Cryptocurrencies have exploded in popularity over the past few years. However, despite their name, cryptocurrencies have largely functioned as more of a speculative investment than as a true currency, and their volatility has made it very difficult for cryptocurrencies to function as a true medium of exchange. Stablecoins are attempting to rectify this issue by maintaining a consistent value, often pegging themselves to a traditional currency like the USD. The exact mechanism for suppressing volatility varies across currencies. Some ensure stability by collateralizing with a traditional currency (i.e., USD) and allowing users to redeem the stablecoin for fiat, thereby assuring a consistent exchange rate via the threat of arbitrage. Other stablecoins keep volatility low by employing a form of monetary policy which allows them to expand and contract the supply of currency as needed, e.g. as Terra does. Regardless of the mechanism for suppressing volatility, one thing all of these coins have in common is the need to identify when the price has moved too far. This may seem trivial to those unfamiliar with this space (why don’t they just check how much the price has moved on Yahoo Finance?). However, as we’ll cover in this article, this is actually a significant challenge in the world of cryptocurrencies and block chain. This has brought on a whole new series of technological products — oracles — to address the issue. In this article, we will start by providing more intuition for why oracles are needed. Then, we’ll discuss their design and the biggest issues faced by oracles today.
Why are oracles needed?
In many financial markets, getting an accurate price is a trivial task. For example, if we want to find out the price per share of Facebook, all we need to do is go on any number of financial market web sites, or perhaps just turn on CNBC. So what makes cryptocurrencies different? After all, there are dozens of cryptocurrency exchanges worldwide, with purportedly huge trade volumes. On the surface, that would imply liquid markets where we can simply observe where the latest trades are done to infer the relevant price for cryptocurrencies, much like we do with most financial markets.
The issue for cryptocurrencies is the reliability of the observed trade data. In a presentation to the SEC earlier this year, Bitwise Asset Management summed up the issues well. After conducting a thorough investigation of trade patterns and transaction costs across a broad range of exchanges, they concluded that “the vast majority of this reported volume is fake and/or non-economic wash trading.” To put some numbers around this, they found that 71 of 81 exchanges posted dubious trades, and up to 95.5% of the alleged $6 billion per day in trading could be suspect. This included trades from exchanges that were ostensibly among the largest in the world, such as Coinbene.
How are oracles currently designed?
In a market where public prices are unreliable, cryptocurrencies have turned to various oracle systems. The exact mechanics vary across the different cryptocurrencies, but these systems frequently boil down to asking a list of trusted entities to submit prices. These entities serve as a screening and validation mechanism, and are supposed to provide a more accurate estimate of the true price of the currency in question.
Cryptocurrencies often offer their oracles an incentive for accurate submissions, with the best submissions receiving a financial reward. The “best” submissions are typically defined as the submissions that are closest to the middle (which can be the median or mean) of all the submissions. At first glance, this seems like a sensible rule, which would rule out extreme prices as well as random ones… but does this truly result in an accurate, truthful assessment of prices? In the next section, we discuss some potential issues.
What are the biggest issues faced by price oracles?
Renowned economist John Maynard Keynes once described investing as a beauty contest — “investment may be likened to those newspaper competitions in which the competitors have to pick out the six prettiest faces from a hundred photographs, the prize being awarded to the competitor whose choice most nearly corresponds to the average preferences of the competitors as a whole; so that each competitor has to pick, not those faces which he himself finds prettiest, but those which he thinks likeliest to catch the fancy of the other competitors.” In the same way, oracle systems that award submissions which are closest to the middle may incentivize participants to focus on what others think is the price, rather than simply provide assessments of the price based on fundamental value. Research has shown that these two quantities can certainly differ, and “beauty contest” behavior can impact the functioning of a market.
In their 2006 paper, “Beauty Contests and Iterated Expectations in Asset Markets,” Allen, Morris, and Shin created a quantitative model for understanding the impact of beauty contests. They found that these dynamics can cause prices to systematically deviate from fundamental value, and there is no unraveling of iterated expectations that forces a “fair” equilibrium price. Further, prices in these markets tend to exhibit inertia, reacting more slowly to new pieces of information. Arbitrage will also fail to pull prices to fair value, as long as the potential arbitrageurs are risk averse and lack perfect estimates of true value (two assumptions which are very likely to be true in real world markets). These findings were consistent with the work by Froot, Scharfstein, and Stein years earlier. They found that it can be perfectly rational for speculators with short time horizons to willfully ignore fundamentals and choose to trade on what they think others are trading on instead. This, in turn, can ultimately lead to a “direct negative impact on the informational quality of asset prices.”
Despite the concerns with beauty contests, these systems are frequently used, and often function well. The logic is that, in practice, it is difficult enough to determine what others are thinking (how do you guess if the other participants will be biased upward or downward at a given point?), that it becomes easier and better to just respond with the truth.
