Asset Risk Assessment: DOLA
A deep dive into Inverse Finance’s stablecoin DOLA
This research was spearheaded by @Lavi_54 and @dabar_90.
Useful links:
Docs Smart Contracts
Transparency overview (smart contracts relation)
Coingecko: INV
Coingecko: DOLA
PeckShield audit for debt repayment contracts
DebtRepayer Contract (Etherscan)
Debt Converter Contract (Etherscan)
Abstract
Inverse Finance is a protocol that develops and manages multiple DeFi products and tools. Its main products are a lending market and the stablecoin DOLA. The Frontier lending market was paused after two exploits earlier this year. Since then, Inverse has prioritized reducing its bad debt that resulted from these hacks. At the same time, it developed and just released its newest product FiRM (Fixed-Rate Money Market). FiRM is an improved version of Frontier with additional features, increased security, and a new primitive to facilitate fixed-rate borrowing of DOLA.
DOLA is the hybrid collateralized/uncollateralized stablecoin integrated with all of Inverse's other products. It is partially collateralized by deposits in its lending markets and partially issued by Inverse to regulate the balance of DOLA in a variety of liquidity pools. During the period after Frontier was paused, all minting and burning of DOLA has been managed by Inverse's Fed Chair multisig. All protocol-controlled DOLA is deployed through the Fed contracts, each of which employs a liquidity pool strategy that deposits DOLA directly into those pools.
A quick TL;DR of our findings:
Inverse Finance is focused on developing DeFi primitives and financial tools, such as lending markets, a stablecoin, fixed-interest products, and more.
The protocol is a rather complex apparatus with many moving parts and a history of swiftly pivoting and introducing new products. Their first product DCA was stopped to develop Anchor (later renamed to Frontier), which was paused and is being replaced by FiRM. The stablecoin DOLA has persisted throughout but has undergone several transformations. It began as a collateral-backed stablecoin. Currently, it’s not backed by exogenous collateral but holds the peg via AMM pool management (through Fed contracts). It is transitioning to a hybrid model by lending DOLA through FiRM with variable and fixed lending rates, in addition to AMM injections via Feds.
DOLA has liquidity pools on Curve, Balancer, Velodrome (Optimism), and Sushi. Curve and Balancer AMMs are the most significant “stability mechanisms”, as there is almost no exogenous collateral backing the stablecoin.
Inverse suffered from two exploits in April (~$15.6M) and June (~$5.8M) 2022, due to oracle price manipulation. The deployment of two debt-repayment contracts allows affected users to redeem small portions of their collateral. The income for the repayments stems mostly from Inverses’ bonds (i.e. an Olympus Pro integration). The largest bad debt position is the DOLA portion (approx. $9.5M).
After the exploits, Inverse minimized Frontier’s operations and started the development of a new lending protocol called FiRM (Fixed Rate Market). FiRM comes with security improvements (i.e. pessimistic oracle, isolated market pools, borrowing rights). It also has a novel architecture and introduces new DeFi primitives DBRs and PCE.
$INV is the protocol’s governance token that can be staked (xINV). Both INV and xINV provide voting rights and can be used as collateral in the Frontier lending market.
The two debt-repayment contracts have undergone an audit by Peckshield. FiRM went through a bug bounty contest at code4arena, whereby some issues of mediocre and low severity were found and resolved.
Inverse Finance - Introduction
Inverse Finance is building a suite of DeFi tools that are governed by the Inverse Finance DAO. The first product was DCA (Dollar Cost Average) vaults, but the DAO decided to put all resources toward Anchor and their synthetic stablecoin DOLA. Anchor (later renamed to Frontier) is a lending market. Technically it’s mostly a fork of Compound.
DOLA is Inverse’s second main product - a stablecoin soft-pegged to the US-Dollar. The stable was originally issued through Frontier, where users could borrow DOLA against different collateral tokens. For instance, ETH, WBTC, and YFI, as well as yield-bearing tokens such as yvDAI, yvUSDC, or stETH. At its peak in January 2022, Inverse had over $140M in TVL.
