Understood that launching Ozone quickly is of high interest to the Terra community - this post is intended to collect community feedback around the Ozone’s mechanism - I will be following up with a plan of action & ask for funding from the Terra Community Pool (which will burn all the Luna contained therein if the proposal is successful) to bootstrap the initial funds for the Ozone Protocol shortly in the future.
Unlike some other protocols where TFL worked in stealth to launch projects, it’s more important for Ozone to be developed in the open in the community as the vast majority of funds plans to be bootstrapped by the community pool.
But for now, let’s dive into how I’ve been thinking about Ozone.
Ozone Insurance v2.1
Ozone is an insurance mutual protocol that facilitates levered coverage of technical failure risks in the Terra DeFi ecosystem. Insurers can deposit X UST and provide coverage up to N * X UST to cover various TeFi contracts, N being the leverage constant set by governance. When Ozone is “overleveraged”, the system calibrates itself to its target leverage ratio by increasing the emission of the $OZ governance token to insurers.
The system has three actors:
The insurer
The insuree
The $OZ staker
System Components
oUST: Ozone UST - a virtual balance of UST that insurers can allocate to Covered Vaults to provide coverage. The insurer gets target_leverage_ratio * deposit size # of oUST when he makes the deposit.
Covered vault: A Covered Vault (CV) is a smart contract that wraps a TeFi contract that takes in UST and offers users yield. The CV deposits UST on behalf of the insuree to the yield contract, say Anchor, and takes the cut of the resultant yield. Should technical failure of the yield contract occur, the CV claims UST against the underlying insurance pool.
Global insurance pool: the global pool of UST deposited by insurers.
Key Variables
target_leverage_ratio : Ratio by which Ozone’s AUM will be leveraged to provide coverage. For example, if N is set to 4 and Ozone’s AUM is 2B, Ozone will provide coverage up to 2B * 4 = 8B. Initially set to 1.
real_leverage_ratio : Ozone’s outstanding oUST balance divided by the balance of UST in the global insurance pool.
vault_whitelist : A list of {CV_address, cover_fee} tuple recognized by the system. Governance can add to or remove from this list.
climate_tax : a [0, 1] tax charged on the cover_fee revenues from each CV. Is collected by governance, used to buy back $OZ from Terraswap and distributed to users that stake $OZ in governance similar to $MIR and $ANC.
claim_delay : The amount of time claim_underlying takes to claim funds from the insurance pool. If coverage is successfully challenged for the CV by governance, all claims not yet processed fail, and the UST returned to the insurance pool. The claim_delay period must always be longer than the length of the governance vote period.
cover_fee_max: The maximum cut of the yield each CV takes. Initially set to 0.5.
Mechanism
Whitelist / blacklist coverage
A whitelist_coverage_proposal adds a CV contract to the whitelisted set, and the proposal includes the cover_fee ratio of the yield to be captured by the CV.
A blacklist_coverage_proposal removes the CV from the whitelist.
Provide coverage
The insurer can provide leveraged insurance through ozone, which locks up UST for varying periods of time, and earns yield from various TeFi contracts.
The insurer deposits X UST into Ozone, which mints X * target_leverage_ratio oUST. The deposited UST has a 1 year lockup period. This mechanism can be edited such that there are varying lockup periods with varying leverage ratios, similar to a Curve.fi bonding curve.
V2.1 Addition: The cover_fee is a function of the utilization ratio of the CV. cover_fee = min(cover_fee_max, 1 / u(CV)), where u(CV) = val(UST deposit in the CV) / val(oUST in CV), and cover_fee_max is some global gov determined var in [0,1], say 0.5.
The insurer then funds oUST into various Covered Vaults of his choice, and starts to earn a yield on each of them pro-rata to his portion of oUST staked to the overall pool. The cover_fee * (1 - climate_tax ) is collected by the CV is passed onto the insurers.
Buy coverage
Depositing into a covered vault allows the user to purchase ozone coverage for TeFi yield farming in exchange for paying a cut of the resultant yield.
