Stability, Elasticity, and Reflexivity: A Deep Dive into Algorithmic Stablecoins

In 2014, two academic papers were published: one by Ferdinando Ametrano called “Hayek Money: The Cryptocurrency Price Stability Solution,” and another by Robert Sams titled “A Note on Cryptocurrency Stabilisation: Seigniorage Shares.”

Drawing on Friedrich Hayek’s critique of the Gold Standard, Ametrano argues that Bitcoin, because of its deflationary nature, cannot adequately perform the unit-of-account function that we require of a currency. Instead, he proposes a rules-based, supply-elastic cryptocurrency that “rebases” (i.e. changes the money supply pro rata across all token holders) according to demand.

In “Seigniorage Shares,” Sams puts forth a similar model with a similar justification, but with an important twist. Instead of a “rebasing” currency, in which changes to the money supply are distributed pro rata across all wallets, Sams’s system consists of two tokens: the supply-elastic currency itself and investment “shares” of the network. Owners of the latter asset, which Sams calls “seigniorage shares,” are the sole receptors of inflationary rewards from positive supply increases and the sole bearers of the debt burden when demand for the currency falls and the network contracts.

Astute crypto observers will recognize that Ametrano’s “Hayek Money” and Sams’s “Seigniorage Shares” are no longer academic abstractions. “Hayek Money” is nearly identical to Ampleforth, a protocol that launched in 2019 and rocketed in July 2020 to a fully-diluted market capitalization of over $1 billion. More recently, Sams’s “Seigniorage Shares” model has, to varying degrees, served as a foundation for Basis, Empty Set Dollar, Basis Cash, and Frax.

The questions before us now are no different from those confronting readers of Ametrano’s and Sams’s papers six years ago: Can an algorithmic stablecoin truly achieve long-term viability? Will algorithmic stablecoins always be subject to extreme expansionary and contractionary cycles? Which vision of an algorithmic stablecoin is more compelling: a simple rebasing model or a multi-token “seigniorage” system (or something else entirely)?

On all of these questions, the jury is still out, and it will likely be some time before a broad consensus emerges one way or another. Nevertheless, this article seeks to explore some of these fundamental issues, both from first principles reasoning and by drawing on some empirical data from recent months.

Stablecoin background

Algorithmic stablecoins are a world unto themselves, but before diving in, it’s worth taking a step back and surveying the broader stablecoin landscape. (Readers who are already well-acquainted with stablecoins might skim or skip this section.)

Overshadowed by Bitcoin’s snowballing institutional adoption, DeFi’s sweltering summer, and Ethereum’s impending network upgrade, stablecoins have been on a tear of late, with a total market cap that has eclipsed $25 billion. This parabolic growth has caught the eye of powerful individuals outside of the cryptoverse, including, most recently, a cadre of U.S. legislators.

USDT remains the dominant stablecoin, but it is far from the only game in town. Broadly speaking, we can divide stablecoins into three categories: collateralized by U.S. Dollars, over-collateralized by multi-asset pools, and algorithmic(1). Our focus in this article is on the last category. However, it is important to note the benefits and drawbacks of stablecoins in the other categories, since understanding these tradeoffs will enable us to sharpen the value proposition of algorithmic stablecoins.

Stablecoins in the first category—namely USDT and USDC, but also exchange-based tokens like BUSD—are centrally managed, backed by, and redeemable one-to-one for, U.S. Dollars. These stablecoins have the advantages of an assured peg and capital efficiency (i.e. no over-collateralization), but their permissioned, centralized nature means that users can be blacklisted and the peg itself is dependent on the trustworthy behavior of the central entity.

The second category, multi-asset collateralized stablecoins, includes MakerDAO’s DAI and Synthetix’s sUSD. Both of these stablecoins are over-collateralized by cryptoassets, and both rely on price oracles to maintain the peg to the U.S. Dollar. Unlike centralized tokens like USDT and USDC, these can be minted permissionlessly, although in DAI’s case, it’s worth noting that permissioned, centralized assets like USDC can be used as collateral. Moreover, the over-collateralized nature of these stablecoins means that they are extremely capital-intensive, and the highly-volatile, hyper-correlated nature of crypto assets have rendered these stablecoins vulnerable to crypto-wide shocks in the past.

