AIP - 69: Wind down the protocol Core Module for agEUR burn and launch Transmuter

This is a vote to:

• wind down the protocol's core module for agEUR burn
• swap the USDC, DAI and FRAX backing agEUR (not the one corresponding to SLP funds) into EUROC and bC3M by Backed
• deposit a portion of the protocol's reserves into a Transmuter implementation and launch this implementation as a minting module for agEUR on Ethereum.

If accepted, this vote will officialize the launch of Transmuter as a price stability module for Angle.

Context

Several months ago, after the Euler hack, discussions were started about the steps for restoring agEUR peg, and a new module for agEUR and Angle. Thanks to the measures that were voted after Euler recovery, agEUR has consistently traded at peg over the last 3 months. In the meantime, we have relentlessly been working with Angle Labs on a new minting module for agEUR called Transmuter.

Before going into the actual proposal and plan for Transmuter launch, let's deep dive on the current status of the protocol.

Angle Protocol Current State

The protocol has several minting modules live:

• the Core module is partially open:
  • it is possible to burn agEUR within the Core module for USDC but not to mint it
  • the protocol has no hedging mechanism and it is currently exposed to a USD/EUR exchange risk
  • the protocol standard liquidity providers can still deposit or withdraw their liquidity. But there is no strategy in place enabling them to earn from their funds, and these SLPs bear no counterparty risk beyond the Angle smart contract risk.
• the Borrow module is live on different chains with no restriction
• the protocol is also engaged in liquidity algorithmic market operations where it minted agEUR paired with surplus USDC on Arbitrum, Optimism and BNB Chain to boostrap agEUR liquidity on these chains

In terms of metrics, the exact state of the protocol can be found on this spreasheet.

As of the 24th of July 2023, the system has:

• 7,119,572.1 EUROC in the protocol Governance multisig
• 9,835,500 agEUR issued from USDC and an amount of USDC for users equal to 8,594,036 USDC (= PoolManager USDC balance - value of SLP claims)
• 1,499,985 agEUR issued from DAI and an amount of DAI for users equal to 2,677,088 DAI
• 1,708,010 agEUR issued from FRAX and an amount of FRAX for users equal to 1,739,945 FRAX
• The protocol surplus sits at ~ $7.4m.

As the upcoming minting module proposed does not come with any hedging mechanism, it will no longer be safe to back agEUR with USD denominated assets. This vote therefore proposes to swap all the USD stablecoins backing agEUR through the Core module into other Euro denominated assets. In total, 13.043m have been issued from the Core module, and the protocol can afford to swap given the numbers mentionned above:

• 8,594,036 USDC
• 2,677,307 DAI
• 1,739,945 FRAX So approximately $13m worth of assets.

Note that, if we're going that way, assets from Standard Liquidity Providers can just remain in the protocol so these have the flexibility to leave at any time.

About Transmuter

In this proposal were mentioned some of the limits we're seeing with the Core module in particular:

• improper resilience in face of black swan events like the USDC depeg
• too high dependence on hedging mechanisms.

The Transmuter system was introduced in this whitepaper as a form of price stability module 2.0 for agEUR. For more user friendly details on it, we've also written a documentation of the system here.

As a TL;DR, Transmuter is a minting module that can work for agEUR, just like it can work for any other stablecoin. It is conceived as a basket of different assets which can all be used to mint or burn the stablecoin at oracle value.

It comes with automated mechanisms to maintain the exposure to each asset in the reserves within reasonable bounds. This enables the system to properly segregate and diversify the risks between the assets in its backing, and guarantees at the same time that in case of a black swan event the system does not end up over-exposed to the weakest assets of its reserves.

Transmuter supports three main user actions: Mint, Burn and Redeem. The mint and burn actions rely on the idea that each asset in the reserves has a target price used to assess whether the asset is depegging and some conservative measure must be taken or not.

Practically speaking, the three operations work as follows:

• Mint: Stablecoins can be minted at oracle value from any of the supported assets with adaptive fees provided that the deviation of the asset used with respect to its target price is reasonable.
• Burn: Stablecoins can be burnt at oracle value for any of the assets in the backing with adaptive fees, provided that the deviation of all assets respective to their target price are reasonable. The idea is to avoid capital outflows changing the exposures of the system in times of uncertainty.
• Redeem: Stablecoins can be redeemed at any time against a proportional amount of each asset in the backing. Users should have a way to exit at any time, and so this feature is available in any conditions.

