Liquidation Cascades: How One Asset Takes Down a Pool

Liquidation exists to keep a lending market solvent: when collateral falls far enough, it is sold to repay the debt before the position goes underwater. Executed on a normal day, it is unremarkable. Executed simultaneously across many positions holding the same collateral, it becomes reflexive — the selling required to protect the protocol pushes the price down, which triggers more liquidations, which requires more selling.

The five stages

First, a price move takes a cluster of positions below their liquidation threshold. Clustering is normal rather than coincidental: borrowers using the same collateral face similar parameters and tend to borrow to similar comfort levels.

Second, liquidators buy the collateral at a discount and sell it to recover their capital. That selling hits the same market that just fell.

Third, the selling depresses the price further, taking the next tranche of positions below their threshold.

Fourth, the loop repeats, and the rate at which it repeats depends on how much collateral sits in each price band and how deep the market is beneath.

Fifth, one of three things ends it: the price falls to where buyers absorb the supply, liquidity arrives from elsewhere, or the collateral runs out. The third case is the bad one, because it usually means positions were liquidated at prices that did not cover their debt.

The conditions that make it possible

Cascades need specific ingredients, and their absence is what makes most sharp price moves ordinary.

Concentrated collateral. If one asset backs a large share of borrowing in a market, its price move is the market's problem. Diversified collateral spreads the trigger across uncorrelated moves.

Thin liquidity relative to the collateral held. The important comparison is not the asset's headline trading volume but the depth available at the moment liquidations fire — which is exactly when it is thinnest.

Clustered thresholds. When many positions liquidate within a narrow price band, the loop has fuel. Varied collateral factors across assets spread the bands out.

Reflexive collateral. The worst case is collateral whose value depends on the health of the system borrowing against it — a protocol's own token used as collateral in its own market, for instance. A price fall then damages both sides of the equation at once.

Why liquidation penalties cut both ways

The liquidation penalty — the discount a liquidator receives — has to be calibrated carefully, and both errors are costly.

Too small, and liquidators do not act during congestion, when transaction costs spike and the profit no longer covers the risk of the price moving before execution. Positions then go underwater and the protocol takes bad debt. This is the failure mode behind several of the largest losses in on-chain lending: not that liquidation was wrong, but that nobody found it worth doing at the moment it mattered.

Too large, and the penalty itself accelerates the cascade by transferring more value out of borrowers on every step and putting more collateral onto the market than the debt required.

The parameter is therefore a judgement about which failure the protocol fears more, made in advance, published, and tested only when conditions are at their worst.

What actually breaks the loop

Several mechanisms exist and they work at different points.

Supply caps limit how much of one asset can ever be posted as collateral, which bounds the fuel available before anything happens. This is the most effective intervention because it is preventive.

Isolated markets confine a collateral failure to the market that accepted it, so a bad listing damages its own depositors rather than everyone. This is the structural argument for isolated designs over shared pools.

Partial liquidation closes only enough of a position to restore health rather than all of it, which reduces the collateral hitting the market per step.

Circuit breakers and pauses stop the loop directly and are the bluntest tool: they also trap solvent users who wanted out, and they require someone to hold the authority to trigger them, which is a control risk of its own.

Assessing a market's exposure

• What share of borrowing is backed by a single collateral asset, and how deep is that asset's market at stress levels rather than average ones.
• Are supply caps set, and are they small relative to on-chain liquidity for that asset.
• Are markets isolated or shared, which determines whether a bad listing is contained.
• Is the liquidation penalty large enough to attract liquidators during congestion, when it is actually needed.
• Does any accepted collateral derive its value from the protocol itself, which is the reflexive case.

A market that has never seen a cascade is not necessarily well-designed; it may simply not have been tested. The parameters above are observable in advance, which is the only time the answer is useful.