What PoS and DeFi can learn from mortgage-backed securities
“I find it in the idea that it is the function of the rate of interest to preserve equilibrium, not between the demand and the supply of new capital goods, but between… the demand for liquidity and the means of satisfying this demand.”
— Montesquieu
The financial crisis of 2007 was one of the first moments since the 1929 stock market crash when Americans viscerally understood the phrase, “liquidity is king.” Devastating losses occurred in almost every market but were most pronounced in what was supposed to be the safest, government-protected market — real estate. Cryptocurrencies were born in the ashes of this crisis, promising censorship resistant money whose supply could not be wantonly manipulated by governments.
And yet today, the cryptocurrency world is living in a deluge of leverage provided by centralized and decentralized venues. This leverage often comes at a cost — a lack of liquidity when market conditions seize up and margin calls flood exchanges, custodians, and smart contracts. Why do people need so much leverage, and what causes these liquidity crunches?
To explore these questions, this post will focus on leveraged decentralized finance (DeFi) protocols and network-provided leverage on Proof of Stake (PoS) coins, commonly known as staking derivatives. We posit that many leveraged crypto products look a lot like the villains of the 2008 financial crisis. Our motivation with this comparison is not to condemn DeFi or PoS. Rather, we point to specific opportunities for these protocols to do better. But we also posit that, left unchecked, the same risks are liable to surface in crypto markets.
Particularly important is the risk that certain market participants become “too big to fail.” But what might too big to fail look like in crypto? Imagine a world where Binance is overleveraged due to borrowing heavily against on-chain assets under its management. As these assets begin to get massively liquidated, like Maker liquidations during Black Thursday, Binance can push for a DAO-style fork to save itself from liquidation. Such a fork resembles a bailout, akin to those following the 2007–2008 financial crisis.
We attempt to model these and other risks in our recent paper on staking derivatives. We discuss not only PoS networks, but also DeFi protocols (Aave, Compound, and Synthetix) and analogize their characteristics to those found in traditional securitization structures.
What are staking derivatives?
First, let’s understand why staking derivatives exist.
PoS coins aim to replace the energy guzzling hash power of Proof of Work (PoW) with security provided by locked cryptoassets. While PoW forces you to ‘lock-up’ energy and hardware, PoS forces you to lock up capital. But how are they different?
A key difference comes from liquidity restrictions. In order to ensure that the network has liveness — can keep accepting transactions — Proof of Stake networks force users to lock their stake up for a long time. By having capital locked up, the network can enforce punishments, called slashings, when validators perform malevolent actions. For example, if the network needs nodes to be online 99.999% of the time to ensure liveness, it may slash validators who are not online during a block that they are chosen to produce.
On the other hand, PoW miners lock up their ‘stake’ by spending upfront capital on mining hardware, which they repay as they earn block rewards and fees. Given the upfront cost of hardware, miners tend to have liquidity issues as they wait to amortize their machines and earn a profit. Should a miner’s expenses go up, say due to increased energy costs, they may have to borrow cash to pay for electricity. Currently, miners execute such loans by borrowing against earned coins. In theory, they could use their mining hardware as collateral to borrow cash. However, Anicca Research’s Leo Zhang reports that thin secondary markets for mining hardware make lenders skittish of accepting machines as collateral. Instead, miners directly borrow against their coins, which has been a major contributor to the explosion in leverage provided by lenders such as BlockFi and Nexo.
In Bitcoin, miners receive earned coins every 100 blocks (~16.6 hours), so coins are readily available. This is harder to do in Proof of Stake, where many protocols often specify that coins are locked up for weeks or even months. To make access to liquidity for PoS validators similar to that of PoW miners, developers have proposed staking derivatives. These derivatives let you borrow by issuing a synthetic asset backed by your locked stake, giving you partial liquidity. The synthetic asset is priced such that it is never worth more than the underlying borrowed asset and loses value when borrowers ‘default.’ In the simplest case, default occurs when a validator is slashed and falls below a minimum collateralization level. The network would then appropriate the validator’s stake and redistribute it as fit.
But how does the network determine the price at which the validator can borrow? The key parameter is the derivative pricing function. Let’s consider how two parties would mechanically execute such a loan. Imagine a borrower going to a lender who looks at the PoS chain to see the borrowers’ balance. If the borrower’s request and balance are satisfactory, the lender can give the borrower the token loan, add the loan to their loan book, and recompute the price. Keeping track of the price is important, as it allows the lender to price any subsequent loans accurately. The lender then continues to monitor the chain. If the borrower is slashed, the lender updates their loan book and the price. At the end of a lock-up period, the lender can make a capital call for liquidation and/or assess the price that the borrower has to pay. However, all of these steps rely on the lender being able to trust that the borrower will repay the correct amount at the end of a lock-up period.
