Foundations of Fiat-Denominated Loans Collateralized by Cryptocurrencies

In this work, we focus on a mixed setting where parties interact both with a classical fiat currency such as USD and a cryptocurrency such as Bitcoin. This differs from the standard approach taken in DeFi, where the protocols are designed primarily for interactions among digital assets only. To the best of our knowledge, such a setting was not formally studied before in the context of cryptoloans. Nevertheless, there is a clear motivation for design of secure protocols supporting such loans.

On the borrower’s side, a known speculation strategy is the so-called “hodling,” i.e., the strategy to buy some amount of cryptocurrency and wait an extremely long time for it to rise in value. Such speculators, known as hodlers, might wish to use their cryptocurrency as collateral for a loan (e.g., instead of a classical mortgage) as long as they keep exclusive access to their crypto asset during the lifetime of the loan (except in the case of their default). An estimated 10M Bitcoins were in dormant wallets in 2020 [1]. On the lender’s side, many classical providers of liquidity would be attracted by the interest from an algorithmically governed loan, which is extremely low-risk since the collateral can be liquidated fast in the case of default or undercollateralization due to a drop in value of the cryptocurrency.

However, a purely DeFi solution where the loan is denominated in a cryptocurrency might not be acceptable to either party. The most natural solution in this context is to use a stablecoin, a decentralised analogue of a fiat currency pegged to its value [8], as an intermediary asset for enabling the interface between fiat currency and cryptocurrency. The first drawback is that stablecoins are built using complex protocols which might deter conservative lenders and borrowers such as a classical bank. Additionally, both the lender and borrower (in case the borrower seeks liquidity and not just an instrument for speculation) then have to go through the additional process of exchanging fiat currency for a stablecoin (and vice versa) which induces extra inefficiencies to the process in terms of fees and delays.

We present three protocols. The first protocol illustrates the basic considerations in a simplified setting where we assume exchange rates between the underlying cryptocurrency and fiat are fixed. Next, we give two protocols in a realistic setting where exchange rates can fluctuate. All our protocols involve a rational borrower, a rational lender, and an honest arbiter. Naturally, the separation of roles in our protocols implies that our protocols have add more value in the more challenging peer-to-peer setting rather than the simpler bank-style setting.

The idea behind the basic protocol ${\mathrm{\Pi }}_1$ is to lock the collateral for the entire duration of the loan into a smart contract. The contract redistributes the collateral at the end of the loan in a way such that both borrower and lender end up with slightly less than what they put into the protocol, with the remaining portion being held by the arbiter. The arbiter gives back the respective portions to the parties that behave honestly, and keeps the corresponding portion in case of misbehaviour.

However, in the setting where exchange rates fluctuate thoughout the loan term, the value of the collateral relative to the principal can change drastically and collateral can become vastly overcollateralised or undercollateralised. This can lead to misbehaviour on the side of both parties. For instance, the borrower might run away with the loan if the collateral becomes undercollateralised. Our first protocol ${\mathrm{\Pi }}_2$ in this setting allows the smart contract to make calls to an external price oracle at specified times during the loan term to get the price of the cryptocurrency. The collateral is then redistributed according to this price to ensure that the lender should always get back an amount worth the value of the principal when the lender behaves honestly. When the value of the collateral reaches or drops below the principal, the contract immediately liquidates the collateral and gives the entire collateral to the lender.

Our second protocol ${\mathrm{\Pi }}_3$ in this setting simplifies the contract significantly by removing oracle calls, and also giving both parties the additional freedom to decide when and at what price to terminate or liquidate the protocol. The collateral is immediately released upon termination or liquidation. This comes with the cost of both parties needing to remain online throughout the loan duration, and the way the collateral is redistributed upon termination or liquidation of the protocol is fixed and has to be specified at the beginning of the protocol.

We show in Theorem 1 and Theorem 7 that behaving honestly as specified by the protocol is a subgame perfect equilibrium in the games induced by ${\mathrm{\Pi }}_1$ and ${\mathrm{\Pi }}_2$. We also show in the full version of our work [17] that, as long as the price of the cryptocurrency does not rise too much, the honest strategy profile of behaving according to the protocol is a subgame perfect equilibrium in the game induced by ${\mathrm{\Pi }}_3$.

