OpenZeppelin reviewed the following collateral assets provided by the WOOF team for use in the WBTC market:
Our review focused on assessing the risks associated with using these assets as collateral in the protocol. The analysis included factors such as the asset’s capitalization, market liquidity, implemented custom functionalities (e.g., pause mechanisms and fees), prior audits, and the potential for price manipulation.
Additionally, WOOF requested OpenZeppelin’s recommendations for appropriate price feeds for these assets as Chainlink data feeds may not support all the assets under consideration.
Assets Review
uniBTC
Deployed on April 13, 2024, uniBTC is a restaking token that allows users to deposit WBTC, which can then be staked across various protocols on the Babylon network. As a result, its value depends on the behavior and security of Babylon. The uniBTC codebase could be better documented— for example, the vault’s documentation incorrectly stated that unstaking was disabled and would take 30 days to process, when in reality, the delay is 8 days, and unstaking any amount is possible.
Since our evaluation focused solely on the collateral asset, we initially relied on Bedrock’s documentation regarding the vault’s functionality. However, inconsistencies in the documentation led to confusion, prompting a further review.
After re-examining both the documentation and the unstaking contract, we confirmed the actual delay is 8 days, not 30, and unstaking is fully functional.
Status: Adding this asset as collateral would not present new risks beyond currently manageable and acceptable.
swBTC
Deployed 12 August 2024, Swell Restake BTC (“swBTC”) tokens represent ERC-4626 shares in a strategy that invests user-deposited WBTC in other restaking protocols like EigenLayer, Symbiotic, or Karak.
Key Risks and Trust Assumptions:
- Small track record and market cap: Deployed in Aug 2024, the total supply of swBTC today is roughly 300 tokens representing a market cap of not even $30MM. It is held by less than 300 addresses on the mainnet with at least 67% of the supply held by a Layer Zero endpoint (i.e., bridged away), thereby further concentrating the mainnet supply.
- Strategy is actively managed: Different roles within the system actively manage the strategy underlying the tokens. However, there is no prospectus to explain the management philosophy and goals.
Status: Not recommended at present due to the reasons given above.
LBTC
Deployed 17 May 2024, LBTC is presented as the Universal Liquid Bitcoin Standard, offering yield-bearing, cross-chain capabilities and being backed 1:1 by BTC. It enables BTC holders to engage in various DeFi activities, including staking, borrowing, and trading. Withdrawals require a 9-day process to unstake and unbond BTC.
Status: Adding this asset as collateral would not present new risks beyond currently manageable and acceptable.
solvBTC
Deployed 27 Jun 2024, solvBTC is part of the Bitcoin Reserve initiative, designed to unlock the potential of Bitcoin through a transparent Proof-of-Reserve model and seamless liquidity market integration. It serves as a gateway to BTCFi and aims to attract traditional funds to the crypto space.
Status: Adding this asset as collateral would not present new risks beyond currently manageable and acceptable.
eBTC
Deployed on August 14, 2024, eBTC is a dual-yielding, Bitcoin-backed token designed to meet the needs of restaking collateral. It supports staking and restaking services through partnerships with Lombard and Babylon. The asset interacts with a hook contract that enforces blocklists and lock periods.
The blocklist used in the transfer hook is currently empty, and the lock period is set to zero. Additionally, these parameters can only be updated by privileged users, and the lock would only apply to accounts that have deposited tokens into the hook contract. However, we assume that Compound will not perform these deposits and, therefore, will never be subject to the lock period.
Furthermore, there is a risk that the hook contract could be updated to another contract, potentially causing a disruption in transfers if any additional lock or restriction were introduced in the beforeTransfer() hook. However, the only entity currently capable of modifying the hook contract is a Timelock contract, which currently has a 1-day delay. Therefore, we assume that the Timelock contract is reliable, and any changes to the hook contract will be monitored to prevent potential future issues within the Compound protocol.
Status: Adding this asset as collateral would not present new risks beyond currently manageable and acceptable.
FBTC
Deployed 30 May 2024, FBTC is a 1:1 Bitcoin-backed, cross-chain liquid Bitcoin designed for staking, borrowing, and yield farming in DeFi ecosystems. Its minting and burning is managed by a custodian, introducing centralized elements.
Key Concerns:
- Low market capitalization and limited holders.
- Centralization risk, with approximately 50% of tokens held by two EOAs.
- Blacklist functionality poses a potential threat if Compound is ever blacklisted.
Status: Not recommended for use as collateral due to the above risks.
tBTC
Deployed 17 August 2021, tBTC is a decentralized Bitcoin wrapper backed 1:1 by Bitcoin. It uses threshold cryptography to eliminate the need for a centralized custodian, making it trust-minimized and redeemable for Bitcoin.
Status: Adding this asset as collateral would not present new risks beyond currently manageable and acceptable.
pumpBTC
Deployed 30 June 2024, PumpBTC provides a liquid restaking solution for BTC through Babylon. It enables yield generation and facilitates seamless staking integration. Minting and burning are managed by a multisig wallet.
Key Risks:
- Minting and burning are unrestricted, relying on trusted multisig accounts.
Status: Adding this asset as collateral would not present new risks beyond currently manageable and acceptable.
Price Feeds
For price feeds, the following recommendations are made:
-
If the baseTokenPriceFeed in the market uses a constantPriceFeed for BTC prices, the Chainlink feeds provided by WOOF would suffice:
-
If a price feed for USD is required, we recommend creating a custom price feed using the logic of the WBTCPriceFeed. This would include an additional function to calculate the asset price in USD based on the BTC exchange rate provided by Chainlink.