Debate Hour: Stablecoin Governance: Immutability vs Upgradeabilty

uh hello hello um it it all started in Lobster chat uh where those two guys were having a very interesting conversation and I was like that that got to come on stage at stable Summit so I'm really excited to to have Mark and Paul up here um I think the previous debate touched on some of the some of the points but um yeah let's let's let let's kick it off with um is governance needed just to give the token a utility ask does it work well ask him because all token has some value and some utility what does Mor does right so the way I think about tokens in general is just a decentralization tool for taking decisions that no other people would be able to take so for example if you have a decision that requires High degree of like knowledge or high degree of um activity it's very hard to imagine that you know token orders are all knowledgeable and they're all active enough in order to you know take that decision if however uh you don't require activity nor knowledge and you need the decentralize the decision to be as decentralized as possible well you can have a multisig with like you know 10 15 people uh this is how you know like cor like very big Primitives in this in Industry are built I'm thinking like wbtc for example is is built that way uh but then if you want even more decentralization then toen governance is really a way of uh achieving that right so really the way I think of tken governance is really a more decentralized like way of having multi on decisions that cannot be decentralized otherwise not through smart contracts or not through incentives but I think it's really like the last resort uh when you can't you know build it in the code in immutable code we I'm sure we'll talk to this about this again if you can't build an an incentive align system and it's all political then toen governance can be used but to me it's really the last result I think it's a it's a very interesting view um let's uh let's rephrase a bit the debate I do believe and I think you will agree Paul there's less distance between the a governance and the mor governance then and between all networks and all protocols then there is between us and let's say a celsus in terms of centralization decentralization and the value add for the end users to us the the view of governance and the power we give to the Token holders within the a framework is to act as both participant in the governance and the organization of the protocol but also and more uh importantly as fail safe and guard rails because right now on metamorph Vault I have to trust Gauntlet I have to trust air E7 I have to trust sters which are pretty good at their job most of the time except gauntlets but uh but I have the choice to to pick one of them but the issue is that I don't have a fail safe and the other governance is the fail safe of the creators right so okay so let's talk about risk management in the case of governance so we have two approaches one is uh monolithic po a where every single of the 700 risk parameters are determined by token orders right and we have the moror approach where the core is immutable and you have also a lot of risk parameters but uh you have different risk management vaults that have different governance right one of them is maker Dow and maker Dow you know uh is going through the same I don't want to say the same but the similar governance process as a in order to change risk parameters but maybe that's not relevant that's not the you know the best governance mechanism for all uh risk management and so you have like a wide variety of of of doing risk management in Moro and it's completely open it's completely modular so some some like you know steakhous or block analytica have put in place like user governance with Aragon where essentially users of the vaults are able to like veto uh the risk parameters decisions that are taken but at the end of the day like in Moro We don't have a opinion on this like it's really like an Open Marketplace where users will be deciding which governance style they prefer the most which one they value the most for their risk management I think it's it's an important point I think everybody love externalized curation until someone actually lose money and if you look at the previous model morphol like model uh which is more closer to the morphol blue model than metamorpho if I have to be honest it was RAR capital and RAR Capital has another name in the community it's the bad de product because when you don't have curation basically nothing prevent uh low quality and and because of the like you can have you can literally have scams on Mor blue like and yeah you can have scam on Mor blue and but you it's an opportunity like same thing as unisoft by the way like on unisoft you can trade a bunch of tokens that are not the right on the thing is by exposure to Unis swap is usually one block while I have a I can have it for years I have a position if you un you you don't you don't keep it for a block usually I mean just in time you mean LP yeah like LP is a difference I I agree that so um just you you you you you mentioned the the possibility for bad de um there was a CRV accident um early 2023 I think it's a you want to talk the it's a great example to to talk about the CRV attack of November 20 22 so basically what happened is it's a failure there's four main risk in Def and uh that's my talk on Monday uh we have a talk together on Monday not not together but the same room but uh my talk uh we'll talk about the full mearing risk of defi the the main one is smart contract risk but you also have collateral failure price feed issue or rameter issues and that's a collateral curation failure because is a great asset and I love curve and the curve ecosystem and thank us thank them to invite us today but the risk