The governance proposal presented by Gauntlet, advocating for the freezing of CRV and setting CRV LTV to 0 on Aave v2, addressed the increasing concentration risk caused by the substantial deposits of CRV tokens by Curve DAO's founder. Although the proposal was ultimately voted down by the governance participants, the underlying concerns remain valid. The founder's deposit of 38M $CRV ($24.5M) into Aave, prompted by a significant drop in $CRV price, raised the health rate to 1.52, with a total of 290M $CRV ($187M) deposited and $71M borrowed in stablecoins. This concentration of collateral exposes both Curve and Aave to heightened risks, particularly during market decline and diminishing liquidity, as exemplified by the bad debt incurred by Aave in November 2022.
It was precisely the consequences of a major liquidation event on November 22nd, 2022, involving a borrower who had borrowed close to $40M of CRV tokens using USDC as collateral, that prompted our decision to conduct an in-depth analysis of the events. Through this analysis, we gained valuable insights that have served as inspiration for improving the liquidation logic of lending protocols. Our rigorous stress-testing, involving thousands of historical price trajectories, has allowed us to refine the protocols and develop enhanced measures to mitigate risks effectively.
As it turns out, the bad debt incurred was not a result of a volatile price trajectory over which Aave or any lending protocol had no influence, but rather it is an outcome of sub-optimal protocol design, also shared by other major lending DeFi money markets. In a nutshell, once a user’s loan-to-value ratio crosses a certain threshold, which we call the undercollateralization frontier, it is in the protocol’s interest to stop incentivizing the liquidations of that user. This counterintuitive action prevents future toxic liquidation spirals and offers a substantial improvement in the bad debt that a lending market can expect to incur. Additionally, we propose changes in how protocols should design the liquidations. Protocols should upgrade the liquidation logic and make use of the dynamic parameter tuning based on the user's situation. We propose implementing dynamic liquidation incentives, and closing factor policies.
What happened?
On November 13th, Avraham Eisenberg, the trader linked to last month’s $114 million Mango Markets exploit, borrowed 92 million Curve (CRV) tokens (worth $40 million at the time) using the decentralized lending platform Aave. At the moment when he ended up building up his position, his collateral in USDC was worth $64 million, making his loan-to-value ratio 62%.
After a series of large fluctuations in the CRV price, Eisenberg’s position was abruptly liquidated on November 22nd. This ultimately left Aave with $1.7 million of bad debt. We believe that this situation was avoidable and is attributable to a toxic liquidation spiral which guaranteed that Avi Eisenberg’s initially overcollateralized CRV short would evolve into an undercollateralized final state.
How it works?
Most of the DeFi lending markets, such as Aave, Compound or 0vix rely on overcollateralization of a user’s borrowed assets. When you want to borrow an asset X, first you have to supply a specified minimum amount of asset Y. After all, in a permissionless, pseudonymous world of blockchains, how else do you make sure that someone is not going to just run away with your funds? Every user’s borrowing position is backed by collateral. The borrowing position has to be overcollateralized at the level such that when the collateral value drops due to large price movements, the user and the platform are solvent. The total value of borrowed assets can not exceed this overcollateralization ratio, defined by the collateral factor. If a user crosses this threshold, they can be liquidated by any other participant of the blockchain. But why would anyone bother to “liquidate” other irresponsible participants of the system?
When a liquidation takes place, the liquidator repays an arbitrary amount of the liquidatable user’s loan, in exchange for receiving the equivalent amount of the collateral tokens, at a specified by the protocol discount. This discount is typically set by lending protocols for all assets as the same, static value, usually called a liquidation incentive. One thing to bear in mind is that a liquidator can repay at most a given percentage of a user’s loan, denoted by the closing factor. Generally speaking, the precise amounts paid by/to the liquidator are the result of an optimization problem whose complex details fall outside the scope of this article.
The aim of liquidations is to make the portfolio of a risky user healthier, as measured in Loan to Value (LTV). In the case of multi-collateral portfolios, the user’s specific LTVliq is computed by performing a weighted average across their available collateral assets. In the case at hand, as Avi only held USDC as collateral, his portfolio’s liquidation threshold was equivalent to Aave’s liquidation LTV threshold for USDC: 89%. Whenever Avi’s portfolio’s loan-to-value ratio satisfied LTV > 0.89 (the thin horizontal black line in Figure 1) liquidations would be allowed to commence (thin vertical black lines in Figure 1). At each liquidation call, liquidators were rewarded with Aave’s 4.5% liquidation incentive. What’s worth noting here is that when the liquidations start happening, the user’s portfolio is still overcollateralized - in this case at the 89% ratio.
When Liquidations become toxic
The goal of a liquidation is to decrease the user’s loan-to-value ratio below a LTVliq value. In most cases, this actually does take place. In others, however, a liquidation call leads the user’s LTV to increase. We label such liquidations as toxic. Toxic liquidations are dangerous for the protocol since they mathematically guarantee that the user’s portfolio health will worsen through no fault of their own.
