Managing Risk in Leveraged Vaults

Teddy Woodward -

Notional’s leveraged vaults allow users to get highly leveraged exposure to DeFi yield strategies. While leverage helps make great products, it also exposes Notional to risk.

In this blog post I will demystify the risk management and parameter setting process behind leveraged vaults to show how we keep Notional safe. I will describe the detail behind the risk parameters we have for each leveraged vault, why we have them, and how governance sets them.

Lines of defense - preventing insolvency with liquidations

Ultimately, Notional’s solvency depends on undercollateralized accounts getting liquidated. If accounts get liquidated in a timely manner, we’re good. If not, we’re in trouble. So when Notional governance sets risk parameters for leveraged vaults, we’re primarily concerned with two questions:

  1. Will these selected parameters result in prompt and reliable liquidations once an account is undercollateralized?
  2. In the event that liquidations don’t immediately occur for some reason, how much of a decline in the price of the collateral asset can the protocol weather before becoming insolvent? Is this the right amount of buffer given the volatility and any other relevant characteristics of the collateral asset?

Prompt and reliable liquidations are the protocol’s first line of defense. If every account were immediately liquidated upon becoming undercollateralized, Notional would have zero risk of insolvency. We use the minimum borrow amount and liquidation discount parameters to minimize the chance that liquidations do not occur when they should.

The protocol’s second line of defense in the event that liquidations are slow to occur is the max leverage ratio. The max leverage ratio limits the amount of risk that a borrower can take and gives the protocol some buffer to handle situations where liquidations do not occur and the price of the collateral continues to decline. The size of this buffer is called the safety margin. The lower the max leverage ratio, the larger the safety margin and the safer the vault.

We’ll dig into all of this, but let’s start with the first line of defense - ensuring prompt and reliable liquidations under normal circumstances. To do that, we need to walk through what happens when someone liquidates a vault account.

How leveraged vault liquidations work

When someone liquidates an underwater account, they take out a flash loan for the required currency (like USDC), purchase the account’s collateral at a fixed discount to the oracle rate, sell the collateral for the liquidation currency in the market, repay the flash loan, and then keep what’s left over.

So the liquidator’s profit is a function of the amount of collateral they purchase, the discount they get from the oracle price, the price they’re able to actually sell the collateral, and the ETH gas cost of submitting the transaction. Here’s the formula:

Net profit = Collateral purchased * (marketRate - (oracleRate * (1 - liquidationDiscount)) - ETH gas cost

For liquidations to reliably happen, we need to be confident that the above equation yields a positive number. We have two parameter settings we can use to ensure that this happens:

  1. Minimum borrow amount. Enforcing a minimum borrow amount requires that any account which could be liquidated holds enough collateral to make it worth the liquidator’s while. For example, if an account held $10 of collateral vs. $5 of debt it would never get liquidated because the liquidator’s profit would never cover the gas cost of performing the liquidation.
  2. Liquidation discount. The greater the liquidation discount, the greater the profit for the liquidator.

Ensuring profitable liquidations requires setting the minimum borrow amount and the liquidation discount in tandem. The first step to setting these parameters correctly is to calculate the fixed cost that the liquidator will have to overcome for performing the liquidation - the ETH gas cost of submitting the transaction.

Liquidation gas cost

Gas prices on ETH Mainnet are not constant, and neither is the ETH price. This means that estimating the cost of liquidations requires a few assumptions. We can make these assumptions based on historical precedent.

For example, here is a set of conservative estimations to calculate the liquidator’s USD-denominated gas cost based on realized data from the last bull run - 1.5M gas cost for the liquidation, a 200 gwei gas price, and an ETH/USD price of 4,000 USD. Under these assumptions, a liquidation would cost 0.3 ETH or 1,200 USD!

That means that the liquidator would need to make at least this much money on the liquidation in order to do it. So the next step to setting the min borrow amount and liquidation discount is to determine how much profit a liquidator will make upon liquidating an account that has borrowed the minimum amount. We should make sure that the min borrow amount and liquidation discount we set produce a profit greater than the gas cost we’ve solved for here.

Calculating liquidation profit

The liquidator’s profit is the difference between their purchase price and their sale price multiplied by the amount of collateral they purchase. We know their purchase price - it is the oracle price * (1 - liquidation discount). But we don’t know what their sale price will be for two reasons:

  1. When the liquidator sells the borrower’s collateral they will incur slippage.
  2. The market price of the collateral at the time of liquidation can be different from the oracle price. This is called the oracle price basis.

Both the slippage and the oracle price basis can eat into the liquidator’s profit. For example, if the liquidation discount is 5% but slippage is 0.3% and the oracle price basis is 1%, the liquidator’s actual profit is only 3.7% on the amount of collateral they purchase, not 5%.

This analysis means that we can’t assume that the liquidator will capture the full liquidation discount as profit.

