A public design specification for the liquidation mechanism in the forthcoming $GFOF lending protocol. A design proposal supported by synthetic accounting research. Open to criticism, revision, and public challenge.
This revision distinguishes design objectives from demonstrated capabilities and retains the published arithmetic correction. The ordinary liquidation trigger remains unresolved; read the eligibility notice in Section 5. No production lending rule is adopted by these corrections.
Since this specification's September 19 revision, a private Solana prototype has exercised selected supply, draw, interest-accounting and principal-repayment flows with synthetic tokens. The design-only status described below reflects that earlier revision. There is still no public lending market, audited application or live liquidation rule. See current progress and remaining gates. This status note does not change the proposed liquidation mechanism or the specification's revision history.
The Federation is researching lending infrastructure as part of its broader mission to bring financial activity on-chain. This specification explores whether advance warnings, time to respond and controlled partial liquidation can improve borrower outcomes while accounting for lender exposure and executable liquidity.
The lending protocol is not live. The current work comprises a design proposal and synthetic accounting models, not an audited lending application. Publishing the design makes its assumptions, trade-offs and unresolved decisions available for scrutiny before implementation.
Liquidation mechanisms differ by protocol, version and market. In a debt-repayment model, a liquidator repays some eligible debt and receives collateral valued to include a liquidation bonus. A close factor limits debt repayment; it is not automatically the same percentage of total collateral transferred. Aave's documentation describes repayment limits that vary with the position's health factor and size. Any numerical comparison must identify the relevant market, version and assumptions. Source: Aave liquidation documentation.
Gradual conversion is another design approach: collateral exposure changes over a price range rather than through a single liquidation step. Its outcomes depend on liquidity, price paths and the mechanism's rules. A smoother process does not by itself establish lower losses.
The Federation's research asks three practical questions: can borrowers receive useful warning, can execution avoid unnecessary collateral transfers, and can liquidators remain willing to execute under stressed conditions? These questions need matched scenarios and explicit loss accounting, rather than a universal ranking of protocols.
These are design objectives. They are not guarantees delivered by the present model. Future revisions should explain where objectives conflict and what evidence supports a chosen trade-off.
The proposed mechanism combines advance warnings, a grace period, partial liquidation and batched execution. Their interaction is the subject of this research; novelty and superiority are not established by combining them.
Every collateral market defines three thresholds, not one:
Thresholds would need to be specified for each supported market. The authority to set or change them, the evidence required and the bounds on those changes remain to be defined under the Federation's controlling governance arrangements.
When a position enters the grace LTV band, a grace timer starts. During this window (initial proposal: 30 minutes for stablecoin-collateralized positions, 10 minutes for volatile collateral), the position is not liquidatable. The grace period exists to give the borrower time to:
If the position exits grace LTV during the window, the timer resets. If the position stays in grace and the window closes, the position becomes liquidatable — but only up to a partial amount (4.3).
Unresolved conflict: the preceding eligibility description differs from Section 4.1, which also requires reaching liquidation LTV. See the worked-example notice. Neither interpretation is selected by this correction.
Emergency handling remains unresolved. The earlier proposal compared a price drop with an LTV threshold without defining consistent units. No operational emergency threshold is selected here. A complete design must specify the trigger, data requirements, permitted response, authority and treatment of losses that execution cannot recover. Bypassing grace alone does not establish solvency.
The research uses an illustrative cap of 25% of outstanding debt for a fill. The specification still needs to define how that budget is shared across transactions, actors and blocks. A cap alone does not determine the repayment needed to restore a chosen LTV or guarantee that enough collateral and liquidity remain.
The intended benefit is to avoid unnecessary liquidation while preserving an opportunity for borrowers to respond. Whether that opportunity is usable depends on scheduling, transaction inclusion, data availability and price movement. Repeated fills can accumulate costs, and a price collapse can create a shortfall before any fill occurs. Emergency cap changes and their authorization remain open decisions.
The proposed direction groups eligible liquidation requests into defined execution windows and explores sharing rewards among valid participants. The aim is to reduce advantages from transaction ordering while retaining sufficient incentive to execute.
Batching does not establish that MEV, manipulation or fee competition disappears. The design must address ordering, spam, collusion, censorship, failed attempts and aggregate repayment limits. Neither the reward mechanism nor those adversarial properties has been validated by the current accounting model. Window length, participation conditions and settlement rules remain research choices.
This example illustrates position accounting at a fixed valuation. Numbers are illustrative, not committed parameters.
Sections 4.1 and 4.2 describe different ordinary liquidation conditions. Section 4.1 requires expired grace and reaching the liquidation threshold; Section 4.2 permits liquidation above the grace threshold after grace expires. The example below does not resolve that conflict. Its hypothetical fill demonstrates accounting, not an adopted eligibility rule. This specification remains a research proposal.
