How Spark Dodged the KelpDAO Hack While the Rest of DeFi Got Hit

Transcript

I would say so like right now we are probably in like a a peak sort of danger zone, but I I feel like we're going to move actually to a better place ultimately because AI, although it can be used on the offensive, it can also be used on the defensive. >> Everyone, welcome to Unchained. Your no-hype resource for all things crypto. I'm your host, [music] Laura Shin. Before we dive into today's interview, we'll take a quick word from the sponsors who make the show possible. >> [music] >> This episode is brought to you by 1-in Aqua, the shared liquidity layer from 1-in. Back multiple liquidity positions with one wallet balance and keep your tokens in your wallet until a swap fills. See how it works at 1-in.com/aqua.

Today's guest is Sam MacPherson, [music] co-founder and CEO of Spark. Welcome, Sam. >> Yeah, thanks for having me. >> Heads-up, everyone. I'm on vacation, so by the time you hear this interview, it will be a few weeks after this interview was actually recorded in mid-July. Just in case something major blows up in DeFi between now and then and you're wondering why Sam and I don't discuss it. So, Sam, Sky is the oldest stablecoin. It's the true OG and it started as MakerDAO and your DeFi protocol, Spark, is built on top of it. Tell us what Spark does and explain its relationship to the Sky protocol.

>> Yeah, sure. Um so, Sky, formally MakerDAO, is uh originally launched in 2019 with the Dai stablecoin and there was sort of two restructurings that happened around the 2022 period. Um first was the rebrand from Maker to Sky and then the stablecoin became from Dai to USDS. And then the second piece was a restructuring of the governance so that um the first iteration of the DAOs were not really working that well at scale managing large amounts of money. So, uh it was decided to restructure into this sub DAO model. So, now the way things sit is that Sky functions um more like a central bank and wholesale uh

liquidity issuer. So, the sub DAOs, Spark being one of these, is functions more as a commercial bank that is able to draw on the liquidity reserves of of Sky and then deploy it into commercial lending activities. And so, primarily this is a mix between real-world assets uh to get the base yield usually from treasury bills and then uh crypto over-collateralized lending, primarily like Bitcoin and ETH uh backed loans. >> Okay. And so, what are the main products that uh Spark has?

>> As a Spark started out with uh um an internal lending market. Um so, this is a on-chain money market uh similar to like, you know, Compound, Aave, um these types of things. And uh this is like the crypto-backed loan section of the balance sheet. It is uh focused on lending against um Bitcoin, ETH, um and these types of loans have been around. It it is similar to the CDP model that Maker originally had. Since then, Spark has expanded to cover a lot of the different uh verticals. So, uh we have launched uh what is called Spark Savings, which is um a vault product that will allocate uh it's on sits on top of USDC and USDT. And this provides

um a yield on top of these uh stable coins. And so, what Spark functions as is a allocator across the space. So, um you you as a depositor into Spark Savings, Spark will allocate uh the capital on your behalf and allocate to opportunities between DeFi, CeFi, um and TradFi with with RWAs um to optimize the risk-adjusted yield into that product. So, currently we're offering uh 3.6% on USDC and uh the USDT rate is 3. or sorry 2.75%.

So, other products like we've recently also expanded into institutional lending. We do custodial Bitcoin back lending through Anchorage. So, this is institutions who want to get financing against their Bitcoin on their balance sheet usually. And so, they will they will borrow from us and this is this is facilitated by Anchorage, the qualified custodian. Um and another thing that we've recently got into is Spark Prime. This is a CD5 Prime brokerage. We're still in the preliminary phase of scaling this up, but the the idea here is that we do lending and hedge funds primarily are able to margin their positions across DeFi as well as CeFi and now actually

there is support for TradFi venues, which is very interesting especially with the uptick in um uh more like traditional stocks becoming the big hype cycle right now. So, this can provide hedge funds with coverage in TradFi venues connecting it to modern DeFi venues like Hyperliquid to provide liquidity. >> Okay, so you kind of we're getting a lot of buzz in the wake of the KELP DAO hack. You know, basically what it when you look at the TVL of Spark uh dot fi on DeFi llama, it's very clear that you know, something happened around

