RGP-14: Partner with Ante and stake Ribbon’s Ante Tests

Proposals
1

RGP-14: Partner with Ante and stake Ribbon’s Ante Tests

Authors

Ante Finance

Summary

Ante Finance proposes a partnership with Ribbon to stake two Ante Tests for Ribbon. Ante Tests are on-chain commitments (staked with crypto) that check key, live assumptions like protocol solvency, multisig balances, and more hold true. Ante uses Ante Test stakes to calculate Decentralized Trust Scores, and is building a decentralized Schelling Point for protocol trust.

Staking Ribbon’s Ante Tests helps Ribbon signal alignment with users, earn yield from fees, and give users and integrations a trustless way to claim programmatic payouts if staked commitments fail.

Proposal

Ante proposes the Ribbon treasury stake 100 ETH behind two Ante Tests (50 ETH each) covering Ribbon “doomsday” scenarios (TVL plunge and multisig $RBN dump). Ante devs worked with the Ribbon team and community to study Ribbon V2’s codebase and write two suitable tests.

The proposed stake is ~0.15% of treasury assets at time of writing, and would put Ribbon in the highest trust tier (S) currently available on Ante. The stake can earn yield from challenger fees if the tests pass and are at risk if they fail (learn more). Funds can be unstaked (after 24hr cooldown) by the multisig as long as a verified Ante Test failure has not occurred on-chain.

Ante has written a Ribbon code tour and Ante Test walkthrough to educate Ribbon & Ante communities on the architecture, risks, and design of Ribbon’s Ante Tests.

How does this benefit Ribbon?

  1. Show confidence and alignment to new users - Staking Ante Tests signals “skin in the game.” Staking implies that Ribbon believes key, on-chain “bad” scenarios won’t occur.
  2. Give users optional downside protection - Ante opens a trustless way to receive payouts in specific failures by challenging; in return, Ribbon’s stake can earn challenger fees.
  3. Attract more dev eyeballs to codebase - Find future bugs with more eyes. A critical bug in Wild Credit was found right after a community dev reviewed a new Ante Test for Wild.
  4. Improve future composability - Ante Tests can serve as an oracle for protocol health, and are designed with future integrations in mind, boosting composability.
  5. Advance Ribbon’s brand - Compound Ribbon’s legitimacy by adopting an innovative crypto-native testing standard. This puts Ribbon on the vanguard of quantifying smart contract risk premia autonomously, which may eventually attract new entrants.
  6. Shape Decentralized Trust Ratings - a 100E stake puts Ribbon in the top “trust rating” tier on AnteV0.5. As an early protocol partner, Ribbon can influence how trust ratings apply to structured products and evolve for a broader audience, which may accelerate DeFi growth.

Voting

Voting will open on Snapshot in three days. Each voter will be able to vote either “Yes, partner with Ante and stake 100E” or “No, don’t do this”.

About Ante

Ante hosts on-chain, incentivized tests (“Ante Tests”) that check key commitments like protocol solvency, multisig balances, and more in real-time. Ante creates a trustless mechanism for stakers of those commitments to pay challengers automatically when corresponding Ante Tests fail. Ante Tests simplify programmatic “catastrophe detection” because an Ante Test failing can indicate a “doomsday” scenario: trusted or implicit assumptions about a protocol are broken. Ante uses staking activity to impute decentralized trust scores, and is developing a decentralized trust rating system to quantify DeFi risk premia, thereby promoting safer DeFi protocol interoperability and growing the broader ecosystem.

Ante leverages the open nature of decentralized finance by empowering any dev to write, deploy, and stake (or challenge) new Ante Tests for any protocol. In fact, FrankieIsLost, an anon dev now at Paradigm, independently wrote one of the first Ribbon Ante Tests last year. Ante aims to grow a security-aware developer community and to encourage open source developers worldwide to cover all of Web3 with Ante Tests.

FAQ

Q: What does the staked ETH do?

The ETH backs specific catastrophic cases defined by the Ante Tests. While the tests hold, stakers can earn yield from challenger funds. If the test fails, the fund pays out to challengers. The stake will also be used as an input for Ante’s trust ratings calculations. 100 ETH staked will put Ribbon into the current top trust tier on Ante.

Q: How is this different from insurance/audits/bug bounties/formal verification?

