Given that Anchor’s integration with Chainlink’s oracle network is already in the pipeline, I believe this unfortunate event provides the perfect occasion for Anchor’s community to devise a policy regarding protocol malfunction. Fortunately, the scope of the damage is relatively small, too, compared to the sheer amount of assets under management.
I encourage everyone to consider this issue as a matter of policy rather than a one-of decision: our decisions will set a precedent that will serve as the basis for future stakeholder’s expectations.
Some of us have emphasized on the fact that smart contract and oracle risks are always a given when dealing with Anchor and DeFi as a whole, and that, thus, transferring losses from impacted wallets to Anchor stakeholders is somewhat unfair. I agree on principle: the risks of interacting with Anchor protocol were not obfuscated and thus, it is the user’s responsibility to assess risk before interacting with Anchor or any protocol.
That being said, to my understanding, the responsibility for the faulty liquidations lies with the protocol, as it was the Anchor Oracle Price Feeder and not an exogenous piece of infrastructure that malfunctioned. Furthermore, I believe it is in the long-term best interest of Anchor’s stakeholders to take remedial actions :
- Anchor is positioned as a reliable and stable source of yield for both crypto natives and ‘‘normies’’. Confidence in the protocol is of the utmost importance if we intend for Anchor to receive large deposits, and deposits from non crypto natives which are more risk averse than us fellow degens.
-
Anchor does not exist in a vacuum, other protocols have been faced with faults and hacks before and the actions they took contribute to shaping the expectations of the public. Over time, I believe that protocols which either have a clean track record, or a record of making harmed users whole will outperform protocols which have less favorable histories. I believe ThorChain and Popsicle Finance are examples of how proper remediation can reestablish protocols and chains following faults.
- Finally, setting up a remedial policy now, when the damage is somewhat constrained, should allow us to devise a rational policy to be followed, should another such event happen.
This brings me to the means by which Anchor should make users whole. Because the liquidated collateral is not in Anchor’s custody anymore and because is immutability is one of the main features of blockchain technology, rolling back the transactions is not possible. I also don’t believe that TFL should be involved in making users whole, unless TFL’s liquidator directly participated in the faulty liquidations (in which case this portion of the liquidations could be reversed via bona fide retrocession of the collateral). Finally, because it is not the purpose of the yield reserve to be drawn upon to make borrowers whole and because remedial action should not hinder the protocol’s ability to pay out the advertised yield in the long-term, I believe we should refrain from mobilizing the reserve.
This obviously narrows the toolsets available to our remedial action but here’s what I believe to be the best course of action:
Recognize that, as ANC stakeholders, we are underwriting the protocol for the better and worse, and accept that making users whole will most likely have an adverse impact on the price of ANC in the short-term.
Set-up a remedial plan whereby ANC from the community pool is gradually sold on the open market for UST and streamed to the impacted wallets so as to make them whole without crashing the price of ANC.
Recognize that, as underwriters for the protocol, ANC holders should be compensated for the risk they take. This is in line with the discussion around ANC’s tokenomics which arguably need some tweaking, and perhaps a move from the buyback system to perhaps a protocol yield sharing model, but these considerations deserve a thread of their own.