Stealth Liquidation

Unlike traditional auction-based liquidations, stealth liquidations are executed automatically by keepers or liquidators who directly repay the borrower's debt in exchange for a portion of their collateral at a discount. This process occurs in a single transaction, bypassing public bidding wars. The key components are:

• Liquidation Incentive: A discount (e.g., 5-15%) on the collateral's value, paid to the liquidator.
• Health Factor: A numerical representation of a position's safety; liquidation triggers when it drops below 1.0.
• Close Factor: The maximum percentage of a position's debt that can be liquidated in a single transaction.

A core design goal is to reduce slippage and price volatility caused by large, predictable liquidation events. By allowing many liquidators to compete to fill small portions of an underwater position, the selling pressure is distributed. This contrasts with batch auction systems that can create predictable, large sell-offs, making the protocol and its users vulnerable to market manipulation and liquidation cascades.

The system relies on a decentralized network of keepers (bots or individuals) who monitor the blockchain for undercollateralized positions. They compete to be the first to submit a profitable liquidation transaction, earning the liquidation bonus. This creates a latency race, where keepers invest in infrastructure for low-latency transaction submission. Protocols like Aave and Compound use this model.

Two critical parameters govern the process:

• Liquidation Threshold: The loan-to-value (LTV) ratio at which a position becomes eligible for liquidation (e.g., 80% for ETH). It is set lower than the maximum LTV for borrowing.
• Liquidation Bonus (Penalty): The discount offered to liquidators, simultaneously acting as a penalty for the borrower. For example, a 10% bonus means the liquidator repays $100 of debt to receive $110 worth of collateral. This bonus covers the liquidator's gas costs and risk.

While the core mechanism is consistent, implementations vary:

• Fixed Discount Models: Use a static liquidation bonus (e.g., Compound).
• Dynamic Models: Adjust the bonus based on market conditions or the size of the shortfall.
• Isolated vs. Cross-Collateral: Some protocols liquidate only the specific asset that triggered the event, while others may use the borrower's entire portfolio.
• Gas Optimization: Advanced systems bundle liquidations or use flash loans to improve capital efficiency for keepers.

The model introduces specific risks:

• Keeper Centralization: The latency race can lead to infrastructure centralization among a few professional keepers.
• Gas Auction Wars: Keepers may engage in Priority Gas Auctions (PGAs), bidding up transaction fees, which can erode profits and congest the network.
• Liquidation Fairness: Small, unsophisticated borrowers may have less time to react compared to auction systems with longer time delays.
• Oracle Dependency: Entirely reliant on the accuracy and liveness of price oracles; a stale or manipulated price can trigger unnecessary liquidations.

In traditional DeFi, public mempools broadcast pending transactions. When a position becomes eligible for liquidation, searchers can see this and front-run the liquidation transaction. This leads to:

• MEV extraction at the borrower's expense.
• Gas price wars that congest the network.
• A toxic environment discouraging protocol use.

Stealth liquidation systems rely on private transaction relays or encrypted mempools. The liquidation trigger is sent directly to a trusted operator or a network of searchers via a private channel. Key steps include:

• Off-chain matching: The liquidation opportunity is matched with a solver confidentially.
• Commit-Reveal schemes: A transaction is submitted with its details hidden, only revealed after block inclusion.
• Direct RPC endpoints: Bypassing the public mempool entirely.

Some implementations use TEEs (like Intel SGX) to create a secure, verifiable black box for processing liquidation logic. The TEE:

• Receives the private state (e.g., unhealthy positions).
• Computes the liquidation logic confidentially.
• Signs and broadcasts the transaction directly to a validator. This ensures the liquidation is non-front-runnable and the computation is tamper-proof, though it introduces hardware trust assumptions.

Beyond user privacy, stealth liquidation enhances overall protocol resilience:

• Predictable Liquidation Costs: Removes volatile gas auctions, making keeper economics stable.
• Improved Borrower Experience: Reduces the 'liquidation penalty' exacerbated by front-running.
• Systemic Stability: Ensures liquidations execute reliably, protecting the protocol's solvency during volatility.
• Fairer Access: Levels the playing field for liquidation keepers.

