crvUSD: a novel stablecoin design by Curve

Key Points / Takeaways

• On May 17, Curve officially launched the user interface for crvUSD, marking the official public launch of its stablecoin.

• The main idea behind crvUSD is its novel liquidation mechanism ‘LLAMMA’ which turns borrower’s collateral into an LP position to enable continuous collateral rebalances using a special-purpose AMM (“soft liquidations”) as a borrower-friendly, less-volatile alternative to forceful liquidation processes typically implemented on other borrowing platforms.

• Prior to its official public launch, crvUSD contracts were first deployed on Mainnet on 5/3/23 as the Curve team was “testing-in-production” using real funds. Over the following two weeks leading up to the official public launch, multiple redeploys of the crvUSD were required to patch bugs and implement new optimizations. While some critics believe there are more prudent methods to conduct testing prior to launching a new product, these practices may have been necessary due to the team’s commitment to building an immutable protocol.

• Some community members also questioned the decision to launch the stablecoin starting with Frax’s LST frxETH as the only supported asset, considering its market size is considerably smaller compared to market leaders Lido, Coinbase, and Rocket Pool. The Curve team noted that support for Lido’s stETH would be next and that other supported collateral types would be added through governance.

• The Curve team has consistently been pushing the boundaries of new DeFi innovations and with crvUSD, Curve has the potential to set new standards across DeFi including with helping establish ETH LSTs as the default base token, inspire lending platforms to adopt more favorable liquidation practices, push decentralized stablecoins to be more decentralized, and it can potentially kick off a new wave of superDapps as other major DeFi protocols look to launch new products, including Aave with its soon-to-be-released GHO stablecoin.

• Even though crvUSD minting volumes have been relatively modest since launching just days ago, expect crvUSD to have a large impact on boosting yields and voting for gauges on Curve and to move up the ranks to compete with today’s leading stablecoins.

Introduction

Curve Finance is a leading DEX that is optimized for cheap, low-slippage trading, particularly for stable trading pairs (e.g., swapping between similarly priced assets such as USDT:USDC and WETH:stETH). Curve pioneered the StableSwap AMM model, a more efficient approach to balance liquidity pools compared to the commonly used constant product invariant method (x*y=k). Curve later expanded its core stable AMM to more volatile trading pairs with Curve V2, which introduced the concept of automatic concentrated liquidity. Curve’s two most popular trading pools are the 3pool (USDT / USDC / DAI) and tricrypto2 (USDT / wBTC / WETH).

The Curve protocol is decentralized and managed by the Curve DAO. CRV token holders can vote-escrow or timelock their CRV for veCRV, which enables holders to participate in governance and earn 50% of the trading fees generated by the protocol. veCRV holders are primarily DAOs that aim to use their voting power to help bootstrap liquidity by directing CRV emissions via gauge weight voting. The battle for liquidity via gauge weight voting laid the foundation for the ‘Curve Wars’, where third party platforms with large veCRV balances would accept bribes to support certain gauge weights.

Today, Curve is a top 3 DEX on Ethereum but lags Uniswap on overall DEX volumes by a wide margin. However, for stable-stable trading pairs, Curve has historically held a commanding lead over Uniswap and other DEXes, though Uniswap has recently surpassed Curve on this metric over the past several months this year.

Curve Finance Founder Michael “@michwill” Egorov initially revealed that Curve was exploring launching a stablecoin while presenting at a conference in July 2022, later releasing the crvUSD white paper in November 2022. On May 17, roughly six months since the white paper release, Curve officially launched the user interface for crvUSD, marking the official public launch of its stablecoin.

crvUSD stablecoin

crvUSD is a CDP-style stablecoin (collateral-debt position; similar to MakerDAO’s DAI) built on Curve; it can be minted by depositing a volatile collateral (e.g., ETH or liquid staked derivatives of ETH) and borrowing crvUSD against it.

