kinds of insights can only be gleaned through sophisticated risk modeling.
We need better tooling and data
Another problem that exacerbated the debt and aftermath on Thursday was simply the lack of transparency into the system. It took too much time to understand what was happening and even longer to diagnose why. It took many actors from across the Maker ecosystem to pull and piece together data transaction logs and mempool data to reconstruct the timeline of events. Even once the $0 bidding problem was understood, there was another hurdle: it was difficult for new auction bots to get spun up because the Maker codebase is notoriously opaque and hard to work with. For example, the MKR auction website didn’t even exist until it was frenzily built before the MKR auctions began, which would’ve prevented non-technical users from bidding in the auction.
Improving Maker’s legibility and accessibility would help immensely. Maker needs more diverse participants if it hopes to become more resilient.
We need better risk management tools, hedging, and insurance
Beyond top-line improvements to the Maker system, there’s a broader question of how we can make crypto markets as a whole more robust and immune to tail-risks. Some have called for reforms in the broader crypto market structure, but DeFi is a different beast and requires its own solutions. One can imagine that a more diverse, uncorrelated basket of underlying collateral could have partially mitigated the Maker drawdown. Consider a vault that contained not just ETH, but assets that were inversely correlated with ETH such as ETH puts or sETH, creating a portfolio that more closely approaches market-neutral. While we saw tightening correlation across all asset classes in the recent sell off, adding uncorrelated synthetic assets to Maker vault collateral improves safety for the whole system.
And then there’s the people whose vaults were liquidated for $0 — they effectively had their owed collateral stolen from them. While Maker was not technically hacked, the outcome for these users sure feels like they are victims of something. By using the right insurance instruments, these kind of risks could be hedged against, giving greater confidence to end users. Just as dozens of Compound users have insured their Compound deposits using decentralized options on Opyn, one can imagine Maker vault owners purchasing similar options to sell the value of their vaults at a particular market price. This would allow a network of financially-incentivized underwriters to assess the risk of Maker and price and reallocate the attendant risk. Options also have the added flexibility to cover payouts in ambiguous situations in contrast to more traditional insurance products like Nexus Mutual, which refused Maker claims from Thursday.
As Maker completes its round of its Hero’s Journey, there’s no doubt that it has returned changed in many ways and hopefully more resilient. However, Maker still has room to improve as it cements its role as the global credit facility underpinning DeFi.
Big thanks to Teo Leibowitz, Fredrik Haga, and Dune Analytics for their help in preparing data for this article and Haseeb Qureshi for editing.