These all provide different but complementary benefits for protocols and users. Ante hopes these (and Ante Tests) become standard practices for responsible projects. Specifically:

  • Compared to insurance, Ante is programmatic, perpetual, doesn’t require trusted parties, and covers anything an Ante Test dev defines (e.g. known types of economic attack like Rari Fuse Pool #23 are sometimes excluded by insurance). Also, any dev can write & deploy an Ante Test, which means coverage is highly versatile and not gated by any one team.
  • Audits inspect a codebase at a specific point in time; Ante provides ongoing real-time verification of a protocol’s fundamental invariants, even through upgrades
  • Compared to bug bounties, Ante does not require trusted intermediaries for payouts
  • Formal verification mathematically verifies how code executes against a specification, but does not make guarantees about market conditions, economic quality of input assets, or quasi-trusted setups

Q: How does Ante compare to X protocol?

Ante aims to build a Schelling Point for trust so it is easy for developers to access and measure trust of any protocol on-chain. Ante believes growing a global developer community is a valuable way forward to increase peace of mind for all of decentralized finance.

However, there are many interesting projects that want to help make users safer (some mentioned below). So what makes Ante unique?

  • vs. vote-settled cover/mutuals: Mutuals can require buy-in for protection or gate admission, and vote-settled solutions may have settlement lag. Ante is self-serve, non-custodial, and programmatically settled;
  • vs. things built on top of vote-settled products: Some projects build upon existing vote-settled protocols, but can lack rapid, programmatic resolution;
  • vs. programmatic protection markets: Some projects offer structured protection market products for investors. Ante hosts community-written “building blocks” (Ante Tests) for future builders to compose for any purpose;
  • vs. off-chain security analysis or protection: some projects directly offer exploit protection themselves; Ante imputes decentralized trust scores from on-chain data to increase ecosystem composability and real-time transparency for builders.

Q: Is the 100 ETH lost to Ribbon?

No. Staked ETH can be withdrawn 24 hours after initiating an “unlock” as long as the Ante Test continues to pass.

Q: Can the Ante team rug staked funds?

No, it is impossible for the Ante team to rug staked capital. Ante v0.5.2 captures no fees and is non-custodial and non-upgradable, with no admin keys. To the team’s knowledge, the only way to lose funds staked behind an Ante Test is if the test fails and funds are allocated to challengers.

Q: Is Ante audited?

Ante is not currently externally audited, but has secured an audit by Trail of Bits and has conducted an internal audit. Ante has also been live on Mainnet for 6 months, hosting 20+ on-chain Ante Tests. Ante’s multisig has staked their own Ante Tests as a signal of confidence in their own code, and they have a bug bounty program through Immunefi. Ante’s core smart contracts can be found here and everyone is encouraged to review them.

Q: What does this get $RBN holders?

Partnering with Ante gets $RBN holders a safer, more composable Ribbon, as well as exposure to a technical developer community to potentially help build out the Ribbon ecosystem. This also strengthens Ribbon’s moat against potential competitors.

Q: How does this promote interoperability?

Ante’s on-chain trust scores, imputed by Ante Pools, can be used by other developers to build on top of Ribbon anywhere you could use a new “oracle” for a specific, state-machine defined “protocol failure” or “guarantee violation.”

Some examples:

  • A new project that wants to create a meta-vault that allocates funds between spot ETH and Ribbon ETH can now check real-time trust scores as a quantifiable measure of risk;
  • If Ribbon incorporates riskier option pools in the future, Ante Tests could be written for those pools and provide automated payouts in specific failure cases to Ribbon vaults;

Q: What are the Ante decentralized trust ratings?

Ante’s decentralized trust ratings system aims to provide a quantitative measure of risk that can be used to bring DeFi to a wider audience. The system will take in objective on-chain data like funds staked, stake duration, and test quality as well as input from the Ante community, launch partners, and wider crypto community.

Q: Where can I read more about Ante?

Read more about the protocol design and mechanisms at docs.ante.finance.

Extended Q&A (Discord)

Q: Are Ribbon user funds at risk by using Ante?

No. Ribbon users may, however, choose to voluntarily stake or challenge the Ribbon Ante Tests independently of this proposal. Challengers pay a small fee every block, credited to Stakers.

Any staker’s funds are at risk if the corresponding Ante Test they’re backing has a verified on-chain failure, and cannot be reclaimed. (Upon a verified on-chain failure, those funds become claimable by challengers in the Ante Pool who had been challenging for at least 12 blocks before the verified failure occurred. The 12 blocks is to prevent the likelihood of a non-challenger frontrunning to claim the payout.)

Q: Does Ante work multi-chain ?

The Ante Protocol is chain agnostic by design (practically, the time to “finality” is different on different chains or L2s), but currently v0.5.2 is only on Ethereum mainnet. Ante is working on supporting multiple deployments so that trustless Ante Tests can be deployed anywhere they are needed.