These undesirable liquidations happen when user’s LTV crosses what we call the undercollateralization frontier, defined mathematically as 1/(1+inc), where inc represents the liquidation incentive. Given Aave’s inc=0.045, Avi’s liquidations were guaranteed to lead to bad debt after his position’s LTV>0.957.
Why is the liquidation incentive so important to the mechanics of toxic liquidation spirals? It’s quite simple, actually, and it has to do with how the total amount of user’s collateral changes with each liquidation. Recall that at each liquidation call, a liquidator is allowed to repay a loan and repossess an equivalent amount of the collateral at a certain discount. This discount is the liquidation incentive. Thus, at each liquidation call, a user’s total amount borrowed decreases by a bit less than their total amount supplied. The value of this “a bit less” is the liquidation incentive times the value being repossessed. Each liquidation thus pushes the LTV upwards (since the value of collateral decreases by more than the value of the loan) until it exceeds 1, at which point the protocol incurs bad debt.
Another way to think about it is that if the liquidations start when the distance between the user’s current LTV and the undercollateralization LTV (=1) is less than the liquidation incentive, the user is guaranteed to generate bad debt.
If you don’t believe us, look at the animation below. It shows the change in Avi’s LTV before and after the liquidation in cases where his loan-to-value ratio is below and above the undercollateralization frontier. Notice how the relative change in $-value of CRV and USDC differs over time, as the user’s LTV increases. The positive cases of LTV increase before crossing the UC Frontier are a result of dramatic price increases between the blocks.
Can we stop toxic liquidations?
When a user crosses a certain LTV threshold, they are guaranteed to create bad debt for the protocol. This situation takes place whenever the UC Frontier is crossed, not only in case of a targeted attack by a malicious actor. In Avi’s case, the price movement that lead to the toxic liquidation spiral was very volatile. CRV’s value increased from roughly $0.61 to $0.72 in less than 30 minutes. Usually, such price movements are followed by an equally abrupt mean reversion. We can, however, be more conservative and assume that a trajectory that follows what lead to a user becoming undercollateralized is randomly sampled from the historical price data. Using thousands of such price trajectories, what was the bad debt that Aave could have expected given its current liquidation logic? According to our data, it’s $690K, which you can see as the green line in Figure 4.
How can we then prevent it from happening? A trivial solution might be to just halt the liquidations until the user’s LTV falls back below the undercollateralization LTV. For that to occur, a favorable to the protocol price action has to take place. In case of Aave, for this strategy to be successful, the price of CRV had to fall. That’s exactly what happened, but you can not blindly bet on a favorable price movement a priori.
We can, however, think about this problem statistically and ask a question: “on average, what amount of bad debt would the protocol expect to incur had it halted the liquidations?” and run thousands of historical price trajectories to find out. As it turns out, the expected value across our 20 thousand price samples was $540K, which is much smaller than the realized $1.69M, and significantly lower than allowing the toxic spirals to unfold would generate on average.
Now, as you could see in the previous section, the toxic liquidations are a direct result of the LTV crossing the undercollateralization frontier, which is a function of the liquidation incentive. Can we then manipulate the liquidation incentive to prevent the users from getting into a dangerous LTV territory? This is the exact question we have asked ourselves in this in-depth study.
Look at Figure 2 and notice the three horizontal lines: the bottom one showing LTV=0.89, at which user’s position becomes liquidatable, the red one denoting the undercollateralization frontier, and the shaded one, representing LTV=1. The dangerous zone for the protocol is above the red line. Can we thus close the gap between the red line and LTV=1? Dynamically decreasing the liquidation incentive based on the user’s LTV would achieve exactly that, as a result making unhealthy liquidations less attractive to the liquidators. We test a simple mathematical formula in our protocol simulator (link to the associated research paper).
As you can see on Figure 4, the expected bad debt incurred by a lending protocol using this new policy is only $270K. Compared to the expected $690K in the case of the current liquidation logic, we consider that to be a significant improvement in the risk management of lending protocols.
Conclusion
Decentralized finance is still in its nascent stage and expecting the industry to solve all edge cases before they have even been discovered is unrealistic. The open-source nature of the protocols built on blockchains with smart contracts is a double-edged sword. On the one hand, it facilitates predatory trading like that from Avi, since exploiting a fully transparent system is easier than an opaque one. On the other, however, it allows us to conduct studies like this one, learn from each other’s mistakes, and push the industry forward by acting on our findings. In this article, our aim was to show how processes like liquidation that are designed to keep DeFi lending protocol stable itself can manifest themselves as toxic. Liquidation incentives in protocol play an important role in protocol stability and our study offers new insights on how to make our DeFi system more resilient.
