Skip to content
DeFi Reference

Pooled money markets

1. TL;DR

Section titled “1. TL;DR”

A money market pools deposits from many lenders into shared reserves, then lets borrowers draw against those reserves by posting other crypto assets as over-collateralization — nobody needs a credit check because the collateral, not a promise, backs the loan. Interest rates move automatically with how much of the pool is currently borrowed (utilization), and depositors receive a receipt token (Aave’s aToken, Kamino’s cToken, marginfi’s bank share) representing a growing claim on the pool. The same design appears on Ethereum (Aave, Compound, Morpho) and Solana (Kamino, marginfi, Save, Jupiter Lend), with the chain mostly changing how balances are stored, not the economic logic.

2. Explain it simply

Section titled “2. Explain it simply”

Analogy

Section titled “Analogy”

A money market is like a village grain co-op: farmers deposit surplus grain into a shared silo and get a receipt saying how much they’re owed; anyone in the village can borrow grain as long as they leave something valuable — a cart or livestock worth more than the grain — at the gate as security. The co-op charges a fee that rises the emptier the silo gets, and pays depositors a share of it. If a borrower’s collateral becomes worth less than what they owe, anyone can step in, hand back the borrowed grain, and walk off with the collateral at a discount.

ELI5

Section titled “ELI5”

Imagine a big shared piggy bank. People who have spare coins put them in and get a note saying how many coins they added. People who need coins can take some out, but only if they first hand over something else valuable — like a toy — worth more than what they’re borrowing, so the piggy bank never loses money. The fewer coins left in the bank, the more it costs to borrow, so people are encouraged to put coins back in when the bank runs low. If someone’s toy becomes worth less than the coins they owe, someone else can pay off their debt and keep the toy as a reward.

Step-by-step walkthrough

Section titled “Step-by-step walkthrough”

Scenario: Alice supplies USDC to a pooled market (illustrative numbers, modeled on Aave V3’s mechanics); Bob later borrows against ETH.

  1. Before any action. The USDC reserve holds 8,000,000 USDC supplied, 6,000,000 USDC already borrowed (utilization 75%). Alice holds 10,000 USDC in her wallet; Bob holds 5 ETH.
  2. Alice supplies. Alice deposits 10,000 USDC into the reserve. The protocol mints her 10,000 aUSDC (Aave) or an equivalent cToken/share (Kamino, marginfi) — a token whose exchange rate to USDC rises over time as interest accrues. Reserve state: 8,010,000 supplied, 6,000,000 borrowed, utilization drops slightly to 74.9%.
  3. Bob deposits collateral. Bob deposits 5 ETH as collateral. The protocol values it at the oracle price and applies a loan-to-value (LTV) ratio — say 80% — giving him borrowing power (see /lending/collateral-ltv-health/).
  4. Bob borrows. Bob borrows 6,000 USDC from the same reserve. Reserve state: 8,010,000 supplied, 6,006,000 borrowed, utilization ≈ 75.0%. Bob’s wallet: +6,000 USDC, and a variable-debt balance of 6,000 USDC that accrues interest.
  5. Time passes. A year later (holding utilization roughly constant for simplicity), Bob’s debt has grown with the borrow rate and Alice’s aUSDC balance has grown with the supply rate — she can redeem more USDC than she deposited, funded entirely by Bob’s interest payments net of any reserve factor the protocol keeps.
  6. Alice withdraws. Alice redeems her aUSDC for underlying USDC plus accrued interest, provided the reserve has enough unborrowed liquidity sitting idle to pay her out.

Common misconceptions

Section titled “Common misconceptions”
  • Myth: Money markets lend depositors’ money to specific named borrowers, like a bank loan. Reality: Deposits go into one shared reserve per asset; every depositor shares the pool’s borrowers pro-rata (Aave V3 overview docs, 2026-08).
  • Myth: Interest rates are set by the protocol team or negotiation. Reality: Rates are computed by a deterministic formula keyed to utilization — no human sets today’s rate (/lending/interest-rate-models/).
  • Myth: Borrowing is under-collateralized, like a bank overdraft. Reality: Every position across Aave, Kamino and marginfi must remain over-collateralized; a small number of protocols experiment with real under-collateralized credit, but that is not the pooled-market default (marginfi README, 2026-08 fetch, describes “overcollateralized lending” as the norm).
  • Myth: aTokens/cTokens are just accounting entries with no market risk. Reality: They inherit the reserve’s liquidity risk — at 100% utilization, withdrawals fail until borrowers repay, since the underlying tokens are lent out (Aave V3 technical paper, 2022-01, §1.1).
  • Myth: More assets a protocol lists, the safer it becomes. Reality: Aave’s own analysis found listing new assets into one aggregated pool exposes all of that pool’s liquidity to the new asset’s risk — precisely why Isolation Mode exists (Aave V3 technical paper, 2022-01, §2).