mid-April. And basically, you know, Spark ended up kind of being a big beneficiary of that hack. The TVL in ETH is up about 50% from that time today and even in early July it was up about 80% from that point. And you know, this is a a moment where Spark kind of I would say differentiated itself from the rest of DeFi because obviously the rest of DeFi took a big hit. So, why do you think Spark was an exception? >> Yeah, so first off they uh these types of events are unfortunate um for the space as a whole, and so uh like uh we're not like wanting these events to happen even though it is relatively speaking uh good for Spark. Um but yeah,

so what what we uh tend to do is we take a a much more conservative position compared to the wider market. So, uh we did not engage with uh looping um in the same sort of way that some of the other markets were doing. Um additionally, we've had uh rate limits on all of our markets uh since shortly after we launched in 2023. Spark Lend um has uh So, one of the big deterrents for these types of hacks is that basically when um I believe the actor is assumed to be North Korea, um they're looking for ways to exit into decentralized assets. That's usually Ether, Bitcoin. And so, they will take a route that is uh easiest to get through.

So, you kind of need the asset issuer to um make a mistake with uh you know, the way the layer zero configuration was with with KelpDAO. You need and then you needed a venue to get to to ETH. And so, Aave was uh the main venue for this. So, Spark Lend has uh fairly tight rate limits. So, this like even if there was some sort of uh incident with one of the assets that are on the that are available as collateral, uh there's just not that much capital that can be extracted through Spark Lend because as a regular user, the most are okay with just waiting a bit and like, you know, take some time to take out a loan if it's legitimate activity. The ones who need to go through right away, uh usually there's something wrong there.

So, we we designed the market from the ground up to have these sort of safety controls. Other features that we have, we run uh a triple-redundant Oracle. So, even if one of the major providers, so we run it between Chainlink, Redstone, and Chronicle. And so, if one of the Oracle providers prints a bad price, we're actually have liveness even through this type of event. So, yeah, these are just a number of features that we've been like we're just very risk-averse in this space, and so we've been taking this line.

And sometimes it's been a little bit, you know, to the to the deficit of like business growth and revenue opportunities. But this is a new space, and I think we're entering it's a little bit more of a dangerous time with all the AI stuff going on, but they we know how to do best practices, and so we just will continue to follow best practices, and I'm I'm quite confident we'll get through this. But the other the other good note is that I I see a lot of change in the space as a whole, like a sort of a maturing of of taking security seriously. These things are all preventable with just even basic security back best practices. So, I'm optimistic this this is a tough tough

period. And I'm actually glad they were able to recapitalize the market there as well. So, I think it's a lesson, and I feel like the space is going to get just get better. >> And why have you made this conservative approach part of Spark's DNA? >> Yeah, um we just have taken this tack throughout like since like Maker launch back in 2019. We have never really been chasing the newest thing. You know, there was stuff in 2021 that was going through the hype cycle.

We largely avoided it. And so, this this practice it during bull markets, there's, you know, the new flavor of of the year, and things, you know, are perceived to be overtaking us, but we found that just compounding these like just take the conservative view and compound the growth slowly over time has been the winning strategy. And so this is why Sky as a whole is over 10 billion in stablecoin deposits and is is the market leader by far in terms of stablecoin deposits in the space.

>> And then what were you doing before you launched Spark? And and got involved in Maker? >> Yeah, so I was I'm a software engineer by trade, so I had previous companies worked in a completely different space. I was working in video games before this. But yeah, then I worked in Maker. >> Oh, okay. Okay. I didn't know if you were going to say like you worked in TradFi and you know >> [laughter] >> No, just been picking it up. >> Okay. Okay. I don't know if you saw Haseeb Qureshi of Dragonfly tweeted that it's a red flag if like a founder doesn't get good at video games or something.

