Coinbase cbETH
Last updated
Last updated
Full report from Prisma Risk Team: https://hackmd.io/@PrismaRisk/cbETH This section will summarize the findings of the report by highlighting the most significant risk factors in each of the three risk categories: Market Risk, Technology Risk, and Counterparty Risk.
LIQUIDITY: Does the LSD have a liquid market that can facilitate liquidations in all foreseeable market events?
cbETH ranks second in LSD marketshare after Lido stETH, but it is by a large margin. cbETH commands around 11% of the market compared to Lido’s 74.4%. While stETH has ~$600m liquidity across DEXs, cbETH has $44.16m pool TVL in DeFi with 9,501.45 cbETH. Over 97% of cbETH is on Coinbase.
The DefilLlama Liquidity Tool estimates a cbETH>ETH swap size of 9000 cbETH (worth ~$18.1m) would produce a 1% slippage. By comparison, a $300m stETH swap would produce a comparable figure. This ranks cbETH at around 6% of the on-chain liquidity depth of stETH.
cbETH may face greater liquidity challenges in the future. Its fees are the highest of the primary LSD competitors, resulting in consistently lower yields for users. Regulatory scrutiny has caused Coinbase to cease promotional activites or incentive programs to help drive cbETH adoption in DeFi.
VOLATILITY: Has the LSD had any significant depeg event (post merge)?
Following the Shapella upgrade along with some withdrawal demand, cbETH did experience some increased volatility that caused it to trade slightly below its fair value for a brief period. Overall, it has stabilized relative to ETH following the upgrade.
Arriving to the upgrade, Coinbase had warned customers that they “anticipate the Ethereum protocol will take weeks to months to process unstaking requests immediately following the upgrade.” Although withdrawal demand is quite low currently, falling yields or network issues may precipitate large withdrawal demand that cannot be immediately arbitraged.
One advantage of a centralized LSD service is the possibility Coinbase can expedite user withdrawals from the business’s cash flow, potentially averting a withdrawal bottleneck. However, section 1.7(j) of the User Agreement states “Coinbase will not backstop or otherwise intervene to guarantee cbETH liquidity”.
SMART CONTRACTS: Does the analysis of the audits and development activity suggest any cause for concern?
Custody of the underlying ETH is managed by Coinbase internally, and therefore the smart contract security is significant only for accounting purposes.
The system Coinbase deployed was forked from Centre’s FiatTokenV2_1, which is used with USDC and has significant SC maturity, having been on mainnet for multiple years. The additional contracts introduced with cbETH (ExchangeRateUpdater and MintForwarder) have been audited and have access controls centralized to Coinbase.
DEPENDENCIES: Does the analysis of dependencies (e.g. oracles) suggest any cause for concern?
Because cbETH operations are entirely centralized to Coinbase, the most significant risk to users is counterparty risk involving failure of the node operator, lost or stolen private keys, etc.
Withdrawal times are advertised as a minimum of 27 hours and Coinbase has warned users that in times of high network-wide withdrawal demand, processing times can be in the weeks to months.
Coinbase does have a reliable Chainlink pricefeed available for the cbETH/ETH pair.
CENTRALIZATION: Are there any significant centralization vectors that could rug users?
Coinbase has complete centralized control over the cbETH system and user funds. While ownership of staked ETH remains with the user (as per the User Agreement), Coinbase discloses risks that could cause losses for users.
Staking involves the risk of slashing. In some cases, Coinbase will reimburse users, but not “if slashing was the result of a hack, your own actions, or a bug in the protocol itself” (source)
Cyberattacks and security breaches of the platform.
Theft, loss or destruction of private keys under Coinbase Custody.
Various economic and regulatory uncertainties could threaten Coinbase as a business, and therefore the continued operation of cbETH.
LEGAL: Does the legal analysis of the protocol suggest any cause for concern?
On June 6, 2023, the SEC Charged Coinbase with operating as an Unregistered Securities Exchange, Broker and Clearing Agency. A complete list of allegations is in the SEC Complaint. Coinbase responded on June 28th with an Answer to the Plaintiff’s Complaint that outlines various defense strategies.
The enforcement actions and regulatory scrutiny generally have apparently caused Coinbase to exercise caution with promoting cbETH for fear it could be considered a securities offering. It is too early to know for sure how the enforcement action will play out, but in the short term it has dampened the growth of cbETH relative to competitors and there is some uncertainty about the future of the product offering.
Based on the risks identified for each category, the following chart summarizes a risk rating for cbETH as collateral. The rating for each category is ranked from excellent, good, ok, and poor.
We rank cbETH ok on liquidity because although it ranks 2nd by LSD marketshare after stETH, >97% of liquidity is on Coinbase and an $18.1m on-chain swap produces a similar slippage as a $300m stETH swap.
We rank cbETH good in volatility because a centralized service provider should be capable of expedited withdrawal processing during times of high demand than a decentralized protocol. This would strengthen the LSB in certain circumstances. However, Coinbase does not claim to expedite withdrawal requests.
We rank cbETH excellent in smart contracts because the contract architecture is straightforward, managed by permissioned Coinbase addresses, based on battle-tested contracts, is audited, and the contracts themselves do not handle user funds.
We rank cbETH good in dependencies for having a reliable pricefeed available. A centralized service can be an advantage when managing system accounting, withdrawal processing, and unforeseen network issues (high withdrawal demand, Ethereum network issues, etc.)
We rank cbETH ok in centralization because it is a centralized service operated by Coinbase and users are thus exposed to counterparty risk. The User Agreement does offer assurances that users retain legal ownership of their staked ETH. Coinbase does make an effort to reduce centralization of its validators by diversifying across several software clients.
We rank wstETH ok in legal for recently receiving an enforcement action from the SEC alleging that Coinbase’s staking program constitutes a securities offering. See section 5.4.3 for details. Despite regulatory scrutiny, Coinbase has a long history striving for regulatory compliance and appears prepared with a solid legal basis to defend itself.
Compared with Lido stETH, we assess that cbETH is stronger in the categories Smart Contract and Volatility. It is weaker in the categories Liquidity, Centralization, and Legal.
There are potential advantages of a centralized LSD product within a diversified collateral basket, namely that the service provider can react more quickly during adverse circumstances, leading to less volatility and possibly greater user trust in the product.
Care should be taken to limit exposure to cbETH for the primary reasons:
liquidity is quite low despite cbETH having the second highest LSD marketshare and is highly concentrated on Coinbase.
A recent SEC enforcement action demonstrates a level of regulatory scrutiny that creates some uncertainty about the future of the cbETH product or, at the very least, Coinbase’s ability to remain competitive against competing LSD products.
Our assessment overall is that cbETH is a suitable collateral asset within a diverse basket of LSDs, but DAO voters are recommended to limit protocol exposure to cbETH by targeting a basket allocation composed primarily of wstETH. wstETH has a much stronger liquidity profile and achieves a level of decentralization that offers stronger user assurances. cbETH is a good contender with risk attributes making it quite complementary to wstETH, but due to weaknesses in its liquidity profile and legal situation, it should remain a minority member of the collateral basket at this time.