All of which brings us to algorithmic stablecoins. An algorithmic stablecoin is a token that adjusts its supply deterministically (i.e. using an algorithm) in order to move the price of the token in the direction of a price target(2). At the most basic level, an algorithmic stablecoin expands its supply when it is above the price target and contracts when it is below.

Unlike the other two types of stablecoins, algorithmic stablecoins are neither redeemable one-to-one for U.S. dollars, nor are they currently backed by crypto-asset collateral(3). Finally, and perhaps most importantly, algorithmic stablecoins are often highly reflexive: demand is driven in large part—and critics might argue, exclusively—by market sentiment and momentum. These demand-side forces are transposed into the token supply, which in turn generates further directional momentum in what can eventually become a violent feedback loop.

Each stablecoin model has its tradeoffs. Investors that care little about centralization will see no problem with USDT and USDC. Others will find that capital inefficient over-collateralization is a worthwhile price to pay for a permissionless, decentralized currency with a hard peg. However, for those who are not satisfied with either of these options, algorithmic stablecoins represent an enticing alternative.

Reflexivity and the paradox of algorithmic stability

For algorithmic stablecoins to be viable in the long term, they must achieve stability. This mandate is particularly difficult for many algorithmic stablecoins to fulfill because of their inherent reflexivity. Algorithmic supply changes are intended to be counter-cyclical; expanding the supply ought to reduce price, and vice versa. In practice, however, supply changes often reflexively amplify directional momentum(4), especially for algorithmic models that do not follow the “seigniorage shares” model by separating the stablecoin token from the value-accruing and debt-financing token(s).

For non-algorithmic stablecoins, network bootstrapping does not involve game-theoretic coordination; each stablecoin is (at least in theory) redeemable for an equal amount of U.S. dollars or other forms of collateral(5). By contrast, successful price stability for algorithmic stablecoins is not at all assured, since it is determined solely by collective market psychology. Haseeb Qureshi puts this point aptly: “these schemes capitalize on a key insight: a stablecoin is, in the end, a Schelling point. If enough people believe that the system will survive, that belief can lead to a virtuous cycle that ensures its survival.”

Indeed, if we think even more carefully about what it would take for an algorithmic stablecoin to achieve long-term stability, we stumble upon an apparent paradox. In order to achieve price stability, an algorithmic stablecoin must expand to a market cap large enough that buy and sell orders do not cause price fluctuations. However, the only way for a purely algorithmic stablecoin to grow to a large enough network size is through speculation and reflexivity, and the problem with highly-reflexive growth is that it is unsustainable, and contraction is often equally reflexive. Hence the paradox: the larger the network value of the stablecoin, the more resilient it will be to large price shocks. Yet only highly-reflexive algorithmic stablecoins—those that are prone to extreme expansionary/contractionary cycles—have the potential to reach large network valuations in the first place.

A similar paradox of reflexivity holds for Bitcoin. In order for it to be viable for increasingly more people and organizations, it must increasingly grow more liquid, stable, and accepted. BItcoin’s growth in these characteristics over the years have allowed it to become accepted by first dark web participants, then wealthy technologists and more recently, traditional financial institutions. At this point, Bitcoin has gained a hardiness from being deep in its reflexive cycle, which is a path that algorithmic stablecoins will also need to follow.

Ampleforth: a simple but flawed algorithmic stablecoin

Let us now turn from abstract theory to the real world of algorithmic stablecoins, beginning with the largest yet simplest protocol in existence today: Ampleforth.

As noted earlier, Ampleforth is nearly identical to Ferdinando Ametrano’s proposed “Hayek Money.” The supply of AMPLs expands and contracts according to a deterministic rule based on the daily time-weighted average price (TWAP) per AMPL: below the price target range (i.e. below $0.96), the supply contracts, and above it (i.e. above $1.06), the supply expands. Crucially, every single wallet “participates” proportionally in each supply change. If Alice holds 1,000 AMPLs before a rebase and the supply expands by 10%, Alice now holds 1,100; if Bob had 1 AMPL, he now holds 1.1 AMPLs.