>> Yeah, yeah. I guess I'll pass. >> Um [clears throat] well, so you know, the reason that you were able to kind of make it through the KelpDAO incident unscathed was because before that exploit Spark exited rETH, which was the asset on um on KelpDAO that got manipulated. And the way that happened was that Phoenix Labs, your company, which is kind of like the main centralized entity that uh you know manages Spark SparkFi made a proposal to exit rETH, but that then had to be passed through on-chain governance. So I have

two questions about this. First of all, I'd love to hear kind of like what metrics or protocols or processes Phoenix Labs uses to identify these types of risks in DeFi. >> Yeah, so rETH you're you're correct. It was off-boarded in January of this year as part of a general risk reduction strategy. Um there tends to be during bull markets some assets will be on-boarded. Some prove to be successful revenue generators. And but there's always a a trade-off between your risk surface and the um opportunity that on-boarding an asset can bring.

So even with the rETH on-boarding, even if we didn't off-board it at the time, we never on-boarded it into what is called efficiency mode in the market, which is this high high leverage uh with the ETH looping. Um it was only on-boarded at to borrow stable coins. So the LTVs are much more in like the 60-70% range. So even if we didn't off-board it from the market, uh it's it's quite likely that there would be either no or sort of minimal uh losses that were easily recoverable from uh in the Spark Lend market. But yeah, sort of uh what do what is the decision process for off-boarding?

We look at uh all the assets in the market continually and watching uh liquidity, how much people are using them. And there's just sort of an ongoing calculus, you know, if something's not being used that much we don't want this uh this tail risk present in the market. And so we will will off-board it. And and to be fair, the other lending markets do this as well. Sort of just a sort of a waxing and waning of the bull-bear cycle is pretty natural. But I think the key the key point is that even when these assets are on-boarded, these sort of newer more um untested assets, we keep them in very conservative uh risk policies until we see sort of like uh uh some actual organic adoption demand uh growth and

sort of transitions to be this uh stable. So Spark Lend is a is is intentionally keeping a very minimalistic uh set of collateral since uh there was a bit more before, but now we are down to uh just about uh I believe like five assets. Um there's cBtc, wBtc, e uh Lido staked ETH, and then EtherFi. These are the These are the collateral that are accepted in Spark one. And And this covers most of the organic usage in the market. So, we're we're okay with that.

>> Okay, so in a moment we'll talk a little bit more about the Kelp DAO instant, but first we'll take a quick word from the sponsors who make the show possible. $540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the DeFi TVL, if you're wondering. That's according to Dune research commissioned by 1inch. But, there's a solution. 1inch Aqua is the new shared liquidity platform. It lets LPs back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because the LPs don't have to split their tokens across positions.

They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1inch.com/aqua. Remember that providing liquidity carries risk and fees aren't guaranteed. Back to my conversation with Sam. So, my second question about a Spark exiting rsETH just in time to avoid being hit by the Kelp DAO attack is about that decision-making a process. Because essentially Phoenix Labs identified this risk, but in order to act on it, you had to propose it to the DAO, you had to get it approved.

That's pretty kind of like slow and cumbersome. So, I was curious like how well that works. >> Yeah, so um maybe you're referring to sort of like if there's some sort of emergency, is this process able to like react in time? Is that Is that where you're getting at? >> Yeah, yeah. Like I was wondering when there's something more time-sensitive or is some kind of imminent threat, you know, how how does governance work in that situation? >> For sure. So, there are definitely emergency processes. We did not perceive any emergency with the regularly scheduled off-boarding process. So, the governance process takes on on the order of about a month.

That's to go through several stages, including a risk council, which sort of checks that Phoenix Labs as the proposer is doing things that make sense. So, we have three teams sitting there that are uh doing reviews on on sort of what's being proposed. And then we'll make sure it's all okay. Then it will go out to SPK voters who who vote on it on a snapshot poll. And then it will be sent to Sky. And Sky is basically there to put a final check on it that there is not there's not something odd going on. It's like as long as Spark is sort of following the rules that Sky sets out for doing lending, um it will it will pass it provided it adheres to the risk framework.