The insuree may deposit UST into the covered vault - the CV deposits the UST on behalf of the insuree, and allows the insuree to claim 1 - cover_fee from the yield.
The insuree may only deposit UST when:
u(CV) < 1, that is, the oUST in the CV’s pool is greater than the amount of UST deposited by insurees.
size(CV AUM) < size (global insurance pool)
The insuree may claim his deposit from the CV.
The CV first attempt to call claim_underlying(), withdrawing the the deposit from the yield source. If the call fails or returns less than the size of the deposit, a global claim_delay period is triggered, after which claim_insurance() is called, provided that the claim is not successfully challenged by governance.
V2.1 Addition: Let L(CV) be the size of the CV funds impacted, and O(CV) size of the oUST deposits in the CV, which obviously observes the invariant that L(CV) < O(CV). First, the funds are paid out from the stakes of oUST depositors in the CV, pro-rata to their oUST deposits in the CV. If there are any remaining losses, they are withdrawn from the remaining insurance pool, “slashed”, with insurers being compensated in new emission of $OZ tokens vested over [1 year].
Challenge coverage
A challenge coverage proposal is a governance proposal to halt all claims for a CV, or for a particular {CV, claim address} tuple.
A resume coverage proposal is a governance proposal to resume all claims for a CV, or for a particular {CV, claim address} tuple previously blocked by a challenge coverage proposal.
Recover target leverage
As claims are made against the insurance pool, the real_leverage_ratio is going to at times climb higher than the target_leverage_ratio . The protocol aims to return the real_leverage_ratio to the target over time, by:
Waiting : As new insurers enter and mint oUST at the target_leverage ratio, the real_leverage_ratio will organically converge to the target.
Rerouting fees : While real_leverage_ratio > target_leverage_ratio , the UST revenues of cover_fee - (1-climate_tax ) from each vault is routed directly to the insurance pool to increase the AUM, which in turn reduces the real_leverage_ratio. As the cover fees are routed to the insurance pool periodically, an equivalent value in $OZ is minted (inflated) by the governance contract and given out to insurers instead of the normal UST fee. → Removed in v2.1
FAQ
What types of failures would Ozone protect against?
→ Anything that would prevent claim_underlying() from being called - this could be anything from technical failures of covered protocols to failures of economic assumptions (aUST cannot claim UST tokens due to money market illiquidity)
What is the use of the Ozone Community Pool?
→ Anything that the $OZ token holders decide, but i imagine it would be things like 1) paying for risk assessment of new protocols (protocol audits etc) 2) funding development of new ozone friendly features and products, 3) mitigating some unforseen failure of the system etc
What happens if Ozone itself gets hacked?
→ Well then obviously we would be fucked. But with a TradFi insurer, technically someone could run off with the funds or the depository institutions could go bankrupt for some reason. The point is that you place risks in a system that has a smaller technical surface area (as Ozone matures and its code / infrastructure calcifies, its risk of failure will be much smaller than new TeFi protocols). In the beginning, the risks of Ozone failing and Anchor itself failing could be roughly similar.
What is the vision for Ozone?
→ I forsee hundreds of TeFi projects launching, all using the base layer money of the ecosystem in some way. That today is UST. These apps will exhibit decreasing correlation in failure risks over time, and Ozone will be able to increase its leverage to cover them accordingly.
Is it appropriate to use the Terra Community pool for Ozone?
→ This is up to the community to decide. Either way, Ozone will be fine. Having 1B in AUM starting off will bootstrap things much faster, but there a concern that the Luna currently in the community pool is being “double burned”, as it is there as a result of having been burned once already to mint UST. Keep in mind, however, that leveraging seigniorage to fund growth in the ecosystem through the community pool was one of the original design philosophies of the Terra Protocol, and something we recently elected to change as a community in the upcoming Columbus-5 upgrade. Let governance decide.