The study of the interplay between CeFi and DeFi goes back to Danezis and Meiklejohn [9]. Qin et al. [22] conducted an empirical study of major liquidation protocols and their risks in Ethereum. Gudgeon et al. [15] analysed the effect of interest rates on market efficiency for DeFi loan protocols. Qin et al. [23] studied attacks on DeFi using flash loans. Kondratiuk et al. [18] initiated a standardization attempt for cryptoloans using smart contracts on Cardano.

Our work is also related to the works of Avarikioti et al. [6, 5] on using a committee of miners for arbitration in payment channels[10, 11, 3, 21] when two rational parties disagree on the state of the channel. While using a committee or even the blockchain to resolve disputes between the lender and borrower is a possibility, these solutions typically incur a large consensus cost and are less efficient, thus we choose to use the arbiter to resolve disputes.

Here, we define terms related to loans that we use throughout the paper.

Collateral:

The amount provided by the borrower to back up the loan. The collateral is given to the lender in case the borrower defaults on the loan.

Principal:

The loan amount borrowed by the borrower.

Liquidation:

The process of using the collateral for repaying the loan in the case of default or undercollateralization.

Loan to Value Ratio (LTV):

The ratio of the principal to the value of the collateral. The LTV determines the maximum amount that the borrower can borrow depending on the amount of collateral the borrower has. For instance, an LTV of $\frac{1}{2}$ would mean that a borrower with $2x$ amount of collateral can only borrow a maximum of $x$ amount of funds from the lender (assuming a 1:1 exchange rate). In our work, all our protocols assume an initial LTV of $\frac{1}{2}$.

$ϵ$:

A small positive constant parameterising the strength of the penalty that comes with deviating from the specified protocol.

Our protocol ${\mathrm{\Pi }}_1$ consists of $2$ phases: contract creation and loan repayment. In the contract creation phase, the borrower locks the loan collateral into a smart contract and specifies the conditions upon which the contract can be opened. The loan repayment phase occurs at the end of the loan and consists of extracting the collateral from the contract and distributing it to the relevant parties. The details of both phases are as follows:

Contract creation:

• $\mathrm{■}$

  The lender sends $1$M fiat to the arbiter.

• $\mathrm{■}$

  The borrower creates a smart contract and locks the collateral into the contract. The borrower also specifies three important times: $t^{\ast },t_2,t_3$ with $t_3>t_2>t^{\ast }+12$ and $t^{\ast }$ being the start of the loan term. The smart contract only accepts inputs from the arbiter from time $t^{\ast }+12$ to $t_2$, inputs from the lender from time $t_2$ to $t_3$, and inputs from the borrower from time $t_3$ to $t^{\ast }+13$ (more details in the loan repayment phase below).

• $\mathrm{■}$

  The collateral is locked until $1$ out of the following conditions are fulfilled:

  1. 1.

     At the end of the loan term the lender inputs a signed opening to the contract. The contract then pays the full collateral to the borrower.

  2. 2.

     At the end of the loan term, the borrower inputs a signed opening to the contract. The contract then pays out Bitcoins worth $(1-ϵ)$M fiat to the borrower, Bitcoins worth $(1-ϵ)$M fiat to the lender, and Bitcoins worth $2ϵ$M fiat to the arbiter.

  3. 3.

     At one month after the maturity date (i.e. $t^{\ast }+13$), the contract automatically sends the full collateral to the lender.
• $\mathrm{■}$

  The arbiter verifies the contract. If the contract does not pass the verification step, the arbiter refunds the principal to the lender. If the borrower does not create the contract before a timeout period $t_1$, the arbiter refunds the principal to the lender. Otherwise, the arbiter sends the principal to the borrower at time $t^{\ast }$.

Loan repayment:

• $\mathrm{■}$

  From time $t^{\ast }+12$ to $t_2$, the smart contract waits for the borrower to send $1$M to the arbiter. If the borrower repays the debt within this time interval, the arbiter immediately notifies the lender.

• $\mathrm{■}$

  The lender waits until the arbiter notifies the lender that they have the full principal and inputs a signed opening to the contract at any point between $t_2$ and $t_3$ to send the collateral to the borrower. After the contract is opened by the lender within the specified time interval, the arbiter sends $1$M to the lender.