The network-wide “rebase” is what differentiates Ampleforth’s algorithmic model from the seigniorage shares models adopted by other protocols. While the Ampleforth white paper does not provide a rationale for the single-token rebasing design as opposed to the multi-token approach, there would seem to be two primary justifications for this design decision.

The first is simplicity. Regardless of how well it works in practice, Ampleforth’s single-token model has an elegant simplicity that other algorithmic stablecoins cannot match. Second, Ampleforth’s single-token design purports to be the fairest algorithmic stablecoin model. In stark contrast to fiat monetary policy actions, which disproportionately benefit those individuals “closest” to the monetary source (the “Cantillon Effect”), Ampleforth’s design enables all token holders retain the same network share after each rebase. Ametrano makes this exact point in his 2014 paper, where he details the “severe unfairness” of monetary policy actions and contrasts this with the comparative equity of “Hayek money.”

Such are the putative justifications for the Ampleforth model, which has been copied by other rebasing tokens like BASED and YAM. But before turning to the model’s flaws, we might first look at the year and a half of data on Ampleforth’s performance available to us. Since its inception in mid 2019 (just over 500 days), more than three quarters of Ampleforth’s daily rebases have been positive or negative—meaning, in other words, that the TWAP of AMPL has been outside of the target range at over 75% of the rebases since launch. To be sure, the protocol is still in its fledgling stages, so it would be premature to dismiss it on these grounds alone. Nevertheless, we will soon examine how a modified “seigniorage” stablecoin, Empty Set Dollar, has managed to stay over twice as stable as Ampleforth in its first months of existence.

Ampleforth’s defenders often shrug off the lack of stability; many of them would even take umbrage at the label of “algorithmic stablecoin.” Their argument is that it would be sufficient for Ampleforth to be a portfolio-diversifying “uncorrelated reserve asset.” However, this argument is questionable. Take, for example, a cryptocurrency that rebases every day according to a random number generator. Like Ampleforth, this token would have a “distinct volatility footprint,” but it would certainly not be valuable for that reason alone. Ampleforth’s value proposition rests on its tendency to move toward equilibrium, a quality that would theoretically enable AMPL to become a price-denominating currency.

But would it? Imagine for a moment if Ampleforth were to shed its as-yet “sticky” nature and fully transfer price volatility into supply volatility such that the price per AMPL would be mostly stable. Would this “mature” Ampleforth actually be an ideal candidate for a transactional base money?

Here we come upon the crux of the issue—and the central flaw with Ampleforth’s design. Even if the price of AMPLs were to reach $1, the purchasing power of an individual’s AMPL holdings would change on the path to reaching $1. Back in 2014, Robert Sams articulated this exact problem with respect to Ametrano’s Hayek Money:

Price stability is not only about stabilising the unit-of-account, but also stabilising money’s store-of-value. Hayek money is designed to address the former, not the latter. It merely trades a fixed wallet balance with fluctuating coin price for a fixed coin price with fluctuating wallet balance. The net effect is that the purchasing power of a Hayek Money wallet is just as volatile as a Bitcoin wallet balance.

Ultimately, Ampleforth’s simplicity—its straightforward single-token rebasing model—is a bug, not a feature. The AMPL token is a speculative vehicle, one that rewards holders with inflation when demand is high and forces holders to be debt financiers when demand is low. As such, it is difficult to see how AMPL can both serve this speculative purpose and achieve the stability that is the sine qua non of stablecoins.

Multi-token “seigniorage” alternatives

Robert Sams’s “Seigniorage Shares” vision never became reality, but a new class of algorithmic stablecoin projects has recently emerged that shares many of its core ingredients.

Just over a week old, Basis Cash is an overt attempt to revive Basis, an algorithmic stablecoin project that raised over $100 million in 2018 with much fanfare, but never ended up launching. Like Basis, Basis Cash is a multi-token protocol that consists of three tokens: BAC (the algorithmic stablecoin), Basis Cash Shares (holders of which can claim BAC inflation when the network expands), and Basis Cash Bonds (which can be purchased at a discount when the network is in contraction and can be redeemed for BAC when the network exits its deflationary phase). Basis Cash is still in its early stages of development and has encountered some early development hitches; the protocol has yet to undergo a successful supply change.

