Performance Guarantees for Permissionless Lending

arXiv:2610.34774v1 [stat.AP] 26 Oct 2026

Performance Guarantees for Permissionless Lending Nanqiao Wang∗ and Jia Yuan Yu†

Abstract We propose a lending protocol with far fewer risks than existing poolbased lending protocols (e.g., Aave, Compound). In our protocol, lenders and borrowers embody the spirit of decentralization by making competing interest-rate offers, resulting in the discovery of the prevailing interest rate through tâtonnement-like dynamics as opposed to taking rates partly determined by a central authority (e.g., Aave, Federal Reserve). We eliminate the risk of manipulation by creating loans with a fixed interest rate throughout the loan—like US Treasury bills. In particular, we further derive performance guarantees probabilities of repayment shortfall and liquidation by modeling the value of the collateral as a random walk, thus allowing participants to more efficiently manage their risk. To do so, we use characteristic functions and Fourier inversion to derive exact integral representations of the liquidation and repayment shortfall probabilities under the most general assumptions. We illustrate empirically this method by using Bitcoin as collateral and fitting its historical prices to Gaussian, Student-t, and symmetric stable Paretian distributions.

1

Introduction

Risk-averse decision-makers naturally allocate capital across multiple assets, some of which are less liquid (e.g., wrapped tokens, staked tokens, BTC, tokenized RWAs) than others (e.g., stablecoins, US treasury bills). When these decision-makers come across some information and need quick access to liquid assets, they often resort to using the less liquid asset as collateral to borrow liquid assets. However, existing permissionless lending protocols (e.g., Aave, Compound) have two major weaknesses. First, they are tremendously opaque and lack guarantees on risks of liquidation and repayment shortfall. Second, they present extraordinary risks such as arbitrarily-set interest rates, liquidation attacks by manipulation of utilization rates, front-running, withdrawal bottleneck [rse], and overly conservative metrics for valuating the collateral. We propose a permissionless asynchronous marketplace for loans that addresses these two weaknesses. To address the second weakness, this marketplace ∗ email: wangnanqiao2022@gmail.com † email: jy@osore.ca

1

operates in a simpler fashion—like Facebook Marketplace and Prosper—where anyone can offer to lend out an amount of liquid assets for a fixed duration and at a fixed interest rate. Moreover, anyone can take up an existing offer by putting down an appropriate collateral, and vice versa. Participants continuously compete by looking at each others’ offers and updating their own offers. Loans are concluded in an asynchronous fashion—on a first-come-first-served basis like order books—without the strict timing of auctions. Since all parties are trustless, loans are over-collateralized. Every borrower must put down a collateral that exceeds in value what is borrowed. Just as stablecoins are characterized by their predictable exchange rates, our loans are characterized by fixed interest rates impervious to third-party manipulation. To address the first weakness, we provide very general performance guarantees for participants in our protocol. It goes without saying that, just as serious blockchains require safety and liveness guarantees [GKL24], a useful lending protocol that handles billions of dollars of value must come with performance guarantees. Although we would like to guarantee that participating in our protocol is more efficient than in other decentralized finance protocols— e.g., staking [BCHO25], minting algorithmic stablecoins [SVFK24], or swapping on decentralized exchanges [HYZ25], such a strong guarantee would inevitably require strong assumptions. Instead, we settle for guaranteeing that, with high probability, a loan will lead to an outcome (repayment with interest) that is agreeable to both the lender and the borrower. This is possible as long as the value of the collateral follows some particular trajectories. The importance of guarantees is often overlooked in the design of decentralized finance protocols. However, just like the safety and liveness guarantees for ledger-type and virtual-machine-type blockchains are central to their success, similar guarantees are absolutely essential if a permissionless protocol is to manage billions of dollars of value. Despite the extent of use of existing lending pools, some features are still quite counterintuitive. For instance, to avoid liquidation, increasing collateral may be more effective than repaying a loan [BL25]. Moreover, defaulting on a loan is sometimes the best choice when the health factor is too low. These surprising insights highlight the importance of giving performance guarantees to users of lending protocols. Lending protocols serve two asymmetric sets of users: lenders requiring a guarantee of repayment with interest, and borrowers requiring the return of their collateral. The lender requires a guarantee that most of the time, it will walk away from the loan with the principal and interest, with the exception of rare events, whose probability is controlled by the volatility of the collateral valuation. The borrower requires a guarantee that most of the time, the loan concludes with the return of the collateral minus repayment and interest, and with the exception of rare events. Our protocol makes available to the lender and borrower a set of actions (liquidation and top-up) that control the probability of these rare events. Our analysis begins by formally specifying the participants, actions, states, and state-transition rules of the proposed lending protocol in Section 2. Under i.i.d. Gaussian returns, we derive exact expressions for borrower liquidation 2

and lender repayment shortfall probabilities in Section 3. In Section 4, we first express the liquidation time as a first-passage time of a nonnegative running maximum. We follow the approach of [Öhg01, PK04] and use Spitzer’s Theorem [Spi56] and Pinelis’ Integral Formula [Pin15, Eq. 16] to derive a sequence of convolutions that computes this running maximum’s characteristic function from the return distribution. Finally, we apply Gil-Pelaez Fourier Inversion [GP51] on this characteristic function to derive the liquidation probability. For the lender repayment probability, we combine the joint characteristic function recursion of [PK04] with Fourier inversion to derive an exact integral representation. Since first passage times are encountered everywhere from queuing theory to probability theory, Theorem 3 can be useful outside of the finance domain. We situate our work within the literature in Section 5 and conclude by listing open problems for future work.

2

Proposed Lending Protocol

In this section, we formally present a lending protocol inspired from existing protocols, but with enough differences that allow us to give performance guarantees on individual loans. First, we define a pair of tokens: a liquid token (e.g., a stablecoin such as USDC) and a less liquid token (e.g., BTC, tokenized assets). Next, we each participant has a type, as in Bayesian games: the type determines whether a participant is a lender holding the liquid token or a borrower1 holding the less liquid token, and determines the private information (or belief) held by each participant. The participants interact through sequential actions, and these actions are observed by other participants (e.g., committed to the blockchain). Just as stablecoins are characterized by their predictable exchange rates, fixed-rate loans are characterized by predictable interest rates. Our lending protocol is a peer-to-peer marketplace for loans, like Facebook Marketplace and Prosper, where anyone can offer to sell items with arbitrary sale parameters (e.g., cash payment, pick-up in person, etc.). Moreover, buyer can also offer to purchase items that meet a set of criteria. Sellers and buyers compete by looking at each others’ offers and updating their own offer parameters. A sale is concluded instantaneously on a first-come-first-served basis. The main difference with Facebook marketplace and traditional lending through banks is the need for over-collateralization in the trustless world of DeFi. Every borrower must put down a collateral that exceeds in value what is borrowed. The concept of value is tied to a pricing function, and it is hard to get right, especially for tokens with lower circulation and liquidity. Despite the large number of participants, we will use notation borrowed from Bayesian games and stochastic games [Sha53] to facilitate the description of the interaction between a number of participants (wallets) subject to a set of rules 1 The borrower is a “leverager” who uses a collateral as leverage to secure a loan of the liquid asset.

3

and state transitions. The state tracks who owns what, the rules determine the actions allowed in each state and the resulting next state.

2.1

Time, Assets, Wallets, Valuation

Throughout the paper, we consider two assets: a liquid asset liq (e.g., USDC) and a collateral asset col (e.g., BTC, tokenized assets) that is illiquid or less liquid. The liquid asset also serves as the numéraire. Although the notion of liquidity of an asset does not directly affect the guarantees that we present, it is reflected in the price of the asset [DMS20, KM05, FGT08]: an asset is less liquid when its price is more volatile (e.g., due to private information). Time is discrete and indexed by t = 0, 1, 2, . . ., corresponding to successive checkpoints at which the lending protocol evaluates the states of ongoing loans. Each participant is a cryptographic wallet characterized by a type that determines the assets held, whether it is a lender or borrower, and its preference over the space of outcomes (e.g., long-term discounted payoff). In particular, the type determines whether the participant prioritizes one loan parameter value (e.g., interest rate r) over another (e.g., liquidation threshold c, etc.). Since decentralized lending protocol are permissionless, a single decision-maker can easily control multiple wallets with the same or different types—e.g., both lender and borrower wallets. For notation sake, we distinguish three wallets: lender wallet wL , borrower wallet wB , and vault wallet wV . The lender wallet wL and borrower wallet wB are participant-controlled wallets. The vault wallet wV denotes a wallet created by the protocol for the sole purpose of storing the liquid and collateral assets committed to an offer or loan. It is not a participant in the game-theoretic sense: it has no type and no preference relation. Its balance of assets changes only through the state-transition rules of the protocol. The creation of the wallet wV is triggered by certain transactions of the protocol, i.e., offer-tolend and offer-to-borrow of Section 2.3. Each vault wallet wV ≜ wV (γ) is uniquely associated with a transaction hash γ. We drop the γ notation when the triggering transaction is clear from context. The balance of each wallet at time t is represented by a pair of nonnegative numbers. For example, we denote the lender wallet wL ’s balance at time t by WL,t = (WL,t [0], WL,t [1]) ∈ R2≥0 . The coordinate [0] denotes the collateral balance, and the coordinate [1] denotes the liquid asset balance. The same convention applies to wB and wV . Thus, WB,t [0] is the collateral balance of the borrower wallet at time t, and WV,t [1] is the liquid balance of the vault wallet at time t. Wallet balances are generally random variables, since they depend on participant actions and on the future valuation of collateral. This wallet-based representation is a major departure from lending pools (cf. Appendix C). In the lending-pool model, credit-tokens and debit-tokens are introduced to track deposits and outstanding debt. In our protocol, there are no credit-tokens or debit-tokens. Each offer or loan is instead represented directly by its record and by the balances of its associated vault wallet. We now define the valuation process. Since liquid asset is the numéraire, the relevant valuation is the value of the collateral in the liquid asset. At time t, 4

let Ξt ∈ X denote a snapshot of the external environment, such as information from centralized exchanges and decentralized exchanges. The valuation process takes Ξt and an amount z of collateral as inputs, and returns the corresponding value in liquid asset: ϕt (Ξt , z) ∈ R≥0 . When the environment Ξt is clear from context, we write simply ϕt (z). Unlike a unit-price oracle, this valuation process can depend on the quantity z being valued. This allows the model to capture liquidity and market-depth effects when the collateral amount is large. We assume that, for each t and Ξt , the map z 7→ ϕt (Ξt , z) is monotone increasing. Hence, when the inverse is well-defined, ϕ−1 t (x) denotes the amount of collateral whose value at time t is x liquid asset. Remark 1 (Valuation convention for the liquid asset). Throughout this paper, we take liq to be USD and express all asset values in USD. We assume that one USD is worth one USD. Consequently, the USD value of an amount v of liq is also v. We therefore use v to denote both the amount of liq and its USD value, without introducing a separate valuation mapping for liq. By contrast, ϕt (z) denotes the USD value at time t of an amount z of col.

2.2

Design Principles

We design the set of actions to meet the following six fundamental principles. pcp 1 During an interaction where the lender acts first, and the borrower acts second: (a) The lender controls the loan amount v, the loan duration d, the interest rate r, and the probability of repayment with interest. (b) The borrower controls the start time t0 and the probability of liquidation (through the collateral amount z). pcp 2 During an interaction where the borrower acts first, and the lender acts second: (a) The borrower controls the loan amount v, the collateral amount z, the loan duration d, the interest rate r, and influences the probability of liquidation. (b) The lender controls the start time t0 . pcp 3 (Ideal ending) The borrower can end the loan at any time by repaying in full with interest. pcp 4 (Painless ending) The lender or the borrower can split the collateral at any time after maturity, with a share equal in value to the repayment amount going to the lender. pcp 5 During the course of the loan, the borrower controls the probability of liquidation by topping-up the collateral.

5

pcp 6 (Painful ending) During the course of the loan, the lender controls the probability of repayment by liquidating the collateral when some conditions are met. Remark 2 (Similarity to US Treasuries). Principle 2 is exactly how US treasuries are sold to retail investors at non-competitive interest rates. Principle 1 is similar to Principle 2, but giving more control to the borrower.

