Category: technical

4 hours 23 minutes, 3,891 words.

Writer’s note. I’m pretty happy with this piece. One of the goals of speedwrite November was to write a full fleshed out thought in one sitting. This is the first time I think I’ve actually done it. Of course, I’d been thinking about this for a while, but the whole thing was written, from scratch, today. Had to be crypto. AI is too high stakes for me — I get too nervous that it’s not perfectly correct. But of course, the ultimate goal is to write my thoughts on AI in one sitting. This is the first practice run. Also, since this piece is so long, it’s going to count for the next five days. I come back on the 23rd. 

As someone who studied Economics in undergrad but was actually a (not so) secret CS/AI person and then went on to join the EconCS group at Harvard, it shouldn’t come as a huge surprise that I’ve been quite interested in stablecoins for a while. 

Sadly, post LUNA/TERRA collapse (and now FTX), saying that public opinion has soured on stablecoins (and crypto in general) is a fairly large understatement. In hindsight, most of the “stablecoins” or stable coin variants were a bit too heavy on the Ponzi and too light on the stable coin, in my opinion. But in some sense, at the heart of it, they were correct on some level. Here are some speculations on what I think(?) the Platonic ideal of what they were after looks like. If I were to build a stablecoin (not likely), here is what I would do. 

General Framework

There are two fundamental parts to a stablecoin. First is the circulating supply. These are the coins that everyone runs around spending. When you issue circulating supply, you incur liabilities in that you need to have 1 USD backing every coin out there. Second is the reserves. These are the things that you keep to back up the circulating supply. Ideally, reserves balance (and greatly exceed) the circulating supply. In the olden days of America, the circulating supply was the US dollar and the reserves were literal gold bars held in vaults all around the country. Nowadays, it’s a bit more complicated. But certainly, there is no gold backing anymore.

The basic framework I think that a decentralized stablecoin should follow is analogous to the gold standard for classic money. In the last few years, people skipped a few too many steps. It’s kind of hard to initiate a currency as a floating currency based on supply and demand. The non-crypto world spent thousands of years on the gold standard before they were ready to jump off of it. The crypto world is probably faster, but not quite ready for unbacked stablecoins though. Maybe one day, long in the future. Of course, you don’t base a crypto stablecoin off of gold. You base it off the crypto gold equivalent: Bitcoin.

The Race Dynamic

In my mind, there is a race. This race is not a Ponzi style race, as Matt Levine thinks it must be (though to be fair, most practical implementations were Ponzis). It is a race to see if your reserves can hit critical mass before you go bust.

Let me describe this in more detail. Imagine that your stablecoin starts when people start depositing BTC (gold) and getting an analogous amount of tokens (dollars) out. Additionally, every time someone spends your stablecoin, you collect a small fee (sales tax) and add it to the reserves. There are two possible outcomes in “equilibrium” (note that equilibrium may not be reached for a long time, and in fact, there might not be an “equilibrium” in the static sense). 

If at ANY point, the value of your reserves is less than the circulating supply of your token, you are insolvent and at risk of market liquidation. However, at some point, if you manage to survive without getting liquidated and people use your token, the transaction fees (and/or growth of BTC if you are bullish) will eventually mean that your reserves will be FAR more valuable than the liabilities that you incurred. And if you survive long enough that your emergency fund contains far more than the to circulating supply of your USD token, then you are safe. This system is like playing a late game carry like Vayne in League of Legends. If you make it to late game, then you win, and the system is stable. But you could very well fail early. 

Doesn’t this kind of sound like the Ponzi stableshitcoins that blew up this past year? In some sense, yes! That’s part of my claim. Projects like OlympusDAO, Wonderland, or LUNA were in some sense, degenerate reflections of this vision, but actually mostly Ponzis. But there is some version of this that might work!

[second writer’s note: I’m not building this, so feel free to unload on me if you think I’m completely wrong.  In fact, in general if you think that what I’m doing is BS, crypto or not, I’d rather hear it from you than after it’s too late]

I want to emphasize that this idea is not “new” any more than the idea that scaling AI systems to make them more powerful is “new.” One way or another, I think everyone in the space (and some people like me not in it), have thought of some form of this, in one way or another. The hard part is finding out how to get there.

If there is one thing that the previous projects did wrong (though to be fair, saying that they did this “wrong” presumes that they wanted to make a stablecoin and not, you know, get rich and run. It’s not clear that they actually wanted that in hindsight), it is covering up this race dynamic with smoke and mirrors. I think to do it right, you need to put the primary risk front and center. The race dynamic makes or breaks the coin. Everything else, the staking, algorithmic balancing, (3, 3), LUNATICS, is all smoke and mirrors. Plain and simple, the one real dynamic is the race between your reserves and your circulating supply. Expose that at the heart of it for everyone to see.