But all of these transactions could be executed through a smart contract. In fact, the smart contract could directly interface with the PoS protocol’s consensus algorithm. Such a contract could monitor slashes and compute the derivative pricing function. Moreover, we can let the market price the derivative by using a constant function market maker (CFMM), such as Uniswap. This interaction between consensus and DeFi protocols demonstrates the improved capital efficiency that can take place when consensus protocols can interact with the smart contract application layer.
Many of today’s PoS networks do not support this functionality natively, which might make it seem odd that one can borrow from the network itself. However, a number of new networks such as Celo, Terra, and Facebook’s Libra implement their consensus algorithm as a smart contract executed by a distributed virtual machine. In these systems, consensus is a first-class citizen and can be upgraded to interact with other smart contracts. Moreover, DeFi contracts can interact with consensus and read the current state of the system to determine if default events (e.g. slashings) have occurred. For example, Celo’s blockchain implements a CFMM that is used for the consensus protocol to manage the stability of their algorithmic stablecoin. Their live protocol effectively has staking derivatives built in!
But is all of this borrowing safe? After all, PoS networks achieve security proportional to the amount of capital staked. That is, it costs 33% or 50% of the staked capital to perform a double spend [0]. By borrowing against a staked asset (a form of rehypothecation), one gains leverage on their capital as they’ve taken X coins and have the power of X+Y coins, where Y is the size of the loan (in units of X as determined by the derivative pricing function). But, if they default, then the network is left with X-Y coins staked, reducing the network’s security. So if p is the probability of the borrower defaulting on their loan of Y coins, then the network has (1-p)X + pY coins staked and is losing security by issuing such a loan.
Estimating p is extremely difficult as its value changes as borrowers’ credit quality evolves leading to dramatic incentive issues. For instance, if the derivative price moons to a high value, one can reduce slashing costs to effectively zero and abandon their stake. On the other hand, if p is really small, say one in a billion, then the loss in security that the network faces is small — one billionth of X-Y — and the validator can earn almost as much income as they would in PoW.
Things get more interesting when we consider how staking derivative loans are aggregated. In order to promote liquidity and price discovery in the staking derivative asset, we expect PoS derivatives to be fungible across validators. This is similar to how Maker outputs the fungible asset Dai, while individual CDPs/Vaults remain non-fungible.
In this scenario, the staking derivative’s price is tied to the collective obligations of the validator base. Issuing bonds backed by pools of collateralized loans, is exactly the function of Mortgage-Backed Securities and related securitizations structures. But how is the leverage achieved from a network lending to users similar to leverage from MBSs? Let’s take a step back and look at why individuals and banks need leverage on mortgages.
Suppose that you have just bought a home for $640,000, where you spent $100,000 on a downpayment and you are making monthly payments of $3,000 for 15 years. After 10 years, let’s suppose that you have $460,000 in equity in the house [1] and you want to buy a Tesla. You don’t have much cash in your bank account — but you do have $460,000 worth of equity! What if you could borrow $100,000 against the equity in your house and pay it back over 5 years? This is exactly what a home equity loan is — use your house as collateral for a loan whose amount is less than or equal to your equity. Note that the loan provides you leverage which gets you instant liquidity (cash) on an otherwise illiquid asset (house) in exchange for interest payments. If the owner crashes the Tesla and loses their job, leading to the $100,000 loan to default, the lender of the loan liquidates the loan by repossessing the house.
Next, suppose that you’re a bank that issues mortgages [2]. When you make a $500,000 home loan, you suddenly have $500,000 less capital to utilize for lending. Worse, the liability is illiquid — you cannot directly borrow against it to get more capital to lend to someone else. Situations like this were what securitization was made for! Securitization involves taking an asset, placing it under the custody of a company that owns no other assets but issues shares, and then selling those shares to investors. If the asset, such as a house, mortgage, or bundle of mortgages, is worth $1,000,000 and the company issues 1,000 transferable shares, then each share owns the rights to 1/1000 of the asset.
The entity that performs this securitization, such as a bank, will charge a fee for the creation of the shares. Note that the loan holder gets liquidity (cash) by getting leverage against the future cash flow (interest payments) of an otherwise illiquid asset. If the homeowner is unable to make interest payments, the bank repossesses the house, sells it at a foreclosure auction, and divides up the proceeds to the holders of the 500 shares. In practice, lenders pool together many houses and sell shares of bundles of houses — this is a mortgage-backed security.