However, the logic above falls apart when there is coordination among the participants, and they actively collude to dictate the price. In a system where the winner is dictated by the median, forming a cartel which controls 51% or more of the votes will effectively guarantee price control, allowing the cartel to inflate or deflate the price as it desires. However, it also means that it is enough for 50% of participants to be truthful to guarantee that the oracle is correct. Smaller cartels could potentially hold significant influence as well, although the exact strength of the collusive influence becomes much less clear when it comes to smaller entities. As an example, in the oracle adopted by Terra, participants are asked to determine how much Luna is worth 1 SDR. One important feature of the median vote is that, if at least 50% of the votes are within ε of the true price, the oracle price will be within ε of the true price, which significantly makes it more difficult for malicious attacks to move the price significantly away from the true price.
From a practical perspective, it seems likely that cartels would need to get as close to 51% as possible to swing the price. However, from a game theory perspective, some have plausibly suggested that as little as 1% participation is sufficient to have a large influence on prices. One particularly notable scheme is the “P + epsilon” attack, which involves an attacker simply (but credibly) promising to compensate voters with a certain bribe based on how they vote. As described by Vitalik Buterin (founder of Ethereum) in his blog post on this topic, this deceivingly simple tactic should, from a theoretical perspective, provide sufficient incentive to effectively corrupt the entire price mechanism. Of course, this strategy relies on all participants being perfectly “rational” in the economic sense, and fully capable of thinking through the correct strategies from a game theory perspective — two assumptions which are likely *not* true in the real world.
Anonymizing the names of the participants and introducing penalties for those caught coordinating can decrease the chance of collusion. Intuitively, anonymity makes it more difficult to forecast what other players’ incentives are, and to then guess how they will vote. However, it is worth noting that, as Moin, Sirer, and Sekniqi (2019) argued, even without explicit communication, collusion can still happen due to a “natural equilibrium point.” For example if a price move lower will mean that the stablecoin can be profitably redeemed for collateral (denominated in traditional currency), then a large percentage of participants may bias their submissions in that direction.
Beyond concerns with beauty contests and collusion, oracles also must grapple with the threat of malicious attacks. Autonomous Research found 56 documented hacks of cryptocurrency exchanges, initial coin offerings or other digital currency platforms since 2011, and they warned that this was likely a conservative estimate. Oracles have also been vulnerable to endogenous, unintentional glitches. Moin, Sirer, and Sekniqi reported that “in June 2019, a commercial API used by Synthetix suffered a glitch and began to report incorrect exchange rates, resulting in a bot making over $1B during this period. Although the bot owner chose to reverse the trades during this episode, there is no guarantee that the next profiteer will be as generous.” To protect against either type of disruption — malicious or unintentional — a number of cryptocurrencies have attempted to protect themselves by increasing the number of participants in the oracle system. However, this comes with a significant trade-off in terms of speed. Slower price information can result in less efficient markets and even arbitrage opportunities, if the blockchain is using an oracle price that deviates from what is available in secondary markets. Another precaution which has been employed by some is to limit how much prices can change in a short period. These simple risk management mechanisms are called “circuit breakers,” and have existed in traditional financial markets for some time. Many cryptocurrencies shied away from them initially, as they seemed to go against crypto’s ethos of decentralization. However, the merits of these processes have started to outweigh the drawbacks for some, and we have started to see their implementation. One such example is the Maker Platform’s Price Feed Sensitivity Parameter, which allows voters to set a parameter which caps the amount that prices can change in a given period. Exchange have also started to implement similar features — for instance, the CBOE temporarily halts trading for two minutes if the price of bitcoin futures move by more than 10% compared to the prior business day. If the price moves by more than 20%, trading is stopped for five minutes.
Oracle designers are grappling with issues including beauty contests, collusion, and malicious hacks. Currently there are a number of promising approaches being developed and used. The issues outlined in this article have shaped the basic principles of the oracle adopted at Terra, where validators vote a price with a weight that is equal to their Luna stake and the oracle determines the price as the weighted median of the votes. This design is intended to put most of the influence in the hands of those who have a vested interest in a well-functioning oracle, with these participants stabilizing the system in the event of attacks and manipulation. To reduce randomness and wide fluctuations, only validators who vote within either 1 standard deviation or 1% of the outcome are rewarded, while the others receive nothing. Finally, to minimize the possibility of malicious behavior by validators, the cash flow is awarded over the next 7 days.
· Cornell paper: https://arxiv.org/pdf/1910.10098.pdf
· Bitwise asset management presentation to SEC: https://www.sec.gov/comments/sr-nysearca-2019-01/srnysearca201901-5164833-183434.pdf