Curve Stablecoin Design White Paper (Bilingual Version in Chinese and English)

Author: Michael Egorov, Curve Finance

*Compiled by: *JamesX, iZUMi Research**

Overview

The design of the stablecoin has few concepts: lending-liquidating amm algorithm (LLAMMA), PegKeeper, Monetary Policy are the most important ones. But the main idea is in LLAMMA: replacing liquidations with a special-purpose AMM.

The design of this stablecoin includes several key concepts: lending-liquidating AMM algorithm (LLAMMA), PegKeeper (stability mechanism), and monetary policy. However, the main design point is in LLAMMA: replacing the traditional liquidation process of over-collateralized lending with a special-purpose AMM.

Figure 2: Dependence of the loss on the price shift relative to the liquidation threshold. Time window for the observation is 3 days

Figure 2: The dependence of loss on price changes relative to the liquidation threshold. The observation time window is 3 days.

In this design, if someone borrows against collateral, even at the liquidation threshold, and the price of collateral dips and bounces - no significant loss occurs. For example, according to simulations using historic data for ETH/USD since Sep 2017, if one leaves the CDP unattended for 3 days and during this time the price drops 10% below the liquidation threshold - only 1% of collateral gets lost.

In this design, if someone borrows against collateral, even at the liquidation threshold, and the price of collateral dips and bounces, no significant loss occurs. For example, according to simulations using historical data for ETH/USD since September 2017, if a CDP is left unattended for 3 days and during this time the price drops 10% below the liquidation threshold, only 1% of the collateral is lost.

AMM for continuous liquidation/deliquidation (LLAMMA)

AMM for Continuous Liquidation/Deliquidation (LLAMMA)

The core idea of the stablecoin design is the Lending-Liquidating AMM Algorithm. The idea is that it converts between collateral (for example, ETH) and the stablecoin (let's call it USD here). If the price of collateral is high - a user has deposits all in ETH, but as it goes lower, it converts to USD. This is very different from traditional AMM designs where one has USD on top and ETH on the bottom instead.

The core idea of the stablecoin design is the Lending-Liquidating AMM Algorithm. This concept allows for conversion between collateral (e.g., ETH) and the stablecoin (which we will refer to as USD). If the price of the collateral is high, the user has all deposits in ETH, but as the price decreases, it converts to USD stablecoin. This is quite different from traditional AMM designs, where USD is on the top and ETH is on the bottom.

The below description doesn't serve as fully self-consistent rigorous proofs. A lot of that (especially the invariant) are obtained from dimensional considerations. More research might be required to have a full mathematical description; however, the below is believed to be enough to implement in practice.

The following description does not serve as a fully self-consistent rigorous proof. Many aspects (especially the invariant) are derived from dimensional considerations. More research may be required for a complete mathematical description; however, the following is believed to be sufficient for practical implementation.

This is only possible with an external price oracle. In a nutshell, if one makes a typical AMM (for example, with a bonding curve being a piece of hyperbola) and ramps its "center price" from (for example) down to up, the tokens will adiabatically convert from (for example) USD to ETH while proving liquidity in both ways on the way (Fig. 3). It is somewhat similar to avoided crossing (also called Landau-Zener transition) in quantum physics (though only as an idea: the mathematical description of the process could be very different). The range where the liquidity is concentrated is called band here; at the constant po, the band has liquidity from pcd to pcu. We seek for pcd(po) and pcu(po) being functions of po only, functions being steeper than linear and, hence, growing faster than po (Fig. 4). In addition, let's define prices p↓ and p↑ being prices where p↓(po) = po, and p↑(po) = po, defining ends of bands in adiabatic limit (e.g., p = po).

