Verified Platforms
Quick Links
Where to Stay Secure
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
A DeFi liquidation is not the market deciding you were wrong. It is a smart contract running a rule you agreed to without reading it. The rule can fire while you are still solvent.
This is a Kodex walkthrough with Tao. He sits closer to student than master, the bridge between how a system is built and how it feels to use it, and he is going to take a borrowing position apart until the one part that pulls the trigger is visible.
Tao opens a position that got liquidated and lines it up against the price chart. On paper, the collateral still covered the loan. The contract sold it anyway.
What sold it was the design. Not the size of the position, not the leverage. The design.
Start with the thing being liquidated. The backbone of DeFi lending is the collateralized debt position, a CDP. You lock up an asset, and the protocol lets you borrow against it.
Say you deposit $15,000 of ETH and borrow $10,000 against it. The protocol does not care that you feel comfortable. It watches one number: the ratio between what your collateral is worth and what you owe. Set the liquidation threshold at a 150% collateral ratio, and the moment your ETH is marked at less than $15,000 against that $10,000 debt, the position becomes eligible to be sold.
Tao circles two words on the screen: marked, and sold.
The first one hides the whole problem. The contract does not see the market. It sees a number handed to it by an oracle, a service that reports the price on-chain. The contract trusts the oracle the way you trust the clock on the wall. If the clock runs slow, you are late, and you do not find out by looking at the sun.
The second word is where it becomes physical. When the threshold breaks, the protocol does not call you and it does not wait. A liquidator repays part of your debt and takes your collateral at a discount, in the same block. That discount, the liquidation bonus, is the bounty that makes someone show up to close you. The forced sale is the mechanism, not a side effect. There is no version of a CDP where the sale is optional, because the loan only stays safe if the contract can always close the position faster than the price can run.
Hold those two together: an instant price feed, and a forced sale.
Everything that goes wrong in a DeFi liquidation goes wrong inside those two requirements.
A position can be over-collateralized on real, cross-venue prices and still get liquidated, because the contract never acts on real prices. It acts on the oracle's print.
Picture a fast drop. Price gaps down through a thin patch of the order book, the kind of moment where there is not enough liquidity to absorb size without heavy slippage. For a few seconds the on-chain mark sits lower than the price you could actually trade at across the wider market. The contract cannot tell the difference. It sees the threshold break, and it fires.
This is not a thought experiment. On March 10, 2026, Aave liquidated about $27 million across 34 borrowers after its CAPO risk oracle held a stale exchange rate for wstETH, marking it near 1.1939 against an actual rate closer to 1.228, an undervaluation of roughly 2.85%. Liquidation bots captured around 499 ETH, about $1.2 million, in bonuses for closing positions that should never have been eligible at that moment. The collateral was there the whole time. The oracle was simply reading a snapshot from days earlier. Aave reimbursed every affected user in full and recorded no bad debt, and that detail is the tell: if the protocol can make everyone whole afterward, the position was solvent when it was sold.
The liquidation was a trigger artifact, not a verdict.
That is the part retail keeps getting wrong. The lesson people pull from a liquidation is "use less leverage." Sometimes that helps. But a solvent position did not get sold because the borrower was greedy. It got sold because the trigger reads a lagging number and acts on it with no appeal. This is the same family of failure as when off-chain risk liquidates DeFi, a feed outside your control deciding the fate of a position you thought was yours to manage.
Tao's read is blunt. The danger was never the loan. It was outsourcing the trigger to a clock you cannot see.
Now make it plural. A forced sale does not happen in a vacuum. The collateral has to go somewhere, and dumping it into that same thin order book pushes the price down further. A lower price means a lower oracle print. A lower print means more positions breach their threshold. Those get sold too, into a book that is now even thinner.
That loop has a name when it runs at scale: a liquidation cascade. It is not a malfunction. It is what you get when many positions share the same trigger design and the same shallow exit at the same moment.
You can watch the shape of it on perpetuals venues, where the same oracle-plus-forced-sale logic runs even faster. In late May 2026, a single bad data feed on Hyperliquid's pre-IPO SpaceX contract sent the synthetic price down about 45%, from roughly $2,277 to $1,254, before it rebounded near $2,169. On the way down it liquidated 405 users across 1,393 positions. The price came back within minutes.
The closed positions did not come back with it.
This is why the cascade is structural, not accidental. A CDP cannot drop the forced sale without breaking its own solvency promise, and it cannot drop the fast oracle without going blind. The two requirements that keep the loan safe in calm markets are the two that feed the cascade in violent ones.
So you change the primitive.
On June 1, 2026, Vitalik Buterin posted a proposal that does exactly that. Instead of a loan you have to defend with a margin call, you hold a position built from options. You hold a contract tied to a price index, something like USD against ETH, and because the two payoffs always sum to a fixed amount, there is no point at which a liquidation can fire.