What differentiates crvUSD from DAI and other overcollateralized stablecoins is its novel liquidation mechanism dubbed LLAMMA (Lending-Liquidating AMM Algorithm). LLAMMA enables soft, continuous liquidations for borrowers as the collateral value falls in relation to the debt position rather than a complete, discrete liquidation that is typical on other borrowing platforms such as Maker or Aave. LLAMMA achieves this by effectively turning one’s collateral into an LP position (volatile asset and stablecoin pair) in a special-purpose AMM that gradually rebalances as prices fluctuate. Compared to instantaneous liquidations resulting in 100% loss for the borrower, the LLAMMA mechanism limits potential losses faced by the borrower (< 100% loss) and limits the risk of accumulating bad debt borne by the protocol.

For example, when a borrower deposits ETH collateral and borrows crvUSD against it, the collateral will be all in ETH. But if the price of ETH declines, the protocol will gradually convert a portion of the collateral to crvUSD. If the price of ETH recovers, then the cash may be used to re-collateralize or ‘de-liquidate’ the borrower’s LP position by repurchasing ETH using crvUSD. If the price of ETH falls significantly and the collateral approaches the liquidation threshold, then the entire collateral position may be converted into crvUSD, which should be sufficient to cover closing the borrower’s debt position.

LLAMMA’s specialty-AMM follows a similar design to Uniswap V3 pools where liquidity can be concentrated across segments / intervals (referred to as bands on Curve) – the key difference in concentrated liquidity between the two platforms is that Uniswap enables users to specify their concentrated liquidity ranges while Curve algorithmically concentrates liquidity of LPs around an internal oracle price.

Across each concentrated liquidity segment / band, there is an upper bound and a lower bound price range [Pcu, Pcd] – if the price of the position is outside of this range, then the LP position will be entirely in a single asset (e.g., all in ETH or crvUSD); if the price falls within the range (Pcd < P < Pcu), then the borrower will be in ‘soft-liquidation mode’ and the LP position will be a composition of both assets. Sticking with the ETH-crvUSD as an example:

• For Uniswap V3: if ETH price is above the upper limit of the concentrated liquidity segment (P > Pcu), then the LP would be entirely in crvUSD (selling ETH for crvUSD as the price increases); if ETH price is below the lower limit (P < Pcd), then the LP would be entirely in ETH.

• For LLAMMA on Curve: Curve AMM aims to reduce exposure to ETH when the price of ETH decreases so the balance composition of the LP would be the opposite of Uniswap V3 – if ETH price was above the upper band limit (P > Pcu), the LP would be all in ETH; if ETH price was below the lower band limit (P < Pcd), the LP would be entirely in crvUSD. So under LLAMMA, the change in internal token balances within a band would be the opposite of that under Uniswap V3.

Individual crvUSD borrower positions are all aggregated into a single pool for managing collateral balances. The rebalancing process of selling and buying back collateral assets within the pool is conducted by external traders or arbitrageurs. For the continuous soft liquidation to function as intended, the external price of collateral ETH must be known – LLAMMA pulls price data (oracle price or P_ORACLE) from a combination of external oracles including Uniswap Twap Oracle, Chainlink, and Tricrypto, and applies an EMA (exponential moving average) to reduce price volatility and to limit potential risk exposure to manipulation of oracle prices.

Important: while the collateral pool backing crvUSD debt positions includes crvUSD itself, the price oracle is based on the ETH/USD price and not ETH/crvUSD (this is so crvUSD is not effectively backed by itself).

The AMM under LLAMMA was specifically designed so that changes in external price data (P_ORACLE) would lead to larger deviations in the price in the LLAMMA Pool (P_AMM) to incentivize arbitrageurs to rebalance the pool and perform the partial liquidations or de-liquidations of the pool’s assets.

• When there is selling pressure of ETH on Uniswap and P_ORACLE declines, P_AMM will decline at a faster rate (resulting in P_ORACLE > P_AMM), creating an opportunity for arbitrageurs to deposit crvUSD to swap out ETH collateral from LLAMMA until the prices are balanced again (P_ORACLE = P_AMM).

• When P_ORACLE increases, P_AMM will increase at a faster rate (resulting in P_AMM > P_ORACLE), creating an opportunity for arbitrageurs to deposit ETH into the LLAMA pool to swap for more crvUSD until the P_ORACLE = P_AMM again.

