Collateral Portfolio Optimization in
Crypto-Backed Stablecoins

We assume that the reader is familiar with basic DeFi concepts such a blockchains, transactions, smart contracts, and Ethereum (see, e.g., [8, 27, 32] for more details). However, we provide a quick summary of other DeFi concepts that appear later in this work to clarify terminology.

ERC-20 Standard. Smart contracts can be used to define local token types beyond a blockchain’s native token. In Ethereum, this process is facilitated by the ERC-20 token standard. ERC-20-compliant smart contracts maintain a common set of functions for tokens, e.g., transfers and balance inquiries.

Decentralized Exchanges (DEXs). Tokens that are local to the same blockchain can be exchanged without the need for an intermediary by using a DEX that operates an Automated Market Maker (AMM) protocol [33]. The biggest example of a DEX is Uniswap.³³3https://uniswap.org/ As of V2, a Uniswap DEX on the Ethereum blockchain consists of a separate smart contract for any pair of ERC-20 tokens. Users can withdraw tokens of one type from the pool in return for a number of tokens of the other type as described by the AMM. To provide liquidity, users can deposit tokens of both types to earn Liquidity Pool (LP) tokens, which entitle holders to a portion of the fees collected by the DEX.

Wrapped Tokens. A token from one blockchain can exist on another blockchain in the form of a wrapped token – e.g., Wrapped Bitcoin (WBTC), which is an ERC-20 token on Ethereum. Wrapped tokens are typically backed by matching collateral on the original blockchain – this collateral can be controlled by trusted custodians (e.g., WBTC) or through a protocol with overcollateralized vaults (e.g., Xclaim [34]).

Event Logs. Smart contracts in Ethereum can emit events defined by the smart contract code. Events consist of up to 4 32-byte ‘words’ and are stored separately in the block (i.e., blocks have a separate Patricia-Merkle tree for logs). Logs allow clients to efficiently query the state of contracts after a transaction.

Stablecoin Models & Surveys. High-level descriptions of the principles of crypto-backed stablecoins can be found in various survey papers [23, 32, 2]. Werner et al. [32] provide a general overview of DeFi that also includes a brief description of stablecoins. Klages-Mundt et al. [23] provide a high-level overview of research challenges in stablecoins, including a classification of stablecoin designs (custodial vs. non-custodial), a discussion of price and capital structure models from the scientific literature, and agent incentives. Ante et al. [2] provide a systematic literature review of 22 papers that perform empirical evaluations of stablecoins, of which the majority focus on fiat-backed stablecoins.

Salehi et al. propose the formalism of red-black coins [30], which combine stablecoins with another token type that incurs added volatility for a fee – the DSS can be seen as an extension of this concept. They also investigate the removal of liquidations from the DSS. Cao et al. [9] propose two methods that derive stablecoins and leveraged investment instruments from regular tokens. Both works illustrate their methods using simulations of geometric Brownian motion (the latter via a jump-diffusion model).

Stability of Dai Vaults. The stability of Dai vaults is an active area of research both among crypto firms [6, 28] and in academia [4, 21, 22, 10]. Bluhm et al. propose the CALM framework [6] to evaluate the risks of crypto collateral – they consider duration risk, credit risk, market risk, and operational risk. The market risk in CALM is equivalent to the risk studied in this work, i.e., a loss of value of the crypto collateral due to price fluctuations. To evaluate market risk, the authors cite work by Block Analitica [28] on the Maker Risk Dashboard.⁴⁴4https://maker.blockanalitica.com/simulations/risk-model/ The latter uses simulations to recommend system-level parameters for DSS vault types, e.g., the savings rate and debt ceiling. While similar in aim to our work, the simulations have fixed parameters (e.g., 50% price drops for ETH) that do not depend on recent historical data and which do not take the correlation between token price changes into account.

Simulation-based estimation of the credit risk in individual vaults also appears in [4] and [21]. The former work focuses on modeling the price of Dai given a population of investors with varying risk tolerance profiles, whereas the latter focuses on simulating the liquidation auction mechanism. Kjäer et al. study Dai’s liquidation auction mechanism during the Black Thursday event of March 2020 [22], during which a large number of vaults were liquidated. Chaleenutthawut et al. provide a dataset of interactions with the ETH-A vault type [10]. This can be used to study the evolution of the collateral in individual vaults over time. Liquidation risks for individual vaults are also computed using Brownian motion.

