Because signers are able to collude to censor withdrawals or abscond with funds, a bond is required per deposit from each backing signer.
Unlike the staked work tokens used to choose signers, signer bonds need to be a liquid asset with a large market cap. This restriction increases the cost of market-based attacks, where the price of bonded collateral can be pushed up or down by market manipulation.
Bonded signers offer depositors recourse in the case of colluding signers interfering with operation. A signing group that doesn’t provide a requested redemption signature within a timeout (the redemption signature timeout) forfeits their bond. Similarly, a signing group that provably signs unauthorized material forfeits their bond, and additionally risks their work token stake.
Two tokens present themselves as obvious choices for signing bond collateral—TBTC and the underlying work token. During the bootstrap phase of the network, neither is an appropriate candidate due to low liquidity.
Since signer bonds need to be denominated in a widely traded asset to avoid market manipulation, the next most obvious pick for bonding is the host chain’s native token. For tBTC v1, that means ETH. As the ecosystem matures, other bond collateral options might become feasible at the expense of a more complex implementation.
Clearly, security concerns require signing bonds that are proportional to the
lot size of a deposit. To maintain a negative expected value from signers
colluding, the amount forfeited by misbehaving signers must be strictly
greater than the amount they have to gain. Assuming a lot size of {btc-lot-size},
constant exchange rate between BTC and the bonded asset, and a M-of-N group
of signers backing a deposit, the minimum collateral for each signer is
({btc-lot-size})/M, denominated in the asset being bonded (ETH in the base
case).
|
Note
|
For tBTC v1, attributability limitations in the signing protocol mean the signer group is 3-of-3. As a result, the required per-signer bond will be {extra-collateral} of the lot size per signer, for a total {total-collateral} bond (see the following section on ETH price drop relative to BTC). With attributability in later versions, bonds will be able to be decreased by increasing both signing group size and threshold. |
The above assumes a constant exchange rate between BTC and ETH, but in truth the two currencies fluctuate relative to each other, sometimes wildly.
If the value of ETH drops precipitously relative to BTC, then the dollar value of the ETH bonded by the signers can be less than the dollar value of the BTC deposit they have backed, meaning signers have positive expected value if they try to steal the BTC in the deposit.
In order to avoid that, we require that the bonds are overcollateralized. For each ETH signers collateralize, they must put up an additional {extra-collateral}, for a total of {total-collateral} collateralization rate.
In general, total overcollateralization of {total-collateral} (3/2 * 100%)
keeps signer incentives aligned with the well-being of the system up to a 33%
drop ((1 - 2/3) * 100%) in price of the bonded asset against the deposit’s
asset. Increasing this percentage can increase the robustness of the system,
at the expense of opportunity cost to the signers which should be compensated
via fees.
If the value of ETH crosses a security threshold, open deposits will enter pre-liquidation, followed by liquidation.
Since signer fees are denominated per BTC in custody (with overcollateralization factored in), a BTC value drop against the bonded asset translates in lower fees for signers. Note that this does not create any issue for TBTC reserves, but it makes the system less attractive to signers earning fees on their assets.
Signers SHOULD buy TBTC from the markets in anticipation of such overly overcollateralized deposits and they SHOULD use it to redeem these positions where possible, thus reclaiming their ETH liquidity which can be used to back other deposits. An alternative would be to provide signers with the ability to safely rebalance their bonds back to {total-collateral}; however, that introduces implementation complexities and as a result is not the preferred solution for the initial deployment of the mechanism.
Unlike popular synthetic stablecoin schemes, the tBTC system design makes no effort to stabilize the value of TBTC relative to BTC: TBTC will be priced by the market. Instead, the goal is to ensure that the TBTC supply is strictly less than its backing BTC reserves.
For this reason, the only price relationship the system needs to understand is between the signing bond collateral and BTC.
For tBTC v1, that means the price of ETH relative to BTC. Due to only needing prices for a single pair of assets, tBTC will initially use a simple price feed.
At the first threshold of {pre-liquidation-threshold}, a deposit enters pre-liquidation, also referred to as “courtesy call”. In this state, a deposit can be redeemed by anyone, even if the deposit is locked (see the sections on redemption and minting for more). Pre-liquidation indicates that the signers should close the deposit or face forced liquidation after a pre-liquidation period. If the deposit is not closed within {pre-liquidation-period}, or if the deposit collateral falls below {liquidation-threshold} collateralization, liquidation will follow. This gives each signer an incentive to close the position before it becomes severely undercollateralized. Alternatively, if the ETHBTC ratio recovers such that the deposit becomes at least {pre-liquidation-threshold} collateralized during the {pre-liquidation-period}, the deposit is safe and is moved away from the pre-liquidation state.