However, the protocol stopped all borrowing activities after an exploit in April 2022. The protocol has now pivoted to developing a new product called “FiRM” (Fixed Rate Market). FiRM was just launched on December 16th, 2022. It’s a fixed-rate lending protocol where users can borrow DOLA. Besides FiRM, Frontier (which is paused), and DOLA, Inverse also provides a swap function called the Stabilizer to swap DOLA against DAI. Moreover, the protocol sells its own governance token $INV, through an Olympus Pro integration. Users can buy bonds (i.e. INV at a discount), in return for DOLA or INV-DOLA Sushi LP tokens.
Over the past six months, the team has mostly focused on dealing with the consequences of two exploits. A debt repayment process was implemented to reimburse affected users and reduce the amassed bad debt. Additionally, FiRM is intended to create new revenue streams with a priority on debt repayment. Read further to learn more.
Inverse Exploits
In April 2022, Anchor suffered from a severe exploit. Via a sophisticated and capital-intensive market manipulation, a hacker was able to withdraw over $15.6M in user funds. By successfully manipulating the price of $INV, the hacker heavily inflated the value of INV which was used as collateral. This allowed them to borrow millions from Anchor’s pools. According to DeFi Safety and rekt.news, the hacker’s rather professional tactic revealed an unforeseen attack vector. In other words, this was not an obvious vulnerability. Altogether, the hacker was able to run away with 1,588 ETH, 94 WBTC, 39 YFI, and 3,999,669 DOLA (worth $15.6M at the time).
The second exploit happened two months later. This time a flash loan attack led to $5.8M lost overall. The hacker was able to run away with $1.2M. This second attack was deemed “foreseeable” by DFS. The image below shows the TVL drop after the first exploit.
The two attacks left many Anchor users stuck with IOU tokens (called anTokens). Over 24% of the TVL at that time was stolen, leaving Inverse with a significant pile of bad debt. As an initial response, Anchor was paused and the team began working on solutions to repay the bad debt and reimburse affected users. According to RiskDAO’s dashboard, Inverse Finance still has over $14.4M in bad debt today.
Reimbursing Users
At first, Inverse referred to their liquidation engine to repay the debt. But this strategy was only accessible to technically savvy users, as it required the use of liquidation bots. A governance vote enacted the deployment of the DebtRepayer and the DebtConverter. These two contracts were designed to pay back all users affected by the hack.
The DebtRepayer allows holders of the IOU tokens to withdraw the original collateral. Inverse regularly fills the contract with WBTC, YFI, and ETH by forwarding some of their income to DebtRepayer. Users can then withdraw the collected funds. However, there is a discount mechanism that corresponds to the reserves in the pool. Users who are rushing to redeem their collateral will have to accept a reduction. The higher the reserves, the lower the discount rate (starting at 55% discount when the reserve is empty, to 0% discount when the pool has collected 15%+ of the missing funds).
The DebtConverter is the second contract that lets users convert their IOU tokens (anETH, anWBTC, or anYFI) into IOU tokens that are denominated in DOLA. This helps to reduce the volatility of the bad debt, which is denominated in ETH, WBTC, or YFI. Moreover, it lets Inverse pay back the debt in DOLA. The DebtConverter can set a maxConvertPrice for each asset, thus preventing debt increase when prices rise. The DAO regularly funds it with DOLA, which can be withdrawn by holders of anTokens.
Both contracts were audited by Peckshield. Three minor issues were discovered, and all were resolved. However, some concerns were raised regarding the repayment process. The next section will clarify where the money for debt repayment comes from.
Repaying Bad Debt
As mentioned above, Inverse regularly refills both contracts. The funds are derived from several income streams. So far the DebtRepayer has been sponsored with 44.7 WETH, 3.19 WBTC, and 1.08 YFI. In total, roughly $138k worth of collateral tokens. But user interaction with the contract is rather limited. Only 11 addresses have used it. These users accepted a hefty haircut, as there was little funding in the contracts. The image below shows the funding of the DebtRepayer (green arrows) and the withdrawals (red arrows).
The DebtConverter has had similarly sparse usage. Only 10 addresses have withdrawn some DOLA, and mostly in small amounts at a discount. In total $29.5k DOLA has been deposited to this reserve by Inverse.
In summary, these efforts are honorable, but modest compared to the total bad debt. So far, roughly 6.5% of the initial bad debt was eliminated over the second half of 2022, mostly through liquidations at a discount. However, there is still more than $14M in bad debt remaining.
As seen in the images above, the main source of funding for both debt repayer contracts is the Treasury Working Group (TWG) multi-sig. The second funder is the Inverse Anchor Treasury (the DAO’s main treasury), which also funds the TWG’s multi-sig.
