Chapter 16 · How DeFi Lending Works
How can a protocol lend to strangers without checking their credit?
- Capabilities practiced
- Financial LiteracyOnchain Literacy
- Hands on
- On testnet or with a small real amount, deposit collateral, borrow an asset, push the collateral ratio near liquidation, then repay.
- AI Lab
- Have AI draw up a balance sheet for a lending protocol and compare it with a bank. Then verify its interest-rate model parameters.
A Real-World Problem
You apply to a bank for a 50,000-yuan loan.
It requests proof of income, employer details, credit history, assets, liabilities, and perhaps a guarantor. With complete documents, an answer takes roughly two weeks.
The whole process has one purpose: decide whether you are trustworthy. If you do not repay, collection and litigation may take months or years.
Now open an on-chain lending protocol, connect a wallet, and click twice. Ten seconds later, $50,000 of stablecoins arrives.
The protocol knows neither identity, income, nationality, nor whether you are a person or a program. It cannot sue you because it does not know where.
Why does it dare lend to you?
Thought Experiment
Imagine an automated pawnshop.
An unattended street-side machine displays its rules:
- Deposit an object through its slot. The machine can continuously determine its current value.
- If worth 10,000, it lends at most 5,000.
- If the object's value falls below 6,250, a red light turns on.
- Any passerby may repay your debt and take the object, receiving a discount, such as paying only 4,750.
- You may repay to reclaim the object or add collateral to extinguish the light at any time.
The machine never evaluates you. Identity, repayment ability, or disappearance do not matter. It can simply sell the object and earn an additional amount when you fail to repay.
Borrower default itself poses no risk in this model. The question changes from trust in a person to how quickly collateral loses value.
Three prerequisites are essential:
- Accurate, continuously available prices that cannot be manipulated.
- Someone actually arrives to liquidate when the light appears; otherwise debt remains unpaid.
- The liquidator can sell the object afterward; otherwise they will not come.
All hold in calm conditions. The second half of the chapter examines when they fail.
Your Decision
You hold $10,000 of ETH and want stablecoin debt. Maximum borrowing is 75% of collateral value; liquidation begins at 80%.
How much do you borrow?
What Happens
Use three sliders: collateral value, borrowing ratio, and price decline.
Liquidation threshold: 80% . At this LTV, a price fall of about 37.5% triggers liquidation. In a rapid decline, liquidations can push the price down further.
Set the decline to zero and adjust borrowing to observe health. Then increase the decline until health falls below 1.
At an 80% liquidation threshold:
| LTV | Debt against $10,000 | Initial health factor | Decline triggering liquidation |
|---|---|---|---|
| 20% | 2000 | 4.00 | 75% |
| 30% | 3000 | 2.67 | 62.5% |
| 40% | 4000 | 2.00 | 50% |
| 50% | 5000 | 1.60 | 37.5% |
| 60% | 6000 | 1.33 | 25% |
| 70% | 7000 | 1.14 | 12.5% |
| 75% | 7500 | 1.07 | 6.25% |
Derive the relationships rather than memorizing them:
Health factor = current collateral value × liquidation threshold ÷ debt
Tolerable decline = 1 − LTV ÷ liquidation thresholdNow the real turning point: this table assumes collateral can be sold when liquidation occurs.
The complete chain:
- Collateral prices fall
- Many positions fall below health factor 1
- Liquidators acquire collateral
- Liquidators sell it on the market
- Prices fall further
- More positions fall below health factor 1
Liquidation itself is selling. It sends collateral into a market with finite depth, Chapter 15's y. Every position depends on the same price curve, so liquidations trigger one another.
This makes extreme simulator settings meaningful. A 37.5% cushion looks thick in isolation, but if everyone shares it, a 35% decline leaves the system near its first domino.