Transmuter contracts have finished their audit by Code4rena and the public audit report will be published very soon, which means that Transmuter is now ready to be onboarded as a new safe and resilient minting module for agEUR.

As the Transmuter is designed to deal with mostly stablecoins pegged to the same currency as the underlying (e.g agEUR), and as the protocol currently controls mostly USD stablecoins, proposal is to swap the USD stablecoin reserves corresponding to user assets into Euro denominated assets to prepare for the Transmuter launch.

Stablecoins swap

The questions are: to which assets should the USD stablecoins be swapped and when should these swaps happen?

Swap Timeline

Transmuter could live in parallel to the Core module, and the Core Module is routed on 1inch meaning that when people are swapping agEUR to another token, under the hood 1inch can burn the agEUR if it's more efficient to do so. At launch, Transmuter will most likely not be routed by aggregators. To this extent, it might be an option to have both systems living in parallel for the sake of agEUR onchain liquidity.

There has however been very little burns with the Core Module recently. The last burn took place on May 4th. On top of that, the Curve pools with agEUR are currently well balanced, and the agEUR-USDC pool of the protocol is well liquid. All in all, with all htis in mind, it seems that it is not too risky for agEUR liquidity to fully wind down the Core module for agEUR, without waiting for Transmuter to be routed on 1inch. And this vote therefore proposes to wind down the Core module for agEUR AND launch the Transmuter in one go.

Asset Assessment

Now comes the question of which stablecoins the protocol should try to acquire.

Transmuter works by tracking its exposures with respect to the assets it has in the backing. And so the proportions of asset to acquire should mirror the exposures the protocol is going to target.

This is a matter of risk, liquidity and opportunities provided by each asset.

Basically the protocol should try to make the most of its revenues to earn a yield while also being liquid enough for all users to come.

On top of this, note that the cost for redemption operations are in Transmuter linear with the amount of assets supported, so while the protocol could support a wide range of different assets, it does not make sense to start adding an asset if there is no plan to scale up a significant chunk of the reserves in it, as it'll increase the gas cost with no increased diversification.

We have designed an asset allocation framework with the potential and reputable assets to consider. This is a first model that can be refined to include more granular data.

The two assets standing out from the analysis here and that we propose to include into agEUR backing mechanism are:

• EUROC: Circle Euro stablecoin to which the protocol is already exposed
• bC3M is a tokenized version by Backed of the C3M ETF by Amundi. This ETF aims at investing in short term European government bonds (32% France, 23% Germany, 20% Italy, 12% Spain, 6% Netherlands, 6% Belgium, 1% Portugal). It is in many ways equivalent the € equivalent of the bIB01 ETF which is accepted as a collateral in Angle Borrowing module on mainnet. The yield to maturity of this ETF is 3.55% meaning the protocol could technically earn 3.55% a year from holding this tokenized representation of the asset. There is of course an exposure to the interest rate risk (like if interest rates increase the value of the underlying bonds held by the ETF should decrease and so are the shares of the ETF), but given how low the maturity of the shares are, this risk remains relatively small for the protocol. The main risk becoming the Backed risk which is assessed in the risk allocation framework above.

Proposal

With all this analysis in mind, we're proposing to:

1. Recover the user assets from the Core module (8,594,036 USDC, 2,677,307 DAI, 1,739,945 FRAX) and pause burning on this module for all collateral assets
2. Swap the DAI and FRAX into USDC and use half of the USDC into bC3M and the other half into EUROC
3. Launch the Transmuter as a minting module for agEUR with EUROC and bC3M as collateral assets, and with parameters in the idea of this spreadsheet. In particular, at launch, update the accounting of Transmuter to make it consider that it has minted an amount of stablecoins exactly equal to what was minted through the Core module
4. Transfer to the Transmuter 4.5m€ worth of bC3M and 9.5m€ worth of EUROC and leave the rest on the protocol governance multisig for the time being
5. Unpause the Transmuter to start supporting again agEUR mints through a form of price stability module.

The idea here with bC3M is to enable the protocol to generate a revenue on its reserves, and later to structurally distribute it to protocol stakeholders (that is agEUR holders) through a savings contract. While in this setup less than 1/3rd of the assets of the protocol would be related to yield bearing assets, in the future, it'd be worth discussing ways to increase the system's exposure to C3M so its return on assets grows bigger.