However, another Seigniorage Shares-esque protocol, Empty Set Dollar (ESD), has been live since September and has already navigated multiple expansion and contraction cycles. In fact, of ESD’s more than 200 supply “epochs” thus far (one every eight hours), nearly 60% have occurred when the TWAP of ESD is within the $0.95 < x < $1.05 range—meaning that ESD has been more than twice as stable as Ampleforth, albeit over its much shorter life span(6).

At first glance, ESD’s mechanism design appears to be a hybrid between Basis and Ampleforth. Like Basis (and Basis Cash), ESD utilizes bonds (“coupons”) in order to finance protocol debt, which must be purchased by burning ESD (thus contracting supply) and can be redeemed for ESD once the protocol goes into expansion. Unlike Basis, however, ESD does not have a third token that claims inflationary rewards when the network expands after it has paid off its debt (i.e. after coupons have been redeemed). In place of this third token, ESD holders can “bond” (i.e. stake) their ESD in the ESD Decentralized Autonomous Organization (DAO) to receive a pro rata share of each expansion, similar to an Ampleforth rebase(7).

Crucially, unbonding ESD from the DAO requires a “staging” period, in which ESD tokens are temporarily “staged” for 15 epochs (5 days), neither tradable by their owner nor accruing inflationary rewards. ESD’s staging model thus functions similarly to Basis Cash Shares, as both bonding ESD to the DAO and purchasing Basis Cash Shares presuppose risk (liquidity risk for ESD; price risk for BAS) with the potential for future inflationary rewards. Indeed, although ESD uses a two-token model (ESD and coupons) instead of Basis Cash’s three-token model, the net effect of ESD’s staging period is that ESD becomes a de-facto three-token system, with bonded ESD as an analogue to Basis Cash Shares(9).

Comparing single-token and multi-token algorithmic stablecoin models

Clearly, the multi-token design contains many more moving parts than Ampleforth’s single-token rebasing model. Nevertheless, this added complexity is a small price to pay for the potential stability it provides.

Put simply, the upshot of the design that ESD and Basis Cash employ is that the reflexivity inherent in the system is contained, while the “stablecoin” part of the system is (somewhat) insulated from market dynamics(10). Speculators with risk appetite can bootstrap the protocol during contraction in exchange for future benefit from expansion. But users who simply want to own a stablecoin with steady purchasing power can, at least in theory, hold BAC or ESD without buying bonds, coupons, shares, or bonding their tokens to a DAO. This non-rebasing quality has the added benefit of composability with other DeFi primitives. Unlike AMPL, BAC and (non-bonded) ESD can be used as collateral or lent out without having to take into account the complex dynamics of constant, network-wide supply changes(11).

For his part, Ampleforth founder and CEO Evan Kuo has criticized algorithmic stablecoin projects like Basis Cash because they “rely on debt marketplaces (ie: bonds) to regulate supply).” Exhorting people to stay away from these “zombie ideas,” Kuo argues that these algorithmic stablecoins are flawed because, like traditional markets, they “will always rely on lenders of last resort (ie: bailouts).”

However, Kuo’s argument is question-begging, since it assumes, absent any justification, that reliance on debt marketplaces (“bailouts”) is inherently dangerous. In reality, debt-financing is problematic in traditional markets because of moral hazard; business entities that are “too big to fail” can take non-penalized risks by socializing the cost of bailouts. Algorithmic stablecoins like ESD and Basis Cash do not have the same luxury that Fannie Mae and Freddie Mac enjoyed during the 2008 Financial Crisis. For these protocols, there is not a lender of last resort outside of the system to whom bailout costs can be transferred. It is entirely possible for ESD or Basis Cash to enter into a debt spiral, in which debt accumulates without willing financiers, and the protocol collapses(12).

In fact, Ampleforth also requires debt financing in order to avoid a death spiral. The difference is that this debt financing is hidden in plain sight, as it is simply spread across all network participants. Unlike with ESD and Basis Cash, it is impossible to participate in the Ampleforth system without also acting as an investor in the protocol. Holding AMPL while the network is in contraction is akin to bearing the network’s debt (“acting as central bank,” to use Maple Leaf Capital’s phrasing), since AMPL holders lose tokens with each negative supply rebase.