The TWG is tasked with managing liquidity and treasury operations. Liquidity operations include deploying funds to various protocols, which can generate multiple income streams. Most income is derived from yield farming. The following is a rundown of the major TWG activities:
Roughly $469k of TWG funds sit in the DOLA/INV Balancer pool staked on Aura Finance. This is further incentivized via their vote-locked Aura position (~$204k). Some of the earned $BAL rewards are swapped for $AURA (example).
About $217k in CVX is vote-locked CVX on Convex, boosting their pool. The earned $CRV is mostly kept and currently is the second-largest position in their treasury (after USDC).
The TWG also deposited some $WBTC, $ETH, and $YFI into Frontier, to provide exit liquidity for attack-affected users.
The majority of the income used to refund their debt is generated via their Olympus Pro bonding service. By selling $INV at a discount, the treasury is buying $DOLA as well as INV-DOLA Sushi LP tokens. The $DOLA purchased this way is transferred back to their main treasury via the BondsManager contract. From there it is used to cover operational expenses and to fund the two repayment contracts mentioned above.
DOLA as an asset
DOLA is a stablecoin soft-pegged to the US-Dollar. DOLA originally started as a hybrid, partially collateral-backed and partially issued through Fed contracts. However, since the deprecation of Frontier, DOLA is no longer backed by any significant exogenous collateral position. Its supply is fully controlled via the Fed multisig and Fed smart contracts that are deployed and controlled by Inverse Finance. Fed contracts define how much DOLA is available for each of its implementations.
Fed Contracts
From their docs: “Inverse Finance Fed contracts mint DOLA directly to the supply side of lending markets, to the DOLA-3CRV Curve pool, or other fed-enabled liquidity pools in response to market DOLA demand.”
In short, the minting and burning of DOLA is done by Fed contracts. All Feds are controlled by a multi-sig (Fed chair). The contracts have three main functions to control the DOLA supply:
Expansion - Mints DOLA into the lending side of the pool (lowers borrow APY)
Contraction - Burns DOLA on the lending side of the pool (increases borrow APY)
TakeProfit - Transfers all profits earned from borrowers to the Inverse treasury (causes borrow APY % to increase slightly)
These functions can only be called and operated by the account holding the “Fed Chair” role. The current Fed chair for all DOLA lending pools is a 2-of-6 multi-sig wallet. The signers are Inverse team members (see here).
The protocols website provides an overview of all current and previous Feds (see image below). The Feds holding the most TVL at the time of writing this report are the Yearn, Convex, and Aura Fed.
Minting DOLA
Originally, DOLA was issued in exchange for collateral deposited into Frontier. However, this functionality is currently paused for the reasons mentioned above. Currently, DOLA can be added into circulation in the following ways:
Borrowing DOLA - DOLA can be borrowed through FiRM against WETH, or via the supply side of partnering money markets. These integrations are enabled by the Fed contracts. As of today, the only public lending Fed still active is the Fuse6 pool on Rari. The other two Feds are Inverse’s Frontier (to be deprecated) and the new FiRM product.
Liquidity Pools - The second venue to obtain DOLA is through one of the liquidity pools on Curve or Balancer. The Curve pool acts as the main funnel for adding and removing DOLA into/from circulation, by injecting it into the factory pool: DOLA/FRAXBP. With over $18.8M in DOLA, the pool is the largest holder of DOLA, closely followed by the Balancer DOLA-bb-a-USD pool (holding $5M DOLA).
The Stabilizer - Finally, DOLA can be minted with $DAI using the Stabilizer contract. A 0.4% fee on each transaction generates some income for the DAO. However, it hasn't accrued any profits in the past three months. Nonetheless, it can serve as a protection tool in case of a positive depeg (meaning DOLA is above 1 dollar).
This leaves us with four injection points, the Curve FraxBP factory pool, the Balancer DOLA-bb-a-USD pool, the Rari Fed, and the FiRM Fed.
Only the first two are relevant today. The majority of the DOLA supply ($34.7M) is held by Inverse itself. In other words, all DOLA in circulation belongs to Inverse and is lent out via the Fed contracts. A deeper look at the DOLA distribution confirms this:
The Curve pool holds 53.5% of all DOLA. This was injected via the Fed chair.