For borrowers in soft-liquidation mode, options to withdraw collateral or borrow more crvUSD become unavailable. To re-enable withdrawals once they are in liquidation-mode, borrowers can either: wait for de-liquidation, repay loans or self-liquidate (repay loan using collateral & flash loan), add more collateral, or wait for full liquidation and withdraw only in crvUSD.

As previously mentioned, LLAMMA’s liquidation mechanism avoids large-scale liquidations that could cause significant market volatility and it enables rebalancing of collateral assets without resulting in significant permanent losses to collateral value. Still, as LPs with constant rebalancing, borrowers face some financial risk with price fluctuations. Greater value loss can occur if the external Oracle price fluctuates sharply or if the intervention of arbitrageurs is not timely enough (e.g., periods of high gas prices may result in fewer profitable arbitrage opportunities when there are smaller price deviations between P_ORACLE and P_AMM.) However, borrowers may experience gains in collateral value in certain conditions such as when prices move in a consistent direction.

See simulator of crvUSD by 0xreviews and diagrams from 0xstan for visualizations on the rebalancing mechanism.

Other Peg Stabilizing Mechanisms – PegKeepers and Monetary Policy

crvUSD is still subject to price fluctuations due to market volatility or sudden changes in liquidity. LLAMMA is the first and primary line of defense to maintaining crvUSD’s peg to $1 as the mechanism is designed to keep all crvUSD debt sufficiently collateralized and incentivizing arbitrageurs to limit mismatches of the collateral prices in the LLAMMA’s liquidity pool with external price sources (so P_AMM ~ P_ORACLE over time).

Other tools available to maintain crvUSD’s peg to $1 include:

• Automatic Stabilizer (‘PegKeeper’). PegKeepers have mint / burn capabilities to decrease or increase the crvUSD price during periods of price deviation (similar to FRAX’s AMO or ‘Algorithmic Market Operations’ Controller). When crvUSD is trading above $1 due to temporary increased demand for the stablecoin, PegKeepers can mint uncollateralized crvUSD to deposit to the stableswap pool single-sided to return the price to $1. When crvUSD is trading below $1 for any reason, the PegKeeper can withdraw crvUSD from the pool and burn the stablecoin. Stabilizer and AMO modules can help maintain the stablecoin’s peg without having to rely on large capital-intensive PSM pools. At crvUSD launch, four PegKeeper contracts were created. PegKeeper actions defined in the contract can be called by any external caller, enabling them to earn profits in the form of LP tokens. As shown below:

• Monetary Policy (interest rates). Interest rates are incorporated into the AMM. Interest rates increase the size of the loan over time. According to the whitepaper, borrowing rates on crvUSD will dynamically adjust depending on the variance of crvUSD around its peg (borrow rates decrease as crvUSD moves above $1 to incentivize users to borrow and in turn increase the supply of crvUSD; alternatively, borrow rates can quickly ramp up when crvUSD is below $1 to incentivize borrowers to repay their loans and reduce the supply of crvUSD to increase its price). Borrow Rate Formula is: rate = rate0 * exp(-(p - 1) / sigma) * exp(-peg_keeper_debt / (total_debt * peg_keeper_target_fraction)) with variables including: the total debt incurred by PegKeeper, total debt generated by the user through the Controller, the ratio of the two debts is recorded, the price of crvUSD, and a benchmark interest rate0.

crvUSD / LLAMMA Summary

crvUSD / LLAMMA Summary

• LLAMMA is the primary algorithm used by Curve to manage the collateralization of the crvUSD stablecoin. LLAMMA turns borrowers’ collateral into LP positions, enabling it to replace discrete liquidations with continuous collateral rebalances using the special-purpose AMM.

• LLAMMA reduces losses during liquidation by splitting collateral across different price ranges or ‘bands’. Depending on the borrower’s risk position and the price volatility of the collateral asset, collateral within each price band may be sold and bought back to help maintain sufficient collateralization over debt positions.