Let me describe a procedure that explains what I’m thinking. Alas, when I first pictured this, it was very simple and then complexity added itself as it always does. Nevertheless, I think it’s still a relatively simple system and will be described in a simple blog post. I don’t want to say the numbers don’t matter, because the numbers are crucial on whether you hit the critical point for one equilibrium versus the other. But the following numbers are made up without much though and just used to make things concrete. Here goes.

Overview

There are two tokens: COIN and STOCK. COIN is the stable coin. You can redeem it anytime for 1 USD worth of BTC at market price (details described later). Anytime you spent COIN, you pay a 1% transaction fee (lots of details which will be discussed later).

STOCK is not stable. A portion of the transaction fees will be distributed to holders of STOCK. This is the only utility of the STOCK token. In typical corporate lingo, COIN is debt (senior claims to the reserve) and STOCK is stock (expectations of future revenue flows). Unlike a company though, we aren’t trying to maximize the value of STOCK and don’t really mind that much if it is pretty close to zero.

A common operation in crypto is “locking” your tokens for some period of time. In our case, Locked COIN cannot be redeemed for BTC until the time is up. Let’s say the protocol starts with the founder / initial backer locking in 100M of BTC for ten years in exchange for minting 100M Locked COIN and 100M STOCK. After release, periodically, people are allowed to add BTC to the reserves in exchange for minting a proportional amount of COIN and STOCK. Why do they want to do this? Well, if COIN is actually stable at 1 USD and people are using it, then STOCK will be worth some positive value because of the transaction fees. And thus, you gain positive value from depositing your BTC there to compensate the risk of losing the race. There are a lot of tricky details here that will be described later.

As promised, this highlights the race dynamic described above. If you survive the 1) hackers 2) fluctuations in the markets 3) pressure to grow too fast and at some point, the reserves say, become 50x the value of the circulating supply, I think it is fairly safe to say that you have successfully crated a decentralized stable coin. Matt Levine claimed that all stablecoins had no endgame. And to be fair, he was right! But you could imagine a stablecoin which had an endgame like this. The endgame is not Ponzi style where people don’t redeem COIN any more than you would redeem USD. To be fair, that can come way, way, way later, long after people feel comfortable with a BTC-standard system and are ready to switch into a floating system. The (near-term) endgame is that your reserves are far larger than your liabilities, so you don’t care if people redeem or not.

Let’s talk about implementation details and main failure modes in more detail.

Fees

So what are the fees concretely. The fee structure will simply be that every time you send COIN to a new address, 1% of the transfer is sent to the reserve / STOCK holders.

Earlier, I claimed that 50x is a good tipping point for safety of reserves. Some might argue that it’s too much, but it’s better to be safe than sorry here. You want to be robust to black swans. And I think if you are robust to 98% dips in price, you are pretty safe. Until you hit this 50x critical mass, 90% of the fees go to the reserve (i.e. they are burned) and 10% get distributed proportionally to STOCK holders. After critical mass, you can flip it (90% to STOCK, 10% to reserve). 

STOCK/COIN is NOT part of the reserves. LUNA blew up because it relied on the value of TERRA (its sister token). FTX blew up because it relied on the value of FTT (its own token). Sending COIN to the reserve is just burning it. This is because COIN represents a claim of 1 USD on the reserves. If you have a 1 USD claim to yourself, it’s a no-op.

In terms of numbers, 1% is a number I pulled out a hat. On one hand, it seems kind of high. That being said, credit cards, in effect, charge 2.5% on each transaction (the merchant pays the fee and passes it onto you via higher prices) and sales tax varies, but is over 10% in California. On the other hand, the point is to escape the system not to create a new one. I think after though after you hit a critical mass, you can anneal the rate down to 0.1%. But it has to be relatively high in the beginning so the protocol can survive. 

Oracle Attacks.

I initially thought minting was simple, and then I realized I was completely wrong. I bet that I didn’t catch all the edge cases here, but here is a flavor of why it is hard. The general idea though is that people can put in BTC and get out an equivalent amount of COIN. There is a common attack in the crypto world known as the “oracle” attack. Alameda / FTX / SBF was famous for running variations of this strategy and it’s one (of many) reasons that SBF ticked off CZ and which led to his own downfall. Here is a simplified scenario. 