2.3

Actions, Offers, Loans

In our protocol, it is more natural to introduce the action space before the state space. The actions available are reminiscent of those in a limit order book [CDX23], with a few additional actions, and more parameters for each action because each loan is not only described by a price. In this section, we give only an overview of actions, and defer to Section 2.4 the description of conditions under which each action is allowed. Each participant has a private type and observes the set of available offers and wallet balances. Next, each participant decides to take-up an existing offer, wait for a better offer, or create its own offer. A participant who creates an offer is a first-mover who must be careful to include a risk premium in their offer that accounts for the risk that other participants possess private information, e.g., about an impending crash in value of a collateral [rse]. This risk premium can be in the form of a higher interest rate, a lower liquidation threshold higher, etc. A participant who is already a party in an ongoing loan must also decide whether to top-up loans where it is a borrower, or to enter into a new loan with better terms in order to repay a previous loan, and whether to liquidate loans where it is lender. Beside waiting and taking no action, at every time step, a participant can take an arbitrary number of actions selected from the following set, which fulfill the fundamental requirements2 . The parenthetical pcp references indicate the design principles associated with each action. 1. (pcp 1) Offer to lend: a lender wallet wL makes public an offer to lend out v units of liq, with a fixed duration d, a fixed interest rate r for each time step, an initial col minimum required collateral ratio ρ, and liquidation condition c. The protocol creates a vault wallet wV for this offer, and the vault wallet holds the v units of liq until the offer is taken up or canceled. The liquidation condition c specifies that whenever the ratio of values between collateral col and loaned liq drops below the liquidation threshold c, liquidation may be triggered. For simplicity, we omit for now additional contract conditions imposed by the lender, such as limiting the set of further actions that can be taken on the borrowed tokens. 2. (pcp 2) Offer to borrow: a borrower wallet wB makes public an offer to borrow v units of liq, backed by z units of col, with a fixed duration d, a fixed interest rate r per time step, a minimum required initial collateral 2 If we ignore the transaction limits in one block of a blockchain, the action space is actually countably infinite.

6

ratio ρ, and a liquidation threshold c. The protocol creates a vault wallet wV for this offer, and the vault wallet holds the z units of col until the offer is taken up or canceled. 3. (pcp 1 and 2) Take-up an offer: a wallet takes up an offer for lending or an offer for borrowing, with collisions resolved according to first-come-firstserved or transaction precedence as recorded on the blockchain. 4. (pcp 1 and 2) Cancel previous offer: a wallet cancels a previously announced offer that has not yet found a taker. 5. (pcp 5) The borrower can top-up the amount of collateral in an ongoing loan to reduce the perceived probability of defaulting. 6. (pcp 3) Interrupt loan: the borrower can end the loan early by repaying the lender the principal plus interest over the full duration d. 7. (pcp 4) If the loan is still ongoing at the maturity time, the liquidation condition is first evaluated. If the liquidation condition is not satisfied, the lender or, with the lender’s authorization, the protocol service provider immediately executes the natural-ending settlement using the collateral valuation at the maturity boundary. The lender is paid with a portion of the collateral, and the remaining collateral is returned to the borrower. 8. (pcp 6) Liquidate the collateral in an ongoing loan if the ratio of collateral value to accrued debt falls below c. Liquidation is only available up to maturity. The lender receives only the amount of collateral whose value equals the accrued debt at the liquidation time, capped by the collateral available in the vault. Any remaining collateral is returned to the borrower. Remark 3 (Additional actions). Although the set of actions that we introduce can be qualified as bare-bones, it is sufficient to derive strong performance guarantees in the following sections. In practice, participants would require additional actions, such as allowing the borrower to draw down from the collateral when its value grows quickly; allow the lender to use a loan on secondary markets like US Treasury bills; and allow participants to modify an offer instead of canceling it. The fundamental object of our lending protocol is an offer or loan record involving a lender wallet, a borrower wallet, and a protocol-created vault wallet. For ease of reference, the notation used in the offer and loan below is summarized in Table 2. An offer to lend created by lender wallet wL is represented by ℓ ≜ (wL , ∅, wV , ∞, v, 0, d, r, ρ, c). Here, wL is the lender wallet, ∅ is a placeholder for the borrower wallet, wV is the vault wallet created for the offer, ∞ is a placeholder for the loan start time, v is the amount of liq offered for lending, and 0 is a placeholder for 7

the amount of col collateral. The parameters d, r, ρ, and c denote the loan duration, the interest rate per time step, the required initial collateral ratio, and the liquidation threshold, respectively. The vault wallet wV holds v units of liq. Remark 4 (Initial collateral ratio ρ and liquidation threshold c). The parameter ρ is the minimum required initial collateral-to-principal ratio ϕt0 (z)/v, whereas c is the liquidation threshold for the collateral-value-to-accrued-debt ratio during the loan. For an admissible loan, ρ > c ensures that the loan starts strictly above the liquidation threshold. Throughout this paper, we focus on permissionless lending and restrict attention to c > 1. This provides an overcollateralization buffer: liquidation can become available while the collateral value still exceeds the accrued debt. By contrast, thresholds c ≤ 1 provide no such buffer. Similarly, an offer to borrow created by borrower wallet wB is represented by b ≜ (∅, wB , wV , ∞, v, z, d, r, ρ, c). Here, ∅ is a placeholder for the lender wallet, wB is the borrower wallet, v is the exact amount of liq requested by the borrower and z is the amount of col collateral. All other entries have the same meanings as in the offer-to-lend record. The vault wallet wV holds z units of col. Finally, an ongoing loan contract between lender wallet wL and borrower wallet wB is represented by o ≜ (wL , wB , wV , t0 , v, z, d, r, ρ, c). Here, t0 is the loan start time, and all other entries have the same meanings as in the offer records. The vault wallet wV holds z units of col. The maturity boundary of the ongoing loan is t0 + d. Definition 1 (Accrued debt and health factor). For an ongoing loan o = (wL , wB , wV , t0 , v, z, d, r, ρ, c) with v > 0, c > 0, and 1 + r > 0, its accrued debt and health factor at time t are respectively: Dt ≜ (1 + r)t−t0 v, ht ≜

ϕt (z) ϕt (z) = . cDt c(1 + r)t−t0 v

(1) (2)

Here, t0 is the loan start time, t is the current time, z is the amount of col collateral held in the vault, ϕt (z) is the USD value of this collateral at time t, v is the principal value in USD, r is the interest rate per time step, and c is the liquidation threshold. Remark 5 (Adaptive health factor). The health factor in (2) follows the convention used in Aave [aav] and Morpho [mor], incorporating the liquidation threshold directly into the ratio. Our parameter c > 1 corresponds to a conventional liquidation threshold 1/c < 1. Liquidation becomes available when 8

ht < 1, or equivalently when ϕt (z)/Dt < c. Unlike overly conservative formulations that compare the collateral value with the loan’s final maturity value (1 + r)d v [HPS24], our definition is adaptive and compares against the accrued debt Dt = (1 + r)t−t0 v up to time t. Definition 2 (Admissible loan at origination). A loan that starts at time t0 , with principal v, collateral z, initial collateral ratio ρ, and liquidation threshold c, is admissible at origination if ρ>c>0

and

ϕt0 (z) ≥ ρv.

At origination time, admissibility ensures that ht0 =

ρ ϕt0 (z) ≥ > 1, cv c

so that the loan is not immediately eligible for liquidation. Remark 6 (Offer creation and take-up). An offer may be created under Action 1 or 2 only if its specified parameters satisfy the applicable conditions in Definition 2. At take-up under Action 3, the resulting loan must satisfy that definition under the current valuation ϕt . For an offer to borrow, collateral z is committed at creation. A fall in its value may prevent take-up for a proposed loan amount v, while the offer remains recorded. The borrower may cancel it through Action 4 and submit a new offer with sufficient collateral through Action 2. If left open, the offer may become executable again for that amount if its collateral value recovers. For an offer to lend, no collateral amount is fixed at creation; the borrower chooses and supplies sufficient collateral at take-up.

2.4

State Transitions

In contrast to lending pools, our state space is much more complicated. It is not even a vector space or finite-dimensional metric space. It is composed of all possible sets of offers, where each offer can be either an offer for borrowing or an offer for lending. A state in our protocol is therefore an element from a countably infinite-dimensional state space, with the form (1)

(Nt )

St ≜ (ℓ(1) , . . . , ℓ(mt ) , b(1) , . . . , b(nt ) , o(1) , . . . , o(kt ) , Wt , . . . , Wt | {z } | {z } | {z } offers to lend

offers to borrow

, ϕt ),

ongoing loans

where mt and nt denote the numbers of outstanding offers available on the (1) (N ) market, kt is the number of ongoing loan contracts, and Wt , . . . , Wt t denote the balances of all wallets in the protocol, including lender wallets, borrower (1) (N ) wallets, and vault wallets. Here Wt , . . . , Wt t include ordinary participant wallets as well as vault wallets. The role of a wallet in a particular offer or loan is specified by the position in which it appears in ℓ, b, o. The three collections of records in the state are disjoint at each time t. A record in the first two collections is an open offer, whereas a record in the third 9

collection is an ongoing loan. When an open offer is taken up, it is removed from the corresponding offer collection and inserted into the ongoing-loan collection. The initial state is an empty market with no offers, and all wallet balances are at their initial values. The state transitions keep track of the available offers on the market, the ongoing contracts, wallet balances, vault balances, and the valuation of collateral. Each action taken by a participant (wallet) at time t triggers a corresponding state transition as follows. 1. Wallet wL initiates the offer to loan ℓ = (wL , ∅, wV , ∞, v, 0, d, r, ρ, c): St+1 = St ∪ ℓ, WL,t+1 [1] = WL,t [1] − v

(commit liq),

WV,t+1 [1] = WV,t [1] + v

(vault receives liq).

The vault wallet wV receives v in liq. 2. Borrower wallet wB takes up an offer to lend ℓ from lender wallet wL by committing z units of col at time t0 : St = (. . . , ℓ, . . .) 7→ St+1 = (. . . , o, . . .), WB,t+1 [1] = WB,t [1] + v,

(receive liq)

WB,t+1 [0] = WB,t [0] − z,

(collateral)

WV,t+1 [1] = WV,t [1] − v,

(vault sends liq)

WV,t+1 [0] = WV,t [0] + z

(vault receives col).

The vault wallet wV sends v in liq to the borrower wallet and receives z in col. The borrower wallet wB is added to the smart contract, along with the current time t, and the collateral z: ℓ = (wL , ∅, wV , ∞, v, 0, d, r, ρ, c) 7→ (wL , wB , wV , t, v, z, d, r, ρ, c) = o. This transaction is only allowed if the collateral z amount results in an admissible loan (Definition 2). In practice, the collateral amount is typically chosen so that its initial value is determined by the collateral ratio ρ, with ϕt0 (z) = ρv up to implementation-level rounding and oracle-update effects. It is extremely important that the borrower calculates the value z carefully to avoid falling into a liquidation condition once the loan starts, which is subject to the valuation process and the volatility in the value of col relative to liq. 3. Borrower wB initiates an offer to borrow b, requesting v units of liq and committing z units of col as collateral: St+1 = St ∪ b, WB,t+1 [0] = WB,t [0] − z

(commit col as collateral),

WV,t+1 [0] = WV,t [0] + z

(vault receives col).

10

4. Lender wallet wL takes up an offer to borrow b at time t by providing the principal v specified in the offer: St = (. . . , b, . . .) 7→ St+1 = (. . . , o, . . .), WL,t+1 [1] = WL,t [1] − v,

(lender commits liq)

WB,t+1 [1] = WB,t [1] + v,

(borrower receives liq),

WV,t+1 [0] = WV,t [0]

(vault keeps col collateral).

The lender wallet wL is added to the smart contract, along with the current time t: b = (∅, wB , wV , ∞, v, z, d, r, ρ, c) 7→ (wL , wB , wV , t, v, z, d, r, ρ, c) = o. This transaction is only allowed if the collateral amount z and the loan value v result in an admissible loan (Definition 2), thereby satisfying the minimum required initial collateral ratio ρ. 5. The offer creator cancels that offer to lend ℓ: St+1 = St \ ℓ, WV,t+1 [1] = WV,t [1] − v

(vault sends liq),

WL,t+1 [1] = WL,t [1] + v

(redeem liq).

6. The offer creator cancels an offer to borrow b: St+1 = St \ b, WV,t+1 [0] = WV,t [0] − z

(vault sends col),

WB,t+1 [0] = WB,t [0] + z

(redeem col).

7. Borrower wB tops up collateral by ∆z units of col: o = (wL , wB , wV , t0 , v, z, d, r, ρ, c) 7→ o′ = (wL , wB , wV , t0 , v, z + ∆z, d, r, ρ, c), WB,t+1 [0] = WB,t [0] − ∆z

(commit col as collateral),

WV,t+1 [0] = WV,t [0] + ∆z

(vault receives col).

8. Interrupt loan: the borrower wB ends the loan early at time t such that t − t0 ≤ d: St+1 = St \ o, WB,t+1 [1] = WB,t [1] − (1 + r)d · v, d

WL,t+1 [1] = WL,t [1] + (1 + r) · v,

(pay back loan with interest in liq), (lender receives liq),

WV,t+1 [0] = WV,t [0] − z

(vault returns col collateral),

WB,t+1 [0] = WB,t [0] + z

(return full col collateral). 11

9. The lender liquidates loan o at checkpoint t ∈ {t0 + 1, . . . , t0 + d} when the collateral value falls below the liquidation threshold, or equivalently when ht < 1. The liquidation action terminates the loan and distributes the collateral between the lender and borrower respectively as follows: at ≜ min{ϕ−1 t (Dt ), z},

et ≜ z − a t .

(3)

The state transition is St+1 = St \ o,

(4)

WV,t+1 [0] = WV,t [0] − z

(vault sends col collateral),

WL,t+1 [0] = WL,t [0] + at

(lender receives at units of col),

WB,t+1 [0] = WB,t [0] + et

(return remaining col collateral).