• If the price of ETH collateral drops and is below the upper price limit of the borrower’s price band, LLAMMA incentivizes a portion of the collateral in the active price band to be sold for crvUSD in a ‘soft liquidation’. If the price of collateral subsequently increases, the crvUSD would be swapped back for ETH collateral.

• The LLAMMA system relies heavily on arbitrage traders to reinforce crvUSD’s peg. It outsources price discovery to external price oracles (such as Uniswap TWAP Oracle) and generates arbitrage opportunities through the pricing mechanism used for the AMM liquidity pool, which magnifies the price changes in the LLAMMA liquidity pool compared to external pools, incentivizing arbitrageurs to rebalance the pools, thereby performing the ‘soft liquidations’.

• When collateral prices decline and borrowers enter into liquidation mode, borrowers will have the option to repay loans or self-liquidate (repay loan using collateral & flash loan), or in more extreme instances, external liquidators can get involved if a borrower’s health score turns negative (would more likely be triggered by interest accrual rather than price action) which would materialize as an atomic operation where the liquidator would take out the borrower’s LP collateral and pay off their entire debt.

• Aside from the primary LLAMMA mechanism, Curve has other tools to maintain crvUSD including PegKeepers with mint/burn capabilities to influence the supply of crvUSD when its price deviates from $1 and monetary policy, which uses interest rates to encourage more borrowing or repayment activity to influence stablecoin supply and price.

Considerations of using crvUSD / LLAMMA

• LLAMMA provides borrowers with a more favorable liquidation mechanism and allows for more passive management of margin positions. Soft liquidations only change the collateral composition rather than repay a portion of the debt - so by preserving upside potential from collateral price appreciation, soft liquidations should result in overall smaller financial losses for borrowers approaching liquidation levels (borrowers do not incur any financial penalty from soft liquidations).

• Continuous liquidations avoid the potential market volatility and slippage losses that could potentially come from drastic all-at-once liquidations.

• LLAMMA LP positions do not face the same level of impermanent loss risk compared to other AMMs – as prices fluctuate and recover after initially losing value, the borrower’s LP will de-liquidate. There are instances that potentially result in impermanent gains, suggesting that crvUSD could be used as a hedging tool.

• crvUSD can maintain its peg without massive USDC PSM reliance like MakerDAO’s DAI.

• The AMM has its own liquidity, reducing dependency on external liquidity sources (still reliant on external price oracles which may be subject to manipulation). It also leverages other sources of liquidity from Curve and can help direct more liquidity to Curve pools.

• LLAMMA rebalances drive more overall volume and accumulate interest revenue resulting in more fees for LPs, veCRV holders, and the protocol, resulting in a flywheel effect.

• Drawbacks: As collateral positions are turned into LP positions under LLAMA, depositors are exposed to market making losses from constant rebalancing, there is potential for greater value loss of collateral during periods of extreme price volatility and high gas fees, and the general complexity of Curve contracts may result in relatively high gas prices, which can slow active rebalancing from occuring.

crvUSD Deployment Recap

The first crvUSD contracts were launched on Mainnet on May 3. Curve founder Michael Egorov took out the inaugural crvUSD loan in the amount of $1m. The deployed contracts were first noticed on-chain by Curve enthusiasts. In response, the Curve team shared via Twitter that even though the contracts were launched, the official deployment of crvUSD has not been finalized: "As many have figured out, deployment of crvUSD smart contracts has occurred. This is not finalized yet because the UI also needs to be deployed. Stay tuned!"

Even though the UI had not gone up, that hadn’t prevented certain users from interacting with the contract. With the announcement of the second contract deployment the following day, the Curve team reached out to a specific user who had swapped 50k USDC for crvUSD to return their obsoleted tokens, which the user promptly returned in exchange for USDC.

Two days after the second deployment, a third iteration of the crvUSD contract was deployed to fix an issue of unexpectedly high gas usage in certain cases. This new contract had stayed in place for approximately one week as the team live-tested the soft liquidation mechanism via arbitrage trades against Egarov’s $1m at-risk position. The team announced that the findings from the live-testing were that PegKeepers were triggered as intentioned to stabilize crvUSD, and that the borrower’s loss in value was well within the expected limits.