The second largest share is anDOLA (22.9%), which refers to DOLA deposited into Frontier. However, 99.9% of all anDOLA belongs to the AnchorFed (i.e. Inverse itself).
The Balancer vault (15.8%), the Optimism bridge (3%), and the Fantom bridge (1.4%) make up to rest of the top 5. They were, again, injected with DOLA via the Fed chair.
Altogether the top 5 DOLA positions account for almost 97% of the total circulating supply. All of these pools or vaults are controlled through Inverse Fed contracts.
The largest “external Fed” is a Yearn vault. This private vault is part of an agreement between Yearn and Inverse. Yearn manages this vault and provides the counterparty assets (i.e. $FRAX and $USDC) to the Curve factory pool in return for the majority of pool rewards. Again, Inverse can fund this vault with DOLA (example 1 & example 2).
The image below shows the only publicly accessible Yearn vault, which is the almost inactive DOLA-3pool.
In conclusion, DOLA paints a rather fragile picture. There is practically no DOLA natively backed by collateral. Frontier, which was supposed to hold DOLA’s collateral, has over 90% of its TVL in $INV and $DOLA. The rest of the TVL (~$600k) is too little to back the circulating DOLA supply (~$34M). FiRM was just released as a guarded launch with negligible TVL at this time. In other words, all DOLA in circulation entered the market via Fed contracts, most notably via Curve and Balancer. The Fed chair can simply expand and contract the DOLA supply to these pools.
DOLA Peg Stability
Inverse keeps DOLA at a 1:1 peg to the US-Dollar and manages its supply with the following three components:
Fed Contracts - Minting (or recalling) DOLA to Inverse’s products (Frontier and FiRM) and external protocols/partners (Curve, Balancer, Yearn, Rari, Aura, Velodrome).
Liquidity Pools - on Curve (DOLA/FRAXBP), Balancer (DOLA/bb-a-USD), and DOLA/INV.
Amplification Factor - A relatively high amplification parameter of 200 on Curve and Balancer allows DOLA to be off-balance with regard to the other pool counterparty assets without it losing its peg. This reduces slippage in normal pool operation, but would not protect against a loss of confidence in the peg.
The Curve and Balancer pools serve as the main liquidity venues. Both are metapools, which allows DOLA to be paired with the base Curve and Balancer pools with deep liquidity (e.g. FRAXBP). Yield farmers who want to use DOLA to earn interest on one of the protocols must acquire DOLA from one of the existing metapools.
As mentioned above, metapools are the largest DOLA holders. In the current state, it is enough to use the Curve TWAP price feed, to keep DOLA stablecoin pegged to $1. In addition to the Curve pool, Inverse also uses Balancer’s version of metapool called "Composable Pools". On Balancer, DOLA is paired with the bb-a-USD base pool (Balancer Aave Boosted StablePool):
In this composable pool, DOLA has an amplification factor of 200, similar to the Curve metapool. The Inverse team had proposed in August 2022 to increase the DOLA Curve pool A parameter from 100 to 450, although a more modest increase was ultimately agreed upon.
The peg stability during normal operation is strengthened by a high amplification factor (i.e. A = 200) in both metapools. This helps to keep the DOLA peg for a larger range of imbalance within the pool. However, the amplification value constitutes a leveraged bet on peg stability, rather than an enforcement of the peg. In times of distress, higher amplification can lead to severely reduced liquidity as the pool balance reaches the shoulder of the bonding curve.
FiRM - Fixed Rate Market Protocol
After the two exploits of the Frontier lending protocol, Inverse Finance turned to the development of their new lending protocol FiRM, which was launched on December 16th, 2022. FiRM is a lending protocol with many features that are primarily adapted to the ways Inverse functions and the revenue model of the protocol.
There is also a strong emphasis on protocol security, which was the weakest point in Frontier's design. The most significant FiRM features are:
Fixed interest rates
DOLA borrowing rights (DBR)
Personal collateral escrows
Unlocked governance token utility
Isolated lending pools by token and account
Re-design of the oracle price feed and implementation of a pessimistic price oracle (PPO)
The image below displays the system architecture of FiRM:
The system is built with three foundational smart contracts:
The Escrow Contract - initializes the creation of a unique escrow contract for each borrower account and each deployed market in the borrower account.