A broader infrastructure for transaction privacy, of which stealth liquidation is a key use case. Projects like Shutter Network use threshold cryptography to encrypt transactions until they are included in a block. This prevents MEV extraction not just for liquidations, but for all trades and actions, representing a fundamental shift towards a private mempool future.

A stealth liquidation occurs when a lending protocol automatically sells a borrower's collateral to repay their debt after their health factor falls below a critical threshold (e.g., 1.0). Unlike traditional liquidations, it aims to execute via off-chain order flow or private mempools to prevent front-running and reduce price slippage. The process is triggered by keepers or liquidator bots who are incentivized by a liquidation bonus.

The primary benefit is reduced market impact. By hiding the intent to liquidate, protocols avoid signaling large sell orders to the public mempool, which prevents:

• Front-running by arbitrage bots.
• Excessive price slippage that erodes collateral value.
• Cascading liquidations that can lead to market instability. This protects both the protocol's solvency and remaining users from the negative externalities of public liquidations.

Protocols implement stealth features through specific infrastructure:

• Aave V3: Uses Flashbot's SUAVE or similar MEV-relay services for private transaction bundling.
• Compound Finance: Leverages keeper networks that submit transactions directly to validators.
• Morpho Blue: Native integration with private RPC endpoints and order flow auctions to obscure intent. The goal is to route the liquidation transaction through a channel not visible on the public peer-to-peer network.

Liquidators are essential actors who monitor positions and execute stealth liquidations. They are economically motivated by a liquidation bonus (or liquidation penalty), a discount at which they can purchase the collateral. For example, a 5% bonus means they repay 100% of the debt to seize collateral worth 105% of that debt. Their profitability depends on gas costs, bonus size, and their ability to execute transactions before competitors.

Liquidation is governed by two critical risk parameters:

• Health Factor (HF): HF = (Collateral Value * Liquidation Threshold) / Total Borrowed. A position becomes liquidatable when HF < 1.
• Liquidation Threshold: The maximum percentage of an asset's value that can be borrowed against (e.g., 80% for ETH).
• Liquidation Bonus: The incentive paid to the liquidator, added as a discount on the collateral (e.g., 5-15%). These parameters are set by protocol governance and vary by asset risk.

While reducing MEV, stealth liquidations introduce other considerations:

• Centralization Risk: Reliance on a few private relay services or keeper networks.
• Opaque Execution: Lack of transparency can make it difficult to audit liquidation fairness.
• Gas Auction Wars: Liquidators may still compete via priority gas auctions within private systems.
• Regulatory Scrutiny: Private transactions may attract attention regarding market fairness and transparency regulations.

A stealth liquidation is initiated when a borrower's health factor (or collateralization ratio) drops below 1.0 (or a protocol-specific safe threshold like 1.1). This is typically caused by:

• A sharp drop in the value of the collateral asset.
• A significant increase in the value of the borrowed asset.
• Accrued, unpaid interest on the loan. The process is automated by smart contract logic, removing the need for manual intervention and ensuring the protocol remains solvent.

The 'stealth' aspect refers to the transaction's execution path, designed to minimize market impact and protect the liquidator's profit. Instead of a public DEX swap, liquidators often use:

• Flash loans to atomically borrow, repay the debt, claim the collateral, and sell it.
• Private mempools (like Flashbots) to submit the transaction bundle directly to validators, bypassing the public mempool.
• MEV (Maximal Extractable Value) strategies to capture the liquidation bonus efficiently. This prevents front-running and reduces slippage, but can centralize liquidation profits among sophisticated bots.

For borrowers, stealth liquidations pose significant financial risks with little recourse:

• Total Loss of Collateral: The borrower loses the seized collateral, minus a liquidation bonus paid to the liquidator.
• No Warning: The event can occur suddenly during market volatility, as there is no grace period or alert.
• Remaining Debt: If the collateral sale doesn't cover the full debt (e.g., due to bad debt), the protocol may pursue the shortfall through other means, depending on its design.
• Network Congestion: During high volatility, gas price spikes can prevent borrowers from depositing more collateral or repaying debt in time to save their position.