Finally (at least for now), a fourth iteration of the crvUSD contract was deployed on 5/14/23, which added new optimizations for borrowers against slippage value loss from front running and made several other bug fixes and parameter tweaks. For greater technical detail, see the list of commits from Founder @michwill.

Testing in Production

While smart contracts on Ethereum are immutable by default, many DeFi protocols rely on DAO/multi-sig governed code that leverage upgradeable proxy contracts to change a contract’s logic for executing contract functions – this is useful for developers to fix bugs or add new functionality after a contract has been deployed. Often times, DeFi teams can implement these changes without most users even noticing. However, having upgradeable proxy contracts also provides some degree of mutability, which comes with new security risks and can potentially enable malicious parties to exploit user funds.

Throughout its history, the Curve team has remained firmly committed to the immutable route and has chosen to forego the use of upgradeable contracts for most cases – this means that user funds cannot be exploited via upgradeability of the token’s smart contract (note: the only admin change that can be made by the Curve DAO is ramping the A (amplification) factor; contracts cannot be killed by the Factory’s admin). This also means that Curve cannot easily patch newly uncovered bugs without having to fully redeploy the smart contracts. As the Curve team recalled on Twitter, several redeployments were required when launching stablecoin pools: “Stablecoin pools were relaunched 3 times in January 2020. First cryptopools were relaunched 3 times on polygon (that's why current is called atricrypto3). And stablecoin is a much more complex system. So, what's the surprise here? Need to make sure everything works well!”

Testing on mainnet is often required to test new adversarial conditions with real funds at stake, find new areas for gas optimizations and to crowdsource code reviews. Even after spending all the time thinking through all the edge cases, it’s extremely unlikely that a team would get everything right on the first mainnet launch of a novel and complex application as crvUSD.

So now that the front-end for crvUSD has officially been launched, even if more bugs are discovered requiring more token contract redeployments to occur, it’s an encouraging sign for the security and optimizations of crvUSD. Given the mission critical nature of stablecoins and the importance of Curve as the most popular trading venue for stablecoin pairs, it’s imperative that sufficient testing occur for all foreseeable risks to ultimately provide greater assurances in the safety of crvUSD.

Learnings / Observations so far

After each deployment of a new token contract, founder @michwill typically takes out a $1m crvUSD debt position against a sfrxETH (FRAX’s staked ETH token that accrues staking yield) collateral position, then borrows even more crvUSD to take on a risky position that nears the max LTV possible in order to live test soft liquidation process via arbitrage trades. Since the debt position was initiated on 5/6/23 with the third deployment, the price of the sfrxETH collateral fell to a low of ~$1820 on 5/12 after starting at ~$2070 (down ~12%).

By that point, @michwill reported that the first of 10 price bands was completely liquidated from sfrxETH to crvUSD, and the collateral value within the second band had fallen in value due to loss from rebalancing. According to a recap of the liquidation event by the Curve team, “The only position was in "soft liquidation" for about a week and lost several % of value. This was well within the expected limits”. Overall, Mitch noted he had experienced just a 0.5% loss from the starting value, in line with historical back testing as shown in the Figure below from the white paper:

The Curve team also reported over this testing period that “DAO earnings from about 1.5M crvUSD produced by the CDP and from stabilizing crvUSD (especially the latter) were about $2000 for this week. Those were the "test earnings", so they will not be converted to fee distribution, but they tested what is possible in prod”. $2000 in weekly fees on $1.5m of capital equates to ~7% annual yield, a non-trivial rate or return (although we acknowledge that it doesn’t make much sense to extrapolate the one week’s worth of data since the majority of fees were from stabilizing crvUSD and Mitch was intentionally testing the rebalancing mechanism with a highly levered debt position).