(5)

10. Natural end of loan o: at the maturity time t = t0 + d, if the loan is still ongoing, the protocol first evaluates the liquidation condition. If ht < 1, the liquidation action described above applies. Otherwise, the protocol service provider immediately executes the natural-ending settlement. The settlement follows the same collateral-distribution rules as benevolent liquidation. Specifically, the collateral amounts are given by (3), and the state transition is given by (4)–(5), all evaluated at t = t0 + d. To avoid the complexity of performing an exchange between col and liq, the repayment occurs in units of col as opposed to liq, and lender has the burden of converting it back to (1 + r)d v units liq. Remark 7 (Asset-agnostic lender). Observe that the interrupt loan ending repays the lender in liq, whereas the other endings repay in col. We assume throughout the paper that the lender is agnostic to receiving the repayment in col or liq. In other words, we ignore costs for converting between col and liq. Remark 8 (Alternative liquidation rules). The above protocol presents a rule for distributing the collateral that prioritizes repayment of the lender. A more general protocol could conceivably allow a distinct distribution rule for each loan. For instance, a distribution rule that transfers the full collateral to the lender in the event of a liquidation would encourage lenders to participate and borrowers to keep the health factor at more conservative levels. Figure 1 illustrates the transition from an offer to an ongoing loan and to a terminated loan. The state S1 denotes an available offer to borrow, S2 denotes an available offer to lend, S3 denotes an ongoing loan, and S4 denotes a terminated loan or canceled offer. The arrows show the transitions following the different actions of the protocol. Figure 2 illustrates the evolution of the health factor over the course of a loan that starts at time 0. The left panel shows BTC-USD daily close prices Pt from 2026-06-01 to 2026-06-15. The right panel compares three collateral strategies for a loan with v = 50000, c = 1.05, ρ = 1.2, and an APR of 8.00%. 12

Start cre

w rro

o ob rt

off

er

top up

e

off ate e r c

ate

to

len

d

take up

take up

S1

S3

S2

interrupt, liquidate, natural end

cancel

cancel

S4

75,000

1.50

72,500

1.40

70,000

1.30

Health factor

BTC/USD close price

Figure 1: Relation between offers and loans.

67,500 65,000

Baseline More initial collateral: +0.10 BTC Top-up path: +0.10 BTC at t = 5 Minimum required initial health factor Liquidation boundary

1.20 1.10

62,500 60,000

1.00 0

2

4

6

8

10

Loan horizon (days)

12

14

0

2

4

6

8

10

Loan horizon (days)

12

Figure 2: BTC/USD daily close prices and health factor paths under three collateral strategies.

13

14

Health factors are evaluated using (2), with ϕt (z) = Pt z: higher BTC prices or additional collateral increase the health factor, while accrued debt growth reduces it. The dotted and dashed horizontal lines mark the minimum required initial health factor and the liquidation boundary, respectively. The baseline path (circle markers) starts with exactly the required collateral, giving an initial health factor of approximately 1.14. The more-initial-collateral path (square markers) adds 0.1 BTC at origination, increasing the initial health factor to approximately 1.28, whereas the top-up path (triangle markers) adds the same amount of BTC on day 5. Before day 5, the top-up path follows the baseline below the more-initial-collateral path; from day 5 onward, it coincides with the latter because both hold the same amount of BTC. Both the baseline and top-up paths first fall below the liquidation boundary on day 4 (2026-0605). The baseline is below the boundary on days 4, 5, 8, and 9, whereas the top-up path is below it only on day 4. Note that the continuations of the baseline and top-up paths beyond day 4 are shown for illustration only. If liquidation is executed at the first eligible checkpoint, both loans terminate on day 4, before the scheduled top-up. By contrast, the more-initial-collateral path remains above the boundary throughout this historical window, with a minimum health factor of approximately 1.09, avoiding liquidation along this price path. Remark 9 (Regime of few participants). When there are few participants, we can restrict the values that the parameters can take in order to increase the likelihood that offers are taken up. For example, d, ρ, c take finite values, and v is in multiples of 100. Remark 10 (Frontrunning). Frontrunning can occur in various ways. For example, a lender cancels an existing offer to lend and then is about to take up an offer to borrow, but another lender swoops in and preempts this take-up action by paying more gas fee.

3

Performance Guarantees

In this section, we derive two guarantees for participants in our protocol. First, we quantify the probability of liquidation of the collateral during the contractual loan period. Second, we quantify the probability that the lender receives less than the promised repayment when a loan terminates. These are arguably the most important quantities for borrowers and lenders, and can serve as stepping stones to derive other guarantees. Both guarantees are derived under a pessimistic scenario where the borrower never tops up the collateral, and where the lender always triggers the liquidation action as soon as it is allowed. Consider an admissible loan and measure time relative to loan origination. Throughout this section, loan states are indexed by t ∈ {0, . . . , d}, where t = 0 is the origination time and t = d is the maturity time. We assume that neither a collateral top-up nor an interrupt action occurs after origination; hence, the collateral amount z remains fixed. As specified in Section 2.4, the loan is liquidated at the first checkpoint t = 1, . . . , d where ht < 1. At maturity 14

time d, liquidation check is performed one last time before the natural-ending settlement occurs. We model the collateral valuation as a geometric random walk. This is the discrete-time analogue of the geometric Brownian-motion models commonly used in finance [HLZ07, SM69]. Because the collateral amount z remains fixed throughout the analysis, it is sufficient to specify the valuation process for the collateral held by the particular loan under consideration. Assumption 1 (Gaussian log-valuation increments). For the collateral amount z held by the loan, ϕt (z) = eϵt ϕt−1 (z),

t = 1, . . . , d,

where, conditional on the information observed at origination, ϵ1 , . . . , ϵd are independent and identically distributed as N (µ, σ 2 ), with µ ∈ R and σ 2 > 0. With time measured from loan origination, so that t0 = 0, define the log inverse health factor by Yt ≜ − log ht = log

cDt , ϕt (z)

t = 0, . . . , d.

(6)

For the admissible loan under consideration, let Y0 = y0 denote the observed value of the log inverse health factor at origination. For the remainder of the paper, all distributional statements, probabilities, and expectations are conditional on the observed initial value Y0 = y0 . By Assumption 1 and (6), and defining the increments ∆Yk ≜ log(1 + r) − ϵk , we obtain Yt = y0 +

t X k=1

(log(1 + r) − ϵk ), | {z }

t = 1, . . . , d.

(7)

∆Yk

Starting from the initial position y0 , each time increment k brings an additional debt term log(1 + r), which is countered by a collateral appreciation term ϵk . We define the liquidation time in terms of the sequence Yt by observing that liquidation is triggered if ht < 1 ⇐⇒ Yt > 0. Definition 3 (Liquidation time). Let T denote the time when liquidation is triggered, with the convention that it takes value ∞ if no liquidation is triggered. Formally, ( ∞, if Y1 ≤ 0, . . . , Yd ≤ 0, T ≜ (8) min {t ∈ {1, . . . , d} : Yt > 0} , otherwise. In turn, we have {T = 1} = {Y1 > 0},

{T = t} = {Y1 ≤ 0, . . . , Yt−1 ≤ 0, Yt > 0}

The event T = ∞ denotes a natural-ending settlement at time d. 15

t = 2, . . . , d. (9)

3.1

Borrower Liquidation Probability

Since the liquidation event is entirely determined by the path Y1 , . . . , Yd , in this section, first establish the joint distribution of this sequence and then quantify the probability of liquidation. Lemma 1 (Multivariate Gaussian representation). Under Assumption 1, for every t ∈ {1, . .. , d}, the vector random variable (Y1 , . . . , Yt ) has a Gaussian distribution Nt µYt , ΣYt

with mean and covariance matrices:

(µYt )i ≜ y0 + i log(1 + r) − µ ,

(ΣYt )ij ≜ σ 2 min{i, j},

for i, j ∈ 1, . . . , t. (10)

We denote the multivariable Gaussian cumulative distribution function of G ∼ Nt (µ, Σ) by Φt (x; µ, Σ) ≜ P(G ≤ x). Let 0t denote the t-dimensional zero vector. Our main guarantee for the borrower is the following probability of liquidation. Theorem 1 (Borrower liquidation probability). Under Assumption 1 and the loan setup in Section 3, the probability of liquidation at time t is    1 − Φ1 0; µY1 , ΣY1 , for t = 1     P(T = t) = Φt−1 0t−1 ; µYt−1 , ΣYt−1 − Φt 0t ; µYt , ΣYt , for t ∈ {2, . . . , d}, (11) and the probability of liquidation by time s is   P(T ≤ s) = 1 − Φs 0s ; µYs , ΣYs ,

for s ∈ {1, . . . , d}.

(12)

Remark 11 (Operating regime). This theorem shows that, in order to avoid frequent liquidation events or requiring frequent top ups, the lending protocol requires that the value of the collateral increases geometrically faster than the value of the loan with accumulated interest, i.e., that µ > log(1 + r) in (10). Remark 12 (Borrower control). The borrower can use Theorem 1 to select loan terms that keep the liquidation probability below a desired level. Subject to the admissibility requirements, a smaller loan amount v, shorter duration d, lower interest rate r, lower liquidation threshold c, or larger collateral amount z reduces liquidation probability. During the course of the loan, a re-evaluated version of the probability in (12) can also guide whether and how much to top up the collateral.

3.2

Lender repayment shortfall Probability

In this section, we give a guarantee on the probability that the lender suffers a repayment shortfall when the loan terminates. Again, for simplicity, we assume that the borrower lets the loan terminate never topping it up nor interrupting it. We will see that the lender can control this probability through the parameters ρ and c. 16

Definition 4 (Repayment shortfall). We say that the lender suffers a repayment shortfall by time s ∈ {1, . . . , d} if the collateral cannot cover the accrued debt, i.e., T ≤ s and ϕT (z) < DT . Observe that no shortfall can occur if the borrower interrupts the loan or if T = ∞ (no liquidation). In the event of a liquidation at time t, if the lender receives a portion of the collateral equivalent to the accrued debt Dt , it incurs a loss due to missing out on interest from time t to the initial maturity d, but does not suffer a shortfall. For simplicity, we ignore the slippage and other costs that the lender may incur to convert the received portion of col to liq. Theorem 2 (Lender repayment shortfall probability). Under Assumption 1, with the loan setup in Section 3, the lender repayment shortfall probability by time s ∈ {1, . . . , d} is P(T ≤ s, ϕT (z) < DT ) s h   X    i Y Y Y ⊤ Y = 1 − Φ1 log c; µ1 , Σ1 + Φt−1 0t−1 ; µYt−1 , ΣYt−1 − Φt (0⊤ , t−1 , log c) ; µt , Σt t=2

(13) with the sum interpreted as zero when s = 1. Remark 13 (Lender control). For a fixed admissible collateral amount z set by the borrower, the value of c and ρ jointly control the value y0 = log ϕ0cv(z) , subject to the admissibility constraint c < ρ. In turn, the value y0 controls µYt , which finally controls the probability of (13). Therefore, the lender can control this probability by setting c and ρ appropriately or by selecting an offer with such values.

4

Generalized Liquidation and Repayment Shortfall Probabilities

The preceding analysis derives exact liquidation and repayment shortfall probabilities under Gaussian log-valuation increments ϵt . We now employ characteristic functions to generalize those results to arbitrary increments that are independent and identically distributed. This generalization most importantly allows us to select a suitable family of distributions based on prior knowledge about the valuation dynamics of the collateral. The tradeoff is that the general results require numerical approximation of the corresponding integrals. As before, we consider an ongoing loan that started at time t0 = 0. We take the observed origination value of Y0 to be y0 < 0, and recall that Yt = y0 +

t X

∆Yk ,

k=1

17

for t = 1, . . . , d.

We assume that the log-valuation increments ϵ1 , . . . , ϵd are i.i.d., and denote the common characteristic function by φϵ (ω) ≜ E[eiωϵ1 ]. In turn, the sequence ∆Yt is also i.i.d. with a common characteristic function f (ω) ≜ E[eiω∆Y1 ] = eiω log(1+r) φϵ (−ω).

(14)

Define the running maximum of the changes in Yt from its origination value and its characteristic function by Ms ≜ max (Yt − y0 ), 0≤t≤s

χs (ω) ≜ E[eiωMs ],

s = 0, . . . , d.

For t = 1, . . . , d, also define the positive-part sequence and its characteristic functions: (Yt − y0 )+ = max{0, Yt − y0 },

ψt (ω) ≜ E[eiω(Yt −y0 )+ ].

