Analysis of Market Price vs Exchange Rate for wstETH
TLDR: Market price is always a better pricing mechanism when the risk parameters reflect that liquidity is somewhat volatile, however it puts constraints on the market size and attractiveness over time. The exchange rate has its own set of trade offs but there can be some security measures taken to limit the possible worst-case scenarios and associated toxic flow. We believe that, given the trade-offs, the exchange rate should be considered the real price in Morpho.
All of the critiques about secondary price, liquidity and oracles can arguably be made for any asset. The material difference here between pricing, say, SHIB and stETH, is that there is in theory a well functioning primary market to convert stETH for ETH, namely staking withdrawals. The question at hand is whether it is the primary or the secondary market that should be the source of the price, both of which come with their own sets of constraints which we will dive into below.
First thing to note is that LSTs trade mostly on DEXs or their affiliated CEX if there is one. For example, in order for Binance to incentivize their users to stake on their platform, they do not list cbETH or stETH. In addition, staking on Binance is often turned on for users whenever they hold ETH. Taking this into account, we will focus on DEX liquidity which is the most relevant for liquidations in the course of normal price drops and scenarios where there is not massive panic in the market.
Market price
TLDR: Continuing on its current path, the quality of the secondary market price data for LSTs will only become poorer over time as users seek more profitable avenues than providing liquidity on DEXs. As such, using market price data will either lead to the size of the market being increasingly constrained to reflect the deterioration of liquidity, or create the opportunity for manipulation if proper measures are not put in place.
The below paper studies the profitability of liquidity providers for LST/LST and LST/native asset pairs on DEXs. The key takeaway, beyond which type of pool should be used for a particular pair if you want to be an LP, is that most LPs in these pools underperform compared to simply staking.
What this means is that, as an LST holder, there is no clear incentive to provide liquidity on DEXs, since holding the LST will generally yield better returns. Moreover, by sticking to only staking, the LST holder will be exposed to less smart contract risk compared to staking + LP.
This paper is anonymized because it is a submission to Financial Cryptography and Data Security 24. We will credit the authors whenever we have that information.
See below some recent data on (w)steth used as collateral on lending platforms.
The two charts below illustrate (i) the total value of tokens paired with stETH on DEXs and (ii) wstETH bridged to Layer 2s. The total stETH value on DEXs has been going down significantly over time. Some of the DEX liquidity which going down is due to users switching to wstETH/ETH or pairing with other LSTs, but this is marginal. Most of it is going to simply staking and/or bridging to layer 2s.
Source: Block Analitica forked query from Lido’s dune dashboards to look over the last 12 months.
Source: Block Analitica forked query from Lido’s dune dashboards to look over the last 12 months.
With other attractive options emerging, such as restaking and Layer 2s with “native” yield, as well as the fact that LPs are less profitable compared to simply staking, LST DEX liquidity on Ethereum mainnet is bound to go down further.
Decreasing liquidity is an issue for the price data because it is less reliable and more susceptible to manipulation/noise trades. Moreover, large liquidations are less likely to be profitable.
Using market price also exposes you to how oracles handle the price if there is not a single source of truth, as there is for the exchange rate. This is no different than for most assets. However, it may become an issue when the leverage on these LSTs is in the billions. When liquidity decreases, the venues where the prices are fetched from (and their corresponding weightings) are easy to derive. For assets that also trade on CEXs, it can be more obscure how the prices are weighted.
On December 2nd, the wstETH/ETH oracle on Arbitrum jumped 25%+. It is hard to understand exactly what happened. The author of the tweet below alleges this malfunction happened because of a sandwich attack on mainnet, but for some reason the effects took place on Arbitrum.
There is a similar oracle on Optimism as well. However, the price jump was not reflected there (although as you can see below, the price volatility of that oracle was quite high).
Source: Dune - Block Analitica Research
Source: Dune - Block Analitica Research
As alluded to above, we do know who is submitting these prices, but it is generally not common knowledge how the prices are processed and weighted. For oracle protocols, disclosing exactly how their providers are weighting price sources is a security concern. Mainly because it might put a somewhat clear price tag on how much it would cost to manipulate a given feed. However, in the case of wstETH and most LSTs, the number of dependable sources from which price data can be sourced is limited. As a result, there is a lack of sufficient options to prioritize one source over another.