Tao reconstructs the shape of it. A deposit splits into two paired components. Call them P and N. Their values always sum back to the original deposit, whatever the price does, so one side gains exactly what the other gives up. At maturity, an oracle reads the price once and settles the payout between them.
Sit with what that removes. Both outcomes are funded the moment you deposit, so there is nothing to call in later. No margin call. No threshold to breach. And because settlement happens at maturity instead of second by second, the system does not need a fast oracle that an attacker can nudge or a stale feed can break. It can run on a slow oracle, even a prediction-market-style one that updates on a relaxed schedule.
That is the structural difference.
A CDP removes risk by promising to sell you out in time. The options model removes risk by funding both endings up front, so there is nothing to sell out of.
| Debt primitive (CDP) | Options primitive (P/N split) | |
|---|---|---|
| How your deposit is treated | Collateral backing a loan | Split into two parts that always sum to the deposit |
| What triggers a loss | An oracle marks you past a threshold | Nothing; both outcomes are pre-funded |
| Oracle speed required | Fast, constant, costly to secure | Slow; settles at maturity |
| What fails first under stress | The forced sale into thin liquidity | Rebalancing cost, not a forced exit |
| Who absorbs a price gap | The borrower, in the same block | Shared by design between the two parts |
Remove the fast-oracle dependency and the forced-sale trigger, and you have removed the liquidation itself rather than tuning it.
The cascade has nothing left to feed on.
A primitive that deletes liquidation sounds like the end of the story. It is a forum post.
Three things keep it honest. First, the position needs regular rebalancing to hold its shape, and it is not yet clear whether those trades stay cheap enough to avoid the same slippage and poor execution that hurt people in the current system. The cost moves around; it does not vanish. Second, this is a proposal, not a product. It names a structure, not a protocol you can open this afternoon. No audited contract, no live market, no track record. Third, even a slow oracle is still an oracle. Settlement still rests on someone reporting a price honestly at maturity.
Tao keeps one line in view: a model that removes a risk on paper has not removed it from your account. You still trade the system that exists. The options model is worth understanding because it shows you where the liquidation actually comes from.
It does not yet give you anywhere else to stand.
Not in debt-based DeFi. As long as you borrow against collateral, the trigger exists, and you cannot opt out of it from inside the position. What you can do is change how close you ever let the trigger get.
Size the buffer for the gap, not the average move. A position that survives a smooth 20% drift can still die in a 5% gap if that gap lands in thin liquidity and the oracle prints the bottom of it. Headroom is not about the move you expect. It is about the worst few seconds you can picture.
Know your two numbers. The first is your liquidation threshold, the ratio where the contract is allowed to sell you. The second is how often your protocol's oracle updates, and where it sources its price. A protocol with a slower oracle and a fixed update cadence behaves differently in a gap than one tracking spot tick by tick. If you do not know the oracle, you do not really know the position.
And do not hand the trigger to hope. The Kodex Survival Framework is built on this: the rules that hold are the ones you set before the candle, not the ones you reach for during it. Liquidation is the cleanest case there is, because the contract has already decided what it will do.
You are the only party at the table who has not.
If you want to feel where that threshold sits before it costs real money, walk a collateralized position toward it in the Market Simulator on paper first. The number on the screen teaches faster than the number in your account.
Until the primitive changes, the liquidation rule is yours. It is written into the contract you are borrowing from right now, and it will run exactly as specified whether or not you ever read it. The model that would delete the rule is real enough to study and too early to use.
So the work is not to fear the trigger. It is to know exactly where it sits, what feeds it, and how little distance you are leaving between it and you. The position you understand is the one the cascade has the hardest time reaching.
Only if it lands in time. Adding collateral widens your ratio and pulls you back from the threshold, but it is a race against the same block the liquidator is working in. In a fast gap, a top-up transaction can arrive after the position is already sold, especially when the network is congested and you are paying a normal fee. Headroom set in advance beats a rescue sent during the drop.
A collateralized debt position is the structure behind DeFi borrowing. You lock collateral, borrow against it, and agree to a liquidation threshold. If the collateral's value falls too close to the debt, the protocol sells the collateral to repay the loan. The position is the deposit, the debt, and the rule that ties them together.
Because the contract acted on the oracle's mark during the gap, not on the price that came back. A forced sale settles in the moment the threshold breaks. If the oracle printed a low or stale value and the trigger fired, the sale is final even if the market rebounds right after, exactly as it did for the 405 Hyperliquid positions closed seconds before the price returned.
No. Vitalik's June 1, 2026 proposal is a research design, not a deployed protocol. There is no audited, usable options-based lending market yet. The idea is worth understanding now because it isolates what causes liquidations, but the system you borrow from today still runs on a CDP and a fast oracle.