If you only remember one thing

Section titled “If you only remember one thing”

A money market is one shared, interest-bearing pool per asset; you borrow from the pool as a whole, and the rate you pay is a live readout of how much of that pool is currently lent out.

3. How it works

Section titled “3. How it works”

Utilization and the shared reserve

Section titled “Utilization and the shared reserve”

Each asset the market lists (USDC, ETH, SOL, …) has its own reserve: a pot of supplied liquidity plus a ledger of who has borrowed how much of it. Define utilization UU for a reserve as U=DA+DU = \frac{D}{A + D} where DD is total debt outstanding and AA is liquidity still idle in the reserve. UU is the single number both the interest-rate model (/lending/interest-rate-models/) and withdrawal availability depend on: at U→1U \to 1, further withdrawals or borrows revert until someone repays (Aave V3 technical paper, 2022-01, eq. 6).

Interest-bearing receipt tokens

Section titled “Interest-bearing receipt tokens”

When a lender supplies, the protocol mints a receipt token representing their share of the reserve. Two accounting styles exist among the sources for this page:

  • Rebasing balance (Aave aTokens). An aToken’s balance grows directly: 1 aUSDC deposited today becomes 1.00003 aUSDC tomorrow as the protocol’s internal liquidity index LtL_t increases, where a holder’s underlying claim is balance×Lt/Lt0\text{balance} \times L_t / L_{t_0}.
  • Appreciating exchange rate (Kamino cTokens, marginfi bank shares). The token balance stays fixed, but each token is redeemable for a growing amount of the underlying — Kamino’s docs describe reserves “minting cTokens (collateral tokens) to user” on deposit, with interest accrual updating reserve state every time it’s refreshed (Kamino architecture docs, 2026-08 fetch). marginfi tracks each user’s raw balance and multiplies it by a per-bank cumulative rate at settlement: “Sally’s $10 debt today accrues interest and grows to $11” while “Bob’s B is now worth $11” (marginfi README, 2026-08 fetch).

Both approaches are economically identical: whoever holds the receipt token when interest accrues captures a proportional share of it, with no separate claim step.

Collateral, LTV and liquidation in one sentence

Section titled “Collateral, LTV and liquidation in one sentence”

Every borrow is checked against a health factor — collateral value times a liquidation threshold, divided by debt value — and if it drops below 1 any address may liquidate part of the position for a bonus, full mechanics in /lending/collateral-ltv-health/ and /lending/liquidations/; this page only needs that borrowing power is a function of deposited collateral, not identity or history.

Isolating risk inside one pool

Section titled “Isolating risk inside one pool”

Because every reserve in an aggregated pool shares one collateral pool, a single bad asset can threaten the whole market. Aave V3 addressed this with Isolation Mode — an asset listed as collateral-only, capped by a hard USD debt ceiling, whose user cannot simultaneously use any other asset as collateral (Aave V3 technical paper, 2022-01, §4.2). Efficiency Mode (E-Mode) does the opposite for correlated assets, raising LTV/liquidation-threshold for a category (its own example: stablecoin E-Mode, 75%→97% LTV — Aave V3 technical paper, 2022-01, §3.1). marginfi calls this per-pair “Emode,” and Kamino “Elevation Groups” — isolated sub-markets with capped cross-collateralization (Kamino architecture docs, 2026-08 fetch).

4. Worked numeric example

Section titled “4. Worked numeric example”

Continue the Alice/Bob scenario from §2 with illustrative interest-rate parameters modeled on Aave’s published two-slope shape (not Aave’s actual live USDC parameters): Uoptimal=80%U_{optimal}=80\%, base rate R0=0%R_0=0\%, Rslope1=4%R_{slope1}=4\%, Rslope2=75%R_{slope2}=75\%, and reserve factor 10% kept by the protocol.

