Cowrie Research

liquidation-auction-liveness-failure

16 min read

Liquidation Auction Liveness Failure / Keeper Participation Collapse

  • Name: Liquidation auction liveness failure / keeper participation collapse
  • Category: exploit pattern / liquidation-design failure / auction-liveness risk / offchain-participant dependency
  • Summary: Liquidation auction liveness failures break systems that assume stressed collateral can always be sold into a competitive market quickly enough to restore solvency. The protocol outsources rescue to keepers, searchers, or auction bidders, but under the exact conditions when liquidations matter most — price shock, oracle lag, mempool congestion, capital scarcity, or brittle bot logic — honest participants disappear or get stuck. If the auction design also permits pathological opening bids, short timers, or thin bidder sets, a surviving bidder can seize collateral at absurd discounts and convert a liquidation engine into a bad-debt or collateral-confiscation machine. The preserved invariant is sharper than liquidations exist: the system has to stay economically sane even if only one bidder, or one class of bidder, can still transact during the stress window.
  • What it is:
    • A lending or stablecoin system relies on external actors to notice unsafe positions, fund bids, and compete in auctions.
    • The protocol assumes that offchain participation will remain live and price-discovering during systemic stress.
    • A market shock or infrastructure failure causes many liquidations at once while also making keeper participation harder.
    • The auction mechanism still advances even when there is little or no real competition.
    • The resulting clear price is not an honest distressed-market price; it is a liveness failure monetized by whoever can still get transactions through.
  • Typical preconditions:
    • Liquidations depend on external keepers or bidders rather than protocol-owned backstops.
    • Auction design allows very low opening bids, weak reserve pricing, or first-bid capture when competition is absent.
    • Bid windows are short relative to stressed blockspace conditions or funding frictions.
    • Keeper bots rely on brittle gas strategies, nonce handling, or centralized infrastructure that fails under congestion.
    • Price updates, oracle delays, or liquidation throttles can bunch many auctions into the same stress window.
  • Common vulnerable surfaces:
    • English liquidation auctions that open from bid = 0 or near-zero and require outside bidding competition to discover price
    • liquidation engines that assume mempool access and gas repricing will keep working under chain-wide congestion
    • keeper ecosystems where only a handful of bots have the inventory, internal balance, or operational tooling to compete
    • systems with stale-price delays or batch liquidations that create abrupt bursts of auctions instead of smoother flow
    • debt mechanisms where failed collateral recovery turns directly into protocol bad debt or governance-token dilution
  • Exploit sequence:
    1. A price shock, oracle lag, or other stress event pushes many positions into liquidation at once.
    2. The protocol opens auctions and expects keepers to compete away the discount.
    3. Honest bidders fail to participate reliably because gas spikes, nonce chains jam, funding is scarce, or bots were not built for the stressed state.
    4. One or a few surviving bidders submit dust or severely discounted bids and face little real competition.
    5. Auctions settle at prices far below economically fair distressed value.
    6. Vault owners lose far more collateral than intended, and the protocol may still be left with bad debt because the auction never raised enough repayment value.
  • Variants:
    • Near-zero opening-bid capture — the first live bidder wins most or all of the collateral for a dust bid because nobody else can respond before the timer expires.
    • Mempool-jamming / nonce-stall amplification — attackers worsen already stressed conditions by exploiting or inducing transaction-ordering and replacement failures in competing keeper bots.
    • Backstop-participant collapse — auctions do not clear at all, or clear only after deep discounts, because the supposed buyers lack capital or cannot source funding in time.
    • Oracle-lag liquidation wave — delayed price propagation compresses many liquidations into one window, overwhelming bidder capacity exactly when more time and competition are needed.

Three liquidation-state promotions reviewers should keep separate

  1. Some liquidation path can mechanically seize collateral at all

    • The oracle can publish a bad price, a vault can cross threshold, and the protocol can kick an auction or authorize a closeout.
    • This is only a triggerability claim. It does not yet mean the system can realize sane stressed recovery value.

  2. The protocol promotes the first live bidder or liquidation fill into canonical stressed-market price discovery

    • The auction opening rule, fixed-discount liquidation bonus, or first executable take becomes the authoritative answer to what is this collateral worth under stress right now?
    • This is the decisive pricing promotion, and it is stronger than merely proving collateral was seizable or that some bidder existed.

  3. That accepted stressed price still deserves full collateral-transfer and debt-recovery authority

    • Once the protocol has accepted one live bid, it may still transfer the whole collateral lot, close the borrower, crystallize bad debt, or socialize the residual loss.
    • This is a separate promotion again: someone bid is not yet the same statement as this bid should control final collateral transfer and solvency accounting.