What will prevent $O3 stakers (now $OZ) from denying all claims to prevent dilution?
→ I believe $OZ stakers through long lockups will be incentivised to vote honorably, as Ozone’s loss of credibility will lead to discontinued utility for the protocol. Furthermore, keep in mind that claims governance isn’t approval-based, but denial-based - we could simply set the threshold to deny claims high to favor approval in cases where decisions are controversial.
Shouldn’t the yields be at least 20%+ for users to deposit UST into Ozone instead of Anchor?
→ When Ozone is securing multiple protocols, I believe it will be possible to get to a state where it is drawing down enough yield at high enough leverage to comfortably beat the 20% yield - but as we are getting there, farming incentives of the $OZ token should be sufficient to beat 20% yields (think it should be somewhere above 60-80% APR)
From @roger - should the Terra protocol offer insurance natively?
→ Layering.
(Updating as new Qs come up from the community)
The $OZ Token
Supply: 10B, no max supply
Distribution:
15% - Luna airdrops (5% genesis, 10% over 1 year)
20% - OZ-UST LP incentives over 4 years
20% - Community pool
45% - Insurer incentives over 4 years (divided in weekly installments to insurers)
Functions:
Protocol governance
Backstops protocol solvency through new emissions
Captures yield from the farms the protocol is insuring through a buyback & distribute scheme to stakers
Very cool. Who exactly decides on claim challenges, just a gov proposal to stakers? What’s the mechanism that balances claims in a vault that are above actual UST for the vault (assuming levered above 1)? Will payouts rely on a time delay for claims mixed with ramping up incentives for new insurers to bring in more coverage or will the funds be pulled from other vaults (global)?
Hey… i have a little question…
The Ozone Insurance will protect against “technical failure”…
But what/or is there…a Insurance against a hacker attack? And could be a hacker attack on Anchor?
I mean…you interact direct from your wallet with the smart contract to anchor.
If your wallet isnt compromised how could be a hacker get access to my funds in Anchor?
(Sorry to ask this question … and maybe it is difficult to answer that but i think many people are a little bit cautious cause many dont understand exactly the function of the interaction between the own wallet and Anchor)
I really do enjoy the covered vaults proposals. Will 100% allow for earlier exploration into smaller protocols that exist in the ecosystem that have been voted and accepted into having their vaults wrapped.
Nice. One consideration here , Ozone governance should be able to allocate funds to fund audits of the projects in which it insures . Not too much of an issue just now , but as this ecosystem grows i see this as an important functionality and a way for Ozone to provide mutual value to other projects in the TEFI ecosystem.
I understand 20% of the initial supply will go to the community pool but is there a plan to regularly replenish the community pool? Something worth considering .
Is there a target percentage on the cost of cover for an insuree (e.g. we’re targeting 2.5% for this umbrella coverage in TeFi or is it variable)? Will each protocol have different costs associated with them based on parameters such as length of time in the Terra Ecosystem, audits, etc?
How much of the community pool is being burned?
Is the plan to still burn everything so that only ~$100m worth of LUNA remained in the pool? That would be great.
-the cover_fee should be a factor for CV utilization, when an insuree tries to deposit.
-what currency is returned when claim_insurance() is called? oUST or UST?
-when an insurer’s deposit is redeemable post lock-up, are there any constraints when trying to withdraw oUST from a CV? ie, are they held to the same “below utilization ratio = 1” standard as insurees?
-wouldn’t the target_leverage_ratio have to increase over the 4 year period before insurer incentives run out, otherwise we can potentially see utilization ratio skyrocket (ie, very under-insured) as insurers seek better return elsewhere?
happy to try contributing ideas after i understand the ozone proposal a little better.
I fail to see how and where the community funds will be used. Are they used as an initial standalone insurer? Community fund*n leverage? Is it put in the global insurer pool UST direct without leverage? I guess this makes sense but it isn’t specified.
Can we refer to the ozone token as something other than $O3 for discoverability purposes?