At U=75.0%U = 75.0\% (below optimal), the borrow rate is Rborrow=R0+UUoptimalRslope1=0%+0.750.80×4%=3.75%R_{borrow} = R_0 + \frac{U}{U_{optimal}} R_{slope1} = 0\% + \frac{0.75}{0.80}\times4\% = 3.75\% The supply rate is the borrow rate times utilization, minus the protocol’s cut: Rsupply=Rborrow×U×(1−reserve factor)=3.75%×0.75×0.90=2.53%R_{supply} = R_{borrow}\times U \times (1 - \text{reserve factor}) = 3.75\%\times0.75\times0.90 = 2.53\%

Over one year (ignoring compounding for simplicity and holding UU fixed):

  • Bob’s 6,000 USDC debt grows to 6,000×1.0375=6,2256{,}000\times1.0375 = 6{,}225 USDC — he owes 225 USDC in interest.
  • Alice’s 10,000 USDC deposit grows to 10,000×1.0253=10,25310{,}000\times1.0253 = 10{,}253 USDC.
  • Across the whole 8,010,000 USDC reserve at 2.53% supply APY, total interest paid to lenders is about 202,653 USDC for the year; total interest collected from all borrowers on the 6,006,000 USDC of debt at 3.75% is about 225,225 USDC; the roughly 22,572 USDC gap is the reserve factor kept by the protocol treasury.

If instead a sharp ETH sell-off pushed Bob’s health factor below 1, a liquidator could repay part of his 6,225 USDC debt and seize a proportional slice of his 5 ETH collateral at a liquidation bonus — worked through in full in /lending/liquidations/.

5. Where it’s used

Section titled “5. Where it’s used”

Ethereum

Section titled “Ethereum”
  • Aave V3 — the largest aggregated pooled market by design lineage described above; roughly $17.4B in deposits (secondary, DefiLlama, as of 2026-08, approximate). Isolation Mode and E-Mode both originate here. aave.com/docs
  • Compound — popularized the exchange-rate cToken accounting style pooled markets still use (Leshner & Hayes, “Compound: The Money Market Protocol,” 2019, cited in the Morpho Midnight whitepaper’s references).
  • Morpho — isolated, immutable one-collateral/one-loan-asset markets instead of one pool; roughly $9.55B (secondary, DefiLlama, as of 2026-08) — full treatment in /lending/modular-lending/.

Solana

Section titled “Solana”
  • Kamino Lend — reserves, obligations and a LendingMarket account modeled closely on Aave/Compound, with “Elevation Groups” for isolated sub-markets; roughly $1.1B in deposits (secondary, DefiLlama, as of 2026-08). docs.kamino.finance
  • marginfi (rebranded Project 0 / P0) — Groups → Banks → Accounts → Balances, distinguished by “cross-venue collateral” letting one margin account hold positions from other protocols like Kamino (marginfi/P0 docs, 2026-08 fetch); roughly $32M on its own lending banks (secondary, DefiLlama, as of 2026-08). docs.marginfi.com
  • Save (formerly Solend) — an “algorithmic, decentralized protocol for lending and borrowing on Solana” offering deposit interest, borrowing, and leveraged long/short (Save docs, 2026-08 fetch); center of the June 2022 governance incident in /lending/liquidations/. docs.save.finance
  • Jupiter Lend — “Earn Vaults” for depositors and “Borrow Markets” for collateralized borrowing: “Deposit into Earn vaults to earn yield, or use assets as collateral in Borrow markets to take out loans” (Jupiter developer docs, 2026-08 fetch). developers.jup.ag/docs/lend

6. Risks, attacks, and incidents

Section titled “6. Risks, attacks, and incidents”
  • Insolvency from correlated collateral crashes. Because all borrowers in an aggregated pool draw against the same liquidity, a sharp, correlated price move across many collateral types can leave liquidators unable to close positions before collateral value falls below debt, producing bad debt socialized across all lenders in that reserve.
  • Integration risk from listing exotic assets. Cream Finance, 27 October 2021 (Ethereum). An attacker used flash loans against Cream’s “Iron Bank” money market, exploiting how the AMP token’s ERC-777 transfer hooks interacted with Cream’s reentrancy guards to re-borrow against collateral that should already have been consumed, draining roughly $130M in assorted assets (as of 2021-10; Cream Finance’s own incident acknowledgment on Twitter/X, 2021-10-27, and widely corroborated post-mortems). It was Cream’s third exploit within a year. This exact mechanism — flash loans plus a reentrancy gap in a listing’s non-standard token behavior — is why Aave V3’s technical paper (2022-01, §1.2) singles out “careful review and audit process of any code update and governance proposal” as central to protocol safety.
  • Utilization-100% liquidity crunches. If utilization is driven to (or near) 100%, non-borrowing depositors cannot withdraw until debt is repaid or new liquidity arrives — a risk unique to shared-pool designs.
  • Oracle and admin-key attack surface inherited from the pool. Because reserves share collateral valuation logic, a single mispriced or manipulated oracle threatens every position in that reserve simultaneously; Aave V3’s own threat model lists a malicious oracle, risk admin, or pool admin as capable of draining or mispricing the entire market (Aave V3 technical paper, 2022-01, §4.7). See /oracles/oracle-manipulation/.
  • Cross-chain/bridge risk from liquidity-portability features. Aave V3’s Portal, which burns/mints aTokens across networks, requires governance to vet each bridge, since a flawed BRIDGE-role holder “may mint up to the unbacked cap and never back it, effectively allowing it to steal” from liquidity providers (Aave V3 technical paper, 2022-01, §4.7).

