Synthetic Assets Protocol Development

Developing a synthetic assets protocol

Synthetix lost about $37 million in 2019 not because of a code vulnerability — because of a bug in Chainlink oracle for Korean won. One bot read an incorrect price, executed 37 million sETH/sKRW transactions in a few minutes. Protocol rolled back transactions via governance. This is an illustrative story: synthetic assets are a protocol that entirely lives on price data accuracy, and any failure in this layer is fatal.

Architectural approaches to synthetics

Two fundamentally different mechanisms underlie most synthetic protocols.

Debt pool model (Synthetix v2/v3)

All protocol stakers collectively bear the debt to synthetic holders. If holders of sAAPL earn, stakers lose — proportional to their share in total debt pool. This creates zero-sum dynamics inside the protocol and complex P&L mathematics for liquidity providers.

Main debt pool problem: if some synthetics rise in price significantly faster than others, staker debt inflates asymmetrically. Synthetix v2 solved this via debt hedging using synthetic indices on Curve. Synthetix v3 separated collateral pools by isolated markets — now risk isn't spread globally across all stakers.

CDP model with overcollateralization (Mirror, Abracadabra)

Each synthetic is backed by collateral in another asset with surplus. Mirror Protocol minted mAAPL, mTSLA under UST collateral at 150%+ ratio. After UST collapse in May 2022 — nothing was left to back redemption. This is the existential risk of any CDP-synthetics: collateral quality determines entire system stability.

Oracles: the weakest point

Latency arbitrage

Synthetix v1 suffered from frontrunning: trader saw oracle update in mempool, sent transaction with higher gas, traded at old price before update passed. This is called latency arbitrage.

The solution Synthetix implemented — off-chain pricing with on-chain settlement: price is signed by authorized node at trade moment, contract verifies signature. Zero slippage, latency arbitrage impossible. Similar mechanism used by Pyth Network via Wormhole.

function exchange(
    bytes32 sourceCurrencyKey,
    uint256 sourceAmount,
    bytes32 destinationCurrencyKey,
    bytes calldata priceUpdateData,  // Signed price from Pyth
    uint256 publishTime
) external {
    // Verify price freshness
    require(block.timestamp - publishTime <= MAX_PRICE_LATENCY, "Price too old");
    
    // Update price on-chain atomically with trade
    pyth.updatePriceFeeds{value: msg.value}(priceUpdateData);
    
    // Execute exchange at verified price
    _internalExchange(sourceCurrencyKey, sourceAmount, destinationCurrencyKey);
}

Real-world assets (RWA synthetics): specifics

Synthetics on stocks, commodities, forex only work during market hours. Contract must know when market is closed and block trading — otherwise arbitrageurs will exploit gap between close and open.

RWA-synthetics require:

• Market hours oracle — check trading activity
• Circuit breaker on price deviation >10% between updates
• Settlement mechanism for expired synthetics

How we build synthetic protocol

Stack and components

Core contracts (Solidity):

• SynthFactory — deploy new synthetic ERC-20
• CollateralManager — manage collateral, calculate C-ratio
• ExchangeEngine — exchange logic, fee routing
• DebtLedger — track global debt (for debt pool model)
• OracleAggregator — aggregate Chainlink + Pyth with fallback

Development in Foundry with fork-tests against mainnet. Especially important to test scenarios with historical price data — replay real market movements via vm.warp and mock oracles.

Formalization invariants for Certora:

• Sum of all synthetics in USD equivalent ≤ sum of collateral × max C-ratio
• After liquidation, C-ratio of position always ≥ target C-ratio

The Graph subgraph for indexing mint/burn events, positions, historical debts — without it frontend will read state via slow on-chain calls.

Liquidation mechanism

For CDP model: if C-ratio falls below minimum threshold, position is open to liquidators. Liquidator burns synthetic, gets collateral at discount (usually 10-15%).

Critical moment — liquidation flag: can't liquidate position atomically if it creates flash loan vector. Scheme: liquidator must hold synthetic to liquidate. Flash loan lets one borrow synthetic, liquidate position, get collateral and return loan — if protocol unprotected.

Protection: same-block restriction — forbid liquidation if synthetic was obtained in same block (similar to ERC-4626 share inflation protection).

Working process

Analytics (5-7 days). Choose model (debt pool vs CDP), asset list, oracle sources, C-ratio parameters, fee structure. Model economics via Python simulations: what happens at -40% main collateral asset.

Design (1 week). Contract architecture, storage layout, oracle integrations. Separately — governance mechanism for adding new synthetics and changing parameters.

Development (6-10 weeks). Core protocol + synthetic ERC-20 + liquidations + oracle aggregator. Tests: unit, integration, fork-tests, invariant tests in Echidna.

Security (2-3 weeks). Internal audit (Slither, Mythril, manual), then external audit. For synthetic protocols — mandatory, minimum one external team.

Deployment and monitoring. Tenderly alerts on anomalous C-ratio movements, volumes, price deviations.

Timeline estimates

Basic CDP protocol for one synthetic — 6-8 weeks. Full multi-asset platform with debt pool, governance and multiple collateral types — 3-5 months. Parallel audit adds 4-8 weeks.

Cost calculated individually after determining architecture and asset list.