Frax sfrxETH
Last updated
Last updated
Full report from Prisma Risk Team: https://hackmd.io/@PrismaRisk/sfrxETH This section will summarize the findings of the report by highlighting the most significant risk factors in each of the three risk categories: Market Risk, Technology Risk, and Counterparty Risk.
LIQUIDITY: Does the LSD have a liquid market that can facilitate liquidations in all foreseeable market events?
frxETH can be considered not only an ETH liquid staking token but also a liquidity management protocol, thus setting it apart from its competitors. This gives Frax a unique advantage to grow and sustain its liquidity depth through its AMO activities in the Curve frxETH/ETH pool and other liquidity venues.
Although the total frxETH marketshare is fairly low (2.31%), its available on-chain liquidity makes up a large proportion of its marketcap. Whereas stETH has ~$425m on-chain liquidity on $14.39b in TVL (3% of TVL), Frax has ~$75m on-chain liquidity on $448m TVL (>16% of TVL). Despite frxETH having 5% of the TVL compared to stETH, it has 25% the liquidity depth (a $50m frxETH>ETH swap produces 1% slippage compared to $300m stETH>ETH swap).
Available liquidity is dependent on Frax’s ability to incentivize its frxETH pools, but the protocol model is highly focused on ensuring deep liquidity.
VOLATILITY: Has the LSD had any significant depeg event (post merge)?
As with frxETH liquidity, the Frax liquidity management focus has kept frxETH remarkably on peg, especially compared to competitors such as stETH and cbETH. Users should be aware that price stability comes as a cost of trusting the Frax team to responsibly manage liquidity.
As a recent example, the Curve pool became somewhat imbalanced in mid-June. In response, the frxETH Treasury increased the ETH withheld on frxETH deposits to 70%. This allowed the treasury to divert user deposits toward balancing the pool. It is possible that redemption demand becomes excessive enough that Frax must exit validators to balance the pool. This process can be time consuming, especially if network-wide withdrawal demand is high. The responsibility of maintaining price stability is therefore the burden of the frxETH treasury and Frax team as operators of the frxETH validators, and it is possible that poor management could result in increased volatility.
SMART CONTRACTS: Does the analysis of the audits and development activity suggest any cause for concern?
There has only been one audit of frxETH and sfrxETH by code4rena on 29th of November, 2022 (contest taking place from 22nd to 25th September). The frxETH code heavily borrows from Frax and FPI stablecoins. Both of these are battle tested and have gone through extensive audits.
DEPENDENCIES: Does the analysis of dependencies (e.g. oracles) suggest any cause for concern?
There is no Chainlink pricefeed available for frxETH at this time, although the Frax team has said they are working to introduce one. For now, the two pricefeed options are a UniswapV3 frxETH/FRAX TWAP oracle and a Curve frxETH/ETH EMA oracle. Curve is currently recommending third parties to not integrate the EMA oracle, as it can be manipulable over multiple blocks, especially in low-volume pools. Curve is working to move to a new pool implementation that ameliorates this concern.
For now, there is not a pricefeed solution that can be considered highly reliable, although there appear to be active efforts to rectify this.
CENTRALIZATION: Are there any significant centralization vectors that could rug users?
The 3-of-5 frxETH Treasury multisig is responsible for protocol operations and funds management. All user funds are managed by this multisig and by ETH staking validators operated by the Frax team. The total value managed by the Frax team (which can potentially be rugged) is currently $437m.
While Frax has expressed an intention to upgrade funds management to an on-chain DAO governed by veFXS tokenholders, including having open sourced code for the upgrade, they have so far not begun the governance upgrade process. It is unknown when the upgrade will take place. Llama Risk began covering Frax in 12/21, and at that time the upgrade was planned for Q2 '22. The roadmap for the upgrade has since been delayed at least a year.
Frax has also announced plans for a frxETH v2 that would behave as a collateralized lending market that diversifies the frxETH node operator set. The timeline for this upgrade is unknown.
LEGAL: Does the legal analysis of the protocol suggest any cause for concern?
Frax operates as a DAO with no legal entity. It is possible a DAO could be considered an “unincorporated general partnership” with uncertain consequences. In the most extreme case, a member of the DAO could be held liable for all the debts and legal issues faced by the DAO.
Frax has not had any enforcement actions against it, although due to factors such as the centralization of operations and funds management along with questionable sanctions compliance, Frax may be exposed to regulatory risk.
Individuals who are creators, owners, operators, or others who maintain control or wield substantial influence over the Frax protocol may fall under the FATF’s definition of a VASP (“Virtual Asset Service Provider”) and would be required to comply with regulatory guidelines.
Frax does not appear to track addresses for sanctions compliance, nor does its terms of use include explicit restrictions of access to its services by sanctioned persons or residents of sanctioned countries. While this may not necessarily indicate a lack of compliance, the absence of such clauses might create ambiguity and potential enforcement risk.
Based on the risks identified for each category, the following chart summarizes a risk rating for wstETH as collateral. The rating for each category is ranked from excellent, good, ok, and poor.
We rank sfrxETH as excellent on liquidity because relative to its marketcap, frxETH has very deep market depth that provides strong assurances of liquidity in nearly all foreseeable market circumstances.
We rank sfrxETH as excellent on volatility because Frax places a strong emphasis on maintaining price stability through its Curve pool integration that creates a stronger assurance than competitors.
We rank sfrxETH as good on smart contract because it has undergone one audit but contracts have only been on mainnet since October '22 and therefore are still somewhat immature.
We rank sfrxETH as ok on dependencies because there is no highly reliable price feed available currently. However, Frax is actively working on a Chainlink feed and Curve is actively working to improve its EMA oracle.
We rank sfrxETH as ok on decentralization because there is a significant trust assumption in the Frax team to responsibly and honestly manage ~$437m worth of user funds. The team has a roadmap to decentralize, although they have a history of postponing decentralization efforts.
We rank sfrxETH as ok on legal because it is susceptible to enforcement action due to centralization of core managing functions in the hands of a few team members, and yet it has not formed any legal entity or implemented any sanctions compliance measures.
Our overall assessment is that sfrxETH performs well on market risk factors (liquidity and volatility) and poor on counterparty risk factors (decentralization and legal) relative to competitors wstETH and cbETH. We scored sfrxETH lower on dependencies because it does not have a highly reliable pricefeed at this time, although this is likely a problem that will be resolved in the near term.
The clear advantage of sfrxETH is the focus Frax places on ensuring deep liquidity through its liquidity management operations. This should allow it to immediately process withdrawal demand in most market scenarios through the managed Curve pool, and otherwise provide users with an assurance that Frax will restore the balance in uncommon situations involving significant liquidations and/or withdrawal demand.
Care should be taken to limit exposure to sfrxETH for the primary reasons:
There is no highly reliable pricefeed for frxETH at this time.
There is significant counterparty risk due to a high level of centralization in frxETH contract operations, validator operations, and funds management.
Both of the primary concerns are points that the Frax team has publicly stated they are working to resolve, including announcements of a frxETH v2 involving a decentralized node operator set and open sourcing the GitHub repo for decentralized governance. Assuming both upgrades are successful, sfrxETH may become the most desirable LSD from a risk perspective. Until then, there is substantial counterparty risk and it is recommended to limit protocol exposure to sfrxETH as a collateral asset.