7. Open problems

Section titled “7. Open problems”
  • Capital efficiency vs. contagion isolation. Aave’s own V3 design notes frame this as an unresolved tension: aggregated pools maximize capital efficiency but concentrate risk, while isolated pools/pairs fragment liquidity and worsen UX for multi-asset borrowers (Aave V3 technical paper, 2022-01, §2). Isolation Mode and E-Mode are partial answers; V4’s Hub-and-Spoke is a further attempt (see /lending/modular-lending/).
  • Liquidity fragmentation across chains and markets. Aave’s V4 blog post frames the entire Liquidity Hub redesign around the observation that in V3 “liquidity in one market can’t be used to meet borrowing demand in another” (Aave, “Understanding Aave V4’s Architecture,” 2025-06-12).
  • Recourse when a liquidation or price feed is simply wrong. cc7768’s ethresear.ch framework argues pooled lending is “Fast DeFi” — instant, anonymous, but no recourse — and liquidated users “have no opportunity for recourse if the liquidation occurred at an inaccurate price” (ethresear.ch 11182, 2021-11-04); whether crypto-native insurance closes that gap remains unresolved (Paradigm, “Crypto-native Insurance,” 2020-08-11) — see /lending/risk-engines/.
  • Whether undercollateralized credit can ever join the pooled model. marginfi’s own README describes enabling “undercollateralized lending against a variety of assets,” yet every mechanism it documents still requires posted, over-collateralizing assets — an open framing gap across the industry (marginfi README, 2026-08 fetch).

8. Ethereum vs Solana

Section titled “8. Ethereum vs Solana”
AspectEthereumSolana
Flagship pooled marketsAave V3, CompoundKamino Lend, marginfi/P0, Save
Receipt-token accountingRebasing balance (aToken) or fixed-balance debt tokensFixed-balance cToken / bank shares with rising exchange rate
Isolated-risk mechanismIsolation Mode, siloed borrowing, per-market deploymentsElevation Groups (Kamino), isolated Banks/Risk Tiers (marginfi)
Oracle refresh modelPush oracles updated by keepers/Chainlink nodes; V3 Price Oracle Sentinel handles sequencer downtimeExplicit refresh_reserve/refresh_obligation instructions must run in the same or a very recent slot before any risk check
Cross-chain liquidityAave V3 Portal (bridge-based aToken burn/mint); V4 Liquidity Hub in developmentmarginfi’s cross-venue collateral lets one account use positions native to another Solana protocol as collateral directly

Both ecosystems converge on one core primitive — a shared reserve per asset, utilization-priced interest, over-collateralized borrowing, permissionless liquidation — but Ethereum’s slower blocks pushed it toward batching safety checks into oracle sentinels and portal-style bridges, while Solana’s sub-second slots let protocols like marginfi require a fresh oracle refresh inside the same transaction as any risk check.

9. Reference doc

Section titled “9. Reference doc”

The reference

Section titled “The reference”

Aave V3 Technical Paper — Emilio Frangella, Lasse Herskind (Aave), 27 January 2022. raw.githubusercontent.com/aave/aave-v3-core

Summary of the reference

Section titled “Summary of the reference”

The paper opens by grounding V3’s design in four goals — capital efficiency, protocol safety, decentralization, user experience — and diagnosing why Aave V2’s aggregated-pool design fell short of each. It notes Aave had reached “peak liquidity of $30 billion” with “close to $20 billion” sitting idle across networks generating yield only from borrowing activity, and argues that aggregating all collateral into one pool per network forces conservative, one-size-fits-all risk parameters (§1).

Section 2 evaluates the two alternative designs the market had already tried — isolated liquidity pairs and isolated liquidity pools — crediting each with lower gas costs and more permissionless listing, but faulting both for fragmenting liquidity, degrading borrower UX (multiple positions to manage), and skewing TVL toward riskier assets that pay more to attract fragmented liquidity.