Healthy review keeps these three questions separate instead of flattening them into one vague liquidation happened story.

  • Detection heuristics:
    • Ask what happens if only one bidder can successfully transact during a volatility event; that is usually the real stressed-state lower bound.
    • Simulate chain congestion, rising gas, nonce-replacement failures, and pending-tx chain jams against real keeper software instead of assuming ideal bidding.
    • Check whether opening bids, reserve prices, or auction-price curves are strong enough to prevent dust-price collateral seizures when competition collapses.
    • Model liquidation throughput under oracle-lagged or batch liquidation conditions, not only under smooth price movement.
    • Separate can the protocol seize collateral? from can the protocol actually realize enough repayment value from that collateral under stress?
    • Treat liquidations as a full-stack system: oracle timing, blockspace, bot operations, internal balances, and auction math all matter.
  • Defenses:
    • Use auction formats and parameters that degrade gracefully under low participation, such as safer reserve logic, better price curves, or backstop commitments.
    • Ensure opening conditions do not let dust bids capture economically large lots when competition disappears.
    • Lengthen bidding windows or otherwise avoid assuming normal blockspace conditions during stress.
    • Build or incentivize diversified keeper sets with robust gas repricing, nonce management, and funding access.
    • Add protocol-owned or precommitted backstop liquidity so solvency restoration does not depend entirely on opportunistic outside bots.
    • Stress-test the liquidation stack during the same conditions that create liquidations: volatility, oracle delay, funding stress, and block congestion.
    • Treat single bidder still online as an explicit design scenario with acceptable recovery bounds, not as an out-of-scope operational accident.

What sound design looks like

  • The stressed-path lower bound is explicit

    • Reviews state what recovery should still look like if only one bidder, or one bidder class, can transact during the liquidation window.
    • Auction exists is not accepted as evidence; the protocol writes down the minimum acceptable recovery ratio, reserve-price discipline, or backstop behavior for the low-participation state.

  • Opening conditions fail closed instead of outsourcing price safety to competition

    • The first executable bid or take cannot seize economically large collateral lots for dust just because the rest of the bidder set is stuck.
    • Reserve logic, Dutch-price schedules, lot sizing, or precommitted backstops provide price discipline before competitive bidding arrives, not only after.

  • Keeper liveness is treated as a security dependency, not an ambient market service

    • Liquidation design explicitly models mempool access, gas repricing, nonce handling, prefunding, and venue access as part of the solvency boundary.
    • The sharper positive-design companion here is liquidation-capital provenance and keeper-competition assumptions: protocols should be able to say what capital, what venues, and what bidder diversity they are really counting on.

  • Auction design matches collateral reality

    • Illiquid collateral should not require near-floor opening bids, long capital lockups, or other terms that assume better stressed clearing than the asset family can actually support.
    • The same review that approves collateral admission should write down who can realistically absorb liquidation size and under what timing assumptions.

  • Backstop and loss-socialization paths are precommitted

    • If real-time bidder competition still thins out, the protocol already knows whether protocol-owned liquidity, an insurance fund, capped discounting, or explicit recapitalization absorbs the gap.
    • Crisis improvisation is not allowed to stand in for liquidation design.

Failure-prevention checklist

  • Define the single-bidder stressed-state invariant explicitly: if only one bidder can arrive, what collateral-discount bound, debt-recovery bound, or protocol-loss bound must still hold?
  • Audit the exact opening rule, not only later auction rounds. A minimum-increment parameter does not help if the first valid bid can still be dust.
  • Match lot sizing and auction timers to real stressed blockspace and funding conditions, not to calm-market averages.
  • Require reserve pricing, descending-price discipline, or precommitted backstop capacity strong enough to stop collateral seized from drifting arbitrarily far away from debt recovered under low participation.
  • Review keeper diversity as balance-sheet and operations diversity, not just address count: gas policy, nonce management, prefunding model, venue access, and capital source should not all collapse at once.
  • Model liquidation-capital provenance directly: what asset must bidders bring, where does it come from during stress, and can it still be sourced when the same market shock is underway?
  • Treat illiquid collateral auctions as a solvency design problem, not a UI parameter problem. Opening bids, lockups, redemption windows, and borrower optionality must make sense for distressed clearing, not just for ordinary markets.
  • Precommit the fallback path if auctions stall: protocol-owned liquidity, insurance, dilution, pause, or another bounded recapitalization route should already be written down.
  • Run stress simulations that combine the same failures real incidents combined: oracle lag, liquidation bursts, gas spikes, nonce jams, thin bidder sets, and correlated funding stress.
  • Refresh liquidation assumptions whenever active float, collateral mix, or keeper concentration changes materially. A once-safe auction design can become unsafe when participation decays.