In future versions of the system, more complex pre-liquidation mechanisms could be introduced. For the initial version it seems prudent to choose a simple mechanism with large penalties for ongoing undercollateralization. In addition, by incentivizing redemption of undercollateralized or significantly overcollateralized positions, signers are protected from being long ETH for long periods of time.
Forced liquidation should be rare, as rational signers will redeem deposits before liquidation becomes necessary. However, the possibility of extreme punishment via liquidation is necessary to prevent dishonest behavior from signers. Liquidation may occur because signers didn’t produce a valid signature in response to a redemption request, because the value of the signing bond dropped below the liquidation threshold, because they did not respond to the courtesy call, or because the signers produced a fraudulent signature[1].
The primary goal of the liquidation process is to make the deposit owner whole in the face of incorrect signer behavior or external dynamics that compromise deposit safety.[2] The secondary goal is to punish signers maximally for incorrect behavior, when such behavior can be proven.
The most valuable asset held by the system is the signer bond. Therefore, the liquidation process seizes the signer bond and attempts to use the bonded value to purchase TBTC and compensate the deposit owner. Any signer bond left over after the deposit owner is compensated is distributed to the account responsible for reporting the misbehavior (for fraud) or between the signers and the account that triggered liquidation (for collateralization issues).
To compensate the deposit owner, the contract starts a falling-price auction with the seized signer bond. It offers {liquidation-auction-start-percent} of the signer bond in exchange for the outstanding TBTC amount. This amount assumes that the deposit is properly collateralized at {total-collateral}, which guards against price feed malfunctions that could cause a properly-collateralized deposit to otherwise be taken for an incorrectly high ETH value. The amount of bond on sale increases over time until someone chooses to purchase it, or the auction reaches 100% of the bond. The auction will remain open until a buyer is found.
TBTC received during this process is sent to the deposit owner; if the owner is the vending machine, the vending machine MUST burn the TBTC to maintain the supply peg. If any bond value is left after liquidation, one of two things occurs:
-
In case of liquidation due to undercollateralization or abort, the remaining bond value is split 50-50 between the account which triggered the liquidation and the signers.
-
In case of liquidation due to fraud, the remaining bond value goes to the account which triggered the liquidation by proving fraud.
At the end of liquidation, unresponsive or misbehaving signers have control of the deposited BTC. What those signers do with the BTC outside the tBTC system is for them to decide—it might be split up, stolen by a signing majority, or lost permanently.
|
Note
|
If a Fee Rebate Token (FRT) has been given out to mint TBTC for a deposit that is liquidated (see the Minting section), the FRT owner is not refunded during liquidation. The fees that were escrowed in exchange for the FRT are instead used to compensate the signers, and the FRT is no longer eligible for compensation. |
-
Signers guard a deposit of 1 BTC, backed by 75 ETH at 0.02 BTC/ETH (1.5 BTC in ETH, 150% collateralization ratio).
-
ETH price drops to 0.01333 BTC/ETH. 75 ETH now only collateralizes 100% of the Deposit (1 BTC / 75 ETH)
-
Liquidation is triggered and the 75 ETH is seized to buy back TBTC.
-
The deposit must use the 75 ETH to purchase 1 TBTC. In an attempt to get a discount, it auctions {liquidation-auction-start-percent} of its ETH reserves.
-
An arbitrageur burns 1 TBTC at 90% of the auction and obtains 67.5 ETH. The liquidation of the deposit is now over. The arbitrageur might do this because the price has recovered during the auction, because they intend to use the ETH to arbitrarge against a higher price later or with a different asset, or because they are arbitraging against an earlier, advantageous TBTC price at which they acquired the requisite TBTC.
-
Half of the remaining 7.5 ETH is distributed to the signers (if they had committed fraud this would be 0), and the remainder is given to the account which started the liquidation process on the Ethereum smart contract. At this point, the deposit is marked as closed. Note that the FRT holder is not refunded during liquidation..
-
Optionally, the N signers coordinate and agree on how they will distribute the 1 BTC deposit.