Section 3 lays out V3’s answers. Portal lets aTokens be burned on one network and minted on another so liquidity can flow across Aave deployments ahead of the underlying bridge transfer completing. E-Mode groups correlated assets (stablecoins, ETH derivatives, BTC derivatives) into up to 255 categories, each overriding LTV/liquidation-threshold/bonus/oracle for borrowers who commit to borrowing only within that category — its worked example takes stablecoin LTV from a base rate to 97%. Isolation Mode lets governance list a new or exotic asset as collateral-only, capped by a hard USD debt ceiling, without exposing the rest of the pool. Section 3.2 adds supply/borrow caps, granular per-asset borrowing-power control down to 0% without forcing existing borrowers into liquidation, permissioned “risk admins” who can tune parameters without a full governance vote, an L2 Price Oracle Sentinel that adds a grace period after sequencer downtime, and a variable liquidation close factor allowing full liquidation once health factor drops below 0.95 (versus V2’s fixed 50% close factor).

Section 4 gives the technical detail: the E-Mode and Isolation Mode invariants, the reworked stable-rate formula that removes the old lending-rate oracle in favor of an algorithmic rate keyed to the ratio of stable to total debt, the Portal accounting equations that separate borrow-side and supply-side utilization once “unbacked” bridged aTokens exist, and the Price Oracle Sentinel’s grace-period logic. Section 4.7 closes with a full role-by-role threat model — what a malicious oracle, bridge, asset-listing admin, risk admin, emergency admin, pool admin, or ACL admin could each do if compromised, down to the observation that a compromised addresses-provider owner means “governance has fallen and it is game over.”

Key quotes

Section titled “Key quotes”

“Aave remains one of the biggest DeFi protocols, reaching peak liquidity of $30 billion.” (§1, Introduction)

“New liquidity protocols have sought to improve collateralization power while reducing risk by enabling either isolated pools or isolated pairs.” (§1.1, Reduce liquidity segregation)

“E-Mode allows borrowers to restrict themselves in borrowing only assets belonging to a certain category.” (§3.1, E-Mode)

“Borrowers supplying an isolated asset as collateral cannot supply other assets as collateral.” (§3.1, Isolation Mode)

“ADDRESSES PROVIDER: If the owner of the addresses provider is malicious governance has fallen and it is game over.” (§4.7, Threat Model)

How to read the original

Section titled “How to read the original”

Background needed: what LTV, liquidation threshold and utilization mean (covered in /lending/collateral-ltv-health/), and a rough sense of what Aave V2 looked like, since the whole paper is framed as “what V2 got wrong.” On a first pass, skip the stable-rate formula derivation in §4.4 (it only matters if you’re pricing Aave’s now-largely-deprecated stable-rate borrows) and the Portal accounting equations in §4.5 unless you’re specifically studying cross-chain liquidity design. The hardest paragraph is the E-Mode “Invariants” block in §4.1: it reads like a specification, but the key intuition is simpler than it looks — a user can only ever get the E-Mode discount when every asset they’ve borrowed is in the same declared category, and exiting requires the position to already be healthy without the discount.

What changed since

Section titled “What changed since”
  • Aave V4’s Hub-and-Spoke architecture (2025-06) replaces V3’s per-network, per-market siloed liquidity with one shared Liquidity Hub per network and permissionless “Spokes” for specialized use cases — see /lending/modular-lending/.
  • Aave’s own current docs (2026-08 fetch) describe additional V3-era features not in the 2022 paper, including ERC-4626 “Aave Earn Vaults” and reserve-level “Siloed Borrowing” that restricts a borrower of one asset from holding any other simultaneous borrow.
  • The paper’s stable-rate mechanism has become largely a legacy feature across Aave deployments as of the mid-2020s, with most borrowing using variable rates; Morpho’s Midnight protocol (2026-05) instead approaches “fixed rates” through a fully separate offer-matching market rather than an in-pool stable-rate formula (see /lending/interest-rate-models/).

Secondary references

Section titled “Secondary references”
  1. Aave V3 Overview docs (aave.com/docs/aave-v3/overview) — read if you want the current, plain-language description of supply/borrow/liquidation mechanics without the 2022 paper’s V2-comparison framing.
  2. Kamino Lending, “Protocol Architecture” docs — read if you want to see the same pooled-reserve design expressed as Solana account types (LendingMarket, Reserve, Obligation) instead of EVM storage slots.
  3. marginfi-v2 README (GitHub) — read if you want a second, more example-driven walkthrough of interest accrual, health factor and liquidation math with concrete dollar figures worked out.

10. Sources

Section titled “10. Sources”