So, in the emergency situations, obviously this is way too slow. So, what we do have emergency multisigs that can pause the protocol and just to see what's going on if there is some sort of emergency situation. And um yeah, there will be like if there needs to be some sort of like emergency change done under the protocol, everything is behind time locks, so there is like certain minimum constraints. And this is for safety. Having assets under custody with no time lock is actually uh quite dangerous and makes you a target for North Korea, as as we can see with like the Drift hack, for example.

Um so, having a time lock on the assets in the Sky protocol as a whole is incredibly important. Um but if if we really need to move quickly, there is uh expedited emergency processes that can be done on the order of a day or two to do these sort of administrative changes. But first and foremost, the the multi-sigs provide this uh protection. They're not custody in the assets, but they're like a pause and let's let's take a beat and see what's going on sort of protection. And this is pretty standard across DeFi.

>> Okay, yeah, I'll ask you a little bit more about that governance bit in a while, but I do also now want to ask about another question that came up quite a bit during that whole period cuz it wasn't just the Curve DAO attack, but obviously there was Drift, and then there was this whole slew of other ones that seemed to pop up because of AI becoming uh just so much more capable. You know, we saw that a lot of people began debating what the fair yield was to offer people in DeFi for the risk of putting their assets on chain, and I wonder how you think about that question.

>> Yeah, I think it's a fair question. Um I'm more in the camp I would say that, you know, whatever the market rate is is is what it is, and um people are willing to accept this risk. I do think it's important that we make the risk clear to the depositors, and this is something we've we've been striving for at Spark is having DeFi ratings cuz I think this has been a big missing piece is that people they'll often look at like, you know, what is the highest APY and not really understand deeply what sort of the uh risks that are involved with these with structures. So, first and foremost, we we we want the user to be aware of like what what they're getting into when they deposit.

Now, I mean, why is the why is the yield uh sort of around SOFR, and I guess it's being argued that it, you know, should be much much higher cuz this is a new space, there's lots of risk. Um you know, that might be true, um but like also there is just an excess of uh stablecoin liquidity searching for yield and in the space. So, um this is naturally leads to more compressed rates. And so, uh for us uh Sky has a around 10 billion on its balance sheet and about 40% is deployed or so into various forms of lending. A lot of it sits as idle liquidity and so, the rate will naturally converge to

around SOFR. Um but yeah, I think as as more and more like stablecoin use cases come on chain, I think having this like highly liquid uh base yield is is is is a good thing. People want sort of the the treasury yield at at all times on their cash and so, this product um we're we're aiming for Spark to be sort of like the conservative version of this where you can just park your cash and not have to worry about it. We are in very conservative strategies. As I said, most of it is cash T-bills and um crypto-backed lending which has been quite solid over the years. There's been no major loss event against like ether Bitcoin collateral.

And so, yeah, we we think it's a a fairly uh safe product and like uh but we want everybody to be aware of the the risk cuz it's ultimately the individual's judgment call. >> Yeah, I mean, it's very difficult to make that judgment call when things are shifting so much. You know, so speaking about how things really have changed dramatically for DeFi recently, this whole wave of new hacks that are happening because of the AI threat is obviously causing first of all a lot of people to pull their assets out of DeFi, but it's also resulting in calls in the industry for DeFi DAOs, for founders to think more critically about how to protect their systems. How do you

think about that and how do you think the industry should be approaching that threat? >> Yeah. Um I would say so like right now we are probably in like a a peak sort of danger zone, but I I feel like we're going to move actually to a better place ultimately because AI, although it can be used on the offensive, it can also be used on the defensive and formal verification is really where we're going with all of this. Smart contracts in particular actually have a are are quite uh safe just because of the simplicity of the code. If you look at the major hacks, these are all opsec hacks and opsec like again, we know how to do this correctly. You just have to follow best practices and you can you can

um like you you don't have to worry about the AI is not a like a a magical thing that can just do anything. It does follow the rules of physics and so we do know how to deal with it. Um yeah, where I'm optimistic that we're going though. So already smart contracts are are quite uh robust. We are using um internally at at Phoenix Labs AI for uh we still have human auditors, but like we are uh complementing that with the addition of AI. It is starting to become good enough that it is actually um catching up to some of the the best human auditors that are available.