parameter of curve in 2020 should not have remained the same in November 2022 because the secondary liquidity the market cover curve and uh the risk profile of the asset that Chang but the issue is that we were working with people that work no for him uh that we're not able to update the risk parameter to the reality of the markets and that's why we believe at having it's really important to not have immutable risk parameters because the reality of today will not be the reality of tomorrow we are in the industry of the most volatile asset class in the world and bare Market will happen so your protocol should be prepared for it or prepared to die right so on on this specifically so I agree on the idea that risk management is essentially about anticipating the future and so like fundamentally it's not something that's immutable that's not something that can stay static uh Etc you have to have updates of like Risk parameters Etc then the question is how do you do it right and you have essentially two approaches the first approach is really you provide a very passive you know almost a fun to to the user where they they you know they provide your liquid their liquidity and you're going to manage all the risk parameters for them and everybody is going to be treated equally and and you know you trust the governance to to act correctly on this and in the mor so that's the a model on the Morpho blue model so Morpho blue is a trustless and immutable uh lending primitive if you lend to Morpho blue directly like without you know any going through any of the risk manage Vols but nobody does that uh no almost nobody yeah but if if you do if you do it you have to be active like you have to change the risk parameters like if for example there is an oracle failure you have to change like markets Etc and this is why uh at Moro We have built things in layers right so we have the core which is completely immutable and we can talk about code of gradability after uh but which is immutable and then on top you have like the modular layers that essentially obstruct away you know like Risk Management but it's not the only one like account abstraction like those kind of things and uh and yeah and this way users that are depositing in the gaunlet volts in The steakhous Volt uh they don't have to care about those like it will be updated like constantly like it it will change markets if like there is a a risk parameter change that uh that you want but um that imply Trust on the risk creation and yeah like on a you trust the token orders and like ACI and like the leest yeah yeah but uh my voting power in a is from the a token holders like I have zero vote from my own tokens everything is delegated but it's an important fact because when you trust risk creators you trust them to be good at their job and when you provide itat to the gaunlet metamorph volt and those guy decide to be liquidity provider to the counterparty of easy eat as collateral that might be a good idea because Renzo is a good project but the thing is that this Mor Brew uh Vault use secondary liquidity as the price feed and the Oracle and when we got a flash deeg of a few hours 100% of the borrower got liquidated and there's been a tiny fraction Moro is going to be fine but there's been a tiny fraction of bad Dept so user that trusted gaunlet lost money and that's for me a failure of creation right so yeah let's talk about this for a second because I think that's very important so in the case of gaunlet what they've done is uh they have multiple volts and what something that Mor allows you to do as a risk manager is to build different risk tiers different risk profiles that is obviously going to yield differently so I think like the nomination is like Gauntlet Prime for example only exposes you to I think two or three blue chip assets say wbtc STS it's really like the most Blue Chip field you could ever hope for it's like you know you don't get exposed to like you know 20 assets and and I don't know how many risk parameters it's extremely simple 1,000 lines of code in total is to me feels like the probably one of the lowest risk opportunity in defi then you have the gauntlet core volts or The Gauntlet LST volts that have uh different risk profiles they on board much more collateral and they're yielding much higher than uh their incumen and much higher than a na or or a compound for example and yes like consider the bad depth not sure oh so the the bad depth that gaunlet got in this Vault was accounting for two days of Interest so it means that the the big bad dep that that Mark Zeller is talking about is two days of Interest so um I think there there is you know to bring it back to stable coins right so so there is this challenge of you know you have multiple different vaults which the pool Tok of those volts is unique for each of them right and when when we talk about stable coins you need to have the the fungibility right you need to be able to achieve scale so so does immutability hinder scalability I think there's a two way to to and I'm not sure we disagree on this one uh I believe that the base layer of M M blue has no users and we never have users for the same reason RAR Capital was not a great ID and I don't think agna is a great ID if you are in the room hello uh this layer the user experience and the secate liquidity and the active management make it absolutely not scalable in that sense and when you have segregated liquidity usually you end up with a cost of liquidity that increase that also make it non interesting but I do believe there's value in allocation of liity providing and what we call internally raking and probably what you call internally like allocator or whatever to have some kind of flavors of that so according to the risk profile of the user in a cated way on our side and in the more whatever on their side you