Even though on mainnet the stETH/ETH oracle is also representing DEX liquidity, these types of price jumps have not happened there as of yet. The liquidity has remained relatively strong despite going down significantly over time.
The one significant depeg happened during the Luna crisis and ensuing period (fun times!).
Source: Dune - Block Analitica Research
The conclusion is that although the secondary market price has been a reliable pricing mechanism pre-merge on Ethereum mainnet, its quality will most likely only deteriorate because of liquidity fleeing to more profitable venues. This, in turn, will lead to tightening conditions and competitiveness on lending platforms for wstETH using market price.
Exchange rate
First, let’s talk about slashing events by diving deeper into what happens, and how much can actually be lost during such events.
At the Consensus Layer
At the Consensus Layer, when a validator is slashed, they get \frac{1}{32} of their effective balance taken away from them and are forcibly queued to exit 36 days later (8192 epochs). On the 18th day, the correlated slashing penalty is applied to the validators in question. During that period, they continue to perform their duties or get hit with attestation penalties. Moreover, they do not receive any rewards, and are subject to any inactivity leak related penalties. The base penalty is 3.1% of their effective balance, which basically would be 1 ETH. See Eth2Book on Slashing for more information.
How does Lido handle these events?
Some napkin math will tell you that a validator can lose 3.1% of their balance because of a slashing event.
Lido has 38 operators (according to their website). So on average, each operator runs about ~2.6% of Lido’s TVL. At the time of writing, Lido represents 31.52% of the staking on Ethereum. So each operator runs about 0.81% of the total staking on Ethereum.
You would think that if one operator goes down, then Lido would lose 3.1% * 2.6% = 0.08% of its TVL from the slashing event, add to that, say, 1 ETH/validator of correlated slashing (since 0.81% of the total effective stake is slashed). So Lido would lose 3.1% * 5.2% of its TVL i.e. 0.16% of its TVL, which is 16 days of earnings. It doesn’t seem like a catastrophic scenario.
However that is not an accurate description of what would happen.
In practice, Lido would go into Bunker Mode and socialize the loss. There would be a negative rebasing event assuming that there wasn’t some crazy MEV, and redemptions would be delayed until it is clear that the proper rebasing has been applied.
Moreover, an entire operator cannot be slashed, only one of their validators will get slashed, and only if they commit a serious offense. For example double signing. Being slow will only incur penalties.
If each operator is on average running 7.6K validators, the likelihood of the equivalent of an entire operator being slashed is unlikely.
There is a lot of details about what would trigger bunker mode and how it’s handled in this document from Lido “Bunker mode”: what it is and how it works, Appendix B explains different scenarios that could trigger bunker mode. In short, it would happen when the Lido oracle notices that either:
there is new or ongoing mass slashing that can cause a negative rebase
there is a negative rebasing in the current frame (a frame is 24 hours currently)
there is lower than expected rebasing and negative rebasing towards the end of the frame (in the last 23 epochs)
There are some scenarios, albeit unlikely, that can result in more serious issues. For example a bug in a supermajority client or cloud providers going down. Some of these examples are also mentioned in the Lido Bunker Mode document.
If the Lido Protocol goes into bunker mode, it will stop withdrawals in order to (i) figure out what is going on, (ii) determine the correct rebasing, and (iii) give time for Lido governance to decide on a course of action if the situation is more dire than a small rebasing event.
All this to say: the exchange rate will be accurately reflected in mild and even in worst case scenarios.
A common misconception about withdrawals
When a validator is forcibly exited, they can only withdraw their remaining balance 36 days later. This is true in practice for solo validators and small operations. However, it is not applicable to Lido and other major LSTs.
Validators are exited by sweeping through the validator set automatically. The size of the validator set is a worst case scenario to get an expected time for a withdrawal to occur for an eligible validator. For Lido, however, who has multiple node operators controlling thousands of validators distributed throughout the validator set, the likelihood of them being able to exit one or multiple validators in a timely fashion is very high. In normal scenarios, Lido can process a large number of withdrawals. So even in a worst case scenarios, for example if one validator, or a few validators from a given operator are being slashed or receive penalties, or if a negative rebasing happens, withdrawals will still be performed in a timely fashion after bunker mode is exited.