And yeah, again in including uh formal verification, this is where you have like the highest confidence that the code is is indestructible. So um this is just going to make the industry a lot more robust. So I think what people are seeing is you know, there's hacks and all this like software that's been around for like the longest time. But these code bases are like millions of lines. So it's more just about the surface area. Of course, there's going to be someone that made a mistake in these large code bases and this is where we're seeing a lot of the hacks. It's not so much in the smart contracts where most modern smart contracts are intentionally kept as minimal as possible.

Human reviewers can have high confidence after auditing themselves like that this thing is safe. And now we're going to get this extra piece that just I think cement smart contracts as as one of the safest ways to custody assets. >> Mhm. Okay. Well, I want to circle back to what I asked earlier about when you had to propose that, you know, RS ETH be exited and then had to wait for the full governance process.

You are probably very well aware that we're at this moment in time where DAOs are either disbanding or they're being paused or they're you know, basically just becoming more centralized in various ways or there is wars over attempts to you know, centralize at least certain aspects of their functions. So, I wondered how you think about that because you the operate a centralized entity that is you know, managing these decentralized protocols. You have to deal with this decentralized governance.

Are there any thoughts about changing it in either direction or do you have thoughts on just the trends that we're seeing where some DAOs are just becoming more centralized? >> Yeah, so there there's a few things. On the token versus equity, I believe there needs to be one instrument that value accrues to. So, for us that is the SPK token and then the broader Sky ecosystem has has a fairly good track record of keeping everything under Sky as much as possible.

There are realities of you know, interfacing between like legal and smart contracts that just aren't there yet. So, you have to make do. But to the best of our ability, we do put all of the value into the into the token side. So, Phoenix Labs exists as uh just an operating company that we are not raising money under Phoenix Labs or anything like that. And so without I I think I'm very clear on that. Um I guess the next part of your question uh sort of where the uh the DAO structure I guess. So we we kind of went through this uh like DAO issue like back in '21, '22 uh with Maker was actually like one of the first

DAOs that was like operating a large-scale protocol and really tried to do the DAO thing for real. Like the Maker token voting and then you had there was teams that were operating with it within it. Um but uh just this we do this quickly realize this like flat structure just doesn't work. So uh what what happens and it's not much different than any sort of like governance with humans is you get political factions forming and uh sort of informal alliances, structures. And so you really kind of need a more natural way place for that to sit. And so this is why the sub DAO model was conceived is that the core DAO no longer has to make decisions about what to do.

It will just set the rules and the risk policy that the sub DAOs have to follow. And then the sub DAOs can can splinter off into these into political factions even that then compete in the free market to deliver the most value to the core DAO. Um so we're still in the process of of scaling this up. Will it work? It's not uh proven yet, but uh I having worked in both uh structures before the sub DAO model uh it it's just a much more natural fit for sort of getting the advantages of like more things that look like a little bit more centralized and can move quicker um with the uh emergent uh decentralization of of the structure as

a whole. >> Mhm. Super interesting. Okay, let's also now talk about stablecoins because we're just in this moment where clearly stablecoins are probably going to be the next big onboarding tool in crypto. Less sexy than ICOs or DeFi summer or NFTs or even dats, but they're still going to be probably, I would imagine, the biggest onboarding tool um ultimately for crypto. Um Now, along with all this new stablecoin activity we're seeing like the flourishing of neo banks and there's just so many players that are competing to offer yield on stablecoins. Robinhood chain is now offering 7% in its earn

product with USDG. How do you think about competing in that environment? >> Yeah, so Spark was uh selected as one of the three asset issuers to back uh that 7% vault. So, our product we have there, which is Spark savings USDG, uh provides uh a yield um that can is cross-chain yield that can be used on a new chain like Robinhood. And so, what we're seeing in the market right now is this playbook that uh Coinbase started where it's uh you have the exchange um or even more generally, you have the distribution channel, you connect it to a chain on the back end is being copied. So, we see this with Robinhood now, but we also see it with