This is only possible with an external price oracle. In summary, if one creates a typical AMM (for example, with a bonding curve that is a segment of a hyperbola) and adjusts its "center price" from (for example) low to high, the tokens will adiabatically convert from (for example) USD to ETH while providing liquidity in both directions along the way (Fig. 3). This is somewhat analogous to avoided crossing (also known as Landau-Zener transition) in quantum physics (though this is merely a conceptual analogy; the mathematical description of the process could differ significantly). The range where liquidity is concentrated is referred to as a band here; at a constant po, the band has liquidity from pcd to pcu. We seek pcd(po) and pcu(po) as functions of po only, with these functions being steeper than linear and thus growing faster than po (Fig. 4). Additionally, let's define prices p↓ and p↑ as the prices where p↓(po) = po and p↑(po) = po, which define the ends of bands in the adiabatic limit (e.g., p = po).

The range where liquidity is concentrated is called "band" here; at the constant po, the band has liquidity from pcd to pcu. We seek pcd(po) and pcu(po) as functions of po only, with these functions being steeper than linear and thus growing faster than po (Fig. 4). Additionally, let's define prices p↓ and p↑ as the prices where p↓(po) = po and p↑(po) = po, which define the ends of bands in the adiabatic limit (e.g., p = po).

Figure 3: Behavior of an "AMM with an external price source". External price pcenter determines a price around which liquidity is formed. AMM supports liquidity concentrated from prices pcd to pcu, pcd < pcenter < pcu. When current price p is out of range between pcd and pcu, AMM is either fully in stablecoin (when at pcu) or fully in collateral (when at pcd). When pcd ≤ p ≤ pcu, AMM price is equal to the current price p.

Figure 4: AMM which we search for. We seek to construct an AMM where pcd and pcu are such functions of po that when po grows, they grow even faster. In this case, this AMM will be all in ETH when ETH is expensive, and all in USD when ETH is cheap.

We start from a number of bands where, similarly to Uniswap3, hyperbolic shape of the bonding curve is preserved by adding virtual balances. Let’s say, the amount of USD is x, and the amount of ETH is y; therefore, the "amplified" constant-product invariant would be:

We begin with several bands where, similar to Uniswap3, the hyperbolic shape of the bonding curve is maintained by adding virtual balances. Suppose the amount of USD is x, and the amount of ETH is y; thus, the "amplified" constant-product invariant would be:

We also can denote x0 ≡ x + f and y0 ≡ y + g so that the invariant can be written as a familiar I = x0 y0. However, f and g do not stay constant: they change with the external price oracle (and so does the invariant I, so it is only the invariant while the oracle price po is unchanged). At a given po, f and g are constant across the band. As mentioned before, we denote p↑ as the top price of the band and p↓ as the bottom price of the band. We define A (a measure of concentration of liquidity) in such a way that:

We can also denote x0 ≡ x + f and y0 ≡ y + g, allowing the invariant to be expressed as the familiar I = x0 y0. However, f and g are not constant: they vary with the external price oracle (and so does the invariant I, which is only invariant while the oracle price po remains unchanged). At a given po, f and g are constant throughout the band. As previously mentioned, we denote p↑ as the upper price of the band and p↓ as the lower price of the band. We define A (a measure of liquidity concentration) in such a way that:

The property we are looking for is such that higher price po should lead to even higher price at the same balances, so that the current market price (which will, on average, follow po) is lower than that, and the band will trade towards being all in ETH (and the opposite is also true for the other direction). It is possible to find many ways to satisfy that but we need one:

The property we seek is such that a higher price po should result in an even higher price at the same balances, ensuring that the current market price (which will, on average, follow po) is lower than this price, and the band will trade towards being entirely in ETH (and the reverse is true for the opposite direction). There are many ways to achieve this, but we need one:

where y0 is a p0-dependent measure of deposits in the current band, denominated in ETH, defined in such a way that when current price p, p↑ and po are equal to each other, then y = y0 and x = 0 (see the point at po = p↑ on Fig. 4). Then if we substitute y at that moment:

where y0 is a measure of deposits in the current band that depends on p0, denominated in ETH, defined such that when the current price p, p↑, and po are equal, then y = y0 and x = 0 (see the point at po = p↑ in Fig. 4). Then, if we substitute y at that moment:

Price is equal to dx0 /dy0 which then for a constant-product invariant is:

The price is equal to dx0 /dy0, which for a constant-product invariant is:

One can substitute situations where po = p↑ or po = p↓ with x = 0 or y = 0 correspondingly to verify that the above formulas are self-consistent.