Build a Model
Compare with a bank
A lending protocol is a rewritten balance sheet.
| Bank | On-chain lending protocol | |
|---|---|---|
| Assets | Loans, Treasuries, reserves | Borrower debts and unborrowed pool funds |
| Liabilities | Deposits | Depositors' claims |
| Capital | Shareholder equity absorbs bad debt | Usually absent or a small reserve |
| Lending basis | Income, credit, guarantees | Collateral market value |
| Lending speed | Days to weeks | One block |
| Default response | Collection, lawsuits, auctions over months | Liquidators within seconds |
| Leverage | Assets may exceed capital tenfold | No expansion; each loan overcollateralized |
| Maturity mismatch | Short deposits finance long loans | Limited; both sides generally on demand |
| Bank-run equivalent | Depositors queue without access | Utilization reaches 100%; withdrawals stop |
| Backstop | Shareholders, insurance, central bank | None; depositors share bad debt |
| Interest setting | Central-bank policy and bank pricing | Public utilization formula |
Three conclusions:
- Giving up credit assessment enables speed and permissionless access, but lending only reaches people who already have assets. It provides liquidity rather than inclusive unsecured credit.
- There is no capital cushion. Banks lose shareholder money first; protocols often lose depositors' money directly.
- Utilization replaces maturity mismatch as withdrawal risk. The forms differ, but the result feels the same: too much money is lent out and you cannot withdraw.
Interest is a formula
The price between lenders and borrowers depends on utilization:
Utilization = borrowed amount ÷ total deposited amountRates usually rise gently at low utilization, then sharply beyond a kink often near 80%.
This is a price-based balancing mechanism. Low rates attract borrowers when utilization is low. High rates encourage repayment and new deposits when utilization is high.
The steep segment is the system's brake against a run. It promises economic pressure to return funds, rather than guaranteed immediate withdrawals.
Depositor interest comes from borrowers:
Supply rate ≈ borrow rate × utilization × (1 − protocol share)Chapter 17 uses this repeatedly. At 50% utilization, supply interest is roughly half the borrowing rate. Similar supply and borrow rates suggest near-100% utilization, which makes withdrawal difficult.
Three prerequisites, three incident types
Each automated-pawnshop assumption has failed in reality:
| Prerequisite | Failure | Risk category |
|---|---|---|
| Accurate, manipulation-resistant prices | Wrong liquidations or missed necessary liquidations | Oracle Risk |
| Willing liquidators | Positions remain unhealthy and become bad debt | Operational / Liquidity |
| Sellable collateral | Liquidators cannot exit, so stop participating | Liquidity Risk |
Chapter 24 puts these into a shared risk model. Remember: none requires a code bug; perfect execution can still lose money.
What It Is Called
Assets locked in the protocol to support debt.
Quality matters: volatility, depth, and acceptance. An asset moving 80% and a stablecoin create different positions even at identical LTV.
Debt divided by current collateral value.
Distinguish maximum borrowing LTV, the entry limit, from liquidation LTV, the trigger. Their gap is the cushion. Many watch only the former while the latter determines their outcome.
Collateral value × liquidation threshold ÷ debt. Below 1 means liquidation.
It compresses remaining room into one number. A health factor of 1.1 leaves only about a 9% decline. Convert it back to a decline for useful intuition.
The fraction of deposited funds already borrowed.
It determines borrowing rates, supply rates, and withdrawal availability. At 100%, the pool has no cash; depositors wait for repayment or new deposits. Read utilization alongside APY.
The curve mapping utilization to interest, usually with a kink.
Governance can often change its kink and slopes, immediately affecting everyone. Investigating who controls these parameters is essential.
When health falls below 1, a third party repays some debt and takes corresponding collateral at a discount.
Usually only part of the position closes to restore safety. The borrower pays the discount as a penalty. Profit-seeking bots execute liquidation and appear only when profitable.
Debt exceeding collateral value after liquidation fails to finish in time.
Without shareholders or insurance, depositors generally share the loss, or a protocol reserve covers it. Reserves are usually smaller than extreme shortfalls. This sharply distinguishes protocols from banks.
Hands-on
Prefer a testnet. On mainnet, use only an amount you can afford to lose completely, usually a few to tens of dollars. The goal is observing health-factor changes, not earning money; a tiny amount works equally well.
