Investing in Risk Harbor
By: Pantera Capital
Tags: Cryptocurrency, Venture Capital, Fintech, Blockchain, Risk Management

by Tina Chen, June 2021

DeFi Insurance Landscape

Roughly $50 billion worth of assets is locked up in decentralized finance (DeFi), a fourfold increase since the start of this year. These deposits are mostly uninsured.

In the past year, over $400 million worth of crypto assets has been stolen in DeFi-related hacks and attacks. According to CipherTrace, DeFi hacks were responsible for the theft of $156M between January and April of 2021. Yearn.Finance, for instance, was exploited in February, resulting in the loss of $11 million of crypto assets. In early March, DODO lost $3.8 million in a similar attack, followed by Roll being exploited for $5.7M just days later. In the last month alone, we’ve seen Rari Capital ($10M), EasyFi ($80M), and FinNexus ($7.6M) also get hit with devastating, costly attacks.

The good news is DeFi projects are experiencing explosive growth, and that growth shows no signs of slowing down.

Bad news?

This rise in hacks is likely to accelerate as DeFi continues to grow, further exposing liquidity providers and stakers to acute risks of loss.

In traditional financial markets, retail investors and institutions can hedge their exposure to market risks by using options and other derivatives. They can also mitigate counterparty risks by buying credit default swaps and insurance. DeFi, however, is still nascent, and its users have little protection against platform vulnerabilities and the malicious actors who exploit them.

At present, option hedging strategies are among the only loss protection mechanisms available to DeFi users. However, those are complex, volatile, expensive, and likely not a viable long-term solution.

DeFi has not traditionally attracted the risk-averse, so it may come as no surprise that the space has been slow to offer better risk-mitigation solutions. But with the growing popularity of DeFi protocols — and the ever-present bugs and vulnerabilities in their code — the time has come for protection providers to fill the existing gap in coverage paving the way for mainstream adoption.

Introducing Risk Harbor

Meet Risk Harbor, a risk management marketplace for DeFi that utilizes an automated, transparent, and impartial claims process to protect liquidity providers and stakers against smart contract hacks and attacks.

At its core, Risk Harbor believes every single crypto asset should be protected without the need for trusted intermediaries, thereby creating a truly permissionless and open financial system accessible to everyone.

A DeFi Parametric Risk Management Solution

Unlike other decentralized protection policies, Risk Harbor follows a parametric protection pedagogy. Its algorithmic, transparent, and impartial solution removes the need for oracles and third-party authorities, all while providing near-instantaneous payouts.

Parametric protection has been around since the 90s. As its name suggests, it sets parameters that determine payouts based on specific, predetermined metrics. In contrast to a traditional indemnity policy, a parametric protection contract protects the policyholder against the occurrence of a predefined event by promising a payout if and when predetermined parameters are satisfied. For example, if you live in a hurricane-prone area, you might consider a parametric protection policy that pays out $50,000 if a Category 3 hurricane occurs within a set geographical location. If the predefined event or “Category 3 hurricane” does occur, it triggers the payout without needing a claims adjuster to make subjective determinations.

Risk Harbor functions similarly.

Risk Harbor allows individual users to purchase only what they need for parametric protection. Underwriters create risk management pools with specified parameters, and buyers choose which pool they want to buy into. Total premium is paid upfront, and the proportional amount is added to the corresponding underwriters’ pool.

In the event that Yearn was hacked and yUSDC tokens were stolen, a Risk Harbor policyholder would submit two transactions to the protection contract to file a claim and receive a payout. Policyholders would be paid within three blocks or 45 seconds of the hack. Thus, every Risk Harbor participant, from the underwriters to the individual policyholders, is free from manipulation.

In comparison, competitors like Nexus Mutual are highly inefficient. For one, Nexus Mutual is a governance-based insurance protocol, which makes resolving each claim a lengthy, adversarial process between underwriters and the policyholders. Underwriters on Nexus Mutual maximize profits by collecting premiums and denying claims. These protocols operate with risk assessors who vote on payouts. However, because risk assessors also play the role of the underwriter, they are incentivized to not pay out as many claims as possible. Of the 94 claims filed (with projects like MakerDAO MCD and Balancer V1), more than 80% were denied.

Risk Harbor, on the other hand, has a claims process free of any human input or bias, making payouts in ~45 seconds. And because of this objective solution, they can handle infinite entropy. By removing the need for trusted intermediaries, Risk Harbor’s model takes away the possibility of pool underwriters undercutting the system. This allows for infinite permutations of risk protection without any slowdown, processing time, and prevents miscellaneous incentives.

Maximizing Capital Efficiency via Composability

In the insurance context, the pool of paid-in premiums (the “float”) can be viewed as a zero-interest loan, to be paid out in the future when claim events happen. Traditional insurance companies, like those held by Warren Buffett’s Berkshire Hathaway, reinvest their float to earn extra cash. Risk Harbor is the first DeFi risk management protocol that enables underwriters to do the same.

