Lending Protocols and Liquidations
A bank lends to people it knows: it checks their income, their credit history, and their other debts, and it can take them to court if they do not pay. A lending protocol on a blockchain knows nothing about its borrowers, who are anonymous addresses, and it cannot take anyone to court. It lends anyway, to anyone, by holding collateral worth more than the loan and selling it automatically when its value falls too far. This chapter explains how these loans work, how the health factor decides when a loan can be liquidated, who does the liquidating, and why liquidations can feed on themselves in a crash.
Lending without knowing the borrower
In a lending protocol such as Aave or Compound, lenders deposit tokens into a pool and earn interest; borrowers take tokens out of the pool and pay interest. Because the protocol cannot enforce repayment, every loan must be backed by collateral worth more than the loan. As Qin et al. (2021) explain, “because the lending and borrowing on blockchains lacks compulsory means on defaults, the amount of debt borrowers can take on is typically inferior to the security deposit in value.” Loans are over-collateralized.
Why borrow at all, if you must deposit more than you receive? Because the collateral and the loan are different tokens. An investor who owns ETH and expects it to rise can deposit it, borrow dollar stablecoins against it, and buy more ETH: a leveraged position, without selling the original ETH. Others borrow a token to sell it short, or to use it elsewhere without giving up their exposure to the collateral.
The interest rate is set by a formula rather than by a loan officer. It rises with the pool’s utilization, the share of deposits currently lent out. When utilization is high, rates rise steeply, which draws in deposits and discourages borrowing, so that lenders who want to withdraw can still do so.
The health factor
Each type of collateral has a liquidation threshold, the fraction of its value that counts toward securing debt; riskier tokens get lower thresholds. A loan’s health factor is \text{HF} = \frac{\sum_i (\text{value of collateral } i) \times (\text{liquidation threshold } i)}{\text{value of debt}}, \tag{1} the ratio of the borrowing capacity of the collateral to the debt. While HF is above 1 the loan is safe. When it falls below 1, the loan “becomes eligible for liquidation” (Qin et al. 2021).
For one type of collateral, a borrower with c units of collateral at price P, a threshold \theta, and debt D has \text{HF} = cP\theta/D, so the loan becomes liquidatable when the price falls to P^{*} = \frac{D}{c \, \theta}. \tag{2} A borrower can always see how far the price can fall before that happens, and can add collateral or repay debt to move P^* further away.
Liquidation
Once a loan’s health factor drops below 1, the protocol does not sell the collateral itself. Instead, “anyone can repay the debt and claim the collateral” (Qin et al. 2021), at a discount. In the versions of Aave studied by Qin et al. (2021), a liquidator could repay at most 50% of the debt in one transaction, the close factor, and received collateral worth the repaid debt plus a liquidation spread, which Aave calls a liquidation bonus, ranging from 5% to 15% depending on the collateral. Later versions changed these numbers, allowing larger liquidations when a loan’s health factor is far below 1. The bonus pays liquidators to act quickly, before a falling price leaves the loan with less collateral than debt.
Liquidators are mostly automated programs that watch every loan and compete to be first. Qin et al. (2021) study four major lending protocols on Ethereum from their start to April 2021 and find cumulative liquidations of 807.46 million dollars, carried out by 2,011 different liquidator addresses. Competition is intense: 73.97% of liquidations pay an above-average transaction fee, which they read as a sign of competitive behavior, since a higher fee buys a better chance of being included first. They also conclude that “most liquidation systems are unfavorable to the borrowers”: the bonus goes to the liquidator, and the borrower can lose more than is needed to make the loan safe again.
Oracles
A protocol on a blockchain cannot see prices on outside exchanges. It relies on an oracle, a feed that writes prices onto the blockchain. The oracle is a point of failure: if it reports a wrong price, loans are liquidated that should not be. Qin et al. (2021) document one case: in November 2020, “an irregular DAI price provided by the Compound price oracle allowed liquidators to profit in total 8.38M USD.” An oracle that reads its price from a single on-chain pool is especially exposed, because a large trade can move that pool’s price for a moment, long enough to trigger liquidations.
Cascades
Liquidations can feed on themselves. A liquidator who receives ETH as collateral usually sells it right away, to lock in the bonus. Selling ETH pushes its price down, which lowers the health factor of other loans backed by ETH, which triggers more liquidations, and more selling. How far a cascade goes depends on how many loans sit just above their liquidation price, and on how much the market can absorb before the price moves: the deeper the market, the smaller the price impact of each sale.
Figure 1 shows the mechanism with made-up loans. The notebook on liquidation cascades simulates it, with the liquidated collateral sold into an automated market maker of the kind studied in the previous chapter.
Practice Problems
These problems give you a chance to practice the concepts introduced in this chapter. Try to solve each one on your own before expanding the solution.
Problem 1 (Health Factor and Liquidation Price) A borrower deposits 10 ETH, trading at 3,000 dollars, and borrows 18,000 USDC. ETH has a liquidation threshold of 0.80. Compute the health factor, and the ETH price at which the loan becomes liquidatable. How much more USDC could the borrower take before the loan is liquidatable at today’s price?
Solution
By (1), \text{HF} = 10 \times 3{,}000 \times 0.80 / 18{,}000 = 24{,}000/18{,}000 \approx 1.33. By (2), the loan becomes liquidatable at P^* = 18{,}000/(10 \times 0.80) = 2{,}250, a fall of 25%. The borrowing capacity is 24,000 USDC, so the borrower could take 6,000 more before the health factor reaches 1 at today’s price, leaving no room at all for a price fall. In practice, protocols cap new borrowing at a maximum loan-to-value below the liquidation threshold, so the borrower could not go quite that far.Problem 2 (A Liquidation) ETH falls to 2,200 and the loan of the previous problem becomes liquidatable. With a close factor of 50% and a liquidation spread of 5%, how much debt can a liquidator repay, how much ETH does the liquidator receive, and what is the liquidator’s profit if they sell the ETH at 2,200? What is the loan’s health factor afterwards?
Solution
The liquidator can repay half the debt, 9,000 USDC, and receives collateral worth 9{,}000 \times 1.05 = 9{,}450 dollars, that is 9{,}450/2{,}200 \approx 4.295 ETH. Selling it at 2,200 gives a profit of 450 dollars, before transaction fees. The borrower is left with 10 - 4.295 = 5.705 ETH and 9,000 USDC of debt, so \text{HF} = 5.705 \times 2{,}200 \times 0.80/9{,}000 \approx 1.12. The loan is safe again, but the borrower paid 450 dollars to the liquidator, and repaid far more debt than was needed to restore a health factor of 1.Problem 3 (What Makes a Cascade Worse?) Select all statements that apply.
- Many loans with liquidation prices just below the current price make a cascade more likely.
- A deeper market for the collateral, where large sales move the price less, makes a cascade smaller.
- Liquidation bonuses make cascades impossible, because liquidators act quickly.
- An oracle that reads its price from a single small pool makes liquidations easier to trigger by manipulation.