Avoiding Ruin
This article is going to be a bit off brand compared to what my blog usually contains. Themes previously explored related to writing secure code and keeping black hats away from funds in smart contracts. Today, we are going to talk about how to avoid tail risks as a DeFi user.
Before we dive in there are two important concepts to define: positive and negative skew. Positive skew is a position that has unlimited upside and capped downside, which for the sake of this article will only be your principal. Negative skew is a position that has limited and or capped upside and an unlimited downside of all your principal. How do we avoid negative skew while also harvesting some extra sweet yield?
Let’s say you have a portfolio that is 100% on chain, and opportunities lie before you to earn an additional 2–15% on capital. How would you go about evaluating these different opportunities? First, you could group opportunities into categories: AMM LP, with and without impermanent loss (IL), and lending against blue chip and long tail collateral and stablecoins, decentralized and centralized. If you have a high risk tolerance, you would most likely be LP’ing on AMM’s with IL, lending against long tail collateral and apeing decentralized stablecoins. If you have a lower risk tolerance, you would be LP’ing without IL (against stable pairs), and only using centralized stablecoins.
Now that the categories and their relative risks are clear, we would construct a portfolio where a third of our portfolio goes into each category. This leads us to our next question, how do we allocate within each third to a given protocol or set of protocols? We want to avoid blowout risk, that is a single protocol getting hacked and taking out our entire portfolio. To mitigate this, we would likely allocate to at least three different protocols within each category so that a single hack has a lower blast radius and can only wipe out a small portion of our funds.
Get Elliot’s stories in your inbox
Join Medium for free to get updates from this writer.
In order to construct this portfolio, there are certain risks you must accept, like L1, L2, Solidity Compiler, and oracles like Chainlink being secure. If any of these programs contain vulnerabilities, you’re done, so you must accept these as being secure otherwise your portfolio all has massive correlation risk since all DeFi protocols share these common codebases. In Nassim Taleb’s book The Black Swan, he shows 1000 days in the life of a turkey, it is safe, and develops patterns of behavior that are reliant on the farmer that feeds it and is lulled into a false sense of security. But this false sense of security can be dangerous…
According to Taleb, investors should construct a barbell portfolio, where a small portion of their capital is deployed into high risk, high reward opportunities and the majority of their portfolio is deployed into low risk investments like cash and treasuries. In his view, investing in the overall market is risky in unknowable ways, and that isn’t the best way to invest. If you subscribe to Taleb’s philosophy, you probably don’t think yield farming in DeFi makes sense since you can’t quantify the tail risk of smart contracts blowing up. There simply is not enough data to put together actuarial tables of this kind of risk. If Taleb were to put together a graphic of why DeFi is so scary, it would look something like this.
Personally I’m a bit skeptical of Taleb’s philosophy, and think risk in DeFi is probably priced into the yields. Vitalik also recently posted about how the amount of funds lost to DeFi has been declining significantly compared to the TVL, making it much safer. I tend to agree with this viewpoint. Ethereum has proven its security by operating for over ten years without any downtime or hacks. If any exploits existed at the base layer, there are huge incentives to find and report them. Chainlink has been live for over six years and never suffered an exploit. If you can’t underwrite these foundational risks, you can’t DeFi.
According to Vitalik, in 2019, 2% of all TVL in DeFi was stolen. If you’re only eking out a few percent in yield on dollars, this isn’t a good risk/reward profile since you could get the same or better rates buying U.S. Treasuries. However, now the numbers are a lot lower, with Vitalik’s research putting the percentage of TVL stolen this year around or under 0.1%.
Ok, so we have managed to convince ourselves that the likelihood of blowups from unknown tailrisks are low enough that participation makes sense. Now, how do we go about constructing this portfolio? We can use the Kelly Criterion for portfolio construction, but it has to be modified a bit to account for the fat tail risks we are taking that aren’t quantifiable. Let’s just say that no one DeFi protocol can hold more than 10% of our portfolio, so if a hack happens, we aren’t risking complete ruin. In choosing and evaluating protocols, their liveness, TVL and history matters a lot. We can’t expect to have any way to evaluate the safety of a protocol that launched yesterday without any TVL. Previous history of hacks is usually a pretty negative signal, though this is not definite.
Another way risks in this portfolio can be correlated is through composability. If you have a portfolio split between Morpho, Aave, Compound, and an ETF protocol which deposits funds into Morpho, Compound and Aave, then you really are exposed to the same 3 underlying protocols with a wrapper around one of those positions that deposits funds into the same three venues you are already exposed to. Other examples such as Pendle allow trading of yield tokens where the underlying yield is generated in another venue.
Yield farming with dollars can be a scary proposition, since upside is capped to the current market rates, which rarely go above 10%, and you can lose your whole position in a hack. You can’t know how a protocol will blow up ex ante (unless you find the bug yourself).
Tying all of this together: DeFi has matured significantly in the past 5 years, with hack rates dropping from 2% to under 0.1% of TVL. However, capped upside with uncapped downside means users need frameworks to control risk. Capping protocol exposure and diversifying across multiple protocols per risk category reduces risk of ruin. Users must assume the foundation layers such as L1/L2 and oracles are secure to engage with yield strategies. Watch out for hidden correlation through composability, wrapping the same protocols in a basket doesn’t automatically create diversification if you already have exposure. Lastly, if you’re earning 10%+ on stablecoins or anything in DeFi, you’re taking meaningful risk whether you feel it, or not. The opportunity is real, but you have to go into it clear eyed, understanding the risks.
DISCLAIMER: This article is for informational and educational purposes only and does not constitute financial, investment, or legal advice. The author is not a financial advisor. DeFi carries significant risks including total loss of capital. Always do your own research and consult with qualified financial professionals before making investment decisions.
