Announcing Pinto: Leviathan-Free Low-Volatility Money
“Nothing in the world is as soft and yielding as water. Yet for dissolving the hard and inflexible, nothing can surpass it.
The soft overcomes the hard; the gentle overcomes the rigid. Everyone knows that is true, but few can put it into practice.
Therefore the Master remains serene in the midst of sorrow. Evil cannot enter his heart. Because he has given up helping, he is people’s greatest help.
True words seem paradoxical.”
— Lao-tzu, Tao te Ching, Verse 78
An Existential Threat
“Whatever can happen, will happen.”
— Murphy’s Law, 20th Century Proverb
Quality money empowers individuals and communities. By leveraging the power of a censorship resistant, verifiable, permissionless, globally distributed computer network, BTC has found clear product market fit as the best store of value. However, there has yet to be a comparable success with respect to media of exchange.
Stablecoins promise to serve as reliable media of exchange in the crypto economy. However, leading stablecoins suffer from a centralization flaw that not only limits their utility, but creates an existential threat to the integrity of the computer networks they are used on.
Because (1) the centralized operators of leading stablecoins (e.g., Circle, Tether) dictate the canonical state of networks where the majority of network-native value depends on said stablecoin (i.e., every existing censorship resistant compute network but Bitcoin) and (2) companies are subject to governments, the canonical state is ultimately subject to governments rather than stakers or miners.
This reality is a far cry from the goal to create truly censorship resistant, verifiable, permissionless, globally distributed computer networks.
Nonetheless, the demand for quality media of exchange is so great that stablecoins are the crypto asset class that has found foremost product market fit after BTC. While stablecoins make up only 6% of the crypto market cap, 77% of the aggregate crypto trading volume is at least one side stablecoin. The need for a quality censorship resistant, verifiable and permissionless network-native medium of exchange has never been greater.
Between a Rock and a Hard Place
“Revolution rock, it is a brand new rock”
―The Clash, London Calling, 1979
To date, all attempts to create a censorship resistant network-native medium of exchange with competitive carrying costs to centralized stablecoins have failed due to either (1) excessive carrying costs due to collateral requirements or (2) excessive volatility due to insufficient collateral requirements.
On the one hand, locking up collateral to mint stablecoins realizes incredible opportunity cost which ultimately manifests in high carrying costs. Censorship resistant collateralized stablecoins are unable to compete with centralized stablecoins on carrying costs because there isn’t sufficient quality censorship resistant collateral. Excessive carrying costs for censorship resistant stablecoins compared with centralized stablecoins lead to wider spreads and higher borrowing costs*.*
On the other hand, the highly reflexive nature of under-collateralized stablecoins has resulted in fatal excess volatility in almost every implementation to date. Most attempts at under-collateralized stablecoins have experienced a bank run and collapse to ~$0 within months.
There have been 2 notable exceptions, neither of which attempts to maintain a hard peg (i.e., perfect stability) or uses any collateral.
Ampleforth is a rebasing stablecoin that has successfully achieved consistent peg crosses over the course of 5+ years. However, the rebasing nature of the system limits the utility of the currency as money. When below peg, tokens are removed from people’s wallets in order to repeg the stablecoin. While this technique has demonstrated efficacy at regularly crossing the stablecoin price over its peg, it creates a horrible user experience for savers and borrowers alike.
Beanstalk is a credit based stablecoin protocol that similarly issues dividends to depositors when above peg. But, instead of forcibly rebasing when below peg, Beanstalk incentivizes individual holders to voluntarily burn their stablecoins (i.e., Beans) for an IOU for more Beans under certain conditions in the future (i.e., Pods). While Beanstalk has experienced extended periods below peg, it is the only other non-collateralized stablecoin model that hasn’t crashed to $0 due to a bank run.
A Seed of Hope
“So you’re telling me there’s a chance”
— Lloyd Christmas, Dumb and Dumber, 1994
Credit is king.
Beyond creating a better experience for stablecoin users, credit presents the only viable option for network-native value with anti-reflexive properties and the potential for infinite scale. The more debt a borrower repays, the more creditworthy the borrower is viewed. Increased creditworthiness enables borrowing more at lower interest rates.
An autonomous agent native to censorship resistant, verifiable, permissionless, globally distributed computer networks and optimized to create credit has the potential to issue a censorship resistant network-native medium of exchange with competitive volatility and carrying costs to centralized stablecoins.
In the 3 weeks prior to its hack in April 2022, Beanstalk began the first ever deleveraging of an autonomous agent. Even after being hacked for every dollar, Beanstalk’s credit history enabled it to borrow an additional $17m of value to recapitalize and restart itself.
Nobody knows what would have happened had Beanstalk not been hacked, but given the efficacy demonstrated by the model both before and after being hacked, there are very good reasons to find out.
A Data Problem
“Beanstalk is likely being Replanted with a ridiculously high Pod Rate in the worst a) macro environment in at least a decade, b) crypto market in years, c) stablecoin market of all time, and d) endogenous circumstances possible, as a result of the attack. This presents an incredible opportunity for the model to demonstrate its efficacy. We will all know very quickly if it is working or not.”
