Article by Max Holloway (@max_holloway) | Paper by Thomas Cintra (@tncintra) & Max Holloway

A key component to user adoption of financial products is that they trust their assets will remain safe. Whether they're trusting a bank due to its FDIC insurance, or they're trusting a decentralized lending platform because of its open-source code, the product must inspire confidence in its users that their assets are safe. In the case of dYdX, users can gain this confidence by auditing dYdX's on-chain verifier contracts. However, it is clearly not realistic to assume that all users will audit this code, and even if they did, it is still unrealistic to assume that those auditing the code can diagnose every vulnerability. To protect users from the case where dYdX cannot pay back its depositors, the protocol uses what is called a safety staking module.

The safety staking module is a pool of funds with the following attributes.

1. Users deposit DYDX token into the module, and they must wait for a lockup period before withdrawing the DYDX token.

2. Governance can vote to "slash" the DYDX in the module via an on-chain governance vote, then send the slashed DYDX to any other Ethereum address.

3. There are 383,562 DYDX paid in interest to pool depositors each 28-day epoch, and the depositors' share of the interest is equal to their share of the DYDX deposits.

It is the stated intention of the safety staking module that it only be slashed in the case of a shortfall event, which could take the form of an exchange insolvency or a smart contract exploit, although if governance were corrupt, it could slash these funds without any justification at all.

Currently, the safety staking module holds ~40M DYDX tokens, and the module's depositors receive a cumulative 383,562 DYDX per epoch, which annualizes to a 12.5% return.

The safety staking module is scheduled to last for five years, over which time it would account for 25M DYDX, or 2.5% of the DYDX token emissions. Considering the fact that this module accounts for tens of millions of dollars worth of emissions, it is prudent to ask: is the safety staking module optimal in its current form, and if not, how could it be improved?

To know if the safety staking module is optimal, we must define the objective. In this case, our objective is simple: maximize the safety staking module's insurance power, given a fixed amount of DYDX emissions. We define insurance power as the amount of USDC that we could receive if we sold the slashed assets from the safety staking module in a reasonably short (<1 week) timeframe.

Under this objective, the current safety staking module's design is abysmal. In the case of a shortfall event, the protocol would need to pay users affected by the shortfall event in USDC. Converting all of the DYDX in the safety staking module -- i.e. 29% of the circulating supply -- would have a devastating market impact. Even if the DYDX token price was unaffected by the shortfall event, dYdX would only be able to salvage pennies on the dollar when auctioning off millions of DYDX tokens.

To make things worse, it is not fair to assume that DYDX token price would go unaffected in the case of a shortfall event, prior to a token sale. Fundamentally, a shortfall event provides three pieces of meaningful new information: (1) the protocol is less economically secure than previously thought, (2) the protocol is less capitalized than previously thought, and (3) there is a chance that up to 40M DYDX will be dumped onto the market to cover the event. Although we do not speculate on the precise impact on price, we believe it is fair to say that a shortfall event spells bad news for the token.

The fact that DYDX is the deposit asset is a massive issue for the dYdX safety staking module. In our paper, we also outline other issues, such as the impractically small lockup period, and the inherent conflict of interest wherein safety staking module depositors receive governance voting power.

The majority of the safety staking module's issues can be resolved by simply changing the deposit asset. In our paper, we consider two alternative deposit assets -- USDC and DYDX-USDC Balancer Pool Tokens -- and one can imagine even more exotic yield-bearing deposit assets, such as Aave's aUSDC or Yearn's yUSDC. All of these deposits have varying risk and return tradeoffs. Since we prioritize the safety staking module's security over capital efficiency, we believe a USDC-based safety staking module is the best solution.

Using USDC for the safety staking module's deposit asset has a number of benefits; it would markably increase the module's insurance power, it would eliminate conflicts of interest between the module's participants and dYdX governance, and ceteris paribus it would most likely increase the notional value of the module.

Although this change is conceptually simple, it nevertheless requires an engineering lift to migrate from the current safety staking module to a USDC-based one. While we would like for these changes to go into effect immediately, the dYdX team has declined to allocate the engineering resources necessary to create and deploy these new contracts until the launch of dYdX V4. Therefore we suggest that the next steps of this work be split into two parts.

First, we should halt emissions to the current DYDX-based safety staking module, since the current module does not provide meaningful insurance power to the protocol. Second, we should create a USDC-based safety staking module once dYdX V4 has launched and the dYdX team has sufficient engineering resources.

User trust is an essential component to the success of any financial product. In light of recent shortfall events with centralized exchanges and lending desks, the promise of a noncustodial exchange is more pertinent now than ever. Shortfall event insurance supplements the benefits of dYdX's noncustodial exchange.

Although self-insuring the protocol via a safety staking module is an excellent idea, its current implementation on dYdX has a fatal flaw: the DYDX token is the insurance asset. This renders the current safety staking module nearly useless, and as such we believe it is best for token holders to halt emissions to the module. After dYdX V4 is released, we believe a USDC-based safety staking module would provide an apt insurance mechanism.

Phase 1 of these changes -- winding down the current safety staking module -- has passed an off-chain snapshot vote, and it is now slotted for an on-chain vote, beginning on November 22.

We believe that dYdX has a chance to grow into a world-class exchange, and to do so, we must be smart about the way we issue DYDX. Let's do the smart thing and wind down the safety staking module.

Links

• Research paper

• Dune dashboard

• Off-chain Vote

• On-chain Vote

Disclosure: Reference to the DYDX price is necessary for this research. The authors do not own DYDX token, nor are they affiliated with dYdX Trading Inc. or any of its affiliates. This research was funded by the dYdX Grants Trust. Any opinions and results stated here are those of the authors, not of dYdX, its affiliates, nor the dYdX Grants Trust. This is not financial advice.