ARFC. Stable rate deprecation

Summary

Proposal for the full deprecation of stable rate mode from Aave v2 and v3, with all user positions being swapped to variable.

Motivation

On the 4th of November 2023 6, a report was received via the Aave <> Immunefi bug bounty program about a critical bug related to the stable borrow rate.

Only certain assets were affected due to their configuration, but given the nature of the bug, together with the progressive deprecation of stable rate that started before (not enabled in Aave v3 Ethereum, the main instance of Aave at the moment, or any other afterwards), the fix involved a full deprecation of minting mechanisms of stable debt: halting new borrowings in that mode and also halting rebalancing and swapping from variable to stable.

Even if with the halting of minting of stable rate we are fully confident that there is no further vector, the current situation is extremely asymmetric, and creating really important technical overhead, for example when doing security evaluations/reviews of the protocol: there are user positions at stable, which factually have fixed rate until they decide to close it, without any kind of rebalancing applicable.

Additionally, and even if we know with full certainty that it is not applicable anymore, we are not comfortable disclosing how was the attack vector reported in November until all user stable debt positions are closed.

Therefore, after evaluating the scenario for some time, we think the better solution is to progress on the deprecation of stable rate, by having all user positions at stable moved to variable.

Specification

The Pool smart contract on both Aave v2 and v3 has a function swapBorrowRateMode(), originally allowing for an user to swap his own borrow mode from stable to variable and vice versa, and after the bug report, only allowing the user to swap from stable to variable.

With one of the swap directions not available anymore, this function becomes factually a mechanism of off-boarding from stable rate to variable. However, in some cases, for lack of monitoring of the positions, and in others, because it is not profitable, multiple users have stayed in stable rate mode, not swapping to variable.

The proposal consists in an update to the Aave Pool and its affected libraries to make the swapBorrowRateMode() permission-less (technical details apart) in order to allow any address to trigger a swap of rate from variable to stable.

This will allow, for example, an Aave DAO automation to swap all current stable debt positions to variable, without any type of penalty to the users, apart from losing their stable exposure (sometimes positive for them, sometimes negative, if compared with the current variable rate).

As no new positions with stable rate can be created, this will allow for the final off-boarding of the mode, once all positions are at variable.