Liquidations

1. TL;DR

A liquidation is the mechanism that keeps a lending pool solvent once a borrower’s health factor drops below 1: a third party (a “liquidator,” usually a bot) repays part or all of the borrower’s debt and, in exchange, seizes collateral worth more than what they repaid — the discount is their incentive to act fast. Protocols differ mainly in how that discount and repayable amount are set: Aave and Kamino use a fixed liquidation bonus with a variable close factor, MakerDAO-style systems run a Dutch auction that lowers the price until someone bids, and Curve’s crvUSD instead avoids one-shot liquidation entirely with a continuous, reversible “soft liquidation” (LLAMMA). When no liquidator arrives in time, or collateral is worth less than the debt it secures, the shortfall becomes bad debt that the protocol must absorb or socialize.

2. Explain it simply

Analogy

A liquidator is like a tow-truck operator working a repossession lot: if you stop making car payments and your car’s resale value falls close to what you still owe the bank, anyone with the cash can pay off your remaining loan and drive the car away at a discount, as a reward for doing the bank’s collections work instantly instead of waiting for a court process. A Dutch-auction version is the same idea run as a clearance sale: the price of the repossessed car drops every few minutes until somebody finally decides it’s cheap enough to buy.

ELI5

If you borrowed coins using your toy as security, and your toy becomes worth barely more than what you owe, anyone can step in, pay off some of what you owe, and take your toy home at a discount as a reward. This has to happen fast, because if nobody does it in time and the toy becomes worth less than what you owe, the piggy bank itself loses money. Some piggy banks slowly sell off a little bit of your toy at a time as it loses value, instead of taking the whole thing at once, so that if the toy’s value comes back up, you get to keep more of it.

Step-by-step walkthrough

Continuing Bob’s position from /lending/collateral-ltv-health/: 5 ETH collateral, 9,000 USDC debt, LTV 80%/liquidation threshold 85%, liquidation bonus 5%, and (illustrative) close factor 50%.

1. Before liquidation (state: HF = 0.897). ETH has fallen to $1,900. Collateral value $9,500; debt $9,000. Bob’s position is liquidatable but untouched.
2. A liquidator bot detects the position. Liquidator bots continuously scan for HF < 1 across all open positions — this is a purely mechanical, permissionless race, not something the borrower is notified about in advance.
3. Liquidator repays part of the debt. With a 50% close factor, the liquidator may repay up to $4,500 USDC of Bob’s debt in one transaction.
4. Liquidator seizes collateral at a bonus. At $1,900/ETH and a 5% bonus, the liquidator receives collateral worth $4,500 × 1.05 = $4,725, i.e. $4,725 / $1,900 ≈ 2.487 ETH.
5. After liquidation (state update). Bob’s debt: $9,000 − $4,500 = $4,500. Bob’s collateral: 5 − 2.487 = 2.513 ETH, worth $4,775 at $1,900/ETH. New$HF = \dfrac{4{,}775\times0.85}{4{,}500} = 0.902$ — still just under 1, so a second liquidation of up to 50% of the remaining debt can follow immediately if no price recovery or top-up occurs.
6. The liquidator’s profit. They spent $4,500 USDC and received $4,725 of ETH — a $225 profit (before gas), realized the moment they sell the ETH back to USDC on the open market.

Common misconceptions

• Myth: Liquidation seizes all of a borrower’s collateral. Reality: Most protocols cap repayable debt per call via a “close factor” — Aave V2 fixed this at 50%; V3 made it variable, allowing full liquidation only “when the position approaches insolvency (HF < 0.95)” (Aave V3 technical paper, 2022-01, §3.2).
• Myth: Liquidators are the protocol team, or need special permission. Reality: Liquidation is permissionless — marginfi’s docs state plainly “liquidation is open to third parties, and encouraged” (marginfi README, 2026-08 fetch).
• Myth: A liquidation bonus is pure profit. Reality: The liquidator still sells seized collateral, pays gas, and races other bots; net profit is the bonus minus all that, which is why liquidation bots are often flash-loan-funded (/lending/flash-loans/).
• Myth: If a position is liquidated, the protocol always comes out whole. Reality: If collateral falls below debt before any liquidator acts, the protocol is left with bad debt, socialized or covered by an insurance fund.
• Myth: Soft liquidation (LLAMMA) means no liquidation actually happens. Reality: Collateral genuinely converts to the stablecoin as price falls through a band; it happens gradually and reverses on recovery, rather than being one-shot and irreversible (LlamaRisk, secondary, accessed 2026-08-29).