Say you take out a loan for 1M, secured by say, 2M worth of BTC. This loan has a condition that if the value of your collateral drops to say only 1.5M, then it will sell your BTC on the open market until you have paid back your loan. How does it know what the value of BTC is? It has to check an “oracle” or a trusted source of truth. You can now probably guess what the attack is. Perhaps you notice that the oracle doesn’t have much liquidity. You decide to sell a large amount of BTC on the oracle and crash the price of BTC to say, 1 cent for a few seconds. During that time, the original loan is liquidated in your favor. Immediately after, you buy up a lot of BTC on the oracle and recover most of your attack cost. Whether or not this attack is profitable depends on the details of a given contract. In the real world, these attacks have centralized defenses. For example, on the stock exchange, if the price moves too fast for no reason, trading is halted. This happened, notoriously, multiple times a day during the GME saga. Crypto exchanges have no such problems. Most “hacks” you have heard about in recent years in crypto are instances of this, in various degrees of sophistication. See a contract that queries some oracle for a value. Realize that you might be able to manipulate the value temporarily to your benefit, with the cost of manipulation much less than the gain from the attack.

Let’s apply that here. When you deposit BTC, the contract needs to know the price of BTC to know how much COIN to give to you. If you use the current price on any given exchange, you are always vulnerable to manipulations. If you use the average price, you are vulnerable to arbitrage. Both drain the reserve, which is very bad. I think the solution here is that when you deposit BTC, the protocol doesn’t give you your COINS immediately. Instead, it picks some (cryptographically secure) random time in the next week and gives you the coins based on the price at that moment. After all, if you can manipulate the price for a whole week, it’s not clear that it is manipulation :D. This is a solution that works here, but not in general. In trading, you cannot wait very long. Here though, there is really no rush. There are some considerations here, especially if the protocol gets big. But on the whole, proof of work (Bitcoin again!) is very good at generating randomness. 

Market Fluctuations

OK, I admit it. I have been procrastinating about the central question of stablecoins. For good reason though! I needed to describe the details before I could actually discuss the important bits. There is one central question about decentralized stablecoins which do not hold USD one-to-one. What happens in a market crash? After all, Bitcoin crashes by double digits all the time.

Let’s say you have 1B dollars of BTC deposits and 1B of liabilities in terms of COIN. What happens if BTC crashes by 20%? COIN stays the same because it is a stablecoin. But your reserves have lost 20%. You are now insolvent. This is more or less what people thought happened to FTX last week. This week …. 

There are two main defenses to this. Recall that the founder / initial backer locked in 100M and is not allowed to redeem for 10 years. Why is this important? A cold start donor is not strictly required, but in practice, I think likely necessary. If you have no donor, any tiny fluctuation is basically instant death. You are running a protocol with tiny margins and if at any point, say your reserves are only 99% of deposits. This might trigger a bank run! No one wants to be in the last 1% and get nothing. The locked donor is your backstop. Until the time period runs out, he is the last one out. The locking means that for the first decade, you have a 100M dollar buffer whereupon the founder cannot conduct a bank run. Thus, your reserves only have to be at least 100M less than the reserves for the first ten years to survive.

Why might someone do this? Well, some institutions are quite interested in seeing a good stablecoin. Perhaps you can incentivize them by offering a larger than usual amount of STOCK token. Finally, an idea that I’ve been mulling around with but am still very unsure about is that this might be a one angel can save a million sinners equilibria problem. If you jumpstart the protocol for a relatively small amount, perhaps you can drastically shift the equilibrium even if everyone else behaves selfishly. That is, past attempts stablecoins are obviously unstable equilibriums, even while they survived. But maybe not having a stablecoin is also an unstable equilibrium in the sense that if someone jumpstarts it at relatively small cost to themselves, the whole ecosystem can benefit.

OK, but this is just a temporary bandage. The second defense is controlling your growth rate. Most things in crypto (and in tech in general) want to blitzscale. I think you actually don’t want to here. Let me make things super clear. Let’s say you have 500M circulating supply and 1B in reserves. A 2-to-1 ratio is pretty safe right! People think you are ultra-safe and put in 1T dollars of deposits. Now you have 1.001T in reserves and 1.0005T in liabilities. A 1% change in the market prices means that you are dead, dead, dead, dead, dead. You are probably dead with a 0.1% change in market prices. 

So you don’t want to grow too fast. Thus, you want to only allow in deposits that allow you to maintain some buffer. I think a good rule of thumb is that you should only allow new deposits in so far as you can maintain a 2-to-1 ratio between reserves and unlocked COIN. This parameter might be too loose, but if you can hit it, you seem to be relatively safe. No one can do a bank run, because even if everyone redeemed, you have enough reserves to pay off your (unlocked) creditors.