What is common to both of these situations? First, the owner of the asset/liability is stuck with a long-term commitment — to pay or receive interest on a mortgage for 15 to 30 years. But the owner has many short-term liabilities and/or opportunities that they need short term liquidity on. In order to get this liquidity, they borrow against their assets. This secured lending allows the borrower to get access to liquidity while allowing the lender to have some downside protection — they can liquidate the collateral (house). This ability to turn long-term assets into short-term liabilities is a cornerstone of finance.
In crypto, we have both of these types of lending. To borrowers, lenders like Compound or Aave are like the Tesla loan — you pledge your crypto collateral (analogous to the home) in order to get stablecoins (analogous to the dollars for your Tesla). If you can’t repay the loan or the value of your collateral goes below the amount that you borrowed, you are liquidated.
Similarly, staking derivatives let validators borrow against their staking operation. If there are many validators borrowing against their stake at the same time, then the network holds liabilities in each of them that depend on their probability of defaulting. The network, which has to price the loss of security, has to aggregate the total secured capital of the network by estimating
where
- S is the amount of capital used to secure the network
- p is the vector of default probabilities (e.g. the ith element is the probability of default of the ith validator)
- X is the vector of stakes (e.g. the ith element of X is the stake locked by the ith validator)
- Y is the vector of borrows (e.g. the ith element of Y is the amount that the ith validator is borrowing via a staking derivative)
Just like a mortgage-backed security represents the value of an aggregation of many loans, a staking derivative pools liens into a single package and then tokenizes them. The price of the aggregation is the most important thing to measure — it represents the price of security in the network!
But if staking derivatives are like mortgage-backed securities, aren’t they bad and horrible? Won’t we just cause a financial crisis again, except with non-state-backed capital?
Maybe, though there’s one key difference between “crypto securitization” and MBS. First, let’s take a step back and look at the characteristics of securitization. The simplest function of securitization is pooling assets and issuing securities backed by their cash flows. In our (admittedly caricatured) example of MBSs below, a mortgage originator extends home loans to consumers. The originator then sells the loans to a special-purpose entity in exchange for cash. This entity finances the purchase by issuing bonds (such as MBSs) to investors. These will represent the cash flows of potentially thousands of individual loans and will be far more liquid than the loans that comprise them. This allows larger buyers to purchase a single, liquid asset that matches their risk preferences instead of having to go out and purchase thousands of individual loans.
If we look at DeFi lending protocols like Aave and Compound, we notice a very similar structure. A heterogeneous set of loans is pooled into a smart contract. The protocol finances these loans by issuings bonds, such as cDAI, backed by the cash flows of the loans. In this sense Compound and Aave, are just as much securitization protocols as they are lending protocols.
The key difference is that the lending protocol both originates the loans and automatically executes the securitization. In contrast, in conventional securitization, the relationship with the borrower is typically handled by a separate entity in the originator. This difference is critical in the case of PoS, as the protocol needs to automatically enforce liquidations of overleveraged borrowers. DeFi protocols like Liquity plan to do the same.
Securitization transactions are typically identified with tranching: issuing different classes of securities backed by the same pool that cater to different risk preferences. At first glance, that may appear to be lacking in the above example of Compound where a uniform bond is issued in the form of cDAI. However, we are beginning to see options emerge that offer lower risk (such as combining cDai with insurance protection via Opyn or Nexus Mutual) and higher risk (such as PoolTogether) to cater to lenders with different preferences.
One of the issues with mortgage-backed securities that led to their catastrophic collapse in 2007–2008 is that it was very hard to transparently price them. Part of this stems from principal-agent issues, but a lot of it results from the lag time between a default happening and when it hit the MBS. For instance, if a borrower defaults on a house, then the missed payment is first transported to the lender. The lender then reports the missed payment to the mortgage securitization who subsequently tells all shareholders that their lien has defaulted. This process, due to the vagaries of the US home market, can take months to propagate defaults up the complex financial stack [4].
In crypto, the problem is not as pronounced. With crypto leverage — be it on crypto collateral or staked collateral — all participants know when a loan is in default or not. This means that financial products that depend on these loans, such as staking derivatives, can instantly price in defaults and execute liquidations. While liquidation can still be risky — for instance, market and liquidity risks can disincentivize liquidators in protocols like Compound or Maker from executing liquidations [3] — this is much more efficient than in traditional markets. The effectiveness of relatively expedient liquidations in crypto means that much more complex securities can be priced, packaged, and reused in ways that are more difficult in the traditional financial world.