Others. Like our work, Balance [17] aims to reduce the overcollateralization rates in crypto deposits (Dai’s collateral is included as an example) through portfolio optimization, however the focus is on attacks rather than price fluctuations. CroCoDai [29] aims to improve the resilience of crypto-backed stablecoins by allowing native support of collateral on multiple chains without the need for (expensive) cross-chain transfers of wrapped tokens.

A multitude of stablecoin designs have emerged in practice, and we use this section to highlight some of the most prominent designs. We focus on crypto-backed stablecoins as they are the main focus of this paper.

Crypto-backed stablecoins: Dai is the most prominent (by market value) stablecoin with a crypto-backed component, although it is more accurately referred to as a hybrid fiat/crypto-backed stablecoin because around 60% of its collateral consists of real-world assets held by the Maker Foundation. Examples of pure crypto-backed stablecoins include Liquity USD (LUSD) and Reflexer’s RAI, which are both backed entirely by ETH vaults.

The Frax [20] platform supports a hybrid crypto-backed/algorithmic stablecoin (FRAX). FRAX, or any Frax-like coin, is a fully crypto-backed stablecoin upon its inception – users can only mint new coins by depositing other ERC20 tokens such as USDT (Tether), BUSD, sUSD, USDC, and Dai. However, once FRAX has achieved significant usage, its algorithmic component – in which tokens are minted or burned when the currency loses its peg – becomes more prominent. Celo [11] is a layer-2 Ethereum platform which supports its own stablecoin (CUSD), which is backed by a combination of fiat and crypto assets including Celo’s ERC-20 token (CELO) and other cryptocurrencies such as Bitcoin and Ether.

Other stablecoins: The most prominent examples of fiat-backed stablecoins include Tether (USDT) and Circle’s USD Coin (USDC). As mentioned in [19], prominent examples of pure (non-collateralized) algorithmic stablecoins include Ampleforth (AMPL), and the now-defunct Terra (UST), NuBits (USNBT), and BaseCoin (BAB). The large number of collapsed algorithmic stablecoins has called the viability of this approach in doubt [26].

The primary way to increase a crypto-backed stablecoin’s resilience to price shocks is to obtain a portfolio that minimizes volatility, especially downward movements. Large, sudden price drops can result in a liquidation of users’ deposits and potentially destabilize the entire protocol. Even though positive returns are beneficial for a portfolio’s stability, the mean returns vary significantly over the observed years and are often close to zero in the medium-term. By contrast, we have observed from our data that variance values are more persistent over time. Therefore, the mean returns are not our primary optimization criterion, and we focus first on minimizing the volatility while considering the (possibly high) correlation between token prices.

Using principles from mean-variance analysis, the optimal portfolio composition is found by solving the convex optimization problem defined as

where $M$ denotes the number of included tokens, $a_{i}$ the fraction of the portfolio that is invested in token $i\in\{1,\ldots,M\}$, $\boldsymbol{a}$ the vector $(a_{1},\ldots,a_{M})$, and $C$ the $M\times M$ covariance matrix of the prices of the included cryptocurrencies. Here, the prices are assumed to be random variables whose probability distribution has the same (finite) mean and variance over short time windows. The bounds $\lambda_{i}\in(0,1)$ prevent portfolios that are dominated by a single token and therefore more prone to black-swan events (e.g., the collapse of the FTX token [18]).

Regarding the mean returns, Figure 1 visualizes the trade-off between price (normalized) volatility and expected returns for different token types, as indicated by their symbol (e.g., BTC for Bitcoin). We observe an efficient frontier of optimal portfolios, i.e., the portfolios with the highest return for a given level of risk. In Figure 1, we have also displayed the tokens’ Sharpe ratios [31] – higher values indicate higher rewards for the same volatility. We observe that BTC has the lowest volatility in our dataset, but not the highest returns. By contrast, the Fantom token (FTM) has the highest returns, but at the cost of high volatility.

