Cowrie Research

liquidation-capital-provenance-and-keeper-competition-assumptions

14 min read

Liquidation-Capital Provenance and Keeper-Competition Assumptions

  • Name: liquidation-capital provenance and keeper-competition assumptions
  • Category: liquidation-design reference / stressed-unwind design checklist / positive-design companion to liquidation-auction liveness failure and liquidator-independence assumptions
  • Summary: Many lending and CDP systems model liquidation as if someone will always show up with the right asset, enough balance-sheet capacity, and enough venue access to restore solvency. That assumption is often left implicit. In real incidents it breaks in several different ways: honest keepers disappear under congestion, liquidators need the rising debt asset rather than the falling collateral, seized collateral can only be sold back into the same thin venue that printed the mark, or the only realistic liquidator capital is correlated with the same manipulative loop that created the bad state. This note exists to preserve the narrower design question what exact capital, venue, and competition assumptions make liquidation executable at the prices the protocol recognizes? instead of leaving readers to infer it only by inverting Maker Black Thursday, Aave V2 CRV, Venus XVS, or the self-liquidation cluster.
  • Why this note exists:
    • Liquidation exists is not the same claim as liquidation can actually restore solvency at this position size and market state.
    • The exploit corpus already preserves two nearby questions: liquidation auction liveness failure asks whether bidders show up at all, and liquidator independence assumptions asks whether the attacker owns the liquidator side. This note preserves the middle question of what real capital and real execution venues the liquidation path assumes will be available even if the liquidator is honest.
    • Many bad-debt incidents are best understood as recognized solvency value outran executable unwind capacity, not only as oracle was wrong or collateral factor was too high.

What this note means by liquidation-capital provenance

  • Liquidation-capital provenance means the real source of the assets a liquidator must spend to close debt or bid in an auction.
  • Keeper-competition assumptions means the protocol’s usually implicit belief that enough independent liquidators can source that capital, reach the relevant venues, and compete quickly enough under stress.
  • The useful question is not just can liquidators make money? It is what exact assets, funding rails, inventory, and venue depth must remain available before the protocol's recognized liquidation path is economically real?

The main assumptions a healthy liquidation design should make explicit

1. Liquidator capital is a first-class dependency, not an ambient market service

  • A liquidation path only works if someone can produce the repayment asset or auction bid asset at the needed size and speed.
  • If the protocol never writes down where that capital is expected to come from, it is probably assuming much more depth than actually exists.
  • Aave V2 CRV is the clean reminder: the protocol’s collateral was strong USDC, but liquidation still depended on outside actors sourcing rising CRV fast enough into a squeeze.

2. The asset liquidators must source may be the stressed bottleneck, not the collateral

  • In fixed-discount liquidations, the hard part is often buying or borrowing the debt asset in a moving market, not selling the seized collateral later.
  • In auction systems, the hard part may instead be arriving with bid capital under congestion.
  • The protocol should explicitly ask which side of the liquidation trade becomes scarce first under stress.

3. Recognized collateral value and executable exit value are different security objects

  • A protocol may correctly observe a price while still being unable to realize that price at liquidation size.
  • Thin governance tokens, thin LP wrappers, isolated pools, or locally printed house-asset marks often support more paper borrowing than real unwind depth.
  • Venus XVS is the high-signal warning: even if the quoted XVS mark was fresh, the protocol still could not turn seized XVS into enough repayment value once liquidation began.

4. Venue access matters as much as price access

  • Liquidation assumes not only that a price exists, but that liquidators can actually transact at the relevant venue or set of venues.
  • If the executable path depends on one DEX pool, one exchange withdrawal path, one bridge lane, or one congested mempool, then solvency depends on that access layer too.
  • Maker Black Thursday is the canonical bidder-access case: keeper participation failed operationally even though auction logic kept running.

5. Competition assumptions should be written for stress, not for normal hours

  • Many systems look safely liquidatable when modeled against normal spreads, normal mempool conditions, and ordinary inventory.
  • The real lower bound is what happens when volatility, congestion, and correlated funding stress hit at the same time.
  • The protocol should assume fewer liquidators, worse inventory access, and shallower executable depth exactly when more liquidation is needed.

6. Correlated capital is not the same thing as independent rescue capital

  • A liquidator funded by the same manipulated asset family, the same short squeeze, the same bridge inventory, or the same exchange chokepoint is not an independent backstop.
  • Even without attacker-owned self-liquidation, correlated keeper capital can disappear or become too expensive exactly when the protocol needs it.
  • This is the economic cousin of liquidator independence assumptions rather than the same question.