Example

Let’s say we have a simple leveraged vault that allows a user to borrow ETH against stETH:

  • Max leverage ratio: 5x
  • Minimum borrow amount: 20 ETH
  • Liquidation discount: 3%

Let’s see how much profit a liquidator would make liquidating the smallest possible account. With a minimum borrow amount of 20 ETH and 5x max leverage, the minimum amount of collateral that the account can hold is 24 stETH, assuming 1 ETH = 1stETH. The liquidator’s slippage trading stETH for ETH is reliably low, but the oracle price basis can be significant. We can make the conservative assumption of 0.1% slippage and 1% oracle price basis.

With these assumptions, the liquidator’s minimum profit will be 1.9% * 24 ETH = 0.456 ETH. At 1.5M gas for the liquidation and a 200 gwei gas price, their cost will be 0.3 ETH so they would make a net 0.156 ETH profit. This means we could be confident that liquidations on this vault would happen promptly even if the scenario were a bit worse than our conservative estimates.

Now onto the second line of defense - the max leverage ratio.

Setting the max leverage ratio

The max leverage ratio protects Notional and Notional lenders in the event that liquidations do not occur when accounts become undercollateralized by giving the protocol a safety margin.

The safety margin is the percentage amount that the collateral price can fall after an account has become eligible for liquidation and before the account hits the loss threshold and becomes insolvent.

To illustrate the safety margin, let’s walk through an example.

Example

Let’s say we have a vault that allows the user to borrow ETH against stETH collateral at a max leverage of 5x. In this example, the stETH price starts at peg and we have the following account:

Collateral: 1,000 stETH
Debt: -720 ETH
stETH / ETH price: 1
LTV: 72%

Now the stETH price begins to de-peg and hits the account’s liquidation price of 0.9:

Collateral: 1,000 stETH
Debt: -720 ETH
stETH / ETH price: 0.9
LTV: 80%

At this point, the account is at its max leverage ratio and is one tick away from liquidation. With a liquidation discount of 5%, the liquidator is able to purchase the account’s stETH at a price of 0.855 (0.90 * 0.95). If the liquidator pays off the account’s debt in full, the account will be left with ~157.9 stETH and the lending protocol will have evaded any risk of insolvency.

But for some reason, the liquidation does not occur and the price continues to decline all the way down to 0.7579. At this point, finally, a liquidator steps in and buys all the account’s stETH at a price of 0.72 (0.7579 * 0.95). This liquidation puts just enough ETH into the account to perfectly offset its debt and protect the protocol from insolvency. That was close!

The minimum price at which a liquidation fully repays the account’s debt (0.7579 in this case) is called the loss threshold because if the price goes any lower, the protocol becomes insolvent. The percentage distance between the account’s liquidation price and the loss threshold is the safety margin. In this case, the lending protocol has an ~18.7% safety margin (0.9 / 0.7579). The higher we set the max leverage ratio, the smaller our safety margin is and vice versa.

Why have a safety margin?

The lending protocol never expects to need the safety margin. Properly selected minimum borrow amounts and liquidation discounts should (and we have seen empirically, do) lead to near-instant liquidations as soon as an account reaches its liquidation price. The safety margin exists to protect the lending protocol in the event of some unexpected or unknown risk that is beyond the range of normal circumstances.

The full spectrum of risks that could cause the lending protocol to need the safety margin is unknowable. But here are a few examples where the safety margin could come in handy.

  • Chain failure. Liquidations can only occur if the chain is processing transactions. If Ethereum or whatever other chain the lending protocol runs on goes down, liquidation would be impossible. In this scenario, prices may still be updating on centralized exchanges so it is possible that by the time the chain comes back online, prices have moved so much that the lending protocol has become insolvent.
  • Oracle failure. Most lending protocols today (including Notional) rely on some mix of an external oracle provider like Chainlink and price oracles sourced from DEXes. If this infrastructure fails for some reason and stops publishing fresh data, prices could move and the liquidations that should happen will not happen. By the time the infrastructure comes back online, prices could have moved so far that the lending protocol becomes insolvent.
  • Catastrophic economic event. Some assets like stETH derive their value from other assets that back them. This could potentially lead to events that cause discrete price changes that happen so quickly that liquidations are impossible. For example, a nuclear bomb could go off that destroys a data center where some Ethereum validators hold their private keys and 30% of the ETH that backs stETH is lost forever.

Choosing the right safety margin

It is not possible to choose a safety margin that completely removes the risk of protocol insolvency. The only way to completely remove that risk is to simply not allow anyone to borrow anything in the first place. The existence of a lending protocol implies the acceptance of some amount of risk - the question is just how much.

At Notional, we choose safety margins based on a mix of historical data and fundamental analysis of the collateral asset. Safety margins on most of Notional's leveraged vaults are set to be roughly equal to the worst-ever 24 hour move in the asset’s history. A safety margin of this size strikes a good balance between safety for lenders and capital efficiency for borrowers.

Risk management and parameter setting is about balancing risk and reward. Risk parameter setting almost always involves assumptions and judgment calls based on historical data - there is no single “right” answer. But with a clear understanding of market dynamics and the technical intricacies of collateral and liquidation mechanisms we can make informed decisions that deliver value to borrowers while keeping lenders and the protocol safe from insolvency.