From both first-principles reasoning and empirical data, we can conclude that the multi-token, “Seigniorage Shares”-inspired model has significantly more built-in stability than its single-token rebasing alternative. Indeed, Ferdinando Ametrano has recently updated his “first simplistic implementation” of Hayek Money from 2014, and he now favors a multi-token, seigniorage-based model in light of the problems outlined above.

Nevertheless, even if multi-token algorithmic stablecoins are superior to their single-token peers, there is no guarantee that any of these algorithmic stablecoins will be sustainable in the long run. Indeed, the underlying mechanism design of algorithmic stablecoins precludes any such guarantee, since, as mentioned above, the stability of algorithmic stablecoins is ultimately a reflexive phenomenon grounded in game theoretic coordination. Even for protocols like ESD and Basis Cash that separate out the transactional, stable-purchasing-power token from the value-accrual and debt-financing token(s), the stablecoin token will only remain stable so long as there are investors who are willing to bootstrap the network when demand falls. The moment that there are no longer enough speculators who believe that the network is resilient, the network will no longer be resilient.

Fractional reserve stablecoins: a new era of algorithmic stablecoins?

The speculative nature of purely algorithmic stablecoins is inescapable. Recently, however, a couple of fledgling protocols have emerged that attempt to rein in the reflexivity of algorithmic stablecoins by utilizing partial asset collateralization (“fractional reserves”).

The insight here is simple. Haseeb Qureshi is correct in his observation that, “fundamentally, you could say that the ‘collateral’ backing Seignorage Shares is the shares in the future growth of the system.” Why not then supplement this speculative “collateral” with actual collateral to make the system more robust?

ESD v2 and Frax do exactly that. ESD v2 is still in the research and discussion phases, after which it will eventually be voted on by governance. If implemented, the upgrade would make several substantial changes to the current ESD protocol. Chief among them is the introduction of a “reserve requirement.”

Under the new system, the ESD protocol would target a 20-30% reserve ratio(13), denominated initially in USDC. These reserves are funded in part by the protocol itself, which sells ESD on the open market when ESD is above a certain price target, and also by ESD holders who wish to unbond from the DAO (they must make a deposit to reserves). These USDC reserves are then used to stabilize the protocol during contraction by automatically purchasing ESD until the minimum reserve requirement is reached.

Frax, which is yet to launch, is an even more elegant attempt to create a partially-collateralized algorithmic stablecoin. Like Basis Cash, Frax consists of three tokens: FRAX (stablecoin), Frax Shares (governance and value-accrual token), and Frax Bonds (debt financing token). However, unlike all other algorithmic stablecoins discussed thus far, FRAX can always be minted and redeemed for $1, meaning that arbitragers will play an active role in stabilizing the price of the token.

This minting/redeeming mechanism is at the heart of the Frax network, since it utilizes a dynamic fractional reserve system. To mint one FRAX, a user must deposit some combination of Frax Shares (FXS) and other collateral (USDC or USDT) worth one dollar. The ratio of FXS to other collateral is determined dynamically by demand for FRAX (as demand rises, the proportion of FXS to other collateral increases). Locking up FXS to mint FRAX has deflationary effects on the FXS supply, so as more FXS is required to mint FRAX, demand for FXS will naturally increase as supply drops. Conversely, as Frax’s documentation notes, during contraction, “the protocol recollateralizes the system so that redeemers of FRAX receive more FXS and less collateral from the system. This increases the ratio of collateral in the system as a proportion of FRAX supply, increasing market confidence in FRAX as its backing increases.”

Effectively, dynamic collateralization acts as a stabilizing counter-cyclical mechanism, enabling the Frax protocol to blunt the deleterious effects of extreme reflexivity if needed. But it also allows the protocol to remain open to becoming fully un-collateralized in the future, if the market so chooses. In this sense, Frax’s dynamic collateralization mechanism is “agnostic.”

Neither Frax nor ESD v2 is live, so it remains to be seen whether either will succeed in practice. But in theory at least, these hybrid, fractional reserve protocols are promising attempts to marry reflexivity with stability, while still remaining more capital efficient than over-collateralized alternatives like DAI and sUSD.