Setup. A borrower deposits $10,000 worth of SOL as collateral and borrows $5,000 of USDC. The market has an advisory LTV of 65%, grace LTV of 72%, and liquidation LTV of 78%. Initial LTV: 50%.
Event 1. SOL drops 20%. Collateral is now worth $8,000. LTV = 5000 / 8000 = 62.5%. Still below advisory. Position is healthy. No action taken.
Event 2. SOL drops another 8%. Collateral now $7,360. LTV = 5000 / 7360 = 67.9%. Advisory flag set. Borrower's wallet shows a yellow badge on the position. No penalty. No action permitted against the position.
Event 3. SOL drops another 7%. Collateral is now $6,844.80. LTV = 5000 / 6844.80 ≈ 73.0482%, above the 72% grace threshold but below the 78% liquidation threshold. Under the proposed notification flow, the position enters grace and a 10-minute countdown begins. Notification delivery is not established by this example.
Event 4 — two paths.
Controlled bonus comparison. At the same 5% bonus rate, repaying 50% of the initial $5,000 debt would produce a $125 bonus, compared with $62.50 for a 25% repayment. That is twice the bonus for twice the debt repaid. It is not a comparison of total losses or a claim about a particular protocol. This fixed-price example does not establish solvency through subsequent price shocks.
This is a draft spec. We are publishing it specifically because we don't have all the answers. Here are the open problems:
The grace-period mechanism assumes a borrower who can respond. If a borrower has clearly abandoned a position (no wallet activity for weeks, no response to multiple notifications), should the grace period still apply? Our current lean: yes, because the alternative is a heuristic that will be gamed. But this is a live debate.
An unavailable or unacceptable quote leaves current valuation uncertain. Research compares restarting grace, pausing it and retaining elapsed time, but no production policy has been selected. A fallback source also requires explicit acceptance rules. Preventing liquidation on invalid data does not prevent price exposure or settle who bears a resulting shortfall.
Emergency triggers may create manipulation incentives. The relevant attack cost depends on valuation sources, market depth and execution rules; deep-market assumptions cannot be extended to every collateral type. Trigger design, authorization and adversarial testing remain open.
For one fill repaying 25% of pre-fill debt at a 5% bonus, the bonus equals 1.25% of that pre-fill debt. This is not a limit on loss relative to original collateral or borrower equity, and it does not bound cumulative costs across repeated fills. Price movement and other execution costs can affect outcomes separately. A total worst-case borrower-loss bound remains unresolved.
A nominal bonus does not establish profitable execution. Sale discounts, fees, failed attempts and latency affect participation. Current synthetic models test some of those sensitivities; they do not establish live-market participation or validate the proposed reward-sharing mechanism.
Bringing more financial activity on-chain requires more than tokenizing assets. Lending markets also need defensible valuation, executable liquidity and clear treatment of default and loss. The Federation is exploring whether borrower-focused liquidation design can contribute to that infrastructure. Support for any particular asset remains unproven.
Consider a hypothetical binary claim that pays either one unit or zero at resolution. Its marked value before resolution does not guarantee that a large position can be sold at that price. Resolution can remove collateral value before liquidation can recover debt.
Research questions include time-to-resolution limits, disputed outcomes, valuation interruptions and shortfall handling. A partial repayment cap does not insure the borrower or lender against the underlying payoff. No prediction-market collateral product is committed by this specification.
Tokenized real-world assets, locked staking claims and vested allocations may have transfer restrictions, delayed redemption or limited secondary liquidity. Those conditions must be assessed asset by asset. Smaller sales may reduce immediate sale size, but extending execution also leaves exposure to further price changes.
Any proposed market needs evidence about executable proceeds, settlement timing, relevant rights and failure handling. The current model does not establish suitable limits or a launch-ready market for these assets.
Lending against less collateral introduces requirements beyond liquidation: underwriting, privacy-preserving verification where appropriate, default recovery and explicit loss allocation. A roadmap interest in privacy does not establish that those capabilities exist or that the same liquidation engine can support them.
Credit-based lending remains a separate research direction. Its feasibility cannot be inferred from a partial-liquidation example.
The objective is financial infrastructure that builders and businesses can evaluate through clear rules and observable evidence. For each proposed market, progress means establishing valuation, executable liquidity, borrower and lender outcomes, implementation security and accountable control of changes.
These are research directions, not supported collateral listings or delivery commitments. We will distinguish design intent, simulated findings and demonstrated capabilities as the work develops.
This spec is live for public criticism. If you see a flaw — a game-theoretic attack we missed, a parameter choice that won't survive contact with real markets, a scenario we haven't considered — we want to know. Send feedback to @WelksCrypto on X or to the admins in t.me/GFOF_SOL. All substantive public comments will be acknowledged in the revision log of the next version, with attribution unless the author requests otherwise.