— Publius, Thoughts Before the Barn Raise, June 5, 2022
While the plan to restart Beanstalk in incredibly adverse conditions did lead to high quality data, it did not ultimately indicate whether the model is “working” or not, nor did it best set Beanstalk up for success.
The Stalk System of the Silo has kept Beanstalk alive over extended periods below peg by preventing and limiting the extent of bank runs. Clearly, the deficiencies in Beanstalk lie in (1) its inability to attract creditors in its credit facility (i.e., the Field) and (2) incentivize Converts within the Silo to repeg the Bean price.
The dutch action mechanism theoretically improved the efficacy of the Field to near perfection, but has not been used despite being live for 18 months. The exploit and ensuing terms under which Beanstalk restarted have left it in so much debt it cannot attract creditors at any rate.
Similarly, the Seed Gauge System overhauled the peg maintenance mechanism by creating tools for Beanstalk to autonomously optimize some of the parameters in the Silo to incentivize particular Converts, yet it has barely been used in its 6 month life. Beanstalk cannot currently incentivize Converts because of certain improperly fixed parameters and a lack of an active user base.
Without users, the theoretical efficacy of the model doesn’t matter. Without data, it is impossible to gauge its practical efficacy and improve it accordingly.
Pinto
“I got a fever, and the only prescription is more cowbell.”
— Will Ferrell as Gene Frenkle, SNL, April 8, 2000
Today, we are proud to announce the launch of the first ever Beanstalk fork — Pinto: censorship resistant low volatility money.
Pinto implements all the latest features of Beanstalk, Basin, Multi-Flow Pump, Pipeline and Tractor (i.e., the entire Beanstalk ecosystem code base) and restructures the original Beanstalk debt to give the Beanstalk model a clean shot at success and failure.
We expect Pinto to generate a significant amount of new data that can be used to further refine the Beanstalk model and ultimately create a censorship resistant medium of exchange that outcompetes centralized stablecoins.
Why low volatility?
“Everything flows, nothing stands still.”
— Heraclitus
The term stablecoin gives people the wrong idea. Whereas sufficiently collateralized stablecoins are in fact stable coins, they are not money. Money has endogenous value. Money is volatile in nature. Our goal is to create money with endogenous value because of its censorship resistance, capital efficiency and low volatility.
Beanstalk was never intended to create perfect stability. The stablecoin trilemma clearly states that censorship resistance and capital efficiency (i.e., low carrying costs) come at the cost of ideal price stability. However, there is certainly some sufficiently low level of volatility below which a censorship resistant money with competitive carrying costs would compete with centralized stablecoins.
Stablecoin out. Low volatility money in.
Why Fork?
Two gunslingers walked out in the street // And one said, “I don’t want to fight no more” //
And the other gunslinger thought about it // And he said, “Yeah, what are we fighting for?”
— Tom Petty, Into the Great Wide Open, 1991
While censorship resistant low volatility money is likely to be a winner take most asset class (i.e., just like censorship resistant store of value, a la BTC), at such an early stage in the development of the asset class, multiple competing versions can be symbiotic.
Beanstalk clearly could benefit from a debt restructure. Doing so requires either (A) proposing a debt restructure to the DAO that would force the restructure on everyone, including those that did not vote for it, or (B) deploying a fork that restructures the debt without imposing the restructure on anyone.
Forking enables every debt holder in the old version of Beanstalk to retain the entirety of their position in Beanstalk and receive an airdrop for additional debt from Pinto.
A true win win, Pinto demonstrates the potential for a healthy and sustainable model for forking the Beanstalk codebase by enabling low friction and permissionless development while honoring prior versions’ debts and without imposing on any participant.
Securing Pinto
“Fool me once, shame on you; fool me twice, shame on me.”
— 17th Century Proverb
There are two and three separate and independent systems within and without Pinto, respectively, that have been or will be put in place to minimize the risk of another hack.
No Governance
Using a fork-based model for upgrades instead of on-chain governance removes the need to vote on upgrading the system. By removing the ability to upgrade Pinto via vote, there is no longer the potential for governance vulnerabilities like the one that was exploited to hack Beanstalk.
While in its early days Pinto will remain upgradable by a multisig under explicit conditions, the intention is to remove upgradability altogether as soon as is prudent.
Beanstalk 3: Secure Beanstalk
This year, the entire Beanstalk codebase was restructured with a prioritization on loss prevention and minimization over gas efficiency. In the past, a significant amount of complexity was added to the code in the interest of lowering farmers’ gas costs to make Beanstalk more accessible. However, this complexity also introduced a significant amount of bugs and, with them, costs via bug bounty programs.
Pinto uses the Secure Beanstalk implementation to minimize the risk of losing funds due to bugs and is deployed on the Base L2 network to minimize fees despite the less gas efficient implementation. Because it is on an optimistic rollup that uses Ethereum mainnet as the base sequencer, Beanstalk gets the low latency and costs of an L2 with the censorship resistance and security of the L1.