The Market Contract is a central contract of the FiRM protocol and contains almost all core logic (e.g. set admin roles, lending, collateral, borrowing functions, and set lending parameters). It also has a call function for the borrowerController (setBorrowerController), escrow contract (getEscrow), and pauseBorrows function that can be called by the pause guardian or governance.
Both the Pause Guardian and governance can pause borrowing for a market, but only governance can unpause.
DBR Contract (DBR.sol) is an ERC-20 token (non-standard) that gives the holder the right to borrow DOLA at a 0% interest rate and burn 1 DBR token for 1 borrowed DOLA per year.
DBRs are a new DeFi primitive that still needs to prove their viability. In short, DBRs are minted by Inverse and sold to the market (later they may be distributed through other means). Holders of DBR are allowed to borrow DOLA at a fixed-interest rate for one year. 1 DBR allows holding 1 DOLA for one year, or 2 DOLA for six months, or 4 DOLA for three months, and so on. The DBR amount in the user's wallet is steadily declining.
If a borrower of DOLA does not have enough DBR in their wallet, additional DBR will be added by a third party, according to the docs. The costs of the DBR recharging are paid by increasing the DOLA loan of the borrower. In addition, the DBRs added via recharging are at a premium to the market price.
In other words, the interest rate of DOLA is now defined by the price of DBRs. Thus, allowing fixed-interest rates, as the DBRs are bought in advance and then used up (as long as the loan is not expanded over time).
Another newly deployed smart contract is the FiRM Fed contract, which has the same functions as the old one used for Frontier. The new oracle contract also uses Chainlink’s price feed interface. It’s possible to use other oracles as well and the new Fed uses a pessimistic price oracle (PPO) solution. The PPO uses the lower of either the available collateral prices on Chainlink or the 48-hour low price as observed by the PPO, divided by the collateral factor. The implementation of the new oracle model represents an additional layer of security to the FiRM protocol in the context of manipulations.
Risk Vectors
Some of the risks are highlighted below.
Smart Contract Risk
FiRM has not been audited by a third-party auditing firm. However, there was a bug bounty program running on Code4arena, which attracted high participation (140 wardens). The final report reveals no bugs of high severity, but 18 vulnerabilities with a risk rating of medium and 54 issues of low to non-critical severity.
Besides FiRM, the team also recently deployed the two debt repayment contracts mentioned above. Both of the contracts were audited by Peckshield. The audit report did not find any major bugs. Only three minor issues were resolved.
Inverse Finance opened a bug bounty vault on Hats Finance, but the vault is still empty.
As an additional security measure, the Inverse Analytics Working Group has created a sophisticated “in-house alerting system”, which warns members in relevant working groups of on-chain events.
In summary, there are solid attempts to improve the protocol’s security. But since the newest product has not undergone extensive real-market testing, and it wasn’t audited by a highly reputable auditing firm, it doesn't yet warrant high confidence in its safety.
Governance Risk
Inverse Finance is a DAO governed by its team and the Inverse Community. Officially, decision-making is in the hands of $INV holders via on-chain voting. INV and staked INV (xINV) tokens represent voting rights. Voting rights can also be delegated.
To submit an on-chain proposal, one needs to hold a minimum of 1900 votes. Voting lasts for three days. To pass, the proposal requires a minimum quorum of 9500 votes and a majority of votes FOR. The community has a social agreement to discuss and debate proposals for at least 24 hours before on-chain submission. Discussions take place via Discord and the governance forum.
Some aspects of the protocol are controlled via the GovernorMills module (a fork of Compound’s Governor Bravo).
The DAO has control over the following aspects of the protocol:
The INV governance token
The treasury (INV tokens, Anchor profits, and protocol-owned liquidity)
Governance parameters (e.g. quorum, requirements to submit a proposal, etc.)
Lending and Stabilizer parameters
Creating “Working Groups” with budgets
However, GovernorMills is not fully permissionless. The GovGuardian has the power to cancel every proposal submitted to GovernorMills. This role is currently held by one address, which appears to be Inverse’s founder (i.e. InverseDeployer).
To better manage daily operations, Inverse has many permissioned roles. Most are assigned to working groups via governance proposals. An overview of all working groups and multi-sigs can be seen here and are listed below:
Fed Chair - Manages and implements Fed policies (2/6 multi-sig).
Treasury Working Group - Optimizes the Inverse treasury and manages liquidity operations (Ethereum 3/4 multi-sig; Fantom 3/5 multi-sig; Optimism 3/4 multi-sig).
