Summary:
Proposed Changes:
- We propose to update the RWA oracle for fOUSG to the current 3rd Party constrained oracle at
0x0502c5ae08E7CD64fe1AEDA7D6e229413eCC6abe
Scope:
- These modifications would impact the fOUSG market only, Other markets, fDAI, fUSDC, fFRAX, fUSDT will be unaffected by this proposal.
Objective:
To remove/mitigate centralization risk through permissioned oracle administration, and increase the robustness and transparency of the protocol as a whole. We believe that this method of verifying prices pushed to the oracle offers a unique approach compared to Proof of Reserves , as it addresses potential risks associated with auditors relying on reference data from a single centralized brokerage API.
Context
Background:
In FIP-04 we updated Flux lending market to source the price of OUSG from an RWA oracle which constrained the price movements of OUSG to be within a fixed bps range of the previously set price.
Summary:
Following from this effort we now propose to migrate to an oracle which dynamically constrains the price movement of OUSG relative to those of SHV, (The underlying asset backing OUSG). The constraints being proposed imply that OUSGâs price can only be set +/- 74 BPS relative to the price movement of the underlying asset.
This oracle ensures that set prices for OUSG are consistent with price movements of the underlying asset. This bolsters the overall decentralization of flux by having set prices verified by independent data sources. The data feed is sourced and provided by chainlink, and can be found on the chainlink website here
Current configuration:
Oracle Prices are currently pushed to the Flux through RWAOracleRateCheck by a centralized multisig.
While this oracle constrains the prices which the oracle administrator is able to set, it does not verify that these price movements are consistent with the movements of the backing asset.
Proposed Changes:
Ingest Data feed for OUSG from RWAORacleExternalcomparisonCheck. This contract ensures that the price of OUSG that is pushed to this oracle is in line with the price fluctuations/appreciation of the backing asset.
Technical Details:
ExternalRateComparisonCheck.sol
We introduce a new âRWA Oracleâ contract that computes the acceptable range of prices using the Chainlink SHV price oracle. It enforces that the OUSG token price change can not be more than 74bps from the changes in the SHV ETF price and also that each price-setting event happens at least 23 hours apart. Additionally, it protects against the unlikely event of a SHV Chainlink Oracle price error by having a check that ensure the price doesnât change by more than 2% in any scenario.
Chainlink SHV/USD Price feed
We have partnered with Chainlink to sponsor a new price feed Oracle for the NASDAQ:SHV ETF and integrated it into our new Oracle system. The SHV ETF is one of the largest short-term treasury bill ETFs by AUM and daily trade volume, so its pricing data can reliably be sourced from multiple highly trusted institutions.
The vast majority of the âOndo I LP Fundâ (the fund backing the OUSG token) is invested in SHV, so we can deduce that the price of OUSG and SHV are highly related over short time horizons.
The price of OUSG is not equal to that of SHV and does not track the price of SHV over long periods of time . The SHV ETF oscillates around a constant price (recently near $110) as its holders are benefited from monthly dividend payments when held on the âex-dateâ.
Implementation details of the new OUSG price Oracle contract:
With the above insights covered, we can drill into the details of the actual contracts. The RWA Oracle constrains the manual price updates with a relative and absolute check.
The relative check compares the price changes of OUSG to the SHV price and ensures that they do not differ by more than 74 bps. To ensure the relative check is always consistent, the OUSG Oracle Price cannot be updated unless there is a recent (past 25 hours) SHV price update in the Chainlink oracle that is different than the previous SHV price update that was used in the previous price set.
The absolute check enforces that the OUSG price can not change more than 200 bps up or down between price updates. This absolute check is enforced at all times and prevents any extreme OUSG price movements in the scenario that the SHV price feed is compromised or erroneous. This contract utilizes Open Zeppelinâs audited access control contracts and has a single permissioned account that can set the price.
Constraint Calculations:
Below are some visualizations on a number line for how the RWA Oracle contract behaves in different scenarios.
(Please be aware that, based on historical data of the SHV ETF and the Ondo I LP fund, these daily price changes are unlikely to be observed in the real world. They are large purely for illustrative purposes.)
When the price of SHV moves +50 bps:
When the price of SHV moves +150 bps:
In extreme cases where SHV moves more than 274 bps in either direction, the contract deems the SHV price unreliable and effectively ignores it. However, the absolute OUSG price change check will still be in effect and constrain the price change to plus or minus 200 bps.
In less extreme cases where the relative constraint can not be ignored (e.g SHV moves -220 bps), we compute the acceptable range like so:
The relative and absolute constraints can be expressed by the following formula.
In the nominal case, when at least 23 hours have elapsed since the last price was set, the range of settable prices are computed like so:
OUSG = the last set price.
max(ousgâ(1â0.02),ousgâ(1+shvÎ â0.0074))
âmin(ousgâ(1+0.02),ousgâ(1+shvÎ +0.0074))
Constraint Selection
When selecting the constraint, we used historical data of the SHV ETF. The daily change in closing price has never moved more than 0.38% (38 bps) in a single day since inception. Historically speaking, the largest observed daily changes to SHV ETF occur on from Ex-dates. To provide a sufficient buffer for future scenarios, we doubled the largest historical daily price change (37 bps) to arrive at 74 bps for the relative check.
Worst-Case Scenario Analysis
The primary benefit of this system is realized when hypothesizing the worst-case scenario. Even if a malicious actor is able to access and push false prices to the oracle, in an attempt to try and profit by setting the price of OUSG to zero and then liquidating borrowers who have OUSG posted as collateral. The RWA Oracle contract would prevent (or mitigate) this as it enforces that the worst possible price manipulation that could happen would be -2% every 23 hours. This should provide users of dependent Defi protocols sufficient time to protect themselves. In the described scenario, this action would be repaying outstanding borrows.
Glossary
Ondo I LP Fund - The fund that backs the OUSG product, whose charter is to hold the SHV ETF and reinvest the dividends.
OUSG token - The ERC20 token that represents an investorâs share in the Ondo I LP fund.
Net Asset Value (NAV) - the net value of an investment fundâs assets less its liabilities, divided by the number of shares outstanding (Net Asset Value (NAV): Definition, Formula, Example, and Uses)
Chainlink Price Feeds - Decentralized system that aggregates real-time pricing data from multiple reputable sources and delivers it to smart contracts on the blockchain. These feeds utilize a network of independent node operators that participate in an incentivized consensus mechanism to source and validate the pricing data.
SHV ETF - The BlackRock-managed ETF that is comprised of short-term treasury bills. The yield from the underlying treasury bills is the main source of price appreciation for the OUSG token.
Ex-Date - The date that determines whether the buyer of a stock will be entitled to receive its upcoming dividend.