If you only remember one thing

Liquidation is a race, open to anyone, to repay someone else’s under-collateralized debt in exchange for their collateral at a discount — and the whole design exists to make that race happen before the discount stops covering the protocol’s downside.

3. How it works

Liquidation flow in a pooled lending market: an oracle price drop pushes health factor below 1, a liquidator repays debt and seizes collateral at a bonus, and unrecovered shortfalls become bad debt.

Fixed-bonus liquidation (Aave, Kamino, marginfi)

When $HF < 1$, a liquidator calls a liquidation function specifying how much debt to repay (bounded by the close factor) and which collateral to seize. Collateral seized, in the debt asset’s units, is

$$\text{collateral}_{seized} = \text{debt}_{repaid} \times \frac{p_{debt}}{p_{collateral}} \times (1 + b)$$

where $b$ is the liquidation bonus (e.g. 5%). Kamino names this directly: liquidate_obligation_and_redeem_reserve_collateral “validates obligation is underwater,” then the “liquidator repays portion of debt” and “receives collateral at discount” (Kamino architecture docs, 2026-08 fetch). Aave V3’s variable close factor refines V2: above $HF = 0.95$ a liquidator can only close 50% per call, but below that the position “can be liquidated entirely” in one call, since partial liquidation is unlikely to restore health anyway (Aave V3 technical paper, 2022-01, §3.2).

Dutch-auction liquidation (MakerDAO lineage)

An alternative to a fixed bonus is to let price discovery set the discount: start an auction for the seized collateral at (or above) its oracle price, and let the price fall over time until a bidder accepts it — avoiding a hardcoded bonus that’s too small in a crash or too generous in a calm market, at the cost of depending on enough bidders being able to actually bid before the auction clears. MakerDAO’s own “Black Thursday” (12 March 2020) is the canonical cautionary tale: ETH fell roughly 43% intraday, gas prices spiked, and Maker’s keeper bots — not tuned for the fee spike — were crowded out, letting at least one bidder win auctions at a bid of literally $0, worth a reported $8.32M in ETH (as of 2020-03), contributing to roughly $4M in system-wide bad debt (secondary: CoinDesk, 2020-07; accessed 2026-08-29 — no MakerDAO primary blog page was reachable). The episode is widely cited as the reason zero-bid protection became standard in auction-based liquidation systems.

Continuous, reversible soft liquidation (Curve crvUSD’s LLAMMA)

Curve’s Lending-Liquidating AMM Algorithm (LLAMMA) reframes liquidation as a continuous AMM process. Collateral sits in price “bands,” and as the oracle price falls through a band, the AMM gradually converts collateral into the stablecoin; critically, “if the prices of users’ collateral assets start to recover… it will automatically start to buy back the collateral it sold” (secondary: LlamaRisk, “A Primer on Curve Lending,” accessed 2026-08-29). Band width is set by an amplification factor $A$ — “a higher value of A results in narrower price bands” — and the number of bands $N$ trades maximum LTV against how gradual the conversion is (LlamaRisk, accessed 2026-08-29). Because conversion reverses on recovery, a borrower never fully “soft-liquidated” through all their bands can end up back where they started, unlike an irreversible fixed-bonus or auction liquidation.

Keeper bots and the liquidation race

All three designs rely on someone submitting the liquidation transaction fast enough. Specialized “keeper” bots monitor every position’s health factor continuously and race each other — often using flash loans to source repayment capital without idle balance sheet — for inclusion in the block where a position first crosses threshold, making liquidation a MEV-adjacent activity (see /mev/mev-taxonomy/).

Bad debt and insurance funds

If collateral value falls below debt value before liquidation completes, the position becomes bad debt: a permanent shortfall absorbed somewhere — socialized pro-rata across remaining suppliers, drawn from a safety module/insurance fund, or written off for an isolated market’s lenders. Morpho Midnight’s bad-debt accounting reduces “lenders’ credit proportionally” the moment a liquidator’s action reveals the shortfall (Morpho Midnight whitepaper, 2026-05, §4.5), faster than protocols waiting for full collateral seizure. See /lending/risk-engines/ for how protocols size these buffers.

4. Worked numeric example

The full arithmetic is worked in §2’s walkthrough (Bob: 4,500 USDC repaid, 2.487 ETH seized, $225 profit before gas, $HF ≈ 0.902$). Extending it: since Bob’s $HF$ is still below 1, a second liquidator can repay up to 50% of the remaining 4,500 USDC — $2,250 — seizing $2,250 × 1.05 / \text{\textdollar}1{,}900 ≈ 1.243$ ETH, leaving Bob with 1.27 ETH and $2,250 debt, $HF \approx 0.911$. Absent recovery or a top-up, this cascades: each fixed-percentage close factor leaves the position just as unhealthy relative to its (smaller) debt, which is why Aave V3 lets close factor jump to 100% below $HF = 0.95$ (Aave V3 technical paper, 2022-01, §3.2).