Theorem 3 (Liquidation probability under i.i.d. returns). Suppose that ϵ1 , . . . , ϵd are i.i.d. and that the distribution function of Ms is continuous at −y0 for every s ∈ {1, . . . , d}. Then, the characteristic functions ψt and χs are Z ∞ 1 [f (ω + u)t − f (ω − u)t ] − [f (u)t − f (−u)t ] 1 + f (ω)t + du, t = 1, . . . , d. ψt (ω) = 2 2πi 0 u (15) χ0 (ω) = 1,

χs (ω) =

s 1X

s t=1

ψt (ω)χs−t (ω),

s = 1, . . . , d,

Moreover, the liquidation probability by time s ∈ {1, . . . , d} is Z 2 ∞ sin(−y0 ω) P(T ≤ s) = 1 − Re χs (ω) dω. π 0 ω

(16)

(17)

Remark 14 (Continuity assumption). For each Ms to have a distribution function continuous at −y0 , it is sufficient that each Yt have no probability mass at 0 for every t = 1, . . . , d. For certain distributions of the i.i.d. increments ϵk , including Gaussian, gamma, Poisson, etc., their sum is well-known, allowing the distribution of Yt to be derived analytically. Otherwise, repeated samples of ϵ1 , . . . , ϵt yield samples of Yt , which can be used to estimate its distribution and assess its continuity at 0 by inspection. The integral in (17) may appear similar to [AW92, Eq. 3.6] and [Nut69, Eq. 1], but the characteristic function χs in (16) is computed using an approach similar to that of Haslip and Kaishev [HK14, Proposition 3.4], who adopt Öhgren’s recursion [Öhg01] and Spitzer’s Identity. Whereas Theorem 1 applies only to the Gaussian family of distributions, Theorem 3 applies to every possible family. This broader applicability however requires the numerical evaluation of two integrals ((15) and (17)) over unbounded domains and without analytical form solutions. This introduces both truncation errors and quadrature errors from 18

discretizing the integrals. These errors can be reduced by increasing the truncation cutoffs and reducing the step sizes [AW92, Nut69]. A detailed analysis of these numerical errors is beyond the scope of this paper. To give the corresponding guarantee for lenders, we first define the sequence of joint characteristic functions Γs (u, ω) ≜ E[eiuMs +iω(Ys −y0 ) ],

(u, ω) ∈ R2 ,

s = 0, . . . , d.

(18)

Theorem 4 (Repayment shortfall probability under i.i.d. returns). Suppose that ϵ1 , . . . , ϵd are i.i.d. and that the distribution function of Mt is continuous at both −y0 and log c − y0 for every t ∈ {1, . . . , d}. Let f , ψt , and χt be the characteristic functions introduced before Theorem 3. Then, the characteristic functions Γs are Γ0 (u, ω) = 1, Γs (u, ω) =

s  1 X ψt (u + ω) + f (ω)t − ψt (ω) Γs−t (u, ω), s t=1

s = 1, . . . , d. (19)

Moreover, for s = 1, . . . , d, the repayment shortfall probability is " Z s X 1 ∞ sin(−y0 ξ) P(T ≤ s, ϕT (z) < DT ) = Re χt−1 (ξ) dξ π 0 ξ t=1 ) # Z ∞ ( Z ∞   1 sin(−y u) f (ω) 0 + 2 Γt−1 (u, ω) + Γt−1 (−u, ω) du dω . Im e−iω(log c−y0 ) π 0 ω u 0 (20)

4.1

Empirical Liquidation and Repayment Shortfall Probabilities

To employ Theorems 3 and 4, we need to know the distribution or characteristic function φϵ for the sequence ϵt . In this section, we consider the inference problem where this distribution is unknown and must be inferred from historical samples. The first step is to select the most suitable one from a set of three candidate parametric distributions by estimating the corresponding parameters. The second step is to calculate the liquidation probability and repayment shortfall probabilities by plugging-in this distribution into Theorems 3 and 4, respectively. To illustrate these two steps, we use daily BTC-USD returns collected from September 7, 2021 to September 6, 2026 to fit Gaussian, Student-t, and symmetric stable Paretian distributions. Mandelbrot [Man63] proposes stable Paretian distributions for returns to account for departures from Gaussian behavior, such as unusually large price movements. Blattberg and Gonedes [BG74] finds that empirical returns are more Student-t than symmetric stable Paretian, while Chu et al. [CNC15] reports a better fit for Student-t than Gaussian. We select 19

as the most suitable distribution the one with lowest AIC [Aka74]—or lowest BIC [Sch78]. For completeness sake, we compare the liquidation and repayment shortfall probabilities obtained under the three fitted distributions. In the Gaussian case, we also show that successive approximations of the liquidation and repayment shortfall probabilities of Theorems 3 and 4 approach the corresponding exact probabilities of Theorems 1 and 2 as we increase truncation levels. We estimate the parameters of the Gaussian and Student-t distributions by maximum likelihood. For the symmetric stable Paretian distribution, we perform maximum likelihood estimation using SciPy [VGO+ 20], which implements Nolan’s numerical method [Nol97]. Table 1 reports the maximum-likelihood estimates α b1 , . . . , α b8 of the distribution parameters α1 , . . . , α8 , together with the corresponding estimated daily drift E[∆Yt ], AIC, and BIC. Both AIC and BIC favor the Student-t distribution. In Figure 3, we consider an example loan with a duration of d = 30 days, an annual effective interest rate of 6.00%, a required initial collateral ratio of ρ = 1.20, and a liquidation threshold of c = 1.05. The initial collateral is set at the minimum admissible level such that ϕ0 (z) = ρv, and the daily interest rate is r = (1.06)1/365 − 1. Figure 3A compares the liquidation probabilities obtained from Theorem 3 under the three return distributions from Table 1, with truncation levels U = Ω = 1000 for the inner and outer integrals in (15) and (17). For short time horizons, both Student-t and symmetric stable Paretian distributions give higher estimated liquidation probabilities than Gaussian distribution, which is consistent with the fact that they have heavier tails. The symmetric stable Paretian distribution gives the highest estimates for the liquidation probability throughout the thirty-day horizon, reaching a liquidation probability of 34.55% within thirty days from loan origination. The Gaussian and Student-t gives similar estimates for the liquidation probability, especially for long time horizons: the liquidation probabilities are 31.03% and 30.89%, respectively, within 30 days. Next, we examine the numerical approximation in Theorem 3 in the Gaussian case, for which Theorem 1 provides an exact analytical baseline. We approximate (17) at truncation levels U = Ω ∈ {10, 100, 1000}. Figure 3B shows that, as the truncation levels increase, the numerical estimates converge to the analytical Gaussian probabilities as expected. Figure 3C compares the repayment shortfall probabilities obtained from Theorem 4 under the three return distributions from Table 1, with truncation levels U = Ω = 1000. The Gaussian, Student-t, and symmetric stable Paretian distributions give estimated repayment shortfall probabilities of 0.90%, 4.92%, and 9.90%, respectively, within 30 days. Using the same fitted Gaussian distribution and loan parameters, we next evaluate the repayment shortfall probability using Theorem 4. Figure 3D compares numerical evaluations of (20) at U = Ω ∈ {100, 1000} with the analytical Gaussian probabilities of Theorem 2.The case U = Ω = 10 is omitted because the numerical estimates deviate substantially from the analytical Gaussian probabilities. The integral defining ψt in (15) and the u integrals in (20) are truncated at U , while the outer ω integral is truncated at Ω. The repayment shortfall probability is lower than 20

the liquidation probability throughout the thirty-day horizon. For example, on day 30, the Gaussian benchmarks give a repayment shortfall probability of 0.90%, compared with a liquidation probability of 31.04%. Table 1: Parameter estimates and model selection. Distribution

Parameter

Daily drift estimates E[∆Yt ] (×10

estimates Gaussian

α b1 = 2.92 × 10

−4

−4

AIC

BIC

−7967.82

−7956.80

)

−1.32

α b2 = 2.72 × 10−2 Student-t

−0.35 −8301.38 −8284.85

α b3 = 2.86 α b4 = 1.95 × 10

−4

α b5 = 1.71 × 10−2 −0.75

Symmetric stable α b6 = 1.55 Paretian

α b7 = 1.40 × 10

−8262.35

−8245.82

−2

α b8 = 2.35 × 10−4 The parameters are: Gaussian, α1 (mean) and α2 (standard deviation); Student-t, α3 (degrees of freedom), α4 (location), and α5 (scale); symmetric stable Paretian, α6 (stability index), α7 (scale), and α8 (location).

In practice, we also recommend updating the estimated probabilities at each checkpoint (with the last realization of Yt ) for improved prediction accuracy. Although checkpoints occur at a daily frequency in our example, the same approach holds when checkpoints occur at the same frequency as price updates by an oracle.

5

Related Works

Our lending protocol has a unique set of features: it is a permissionless marketplace, with fixed rate and fixed maturity. Each of these features connects it to existing protocols, but together distinguish it from most. By virtue of being a marketplace that matches lenders and borrowers to create fixed-rate fixed-term loans, it is reminiscent of traditional loans with well-defined fixed-rate, like the USD 28 trillion of US Treasury securities outstanding today [fin]. In the latter setting, there is a single borrower who issues bills through discriminatory and uniform-price auction [BH15, Gol07] among lenders. In our protocol, the interest rate of ongoing loans is determined by a different competition, where lenders and borrowers dynamically cancel and resubmit offers, and loans are taken-up instantaneously on a first-come-first-served basis, much like limit orders in order books [CDX23]. Other examples of fixed-rate lending marketplaces include permissioned protocols, such as Prosper [CGL14] and LendingClub, and permissionless protocols, such as ETHLend [ETH]. 21

0.35 0.35 0.35 0.35 0.30 0.30 0.30 0.30

0.35 0.35 0.35 0.35 0.30 0.30 0.30 0.30

Liquidation Liquidation probability Liquidation probability Liquidationprobability probability

Liquidation Liquidation probability probability Liquidation Liquidationprobability probability

Gaussian Gaussian Gaussian Gaussian Student-t Student-t Student-t Student-t Symmetric Symmetricstable stable Symmetric Symmetric stable stable

0.25 0.25 0.25 0.25 0.20 0.20 0.20 0.20

0.25 0.25 0.25 0.25 0.20 0.20 0.20 0.20

0.15 0.15 0.15 0.15 0.10 0.10 0.10 0.10

0.15 0.15 0.15 0.15 0.10 0.10 0.10 0.10

0.05 0.05 0.05 0.05 0.00 0.00 0.00 0.00 1111

5555

10 10 1010

15 15 1515

20 20 2020

25 25 2525

5555

0.008 0.008 0.008 0.008

Gaussian Gaussian(analytical) (analytical) Gaussian Gaussian (analytical) (analytical) Gaussian Gaussian(U (U = == 100) =100) 100) Gaussian Gaussian = = 100) Gaussian Gaussian(U (U(U == == 1000) =1000) 1000) Gaussian Gaussian (U (U(U = == = =1000)

30 30 3030

Loan Loanhorizon horizonssss(days) (days) Loan Loan horizon horizon (days) (days) (A) (A) Liquidation Liquidation probabilities probabilities under under the thethree threefitted fitted (A) (A) Liquidation Liquidation probabilities probabilities under under the the three three fitted fitted return return distributions, distributions, evaluated evaluated at 1000 .. .. return return distributions, distributions, evaluated evaluated atatatUUUU= === = ===1000 1000 1000 (A)

0.08 0.08 0.08 0.08

Gaussian Gaussian Gaussian Gaussian Student-t Student-t Student-t Student-t Symmetric Symmetricstable stable stable Symmetric Symmetric stable

15 15 1515

20 20 2020

25 25 2525

30 30 3030

20 20 2020

25 25 2525

30 30 3030

0.006 0.006 0.006 0.006

0.06 0.06 0.06 0.06

0.004 0.004 0.004 0.004

0.04 0.04 0.04 0.04

0.002 0.002 0.002 0.002

0.02 0.02 0.02 0.02 0.00 0.00 0.00 0.00 1111

10 10 1010

Loan Loanhorizon horizonssss(days) (days) Loan Loan horizon horizon (days) (days) (B) (B) Gaussian Gaussian liquidation liquidation probabilities: probabilities: analytical analytical (B) (B)Gaussian Gaussian liquidation liquidation probabilities: probabilities: analytical analytical benchmark benchmark and and numerical numerical evaluations evaluations atat benchmark benchmark and and numerical numerical evaluations evaluations (B) === {10, {10, {10,100, 100, 100,1000} 1000} 1000}.. .. atat UUUU= {10, 100, 1000}

Repayment-shortfall Repayment-shortfall probability Repayment-shortfall probability Repayment-shortfallprobability probability

Repayment-shortfall Repayment-shortfall probability probability Repayment-shortfall Repayment-shortfallprobability probability

0.10 0.10 0.10 0.10

Gaussian Gaussian(analytical) (analytical) Gaussian Gaussian (analytical) (analytical) Gaussian Gaussian(U = = =10) 10) Gaussian Gaussian (U(U(U === ==10) 10) Gaussian Gaussian(U (U = =100) 100) Gaussian Gaussian (U (U = == = ==100) 100) Gaussian Gaussian(U = =1000) 1000) Gaussian Gaussian (U(U(U === = ==1000) 1000)