What sound design looks like

  • Liquidation-capital provenance is explicit

    • Reviews state what asset liquidators must source, from which venues, at what likely size, and under what latency or congestion assumptions.

  • Executable depth is modeled separately from oracle-recognized value

    • A protocol does not treat oracle says collateral is worth X as equivalent to the system can unwind enough size near X during stress.

  • Stress models assume thinner keeper sets and tighter balance sheets

    • Risk reviews use few keepers, wide spreads, expensive funding, delayed bridge or withdrawal paths, rising gas as baseline crisis assumptions rather than edge cases.

  • Collateral policy and liquidation policy are reviewed together

    • House assets, thin governance tokens, fresh wrappers, or concentrated debt markets are not admitted or scaled without also writing down the liquidation-capital story that would defend them.

  • Backstop design is sized against venue reality, not paper marks

    • If the protocol relies on pre-funded rescue liquidity or insurance, that capital is sized for the asset and venue stress it is actually expected to absorb.

Useful positive design shapes

1. Write down the liquidation object in executable rather than accounting terms

  • For each risky market, answer:
    • what asset must the liquidator bring?
    • what asset do they receive?
    • where can they source the first asset under stress?
    • where can they dispose of the second asset under stress?
    • what happens if those two venue assumptions fail independently?
  • This sounds basic, but many incidents show the protocol only wrote down the accounting side.

2. Distinguish price discovery from solvency restoration

  • Auction participation, debt-asset sourcing, seized-collateral disposal, and recapitalization are different stages.
  • A protocol should know which stage is supposed to restore solvency and what capital that stage consumes.
  • Maker shows the price-discovery / bidding failure mode; Aave CRV shows the repay-asset sourcing failure mode; Venus XVS shows the seized-collateral disposal failure mode.

3. Haircut collateral by executable unwind capacity, not only by statistical volatility

  • Thin governance assets, fresh wrappers, and concentrated borrow markets need limits based on actual stressed liquidation depth, not just volatility or normal-hour liquidity.
  • If collateral can only be unwound through a shallow venue, the solvency system should price that fragility before a crisis does.

4. Model keeper diversity as balance-sheet diversity, not just address count

  • Ten keeper addresses funded through one exchange venue or one bridge lane may still represent one fragile capital source.
  • The useful review question is whether liquidator capital sources are genuinely heterogeneous across assets, venues, and operations.

5. Separate liquidation readiness from listing or collateral admission readiness

  • New markets should not only pass oracle and accounting review.
  • They should also pass a simpler question: if this market becomes the largest liquidation right after launch, who can actually clear it and with what capital?
  • Fresh-market and fresh-collateral incidents keep failing this question before anything more exotic is needed.

6. Precommit the residual-loss path when liquidation assumptions fail

  • If executable liquidation depth proves smaller than recognized solvency value, the protocol should already know whether losses hit insurance, backstop LPs, protocol treasury, governance-token dilution, or users.
  • Crisis improvisation is not a liquidation design.

Red flags that usually mean liquidation-capital assumptions are underdesigned

  • risk reviews discuss price feeds and collateral factors but not which asset liquidators must actually source
  • liquidation simulations use normal market depth instead of stressed depth
  • a protocol treats house-token or thin-wrapper collateral as if printed mark and exit liquidity were interchangeable
  • a market depends on one narrow venue, one exchange path, or one bridge lane for realistic liquidation size
  • keeper diversity is counted by bot identities or wallet addresses, not by real funding source diversity
  • fixed-discount liquidations are described as if they eliminate liveness dependence altogether
  • collateral admission and liquidation readiness are reviewed by different mental models with no shared stress test
  • the protocol has no clear loss-socialization plan if liquidations are locally profitable but globally too slow or too shallow

Design questions worth asking first

  • What exact asset must liquidators bring to close this market, and where is that asset expected to come from during stress?
  • Is the liquidation bottleneck sourcing the debt asset, bidding in the auction, or disposing of seized collateral?
  • How much size can actually be unwound near the recognized mark if only a few liquidators remain live?
  • Are the presumed liquidators funded through the same venue, same exchange inventory, same bridge route, or same correlated collateral family?
  • If the collateral is a house asset, wrapper, or thin governance token, what executable depth justifies its recognized solvency value?
  • What recapitalization path absorbs losses if liquidation remains mechanically available but economically insufficient?