5. Where it’s used

Ethereum

• Aave V3 — fixed liquidation bonus per reserve, variable close factor (50% above $HF=0.95$, up to 100% below it), plus a Price Oracle Sentinel granting a grace period on L2s after sequencer downtime (Aave V3 technical paper, 2022-01, §3.2, §4.6).
• MakerDAO/Sky — the original Dutch-auction liquidation design, whose 2020 failure mode is described above; full peg context in /stablecoins/cdp-stablecoins/.
• Curve crvUSD (LLAMMA) — continuous, reversible soft liquidation via bands, described above; full stablecoin context in /stablecoins/cdp-stablecoins/.

Solana

• Kamino Lend — liquidate_obligation_and_redeem_reserve_collateral implements the same fixed-bonus pattern as Aave, gated by a mandatory reserve/obligation refresh in the same or a very recent slot (Kamino architecture docs, 2026-08 fetch).
• marginfi (rebranded Project 0 / P0) — third-party liquidation “netting a small profit (2.5-10%),” per the worked example in /lending/collateral-ltv-health/ (marginfi README, 2026-08 fetch).
• Save (formerly Solend) — the protocol at the center of the governance incident below; docs describe borrowing and leverage but not specific liquidation-parameter numbers (Save docs, 2026-08 fetch).
• Jupiter Lend — implements collateralized borrowing per its own docs, but the fetched excerpt did not detail liquidation mechanics (Jupiter developer docs, 2026-08 fetch).

6. Risks, attacks, and incidents

• Solend “whale” liquidation crisis, 19–20 June 2022 (Solana). A single anonymous borrower had deposited roughly 95% of Solend’s entire SOL pool and represented about 88% of its USDC borrows (as of 2022-06); as SOL’s price approached the account’s liquidation price, a real liquidation risked triggering a disorderly sell-off cascading through the whole protocol. Solend’s governance blog put it directly: “with the way things are trending with the whale’s unresponsiveness, it’s clear action must be taken to mitigate risk” (Solend governance blog, “SLND1,” 2022-06). The community passed SLND1 (97% approval), granting Solend Labs emergency power to liquidate the account via off-exchange OTC trades — a decision Delphi Labs’ Gabriel Shapiro called “contrary in every way to the DeFi ethos” (secondary: CoinDesk, 2022-06-20). Within a day, SLND2 (99.8% approval) reversed it and lengthened the governance voting window from 6 hours to 1 day (secondary: CoinDesk and Cointelegraph, 2022-06-20). No funds were ultimately lost, but the episode remains the clearest demonstration that a single outsized position can force a protocol to choose between disorderly on-chain liquidation and an emergency governance action undermining liquidation’s “no special permissions” premise.
• MakerDAO Black Thursday, 12 March 2020 (Ethereum) — described in §3; the canonical example of Dutch-auction liquidation failing when congestion prices out honest bidders.
• Liquidation cascades. Each partial liquidation that fails to fully restore health invites another, and in a broad crash many positions cross threshold simultaneously, competing for the same block space and downstream liquidity — amplifying the triggering price move.
• Oracle-price gaps and stale feeds. If the last confirmed price is materially stale, collateral can be seized at a price the market has moved past, or liquidations delayed until damage compounds — the problem Aave V3’s Price Oracle Sentinel softens (Aave V3 technical paper, 2022-01, §4.6).
• Liquidator concentration. If a small number of well-capitalized bots dominate liquidation flow, protocol solvency during a crisis depends on their continued participation — a centralization risk cutting across every design surveyed here.

7. Open problems

• How to size a liquidation bonus that is neither too small (bad debt) nor too large (needless borrower loss). Aave’s move to a variable close factor tied to $HF < 0.95$ is an efficiency fix, not proof the new thresholds are optimal for every asset (Aave V3 technical paper, 2022-01, §3.2).
• Whether soft liquidation generalizes beyond a single AMM-native design. LLAMMA’s reversible model is tightly coupled to Curve’s own AMM infrastructure; whether it can be bolted onto a conventional pooled market without an AMM is not addressed by this page’s sources (secondary: LlamaRisk, accessed 2026-08-29).
• Recourse for a mispriced or unfairly timed liquidation. cc7768’s ethresear.ch framework lists “incorrect liquidations due to manipulated prices” as a founding example of DeFi’s recourse gap (ethresear.ch 11182, 2021-11-04).
• What to do when a single position is simply too big to liquidate safely. Solend’s ad hoc governance answer leaves open whether a pre-committed mechanism (size caps, forced gradual unwind, insurance-backed OTC) should exist before the next such position appears.