0.05 0.05 0.05 0.05 0.00 0.00 0.00 0.00 1111

5555

10 10 1010

15 15 1515

20 20 2020

25 25 2525

30 30 3030

Loan Loanhorizon horizonssss(days) (days) Loan Loan horizon horizon (days) (days) (C) (C)Repayment-shortfall Repayment-shortfallprobabilities probabilitiesunder underthe thethree three (C) (C) Repayment-shortfall Repayment-shortfall probabilities probabilities under under the the three three fitted fittedreturn returndistributions, distributions, evaluatedat 1000.. .. (C) evaluated fitted fitted return return distributions, distributions, evaluated evaluated atatatUUUU= === = ===1000 1000 1000

0.000 0.000 0.000 0.000 1111

5555

10 10 1010

15 15 1515

Loan Loanhorizon horizonssss(days) (days) Loan Loan horizon horizon (days) (days) (D) (D)Gaussian Gaussianrepayment-shortfall repayment-shortfallprobabilities: probabilities: (D) (D) Gaussian Gaussian repayment-shortfall repayment-shortfall probabilities: probabilities: analytical analyticalbenchmark benchmark and andnumerical numerical evaluations evaluationsatat (D) analytical analytical benchmark benchmark and and numerical numerical evaluations === {100, {100, {100,1000} 1000} 1000}.. .. evaluationsatat UUUU= {100, 1000} Figure 3: liquidation Liquidation probabilities (A,probabilities B) and repayment shortfall probabilities Borrower Borrower liquidationand andlender lender repayment-shortfall repayment-shortfall probabilities over over30 30days. days.Gaussian, Gaussian, Student-t, Student-t, and and Borrower Borrower liquidation liquidation and and lender lender repayment-shortfall repayment-shortfall probabilities probabilities over over 30 days. days. Gaussian, Gaussian, Student-t, Student-t, and and symmetric stable stable Paretian Paretian distributions distributions are arefitted fitted to todaily daily BTC-USD BTC-USD log log30 returns. returns. symmetric symmetric stable stable Paretian Paretian distributions distributions are are fitted fitted to to daily daily BTC-USD BTC-USD log log returns. returns. (C,symmetric D) over thirty days. Panels (A, C) compare Gaussian, Student-t, and The Theannual annualeffective effectiveinterest interestrate rateis 6%,, ,, = 1.20,, ,cc,c= 1.05,, ,and ,and and 00(z) ==v.v. 0(z) The The annual annual effective effective interest interest rate rate isisis6% 6% 6% ===1.20 1.20 1.20 =c==1.05 1.05 1.05 and (z) 0(z)== vv. .

symmetric stable Paretian return distributions using U = Ω = 1000. Panels (B, D) compare analytical Gaussian probabilities from Theorems 1 and 2 with numerical estimates from Theorems 3 and 4, respectively, using U = Ω ∈ {10, 100, 1000} in (B) and U = Ω ∈ {100, 1000} in (D). All numerical estimates use a base quadrature step size of 0.5.

22

Our lending protocol is most similar to Morpho Midnight, which introduces intent-based, fixed-term, fixed-rate markets in which lenders and borrowers express offers with acceptable terms [Mor25, Mor26]. Other fixed-rate and fixed-term lending protocols have recently been proposed, emphasizing undercollateralized borrowing [Wil25] or tokenized fixed-rate instruments [Ter26]. The main distinction of our protocol are the performance guarantees for both borrowers and lenders. Other existing permissionless lending protocols are pool-based (e.g., Aave, Compound) with variable interest rates, or auction-based (Term Finance [ter]) with fixed rates. In contrast to lending pools3 , our protocol is impervious to interest-rate manipulations by other users manipulating the utilization rate [HPS24, BL25] or by the lending-pool authority (e.g., Aave, Compound). Our interest rates are fixed, whereas pool-based lending protocols have variable interest rates that change with utilization [BBGD+ 25] and a few lenders often control a majority of the liquidity [GWPK20]. The interest rate for ongoing loans are products of a dynamic competition among participants, which is arguably more fair than the arbitrary rates [HPS24] on lending pools—e.g., Chaos Labs set the interest rate for Aave until April 2026 [cha]. A borrower can first look outside our protocol for the best available rate, and then publish an offer to borrow or immediately take up an offer to lend that is better than elsewhere. Since our loans have a fixed duration d, we avoid redemption bottlenecks due to insufficient reserves in lending pool. By setting a lower bound on allowed values for the duration d, our protocol can prevent flash loan, and the associated attacks [QZLG21]. Most of the technical literature on lending protocols uses a continuous-time model (e.g., Brownian motion) for the valuation of tokens with respect to a numéraire (e.g., USD). The probability of liquidation for a continuous-time lending protocol with zero drift is analyzed in [BV25]. The optimal collateral amount is derived in [MP24]. An alternative lending pool is proposed to address the impossibility of fair interest rates in existing lending pools [HPS24]. A dynamic equilibrium model is proposed in [COYZ23] to predict equilibria that arise over time. Discrete-time models similar to ours are presented in [BNW+ 24, BL25]. The problem of slow convergence of interest rates to a market equilibrium is highlighted in [BNW+ 24]. A detailed model of lending pools is presented in [BL25] along with major features.

6

Open Problems and Future Work

This paper takes a first step in providing performance guarantees that enable rigorous risk management in permissionless decentralized finance. There are of course many important directions for future work. For instance, how do we generalize our results a setting with stochastic gas fees? How do we extend the performance guarantees of Theorem 3 to returns 3 For ease of comparison, we describe lending pools in Appendix C using the same section headings as Section 2.

23

that are not i.i.d. Since the order of transactions on the blockchain are determined by gas fees, can we use a commitment scheme to protect participants from front-running [KDC23]. How do we quantify the dynamics of participants that observe ongoing loan contracts and use tâtonnement-like [Wal74] offers to gauge market demand, as in [CDX23]. How do we model the error between the valuation process ϕt and the actual proceeds of converting the collateral col to liq? Although these guarantees are useful once two participants have already taken actions to contract a loan, other performance guarantees are beyond the scope of this paper. We do not give guidance to the participants on when to take up an offer, versus creating an offer, or waiting for a better offer to appear. We do not characterize how quickly offers turn into loans, nor the convergence of interest rates of similar offers.

References [aav]

Full deprecation of stable rate. https://governance.aave.com/t/ bgd-full-deprecation-of-stable-rate/16473. Accessed: 2025-09-08.

[Aka74]

Hirotugu Akaike. A new look at the statistical model identification. IEEE Transactions on Automatic Control, 19(6):716–723, 1974.

[AW92]

Joseph Abate and Ward Whitt. The Fourier-series method for inverting transforms of probability distributions. Queueing Systems, 10:5–87, 1992.

[BBGD+ 25] Charles Bertucci, Louis Bertucci, Mathis Gontier Delaunay, Olivier Gueant, and Matthieu Lesbre. Agents’ behavior and interest rate model optimization in DeFi lending. Available at SSRN 4802776, 2025. [BCHO25]

Juan Beccuti, Thunj Chantramonklasri, Matthias Hafner, and Nicolas Oderbolz. Towards a formal framework of the ethereum staking market, 2025.

[BG74]

Robert C. Blattberg and Nicholas J. Gonedes. A comparison of the Stable and Student distributions as statistical models for stock prices. The Journal of Business, 47(2):244–280, 1974.

[BH15]

Sushil Bukhchandani and Chi-fu Huang. Auctions with resale markets: An exploratory model of Treasury bill markets. The Review of Financial Studies, 2(3):311–339, 05 2015.

[BL25]

Massimo Bartoletti and Enrico Lipparini. A theory of lending protocols in DeFi, 2025.

[BNW+ 24] Mahsa Bastankhah, Viraj Nadkarni, Xuechao Wang, Chi Jin, Sanjeev Kulkarni, and Pramod Viswanath. Thinking fast and slow: Data-driven adaptive DeFi borrow-lending protocol, 2024. 24

[BV25]

Timofei Belenko and Georgii Vosorov. DeFi liquidation risk modeling using the reflection principle for zero-drift Brownian motion, 2025.

[CDX23]

Rama Cont, Pierre Degond, and Lifan Xuan. A mathematical framework for modelling order book dynamics, 2023.

[CGL14]

Ning Chen, Arpita Ghosh, and Nicolas S Lambert. Auctions for social lending: A theoretical analysis. Games and Economic Behavior, 86:367–391, 2014.

[cha]

Chaos Labs is leaving Aave. https://governance.aave.com/t/ chaos-labs-is-leaving-aave/24386. Accessed: 2026-07-16.

[CNC15]

Jeffrey Chu, Saralees Nadarajah, and Stephen Chan. Statistical analysis of the exchange rate of Bitcoin. PLOS ONE, 10(7):e0133678, 2015.

[COYZ23]

Jonathan Chiu, Emre Ozdenoren, Kathy Yuan, and Shengxing Zhang. On the fragility of DeFi lending. Staff Working Papers 23-14, Bank of Canada, Feb 2023.

[DMS20]

Itamar Drechsler, Alan Moreira, and Alexi Savov. Liquidity and volatility. Technical report, National Bureau of Economic Research, 2020.

[ETH]

Ethlend.io white paper. https://github.com/ETHLend/ Documentation/blob/master/ETHLendWhitePaper.md. Accessed: 2025-09-08.

[FGT08]

Emmanuel Farhi, Mikhail Golosov, and Aleh Tsyvinski. A theory of liquidity and regulation of financial intermediation, 2008. Manuscript, February 25, 2008.

[fin]

Trade reporting and compliance engine. www.finra.org/finra-data/ browse-catalog/about-treasury. Accessed: 2025-09-08.

[GKL24]

Juan Garay, Aggelos Kiayias, and Nikos Leonardos. The Bitcoin backbone protocol: Analysis and applications. J. ACM, 71(4), August 2024.

[Gol07]

David Goldreich. Underpricing in discriminatory and uniformprice treasury auctions. The Journal of Financial and Quantitative Analysis, 42(2):443–466, 2007.

[GP51]

J. Gil-Pelaez. Note on the Inversion Theorem. 38(3/4):481–482, 1951.

Biometrika,

[GWPK20] Lewis Gudgeon, Sam M. Werner, Daniel Perez, and William J. Knottenbelt. DeFi protocols for loanable funds: Interest rates, liquidity and market efficiency, 2020. 25

[HK14]

Gareth G. Haslip and Vladimir K. Kaishev. Lookback option pricing using the Fourier transform B-spline method. Quantitative Finance, 14(5):789–803, 2014.

[HLZ07]

Yongmiao Hong, Haitao Li, and Feng Zhao. Can the random walk model be beaten in out-of-sample density forecasts? evidence from intraday foreign exchange rates. Journal of Econometrics, 141(2):736–776, 2007.

[HPS24]

Joe Halpern, Rafael Pass, and Aditya Saraf. Fair interest rates are impossible for lending pools: Results from options pricing, 2024.

[HYZ25]

Xue Dong He, Chen Yang, and Yutian Zhou. Arbitrage on decentralized exchanges, 2025.

[KDC23]

Kshitij Kulkarni, Theo Diamandis, and Tarun Chitra. Towards a theory of maximal extractable value I: Constant function market makers, 2023.

[KM05]

Nobuhiro Kiyotaki and John Moore. Liquidity and asset prices. International Economic Review, 46(2):317–349, 2005.

[Man63]

Benoit Mandelbrot. The variation of certain speculative prices. The Journal of Business, 36(4):394–419, 1963.

[mor]

Morpho midnight whitepaper. https://morpho.org/whitepapers/ midnight-whitepaper.pdf. Accessed: 2026-07-04.

[Mor25]

Morpho. Morpho fixed rate markets: Liberating the potential of onchain loans. https://morpho.org/blog/ morpho-v2-liberating-the-potential-of-onchain-loans/, June 2025. Official blog post.

[Mor26]

Morpho. The morpho effect: April 2026. https://morpho.org/ blog/the-morpho-effect-april-2026/, May 2026. Official blog post discussing Morpho Midnight.

[MP24]

Ciamac Moallemi and Utkarsh Patange. An analysis of fixed-spread liquidation lending in defi. In Financial Cryptography and Data Security. FC 2024 International Workshops: Voting, DeFI, WTSC, CoDecFin, Willemstad, Curaçao, March 4–8, 2024, Revised Selected Papers, page 105–127, Berlin, Heidelberg, 2024. SpringerVerlag.

[Nol97]

John P. Nolan. Numerical calculation of stable densities and distribution functions. Communications in Statistics. Stochastic Models, 13(4):759–774, 1997.

[Nut69]

Albert H. Nuttall. Numerical evaluation of cumulative probability distribution functions directly from characteristic functions. Proceedings of the IEEE, 57(11):2071–2072, 1969. 26

[Öhg01]

Anders Öhgren. A remark on the pricing of discrete lookback options. Journal of Computational Finance, 4(3):141–146, 2001.

[Pin15]

Iosif Pinelis. Characteristic function of the positive part of a random variable and related results, with applications. Statistics & Probability Letters, 106:281–286, 2015.

[PK04]

Giovanni Petrella and Steven Kou. Numerical pricing of discrete barrier and lookback options via Laplace transforms. Journal of Computational Finance, 8(1):1–37, 2004.

[QZLG21]

Kaihua Qin, Liyi Zhou, Benjamin Livshits, and Arthur Gervais. Attacking the DeFi ecosystem with flash loans for fun and profit, 2021.