Policy Committee - Handles the reward rate policies and has a BondsManager role (5/9 multi-sig).
Growth Working Group - Manages investments and costs related to growth initiatives (2/3 multi-sig).
Community Working Group - Works on community participation and on-chain onboarding (2/3 multi-sig).
Analytics Working Group - Improves protocol and DAO analytics (2/3 multi-sig).
Risk Working Group - Creates the toolset necessary to monitor the various money markets. It has a pause guardian role and can pause a market (1/3 multi-sig).
Bug Bounty Program - Handles rewards for bug bounties (4/5 multi-sig).
Inversedao.eth EOA - has a governance guardian role which means that it can cancel governance proposals.
It’s worth pointing out that the Fed chair has far-reaching powers. As alluded to above, it can mint DOLA into any gov-approved Fed. This contract is managed by a 2-of-6 multi-sig. A second centralized point is the GovGuardian. As mentioned above, it can veto any proposals. It’s controlled by a single EOA wallet (inversedao.eth).
Depeg Risk
Apart from a choppy start, the DOLA peg has been quite stable historically. As explained above, nowadays DOLA mostly relies on AMM Fed management of the Curve and Balancer pools to keep the peg stable. In short, Inverse deploys DOLA into these pools and controls the stability with expansion and contraction of the supply for each Fed contract. For the current supply level, this strategy seems to be working fine, but it is questionable whether it's also scalable.
As of December 16, a new stability mechanism was introduced together with FiRM. Dola Borrowing Rights. The DBR is a token that can support the stabilization mechanism. When DOLA increases above $1.00, additional DBRs are minted and sold to the market. Thus lowering borrowing costs and creating more demand for DOLA. When DOLA is below the $1.00 peg, DBR’s minting rate is reduced, which incentivizes borrowers to repay their loans and take profits on unused DBRs.
Collateral Risk
As mentioned above, the collateral backing DOLA is negligible. At the time of writing, the collateral on Frontier is mostly $INV and $DOLA (overall 87.12% of the total TVL). 99.9% of that belongs to Inverse itself. Plus Frontier will be deprecated anyway.
FiRM’s initial liquidity, provided as part of an initial guarded launch, is $100k in DOLA. It went live with one market (i.e. WETH) and the DOLA available to borrow might be increased during its guarded launch. FiRM is designed to reduce systemic risks with fully isolated collateral deposits that can’t be borrowed. In that regard, it resembles the CDP design of MakerDAO, with the significant difference that borrowers of DOLA need to hold DBRs as explained above. However, FiRM does not play a role in backing DOLA yet.
The current collateral situation appears very fragile. DOLA is heavily under-collateralized and the new product, which is designed to increase collateral and demand for DOLA, just launched.
Oracle Risks
On 11 December 2022, Inverse Finance deployed a new oracle model - the “Pessimistic Price Oracle” (PPO) based on Chainlink feeds. The PPO reduces the risk of price manipulation by including collateral factors in the pricing formula and by observing the last 48-hour low price.
This provides an improvement to the previous oracle implementation. It needs to be pointed out though, that the first exploit was possible due to $INV’s low liquidity. This allowed the hacker to briefly inflate the price, which was reported correctly by the oracle. The new pessimistic oracle price should prevent these kinds of attacks.
Discussion
1. Is it possible for a single entity to rug its users?
In theory, the 2-of-6 multi-sig controlling the Fed chair could mint infinite DOLA, although there are protections in place to prevent excess DOLA from coming into circulation. All Fed contracts minting into an AMM have a maxLossExpansion parameter that limits pool imbalance as a result of DOLA expansion. There is no way we could identify that a malicious Fed Chair might rug LPs, although the manual nature of supply management creates some, albeit remote, possibility for abuse.
The absence of a timelock for mints/burns, the small number of signatures required by the current Fed chair, and the GovGuardian EOA's ability to veto on-chain DAO votes are factors to be aware of when considering the rug potential.
FiRM on the other hand is non-custodial and it appears not to have any central access points. However, as mentioned above, the product just launched a week into writing this report and it was not the main focus of this risk assessment.