Implementation

For EUROC swaps, we suggest using a similar implementation to what was used after the Euler hack when the protocol had to liquidate some of its ETH holdings, that is to say to perform OTC deals through Airswap with market makers among Keyrock, Woorton, Wintermute, ... For bC3M acquisition, as the DAO cannot KYC itself with Backed, we propose to buy by filling pre-existing limit orders on CoWSwap with market makers only as well. For the sake of efficiency, proposed implementation here is to rely on the guardian multisig to transiently perform such swaps: that is to say transfer the recovered funds from the Core module to the guardian multisig, before having it send over the acquired bC3M and EUROC to the Transmuter or the governor multisig once the swaps are done.

And of course, while vote is open now, if successful, it should only be implemented when the audit report for Transmuter has been made available.

Whitelists

The bC3M product must only be sold directly to qualified investors and licensed resellers. On top of that the tokens must not be made available to U.S Persons or for the account or benefit of U.S. Persons, just like the tokens must not be marketed, offered, or solicited in the U.S. or in any other prohibited jurisdiction.

To this extent, having bC3M in the backing of agEUR means that the protocol needs a way to control the users who can burn or redeem agEUR for bC3M. We propose to rely on third parties controlling the whitelist for this, so that only people with a Backed KYC can participate in these operations. In parallel of an Angle governance-controlled whitelist, we propose relying on Keyring systems (which integrate with Backed list of KYC addresses) to manage the authorized. This will enable anyone to onboard itself through Backed or through another KYC provider supported by Keyring (like ComplyCube) to later burn agEUR.

With this, it is important to note that if bC3M is accepted as a Transmuter collateral for the protocol, front end interfaces should not make this product available to U.S. Persons.

Oracles

The oracle question is key in the Transmuter system. While EUROC and C3M are very close to getting the Chainlink requirements, we suggest using in the meantime:

• for EUROC: a Pyth feed and a target price of 1€.
• bC3M: the C3M oracle provided by Redstone to be compared with the C3M oracle maintained by Backed. Note that Transmuter always reads into two oracles, and so the failure of one oracle does not affect the whole system.

Risks

This proposal does not come without risks as it exposes Angle to a new set of smart contracts, to new assets, to new oracles (Redstone, Pyth and Backed).

While the Transmuter has been audited, the Immunefi bug bounty of the protocol will be extended if deployed to support these assets.

As for the assets, the asset allocation framework developed is meant to optimize the risk on reward / ratio for all supported assets. Note that having tokenized securities in the backing means that the protocol could face some liquidity risks, in the sense that in case of distress the protocol could end up overexposed to the less liquid Backed asset. The advantage with Transmuter with respect to other traditional systems is that agEUR holders can still get a claim on the reserves of the protocol, and then deal on their own with the less liquid assets: in short for every agEUR you have, provided that you're whitelisted, you may redeem 1€ worth of reserves (rather than waiting for the protocol to liquidate at a loss its yield bearing instruments).

As for the oracles, Transmuter always looks into 2 oracles, and so the failure of one oracle does not open the system to exploit. At the worst, it can pause the whole system.

Next steps

This vote aims in backing agEUR with high quality Euro denominated assets, and to uniquely position the protocol to start offering a risk-free savings contract to all its stakeholders. Intent is that together with Transmuter, not only would agEUR be the safest and most resilient stablecoin of the market effectively diversifying between a range of different assets, it'd also be the most attractive one as it'd be able to structurally pay the market's risk free yield to its stakeholders.

Transmuter alone will not be sufficient to bootstrap demand for agEUR and kickstart flywheel effects:

• it needs to be well governed, and this is the reason why we have started this discussion on the roadmap for a fully onchain governance for Angle.
• offering a savings contract and handling exposures to the different assets of the system means properly assessing and monitoring risks so the protocol does not overpay and manages its liquidity risk. Improved analytics for the protocol and automated toolings are currently in the works so everyone can track the protocol's exposures to its different underlyings and make up its own mind on the risks of the Angle system. And I guess, all the Angle community should double down its efforts on that so Angle can start emerging as one of the most trusted protocols out there.

Voting options

1. For, swap & launch Transmuter
2. Against, do nothing