8. Ethereum vs Solana

Aspect	Ethereum	Solana
Dominant liquidation design	Fixed bonus (Aave), Dutch auction (Maker), continuous soft liquidation (Curve LLAMMA)	Fixed bonus with combined liquidator + insurance fee (marginfi, Kamino)
Oracle staleness handling	Price Oracle Sentinel grace period on L2 sequencer downtime	Mandatory refresh_reserve/refresh_obligation in the same or very recent slot before any liquidation check
Worst documented failure mode	MakerDAO Black Thursday, 2020-03-12 — zero-bid auctions under gas-price congestion	Solend whale crisis, 2022-06-19 — governance forced to choose between disorderly liquidation and emergency account takeover
Structural mitigation for oversized positions	Supply/borrow caps set by governance (Aave V3)	No documented pre-committed mechanism in this page’s sources; Solend’s response was ad hoc governance action

Both ecosystems converge on the same liquidator-race mechanic, but their worst documented failures differ in kind: Ethereum’s was a price-discovery breakdown under congestion (Maker’s auctions clearing at zero), while Solana’s was a position-sizing breakdown — the mechanism would have worked but was judged too disruptive to let run, forcing a one-off governance intervention instead.

9. Reference doc

The reference

Aave V3 Technical Paper — Emilio Frangella, Lasse Herskind (Aave), 27 January 2022. raw.githubusercontent.com/aave/aave-v3-core

Summary of the reference

Liquidation appears throughout the paper as both a risk-management feature and a threat-model concern. §3.2 (“Risk Management”) introduces the “variable liquidation close factor” as a fix to Aave V2’s rigid 50%-of-position cap, noting this had “shown to be inefficient in many cases, especially with high transaction fees and/or small positions,” and sets the new rule: full liquidation becomes possible once a position approaches insolvency, defined precisely as $HF < 0.95$. The same section introduces the Price Oracle Sentinel, designed for L2 sequencer downtime, which “introduces a grace period for liquidations and disables borrowing under specific circumstances” so that a backlog of stale-priced positions isn’t liquidated the instant a sequencer comes back online.

§4.6 details the Sentinel mechanically: while a sequencer is down, oracle price feeds cannot update (since updates are themselves transactions), so the entire price move that happened during the outage lands all at once when service resumes — a “slow flash crash” risk. Aave’s fix is a grace period after sequencer recovery during which only positions already below $HF = 0.95$ can be liquidated; less-damaged positions ($0.95 < HF < 1$) get time to recover or top up before becoming liquidatable, and borrowing is disabled throughout the grace period.

§4.7’s threat model treats liquidation-adjacent roles explicitly: a compromised Risk Admin “can drop the Liquidation Threshold to 0 and liquidate users,” potentially “atomically in the same transaction or bundle,” and a compromised Emergency Admin, timed with a market crash, could “pause the pool, or unpause an insecure pool,” then “turn on - liquidate - turn off” to become the sole liquidator of an entire market. These aren’t liquidation bugs so much as a candid acknowledgment that the liquidation mechanism’s fairness depends on Aave’s access-control roles behaving honestly.

Key quotes

“In Aave V2, liquidations can only liquidate half of the position at any time. This has shown to be inefficient in many cases, especially with high transaction fees and/or small positions.” (§3.2, Variable liquidation close factor)

“In V3, this mechanism has been improved to allow the position to be fully liquidated when it approaches insolvency (HF < 0.95).” (§3.2, Variable liquidation close factor)

“As long as the position is not heavily undercollateralized (0.95 < HF < 1), it will have grace period starting at the time the sequencer comes up until it can be liquidated.” (§4.6, Price Oracle Sentinel)

“RISK ADMIN: The attacker can drop the Liquidation Threshold to 0 and liquidate users. This can be done atomically in the same transaction or bundle.” (§4.7, Threat Model)

“EMERGENCY ADMIN: The attacker can pause the pool, or unpause an insecure pool. Timed with a market crash, the attacker can turn the pool off, and then atomically perform the sequence (turn on - liquidate - turn off), allowing him to be the sole liquidator.” (§4.7, Threat Model)

