Virtual Reserves: The New Shield Against Loan Liquidation Attacks
Building on the Hoyu litepaper, this technical post further examines Hoyu architecture that merges Decentralized Exchange (DEX) and Money Market (MM) components. The protocol design allows permissionless use of any token as collateral, but also requires careful consideration of novel attack vectors due to this new architecture. In this post, we explain how loan liquidation works on Hoyu, discuss a potential attack that could take advantage of a loan liquidation, and showcase how the proposed design effectively neutralizes this threat.
Altcoins and Currency
Hoyu keeps track of two distinct classes of ERC20 tokens: Altcoins and Currency. Note that this distinction is absent in UniswapV2 as we have already seen in a previous blogpost on how a UniswapV2 swap works. Hoyu users make this distinction at the moment of creation of the Pair and the Vault. The most important difference between Altcoins and Currency is that only Altcoins can be used as collateral and only Currency can be borrowed.
Liquidation Mechanics
The Hoyu architecture is composed from two key building blocks: the Vault (MM component) and the Pair (DEX component). These blocks are implemented as smart contracts particular for each Altcoin-Currency combination. Borrowers interact with the Vault and deposit Altcoins as collateral in order to borrow Currency.
When a loan goes bad, it is liquidated. A loan could go bad, for example, due to insufficient value of its corresponding collateral. In turn, the collateral value may become insufficient due to several reasons, for example, (1) the price of the Altcoin going down, or (2) the loan interest accumulating to the extent that the collateral requirement is breached even if the price of the Altcoin is constant.
The liquidation is atomic and takes place entirely between the relevant Vault and Pair smart contracts. In a liquidation, the Vault sends the Altcoin collateral to the Pair, the Pair swaps the received Altcoins into Currency, and sends the Currency back to the Vault. The swap step warrants further attention.
To perform this swap from Altcoins into Currency, the Pair uses liquidity as provided by Liquidity Providers beforehand. The Pair keeps track of the liquidity in its state variables known as the Reserves. If one were to simply use the UniswapV2 swap, the Reserves would change suddenly. To illustrate the point, we plot the Reserves as a function of time in the figure below. In this example, a liquidation occurs at block 25. A collateral of approximately 700 Altcoins is swapped for 250 Currency, therefore suddenly increasing Altcoin Reserves and abruptly decreasing Currency Reserves in the Pair.
This means that the price of a Altcoin suddenly changes. Such a rapid change opens a riskless profit opportunity for Traders at the expense of Borrowers. Let us explore how an attacker might take advantage of this opportunity.
The Liquidation Attack
An attack of this type may involve the following actions:
- A Trader initiates the process by selling Altcoins, which results in a price decrease.
- This selling action triggers a liquidation which further causes an abrupt drop in the Altcoin price.
- Once the price has significantly dropped, the Trader proceeds to buy their Altcoins back at a price lower than the initial selling price.
As a result of these actions, the Trader ends up profiting, possibly by owning more Altcoins than they started with. A Borrower, on the other hand, ends up being liquidated due to this price volatility, even if the final price is similar to the initial price. In other words, the Borrower is a victim of this attack since their loan is still worth less than the collateral that got liquidated.
Most importantly, this entire attack may be executed in an atomic manner in a single transaction and in one block. Therefore, the Trader could borrow the Altcoins using a flashloan at the start of the attack, and repay those Altcoins at the end. The possibility to use a flashloan means that the malicious Trader does not have to hold the Altcoins between blocks, and therefore earns a riskless profit. This is clearly unacceptable and Hoyu prevents such attacks by introducing Virtual Reserves.
Virtual Reserves
In addition to Reserves, a Hoyu Pair also keeps track of Virtual Reserves. Virtual Reserves are here to smooth out the impact of liquidations. Similar to the usual Reserves, these Virtual Reserves are part of the state variables of each Hoyu Pair. More specifically, Virtual Reserves are only used to perform swaps when a Trader buys Altcoins shortly after a liquidation event. In all other cases, the usual Reserves are used instead. For example, when a Trader sells Altcoins, no matter when, the usual Reserves are used to execute their swap.
Note that in a typical AMM DEX buying and selling prices that a Trader experiences are unequal to start with due to finite Reserves and fees. Hoyu's Virtual Reserves, however, exacerbate this difference temporarily. In other words, notably different prices for buying and selling Altcoins arise in the period of time (the Decay Period) immediately after a loan liquidation event.
Example
Consider once again a loan liquidation that takes place at block 25, where collateral of approximately 700 Altcoins is swapped for 250 Currency. Below, we present two figures that (1) illustrate the (Virtual) Reserve as well as (2) price dynamics.
In first figure, the blue lines show Currency and Altcoin Reserves. Both lines have an abrupt change at block 25 due to the liquidation. A liquidation means that the Hoyu MM component (the Vault) swaps collateral (Altcoins) to the Pair and gets Currency in return. Therefore, the amount of Altcoins in the Pair increases, while the amount of Currency in the Pair decreases. Both changes in Reserve occur suddenly. The Virtual Reserves, however, change linearly (orange lines) and differ from the Reserves by a decaying offset. In this example, the Decay Period is set to 100 blocks. That is, the Virtual Reserves become equal to the actual Reserves in 100 blocks after the latest liquidation event irrespective of other activity in the Pair.
The decay of the Virtual Reserves introduces a favorable price dynamics in the period after a liquidation. In particular, Traders who wish to buy the Altcoin compete along the time and price dimensions. They may buy the Altcoin early and get a low discount (as compared to the price before the liquidation). Alternatively, they may wait longer and get a better price. However, a longer wait introduces the risk that another Trader executes their buy order instead, therefore pushing the price back up.
Note that this decaying price dynamics (orange line in the figure below) coming from the Virtual Reserves only affects Traders that wish to buy the Altcoin. The sellers of the Altcoins experience the usual abrupt price changes (blue line) due to the Reserves suddenly changing. The difference between Reserves and Virtual Reserves therefore opens a temporary gap (spread) between buy and sell prices as shown in the figure below. Here the price decreases from 0.5 Currency/Altcoin to around 0.28 Currency/Altcoin. Note that even though Virtual Reserves change in a linear way, the price does not.
Preventing the Attack
Coming back to the liquidation attack, we see that even if the malevolent Trader were able to sell a large number of Altcoins in order to force a liquidation, they would not be able to buy those Altcoins back at a significantly lower price in the same block. This is because the liquidation opens a sell-buy price spread proportional to the liquidation amount. Since the attack cannot be executed in the same block, the attack cannot be executed as a flashloan, and hence loses its riskless character. The improvement endowed by the Virtual Reserves is even more attractive than one might initially consider: multi-block MEV attacks are also prevented due to the time-price dynamics discussed in the previous section.
Summary
To recap, Hoyu's novel architecture creates a new potential risk: liquidation attacks. This risk is specific to Hoyu's structure due to its combination of DEX and MM components. To mitigate this type of attacks, Hoyu has introduced the concept of Virtual Reserves. These reserves are activated during a liquidation event and create a temporary price difference between buying and selling Altcoins. The implementation of Virtual Reserves prevents immediate completion of an attack, thus invalidating the possibility of a riskless benefit to the attacker. Overall, this post sheds light on how Hoyu's architecture, while presenting unique risks, also provides innovative solutions to maintain system stability and security in the DeFi space.