Minimum Semivariance. Volatility minimization as discussed above treats downward and upward price movements similarly. However, the risk of a stablecoin crash comes only from downward movement. This observation can be captured through the notion of semivariance.⁵⁵5The semivariance of a random variable $X$ is defined as $\mathbb{E}[(X-\mathbb{E}[X])^{2}\textbf{1}(X\leq\mathbb{E}[X])]$ where 1 is the standard indicator function. Computation methods exist for finding optimal portfolios that minimize this risk (called mean-semivariance optimization). The main downside of this method is higher computational complexity, which can become an obstacle when considering a large number of assets over long periods [25]. For the evaluation in Section 5, we will consider optimal portfolios under both minimum variance and minimum semivariance conditions.

Token Selection. Before running the optimization itself, the set of tokens used for optimization has to be selected. The volatility of returns is not the only factor which needs to be considered during this selection. Tokens included in the portfolio must be trusted by users and provide enough liquidity to estimate their price accurately. These criteria imply that we must limit the set of optimized tokens to the top 100 most popular cryptocurrencies. Further, we reduce this list by removing tokens released within the last 3 years because tokens that have weathered the crypto market bust of 2022 are less likely to experience a sudden collapse due to poor foundations (e.g., bugs or serious protocol weaknesses).

If we use convex optimization across this set, we obtain a portfolio entirely consisting of other stablecoins. Although these fiat-backed stablecoins have naturally low price volatility, they come with their own drawbacks as mentioned in Section 1. For that reason, we consider only cryptocurrencies which are not backed by real-world assets. This leads to the most challenging portfolio setting, as these cryptocurrencies are volatile and often highly correlated.

These steps result in a final set of 38 tokens, which are used for the optimization. To ensure greater diversification of the portfolio, we limit the maximum contribution of a single asset by $\lambda_{i}=0.2$ for all $i$. Minimizing volatility and semivariance results in portfolios denoted by A-Vol and A-Sem, respectively. We will compare these portfolios in Section 5 to portfolios that consist only of ERC-20 tokens, to gain insight into the magnitude of the improvements over the historical portfolios, and to explore the potential benefits (in terms of collateral resilience) of including a wider range of wrapped tokens on Ethereum.

Portfolio Evaluation. Once the different portfolios have been determined (i.e., Ethereum-only or not), we can compare them in terms of the main metrics that the portfolios are minimized over, i.e., the annual volatility and annual semideviation – i.e., the square root of the semivariance. In addition, we use stochastic simulations to gain a further understanding of the risk involved. As mentioned before, the main risk comes from a sudden price drop, which may result in the liquidation of the user’s deposit. If the price drop is very big, many user vaults can go into liquidation, and the stablecoin may become unpegged. Therefore, we evaluate portfolios in terms of the risk of the total overcollateralization ratio dropping below the expected ratio.

The main simulation parameters are the initial overcollateralization ratio, $\gamma$, and the required overcollateralization ratio $\theta$ that has to be maintained at all times. We denote the portfolio’s value at time $t$ by $v(t)=\sum_{i=1}^{M}n_{i}p_{i}(t)$, where $n_{i}$, $i=1,\ldots,M$, is the number of collateral tokens of type $i$ and $p_{i}(t)$ their price at time $t$. We assume that $n_{i}$ remains constant for the duration of the simulation. We note that $n_{i}=a_{i}\sum_{j}n_{j}$, where $a_{i}$ is the fraction defined previously, and that the value of the issued stablecoins is given by $v(0)/\gamma$. The stablecoin’s portfolio fails if its value drops below the required threshold, i.e., (after some rearranging)

Portfolios are evaluated using two main strategies: simulations using historical data and using geometric Brownian motion [30, 9]. During historical simulations, periods of historical price data are sampled at random and used for the evaluation of portfolios. Similarly, for geometric Brownian motion, we randomly sample time periods to estimate the mean and variance of the returns and the covariance between individual tokens. These parameters are then used to simulate the prices and evaluate the portfolio. Due to space limitations, we assume an initial overcollateralization $\gamma=2$ and requirement $\theta=1.5$ throughout all simulations. For each simulation result (see Table 1 in Section 5), we use 10 000 runs to estimate the probability that a portfolio fails over a 365-day period.