From the lending protocol’s point of view, what is relevant are the consequences of choosing the exchange rate on its solvency in worst case scenarios and on the market in the course of normal operations.
From the lending protocol’s point of view
The main concern with using the exchange rate is that it’s hard to estimate the likelihood of a negative rebasing and assessing whether its size would make a lot of the open positions backed by the LST unhealthy or worse in bad debt.
The benefits
Using the exchange rate as a pricing mechanism allows for a scalable market, more competitive parameters, and makes the security of that market tied to the health of Ethereum’s infrastructure – which is less volatile and more robust than the liquidity on DEXs in edge scenarios.
From a market microstructure perspective, the exchange rate is a preferable price source, the preprocessing of which is straightforward. It makes users and the protocol less sensitive to noise trades and manipulation on the secondary market.
Most importantly, it makes the protocol immune to crises in the secondary market which are not tied to the health of the LST protocol. Whereas in protocols that use market price, massive liquidations can occur and can lead to further liquidations.
Only issues arising from Ethereum’s consensus layer can lead to the price worsening, which is less likely than that of the market price, since the market price will reflect it but often at worse levels than the crisis at hand.
The considerations
Making a simplified assumption that all ETH borrowing is backed just by wstETH and that liquidity doesn’t change – it would take a really significant drop in the exchange rate for a substantial amount of positions to become available for liquidation and/or to be instantly in bad debt in the current configuration of the different lending platforms.
In the case of a rebasing event, the jump in exchange rate will be significantly smaller than what the current configuration of wstETH can sustain even in most lending markets. The most likely negative rebasing events - which are unlikely - do not create a scenario where an informed user can exploit the protocol before the rebasing.
DEX liquidity will be drained before anything happens. Given the current leverage, it will likely lead to liquidations if no action is taken.
In practice, if Lido goes into Bunker mode, there will most likely be panic on the market before it happens and DEX liquidity will most likely be meaningfully depleted by then by players that are constantly monitoring the beacon chain.
However, in a scenario where the liquidation price is tied to the exchange rate, worsening secondary market conditions will not create a liquidation spiral and likely will not put user’s funds at risk of liquidation.
There will be an arbitrage between DEX prices and lending protocols that use the exchange rate as the price. They will be quoting wstETH higher than the secondary market. People will tend to buy on DEXs and deposit and borrow ETH against it if the spread is big enough to make a profit.
Using exchange rate might create toxic flow in case of a secondary market price depeg
If:
Consider:
In other words, a large enough discrepancy between the exchange rate and the secondary market price makes it profitable to deposit into the lending protocol and borrow as much ETH as possible.
ETH liquidity will flow from lending platforms to DEXs as long as the price dislocation between exchange rate and secondary is greater than that ratio. This might lead to 100% utilization of ETH.
Assuming that the chain is not going into an inactivity leak, then this is not a catastrophic scenario. There will be some friction for users to withdraw their ETH liquidity, however, they will likely be earning far more than the staking rate, and some will deposit to take advantage of it. Moreover, liquidity from leveraged long user liquidations can flow in as their leveraged position becomes unprofitable.
However, the lending protocol might want to avoid prolonged 100% ETH utilization for different reasons. Mainly because the liquidity is needed for liquidations to occur if there is rehypothecation, to keep good UX for users and give them liquidity if they have underwater positions elsewhere.
This trade will likely be limited by the high slippage that users will incur on DEXs and how much ETH liquidity is available for borrows on any given lending platform.
Before any of this happens, it is likely that savvy users will already max out their borrowing power and deplete ETH pools when foreseeing the secondary market price worsening. Even in worst case scenarios, the exchange rate is a preferable solution. It’s important to note that there are catastrophic scenarios such as an inactivity leak where it is hard to draw conclusions. In those scenarios, when the chain is not finalizing, the concepts of DEX liquidity and transactions become more mirky.
Conclusion
Our conclusion is that for wstETH, the best available solution for lending platforms to price wstETH against ETH is to use the exchange rate instead of the secondary market price. Furthermore we recommend that proper measures are put in place to protect against worst-case scenarios and ensure that the health of the protocol and its users are protected.
References