One can substitute situations where po = p↑ or po = p↓ with x = 0 or y = 0, respectively, to verify that the above formulas are self-consistent.

Typically for a band, we know p↑ and, hence, p↓, po, constant A, and also x and y (current deposits in the band). To calculate everything, we need to find yo. It can be found by solving the quadratic equation for the invariant:

Typically, for a band, we know p↑ and, consequently, p↓, po, constant A, and also x and y (current deposits in the band). To calculate everything, we need to find yo. It can be determined by solving the quadratic equation for the invariant:

which turns into the quadratic equation against yo:

which transforms into a quadratic equation in terms of yo:

In the smart contract, we solve this quadratic equation in the get_y0 function.

In the smart contract, we solve this quadratic equation in the get_y0 function.

While oracle price po stays constant, the AMM works in a normal way, e.g., sells ETH when going up / buys ETH when going down. By simply substituting x = 0 for the "current down" price pcd or y = 0 for the "current up" price pcu values into the equation of the invariant respectively, it is possible to show that AMM prices at the current value of po and the current value of p↑ are:

While the oracle price po remains constant, the AMM operates normally, e.g., selling ETH when the price rises and buying ETH when the price falls. By simply substituting x = 0 for the "current down" price pcd or y = 0 for the "current up" price pcu values into the invariant equation, it is possible to demonstrate that the AMM prices at the current value of po and the current value of p↑ are:

Another practically important question is: if price changes up or down so slowly that the oracle price po is fully capable to follow it adiabatically, what amount y↑ of ETH (if the price goes up) or x↓ of USD (if the price goes down) will the band end up with, given current values x and y and that we start also at p = po. While it's not an immediately trivial mathematical problem to solve, numeric computations showed a pretty simple answer:

Another practically important question is: if the price changes up or down so slowly that the oracle price po can fully follow it adiabatically, what amount y↑ of ETH (if the price goes up) or x↓ of USD (if the price goes down) will the band end up with, given current values x and y and starting at p = po? While this is not an immediately trivial mathematical problem to solve, numerical computations have shown a fairly simple answer:

We will use these results when evaluating the safety of the loan as well as the potential losses of the AMM.

We will utilize these results when assessing the safety of the loan and the potential losses of the AMM.

Now we have a description of one band. We split all the price space into bands which touch each other with prices p↓ and p↑ so that if we set a base price pbase and have a band number n:

Now we have a description of one band. We divide the entire price space into bands that touch each other at prices p↓ and p↑, such that if we set a base price pbase and have a band number n:

It is possible to prove that the solution of Eq. 7 and Eq. 5 for any band gives:

It can be proven that the solutions of Eq. 7 and Eq. 5 for any band yield:

which shows that there are no gaps between the bands.

This indicates that there are no gaps between the bands.

Trades occur while preserving the invariant from Eq. 1; however, the current price inside the AMM shifts when the price po: it goes up when po goes down and vice versa cubically, as can be seen from Eq. 8.

Trades occur while maintaining the invariant from Eq. 1; however, the current price within the AMM shifts when the price po changes: it increases when po decreases and vice versa cubically, as can be observed from Eq. 8.

LLAMMA vs Stablecoin

Stablecoin is a CDP where one borrows stablecoin against a volatile collateral (cryptocurrency, for example, against ETH). The collateral is loaded into LLAMMA in such a price range (such bands) that if the price of collateral goes down relatively slowly, the ETH gets converted into enough stablecoin to cover closing the CDP (which can happen via a self-liquidation, or via an external liquidation if the coverage is too close to dangerous limits, or not close at all while waiting for the price bounce).

A stablecoin is a CDP where one borrows stablecoin against a volatile collateral (such as cryptocurrency, for example, ETH). The collateral is placed into LLAMMA within a price range (these bands) such that if the price of the collateral decreases relatively slowly, the ETH is converted into sufficient stablecoin to cover the closure of the CDP (which can occur through self-liquidation or through external liquidation if the collateralization is too close to dangerous limits, or not close at all while waiting for the price to bounce back).