2. If the team vanishes, can the project continue?
If all multi-sig signers disappear, it would be challenging, but possible, for the protocol to survive. Access to the TWG treasury would be disabled. It would also cause difficulties for DOLA. The stablecoin requires active management from the Fed chair multi-sig. The Fed chair could be replaced by a governance vote without permission of the multi-sig, but it is questionable at this time whether anyone outside the team could manage the complex Fed situation. Inverse is designed to empower trusted actors while retaining a decentralized fallback mechanism. There would certainly be headwinds to restructure, but this contingency has been accounted for.
3. Does the protocol rely on CRV or other incentives to keep its peg?
For the large part yes. Curve and Balancer pools are used to keep DOLA’s stability. Without the rewards for these pools, it will be difficult to attract counterparty assets at scale. Members of the Inverse team have publicly recognized that the system's bad debt will likely cause a depeg in the absence of incentives.
The DOLA/FRAXBP pool has been incentivized by bribes, with an average weekly allotment of $28k in INV over the past 5 weeks, and is the 4th most bribed pool on the StakeDAO Votemarket.
4. Do audits reveal any concerning signs?
The repayment contracts were audited by Peckshield and didn’t show any concerning signs. The newly deployed product FiRM underwent a Code4rena contest, with no severe bug or vulnerability findings (18 mediocre and 54 low-impact issues). Code4rena is a crowd-sourced auditing platform, and may not match the quality offered by a reputable auditing firm.
Conclusion
Inverse Finance is a rather complex protocol with many moving parts and a difficult history. The pace at which new products are added and removed is impressive but also peculiar. For a short period, the lending market Frontier seemed to attract a good amount of TVL. However, this mostly vanished after two exploits. Since then, Inverse paused most lending services, and the recently launched FiRM (as well as DOLA, for that matter) still has to prove its product market fit.
The protocol puts a lot of effort into creating transparency, but at the same time manages to be rather intransparent through complexity. For example, the management of DOLA supply expansion and contraction is more or less a black box. There is partially outdated information on the website and in the docs. Users have to manage a flood of data and despite all the information, Inverse manages to cloud the collateral situation around DOLA (e.g. the effective collateralization ratio is not visible anywhere).
Some aspects regarding the management of DOLA raise questions. Most concerning is the fact that almost all DOLA in circulation was just minted by Inverse, and injected into Feds without the backing of any exogenous collateral (i.e. not $INV or DOLA itself). It is only backed by the counterparty assets in the liquidity pools. While this mechanism might work to keep the DOLA at peg in the short term. It is questionable whether this strategy works at scale or during hostile market conditions. What speaks for them, is the fact that DOLA has not deviated after the exploits and kept its peg well during the volatile and bearish year of 2022. However, DOLA is dependent on incentivized pools (Balancer and Curve) plus it requires active management from the team. It’s not a trustless stablecoin that functions without regular intervention.
As mentioned a few times, the protocol is putting efforts into reducing its bad debt, while simultaneously developing new products. This is honorable. However, the protocol is taking rather risky approaches here and there to speed up its debt reduction.
Risk Team Recommendation
Given the state of Inverse's substantial bad debt, leading to the majority of DOLA in circulation being uncollateralized, creating a cycle of dependence on CRV gauge emissions and other yield farming strategies to support the peg, we question the organic viability of the stablecoin. The release of the FiRM lending platform is a step in the right direction toward sustainability, but it is too early to determine the product's success. Although we appreciate the efforts made by the Inverse team to provide transparency and to protect its users in the wake of the previous exploits, we do not believe DOLA currently merits a gauge. We recommend to kill the DOLA gauge until it has achieved 100% collateralization and has demonstrated itself to be organically sustainable. The status of its Curve gauge does not preclude Inverse from incentivizing in its own token while on its path to sustainability.
Sources
Docs Smart Contracts
Diagram overview (Smart Contracts relation)
Coingecko: INV
Coingecko: DOLA
Rekt.news Exploit 1
Rekt.news Exploit 2
DeFi Safety Score
2/6 multi-signature wallet** **Fed Chair multi-sig
Proposal to activate bad debt repayment contracts
DebtRepayer Contract (Etherscan)
Debt Converter Contract (Etherscan)
PackShield audit for repayment contracts
Anchor Fed
FiRM Fed
Fed chair (2-of-6 msg)
Treasury Working Group Multi-sig
Inverse main treasury
DOLA (13 days vesting) bond contract
INV-DOLA SLP BOND (6 days vesting) contract