I say this because on twitter, a dollar sign followed by a symbol is (a “cashtag”) is commonly used for discoverability (effectively hashtags for stocks). However, cashtags do not support digits. If you compose a tweet with $O3 in it, there will not be a generated cashtag and the “$O3” will not be clickable.
Maybe $OZO or other stand in would be superior due to compatibility with twitter cashtags
what will prevent an $O3 whale from denying all claims?
If $O3 is well distributed and we do not get a concentration of power, what will prevent all $O3 holders from denying all claims in governance (since claims = dilution of $O3’s value) and it is in their interest to ensure zero claims? This is similar to how insurance companies always strive to deny your claims
oUST needs to yield > anchor rate for insurers to be incentivized to provide insurance (when insurer $O3 incentives run out after 4 years)
For that to happen, [(cover_fee ex-climate_tax) * (target_leverage_ratio) / (yield of underlying asset)] > 1 for the insurer to remain incentivized. That means if anchor is yielding 20%, the cover_fee needs to be 4% net of climate_tax multiplied by a leverage ratio of 5x. At a leverage ratio of 5x (i.e. 20% asset to liability), the protocol seems quite risky
Am I missing something here? Is oUST also invested in Anchor also to help it get to that yield target? Although it would be weird for the insurance pool to be invested in the thing it is insuring against…
It was a great read, thanks for being open to the community for this! Based on the writeup, it is easy to visualise how this protocol can achieve a balance between solvency and capital efficiency.
What i like best about it is that insurers do not actually have to buy the O3 token, but can provide UST directly in return for a potential yield instead. This leaves us with a clear segmentation of the two groups (insurers vs governance), which allows us to incentivise each of them accordingly during the bootstrapping phase (probably insurers > governance).
@Frozone, @unkn0wn6 raised good points on the commercial aspects of this (sorry a lot of others raised good points but i can only name 2 users). Namely how to price cover, and incentivise insurers.
I hope the community can engage on these topics as they are very important. Imo i see these issues:
The cost of cover_fee is something that i think Nexus mutual also struggles with; the good thing is that we have Anchor as a benchmark of a money market rate for how to price this. A bonding curve like what @Frozone suggested would be great; Assuming N to be 5, a CV can start by charging 20% (hence an organic max rate of 100% APR), and plateauing to 5-7% (hence organic max rate of 25%-35%). Since depositing in Anchor means you essentially take on only SC risk, becoming an insurer on ozone gives you leveraged exposure to SC risk. 30% yield is like taking a 1.5x leveraged. This rate seems fair to me. One complication to this is the climate tax, it should be low enough to ensure insurers are properly incentivised. Again, its great that insurers and governance are properly segregated, which allows us to facilitate this.
A second topic is the scope of coverage of cover. I think it is very important that a guiding principle/definition should be clearly defined by governance very early on, instead of leaving it in limbo and for the community to self-organise. A clear scope will allow insurers to assess the risk before depositing, and facilitate consensus between O3 governance stakers.
Thirdly, how can we better improve O3 governance involvement? At current plan, O3 holders are only indirectly incentivised to participate. This is because their funds are not really at stake (only backstop). They will only be impacted if governance makes a few bad calls and users/insurers lose faith in the protocol, and it fails. But this is very indirect and will result in a lot of free-riders. Can we also implement something like what we’re doing with MIR v2, where only O3 holders who vote >50% of proposals get rewards? @unkn0wn6 made a good point about having a whale denying all claims - but i think this is a good thing. Insurers will have an incentive to accumulate O3 tokens in order to have better control of governance decisions, which will push O3 price up.
If we are using the community fund to bootstrap oUST, could the team share more details of how much of the community fund will be used? Will the entire community fund be used immediately? Or injected in tranches - (with target oUST market cap milestones)? What will the community fund do with the O3 token incentives? I think a central authority (maybe TFL) can take charge of this community pool of O3 earned from the UST provided. They will serve as a steward to guide good governance decisions (i.e. ensure that the guiding principles/definitions are enforced with integrity for any challenge coverage).