Q: What kind of developer community does Ante have?

The Ante developer community is a home for security-minded technical people who believe in a safer DeFi ecosystem, whether they are new to Solidity or established builders. Various early community members that independently wrote Ante Tests also helped found/build projects like Zesty and Gem. Want to try it out yourself? https://docs.ante.finance

Q: What is the goal of Ante?

Ante aims to build a Schelling point for decentralized trust — a simple home for measuring the trust of any objective, blockchain-settleable guarantee. Ante believes Ante Tests can become digital public goods that create positive externalities for all by aggregating information around market trust.

Ante sees that Ribbon is not only a top user of key DeFi infrastructure (Gnosis auctions, Opyn options) and a blue-chip protocol, but also has an engaged, active, global community, and shares values with Ante such as accountability and responsible shipping. Ante believes having Ribbon as an early protocol launch partner is an exciting step toward building the above future, and may be an early step to ushering in an explosion of responsible DeFi interop, broader access and appeal, and greater collective peace of mind.

Q: Is there an $ANTE token?

There is currently no token for Ante.

Q: Where do I learn more about Ante?

Come read some technical posts https://medium.com/ante-finance.

3 Likes
2

Very well written proposal @ken, thank you for the write up!
I’m in favor of doing a partnership with Ante and staking some of the treasury in on-chain tests. It is a very good way to indeed signal confidence in our own infrastructure.

However,
I’ve reviewed the 2 deployed tests and they are pretty rudimentary and don’t really cover a lot. I think we can and must do better.
Main concerns:

  1. The TVL test does less then the title ‘RibbonV2 doesn’t lose 90% of its TVL’ would suggest.
    It only checks 2 out of the current 6 V2 vaults (ETH call and BTC call vault) and asserts independently that the balance does not go under 90% of the balance at the time of the Ante test creation.

  2. The RBN mutlisig dump test case only checks whether the balance remains above 1million $RBN. That multisig currently holds 141million $RBN, which means the test case only covers a very narrow edge case where almost all $RBN is transferred out of the multisig.

I suggest we take some time to design better Ante tests that are more suitable to our goal. The current Ante tests are just not sufficient to show confidence, allow for reasonable downside protection or be used as any on-chain health oracle.
They were however successful in attracting more dev eyeballs to the codebase as I would be interested in contributing to new improved Ante tests for Ribbon. :smile:

The tests should cover at least all V2 vaults and optimally have a dynamic % threshold instead of the arbitrary test deployment balance. Even better if we can find a way to include future v2 vaults.
The RBN multisig test should cover a wider base of doom scenarios, this is something we should discuss and see what would make sense to offer as guarantees.

-0xRob

4 Likes
3

Thanks for the thoughtful feedback, @0xRob!

We talk a little about the tradeoffs around the ability to update the list of tested vaults in our writeup for the Pendle Ante Tests. TLDR: if people are staking or challenging an Ante Test based on a specific set of conditions/vaults being checked, is it in the spirit of the test to be able to change those? Also more potential attack vectors to consider. Many valid takes, though, and in the end there’s room for both types of tests.

A dynamic % based threshold is certainly possible to implement using some kind of checkpointing function to calculate a TWA for TVL at the expense of complexity (a similar method was used in the Comptroller test to calculate the rate of $COMP issuance).

At the end of the day, our approach when writing this initial set of tests was to keep things simple and focus on a small set of doomsday scenarios. Additional tests can always be written for additional coverage (and staked funds potentially transferred to any new tests)! Would love to chat more with you about test design though!

1 Like
4

We can definitely add another Ante Test that covers 3 of the other current V2 Theta Vaults (ETH put, STETH call, AAVE call). The APE call vault looks like it might require a little more modification to the base Ante Test but currently accounts for only 0.3% of current TVL in V2 vaults.

5

@abitwhaleish Thanks for the answer!
First, I can definitely see the reasons why these initial tests are kept as simple as possible, and they are super effective at providing good starting examples.
My main point is that we should consider writing better tests ourselves, and actually fully use Ante to its potential instead of staking some treasury assets in the examples that are given to us for free.

Not sure this is the best place to start chatting about design. But will do it anyway. :smile:
For the TVL test I see 2 main possibilities:

  1. 1 test with a dynamic vault set. This of course has the drawbacks you mentioned and might prove technically challenging if different vaults need different assertion logic.
  2. multiple tests, one for each vault. This can be done fairly simple and reserves the option from Ribbon to always add new vaults when mature enough or remove vaults when they are sunset.

