Lending protocol

Pooled supply, not matched loans

The design that made onchain lending work was giving up on matching. Rather than pairing a lender with a borrower on terms both agreed, suppliers put assets into a per asset pool and borrowers draw from it, with rates floating for everyone at once. Compound's original paper describes this as establishing money markets with algorithmically set interest rates based on supply and demand.¹

That removes the two things that make lending slow, which are negotiation and settlement, and it removes the one thing that makes lending safe, which is knowing who the borrower is. Every design decision downstream is a compensation for that missing information.

The capital involved is not small. DefiLlama's public API reported Aave V3 holding $13,829,558,845.14 on 3 August 2026.⁴ Treat that as a point in time reading across every chain the deployment runs on, not a fixed figure, and remember it says nothing about how much of any single asset can actually be withdrawn on a given day.

The interest rate is a readout of how full the pool is

Utilization is the one variable. Compound defines it as borrows divided by cash plus borrows, which collapses supply and demand for an asset into a single number between zero and one, and then expresses the borrow rate as a governance set curve over it. The illustrative version in the paper is 2.5% plus utilization times 20%.¹

The supply rate is derived, not set. It equals the borrow rate multiplied by utilization, which is why suppliers at 50% utilization on that curve earn 6.25% while borrowers pay 12.5%.¹ The gap is not a spread the protocol keeps. It is the arithmetic of half the pool sitting idle.

The design consequence is that withdrawal liquidity is an incentive rather than a commitment. When an asset gets scarce, utilization climbs, rates climb with it, and the rate is what is supposed to pull new supply in and push borrowers out. It usually works. When it does not, the people who wanted to withdraw find that the money is out on loan and the only thing they have is a very attractive yield.

Three parameters decide when your position gets closed

Aave V3 names them directly: loan to value, which sets how much can be borrowed against a given collateral; the liquidation threshold, which is the maintenance margin the position has to stay above; and the liquidation bonus, which is the discount a liquidator receives for doing the work. Its stablecoin efficiency category is configured at 97% LTV, a 98% liquidation threshold, and a 2% liquidation bonus.²

The health factor is the summary statistic those three produce, and below 1 a position is liquidatable. Aave V3 also allows a full liquidation once that figure drops under 0.95, on the grounds that partial closes on small positions were uneconomic at high gas costs.²

How much gets closed at once is a separate parameter again. Compound describes a close factor limiting how much of the debt any one liquidation may repay, given as 25% in its example, with the process repeating until the borrower is back inside their borrowing capacity.¹

So the interesting number for a borrower is not the loan to value they opened at. It is the distance between the current price and the price at which the health factor crosses 1, and how fast the collateral can travel that distance.

The oracle is the real dependency

Every one of those parameters is applied to a price the protocol did not observe. A lending protocol has no market of its own; it reads a feed, values the collateral, and acts. That makes the price feed a more load bearing component than the interest rate model, and it is where the documented failures cluster.

Aave V3's own risk documentation is unusually candid about this. It lists a sequencer on a rollup as holding significant power over users, able to reject supply and repay transactions during a crash and liquidate positions whose health factor falls below 1, removing the user's ability to defend themselves. The protocol's answer is a price oracle sentinel that introduces a grace period for liquidations and disables borrowing when the sequencer has been down.²

The same document lists an asset listing admin able to swap oracle sources, and a risk admin able to drop a liquidation threshold to zero and liquidate everyone atomically.² Those are governance powers, not bugs. Anyone treating a lending market as trustless infrastructure should read the list of roles first.

Overcollateralisation is the ceiling on the whole category

The BIS put the constraint plainly in its December 2021 review: lending in DeFi tends to be overcollateralised because of the inherent lack of trust in anonymous transactions and the volatility of crypto collateral, and the need for crypto collateral stands in the way of lending to households and businesses for house purchases or productive investment.³ The same review recorded outstanding loans across major lending platforms reaching $20 billion in late 2021.³

That is the honest boundary of the product. It is a leverage and liquidity tool for people who already hold crypto assets, not a credit system, and describing it as the latter oversells it to exactly the audience most likely to check.

The BIS also identified the second order problem, which is that assets borrowed in one place can be posted as collateral in another, building large exposure from a small base and amplifying forced selling when collateral values fall.³ Liquidations are procyclical by construction: they arrive in volume precisely when the market is least able to absorb them, and they land in the same pools whose depth is already thin.

What a token team settles before its asset gets listed as collateral

Getting listed on a lending market reads like a milestone and behaves like a liability transfer. Once a token is accepted as collateral, its price feed becomes a liquidation trigger, and every position opened against it becomes latent sell pressure on whatever venue the liquidators route through. That is usually your own pool.

The questions are not difficult and they rarely get asked. Is there a supply cap, because an uncapped listing lets borrowing scale past the depth backing it. Which oracle feeds the price, and how expensive is that feed to move against your real liquidity. How large is the liquidation bonus, since that is the discount your token gets sold at. Then run the cascade: if every position collateralised by your token were closed inside an hour, what does that do to the pool you seeded?

In our view teams underweight this because the listing itself is free and the consequence is deferred. The mechanism is fine. The question is whether the depth underneath it can absorb what the mechanism is allowed to trigger.