Record initial parameters. Find maximum borrowing LTV, liquidation LTV, and liquidation penalty for your collateral.
Also record supply APY, borrowing APY, and utilization.
Deposit without borrowing. Verify available borrowing equals collateral value × maximum LTV. Investigate discrepancies in documentation, such as asset-specific discounts.
Borrow a small amount. At roughly 30% LTV, record health and manually check collateral value × liquidation threshold ÷ debt.
Increase debt gradually until health is around 1.2. Record each health factor and tolerable decline. Moving from 2.0 to 1.5 feels mild; from 1.2 to 1.05 feels like a cliff. This nonlinear intuition is the Lab's main value.
Stop around 1.2. Restore safety in two ways: add collateral and observe the change; then repay part of the debt and observe again.
Those are your full options in a real decline. Practicing them differs from learning them during an emergency.
Repay everything, reclaim collateral, and record costs. Add interest and Gas and compare with the borrowed amount.
Optionally, repeat on a testnet and push health below 1 to observe actual liquidation losses. Only do this on a testnet.
AI Lab
Two tasks, with the second the main focus:
Task 1:
Draw an overcollateralized on-chain lending balance sheet, assets on the left,
liabilities and equity on the right. Identify each on-chain counterpart.
Compare with a commercial bank, focusing on capital cushions, maturity mismatch,
and who bears bad debt.
Task 2:
For protocol [name], asset market [asset], find:
- Maximum borrowing LTV, liquidation LTV, liquidation penalty
- Utilization kink, slope before the kink, slope after it
- Protocol share or reserve factor
- Current utilization, borrow APY, supply APY
- Who can change parameters and through which process
Give sources and timestamps. Mark unavailable items "not found".
Do not use remembered figures.
Check: supply APY ≈ borrow APY × utilization × (1 − protocol share).The final check is a closed consistency test: if three numbers do not produce the fourth, at least one is wrong, even before checking external data.
These parameters change frequently through governance. Training-data settings are unlikely to match today's settings.
Verify these points yourself after using AI
- Do assets and liabilities align? Deposits are liabilities and loans assets, which models often reverse.
- Did it invent shareholder equity that the protocol lacks?
- Can you verify maximum LTV, liquidation threshold, and penalties in documentation or on-chain settings?
- Are kink and slope parameters sourced rather than invented?
- Does the supply-rate formula include utilization?
- If it says the protocol absorbs bad debt, which specific funds do so and how much exists?
- Does each number have a timestamp? Rates and utilization change within minutes.
Real-World Case
During a sharp decline, severe congestion and soaring Gas prevented most liquidation auction participants from bidding, through cost or operational failures.
Some auctions had one bidder, who obtained collateral near zero. The system incurred bad debt and ultimately issued governance tokens to cover it.
Two assumptions broke: liquidators did not arrive, and the remaining participant faced no competition. Code followed its design while losses still occurred.
Several attacks used the same structure: a protocol valued collateral using a shallow pool's spot price.
An attacker pushed that price up, made collateral appear valuable, borrowed the other assets, and let the price fall again.
Chapter 15's formula calculates attack cost: shallower pools are cheaper to manipulate. Mature protocols use multiple-source medians, time-weighted prices, and borrowing caps for thin assets.
A large position borrowed stablecoins against an illiquid token. After prices fell, liquidators calculated that market depth could not absorb the collateral.
Nobody liquidated; the position deteriorated into eight-figure bad debt.
The lesson: liquidation depends on current depth, not headline capitalization. Chapter 15's four actions become a risk-control tool.
Demand spikes can keep utilization near 100% for days. Depositors see high APYs but cannot withdraw.
The steep rate curve works gradually. Borrowers chasing even higher subsidies may ignore the cost. High deposit APY and unavailable withdrawals often display the same underlying fact.
Change One Variable
Borrowers gain capital efficiency.