There are other mechanisms involved in a crypto-backed stablecoin that we do not consider in the simulations. The stability fee, which is a form of interest paid by tokens holders, plays an important role as it incentivizes users to lock or withdraw their assets. However, we have found that the stability fees are typically too low (i.e., $5$–$10\%$ annually) to have a major influence on our simulations during short time periods, so we not consider them further. In particular, the main effect that we witnessed in our simulations is that stability fees effectively increase the overcollateralization level over time, as vault owners are required to gradually provide added collateral. However, this effect is only noticeable over longer time periods for realistic fee levels. Hence, the protocol engineers’ main goal is still to choose a sufficiently high $\theta$ for the stablecoin to survive short-term price crashes, even if stability fees may boost long-term overcollateralization.

Another factor that we do not consider for the simulations is the cost associated with transaction fees. The transaction fees are paid by users and do not affect the portfolio value directly. However, large transactions fees may discourage users from using the protocol, hence reducing liquidity. This further justifies the focus on evaluating the stability of the portfolio itself: lower risk of failure, as described by (2), potentially decreases the number of withdrawals and liquidation actions, resulting in lower running costs incurred by users.

Given the knowledge of an optimized portfolio, the next question is how protocol engineers can enforce it in practice. In hybrid crypto-backed stablecoin systems, the protocol developers can use their own funds to purchase underrepresented tokens and deposit it as collateral. For example, as we will discuss in more detail in Section 5, MakerDAO already controls nearly 60% of all of Dai’s collateral through real-world assets, in addition to an unknown number of crypto vaults.

In a pure crypto-backed stablecoin system, collateral is, in principle, deposited primarily by a large multitude of users who have their own incentives – for example, as of Feb. 2024, the ETH-A vault type in the DSS had 1011 individual vaults,⁶⁶6https://maker.blockanalitica.com/vault-types/ even if some of these are potentially controlled by the same entity. In this case, protocol engineers have only limited options to enforce portfolios. One way is for the protocol engineers to set stringent debt ceilings (similar to the $\lambda_{i}$ parameters of (1)) for overrepresented tokens. However, a downside is that this may discourage token holders from depositing, thus reducing the total value of the collateral and therefore the maximum number of stablecoin tokens. Another method could be for the protocol engineers to subsidize the conversion of overrepresented into underrepresented currencies by paying for the transaction and DEX fees through a smart contract. The difficulty of enforcing optimal portfolios in pure crypto-backed stablecoins is a limitation of the present work, and research into alternative methods of enforcing the portfolio would be an interesting direction for future work. We do emphasize that variance and semivariance optimization both involve minimizing a convex objective function, so even if an optimal portfolio cannot be enforced precisely, it is, in principle, always advantageous to be as ‘close’ to it as possible.

As of early 2024, the DSS has four main types of collateral: 1. ERC-20 tokens, 2. ERC-20 liquidity pool tokens, 3. peg stability modules, and 4. real-world assets.

1. ERC-20 Tokens. Depositing Ethereum-supported tokens as collateral is the oldest supported method of creating Dai tokens, going back to the Dai white paper [24]. The exact procedure to create Dai tokens is as follows. First, the user creates a Collateralized Debt Position (CDP) through a call to a vault contract. Next, the user sends the tokens to the contract to fund the CDP. This allows the user to create and withdraw Dai tokens, under the condition that, at all times, the ratio of the value of the collateral to the number of created Dai tokens exceeds the overcollateralization ratio $\theta$. Users who have created Dai gradually pay interest over their position – this is called the stability fee. Token prices are periodically updated through price oracles. In the following, we will refer to an individual CDP as a vault.⁷⁷7This is consistent, with, e.g., the Maker Risk Dashboard and [10]. Vaults are grouped by their vault type, with different parameter choices per type, including 1. the ERC-20 token type, 2. the stability fee, 3. the overcollateralization ratio, and 4. the debt ceiling, which is the maximum Dai value that can be created using the vault type’s collateral.

If, due to the stability fee or a price decrease of the collateral tokens, the CDP is not sufficiently overcollateralized, then it can be liquidated – an auction is started, the remaining collateral is sold to to highest bidder(s), and the remaining collateral (if any) is returned to the user.

