Over-collateralized lending: how a loan is secured and closed

An over-collateralized loan is a loan secured by deposits worth more than the amount borrowed, made by a contract that never learns who the borrower is. There is no credit check, no recourse and no collections process, so the only protection the lenders have is the collateral itself and the speed with which it can be sold. Nearly every parameter in a lending protocol is a consequence of that one fact.

Why the collateral has to exceed the debt

A borrower in an open lending market is a key pair and nothing else. If the debt ever exceeds what the collateral will fetch, abandoning the position costs that borrower nothing further, so solvency depends entirely on closing positions before that point is reached. Over-collateralization is the price of the anonymity, and the size of the buffer is set by three things: how far the collateral price can travel before anyone acts, the discount a liquidator needs in order to take the asset and sell it, and the cost of the transaction that does the closing.

Thinly traded collateral needs a larger buffer on all three counts, because selling it moves its own price. That is why the same asset carries different terms in different markets, and why some venues accept a long list of collateral while others isolate each asset so that a failure in a minor token cannot reach the main pool. Deposit caps, borrow caps and isolated markets are all ways of bounding how much of an untested asset the solvency of everyone else depends on.

The arithmetic of a health factor

Two parameters govern each accepted collateral asset. The collateral factor caps how much may be borrowed against it at the moment the loan is opened. The liquidation threshold, set a little higher, is the level at which the position may be closed by anyone. The health factor compares the two sides:

health factor = (collateral value x liquidation threshold) / debt value

Take an illustrative position: five units of collateral priced at 2,000 each, a liquidation threshold of 0.825, and 4,000 units of stablecoin debt. The numerator is 10,000 x 0.825 = 8,250, so the health factor is 8,250 / 4,000 = 2.06. The position becomes liquidatable when the numerator falls to 4,000, which happens at a collateral price of 4,000 / (5 x 0.825) = 969.70, a decline of about 51.5 percent. Run in reverse, that is the only sense in which a liquidation price exists: it is an output of the parameters, not a level anybody selected.

Two details are routinely missed. First, the denominator moves too whenever the debt is not a stablecoin. Borrowing one volatile asset against another means both sides float, and in a broad sell-off they often float in the same direction at different speeds. Second, interest accrues continuously, so a position nobody touches still drifts downward: the debt grows every block while the collateral sits still.

What happens when the health factor reaches one

Liquidation is an open call rather than an internal process. Any address may repay part of the debt and receive collateral in return, valued at the price the protocol reads from its oracle, plus a bonus that is the liquidator's compensation. A close factor caps how much of the debt one transaction may repay, commonly half.

Continuing the example: at the trigger price the five units are worth 4,848.50 and the debt is 4,000. A liquidator repays 2,000 and receives 2,100 of collateral at a five percent bonus. The borrower is left with 2,748.50 of collateral against 2,000 of debt, a health factor of 2,748.50 x 0.825 / 2,000 = 1.13. The position is solvent again, and the bonus has been paid out of the borrower's equity.

The awkward case is a price that gaps in a single block far enough that the collateral no longer covers the debt even before the bonus. No liquidator will act at a loss, so the shortfall becomes bad debt sitting on the protocol, absorbed by accumulated reserves or an insurance fund where one is funded, and otherwise by the suppliers, whose deposits are no longer fully backed. Because each liquidation sells collateral into a market that has just fallen, one round of forced selling can carry the price to the level that triggers the next, which is what a cascade liquidation is.

Where the interest rate comes from

Rates are set by a formula, not by a committee. Utilization is the share of supplied assets currently borrowed, and the borrow rate is a kinked function of it: gently sloping while utilization is moderate, then steepening sharply past a target level so that the last available units become expensive to borrow. The supply rate is derived from the borrow rate rather than set separately, roughly borrow rate x utilization x (1 minus the reserve share), which is why it is always the lower of the two and why it collapses when few people are borrowing.

This has a consequence worth stating plainly: a high supply rate is a report about high utilization, and high utilization is exactly the state in which a withdrawal may not be possible, because the assets are out on loan. That is liquidity risk in its simplest form, and it is not visible in the rate itself. The reserve share is the closest thing here to protocol revenue, and the word does not carry its corporate meaning: there is no consolidated entity, no cost of goods sold, no tax line and no audited statement behind it, only a fee split written into a contract that a governance vote can change. Reading 30-day revenue next to total value locked reports how much of the deposited base is in use, and says nothing about whether the reserve can absorb a loss.

The failure modes that have nothing to do with price

• The price feed itself. A lending market does not know what anything is worth; it knows what its oracle reports, and a manipulated or stale feed produces liquidations that should not happen, or loans that should not be made.
• Atomic manipulation. A flash loan removes the capital requirement for moving a thin market, so the cost of distorting a price for one block can be much smaller than the sum borrowable against the distorted value.
• Upgrade authority. Most contracts can be changed by someone, and upgradeability risk means the code audited last year is not necessarily the code holding the collateral today.
• Code. Smart contract risk is not diversified away by having several markets, because the same libraries and the same patterns are reused across them.

The total value locked page shows deposit bases across lending markets and how quickly they move, the risk section collects the parameters and dependencies described here, and the incident record catalogs what happened the last several times a buffer proved too small. The article on oracles later in this track goes into the price feed problem in detail.