While protecting the protocol, stealth liquidations can contribute to systemic risk:

• Cascading Liquidations: A large, stealthy liquidation can cause significant price impact on the collateral asset, potentially triggering a cascade of further liquidations in a death spiral.
• Bad Debt Accumulation: If liquidators are unwilling to participate (e.g., due to low profitability or high gas costs), underwater positions may go unliquidated, creating bad debt that threatens the protocol's treasury and native token.
• Oracle Manipulation: Sophisticated attacks may attempt to manipulate price oracles to trigger unjustified liquidations for profit.

Protocols and users employ several strategies to mitigate risks:

• For Protocols: Using robust, decentralized price oracles (like Chainlink), implementing circuit breakers or auction-based liquidation mechanisms, and maintaining conservative loan-to-value (LTV) ratios.
• For Borrowers: Maintaining a high health factor well above 1.0, using debt monitoring tools and alerts, avoiding maximum leverage, and diversifying collateral types to reduce correlation risk.

Understanding stealth liquidation requires familiarity with these core DeFi mechanisms:

• Health Factor: A numerical representation of a loan's safety, calculated as (Collateral Value * LTV) / Debt Value.
• Liquidation Bonus: The incentive (typically 5-15%) paid to liquidators from the seized collateral.
• MEV (Maximal Extractable Value): The profit extractable from reordering, including, or censoring transactions within blocks. Liquidations are a primary source of MEV.
• Flash Loan: An uncollateralized loan that must be borrowed and repaid within a single transaction block, enabling complex arbitrage and liquidation strategies.

A liquidation is the forced closure of an undercollateralized loan position in a DeFi protocol. It occurs when the value of a borrower's collateral falls below the protocol's required Loan-to-Value (LTV) ratio. A liquidator repays part of the debt and receives the collateral at a discount, ensuring the protocol remains solvent.

• Purpose: Protects the protocol from bad debt.
• Trigger: Health Factor or Collateral Ratio falls below a threshold.
• Example: On Aave, a position with a Health Factor below 1.0 can be liquidated.

The Health Factor (HF) is a numerical representation of a borrower's loan safety in protocols like Aave and Compound. It is calculated as (Collateral Value * Liquidation Threshold) / Total Borrowed Value.

• HF > 1: Position is safe.
• HF ≤ 1: Position is eligible for liquidation.
• Mechanism: A lower HF indicates higher risk. Stealth liquidation mechanisms often trigger based on small, precise breaches of this threshold to minimize the size of the liquidation event.

The Liquidation Threshold is the maximum Loan-to-Value (LTV) ratio at which a specific collateral asset can be borrowed against before it becomes eligible for liquidation. It is set by the protocol governance for each asset based on its volatility and liquidity.

• Key Differentiator: It is higher than the initial Maximum LTV used for borrowing.
• Function: Creates a buffer zone between the borrowing limit and the liquidation point.
• Example: If ETH has a Maximum LTV of 80% and a Liquidation Threshold of 82.5%, liquidation occurs when the LTV exceeds 82.5%.

The Liquidation Bonus (or discount) is the incentive paid to liquidators for participating in the liquidation process. The liquidator repays the borrower's debt and receives the underlying collateral at a value greater than the debt repaid.

• Purpose: Incentivizes a competitive liquidator network to keep the protocol healthy.
• Mechanism: A 5% bonus means the liquidator receives $1.05 worth of collateral for every $1.00 of debt repaid.
• Stealth Context: Smaller, more frequent stealth liquidations may use a fixed bonus to ensure economic viability for bots executing many small transactions.

Maximum Extractable Value (MEV) is the profit that can be extracted by reordering, including, or censoring transactions within blocks. In DeFi, liquidation MEV is a major category, where bots compete to be the first to liquidate a profitable position.

• Connection to Stealth: Traditional public mempool liquidations are highly competitive MEV opportunities. Stealth liquidation mechanisms, like Chainscore's, aim to mitigate this by using private transaction relays or on-chain randomness to reduce frontrunning and make the process fairer and less costly for the borrower.

An oracle is a service that provides external data (like asset prices) to a blockchain. In lending protocols, a price oracle is critical for determining the value of collateral and triggering liquidations.

• Function: Supplies the real-time price feed used to calculate Health Factors.
• Risk: Oracle manipulation or latency can cause incorrect liquidations.
• Stealth Context: The precision of stealth liquidations is dependent on highly reliable, low-latency oracles to accurately identify the exact moment a position becomes undercollateralized.