When a user deposits collateral and borrows a stablecoin, the LLAMMA smart contract calculates the bands where to locate the collateral. When the price of the collateral changes, it starts getting converted to the stablecoin. When the system is "underwater", the user already has enough USD to cover the loan. The amount of stablecoins that can be obtained can be calculated using a public getxdown method. If it gives values too close to the liquidation thresholds - an external liquidator can be involved (typically shouldn't happen within a few days or even weeks after the collateral price went down and sideways, or even will not happen ever if collateral price never goes up or goes back up relatively quickly). A health method returns a ratio of getxdown to debt plus the value increase in collateral when the price is well above "liquidation".

When a user deposits collateral and borrows a stablecoin, the LLAMMA smart contract calculates the bands for locating the collateral. When the price of the collateral changes, it begins to convert into stablecoin. When the system is "underwater," the user already possesses enough USD to cover the loan. The amount of stablecoins that can be obtained can be calculated using a public getxdown method. If it yields values too close to the liquidation thresholds, an external liquidator may be involved (this typically should not happen within a few days or even weeks after the collateral price has decreased and remained stable, or may never occur if the collateral price does not rise or recovers relatively quickly). A health method returns the ratio of getxdown to debt plus the value increase in collateral when the price is significantly above "liquidation."

When a stablecoin charges interest, this should be reflected in the AMM, too. This is done by adjusting all the grid of prices. So, when a stablecoin charges interest rate r, all the grid of prices in the AMM shifts upwards with the same rate r which is done via a base_price multiplier. So, the multiplier goes up over time as long as the charged rate is positive.

When a stablecoin charges interest, this should also be reflected in the AMM. This is accomplished by adjusting the entire grid of prices. Therefore, when a stablecoin charges an interest rate r, the entire grid of prices in the AMM shifts upwards by the same rate r, which is achieved through a base_price multiplier. Thus, the multiplier increases over time as long as the charged rate remains positive.

When we calculate getxdown or getyup, we are first looking for the amounts of stablecoin and collateral x∗ and y∗ if the current price moves to the current price po. Then we look at how much stablecoin or collateral we get if po adiabatically changes to either the lowest price of the lowest band, or the highest price of the highest band respectively. This way, we can get a measure of how much stablecoin we will which is not dependent on the current instantaneous price, which is important for sandwich attack resistance.

When calculating getxdown or getyup, we first determine the amounts of stablecoin and collateral x∗ and y∗ if the current price shifts to the current price po. Then we assess how much stablecoin or collateral we would receive if po adiabatically changes to either the lowest price of the lowest band or the highest price of the highest band, respectively. This approach allows us to measure how much stablecoin we will receive, which is independent of the current instantaneous price, an important factor for resistance against sandwich attacks.

**
**
It is important to point out that the LLAMMA uses po defined as ETH/USD price as a price source, and our stablecoin could be traded under the peg (ps < 1) or over peg (ps > 1). If ps < 1, then price in the LLAMMA is p > po.

It is important to note that LLAMMA uses po, defined as the ETH/USD price, as a price source, and our stablecoin could be traded below the peg (ps < 1) or above the peg (ps > 1). If ps < 1, then the price in the LLAMMA is p > po.

In adiabatic approximation, p = po/ps, and all the collateral<stablecoin conversion would happen at a higher oracle price / as if oracle price was lower and equal to:

In the adiabatic approximation, p = po/ps, and all collateral<stablecoin conversions would occur at a higher oracle price, as if the oracle price were lower and equal to:

At this price, the amount of stablecoins obtained at conversion is higher by a factor of 1/ps (if ps < 1).

At this price, the amount of stablecoins obtained during conversion is higher by a factor of 1/ps (if ps < 1).

It is less desirable to have ps > 1 for prolonged times, and for that we will use the stabilizer (see next)

It is less desirable for ps > 1 to persist for extended periods, and for this, we will utilize the stabilizer (see next section).