What if too many people want to deposit? Auction it off I guess. Since I doubt people will want to lose money, perhaps you can auction off the amount of time people are willing to lock the money for. You only have room for 10M of deposits this month with 100M of interest in depositing? Have people bid for how many months/years they are willing to lock their token for. If not enough people want to deposit, that’s arguably even better. After all, the entire goal is to get to reserves that are far larger than liabilities. The ideal growth rate is super unclear. Perhaps as some sort of reference. USDT moves on average, 48 times a year. If the reserves get 0.9% (90% of the 1% fee) every time, they grow by 1.009^48 = >50%/yr. Not great, but I doable I suppose. 

Since we are making up numbers, let’s make up some more! Tether has a 66B market cap. If COIN starts with a 100M initial deposit and manages to raise 1B total relatively early, it will take about 10 years for the reserve to fully catchup up from transaction fees alone (1.5^10 = 70). While that may sound like a long time, it seems likely to me that growth would probably happen via locking / depositing BTC rather than fees. I suspect the phases will look roughly like this:

So there is a double race in a sense. First, you will grow. And in this growth phase, your reserve ratio will be roughly constant because any excess reserve will be diluted with new deposits. And then after you hit equilibrium in the growth sense, THEN you need to hit equilibrium where your reserves outpace your liabilities.

Growth Phase. Mainly driven by institutions/protocols that lock large amounts of capital in because they benefit from a stablecoin. The reserve ratio is low but risk of bank run is also relatively low because these locked institutions backstop everyone else.

Stable Phase. Eventually the locking stops and the trust is converted from knowing that you can get out before the big capital holders can liquidate to seeing that the reserves dwarf the liabilities.

As such, the stablecoin is largely functioning very early on and can rise to meet demand, but doesn’t become truly “stable” until a decade or so in. That feels like it’s fine to me. Nevertheless, if at ANY point, the value of your reserves falls below the value of your total outstanding COIN tokens, you are at risk of a bank run. And the fact that everything is completely in the public view means that you can’t rely on FTX/Binance/Tether style obfuscations where you claim you have the assets and you actually don’t.

Final Thoughts

Of course, an important question is: if it all goes bust, who is left holding the bag? In terms of seniority, the claims go (unlocked) COIN > Locked COIN > STOCK. STOCK holders get zeroed out first if the protocol goes bust, because there will be no transaction fees if no one is using the protocol. But that’s OK. We never claimed STOCK was stable. Locked COIN cannot redeem until their timer is up, so the seniority is clear. The order at which you unlock is the order in which you can redeem your claims. In terms of marketing, I think it’s probably pretty important to emphasize that Locked Coin is not stable until it is “unlocked.” But assuming nothing terrible happens, unlocked COIN seems like it should be fairly safe. After all, you are supposed to maintain the 2-to-1 ratio and if it goes bust, because the protocol is not growing / being used, I suppose that is indeed a failure of the system, albeit one you can see from a mile away as the reserves are trackable in real time. In practice, if reserves are about to crash too low, the unlocked COIN holders can see 1) the total reserve and 2) when the next Locked coin unlocks, and so they should always be able to exit first. There is a secondary benefit too. Once people cash out, the ratio of reserves to remaining capital (assuming it was larger than 1 originally) will increase, making the system safer for the remaining people. Of course, if you end up below 1 in terms of ratio of unlocked COIN to reserves, the system is toast.

In my mind, this is the way things should go. The founder is locked for 10 years — likely longer than anyone else. At that point, it should be abundantly clear whether the protocol failed or not. So in a sense, this is very much in line with the spirit of Taleb: ultimate skin in the game.

LUNA was a Ponzi and sort of proud of it. FTX was a Ponzi though no one (on the outside) knew it until it was too late. I think this is not a Ponzi. But you might be skeptical, and you should be. It does sort of sound like a Ponzi and I’m only mostly convinced myself that it’s not.

But I would claim that it doesn’t have the core Ponzi property in that early backers get fantastically rich at the expense of people late to the game. Perhaps you can offer more STOCK to early backers, but honestly, STOCK should not be worth very much anyways relative to the reserves, since its valuation should just be some small multiple on flows. Certainly there are no 100,000% APRs here (not a typo).

And most importantly, it’s not a Ponzi because the endgame isn’t hoping no one pulls out. The endgame you actually get what was promised: a fully functioning decentralized stablecoin backed by more than sufficient reserves. It’s just the road to get there which is straight and narrow.