Considering these 2 options I would argue that removing a test and transferring the stake to a new test is fundamentally the same as updating the vault set of an existing ‘all-vaults’ test. Under the assumption that the permission to take these actions is with the same entity. If we then consider both options to be quite equal, the first has the benefit of a lot more capital efficiency for the stakes. Option 2 is the better option if you want to provide different amounts of cover capital to different vaults.

With respect to the % calculation for the TVL, it helps that funds are only able to be withdrawn once a week on Friday. We can allow one checkpoint per round to combat checkpoint spamming and work with a 3 round median to combat any flashloan exploits. We can make use of the vaultState to achieve this.

I suggest we don’t talk more design over here and wait on some more community and team feedback around the proposal?
#development in discord is probably a better suited place for the technical design discussion.

-0xRob

1 Like
6

Hey!

Thank you so much for the proposal. It is very well written. I love the idea of Ante and allowing people to run tests to verify that protocols are putting their money where their mouth is!

A little about me! I’d consider myself a power user of DeFi but don’t have the deepest technical understanding. So what I am going to write is coming from that perspective.

I am having a hard time understanding the value of Ribbon adding 100ETH to Ante?

Show confidence and alignment to new users

Honestly, I don’t have a ton of confidence in Ante! I don’t intend this to be demeaning in any way but,
Ante currently has 26 ETH staked from protocols on the platform. 20 of which are from Ante finance, and 6 are from Pendle.

  • Have any other protocols outside of Pendle committed funds?

  • Do you ask each protocol for 0.15% of their treasury as a stake?

  • What’s the point of giving Ante 100ETH if Ribbon can unstake it immediately after? (Plus 24 hour cooldown period)

That leads me to my next point as a layman…

I also have a hard time understanding the value of “Tests.”

In this proposal, you write:

Ante opens a trustless way to receive payouts in specific failures by challenging; in return, Ribbon’s stake can earn challenger fees.

Why would anyone challenge "Ribbon Multisig RBN balance remains >=1m" when they can easily verify it themselves onchain?

Also, as a potential Ante user, I would stake ETH, it’s such an easy win, but since I don’t believe anyone is going to challenge the test, I’ll deploy that capital in a more efficient way on a different platform.

Maybe I am missing something here and am totally off the mark but I believe Ante needs to achieve greater PMF and brand awareness before this has any meaningful impact on customer acquisition.

I do love the blogs and breakdown of codes, that is really helpful! However, I will be voting no on this proposal.

2 Likes
7

Moving some conversation from the Discord to here for visibility.

From the Ante team:

Also, any dev can write & deploy an Ante Test, which means coverage is highly versatile and not gated by any one team.

Is there a way for a dev to deploy a test guaranteed to fail as a way to game the system by creating another address to claim challenger rewards?

The proposed stake is ~0.15% of treasury assets at time of writing, and would put Ribbon in the highest trust tier (S) currently available on Ante.

Why does the amount staked imply more trust? i.e. shouldn’t it be relative to the project’s treasury assets? For example, a much larger project may not necessarily be more trustworthy just because they can stake a large amount.

8

Good questions @stefanmendoza!

Is there a way for a dev to deploy a test guaranteed to fail as a way to game the system by creating another address to claim challenger rewards?

  • The stakeable pool that “wraps” the test is only deployable via Ante Pool Factory and does some checks like making sure the test doesn’t immediately fail when deploying - this makes it harder to create “scam” tests
  • The simplicity of Ante Tests makes it easier for someone who is even mildly technical to understand what is going on in the test
  • We’re experimenting with ways to indicate test “quality” (e.g. the badges that indicate whether a test was written by a protocol or reviewed by Ante) so that the community is able to filter out these sorts of malicious/irrelevant tests

In the end, we think more eyes on code via open source community will be better for the robustness of the system vs. centralized teams

Why does the amount staked imply more trust? i.e. shouldn’t it be relative to the project’s treasury assets? For example, a much larger project may not necessarily be more trustworthy just because they can stake a large amount.

In a very real sense, a larger amount staked is more skin in the game. We definitely see the decentralized trust score continuing to evolve over time and incorporating additional on-chain information though (which could potentially include factors like % of project treasury as you suggested or being able to commit a stake for a period of time for increased trust weight).

9

Thanks everyone for the thoughtful feedback and discussion! We’ll work on more tests with the Ribbon team and community. We hope to start our partnership with Ribbon by staking these initial tests in the proposal.