How to read the original

Background needed: health factor and liquidation threshold from /lending/collateral-ltv-health/, and a basic sense of how L2 sequencers queue transactions if you want §4.6 to make sense. Skip §4.4’s stable-rate formula and §4.5’s Portal accounting on a first pass — neither touches liquidation directly. The hardest paragraph is the Emergency Admin attack in §4.7: the subtlety is that pausing and unpausing are each individually reasonable safety tools, and the attack only exists because both actions plus liquidation can be sequenced atomically within one transaction or MEV bundle, turning three legitimate powers into a way to seize a market’s collateral with zero competition. Note that this paper covers Aave’s fixed-bonus design only — LLAMMA’s own primary whitepaper text was not retrievable at time of writing (Curve’s docs site returned an access-blocked response to automated fetching), so treat the LLAMMA description in §3 as a secondary-sourced summary (LlamaRisk, accessed 2026-08-29) rather than a primary-quoted one if you need band-parameter formulas for implementation purposes.

What changed since

• Curve’s LLAMMA (crvUSD, live since 2023) is itself a post-Aave-V3, post-Black-Thursday design explicitly built to avoid both the fixed-bonus cascade risk and the Dutch-auction zero-bid risk this reference documents and this page’s history section covers.
• Morpho Midnight’s bad-debt realization (2026-05) tightens the timing question this reference doesn’t address at all — Aave’s threat model discusses who can cause bad debt, not when a loss is formally recognized once it exists.
• The Solend whale incident (2022-06) postdates this paper and demonstrates a liquidation failure mode — a single position too large to liquidate through normal market mechanisms — that Aave’s threat model, focused on malicious insiders and oracle failure, does not anticipate.

Secondary references

1. LlamaRisk, “A Primer on Curve Lending” — read if you want LLAMMA’s band/amplification-factor mechanics explained in more depth than this page’s summary.
2. Kamino Lending, “Protocol Architecture” docs — read if you want the Solana-side instruction-level view of a fixed-bonus liquidation (liquidate_obligation_and_redeem_reserve_collateral).
3. CoinDesk, “Solend’s Whale Liquidation Crisis Prompts Second Vote to Reverse ‘Emergency Powers’” (2022-06-20) — read if you want the fullest contemporaneous account of the SLND1/SLND2 governance sequence.

10. Sources

• Aave V3 Technical Paper — Emilio Frangella, Lasse Herskind (Aave) — 2022-01-27 — https://raw.githubusercontent.com/aave/aave-v3-core/master/techpaper/Aave_V3_Technical_Paper.pdf
• Protocol Architecture — Kamino Lending docs — fetched 2026-08-29 — https://www.mintlify.com/kamino-finance/klend/concepts/architecture
• marginfi-v2 README (“Project 0”) — mrgnlabs (GitHub) — fetched 2026-08-29 — https://raw.githubusercontent.com/mrgnlabs/marginfi-v2/main/README.md
• Morpho Midnight Whitepaper — Bhatt, Frambot, Garchery, Gontier Delaunay, Husson, Nicole, Laversanne-Finot, Lesbre (Morpho Association) — 2026-05 — https://morpho.org/whitepapers/midnight-whitepaper.pdf
• DeFi: Recourse and tail risks — cc7768 (ethresear.ch) — 2021-11-04 — https://ethresear.ch/t/defi-recourse-and-tail-risks/11182
• Save (formerly Solend) docs — fetched 2026-08-29 — https://docs.save.finance/
• Jupiter Lend developer docs — fetched 2026-08-29 — https://developers.jup.ag/docs/lend
• SLND1: Mitigate Risk From Whale — Solend governance blog — 2022-06 — https://blog.solend.fi/slnd1-mitigate-risk-from-whale-1504285ab4d2
• Solend’s Whale Liquidation Crisis Prompts Second Vote to Reverse ‘Emergency Powers’ — CoinDesk (secondary) — 2022-06-20 — accessed 2026-08-29 — https://www.coindesk.com/business/2022/06/20/solends-whale-liquidation-crisis-prompts-second-vote-to-reverse-emergency-powers
• Solend invalidates Solana whale wallet takeover plan with second governance vote — Cointelegraph (secondary) — 2022-06-20 — accessed 2026-08-29 — https://cointelegraph.com/news/solend-invalidates-solana-whale-wallet-takeover-plan-with-second-governance-vote
• A Primer on Curve Lending — LlamaRisk (secondary) — accessed 2026-08-29 — https://www.llamarisk.com/research/curve-lending
• Mempool Manipulation Enabled Theft of $8M in MakerDAO Collateral on Black Thursday: Report — CoinDesk (secondary) — 2020-07-22 — accessed 2026-08-29 — https://www.coindesk.com/tech/2020/07/22/mempool-manipulation-enabled-theft-of-8m-in-makerdao-collateral-on-black-thursday-report