Development of CDP Liquidation System
MakerDAO in March 2020 (Black Thursday) lost $5.4M due to liquidation system failure: network delays prevented liquidators from participating in auctions, some auctions closed at zero price — 0 DAI for ETH collateral. This was direct design error in auction system where 0 DAI bid was technically valid. Today MakerDAO uses Liquidations 2.0 with Clip auction. Proper CDP liquidation is not "sell collateral", but complex multi-level system with auction house, dog, and clipper.
CDP Liquidation Mechanics in Detail
Collateralization Ratio and Trigger Moment
CDP (Collateralised Debt Position) — position with collateral and debt in synthetic asset. Position is liquidatable when:
CR = (collateral_value / debt_value) < liquidation_ratio
Liquidation ratio depends on asset: for ETH usually 150%, for more volatile — 175–200%, for stablecoins — 105–110%. Proper liquidation ratio choice — balance between protocol protection (too high LR — users hold less debt, bad capital efficiency) and bad debt risk (too low — positions don't liquidate in time on fast drop).
Liquidation trigger occurs on liquidate() call by anyone (permissionless). Caller receives keeper incentive (kick reward) — small reward for auction initiation.
Dutch Auction (Clip): Why Better Than English
MakerDAO Liquidations 1.0 used English auction (bids rising). Problem — had to wait for auction end (up to 6 hours), gas wars between bots, vulnerability to "no participants" scenario.
Liquidations 2.0 (Clip) — Dutch auction on price: starts above market, price exponentially falls with time. Anyone can buy collateral anytime when price attractive. Auction parameters:
-
buf— initial price multiplier (e.g., 1.2 = starts 20% above current oracle) -
tail— maximum auction duration (e.g., 3600 seconds) -
cusp— maximum price drop as fraction of initial (e.g., 0.4 = down to 40% from start) -
chip— percent of collateral as kick reward -
tip— fixed flat incentive in DAI/stablecoin
If auction reaches tail or price drops to cusp without completion — reset: price resets to market * buf. This protects from March 2020 MakerDAO situation.
Flash Loan Liquidations via take()
Clip.take() supports callback: liquidator can receive collateral, do something (e.g., sell via DEX), return debt — all in one transaction. Standard flash loan pattern for liquidations.
interface ClipperCallee {
function clipperCall(
address sender,
uint256 owe, // debt to repay
uint256 slice, // received collateral
bytes calldata data
) external;
}
Integration with Uniswap V3 or 1inch for collateral sale within clipperCall — standard practice for liquidation bots.
System Architecture
Components
Dog.sol — active CDP registry, liquidation trigger
Clip.sol — dutch auction engine (one per collateral type)
Abacus.sol — price calculator (exponential/linear decrease)
Spotter.sol — oracle adapter, feeds price to Dog
Vat.sol — core accounting, stores all CDPs and debts
We implement similar modular architecture adapted for specific protocol. Key: Vat (or equivalent) — only place storing balances. All other contracts only write to Vat via authorized calls.
Oracle Security
Dog gets price via Spotter from two sources: OSM (Oracle Security Module) — with 1-hour delay, and current price for emergency liquidations. OSM delay gives users time to add collateral on rapid drop. This is trade-off: user protection vs. protocol risk on fast moves.
For custom protocols we solve this trade-off based on collateral type. For stablecoins — no delay needed. For volatile assets — 30–60 minutes. For NFT/RWA — special logic.
Liquidator Incentive Calibration
Key question: how much to pay liquidators? Too little — no liquidators during stress. Too much — protocol overpays, users lose more collateral than needed.
Optimal incentive = gas cost of liquidation + risk premium + profit margin. At 300k gas units and 50 gwei = 0.015 ETH. Kick reward must cover this at minimum position size.
For flat tip + chip combination: tip covers gas, chip (% of collateral) gives profit margin. Typical values: tip = 300 DAI, chip = 0.02% (2 bps).
Testing: What Can't Be Skipped
Black Thursday simulation via Foundry fork:
forge test --fork-url $ETH_MAINNET_RPC --fork-block-number 9763200 --match-test testBlackThursdayScenario
Test: ETH drops 40% over 100 blocks, verify:
- All CDPs with CR < LR go to auction
- Auctions complete (don't reach tail) with liquidators present
- Bad debt = 0 under normal conditions
- Reset mechanism triggers without liquidators
Echidna property: totalSystemDebt <= totalSystemCollateralValue * (1 / minimumCR) under any operation sequence.
Development Process
Analytics (2–3 days). Auction parameters per collateral type. Model incentive structure.
Development (1–2 weeks). Dog + Clip + Abacus + oracle integration. Liquidator bot (off-chain) for first weeks of operation.
Testing (3–5 days). Fork tests of stress scenarios. Unit tests of auction edge cases.
Deployment. First testnet with real price movements (via fork). Then mainnet with limited debt ceiling per collateral type.
Timeline Guidance
CDP liquidation system with dutch auction for 1–3 collateral types — 1–2 weeks. Extended system with NFT collateral and custom auction mechanism — 3–4 weeks.