Audit prompts

  • If only one bidder successfully transacts during the liquidation window, what exact price floor, debt-recovery floor, or collateral-seizure cap still protects the protocol and borrowers?
  • What is the first valid bid or take the mechanism accepts, and can that opening step ever produce an obviously absurd clearing result under congestion?
  • What exact asset must bidders source, from which venues, and under what latency assumptions, before the liquidation path is economically real rather than merely mechanically callable?
  • Are auction timers, lot sizes, and redemption windows calibrated for distressed blockspace and illiquid collateral, or only for normal-hour participation?
  • Could mempool congestion, nonce-chain stalls, or prefunding friction disable most honest keepers at the same time the protocol opens the largest auction wave?
  • Does the protocol rely on a handful of keeper operators, one exchange venue, one bridge path, or one capital source that would fail together under stress?
  • If auctions clear far below recognized collateral value, where does the residual loss go, and is that recapitalization path already operationally ready?
  • For illiquid collateral, are opening bids or reserve rules anchored to executable distressed value, or to optimistic floor marks that disappear when liquidation actually matters?
  • Does the protocol distinguish liquidation triggered correctly from liquidation restored solvency at sane economics, or does risk review treat those as the same event?
  • What circuit breaker, pause, or backstop path can intervene before repeated low-competition auctions turn a market shock into a protocol insolvency event?

Lessons that should already be standard

  • Liquidation is not complete when the protocol seizes collateral. It is complete when stressed recovery value is actually realized.

  • Auction competition is not a law of nature. If the design needs many live bidders to avoid absurd outcomes, that dependence is part of the protocol’s root risk model.

  • The opening step matters more than the happy-path middle of the auction. Systems often fail before competitive price discovery ever has a chance to begin.

  • Mempool access, gas policy, nonce hygiene, and prefunded bidding capital belong inside the liquidation security boundary whenever solvency depends on keepers.

  • Illiquid collateral does not become safe just because the protocol can force it into an auction. The auction terms themselves must still match distressed clearing reality.

  • Liquidator incentive exists is not the same statement as liquidation is executable at the recognized values. The missing ingredient is often capital, venue access, or time.

  • Backstops are not optional polish for tail events. They are what keeps a temporary participation collapse from hardening into permanent bad debt.

  • Every liquidation design should answer one blunt question before launch: what happens if the protocol needs rescue precisely when almost nobody can bid?

  • Practical guardrails worth preserving:

    • Design the stressed-path invariant explicitly: if one bidder arrives first and nobody else can respond for several blocks or minutes, the protocol should still not hand out a whole collateral lot for dust. Maker’s bid = 0 opening condition is the clean warning.
    • Audit the exact first-bid rule, not only the later increment rule. A beg / minimum-increase parameter does not protect the opening step if auctions start from bid = 0; in Maker’s Flipper, tend() required bid > previousBid, so the first valid bid was functionally any positive dust amount.
    • Keep liquidation recovery assumptions separate from liquidation triggering assumptions. An oracle can correctly identify bad debt risk while the auction layer still fails to realize anything close to fair distressed value.
    • Require some combination of reserve pricing, descending-price discipline, lot sizing, or backstop commitment that keeps collateral seized and debt recovered from drifting arbitrarily far apart under low participation.
    • Stress keeper operations as seriously as contract math: internal balance funding, gas bidding, nonce replacement, mempool connectivity, and automation brittleness all belong inside the liquidation security boundary.
    • Treat auction backlog and liquidation burstiness as first-class risk variables. If oracle timing or market structure can force many vaults into auction together, bidder capacity has to be designed for the burst, not the average hour.
    • Precommit the socialization path. If auctions still fail, the protocol should already know whether losses hit an insurance fund, a protocol backstop, governance-token dilution, or some other bounded recapitalization path instead of improvising under crisis.