Failure-prevention checklist

  • For each collateral market, document the full liquidation object in executable terms: debt asset required, seized asset received, source venues for the repay asset, exit venues for seized collateral, and the latency assumptions that make both legs realistic during stress.
  • Model oracle-recognized value and executable unwind depth separately, then size collateral factors, caps, liquidation discounts, and backstop commitments against the smaller stressed number rather than the prettier quoted mark.
  • Treat liquidation-capital provenance as a listing and scaling prerequisite, not a post-launch ops detail. New collateral, wrappers, house assets, and isolated markets should not become borrow-significant until the keeper-capital story is written down and reviewed.
  • Stress-test liquidation under few keepers, expensive funding, congested execution, delayed bridge or exchange exits, and correlated venue failure rather than only under ordinary spreads and normal-hours depth.
  • Inventory whether keeper diversity is real across balance sheets, venues, bridge lanes, and financing sources instead of counting distinct bot addresses as independent rescue capital.
  • Precommit residual-loss handling for markets whose executable depth can fail before their recognized solvency value does: insurance, treasury recapitalization, capped exposures, dilution, auction redesign, or asset-specific pause paths.
  • Re-run liquidation-capital reviews whenever borrow concentration, collateral composition, venue routing, or market structure changes materially; stale liquidation assumptions are a lifecycle risk, not just a launch risk.
  • Keep crisis controls narrowable when liquidation capital disappears: lower borrow caps, higher collateral haircuts, narrower liquidation size, slower release, or full pause for markets whose unwind path is no longer credible.

Audit prompts

  • What exact asset does a liquidator need first, and where can that asset still be sourced when the same stress event is already underway?
  • Does the protocol know whether its real bottleneck is auction-bid capital, debt-asset sourcing, seized-collateral disposal, or recapitalization after liquidation finishes?
  • If the quoted collateral price remained fresh but the main disposal venue lost depth, which solvency numbers would still be safe to trust?
  • How many genuinely independent keeper balance sheets exist for this market once shared exchange inventory, bridge routes, treasury relationships, or correlated collateral are netted out?
  • Which liquidation assumptions silently depend on one venue, one bridge, one exchange withdrawal path, or one mempool-access tier staying open during crisis conditions?
  • Are collateral admission, risk-limit sizing, and liquidation-path review owned by one joined process, or can a market scale before anyone proves it is actually unwindable?
  • If liquidators stay honest but too few or too correlated, what bounded-loss controls activate before bad debt becomes uncapped?
  • When the protocol says a market is liquidatable, does that statement mean mathematically callable or economically executable at the recognized size?

Lessons that should already be standard

  • Liquidation is a funding design, not just a price-trigger design.
  • Fresh oracle numbers do not guarantee executable unwind capacity.
  • Keeper count without keeper-capital provenance is theater.
  • Debt-asset sourcing can be the true liquidation bottleneck even when the collateral looks strong.
  • House assets, thin wrappers, and concentrated collateral should earn solvency recognition only after they earn stressed exit credibility.
  • Honest liquidators are not enough if all honest liquidators depend on the same venue, bridge, or balance-sheet shock absorber.
  • A protocol that has no precommitted loss path for failed unwind depth has not fully designed liquidation; it has only delayed insolvency improvisation.

Negative exemplar cluster: what broken liquidation-capital assumptions look like

  • MakerDAO Black Thursday is the canonical bidder-capital and venue-access warning: auctions opened, but stressed keeper operations and congested blockspace meant almost no real competitive bid capital arrived.
  • Aave V2 CRV is the clean debt asset became the scarce liquidation input exemplar: the protocol needed liquidators to source rising CRV, not merely to sell collateral later.
  • Venus Protocol XVS is the recognized collateral mark outran executable exit depth exemplar: liquidations fired, but seized XVS could not restore solvency near the paper values that had already supported borrowing.
  • Hyperliquid JELLY is the backstop-inheritance cousin: the venue’s own liquidator vault inherited an uncloseable short, but pooled HLP collateral meant the final ADL trigger judged losses against the wrong balance-sheet boundary and let a toxic position keep running. Use backstop-sleeve-solvency-isolation-and-inherited-position-trigger-discipline when the sharper design question is how that inherited position should have remained locally bounded after takeover.
  • Venus ZKsync wUSDM is the correlated-capital cousin: the wrapper mark and the liquidation ammunition both lived in the same manipulated asset family, so unwind assumptions were not meaningfully independent.
  • MakerDAO plus Aave CRV together preserve the most important split: sometimes the missing input is bid capital under congestion, and sometimes it is the borrowed asset itself under squeeze.

How to use this note with the exploit corpus

Internal linkages

Control surface

Graph View

Backlinks