will have different risk exposures just like in traditional Finance you can have exposure to RIS trench that will yield different uh profits go for you yeah so so yeah let's talk about liquidity and fragmentation and everything if it's a very misunderstood Topic in general so liquidity is essentially like the availability of liquidity at the moment you need it right and so in the a model and what's really was like the big success of like when compan came out and also what made the success of a and still does today is really the fact that all the liquidity is fungible right you you can go like everybody is treated equally so if you come and borrow usdc like there is a a huge pool of liquidity that is available the downside is of course that you know if you're a usdc ler you get exposed to the worldall pack but but you know that has worked very well like a has $ 20 billion and and this is awesome and so like a common idea is that if you have isolated markets well you have usdc liquidity fragmented into like let's say five different collaterals uh so on Morpho BL you would have the usdc liquidity that is uh you know backed by BTC the one that backed by S the ones backed by whatever like collateral is probably more risky than what you can find on a uh but what matters uh is really what the users like the the lenders when they withdraw what they're able to get or the borrowers when they borrow what they're able to get right and so in Moro We have two components that are built on top of Morpho blue that really solve entirely for this and does actually better than monolithic Landing poles the first one is metamorpho which is essentially reaggregates liquidity for lenders so if you're depositing in a metamorph and this metamorph is going to deposit into five different you know isolated markets well you get the exact same liquidity profile that you would get as a lender if you're depositing on compound or if should depositing on a on the baring side we have the public allocator so the public allocator is a just in time RFQ system to get liquidity just in time at the moment you borrow so let's say liquidity is fragmented in five different markets at the moment you're going to borrow if the risk creators said okay we consider those markets to have the same risk well liquidity will be taken from those different markets just in time so you get the same liquidity profile as you would get on a compound or on a but where it gets interesting that we don't have only one volt we have multiple volts expressing different risk profiles and those volts will share liquidity to the extent that they share race so what that means that on a and on compound for example you have the same assets listed right or on spark you have like s you have whis you have wbtc Etc but those pools are fragmented right like they fragment entirely liquidity in the moro model if you rebuild like a nav like if you rebuild a compound like a spark like they would share liquidity to the extent that they share risk so it's an overall more liquid model then if should build everything as monic well it's so liquid that you need this guy for 65% of your tvl right what sorry you need spark for 65% of your tvl because it's so liquid right yeah but how is that linked to liquidity like what's what's the link with liquidity ofite of this I think the model are not that different uh with V4 that you are aware of we have this concept of liquidity layer which is basically more efficient of what you way to do things that what you just say like in what ways what in what ways like because to me the liquidity layer is like one big pool of liquidity managed by the Avid that you can allocate to many different things correct to my understanding you are focused still on Main net for now and all liquidity layer on V4 is crushing because we have the ability to maintain bird aen on any sh so you will have the ability to have your collateral main net and for example your depth in go or in a tokens on um Bas Network for oh yeah yeah we don't ens Trine bridges in the in the morer protocol yeah for now you will have them eventually uh I'm not so sure then we will add them instead of you um um so I don't think there's much difference here I think there's a difference of implementation the main difference will be that the quad railers that we have is governance because everything that you describe is done by external creation and external uh actors and other token holder more more importantly as a borrower I don't get a say in in all this organization so if I'm basically borrowing liquidity from whatever in in your system and then the counterparty so the lp liquidity provider that brings the liquidity on my loan this decide that overnight the risk a change or the collateral my collateral value is not as good well they're going to wreck my liquidity and my interest rate will go high very very quickly in RV this can happen because risk parameter can change true governance decision but all user can voice their opinion and they are aware in advance through a governance process that something going to change within the protocol so there's no way an a user is ragged overnight if there's something not favorable for them in terms of risk parameters it's at least 10 days away I don't think your system allow that yet right so just to make sure I get it uh so you're saying on a uh borrowers uh they don't need to uh do anything and they can remain passive that's essentially the AER and that you would take over like all the risk management for them I'm saying they have a say because there's an actual governance so right yeah so I think the yeah okay so very quickly on this I think the idea is that just Morpho is built in layers and not as a monolith so you have the the core protocol of morph blue and then on each side you have layers abstracting away like Risk