  • Design contrasts worth preserving:

    • Zero-start English auctions are the most competition-dependent shape. They can work when many keepers are live, but under congestion they let the first surviving bidder define reality because the mechanism itself contributes almost no price floor. If the first-bid rule is literally previousBid < newBid and the auction starts at 0, the opening step is effectively unpriced.
    • Descending-price / Dutch-style liquidation paths degrade better than bid = 0 English auctions because the schedule itself contributes some price discipline, but they still depend on at least one solvent actor being able to fund and submit the take at a sane point on the curve.
    • Fixed-discount close-factor liquidations reduce auction-liveness dependence by replacing price discovery with an explicit liquidation bonus, but they only stay safe if outside liquidators can actually source balance-sheet capacity and unwind the stressed asset during the move that triggered liquidation. Venus XVS (2021-05-18) is the seized-collateral warning that auctionless does not mean livenessless: liquidations technically fired, yet the protocol still could not turn seized XVS into enough BTC / ETH / stable-value repayment once the same thin collateral market began reversing. Aave V2 CRV (2022-11-22) preserves the borrowed-asset cousin: the collateral was strong USDC, but liquidators still had to source rising CRV fast enough to extinguish a giant short before the unwind itself became toxic.
    • Pre-funded backstop pools move the liveness burden earlier in time. They are stronger against nobody showed up to bid failure because capital is already committed, but they create a new question: whether the backstop remains sufficiently capitalized, correctly incentivized, and operationally callable when correlated liquidations hit.
    • The reusable comparison is simple: the more a system relies on real-time distressed-price discovery from opportunistic external bidders, the more its solvency depends on blockspace conditions and keeper operations. The more it internalizes rescue liquidity ahead of time, the more it depends on backstop sizing, governance, and capital stickiness instead.

  • High-signal incidents:

    • MakerDAO Black Thursday near-zero-bid collateral auctions (2020-03-12) — the canonical zero-start English-auction case where Ethereum congestion, delayed liquidation recognition, brittle keeper ops, and Flipper auctions opening from bid = 0 let a small set of keepers win tens of thousands of ETH for effectively zero DAI while Maker still ate bad debt.
    • BendDAO NFT lending liquidation-auction liveness crisis (2022-08-20) — the NFT-collateral cousin where auctions did not fail because bids were too cheap, but because the stressed opening terms were too demanding: near-floor first-bid requirements, long capital lockups, and borrower-redemption optionality made outside bidders disappear while pool depositors still held instant-withdraw expectations.
    • liquidation spiral (2021-05-18) — the fixed-discount / thin-exit-liquidity cousin where liquidations did not fail because bids never arrived; they failed because the collateral being seized could not be monetized anywhere near the paper value that had already supported borrowing, so the protocol discovered too late that liquidator incentive was not the same thing as executable stressed-market depth.
    • bad debt (2022-11-22) — the borrowed-asset squeeze cousin where Aave’s collateral was strong USDC, but liquidation still depended on outside actors sourcing CRV quickly enough into a rising market, and partial profitable liquidations were not enough to stop about $1.6M of bad debt.

Internal linkages

  • Best canonical case: makerdao-black-thursday-near-zero-bid-collateral-auctions-2020-03-12.
  • Best illiquid-NFT auction-design cousin: benddao-nft-lending-liquidation-auction-liveness-crisis-2022-08-20 — useful when the failure is not first bid was too cheap, but first bid plus lockup terms were too demanding for the collateral's real stressed clearing market, so the pool learned too late that NFT floor marks were not live exit liquidity.
  • Best fixed-discount / exit-liquidity-failure cousin: venus-protocol-xvs-collateral-price-spike-liquidation-spiral-2021-05-18 — useful when the failure is not nobody bid, but the protocol still needed real buyers with real balance-sheet capacity to turn seized collateral into repayment, and that depth did not exist at the recognized mark.
  • Best borrowed-asset squeeze cousin: aave-v2-crv-short-squeeze-liquidation-bad-debt-2022-11-22 — useful when collateral quality was not the bottleneck; the unwind failed because liquidators had to source the rising debt asset itself fast enough to restore solvency.
  • Positive-design companion on bidder-capital and venue assumptions: liquidation-capital-provenance-and-keeper-competition-assumptions — useful when the sharper question becomes what capital, venue access, and competition assumptions should the auction or liquidation path have written down explicitly before the stress window arrived.
  • Adjacent positive-design companion on borrower / liquidator separation: liquidator-independence-assumptions — useful when the sharper question is not honest bidders vanished but the attacker could own the liquidator side too, turning liquidation incentives into a payout rail.
  • Adjacent pattern: oracle-configuration-failure — both can turn a protocol’s own safety machinery into liquidation damage, but this pattern is about auction participation and liveness rather than a wrong published price.
  • Adjacent pattern: protocol-native-collateral-fragility — both can leave protocols unable to realize enough value from seized collateral, but this class is about bidder/auction failure under stress rather than a house asset whose quoted mark was never credible exit liquidity in the first place.
  • Adjacent pattern: solvency-check-bypass — both end in bad debt, but here the accounting may be fine while the recovery mechanism fails.

Control surface

Graph View

Backlinks