According to Github repo for the latest (fourth) deployment, some of parameters for borrows and fee structures set around crvUSD at launch:

• Supported collateral assets: only sfrxETH at launch

• Oracles used: TriCrypto, Chainlink ETH, and Uniswap Twap Oracle

• Stable fee: 0.01%

• Policy rate: 10% if PegKeepers are empty; 4% when at target fraction

• Policy Sigma = 2% when at target debt fraction

• Policy Debt Fraction = 10 * 10**16 # 10%

• Market fee: 0.6%

• Market Admin Fee: 0% (as a % of the total fee collected on a swap)

• Market Loan Discount: 9% (+2% from 4x 1% banks = 100% - 11% = 89% LTV)

• Market Liquidation Discount: 6%

• sfrxETH – Market Debt Ceiling: 10m

• PegKeepers: 4

• Rtokens (reserve tokens): USDC, USDT, USDP, TUSD

• Initial PK Funds: 2.5m (= market_debt_ceiling // len(rtokens))

Note: ## Swap fees go to borrowers (through LLAMMA), there are no admin fees, and interest paid by Borrowers is incorporated into the AMM which goes through the fee_receiver contract and ultimately goes to veCRV holders.

Relevant contracts according to the deployment logs on Github:

Some Community Blowback

The decision to launch crvUSD starting with just sfrxETH was questioned by several communitymembers considering frxETH was a relatively small market among ETH Liquid Staking providers. frxETH was well behind Lido’s stETH and RocketPool’s rETH. Others have raised concerns about the Frax team failing to deliver on its promise to remove its multisig and move to purely on-chain governance.

In response on Twitter, the Curve team explained, “Because frxeth pool was the only one with a good oracle at the time”, also noting: “stETH is coming next, with a bigger cap (cap for this market is 10M)”. Then, at the request of the community, the Curve team later added the following clarification on collateral choices for crvUSD to their official docs: “While testing $crvUSD, the team created a market for $sfrxETH with a small market cap ($10MM) because it had a compatible oracle. Additional forms of collateral are expected to be approved by the DAO.”

The Frax DAO always worked closely with Curve since launching the FraxBP pool (now holds ~$500m in TVL, more than Curve’s 3pool on Ethereum). While Curve’s reasoning about the frxeth pool oracle may technically be valid, questioning the decision making process to start with frxETH as the only market is certainly worth exploring given FRAX’s political influence over Curve as the leader on the DAO CVX Leaderboard, which could go against the Curve team’s commitment to trust minimization and decentralization.

It's clear that Curve, as the most popular trading platform for stable asset pairs, has a lot of influence across DeFi markets. Since the first crvUSD contracts were deployed on Mainnet, frxETH has been one of the fastest growing ETH LSD tokens in the market, up ~17% in just two weeks since May 3 to total over 200k in total staked ETH.

Conclusion – crvUSD could have far-reaching consequences

The launch of crvUSD comes at an opportune time. In recent months, failures and issues with leading fiat-backed stablecoins (e.g., Paxos ordered to wind-down BUSD following scrutiny from the US SEC and New York financial regulators; USDC de-pegged to $0.88 after Circle confirmed over $3bn of deposits were held at Silicon Valley bank) have illustrated the advantages of a decentralized, predictable and functional stablecoin. Even the leading DeFi-native stablecoin options have been negatively impacted by USDC’s depegging including MakerDAO’s DAI and Frax’s FRAX. Curve has clearly applied learnings from failures of past stablecoins to come up with a novel and thoughtful mechanism to build a more resilient crvUSD.

The Curve team has consistently been pushing the boundaries of new DeFi innovations, and now with a new stablecoin to integrate into its existing product suite, they can establish a new set of standards for decentralized stablecoins and lending protocols. Zooming out on the decision to launch with just FRAX’s sfrxETH as the only supported collateral market, Curve has stated that it will next add support for Lido’s stETH – a move which could help establish ETH LSDs as the default base token for DeFi. Curve also has the potential to kick off a new wave of superDapps as other leading DeFi protocols look to launch new products including Uniswap with its mobile wallet and NFT market making aspirations, Blur with its lending product for NFTs, and Aave with its soon-to-be-released GHO stablecoin.

Even though crvUSD minting volumes have been relatively modest since launching just days ago, we expect crvUSD to have a large impact on boosting yields and voting for gauges on Curve, and to move up the ranks to compete with today’s leading stablecoins.