Lastly - do we already have some details on the below?
a) Is there a cap on how much oUST can be provided to a single CV? (i.e. 1x UST deposited)
In my opinion insurance for Anchor should have just been built in natively at the Terra protocol level, the biggest risk for anchor is luna(collateral) being susceptible to fast falling market prices due to its nature and lower liquidity than top coins.
In fast falling Luna market conditions there might not be liquidators holding hundreds of millions of UST on hand, and liquidators might be hesitant to liquidate if they expect by the time they liquidate the price of Luna to fall more than what would be profitable for them. This is exactly what happened to Makerdao’s Dai on March 12, 2020.
That day nobody was willing to liquidate undercollateralized positions due to the price of ETH falling incredibly fast in a short time, Dai was left undercollaterlized and some borrowers were left with nothing. Makerdao ended up printing new Maker tokens to recollateralize the system. This very same Keeper liquidation system that the first version of Anchor’s whitepaper criticized is unfortunately the one we have today.
A much better insurance system for Anchor would be to have a last resort mechanism where if there’s no bids for collateral, the protocol itself natively liquidates bluna by converting it into UST at the oracle price to guarantee the solvency of the system. The insurance should also be extended to guarantee the issuance of new UST to depositors when they attempt to withdraw aUST in the event that a hacker empties out all value from anchor. This would be inflationary for UST only in the absolute rare event that this safety-net insurance mechanism has to be used, but given UST’s resiliance and its peg guarantee mechanisms it should be able to handle the price pressure perfectly from such an event.
I see this solution as much better than having a third party non native insurance protocol which relies on constant subsidization. Ultimately insurance providers have to consistently make a better yield on their locked capital pool in Ozone than they would on Anchor and themselves getting insurance, which will probably only be sustainable as long as there’s incentives by $O3. Also, with the native insurance solution there’s no need for depositors to pay a cut out of their 20% APY, and if we want Anchor to be the equivalent of a decentralized FDIC bank, insurance should already be provided for all depositors, especially since Anchor itself as a standalone product is being advertised as a Savings protocol. Meaning it should already have insurance built in since we’re ultimately talking about people’s savings, something not to be taken lightly.
However, at the very least if Ozone development continues the same, since subsidization is already planned I don’t see why we can’t achieve a target rate insurance premium for depositors of less than .5% out of that 20% APY to make it as negligible as possible at the very least.
to point 3) it’s an interesting problem because if whales/all O3 holders start denying all claims, the protocol falls apart (ozone becomes useless) and O3 also becomes worthless. Can we trust Adam Smith to work his magic here?
a) i believe oUST provision is the constraint for the UST deposited i.e. it’s only possible under normal circumstances to overfund a CV but not the other way around.
i) A related question will be - what happens to oUST when the target_leverage_ratio changes? I’ve already minted 100 oUST at 1:1 and if the multiple changes to 2, do i magically get some oUST in my wallet or will my oUST that’s already “staked” in a CV get multiplied by 2?? Sorry if asking this question here makes it messy1
Anchor already has a yield reserve pool for emergencies such as this. In extremely bad circumstances, iirc Anchor governance tokens are also used as backstop of last resort.
@fusion The yield reserve is only useful for when there isn’t enough yield being generated by borrower’s assets, it doesn’t at my knowledge provide any type of insurance mechanism for a black swan liquidation scenario. Also ANC is not used for insurance of any type, what were you referring to?
I have the same question… why have insurance at all? Either the entire system is secure or it isn’t.
What possibly insurance claim could I make that would be believable? Let’s say luna “disappeared” from my wallet… this went where and by who? Who would do the “insurance investigation” for example if the problem was with a smart contract related loss?
I am assuming funds are safe and there would be zero insurance claims … but if there were claims, would it not be possible that the number of claims would be massive? And what is to keep the hacker from stealing and making a claim?
