Sky's decentralization review

@makerdao' Sky is a stablecoin protocol allowing users to mint its USDS stablecoin through Collateralized Debt Positions with a variety of crypto collateral assets. Sky is built on the Maker protocol, by the MakerDAO, to replace the DAI stablecoin and allow for the 1:1 conversion between DAI and USDS. 

USDS can further be staked for the yield-bearing sUSDS token. Various levels of control over the Sky protocol are exercised through an onchain governance system.

Sky Community - Sky.money is a non-custodial gateway to the decentralised Sky Protocol. It is accessible to eligible users 24/7.

DeFiScan assesses and monitors the maturity and risks of DeFi protocols fostering Transparency and Security.
Built with ❤️ by @deficollective

Decentralization Assessments
⛓️Chain
🟢The report is concerned with the Sky instance deployed on Ethereum mainnet. Ethereum achieves a Low chain centralization score.

🚨Upgradability
🔴High Upgradability Centralization Score
$USDS and $sUSDS, respectively Sky's stablecoin and its corresponding yield-bearing version, are upgradeable contracts through Sky Governance proposals. Updating those contracts could change the entire logic of those tokens and may incur a loss of funds for users.

Critical parameters in the Sky protocol can be changed through Sky Governance proposals. Unwanted updates to these parameters can result in the loss of funds, loss of unclaimed yield, or otherwise materially impact the expected protocol performance. 
Example actions are: 
- Forced liquidations, which would result in loss of user funds.
- Creating unbacked debt, which could endanger the protocol's stability.
- Pausing the contracts, which could trap user funds for an undetermined amount of time.

⛅Autonomy
🔴High Autonomy Centralization Score
Circle's $USDC
Sky has a centralized dependency on Circle and its $USDC stablecoin token. Users can mint $USDS from $USDC at a fixed 1:1 rate. This means that $USDS is directly pegged to $USDC which is a centralized stablecoin.

This conversion may be stopped or paused in an emergency Sky Governance proposal. There is a debt ceiling limiting how much $USDS can be backed by $USDC. Nonetheless, at the time of writing, this debt ceiling is high enough that it does not prevent more than 50% of the collateral in Sky from being backed by USDC. The ceiling is explained further in the dependencies section.

Redefining access to verifiable & cost-efficient data. Scalable | Cost-Efficient | Accessible | Verifiable | Oracles. Securing MakerDAO/Spark/Morpho/Euler

@chroniclelabs 

The Sky protocol also relies on the provider Chronicle for price feeds of collateral assets.

Chronicle is an oracle protocol that computes a median price from multiple sources. The protocol contains validators who push new prices and challengers who can freeze and challenge new prices. The validator set of an oracle can be changed with a delay of 7 days. We analysed Chronicle's decentralization in a dedicated report here.

An Oracle Security Module (OSM) enforces a 1-hour window on price updates, and the governance can freeze the current price value to prevent further updates. In addition to freezing prices, the MakerDAO governance can change the oracle provider with a governance proposal.

🔴High Exit Window Centralization Score
All permissions within Sky are held by the onchain Sky Governance. There are no external accounts or multisigs in control.

The minimum delay between approval and execution of a Sky Governance proposal is 18 hours, recently reduced from 30 hours in an emergency proposal. The Sky Governance has a continuous proposal model, which means voters need to migrate their vote from the current proposal to a new proposal. The proposal with the most votes at any time is accepted and can be executed once its delay has passed.

Emergency measures permissions allow the Sky Governance to pause certain contracts through a proposal without being subject to the mandatory delay. This is the case for all contracts that have a Mom who can pause or stop their child.

In addition to that, an Emergency Shutdown Module exists and can shut down the entire protocol if 500,000 MKR tokens are irreversibly sent to the Emergency Shutdown Contract. Once the process is started, a specific timeline allows token holders and vault users to receive the net value of their assets. If the process is activated, it is irreversible, a fork would need to be created in order to revive the protocol. It is assumed that there are 2 scenarios:

1. A malicious majority is hijacking the Sky Governance. The only option once the system is shut down is to set up an alternative fork in which the malicious users' funds are slashed, and the users who shut down the system see their funds restored.
2. A critical bug was discovered and prevented with a system shutdown. The Sky Governance can refund users who shut down the system by minting new tokens.

🚪Accessibility
🟢Low Accessibility Centralization Score
Sky has a main frontend at sky.money. The frontend is not self-hostable nor open source, but multiple other access points exist with Sky-specific apps such as Spark or third-party apps like DeFiSaver or SummerFi Pro. 
These apps build an acceptable backup solution in case of failure of the official frontend.

Overall Score: Stage 0

The Sky protocol exposes critical permissions that are not protected with an Exit Window of at least 7 days or a Security Council and thus earns a High centralization risk score for its Upgradeability and Exit Window dimensions.

Furthermore, Sky is exposed to centralization risks from its USDC and Chronicle dependencies, resulting in an overall High centralization risk score for the Autonomy dimension. Sky thus achieves a decentralization of Stage 0.

The protocol could reach Stage 1 by:
1. No longer swapping its $USDS with Circle's $USDC in a blind fashion
2. Increase its Exit Window to at least 7 days or establish a Security Council.

It could further reach Stage 2 with: 

1. An Exit Window of at least 30 days
2. Changing its oracle provider to a Stage 2 or equivalent protocol. This could also be achieved if Chronicle increases its Exit Window to 30 days.

🔗Links
✍️Protocol Reviewer: @mmilien_ (https://x.com/@mmilien_)
📜DeFiScan complete review
@makerdao (https://x.com/@SkyEcosystem)
Website (https://sky.money/)
GitHub (https://github.com/makerdao)
DeFiLlama (https://defillama.com/protocol/sky-lending)