Concluding thoughts

Algorithmic stablecoins are fascinating monetary experiments, and their success is anything but assured. Although Charlie Munger’s maxim always rings true—“show me the incentive and I’ll show you the outcome”—these protocols have a game-theoretic complexity that is difficult to fully capture from a priori reasoning alone. Moreover, if past crypto market cycles are any indication, we should be prepared for these dynamics to play themselves out in ways that belie rational expectations.

Nevertheless, it would be foolish to dismiss algorithmic stablecoins at this early stage. It would also be a mistake to forget how high the stakes truly are. In his 1976 tour de force, The Denationalisation of Money, Hayek writes: “I believe we can do much better than gold ever made possible. Governments cannot do better. Free enterprise, i.e. the institutions that would emerge from a process of competition in providing good money, no doubt would.” Though still in their nascency, algorithmic stablecoins might eventually serve as a blueprint for, and stepping stone to, Hayek’s vision of a flourishing market for money.

Disclosure: the author may hold positions in the tokens mentioned in this article.

(1) As we shall see later on, some new stablecoin protocols are breaking down these categories.
(2) Usually, this price target is one dollar. However, algorithmic stablecoins (and multi-asset collateralized stablecoins, in fact) have the flexibility of being able to target not just the value of a certain fiat currency, but also baskets of currencies, baskets of consumer goods (e.g. the Consumer Price Index), and even other cryptocurrencies.
(3) As we shall see later on, however, a new generation of algorithmic stablecoins is experimenting with partial-asset collateralization.
(4) In its most simplistic form, the reflexivity manifests like this: During the expansionary phases, non-holders see that large supply expansions have made token-holders wealthy, so they enter the game and buy, pushing up the price and creating further supply expansion, until the spring uncoils and the same reflexivity leads to a sharp unraveling with the same sort of vicious feedback loop (but in reverse).
(5) Of course, one could argue that either the U.S. Dollars themselves, or the alternative forms of crypto collateral, also require their own kind of “collective belief.”
(6) If one were to object that this is not a fair comparison, we could instead compare Ampleforth’s first 67 days to Empty Set Dollar’s 67 days. During those first 67 days for Ampleforth, there were only four days without a rebase. The other 63 days saw positive or negative supply changes, meaning that the TWAP was out of the price target range for over 94% of the time during that early period. If one is still unsatisfied, we can turn to Ampleforth’s most recent 67 days, which had 59 positive or negative rebases (88%). Any way you slice it, ESD has performed better, at least in terms of price stability.
(7) Two additional important details about ESD’s design: the first is that ESD’s supply expansions are capped at 3%, which helps to blunt extreme reflexivity; Ampleforth, by contrast, had a string of ~20% rebases in July. The second is that ESD also incentivizes Liquidity Providers to provide liquidity to the USDC/ESD pool on Uniswap, and a portion of each supply expansion is disbursed to LPs. LPs also have similar requirements for “un-bonding,” but their “staging” period is significantly shorter.
(8) The staging period for unbonding ESD from the DAO is currently set at five days and will be considerably longer in ESD v2.
(9) It should be noted, however, that the staging requirements for bonding and unbonding ESD from the DAO create added “time risk” and illiquidity for this de facto third token, neither of which exist for Basis Shares.
(10) The way that rebases work in the single-token design makes the network highly-reflexive in practice. But if we take Basis Cash as a comparison, the reflexivity is significantly blunted: when demand for BAC goes up, that demand is reflected in the size of the supply increase during a protocol expansion, similar as it does with Ampleforth. However, Basis Shares holders have a right to claim the newly-created BAC supply, which means that Basis Shares become more valuable as demand for BAC rises. However, an increase in the Basis Shares price does not, on its own, stimulate more demand for BAC (unlike with Ampleforth, where the supply increase reflexively encourages other people to buy in so they can earn “rebase rewards”—on this, see footnote 4). Nonetheless, as Andrew Kang has insightfully pointed out to me, Basis Cash’s use of a “pool 2,” where BAC is used to “farm” Basis Shares, ultimately re-creates the same reflexive effects while the Basis Shares token is still being distributed, since an increase in the price of Basis Shares does make BAC more valuable as an asset that is used to farm Basis Shares.
(11) Thanks to Hasu for reminding me of this important point.
(12) Credit to Angelo Min for helping me to conceptualize and articulate this argument.
(13) Here, the denominator is circulating ESD.