2. ERC-20 Liquidity Pool (LP) Tokens. As mentioned in Section 2.1, Uniswap DEXs may issue LP tokens to liquidity providers – in Uniswap V2, such tokens are themselves ERC-20-compliant although they are typically not listed on major exchanges. LP vaults differ from regular ERC-20 vaults in the sense that price information about the tokens in not provided by oracles, but inferred from the pool itself using a formula that is beyond the scope of this paper (see, e.g, the contract code for the DAI/ETH Uniswap LP token oracle [13]).

3. Peg Stability Modules (PSMs). PSMs are a special type of vault that allow for the instant creation of Dai stablecoin by depositing other stablecoins. PSMs do not maintain CDPs, and the created Dai are not subject to stability fees. Any user can deposit Dai in the PSM to withdraw deposited stablecoins if available. PSMs help the DSS maintain its USD peg by providing an alternative route for token holders to buy or sell DAI tokens for $1 even if counterparties cannot be found on traditional exchanges.

4. Real World Assets (RWAs). RWAs are portfolios held on behalf of MakerDAO by trusted third parties. As of early 2024, the largest RWAs are held by Monetalis, Coinbase, and BlockTower, among 15 RWA vault types in total.

Each type of vault is implemented in the DSS through multiple smart contracts. The contract types that are the most relevant to this work are the Join contracts, which allow for the submission and withdrawal of collateral, and Pip contracts, which process price information. Tangential to our work are Clip contracts, which handle liquidations, and the Vat contract which contains the code for CDP manipulation (i.e., creating Dai from deposited collateral). Finally, the Dai contract implements the Dai stablecoin as an ERC-20 token. The Join and Pip contracts are particularly relevant to our work because they emit events that represent collateral changes and price updates, thus allowing us to reconstruct the historical evolution of DSS collateral. A single token type may have multiple vault types – e.g., ETH has three vault types (ETH-A, ETH-B, and ETH-C) which differ in terms of stability fees and required overcollateralization.

A visual representation of the relationship between these contract types can be found in Figure 2. At the top is the Dai contract, and each vault type has its own unique Join contract (GemJoin) to provide an interface to Dai. The Dai contract also has its own Join (DaiJoin) contract to enable the withdrawal of Dai stablecoins from a CDP. Each vault type also has its own Clip contract to handle liquidation auctions (except RWAs, which cannot be liquidated), and interacts with a Pip contract that provides price information for its token type – vault types that share a token type also share the same Pip contract. For ERC20 and LP tokens, Pip contracts return the median of multiple price feeds. PSMs have no Pip contracts as they are assumed to be 1-for-1 exchangeable with Dai. Finally, RWAs have Join and Pip contracts, but no Clip contract for collateral auctions. RWAs typically feature a single creation of a single batch of $10^{18}$ RWA “tokens”, and the size of the deposit is updated through the Pip contract.⁸⁸8For example, the 6s Capital asset (RWA001) was increased from an initial $\$$1,060 on 9 March 2021 to nearly $\$$1.6 million on 27 August 2021 through a “price” update.

To enable our historical comparison, we have collected both vault data (how many tokens were held for each vault type over time) and price data (how much each token type was worth in USD) for the period spanning from the first submission of collateral (Nov. 2019) to the time of writing (Feb. 2024).

Vault Data. After each successful addition or withdrawal of collateral to a Join contract, an event that encapsulates the change is emitted as a 32-byte integer. The full log of events in Ethereum is publicly available a dataset on Google BigQuery [15]. We obtained the Ethereum addresses of all relevant contracts using the list of contract addresses associated with the Dai stablecoin that can be found on MakerDAO’s change log [1]. The resulting collateral compositions for each vault type were validated using Dai Stats [12], which provides snapshots of the current state of collateral in the DSS. We obtained vault data for all 59 vault types used for the DSS (by contrast, [10] only focus on a single type, ETH-A).

Price Data. Price data for ERC-20 tokens can be obtained from Binance via its API [5]. For LP tokens and RWAs, price information can be obtained from events emitted by the Pip contracts. We note that the Pip contracts for the other vault types can also be used to obtain price data, although we have not found major discrepancies when comparing the two.