But 90% LTV leaves only a 5.3% cushion. Liquidators also lose room: little time and profit remain between triggering liquidation and collateral falling below debt.
High thresholds make sense mainly when collateral and borrowed assets are strongly correlated, such as stablecoin pairs or staking claims against underlying assets. Protocols use special parameter modes for this reason.
Borrowers avoid an extra charge.
Liquidators lose motivation: Gas and price risk without a discount make liquidation charity.
Liquidations may stop, leaving depositors with bad debt. The penalty pays the liquidator. Its size balances borrower cost and liquidation reliability.
Price risk is low, allowing high liquidation thresholds.
Risk shifts to a depeg of the collateral stablecoin. Chapter 13 distinguishes temporary liquidity depegs from reserve failures that may never recover.
If many people use the same collateral, its failure triggers mass sales through liquidation, accelerating the depeg. Chapter 21 calls this reflexivity.
It must restore the bank's task: evaluate borrower trustworthiness.
Off-chain identity and credit checks sacrifice permissionlessness. On-chain reputation must resist one person creating thousands of addresses. Guarantors merely move risk to another bearer.
This remains largely unsolved at scale. Overcollateralization is the automatically enforceable approach under the constraint of not knowing the counterparty.
Takeaway Questions
A strong reason for Blockchain is that collateralization, valuation, and liquidation must execute under shared rules that anyone can verify and join. Depending on one company for liquidation makes its failure a system failure; execution was the weak link in the 2020 incident.
Borrowers pay, depositors receive, and the protocol takes a share. This is unusually clear and traceable on-chain cash flow. Chapter 17 shows how rare it is: many on-chain yields lack such a clean source chain.
Liquidation penalties motivate liquidators. Too low means nobody arrives; too high overcharges borrowers. Inspect the number and ask whether it still attracts participants under the worst conditions.
Borrowers bear price risk and penalties; depositors bear inaccessible withdrawals and bad debt; the protocol has little capital at risk. The absence of shareholder backing is the most important balance-sheet difference.
Chapter Check
It exchanges credit risk for price and liquidation-execution risks.
Banks ask whether a person repays. Protocols ask whether someone can sell collateral promptly when it crosses the threshold.
Accurate prices, willing liquidators, and sellable collateral replace credit evaluation. Risk moves to different places and bearers.
Yes. Convert it into a decline.
Health = collateral value × threshold ÷ debt. At 1.1, roughly a 9% decline reaches 1.
Volatile assets can move 9% within a day, including while you sleep.
Convert health into tolerable decline and compare with the largest daily decline over 12 months. When intuition conflicts with arithmetic, intuition is usually wrong.
Borrowers fund interest, but not every deposited dollar is borrowed.
Supply rate ≈ borrow rate × utilization × (1 − protocol share).
At 50% utilization and a 10% share, 6% borrowing produces about 2.7% supply yield. Unborrowed cash earns nothing; the protocol takes another portion.
Conversely, similar supply and borrowing rates suggest near-100% utilization and difficult withdrawals. Read them together.
Liquidators usually sell collateral immediately to realize their discount rather than hold it.
Each sale hits finite depth, lowers prices, pushes more positions below health 1, and triggers further selling.
This is a reinforcing loop, with all positions sharing one price curve. Chapter 18 shows a faster version in perpetual contracts.
At minimum:
- Collateral settings: maximum LTV, threshold, penalty, and borrowing caps; watch illiquid collateral granted high LTV.
- Price sources: single source or median, spot or time-weighted, and restrictions for shallow assets.
- Rate model: kink, slopes, and current utilization.
- Parameter authority: multisig, governance, direct owner, and timelocks.
- Reserve size: whether it can absorb bad debt.
- Bad-debt history: public records and governance discussions.
- Stress test: use Chapter 15 to estimate liquidation volume after the largest collateral falls 50%; can the market absorb it?
The last step separates research from copied documentation. Even an honest inability to calculate it is a valuable recorded finding.
Key idea
Overcollateralization replaces credit risk with liquidation risk: exposure shifts from default to price and speed.