Bug Bounty
Beanstalk has had an Immunefi bug bounty covering the Secure Beanstalk codebase with a maximum bounty of 1.1M Beans live for almost 2 months. Although no guarantee, the lack of substantive bug reports since Secure Beanstalk was deployed is very a strong indicator the codebase is secure.
The vast majority of the Pinto codebase is identical to Beanstalk, so Pinto effectively inherits security from the Beanstalk Immunefi bug bounty program. Additionally, a Pinto bug bounty program will be created once the Pinto supply passes 10M for the first time, with one-off mints to fund the program according to the schedule outlined here.
Audit Competitions
In our experience, public audit competitions are among the highest efficacy ways to discover bugs because of the number of eyes looking at the code simultaneously.
Beanstalk, and thus Pinto, have been heavily audited via various audit competitions. Additionally, we intend to run Pinto-specific audit competitions of the entire codebase once there are enough funds in the development budget.
Real-Time Monitoring and Defense
A critical component of a robust security stack is a real-time production monitoring and defense solution. Once there are sufficient funds in the development budget, we intend to setup Hypernative support similar to Beanstalk’s (or use another competitive solution) for Pinto.
No Governance
“The only freedom which deserves the name is that of pursuing our own good in our own way, so long as we do not attempt to deprive others of theirs or impede their efforts to obtain it.”
— J. S. Mill, On Liberty, 1859
Pinto does not have governance. While Pinto is the first Beanstalk fork, additional development must be completed in order to create a generalized fork system that replaces the need for contract upgrades. In the meantime, limited upgrades to Pinto may be implemented by the Pinto Contract Multisig (PCM), the owner of the Pinto contract.
The PCM will only make changes to Pinto that:
Fix bugs or security vulnerabilities (including dewhitelisting an LP token for which the non-Pinto asset has collapsed);
Change parameters until 2 weeks after the first time the Pinto supply reaches 500M (e.g., Target Seasons to Catch Up, Pod Rate and L2SR thresholds, Deposit Whitelist, optimal LP BDV distribution, etc.);
Mint Pinto to fund a bug bounty program according to the schedule outlined here;
Implement a Fork Migration System.
What About Beanstalk Holders?
“Nemo Resideo [No one left behind]”
— Ancient Roman Military Principle
Pinto will be upgraded to issue assets to holders of Beanstalk debt based on a snapshot of the state of Beanstalk at the time of Pinto deployment. After a supply of 1B Pinto, 3% of mints will go to paying back old Beanstalk debt holders as follows:
Fertilizer holders will receive ERC-1155 tokens similar to the existing Fertilizer tokens;
Unripe Bean holders will receive an asset representing a recapitalized Unripe asset (Ripening Pinto) at a rate of 1 Ripening Pinto per Unripe Bean;
Unripe LP holders will receive an amount of Ripening Pinto based on the Bean Denominated Value of Unripe LP if Beanstalk were fully recapitalized at the time of snapshot; and
Pod holders will receive Pods in a separate Beanstalk Pod Line.
(1) Active Fertilizer holders, (2) Ripening Pinto holders and (3) Pod holders in this separate Beanstalk Pod Line each receive 1/3 of Pinto mints allocated to paying back old Beanstalk holders (i.e., 1% of mints).
If there is no Active Fertilizer, Ripening Pinto holders and Beanstalk Pod holders each receive 1/2 of Pinto mints allocated to paying back old Beanstalk holders (i.e., 1.5% of mints).
If there are neither Active Fertilizer nor Ripening Pinto, Beanstalk Pod holders receive 100% of the Pinto mints allocated to paying back old Beanstalk holders (i.e., 3% of mints).
If there is no longer any outstanding Active Fertilizer, Ripening Pinto nor Beanstalk Pods, the 3% of mints allocated to honoring Beanstalk debt will be distributed to Pinto participants under its normal model.
Pinto is not allocating any mints for Beans or liquid LP tokens held by Beanstalk the time of the snapshot.
A Healthy Environment to Experiment
“I know it when I see it.”
— Chief Justice Potter Stewart on Non-substantive Trolling, 1964
The Pinto experiment will benefit tremendously from constructive public discourse.
As a group participating in an attempt to create censorship resistant money, the Pinto community should value free expression. At the same time, the Beanstalk community learned the hard way that blindly upholding censorship resistance at all costs, particularly in a pseudonymous environment, has major drawbacks. Angry community members who refuse to engage substantively have pushed out the genuinely interested and curious.
In order to create an environment where people actually want to express themselves, the Pinto Discord will not tolerate non-substantive trolling.
Men Wanted for Hazardous Journey
“Small wages, bitter cold, long months of complete darkness, constant danger, safe return doubtful. Honour and recognition in case of success.”
— Sir Earnest Shackleton, Advertisement for the Endurance Expedition, 1913
Thus begins the next chapter in the Beanstalk experiment. A frightening journey lies ahead.
But a future without censorship resistant low volatility money is even scarier. - 20 Nov 2024
Last updated