However, this benefit isn’t free. Unlike a borrower-proximate originator, a protocol lacks knowledge of the credit quality of its borrower base. Moreover, the quality of the collateral it receives in the form of crypto is often of significantly lower quality. The way DeFi protocols have sought to address these issues is through high overcollateralization requirements and aggressive liquidation policies.
Furthermore, there are additional risks to staking derivatives as liquidations reduce the money supply. The reason for this is that when a validator defaults on their loan, the PoS protocol burns or excises their stake from the system. This decrease in money supply provides increased future expected returns to other validators, but can lower the security of the system. Even if the protocol inflates the currency to compensate, it is possible that the market will discount the value of these assets. Thus, the network’s security may be dramatically reduced upon each liquidation.
Finally, traditional securitization structures rely heavily on a diversified pool of loans representing many distinct borrowers. The pseudonymity of DeFi and PoS protocols may make it difficult to assess how exposed the protocol is to any single entity. This makes studying the wealth distribution among borrowers all the more important for PoS. Wealth inequality among PoS participants can jeopardize security by concentrating risk in a small number of borrowers.
This is a key focus of our paper, where we study how staking derivatives affect inequality and returns in PoS networks. We find that, under certain conditions, staking derivatives reduce inequality. There are two intuitive reasons for this effect. First, staking derivatives level the playing field by allowing validators to recycle capital, enabling validators to access a similar opportunity set regardless of their size. Second, defaults of overleveraged validators enhance yields for others by burning stake. When large validators default, that effect is more pronounced. We expect that designating validators who are “too big to fail” will annul this result. In order for staking derivatives to work well, validators must share default risks proportionately and collectively penalize risky behavior, especially that of larger entities.
What does this mean for protocol developers? If they decide to add staking derivatives to their protocol, they need to consider that they’re effectively adding trustless mortgage-backed securities to their system. The positives are that they allow validators to optimize their capital efficiency and earn better overall returns, while liquidations ensure that these liens are priced correctly at all times. On the other hand, the familiar risks of MBSs may still rear their heads in PoS. If the network has lax lending standards, then derivatives can dramatically reduce the network’s security. Protocol designers need to carefully design the derivative pricing function that tells a validator how much they can borrow. This function needs to incorporate fees (interest) paid, credit limitations, and liquidation policies in a manner that makes it unlikely that adverse events occur.
We evaluate their theoretical model using Gauntlet’s agent-based simulation platform and find that there do exist ‘sweet spots’ where one can safely add these derivatives. While the positives may greatly outweigh the negatives in these regimes, PoS protocols staking derivatives are effectively balanced on the edge of a knife. Failure to correctly price default risk or inability to aggressively enforce liquidations when necessary can lead to radical reductions in security.
Cryptocurrencies are now entering their roaring 20s of leverage, and it is wise for protocol designers and operators to carefully understand the risks in the financial engineering that they are embarking on.
We would like to thank Hasu, Georgios Konstantopoulos, Haseeb Qureshi, Celia Wan, Leo Zhang (Anicca Research), Yi Sun, Matteo Leibowitz, Shannon Brick, Guillermo Angeris, Hsien-Tang Kao, Mario Laul, and Fabian Trottner for extremely helpful comments, criticism, and suggestions for this blog post and the paper.
[0] 33% if the network guaranteed finality and uses a Byzantine Fault Tolerant system, 50% if the system is a `longest-chain’ Nakamoto scheme
[1] Equity is the difference between what you owe on your mortgage and what your home is currently worth. Your equity in the house grows as you repay the mortgage. If you owe $180,000 on your mortgage loan and your home is worth $640,000, you have $460,000 of equity in your home.
[2] Technical notes from Haseeb Qureshi: Banks technically don’t need to actually get deposits 1:1. But in an abstract sense you do need to take money from deposits because banks need to maintain a reserve ratio. So assuming a bank is already near the reserve ratio (or their effective “we’re comfortable with this reserve ratio” reserve ratio), if they make the marginal loan then they’d go over their reserve ratio, which means they need to balance it with more deposits. So at equilibrium (unless a bank is slowly decreasing its reserve ratio, as tends to happen with banking regulation), banks do need deposits to make new loans.
[3] This scenario happens when liquidators cannot buy the asset that is needed to execute a liquidation (e.g. the cryptocurrency needed to purchase the foreclosed collateral) and/or if the volatility is too high for an arbitrage profit to be extracted reliably. See Gauntlet’s market risk report of Compound for a detailed explanation and simulation of this scenario.
[4] See this report from Moody’s (pre-financial crisis) and this post-crisis analysis of default timing
