OIP-4 Disallow mints from off peg stablecoin #1000
Description
If a stablecoin is enough off peg, we should not allow mints from it until it returns to peg.
Background and Rationale
During a stablecoin depegging, a primary safety objective of OUSD is to avoid OUSD shifting its asset allocation over to the depegged stablecoin. Our current defense is to reduce the amount of OUSD minted to a user per deposited stablecoin by using the oracle price for the stablecoin they are minting with.
This requires the oracle to be accurate with the current and near future prices. Oracle prices lag actual prices. In a depegging situation, the dollar amount of this lag increases, as the prices both drop faster and faster.
"How did you go bankrupt?", wrote Ernest Hemingway, "Gradually, then suddenly." And so it is with depeggings.
Here is a chart of a 24 hour period around the last USDT depeg. Chainlink's oracle specification for these oracles is that an update will happen if the price changes by 0.25 of cent. At first, this guarantee held, but as the depeg accelerated, the jumps between oracle updates increased. One update was almost an entire cent's worth (400% of the target oracle-to-price deviation).
Had USDT's price continued to fall, we almost certainly would have multi-cent differences between oracle prices and actual prices.
Solution
A simple solution is to just disable minting from coins that have lost their peg beyond a certain point. If it's broken, why would we want it?
This prevents us from getting the coin at all when things start going really south. This also rules out the time periods when the oracles are most likely to be out of spec.
Threshold
Where should we set the threshold?
Here's a chart of the last 1 year of chainlink oracle results.
If we ignore USDT, and only look at below peg prices:
DAI went to 0.9975 for one oracle update, but otherwise has been above that. I would propose that we set the threshold at to 0.9980. This would have blocked a few hours of DAI minting over the last year, but otherwise would have had no negatives effects. This is also just above the current redeem fee threshold.
Implementation
VaultCore mint() should revert if the price is below the threshold.
VaultAdmin priceUSDMint() should return 0 if the price is below the threshold. This will make the UI put the vault at the bottom of the list of good ways to get OUSD with that coin.
We should check the dapp with a zero price from priceUSDMint, and at a minimum verify that a zero does not cause a breaking divide by zero. I don't know that we need to add further code beyond this.