Liquidation Engine

The Health Factor (HF) is the primary metric determining liquidation risk, calculated as (Collateral Value * Liquidation Threshold) / Borrowed Value. A position becomes eligible for liquidation when its HF falls below 1.0. The Liquidation Threshold is the maximum Loan-to-Value (LTV) ratio at which collateral can be borrowed against before it becomes eligible for liquidation, providing a safety buffer below the initial LTV.

The automated process follows a deterministic sequence:

• Monitoring: Oracles update collateral and debt prices.
• Check: The engine calculates the Health Factor for all open positions.
• Trigger: Positions with HF < 1.0 are flagged for liquidation.
• Execution: A liquidator repays part or all of the debt in exchange for seized collateral at a discount.
• Resolution: The bad debt is cleared, and the protocol's solvency is maintained.

To ensure swift execution, protocols incentivize third-party liquidators with a liquidation bonus (or discount). This is a percentage discount on the collateral's market value granted to the liquidator who successfully repays the debt. For example, a 10% bonus means the liquidator repays $100 of debt to receive $110 worth of collateral. This mechanism ensures market efficiency and protocol safety.

Liquidation engines primarily use two models:

• Fixed-Price (Instant): The most common in DeFi. Collateral is sold at a predetermined discount via a public function anyone can call. Fast but sensitive to market volatility.
• Dutch Auction: The collateral price starts high and decreases over time until a liquidator accepts it. More capital efficient in illiquid markets but slower and more complex.
• English Auction: Multiple bidders compete, driving the price up. Rare due to high gas cost and latency.

Liquidations introduce systemic risks:

• Liquidation Cascades: Large, forced sales depress collateral prices, triggering further liquidations in a positive feedback loop.
• Bad Debt: Occurs when collateral value falls faster than liquidators can act, or the discount is insufficient to cover liquidation costs, leaving the protocol with unrecoverable debt.
• Oracle Risk: Price feed latency or manipulation can trigger unnecessary liquidations or prevent necessary ones.

Different protocols implement unique mechanisms:

• Compound/Aave: Use fixed-price liquidations with a health factor and public liquidate() function.
• MakerDAO: Historically used Dutch auctions (flip, flap, flop) via its MCD system.
• dYdX/Perpetuals: Use a margin-based model where positions are closed when maintenance margin is breached.
• Solana (MarginFi, Solend): Similar to Compound's model but optimized for Solana's parallel execution.

Liquidation engines create a competitive landscape where liquidators are incentivized by a liquidation bonus (e.g., 5-10% of the collateral). This competition often leads to MEV (Miner/Validator Extractable Value), where searchers use bots to win liquidation auctions via priority gas auctions, paying high transaction fees. This can:

• Front-run honest liquidators, centralizing profits.
• Cause network congestion and high gas fees for all users.
• Create systemic risks if incentives are misaligned, leading to under-collateralized positions going un-liquidated.

Liquidation triggers rely entirely on external price oracles. An attack on the oracle is an attack on the engine itself. Key risks include:

• Flash loan attacks to manipulate an oracle's spot price on a DEX.
• Oracle latency or staleness, where a lagging price fails to trigger a needed liquidation.
• Oracle centralization risk from relying on a single data source.
• Oracle front-running, where an attacker manipulates the price just before the oracle update to trigger unfair liquidations.

Flaws in the engine's economic or logical design can cause catastrophic failure. Examples include:

• Insufficient liquidation incentive leading to liquidation risk, where no one liquidates underwater positions.
• Overly aggressive liquidation thresholds causing premature liquidations during normal volatility.
• Improper handling of partial liquidations, potentially leaving positions still under-collateralized.
• Incorrect calculation of health factors or collateral ratios due to rounding errors or precision issues in smart contract math.

The engine's code is a high-value target for exploits. Critical vulnerabilities include:

• Reentrancy attacks during the collateral transfer and debt repayment process.
• Logic errors in the auction mechanism or collateral distribution.
• Access control flaws allowing unauthorized calls to liquidate functions.
• Gas limit issues where complex liquidation transactions run out of gas, failing to fully close the risky position and leaving bad debt.

During market-wide crashes, liquidation engines can exacerbate volatility and create systemic risk. This manifests as:

• Liquidation cascades: A wave of liquidations drives down collateral asset prices, triggering more liquidations in a positive feedback loop.
• Protocol insolvency: If the engine cannot liquidate positions fast enough or the collateral is illiquid, the protocol accrues bad debt.
• Contagion to other protocols using the same collateral assets or oracle feeds.
• Network congestion from a flood of liquidation transactions, making it harder for users to top up positions.

While automated, engines may have centralized points of failure:

• Pause mechanisms: Admin keys that can halt liquidations, potentially during a crisis to protect certain positions (or be forced to by regulators).
• Upgradability: Proxy contracts that allow logic changes could be used to alter liquidation rules maliciously.
• Keeper centralization: If liquidation is performed by a small set of privileged actors (keepers), they could collude or be compromised.
• Blacklisting: Engines that integrate with assets subject to regulatory sanctions may need to censor certain addresses, breaking permissionless guarantees.

The Liquidation Threshold is the specific collateralization ratio at which a position becomes eligible for liquidation. It is a risk parameter set by the protocol, typically expressed as a percentage (e.g., 85%). When a position's Loan-to-Value (LTV) ratio exceeds this threshold, the liquidation engine is triggered to close the position, ensuring the borrowed assets are repaid before the collateral's value falls below the debt value.

A Liquidation Penalty (or bonus) is an incentive paid to liquidators for executing a liquidation. It is a percentage discount applied to the seized collateral, allowing the liquidator to purchase it below market price. This mechanism ensures there is always economic motivation to keep the system healthy. The penalty is a cost borne by the liquidated borrower, making their position loss more severe than a simple market decline.

The Health Factor is a real-time metric that quantifies the safety of a collateralized debt position. It is calculated as (Collateral Value * Liquidation Threshold) / Borrowed Value. A health factor below 1.0 indicates the position is undercollateralized and subject to liquidation. Protocols often display this to users as a single number (e.g., 1.75), providing a clear gauge of their position's risk relative to the liquidation threshold.

A Liquidator is an entity (bot or user) that monitors the blockchain for undercollateralized positions and executes liquidation transactions. In return, they receive a liquidation penalty as a reward. Their automated, competitive activity is critical for the liquidation engine's efficiency, as they absorb bad debt and return the protocol to a solvent state. Without active liquidators, systemic risk would accumulate.

Maximum Loan-to-Value (Max LTV) is the highest borrowing ratio allowed when opening a new position, expressed as a percentage of the collateral's value. It is a more conservative parameter than the liquidation threshold, creating a safety buffer. For example, if Max LTV is 75% and the liquidation threshold is 80%, a user can borrow up to 75% of their collateral's value, but won't be liquidated until their LTV drifts above 80% due to market movements.

This refers to the two primary mechanisms for distributing seized collateral. Fixed Discount (or Fixed Spread): The liquidator instantly purchases collateral at a predefined discount (the liquidation penalty). Dutch Auction: The collateral is sold via a descending-price auction, starting above market value and decreasing until a buyer (liquidator) accepts. Each method has trade-offs in speed, capital efficiency, and market impact, affecting the liquidation engine's design.