Hello everyone,
Here’s a short note on recent changes to the protocol due to events after the collapse of FTX. The major pain point around the soBTC depeg was discussed in detail in another thread. This note also covers subsequent changes that were made to deal with disruptions to the Pyth oracles for several tokens on the protocol.
These events can serve as an example of the kind of decisions and actions that a hypothetical risk management core unit might be faced with.
Let’s start with a quick primer Jet margin accounting.
Margin accounting on Jet Protocol
The financial character of margin accounting on Jet is described in Jet Protocol’s public documentation. There are also a couple of implementation details worth understanding to contextual the information below.
Local versus global parameters. Risk parameters (e.g. collateral weights and required collateral factors) are defined as part of the metadata associated with onboarded tokens. These protocol-wide parameters are referred to as global parameters. When a new position is created in a margin account, the corresponding global parameters are copied into the entry of the new position in the margin account. These copies are referred to as local parameters. It is the local parameters that are used for account health checks. When global parameters are changed, the local parameters of existing positions are not changed automatically. This allows for aggressive changes to global parameters without affecting the account health of existing users. It is possible to update local position parameters to match the global parameters.
Refreshing position information. To evaluate the health of a margin account, which is a necessary step in any action that changes position balances (for example, borrowing or withdrawing) the margin program must have an up-to-date picture of position balances and associated prices. To refresh price information, a live Pyth oracle is required. To perform a health check, all debt positions in an account must be refreshed. Collateral positions do not have to be refreshed, but only refreshed positions will contribute collateral toward the health check.
Initial adjustment and soBTC depeg
When news of FTX first broke Jet developers updated the protocol parameters to be significantly more conservative, including zeroing the soBTC collateral weight. Because there were only a few open soBTC positions, and they only held dust, and in order to avoid forcing any accounts into liquidation, these changes were made to the global parameters to affect new positions, but were not applied to existing positions.
Unfortunately two of the users with existing soBTC positions chose to exploit this situation to drain funds from the protocol. These events have already been discussed on the forum. The protocol had borrowing disabled for a few days while Jet developers built and deployed the instructions to take over the debts and collateral of the malicious accounts to repay the debts.
Subsequent oracle problems
The chaos on Solana following the FTX collapse included disruption to several Pyth oracles, which impacted several tokens: ORCA, FTT, scnSOL, stSOL, and mSOL were among the worst affected. Stale oracle prices could not be used to refresh margin account positions, and this led to some users being unable to transact with their margin accounts.
By 18 November Jet developers had deployed program and app updates to address these issues.
The app was modified to avoid unnecessary position refreshes. Collateral positions with zero collateral weight, or with non-zero weight but zero balance, are no longer refreshed. Therefore it doesn’t matter what the oracle state is, and it doesn’t affect the accounting that the positions are stale as they would not contribute anyway. This addressed the problem with ORCA and FTT deposits disrupting margin account functionality, because those assets have always had zero collateral weight.
The liquid staking tokens (stSOL, scnSOL, etc) were more complicated, as Jet developers wanted to avoid zeroing the collateral contribution of those tokens to user margin accounts. Instead Jet developers modified the metadata for those assets to reference the SOL oracle itself. From a collateral contribution standpoint this is a conservative change. To address the potential that these changes lead to undervalued loans of staking derivatives, Jet developers modified the required collateral parameters for liquid staking token loans to require excess collateral that exceeds the value of the loan itself. Since the SOL oracle remains reliable, staking derivative positions are no longer disrupting margin account functionality due to stale prices. It is still possible to borrow liquid staking tokens, but it is very capital intensive.
Loan positions must always be refreshed, and there are no parameter changes that can safely work around that. Therefore Jet developers disabled borrowing of FTT and ORCA to avoid creating new loan positions in these tokens with the potential to disrupt margin account functionality due to stale oracles.
Current status and future work
The protocol is operational, however with higher margin requirements than before. Users who happen to have an ORCA or FTT loan may have trouble operating those margin accounts due to stale oracles. FTT and ORCA borrowing and lending are disabled so that no new loan positions in these assets can be created.
Jet developers encourage the JetDAO to consider offboarding FTT and soBTC, and onboarding a replacement BTC token such as Wormhole BTC. Jet developers (and the awesome community of users) should continue to monitor the market in general and Solana in particular. Liquidity risks might grow as Solana sheds TVL. As the oracles stabilize some of the changes described above should be rolled back. Risk management procedures, particularly around expectations and channels for communication with users during emergencies, must be established. Perhaps this is the time to form a risk management core unit.