Automatic Stabilizer and Monetary Policy

Automatic Stabilizer and Monetary Policy

When ps > 1 (for example, because of the increased demand for stablecoin), there is a peg-keeping reserve formed by an asymmetric deposit into a stableswap Curve pool between the stablecoin and a redeemable reference coin or LP token. Once ps > 1, the PegKeeper contract is allowed to mint uncollateralized stablecoin and (only!) deposit it to the stableswap pool single-sided in such a way that the final price after this is still no less than 1. When ps < 1, the PegKeeper is allowed to withdraw (asymmetrically) and burn the stablecoin.

When ps > 1 (for instance, due to increased demand for the stablecoin), a peg-keeping reserve is formed by an asymmetric deposit into a stableswap Curve pool between the stablecoin and a redeemable reference coin or LP token. Once ps > 1, the PegKeeper contract is permitted to mint uncollateralized stablecoin and (only!) deposit it into the stableswap pool in a single-sided manner, ensuring that the final price remains no less than 1. When ps < 1, the PegKeeper is allowed to withdraw (asymmetrically) and burn the stablecoin.

These actions cause price ps to quickly depreciate when it's higher than 1 and appreciate if lower than 1 because asymmetric deposits and withdrawals change the price. Even though the mint is uncollateralized, the stablecoin appears to be implicitly collateralized by liquidity in the stablecoin pool. The whole mint/burn cycle appears, at the end, to be profitable while providing stability.

These actions lead to a rapid depreciation of price ps when it exceeds 1 and an appreciation when it falls below 1, as asymmetric deposits and withdrawals affect the price. Although the minting is uncollateralized, the stablecoin seems to be implicitly backed by liquidity in the stablecoin pool. The entire mint/burn cycle ultimately appears to be profitable while ensuring stability.

Let's denote the amount of stablecoin minted to the stabilizer (debt) as dst and the function which calculates the necessary amount of redeemable USD to buy the stablecoin in a stableswap AMM get_dx as fdx(). Then, in order to keep reserves not very large, we use the "slow" mechanism of stabilization via varying the borrow r:

Let’s denote the amount of stablecoin minted to the stabilizer (debt) as dst and the function that calculates the necessary amount of redeemable USD to purchase the stablecoin in a stableswap AMM as get_dx, denoted as fdx(). To prevent reserves from becoming excessively large, we employ a "slow" stabilization mechanism by varying the borrowing rate r:

where h is the change in ps at which the rate r changes by a factor of 2 (higher ps leads to lower r). The amount of stabilizer debt dst will equilibrate at different values depending on the rate at ps = 1 r0. Therefore, we can (instead of setting manually) reduce r0 while dst/supply is larger than some target number (for example, 5%) (thereby incentivizing borrowers to borrow-and-dump the stablecoin, decreasing its price and forcing the system to burn the dst) or increase it if it's lower (thereby incentivizing borrowers to return loans and pushing ps up, forcing the system to increase the debt dst and the stabilizer deposits).

where h is the change in ps at which the rate r changes by a factor of 2 (higher ps leads to lower r). The amount of stabilizer debt dst will equilibrate at different values depending on the rate at ps = 1 r0. Therefore, we can (instead of setting manually) reduce r0 while dst/supply is larger than some target number (for example, 5%) (thereby incentivizing borrowers to borrow-and-dump the stablecoin, decreasing its price and forcing the system to burn the dst) or increase it if it's lower (thereby incentivizing borrowers to return loans and pushing ps up, forcing the system to increase the debt dst and the stabilizer deposits).

Conclusion / Conclusion

The presented mechanisms can, hopefully, solve the riskiness of liquidations for stablecoin-making and borrowing purposes. In addition, stabilizer and automatic monetary policy mechanisms can help with peg-keeping without the need of keeping overly big PSMs.

The mechanisms presented here can, hopefully, address the risks associated with liquidations for the purposes of stablecoin creation and borrowing. Additionally, the stabilizer and automatic monetary policy mechanisms can assist in maintaining the peg without the necessity of maintaining excessively large PSMs (Peg Stability Modules).