[rse]

Forensic analysis of the KelpDAO rsETH exploit and cascade effects on DeFi lending markets. https://www.migalabs.io/uploads/ Kelp_DAO_IEEE_V4_6_BRAINS_2026_6361a2be9b.pdf. Accessed: 2026-07-16.

[Sch78]

Gideon Schwarz. Estimating the dimension of a model. The Annals of Statistics, 6(2):461–464, 1978.

[Sha53]

L. S. Shapley. Stochastic games. Proceedings of the National Academy of Sciences, 39(10):1095–1100, 1953.

[SM69]

Paul Samuelson and Robert C. Merton. A complete model of warrant pricing that maximizes utility. IMR; Industrial Management Review (pre-1986), 10(2):17, Winter 1969. Copyright - Copyright Sloan Management Review Association, Alfred P. Sloan School of Management Winter 1969.

[Spi56]

Frank Spitzer. A combinatorial lemma and its application to probability theory. Transactions of the American Mathematical Society, 82(2):323–339, 1956.

[SVFK24]

Nicholas Strohmeyer, Sriram Vishwanath, and David FridovichKeil. Improving DeFi mechanisms with dynamic games and optimal control: A case study in stablecoins, 2024.

[ter]

Term auctions. https://docs.term.finance/protocol/term-auctions. Accessed: 2025-09-08.

[Ter26]

TermMax. TMX token whitepaper. https://docs.ts.finance/ resources/tmx-token-whitepaper, 2026. TermMax documentation.

[VGO+ 20]

Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der

27

Walt, Matthew Brett, Joshua Wilson, K. Jarrod Millman, Nikolay Mayorov, Andrew R. J. Nelson, Eric Jones, Robert Kern, Eric Larson, C J Carey, İlhan Polat, Yu Feng, Eric W. Moore, Jake VanderPlas, Denis Laxalde, Josef Perktold, Robert Cimrman, Ian Henriksen, E. A. Quintero, Charles R. Harris, Anne M. Archibald, Antônio H. Ribeiro, Fabian Pedregosa, Paul van Mulbregt, and SciPy 1.0 Contributors. SciPy 1.0: Fundamental algorithms for scientific computing in Python. Nature Methods, 17(3):261–272, 2020. [Wal74]

Léon Walras. Éléments d’économie politique pure ; ou, Théorie de la richesse sociale. G. F. F. La Goutte, Lausanne, 1874.

[Wil25]

Wildcat Protocol. The elevator pitch. https://docs.wildcat. finance/overview/introduction, 2025. Wildcat Protocol documentation.

[Zyg59]

Antoni Zygmund. Trigonometric Series, volume II. Cambridge University Press, Cambridge, 2nd edition, 1959.

28

A

Figures and Tables Table 2: Notation for loan contract

wL wB wV

≜ ≜ ≜

t0 v z d r ρ

≜ ≜ ≜ ≜ ≜ ≜

c

≜

lender wallet borrower wallet protocol-created vault wallet associated with this offer or loan start of loan liq principal amount col collateral amount duration of loan interest rate for each time step minimum required initial collateral-to-loan ratio at time t0 liquidation threshold

B

Proofs

B.1

Proof of Lemma 1

Proof. By (7), Yi = y0 + i log(1 + r) −

i X

ϵk ,

i = 1, . . . , t.

k=1

Thus, (Y1 , . . . , Yt )⊤ is an affine transformation of the independent Gaussian vector (ϵ1 , . . . , ϵt )⊤ and is therefore jointly Gaussian. Its mean is E[Yi ] = y0 + i log(1 + r) −

i X

µ

k=1

= y0 + i log(1 + r) − µ .

29

For 1 ≤ i, j ≤ t, independence of the increments gives Cov(Yi , Yj ) =

j i X X

Cov(ϵk , ϵℓ )

k=1 ℓ=1 min{i,j}

X

=

σ2

k=1 2

= σ min{i, j}. These are the stated mean vector and covariance matrix.

B.2

Proof of Theorem 1

Proof. At the first checkpoint, liquidation occurs when Y1 > 0. Therefore,   P(T = 1) = 1 − Φ1 0; µY1 , ΣY1 . (B.1) For each t ∈ {2, . . . , d}, first liquidation at time t requires that no liquidation occur through time t − 1 and that liquidation occur at time t. By Lemma 1,     (B.2) P(T = t) = Φt−1 0t−1 ; µYt−1 , ΣYt−1 − Φt 0t ; µYt , ΣYt . The first CDF is the probability that Y1 , . . . , Yt−1 are all nonpositive, so no liquidation occurs through time t − 1. The second CDF is the probability that Y1 , . . . , Yt are all nonpositive, so no liquidation occurs through time t. Their difference is therefore the probability that liquidation first occurs at time t. Because the first-liquidation events are mutually disjoint, summing their probabilities gives, for every s ∈ {2, . . . , d},   P(T ≤ s) = 1 − Φ1 0; µY1 , ΣY1 " # s     X Y Y Y Y + Φt−1 0t−1 ; µt−1 , Σt−1 − Φt 0t ; µt , Σt (B.3) t=2

  = 1 − Φs 0s ; µYs , ΣYs . The intermediate CDF terms cancel telescopically. Notice that the result also applies to the case s = 1. Consequently, we have (12) holds for every s ∈ {1, . . . , d}.

B.3

Proof of Theorem 2

Proof. Notice that no repayment shortfall can occur when T = ∞, which corresponds to a natural ending. Section 2.4 specifies the terminal settlements under both natural ending and liquidation. At time d, the protocol first evaluates the

30

liquidation condition using ϕd . If the condition is satisfied, the loan is liquidated; otherwise, the natural-ending settlement is immediately executed using the same collateral valuation. Therefore, T = ∞ implies that the liquidation condition is not satisfied at time d, and (8) gives Yd ≤ 0. Hence, ϕd (z) ≥ cDd > Dd .

(B.4)

Under the natural-ending settlement, the collateral transferred to the lender consequently has value min {Dd , ϕd (z)} = Dd

(B.5)

at time d. Thus, the lender is fully repaid at natural ending, and the event T = ∞ cannot produce a repayment shortfall. For a finite liquidation time T = t, the protocol instead applies the liquidation rule, the lender receives only the amount of collateral needed to cover the accrued debt, capped by the collateral available in the vault, and any excess collateral is returned to the borrower. Under full-collateral liquidation rule of Remark 8, all collateral held in the vault is transferred to the lender, and no collateral is returned to the borrower. Accordingly, let Rtben and Rtfull denote the asset values, evaluated at liquidation time t, of the collateral received by the lender under benevolent and full-collateral liquidation, respectively. Then Rtben = min {Dt , ϕt (z)} ,

Rtfull = ϕt (z).

(B.6)

Conditional on T = t, the shortfall condition under each rule satisfies Rtben < Dt ⇐⇒ min {Dt , ϕt (z)} < Dt ⇐⇒ ϕt (z) < Dt ,

(B.7)

Rtfull < Dt ⇐⇒ ϕt (z) < Dt .

(B.8)

Hence, full-collateral liquidation rule generates exactly the same repayment shortfall event. Because the two events coincide, we may write Rt for the asset value at time t of the collateral received by the lender Rt = Rtben under the standard liquidation rule and Rt = Rtfull under full-collateral liquidation rule. Their common repayment shortfall event at time t is {T = t, ϕt (z) < Dt } = {T = t, Yt > log c} .

(B.9)

The equality follows from Yt = log (cDt /ϕt (z)). On this common shortfall event, Rt = ϕt (z) < Dt under either liquidation rule. If instead ϕt (z) ≥ Dt , then Rt ≥ Dt under either rule, although the realized proceeds may differ across the two rules. Thus, the choice of liquidation rule may affect the amount recovered when no shortfall occurs, but it does not affect the repayment shortfall event or its probability conditional on T = t. The liquidation boundary and the repayment shortfall boundary therefore

31

divide the state space into three regions: No liquidation; no repayment shortfall: Yt ≤ 0

⇐⇒

Liquidation; no repayment shortfall:

0 < Yt ≤ log c

Liquidation with repayment shortfall:

Yt > log c

ϕt (z) ≥ cDt > Dt , (B.10)

⇐⇒

⇐⇒

Dt ≤ ϕt (z) < cDt , (B.11)

ϕt (z) < Dt . (B.12)

The three-region partition summarizes the distinction between borrower liquidation and lender repayment shortfall: the middle region permits liquidation with full repayment. This completes the characterization of repayment shortfall at every finite liquidation time T = t. Using (B.9), together with the facts that T = ∞ does not produce a repayment shortfall and that the finite first-liquidation events {T = t}, t = 1, . . . , d, are mutually disjoint, we obtain, for every s ∈ {1, . . . , d}, P(repayment shortfall by time s) s s X X = P (T = t, Rt < Dt ) = P (T = t, Yt > log c) . t=1

(B.13) (B.14)

t=1

At the first checkpoint, crossing the repayment shortfall boundary Y1 > log c > 0 also triggers the first liquidation. Therefore, the t = 1 term in (B.14) is P (T = 1, Y1 > log c) = P (Y1 > log c)   = 1 − Φ1 log c; µY1 , ΣY1 .

(B.15)

For each t ∈ {2, . . . , d}, the first-passage representation of T gives P (T = t, Yt > log c) = P (Y1 ≤ 0, . . . , Yt−1 ≤ 0, Yt > log c)   
⊤ Y Y  = Φt−1 0t−1 ; µYt−1 , ΣYt−1 − Φt 0⊤ ; µt , Σt . t−1 , log c (B.16) Substituting these joint-event probabilities into (B.14) gives the conditional lender repayment shortfall probability by time s: P(repayment shortfall by time s) " # s   X   
⊤ Y Y  Y Y Y Y ⊤ = 1 − Φ1 log c; µ1 , Σ1 + Φt−1 0t−1 ; µt−1 , Σt−1 − Φt 0t−1 , log c ; µt , Σt . t=2

(B.17) The right-hand side of (13) also agrees with the first-checkpoint result when s = 1, since the summation term is then absent. Consequently, (13) holds for every s ∈ {1, . . . , d}.

32

B.4

Proof of Theorem 3

Proof. Fix s ∈ {1, . . . , d}. Since y0 < 0, the definitions of T and Ms give {T ≤ s} =

s [

 {Yt > 0} =

t=1

 max (Yt − y0 ) > −y0

0≤t≤s

= {Ms > −y0 }.

(B.18)

Thus, to compute the liquidation probability, it suffices to determine the distribution of Ms at −y0 . We first determine thePpositive-part characteristic function t ψt for t = 1, . . . , d. Recall that Yt − y0 = j=1 ∆Yj , where the increments are i.i.d. with characteristic function f . By independence, f (ω)t is the characteristic function of Yt − y0 , so Pinelis’s positive-part formula [Pin15, Eq. 16] applies to (Yt − y0 )+ . This formula expresses ψt (ω) as 12 [1 + f (ω)t ] plus the difference between two transform values evaluated at ω and at zero. Using the positivehalf-axis representation following Eq. (2) in [Pin15], we express each transform value as an integral and subtract the two integrals to obtain Z ∞ 1 + f (ω)t 1 [f (ω + u)t − f (ω − u)t ] − [f (u)t − f (−u)t ] ψt (ω) = + du. 2 2πi 0 u The integral above is well defined as an improper Riemann integral, since Pinelis’s Proposition 1 [Pin15, Proposition 1] establishes the existence of its defining limit. This establishes (15). To derive (16), we pass from the positive parts of the individual partial sums to their running maximum. Since Y0 − y0 = 0, we have Ms = max (Yt − y0 ) 0≤t≤s

= max {0, Y1 − y0 , . . . , Ys − y0 } = max {(Y1 − y0 )+ , . . . , (Ys − y0 )+ } = max {(Yt − y0 )+ } , 1≤t≤s

s = 1, . . . , d.

Here, the positive part is taken separately for each partial sum Yt − y0 before the maximum is taken. In the present notation, the partial sums and their positive parts in [Spi56] are Yt − y0 and (Yt − y0 )+ , respectively, and their running maximum is Ms . Spitzer’s Theorem 3.1 [Spi56, Eq. (3.5)] gives the following generating-function identity for an infinite i.i.d. sequence with the same increment law. Here we use only its coefficients through degree d, which depend solely on ψ1 (ω), . . . , ψd (ω): ) (∞ ∞ X X ψt (ω) t s ζ , |ζ| < 1. (B.19) χs (ω)ζ = exp t s=0 t=1 Because χs and ψt are characteristic functions, their absolute values are bounded by one. The relevant power series therefore converge absolutely and

33

locally uniformly for |ζ| < 1, permitting term-by-term differentiation and multiplication. Differentiating (B.19) with respect to ζ gives (∞ ) ∞ ! ∞ ! ∞ ∞ X X ψt (ω) X X X s−1 t t−1 p t−1 sχs (ω)ζ = exp ζ ψt (ω)ζ = χp (ω)ζ ψt (ω)ζ . t s=1 t=1 t=1 p=0 t=1 (B.20) We now want the coefficient of ζ s−1 in the product of the two series on the right-hand side of (B.20). We find it using the Cauchy product: multiply one term from each series and add their exponents of ζ. Multiplying χp (ω)ζ p from the first series by ψt (ω)ζ t−1 from the second gives χp (ω)ψt (ω)ζ p+t−1 . For this term to contribute to the coefficient we want, its exponent must satisfy p + t − 1 = s − 1, or equivalently p = s − t. Since the first series starts at p = 0 and the second at t = 1, the possible values are t = 1, . . . , s. Collecting the terms with the same power of ζ, we obtain ! ∞ ! ! ∞ ∞ s X X X X p t−1 χp (ω)ζ ψt (ω)ζ = ψt (ω)χs−t (ω) ζ s−1 . (B.21) p=0

t=1

s=1

t=1

We can now compare the coefficients on the two sides. After differentiation, the coefficient of ζ s−1 on the left-hand side is sχs (ω). On the right-hand side, Ps it is t=1 ψt (ω)χs−t (ω). Since the two power series are equal for |ζ| < 1, uniqueness of power-series coefficients gives sχs (ω) =

s X

ψt (ω)χs−t (ω).