• $\mathrm{■}$

  From time $t^{\ast }+12$ to $t^{\ast }+13$, two mutually exclusive events can happen:

  • –

    (Honest borrower, dishonest lender.) The borrower sent the full principal but the lender does not open the contract between $t_2$ and $t_3$, so the borrower triggers an opening of the contract after $t_3$ and before $t^{\ast }+13$ months. In this case, the arbiter gives the principal to the borrower and $ϵ$M out of the $2ϵ$M worth of Bitcoins paid to the arbiter from the contract to the borrower. The borrower ends up with $2$M ($(1-ϵ)$M from the contract, $1$M from the loan, and $ϵ$M from the arbiter). The lender ends up with $(1-ϵ$)M from the contract, and the arbiter ends up with $ϵ$M.

  • –

    (Dishonest borrower, honest lender.) The borrower did not send the full principal and triggers an opening of the contract after $t_3$. Suppose the partial principal sent to the arbiter by the borrower is $x$M where . The arbiter keeps the partial principal of $x$M and sends $ϵ$M from their share of the contract to the lender. The lender ends up with $1$M ($(1-ϵ)$M from the contract and $ϵ$M from the arbiter), the arbiter with $(x+ϵ)$M, and the borrower with $(1-x+1-ϵ)$M M.

• $\mathrm{■}$

  If the contract has not been opened by $1$ month after the loan maturity date (time $t^{\ast }+13$), the contract automatically pays out the locked collateral to the lender.

Here, we describe our first protocol ${\mathrm{\Pi }}_2$, which contains a few small modifications of the basic protocol to ensure the incentives of the borrower and lender are still aligned even though the exchange rates can fluctuate. The first modification allows the entire collateral to be given to the lender the moment the price of BTC falls below a certain value. This compensates the lender in the case where the price of BTC drops and ensures that the value of the collateral is always at least as large as the loan. Consequently, the borrower and lender are still incentivised to follow the protocol. The second modification allows the contract to make queries to an external price oracle to get the price of BTC and redistribute the collateral according to the updated price. Our protocol ${\mathrm{\Pi }}_2$ aims to maintain the invariant that the value of the collateral at any queried point in time should not exceed $2$M when converted to fiat – any excess collateral is transferred to a temporary account for use when the value of the collateral drops below $2$M or given back to the borrower in the case where ${\mathrm{\Pi }}_2$ terminates with the excess collateral. This ensures that the incentives of the lender and borrower are the same as the basic protocol ${\mathrm{\Pi }}_1$ in the case where BTC prices go up. To ensure that the lender and borrower cannot easily collude with the external oracle and manipulate the exchange rate to their advantage, we recommend using a decentralised oracle connected to a blockchain.

The previous protocol suffers from three drawbacks. First, even though borrower termination fast-tracks to repayment, parties may wait up to a month to recover funds, incurring hidden costs such as opportunity costs. Second, reliance on an external price oracle complicates deployment on some cryptocurrencies. Third, the arbiter controls the cryptocurrencies, a necessity to keep both parties incentivised to follow the protocol’s honest strategy. If collateral prices rise sharply, both lender and borrower have incentives to deviate: the lender may refuse to open the contract, and the borrower may refuse to repay.

Thus, we design ${\mathrm{\Pi }}_3$ to address all three shortcomings of ${\mathrm{\Pi }}_2$. ${\mathrm{\Pi }}_3$ redefines borrower termination as immediate, instantly releasing and splitting collateral between lender and borrower. Both borrower termination and lender liquidation are allowed at any time. This increases flexibility over fund immediacy at the cost of remaining online throughout the loan term. ${\mathrm{\Pi }}_3$ eliminates the oracle by requiring lender and borrower to remain online to decide on liquidation. The arbiter judges whether termination or liquidation is reasonable or unreasonable and compensates the parties accordingly. ${\mathrm{\Pi }}_3$ limits BTC under arbiter control to at most $2ϵ$. This relaxes the previous “honest strategy,” since the lender may refuse to open the contract. Nevertheless, we show that with minimal arbiter control, we can still obtain meaningful stable strategies.