Stripe and Tempo. So, we're seeing a repeated pattern where you have distribution, you have the chain, and you have your own stablecoin, and uh each of them is pushing uh their own stablecoin. You see with the announcement of like OUSD even for Coinbase, for example. So, everybody wants to own the uh own the net interest margin that comes from having users using their stablecoin um within the DeFi ecosystem. So, where Spark comes in, this is one of our biggest growth areas is that we um because of our position as a fundamentally on-chain protocol that has 10 billion in deposits, we're holding um between us and hyperliquid uh Sky is is

one of the largest holders of USDC on chain. So, we are able to pair with these newer stablecoins such as USDG, we can provide a yield, but we can also provide uh market making to the to the issuer to basically kick them right up to scale uh very quickly so that people who are in USDG and they need to go to USDC for whatever reason, they don't have to like and this is for large scale. They don't have to go through the banking system, which is slow. They don't have to pay redemption fees. They can go on chain. And this is a a new a new product that we launched recently with Uniswap called the stablecoin FX layer.

And this is a this is I think this is just a very cool uh a use case for DeFi where you really have all the Legos kind of coming together and providing a fundamentally uh superior uh product than what is traditionally done with with market makers and liquidity. Because of because uh Sky is a whole is holding all these stablecoins as idle inventory anyways, it can it doesn't have there is not a cost of capital basically to be doing this sort of market making with all these upstart stablecoins. And it really helps improve sort of uh what you call like the singleness of money where in the traditional banking system, the Fed backs all the US dollar deposits into banks and so bank deposits

they're largely interchangeable. This doesn't exist in in DeFi um and really kind of you see Sky with USDS is emerging as this uh the this sort of connecting this into the singleness of money of of USD stablecoins and Spark providing all the uh infrastructure and technology to do the automated uh allocation market making um within the Sky ecosystem. >> All right. So, let's now turn to the SPK token, which is Spark's token, which is used for both governance and staking.

Despite the fact that Spark is doing quite well now, you know, after these last few months, and especially having you know, made it through that really existential moment for nearly all of DeFi with flying colors, it's at or near its all-time low. And I was wondering how you think about how to bring more value to the SPK SPK token. >> Yeah, I can give you my view more broadly on how I view the way tokens are going in this space. So, I see largely consolidation.

I think there are a few like sort of store of value exceptions and you know, the individual can decide where this is cut off, Bitcoin, ETH, SOL, etc. But the rest of the tokens I think are just going to converge on like a a DCF valuation. And so, at least like the ones that are structured more like equity. But so, what we can what we have with Spark is that the the the the protocol is revenue, it is profitable. We post all of our numbers on data.spark.fi. And we have quarterly financial reports that go out. So, uh people are free to look at this and sort of you know, underwrite the token as best

as they want. But yeah, and and I guess the last piece is is the value accrual. So, excess profits will go to buybacks in in the token. As as this was voted through governance. So, all of these things connected together basically mean that because there is a fundamentally strong business here, I'm not too worried about pricing in the short term. >> Okay. All right. Well, is there anything else coming up for Spark that you would want to talk about?

>> Yeah, I mean just there's been a lot of growth in the protocol. So, the institutional lending we've seen a lot of traction. We launched this at the end of last year. We are up to 250 million in loans issued there and we're on track. We have a robust pipeline that is on track to grow to I think a billion and beyond by the end of the year. Um so, we have this is a new revenue stream. Um our Spark savings USDT this is a this is a new product that we've introduced again at the end of last year. Um already one of the most liquid USDT products on the market and I expect this to become market leader in the in the near future.

Um so, yeah I think like nothing in particular just we're getting a lot of growth overall on all the products. Um yeah. >> Okay, perfect. Well, thank you so much for coming on Unchained. >> Yeah, thanks for [music] having me. >> And thanks to everyone for joining this live stream. We'll catch you next week. Bye now. Nothing you hear on Unchained is investment advice. This show is for informational and entertainment purposes only and my guest and I may hold assets discussed on the show. For more disclosures visit unchainedcrypto.com. >> [music] [music]

[music]