Management liquidity aggregation account abstraction Etc and that's true for lenders and for bars and to this day uh We've released uh metamorph volts and we've released the public allocator for bars we don't have certain features for bars for example the ability to easily change like markets or have like cross collateral those kind of things uh but uh but yeah like this is definitely something that's easily buildable on Moro without teasing too much I think you you have a vision of that is most analytic that is probably not completely true because the simple fact that we are on nine different network at this point I don't know if it's eight or night but something like that there's a set of risk parameter on every single layer we are so just by that the risk parameter you will have for one asset on mainnet will probably not be the same on scroll for example that's also a layer approach and also with the concept we defend at the ACI I understand it's not uh implemented yet but uh of relending we will have several markets we a markets so the one that just passed governance so I can talk about it as a done fact because talking all the I've talk about it is the Lio a market so this Market will be specialized on itat and E correlated asset the risk parameter you will have and the collaterals you will have there and the liquidity you will have there will be different on than the on the a market a a main market and as a user you will have the option to deposit on the main Market on the Lio a market or both at the same time and let the protocol decide what's the the best heal for you because you are a profit maximalist so you will have at Maxi option I want my collateral to be at only or cross collateral option I want my collateral to be anything in the blue CH Market or anything that provide me the best mody so so you're fragmenting liquidity into two different aols now no because the user are still other users so um I want to just shift for the last question because I think you know we we we've talked a lot about the mechanics of the of of the Lang markers but I mean ultimately like um stable coins are meant to serve as money and there's there is thrust assumptions around that and inevitably you know it's about having a product that is capture resistant so um how do we solve for capture resistance in the case of upgradable infrastructure right so so if it's if it's immutable presumably there is nothing to capture but how do we how do we solve for that when there is upgradability yes I think oh sorry go uh there's two layers there's the erc20 layer the token layers so for example if you have usdc and circle decide that one user in a is a bad guy you Circle will not have the ability to freeze a usdc a deposit within a because there's no freeze method within the a protocol but they will have the ability to do something to their address regardless of what is happening on a and the same thing Happ on Moro if you have usdc on Moro on the circle layer they can do whatever they want on the T layer they can do whatever they want and it's actually a very important thing to consider is that even the centralized table coin they have usdc as collateral most of the time it's it's the case for D but it's also the case for goo on a around I think 5 to 10% of Goo is backed by usdc right now so Circle can act on it it's more than that on D and that's something that is important and I think not discussed enough within the ecosystem is that no matter how decentralized no matter how imitable your protocol is you still rely on third parties and how they design their things on their side yeah I agree with that um I think just coming back to topic immutability versus upgradability I think we have to distinguish like what we're talking about and and really there is like the the code and the uh the management/ governance for example of the stable coin uh when it comes to code I'm a big immutability maximalist uh the reason why is because uh for two years I've built an upgradable uh landing and baring protocol built on top of a which uh until today still has like something like 1.5 billion on on a and frankly building on top of an upgradable protocol is really really more especially if you do it at scale and you're planning to scale with like a lot of like uh tvl and stuff essentially you have to make sure that every time the underlying protocol is upgrading is not changing this one line of code that you're using and when you think about it when an upgrade is performed in a protocol how do you know like developers don't check if the lines they're upgrading they are essentially critical for the smart contracts that are pointing to the upgradable platform and this is really something that's completely underestimated I think in the in the defi e system is that if you really want to build something that people can truly reliably build on top it has to be immutable otherwise like you can upgrade your protocol and it's probably going to kill like another protocol without you even knowing it on the risk management side uh we're on time so I I'll just give Mark like 30 seconds to respond to that because it's an interesting point well it's a great advertisement for the AV because if something change on the avig base there's going to be a governance decision and there's no other way that no will vote to implement that so you will know at least 10 days in advance and you can react if something change in a allocator for gaunlet well tun can wake up a morning and BR you thank you for this so the Avid the Avid checks that every single line of code that is changed is not impacting all the thousands of contracts pointing to the a contract I'd love to see that because that's not true that's not true I I love that we ended on a contentious Point thank you guys for joining thank you thanks everyone for being here [Applause]