This proposal is a ratification vote for emergency actions taken on Sunday 19th June (UTC) to prevent damage to the Bancor Protocol. The purpose of this vote is for the BancorDAO to determine whether the measures taken will remain in place until a long-term solution is proposed.

Voting Instructions:

A vote FOR will result in the emergency measures being left in place until a long-term solution is presented.

A vote AGAINST will result in the steps taken to protect the protocol being reversed, thus returning the system to its vulnerable state.

Preamble

A culmination of factors resulted in an emergency requiring special intervention to protect users of the Bancor protocol. The changes were applied at approximately 23:00 Sunday 19th June, 2022. Due to the emergency of the situation, these actions were taken without a prior DAO decision. The BancorDAO previously approved a proposal acknowledging that such emergency powers were necessary so that protective actions could be expedited ahead of the formal voting process, subject to a subsequent vote. Such an emergency presented itself, and actions were taken with the understanding that the BancorDAO would subsequently vote on whether the protective measures remained in place.

BNT minting, normally used to cover impermanent loss insurance and deficits in withdrawals, was halted. The reason being, at the time, pending withdrawals in combination with the impermanent loss protection (see below) could have crashed the BNT price to essentially zero, leading to a situation in which the recovery of funds for all liquidity providers would have been in peril.

The route to irreversible damage, regardless of BNT printing rates (including zero inflation), can be illustrated as follows.

1. A non-BNT liquidity provider exits from the protocol during a deficit - such as the case with LINK, ETH and wBTC prior to the emergency intervention.
2. The protocol returns their tokens, including an amount of BNT as per the constant product portfolio evaluation alone, or with further compensation in newly created BNT (it makes little difference).
3. The non-BNT liquidity provider then immediately swaps their BNT for the preferred TKN.
4. Therefore, the relative deficit is further exacerbated; the rate of the deficit increase is faster with IL insurance (i.e. with additional BNT printing), but not contingent on it.
5. Steps 1-4 can be executed by multiple users, and inadvertently affect the situation for others. During a sustained cascade, the downwards price pressure on BNT can move the market farther from equilibrium with each iteration.
6. Taken to its natural conclusion, those leaving in a panic would have trampled those who were slower to react, or simply remained patient.

During the week leading to the emergency decision, the following actions and protocol behavior were observed:

1. A clear pattern in which big withdrawals were made, received BNT compensation and immediately sold the BNT tokens leading to suppression of the BNT price.
2. A growing short position on the token as evidenced by the open interest on FTX and OKEx, that happened to coincide with these withdrawals, suggesting an opportunist was seeking to benefit from the oncoming cascade.

The forecasted effects in a worst case scenario for Bancor liquidity providers, and the protocol itself, were severe enough to warrant an emergency intervention. It should be highlighted that Bancor V3 already has changed behavior to V2.1, and many of its features were not given sufficient time to take effect. However, the lack of resilience to a mass-panic event is underscored, and mechanisms to protect the system from similar market conditions in the future will be required at the smart contract-level.

The Threat Identified

The Bancor Network offers its liquidity providers impermanent loss insurance, in return for a portion of the trading fees earned on the protocol. The impermanent loss insurance mechanism operates by reimbursing apparent losses with the BNT token, while offsetting the inflationary costs realized by destroying BNT, paid with fees collected over time.

A series of events transpired that undermined the time assumption, and challenged the notion of a market at equilibrium. Some of the largest rewards accumulators disposed of the tokens hastily and irresponsibly very recently, into a market that was ill-equipped to handle the selling pressure. This created a fast deficit on the protocol with respect to its impermanent-loss protected evaluations of user positions.

Therefore, at the time of intervention there was a significant relative deficit for major tokens on the Bancor protocol, and a large number of active withdrawals in cooldown. Under these conditions, the impermanent loss insurance mechanism was expected to have produced a runaway effect. The large relative proportion of the TVL of the network departing in a short time period, as projected from the withdrawals in active cooldown, had a very credible and substantial risk of resulting in an unsustainable cycle. As the relative balance of BNT inside the network continues to increase, the number of BNT tokens required to compensate liquidity providers also increases. This feedback loop had an unacceptably high probability of coming to fruition, which would have threatened not only user funds, but the protocol as such.

The Emergency Actions Taken

The protocol’s BNT minting capability with respect to the insurance mechanism was paused, effectively halting the feedback loop and preventing the runaway effects. In addition, the following protective measures were implemented:

1. Deposits were disabled across the protocol. This measure prevents users from participating in liquidity provision while the protocol is in a stressed state.
2. Withdrawals from V2.1 require migration to v3 first. This measure prevents a complex contract upgrade for the V2.1 system that would have required a longer development process, and increased the likelihood of bugs and unpredictable behavior.
3. Withdrawals from v3 remain active, with the following modification: BNT compensation is no longer provided at withdrawal. Therefore users may withdraw their pro-rata share of the vault balance in the TKN denomination of their pool token.

Therefore users may withdraw while the system remains in the paused state without receiving BNT.

These measures were implemented as temporary emergency measures to remain in effect until the DAO votes on this proposal. If this proposal is approved, the protective measures will remain in place for now, to protect the protocol until a longer-term technical solution is proposed and approved by the Bancor DAO. The community is actively investigating solutions to reactivate IL insurance; these solutions will ultimately be proposed to the DAO in order to be implemented.

If this proposal is not approved, the protective measures will be rolled-back at the conclusion of the vote, without any other protective measures in place.

The Ratification Proposal

This proposal asks the BancorDAO to ratify continuing the emergency measures put in place on 19th June, 2022, to protect the protocol from harm until a longer-term solution is proposed. If successful:

1. Deposits will remain disabled across the protocol.
2. Withdrawals from V2.1 will continue to require migration to V3 first.
3. Withdrawals from V3 remain active, without BNT distribution. Withdrawals are pro-rata with respect to the vault balance in the TKN denomination of the pool token.

If unsuccessful:

1. The system will be returned to its previous state.
2. Without new technical measures in place to protect the protool, the dangers outlined above will remain a concern.
3. The system will be vulnerable until an alternative protection mechanism is proposed.