(B.22)

t=1

Since M0 = 0, we have χ0 (ω) = 1 and the discrete convolution recursion s

χs (ω) =

1X ψt (ω)χs−t (ω), s t=1

s = 1, . . . , d.

Thus, we have proved (16). It remains to prove (17). Let Fs (x) ≜ P(Ms ≤ x) denote the distribution function of Ms . By the theorem’s assumption, Fs is continuous at −y0 , and hence P(Ms = −y0 ) = 0. Moreover, since Ms ≥ 0 and y0 < 0, Fs is also continuous at y0 , with Fs (y0 ) = 0. Thus neither evaluation point carries probability mass, so we use the continuity-point form of the Gil-Pelaez inversion formula [GP51, p. 481]. If there were mass at −y0 , the discontinuity version would instead return the average of the two one-sided limits [GP51, p. 482]. A corresponding formula for the liquidation probability could then be derived by a similar argument, but we do not consider that case here. Under the present assumptions, the inversion formula gives, for x ∈ {−y0 , y0 },

Fs (x) =

1 1 + 2 2π

Z ∞ 0

eiωx χs (−ω) − e−iωx χs (ω) dω. iω 34

(B.23)

Apply (B.23) at x = −y0 and x = y0 using these continuity conditions, and subtract the latter identity from the former. Since Ms is real-valued, its characteristic function satisfies χs (−ω) = χs (ω). Hence, χs (−ω) + χs (ω) = 2 Re χs (ω). Euler’s formula gives e−iy0 ω − eiy0 ω = −2i sin(y0 ω) = 2i sin(−y0 ω). Using these two identities, the difference between the two numerators becomes  −iy0 ω    e χs (−ω) − eiy0 ω χs (ω) − eiy0 ω χs (−ω) − e−iy0 ω χs (ω)

= e−iy0 ω − eiy0 ω χs (−ω) + χs (ω) (B.24)

= 2i sin(−y0 ω) 2 Re χs (ω) = 4i sin(−y0 ω) Re χs (ω). It follows that 2 Fs (−y0 ) − Fs (y0 ) = π

Z ∞ Re χs (ω) 0

sin(−y0 ω) dω. ω

Using Fs (y0 ) = 0, which follows from Ms ≥ 0 and y0 < 0, we obtain Z 2 ∞ sin(−y0 ω) dω. Fs (−y0 ) = Re χs (ω) π 0 ω Finally, because {T ≤ s} = {Ms > −y0 }, Z 2 ∞ sin(−y0 ω) P(T ≤ s) = 1 − Fs (−y0 ) = 1 − Re χs (ω) dω. π 0 ω

(B.25)

(B.26)

(B.27)

This establishes (17) and completes the proof.

B.5

Proof of Theorem 4

Proof. Fix s ∈ {1, . . . , d}. Since Yt = log(cDt /ϕt (z)) and c > 1, a repayment shortfall at the first liquidation time t occurs exactly when the loan survives through t − 1 and Yt > log c. Hence {T = t, ϕt (z) < Dt } = {Mt−1 ≤ −y0 , Yt − y0 > log c − y0 }. The probability of this event is the survival probability multiplied by the conditional probability that the endpoint exceeds the shortfall threshold. When P(Mt−1 ≤ −y0 ) > 0, P(T = t, ϕt (z) < Dt ) = P(Mt−1 ≤ −y0 ) P(Yt − y0 > log c − y0 | Mt−1 ≤ −y0 ). (B.28) 35

The first factor equals 1−P(T ≤ t−1) and can therefore be evaluated using (17) in Theorem 3, with value 1 when t = 1. To evaluate the second factor in (B.28), we compute the characteristic function of the endpoint conditional on survival and then apply Fourier inversion. This conditional characteristic function is E[eiω(Yt −y0 ) | Mt−1 ≤ −y0 ] =

E[eiω(Yt −y0 ) 1{Mt−1 ≤−y0 } ] . P(Mt−1 ≤ −y0 )

(B.29)

The denominator in (B.29) is the known survival probability. The numerator averages the endpoint exponential only over paths satisfying the restriction on the past maximum; evaluating it therefore requires the dependence between these two random quantities. The proof follows three linked steps. Step 1 obtains the joint characteristic function of Mt−1 and Yt − y0 , which describes the joint distribution needed in this restricted expectation. Step 2 uses that function to impose Mt−1 ≤ −y0 , evaluates the numerator in (B.29), and divides by the known survival probability to obtain the conditional characteristic function in (B.29). Step 3 applies Fourier inversion to (B.29) at log c − y0 to evaluate the second factor in (B.28). Multiplying by the survival probability and summing over t = 1, . . . , s then gives the cumulative probability in (20). Step 1. The numerator in (B.29) involves Mt−1 and Yt − y0 . We first determine Γt−1 , which describes (Mt−1 , Yt−1 − y0 ), and then include the independent increment at t to obtain the joint characteristic function of the required pair. Petrella and Kou [PK04, Lemma 1, Eqs. (7) and (9)] give the joint recurrence Γs (u, ω) =

s  1 X  i(u+ω)(Yt −y0 )+ E[e ] + E[e−iω max{y0 −Yt ,0} ] − 1 Γs−t (u, ω). s t=1

The positive- and negative-part decomposition used in the proof of their Lemma 2 yields the identity e−iω max{y0 −Yt ,0} = 1 + eiω(Yt −y0 ) − eiω(Yt −y0 )+ . Taking expectations gives E[e−iω max{y0 −Yt ,0} ] = 1 + f (ω)t − ψt (ω), which establishes (19). Independence of ∆Yt from the increments through t − 1 now gives E[eiuMt−1 +iω(Yt −y0 ) ] = E[eiuMt−1 +iω(Yt−1 −y0 ) ]E[eiω∆Yt ] = f (ω)Γt−1 (u, ω). This is the joint transform of the two random quantities appearing in (B.28). Step 2 uses it to retain only the paths that satisfy the survival restriction. Step 2. We now compute the expectation in the numerator of (B.29). The same independence used in Step 1 gives E[eiω(Yt −y0 ) 1{Mt−1 ≤−y0 } ] = f (ω) E[eiω(Yt−1 −y0 ) 1{Mt−1 ≤−y0 } ]. 36

(B.30)

We evaluate the remaining expectation by following the truncated-integral argument of Gil-Pelaez [GP51]. The identity obtained below can alternatively be derived from classical Fourier–Stieltjes inversion applied to the distribution of the past maximum weighted by the endpoint exponential [Zyg59, Vol. II, Chapter XVI, § 4, Theorem (4.5)]. To express its survival indicator as an integral, we first establish the algebraic identity for the integrand. Euler’s formulas give     eiuMt−1 + e−iuMt−1 = cos(uMt−1 ) + i sin(uMt−1 ) + cos(uMt−1 ) − i sin(uMt−1 ) = 2 cos(uMt−1 ). The imaginary terms cancel. Multiplying this identity by sin[(−y0 )u] therefore gives   sin[(−y0 )u] eiuMt−1 + e−iuMt−1 = 2 sin[(−y0 )u] cos(uMt−1 ). Next, the sine addition and subtraction formulas give sin[(−y0 + Mt−1 )u] = sin[(−y0 )u] cos(uMt−1 ) + cos[(−y0 )u] sin(uMt−1 ), sin[(−y0 − Mt−1 )u] = sin[(−y0 )u] cos(uMt−1 ) − cos[(−y0 )u] sin(uMt−1 ). Adding these equations cancels the terms + cos[(−y0 )u] sin(uMt−1 ) and − cos[(−y0 )u] sin(uMt−1 ). Consequently, sin[(−y0 + Mt−1 )u] + sin[(−y0 − Mt−1 )u] = 2 sin[(−y0 )u] cos(uMt−1 ). Combining the two identities, dividing by πu, and integrating from 0 to a finite U > 0, we obtain Z  1 U sin[(−y0 )u]  iuMt−1 e + e−iuMt−1 du π 0 u Z Z 1 U sin[(−y0 − Mt−1 )u] 1 U sin[(−y0 + Mt−1 )u] du + du. = π 0 u π 0 u We now evaluate the limits of the two sine integrals. The deterministic identity used in the proof of Gil-Pelaez [GP51, p. 481] is Z ∞ sin v π dv = . v 2 0 We apply this identity one sample path at a time. Once we fix the path, Mt−1 is a fixed nonnegative real number. We can then find the two limits by changing variables in each integral, as follows. For the first integral, Mt−1 ≥ 0 and y0 < 0 imply −y0 + Mt−1 > 0. With v = (−y0 + Mt−1 )u, we have u=

v , −y0 + Mt−1

du =

dv , −y0 + Mt−1

37

du dv = . u v

Consequently, for every U > 0, 1 π

Z U

sin[(−y0 + Mt−1 )u] 1 du = u π

0

Z (−y0 +Mt−1 )U 0

sin v dv. v

Since (−y0 + Mt−1 )U → ∞ as U → ∞, the cited identity gives 1 lim U →∞ π

Z U 0

sin[(−y0 + Mt−1 )u] 1 du = u π

Z ∞ 0

sin v 1 dv = . v 2

For the second integral, the sign of −y0 − Mt−1 determines the result. If Mt−1 < −y0 , then −y0 − Mt−1 > 0. Taking v = (−y0 − Mt−1 )u again gives du/u = dv/v, and hence 1 π

Z U

1 sin[(−y0 − Mt−1 )u] du = u π

0

Z (−y0 −Mt−1 )U 0

sin v dv. v

The upper endpoint tends to infinity, so 1 lim U →∞ π

Z U 0

1 sin[(−y0 − Mt−1 )u] du = u π

Z ∞ 0

1 sin v dv = . v 2

If Mt−1 > −y0 , then Mt−1 + y0 > 0. The oddness of the sine function gives sin[(−y0 − Mt−1 )u] = sin[−(Mt−1 + y0 )u] = − sin[(Mt−1 + y0 )u]. Therefore, taking v = (Mt−1 + y0 )u, we obtain 1 π

Z U 0

sin[(−y0 − Mt−1 )u] 1 du = − u π 1 =− π

Z U 0

sin[(Mt−1 + y0 )u] du u

Z (Mt−1 +y0 )U 0

sin v dv. v

Here (Mt−1 + y0 )U → ∞, and thus 1 U →∞ π

Z U

lim

0

sin[(−y0 − Mt−1 )u] 1 du = − u π

Z ∞ 0

sin v 1 dv = − . v 2

Combining these calculations, for every sample path with Mt−1 ̸= −y0 , 1 U →∞ π

Z U

sin[(−y0 + Mt−1 )u] 1 du = , u 2 0 ( Z U 1 , 1 sin[(−y0 − Mt−1 )u] lim du = 2 1 U →∞ π 0 u −2, lim

38

Mt−1 < −y0 , Mt−1 > −y0 .

Thus their sum tends to 1 when Mt−1 < −y0 and to 0 when Mt−1 > −y0 . The boundary event Mt−1 = −y0 has probability zero by the continuity assumption; for t = 1, it is excluded by M0 = 0 < −y0 . Therefore, Z  1 U sin[(−y0 )u]  iuMt−1 e + e−iuMt−1 du 1{Mt−1 ≤−y0 } = lim U →∞ π 0 u Z  1 ∞ sin[(−y0 )u]  iuMt−1 + e−iuMt−1 du almost surely. = e π 0 u (B.31) Multiplying by eiω(Yt−1 −y0 ) and taking expectations gives E[eiω(Yt−1 −y0 ) 1{Mt−1 ≤−y0 } ] Z ∞ 
1 sin[(−y0 )u] iω(Yt−1 −y0 ) iuMt−1 −iuMt−1 = E e e +e du . π u 0

(B.32)

We now evaluate the expectation on the right-hand side of (B.30) by interchanging the expectation and the improper integral. For fixed ω ∈ R and finite U > 0, the integrand is jointly measurable: after extending sin[(−y0 )u]/u continuously to −y0 at u = 0, it is a continuous function of u and the random vector (Mt−1 , Yt−1 − y0 ). It is also absolutely integrable on the finite interval, since "Z # U
1 iω(Yt−1 −y0 ) sin[(−y0 )u] iuMt−1 −iuMt−1 e E e +e du π u 0 Z 1 U 2(−y0 )U < ∞. ≤ 2(−y0 ) du = π 0 π Here we used |eiω(Yt−1 −y0 ) | = 1, |eiuMt−1 +e−iuMt−1 | ≤ 2, and | sin[(−y0 )u]|/u ≤ −y0 for u > 0. Fubini’s theorem therefore applies on every finite interval. The deterministic sine-integral estimate in the proof of Pinelis’s Proposition 1 [Pin15] implies 1 π

Z U 0

sin[(−y0 ± Mt−1 )u] du ≤ 1 u

for either sign and every U > 0.