By allowing underwriters to use nearly any asset as underwriting capital, the Risk Harbor protocol achieves higher yields for underwriters, incentivizing capital inflows from underwriters and enabling lower premiums for users. The claims tokens on Risk Harbor can also be used for one underwritten contract as underwriting capital for another contract. This composability generates complex risk protection products that would not otherwise be possible. Most importantly, because underwriters can get yield from other sources as well as yield from underwriting, protection premiums on Risk Harbor will be cheaper than its competitors.

Let’s take protection for yyDAI as an example. A customer using Risk Harbor to protect their yyDAI today would pay a premium of 0.4% of the covered amount to protect it for the duration of the contract. The protection would be underwritten using cUSDC (Compound USD coin, representing a staking claim from depositing USDC in Compound), and would yield the underwriter 0.4% over the duration of the contract, in addition to the ~2.0% rewards earned baked into the cUSDC. The higher the total yield, which is the sum of the Compound yield and the Risk Harbor underwriting yield, the more capital gets incentivized to underwrite smart contract risk.

Why we’re investing in Risk Harbor

We’re thrilled to announce Pantera’s investment in Risk Harbor, the first capital-efficient, parametric risk management marketplace for DeFi.

The hacks in the last year have made clear that, as the DeFi ecosystem grows and becomes more complex, malicious attacks are unfortunately inevitable. This creates a widespread need for risk management products that protect against hacks and attacks and mitigate the risks and losses they bring about.

We believe strong risk management solutions will be critical for mainstream DeFi adoption, helping retail investors and institutions to feel safer putting their capital to work.

The Risk Harbor team also exhibits traits we see in other successful DeFi companies: highly competent individuals that can execute at lightning speed, never sacrificing quality or integrity. Founders Raouf Ben-Har and Drew Patel are leading by example: they are grounded yet highly ambitious, future-oriented but also anchored to the present, and they are never willing to settle for the suboptimal. The team is highly competent, drawing on experience from building great products at Google, AWS, Shopify, Twilio, Zap Finance, Goldman Sachs, and others. From how they prioritized rigorous platform security and partnerships with top security auditing firms to their relentless obsession with community building and user experience, the Risk Harbor team has proven itself exceptionally polished at such an early stage.

But what truly sets Risk Harbor apart is how they think about DeFi innovation and the future of open finance. Many crypto projects take what worked in the traditional world and set out to put it onto the blockchain. But this approach doesn’t guarantee a truly permissionless solution, nor does it capture the true potential of blockchain technologies. At Risk Harbor, the team has built a truly crypto-native risk management solution, and no other product on the market is more scalable, flexible, and trustless.

What’s Next for Risk Harbor

At Mainnet launch, Risk Harbor will be supporting the following protocols:

Harvest Finance: Risk Harbor will offer protection for fUSDC holders in Harvest. Harvest is a yield farming pool protocol that allows users to join in together to save gas and maximize yields. Users deposit their USDC tokens into the FARM_USDC contract and receive fUSDC claim tokens that allow them to collect rewards and eventually withdraw their staked USDC tokens from the pool. Alongside the contract risks that the Harvest protocol itself may suffer from, there is also an inherent risk from the protocols that Harvest invests its staked liquidity into. For example, if Harvest deposits some of the USDC that its users staked into a Compound pool and somehow Compound gets hacked, users might be unable to withdraw their staked token from Harvest (since some of those tokens were lost in the Compound hack).

Risk Harbor will offer protection for fUSDC holders in Harvest. Harvest is a yield farming pool protocol that allows users to join in together to save gas and maximize yields. Users deposit their USDC tokens into the FARM_USDC contract and receive fUSDC claim tokens that allow them to collect rewards and eventually withdraw their staked USDC tokens from the pool. Alongside the contract risks that the Harvest protocol itself may suffer from, there is also an inherent risk from the protocols that Harvest invests its staked liquidity into. For example, if Harvest deposits some of the USDC that its users staked into a Compound pool and somehow Compound gets hacked, users might be unable to withdraw their staked token from Harvest (since some of those tokens were lost in the Compound hack). BarnBridge: Risk Harbor will offer protection for Junior Bond holders in BarnBridge’s compound USDC Smart Bond protocol. BarnBridge aggregates yield generating on-chain assets and divides them into risk tranches. Senior Bond holders enjoy steady yields and low risk whereas Junior Bond holders underwrite more of the risk in exchange for higher yields. If Compound were hacked or attacked and BarnBridge stakers had deposited USDC into BarnBridge, Senior Bond holders would be made whole before Junior Bond holders. This means Junior Bond holders are significantly more likely to bear the brunt of a hack or attack than Senior Bond holders.

Moreover, the team also recently announced their multi-chain strategy where they’ll be supporting pools like Polygon (formerly Matic) and Binance Smart Chain, making them one of the first L2 protection solutions on the market.

We strongly believe Risk Harbor will be the leader in the DeFi risk management space and we’re thrilled to be partnering with the team as they continue to build out a truly objective DeFi protection marketplace. As the frequency and severity of DeFi attacks continue to emerge, Risk Harbor’s parametric risk management model will play an essential role for the crypto risk protection ecosystem.

To learn more about Risk Harbor, check out:

You can follow them on Twitter, Discord, and Medium for product updates and other great resources.

P.S. The team is (always) hiring!