The preceding trigonometric identity and the triangle inequality give 1 π

Z U 0

sin[(−y0 )u] iω(Yt−1 −y0 ) iuMt−1 e e + e−iuMt−1 du ≤ 1 + 1 = 2. u

These normalized truncated integrals converge almost surely by (B.31), and the bound is independent of U . Bounded convergence therefore implies convergence of their expectations. On each finite interval, Fubini’s theorem identifies these expectations with the corresponding integrals of the expected integrand. Consequently, the improper integral of the expected integrand exists and equals the 39

expectation of the improper integral in (B.32). This justifies the first equality below; the remaining equalities follow from linearity of expectation and (18): Z ∞ 
sin[(−y0 )u] iω(Yt−1 −y0 ) iuMt−1 1 E e e + e−iuMt−1 du π u 0 Z
i 1 ∞ sin[(−y0 )u] h iω(Yt−1 −y0 ) iuMt−1 E e + e−iuMt−1 du = e π 0 u Z i 1 ∞ sin[(−y0 )u] h iuMt−1 +iω(Yt−1 −y0 ) = E[e ] + E[e−iuMt−1 +iω(Yt−1 −y0 ) ] du π 0 u Z 1 ∞ sin[(−y0 )u] = [Γt−1 (u, ω) + Γt−1 (−u, ω)] du. (B.33) π 0 u The inner integral thus converges for every real ω. Combining (B.32) and (B.33) with (B.30) gives the required numerator: Z f (ω) ∞ sin[(−y0 )u] E[eiω(Yt −y0 ) 1{Mt−1 ≤−y0 } ] = [Γt−1 (u, ω) + Γt−1 (−u, ω)] du. π u 0 (B.34) Dividing by the known survival probability in (B.29) therefore gives, whenever that probability is positive, E[eiω(Yt −y0 ) | Mt−1 ≤ −y0 ] Z ∞ f (ω) sin[(−y0 )u] = [Γt−1 (u, ω) + Γt−1 (−u, ω)] du. πP(Mt−1 ≤ −y0 ) 0 u This determines the conditional characteristic function in (B.29). Step 3 uses it to evaluate the second factor in (B.28). Step 3. To evaluate the second factor in (B.28), we apply Fourier inversion at log c − y0 to the conditional characteristic function in (B.29), as obtained in Step 2. If P(Mt−1 ≤ −y0 ) > 0, the conditional endpoint distribution is continuous at log c − y0 . Indeed, {Mt−1 ≤ −y0 , Yt − y0 = log c − y0 } ⊆ {Mt = log c − y0 }, and the latter event has probability zero by assumption. Applying the inversion formula of Gil-Pelaez [GP51, p. 481] to the conditional characteristic function in (B.29), and taking the complementary probability at log c − y0 , gives
P Yt − y0 > log c − y0 | Mt−1 ≤ −y0 Z n h io 1 1 ∞ 1 Im e−iω(log c−y0 ) E eiω(Yt −y0 ) | Mt−1 ≤ −y0 dω. = + 2 π 0 ω Substituting (B.29) into this expression yields
P Yt − y0 > log c − y0 | Mt−1 ≤ −y0 (  iω(Y −y ) ) Z t 0 E e 1 1 1 ∞ 1 {M ≤−y } t−1 0 = + Im e−iω(log c−y0 ) dω. 2 π 0 ω P(Mt−1 ≤ −y0 )

40

Notice that the survival probability P(Mt−1 ≤ −y0 ) does not change as we integrate over ω. Here it is a positive real number, so we can take its reciprocal outside both the imaginary part and the integral:
P Yt − y0 > log c − y0 | Mt−1 ≤ −y0 Z ∞ n h io 1 1 1 = + Im e−iω(log c−y0 ) E eiω(Yt −y0 ) 1{Mt−1 ≤−y0 } dω. 2 π P(Mt−1 ≤ −y0 ) 0 ω Multiplying by P(Mt−1 ≤ −y0 ), as required by (B.28), gives 1 P(T = t, ϕt (z) < Dt ) = P(Mt−1 ≤ −y0 ) 2 Z ∞ n h io P(Mt−1 ≤ −y0 ) 1 + Im e−iω(log c−y0 ) E eiω(Yt −y0 ) 1{Mt−1 ≤−y0 } dω. π P(Mt−1 ≤ −y0 ) 0 ω Cancelling the common factor in the coefficient of the integral, we obtain 1 P(T = t, ϕt (z) < Dt ) = P(Mt−1 ≤ −y0 ) 2 Z io n h 1 ∞ 1 + dω. Im e−iω(log c−y0 ) E eiω(Yt −y0 ) 1{Mt−1 ≤−y0 } π 0 ω

(B.35)

If the survival probability is zero, the daily shortfall probability and the weighted expectation are both zero, so the last expression remains valid without conditioning on a zero-probability event. Using (17) in Theorem 3, we obtain Z 2 ∞ sin[(−y0 )u] P(Mt−1 ≤ −y0 ) = du. Re χt−1 (u) π 0 u For t = 1, the same identity holds with χ0 = 1 by the Dirichlet integral. Substituting this identity and (B.34) into (B.35), and summing over the disjoint events {T = t, ϕt (z) < Dt }, proves (20).

C

Lending pools

In order to compare with our proposed protocol, we present a precise model of lending pools, such as Aave and Compound.

C.1

Tokens, wallets, oracle

First, we assume that there are two base tokens of interest: col and liq, along with the corresponding credit and debit tokens. In addition to these two base tokens, we also introduce corresponding credit-tokens4 0c and 1c and debittokens 0d and 1d . These tokens and their balances are controlled by the lending pool alone: wallets cannot send them to other wallets. 4 We partially follow the notation from [BL25].

41

We let time steps be denoted t = 1, 2, . . .. The set of participants are a set of wallets W. We abstract away the cryptographic notions behind wallets, and denote the content of a wallet w at time t by wt = (wt [0], wt [0c ], wt [0d ], wt [1], wt [1c ], wt [1d ]) ∈ R6+ .

(C.1)

Here, wt [0] denotes the col balance, and wt [1] denotes the liq balance; wt [0c ] and wt [1c ] denote the credits in col and liq, and wt [0d ] and wt [1d ] denote the debits in col and liq. Credits represent collateral that is deposited into a lending pool, whereas debits track amounts borrowed. We also define the pool reserves at time t as the vector: Λt = (Λt [0], Λt [0c ], Λt [0d ], Λt [1], Λt [1c ], Λt [1d ]) ∈ R6+ .

(C.2)

We assume that there exists a price oracle that takes as input a snapshot Ξt ∈ X of the external environment at time t (e.g., information from various DEXs and CEXs) and outputs a vector of prices, one for each token: πt = π(Ξt ) ∈ R6+ .

(C.3)

c

For a token x, we write ππtt[x[x]] for the slippage-free exchange rate from the corresponding credit token xc to the token x. Equivalently, ππtt[x[x]c ] is the slippage-free exchange rate from the token x to the corresponding credit token xc . Similarly, πt [xd ] πt [x] d πt [x] is the exchange rate from the debit token x to the token x, and πt [xd ] is the exchange rate from the token x to the debit token xd .

C.2

State

The state of the lending pool at time t is composed of the balances of all the wallets participating in the lending pool, the pool reserve Λt , and the price vector π(Ξt ). Assuming that there is a constant number n of wallets participating, then the state at time t is (1)

(n)

Stpool ≜ (wt , . . . , wt , Λt , π(Ξt )).

(C.4)

Following the distinction between wallet balances and pool reserves, we include Λt explicitly in the state, since the pool reserve determines the available liquidity and cannot be replaced by the ordinary token balances held in user wallets. Initially, all credit- and debit-balances are zero.

C.3

Actions

Next, we describe the actions available to the wallets at each time step. The following actions are available to wallets at time t.

42

1. Deposit: a wallet w sends an amount v of x-token into the pool and receives ππtt[x[x]c ] v corresponding xc -credit-tokens. If the value v is allowed, this results in the following state variable updates: wt+1 [x] = wt [x] − v, wt+1 [xc ] = wt [xc ] +

πt [x] v. πt [xc ]

(C.5) (C.6)

The corresponding pool-side reserve update is Λt+1 [x] = Λt [x] + v.

(C.7)

Observe that this deposit assumes that there is no slippage in converting a token x to its xc -credit-token. 2. Borrow: a wallet w receives v units of x-token from the pool and is assigned a corresponding amount of xd -debit-token. If the value v is allowed (enough x-token in the pool and wallet has sufficient collateral), this results in the following state variable updates: wt+1 [x] = wt [x] + v, wt+1 [xd ] = wt [xd ] +

πt [x] v. πt [xd ]

(C.8) (C.9)

The corresponding pool-side reserve update is Λt+1 [x] = Λt [x] − v.

(C.10)

3. Repay: a wallet w sends v units of x-token and reduces its borrowing balance by the corresponding amount of xd -debit-token. If the value v is allowed, this results in the following state variable updates: wt+1 [x] = wt [x] − v,

(C.11)

πt [x] v. wt+1 [xd ] = wt [xd ] − πt [xd ]

(C.12)

The corresponding pool-side reserve update is Λt+1 [x] = Λt [x] + v.

(C.13)

4. Redeem: a wallet w sends v c units of xc -credit-token and receives back the corresponding amount of x-token. If the value v c is allowed, this results in the following state variable updates: πt [xc ] c v , πt [x] wt+1 [xc ] = wt [xc ] − v c . wt+1 [x] = wt [x] +

(C.14) (C.15)

The corresponding pool-side reserve update is Λt+1 [x] = Λt [x] − 43

πt [xc ] c v . πt [x]

(C.16)

5. Liquidate: if the health factor (cf. [BL25]) of a borrower m falls below 1, then a wallet w can liquidate an amount v of m’s x-loan and receive a corresponding amount of y c -credit-tokens from m. This corresponding amount is usually scaled by a factor η > 1 to incentivize liquidation and dis-incentivize borrowers from not putting enough collateral into the pool. If the value v is allowed, this results in the following state variable updates: wt+1 [x] = wt [x] − v,

(repay v on behalf),

πt [x] v, (liquidation reward), πt [y c ] πt [x] mt+1 [xd ] = mt [xd ] − v, (reduce debit balance), πt [xd ] πt [x] v, (loss of collateral). mt+1 [y c ] = mt [y c ] − η πt [y c ] wt+1 [y c ] = wt [y c ] + η

(C.17) (C.18) (C.19) (C.20)

The corresponding pool-side reserve update is Λt+1 [x] = Λt [x] + v.

(C.21)

6. Sending and receiving: a wallet can send and receive tokens 0 and 1 from another wallet, but cannot send credit- and debit-tokens. The balances are updated correspondingly. Remark 15 (Blockchain network fees). So far, for simplicity, we have omitted network transaction fees (e.g., gas) that are typically associated with each action taken by a wallet. These fees can be modeled as additive random variables.

C.4

State transitions

We are now in a position to describe how the state evolves from one time to another, subject to the actions of wallets. In addition to the effect of actions on updating state variables, the state transition also keeps track of interest accumulation as follows. For each token x, the lending pool calculates an interest rate from the utilization of the pool reserve. Let Debtt [x] ≜

X πt [xd ] w∈W

πt [x]

wt [xd ],

(C.22)

denote the total outstanding debt denominated in units of the base token x at time t. The utilization rate of the pool for token x is then Ut [x] ≜

Debtt [x] . Λt [x] + Debtt [x]

(C.23)

A central decision-maker (e.g., Chaos Lab for Aave [cha]) determines coefficients α and β, and sets the interest rate to It [x] ≜ αUt [x] + β. 44

(C.24)

The lending pool then updates credit- and debit-balances for every wallet w: wt+1 [xc ] = (1 + It [x]) · wt [xc ], d

d

wt+1 [x ] = (1 + It [x]) · wt [x ].

45

(C.25) (C.26)

Related documents

• Performance Guarantees for Permissionless Lending#1457928
• Selling Evidence Bit by Bit#1423355
• Enhancing Affine Maximizer Auctions with Correlation-Aware Payment#927231
• From the Social Choice Problem to a Collusion-Proof Tendering Mechanism for Dynamic Stochastic Projects#792968
• From the Social Choice Problem to a Collusion-Proof Tendering Mechanism for Dynamic Stochastic Projects#788964