{"license":"CC-BY-4.0","licenseUrl":"https://creativecommons.org/licenses/by/4.0/","attribution":"ChainChoice (https://chainchoice.io)","category":"lending_borrowing","evidenceReadAt":"2026-09-28","generatedAt":"2026-11-12","criteria":[{"id":"oracle_liquidation_price","label":"What price gets you liquidated, and how far can it drift?","weight":32},{"id":"rate_authorship","label":"Who sets your rate — a utilisation curve or a curator?","weight":24},{"id":"blast_radius","label":"If one market goes bad, how much of yours goes with it?","weight":24},{"id":"shortfall_record","label":"Has it lost lender money before, and did it publish it?","weight":20}],"providers":{"venus":{"oracle_liquidation_price":{"s":9,"q":"Venus V4 introduced ResilientOracle , which lets governance assign main, pivot, and fallback roles per underlying asset. When multiple roles are enabled, the contract can compare sources within governance-set bounds and try another valid source when a comparison fails.","u":"https://docs-v4.venus.io/risk/resilient-price-oracle","d":"2026-09-28"},"rate_authorship":{"s":9,"q":"IRM Risk Steward Interest rate model contract for a market | Interest rate model updates and eMode collateral-factor updates always take the timelocked path, regardless of size.","u":"https://docs-v4.venus.io/risk/risk-oracle-and-risk-stewards","d":"2026-09-28"},"blast_radius":{"s":7,"q":"Risk-fund assets are protocol-controlled funds allocated by governance; they are not a per-user insurance policy, and their existence does not guarantee that every loss or bad-debt balance will be repaid.","u":"https://docs-v4.venus.io/risk/risk-fund-and-shortfall-handling","d":"2026-09-28"},"shortfall_record":{"s":9,"q":"On March 15, 2026, an attacker executed an attack against the THE (Thena) market on Venus Protocol (BNB Chain). | left Venus with just over ~$2M in bad debt. | BoundValidator reverted for approximately 37 minutes as the Binance feed diverged wildly. | 12:42 53,230,145 367% - peak before liquidation","u":"https://community.venus.io/t/the-market-incident-post-mortem/5712","d":"2026-09-28"}},"spark":{"oracle_liquidation_price":{"s":8,"q":"Pricing is aggregated using a three-oracle median that pulls data from RedStone, Chainlink, and Chronicle. When all three return valid, non-stale values, the median is used. When two are valid, their average is used. A single-feed fallback also exists.","u":"https://docs.spark.fi/products/sparklend","d":"2026-09-28"},"rate_authorship":{"s":10,"q":"Because these strategies are immutable (parameters are constructor arguments with no setters), the spell must deploy a new RateTargetKinkInterestRateStrategy with the proposed parameters and repoint the USDC reserve | Optimal utilization (kink): 95% → 98% | Reserve factor: 10% (unchanged) | It does…","u":"https://forum.skyeco.com/t/july-2-2026-proposed-changes-to-spark-for-upcoming-spell/27982","d":"2026-09-28"},"blast_radius":{"s":8,"q":"Collateral supplied to SparkLend reserves stays in the reserve. It is not redeployed into external strategies. | It has always been operated conservatively relative to peers, with a narrow collateral set, multi-oracle pricing, strict rate limits, and first-loss capital.","u":"https://docs.spark.fi/products/sparklend","d":"2026-09-28"},"shortfall_record":{"s":7,"q":"an issue was discovered in DaiInterestRateStrategy , causing the protocol’s assets and liabilities to diverge over time. | the block range was discovered between 18156000 and 18156500 (Sept 17). | the original ~297k discrepancy amount when it was fixed.","u":"https://forum.skyeco.com/t/dai-market-accounting-discrepancy-post-mortem/23102","d":"2026-09-28"}},"morpho":{"oracle_liquidation_price":{"s":7,"q":"Market curators (not Morpho) are responsible for selecting and implementing appropriate oracles for their markets. | Immutable : Once a market is deployed, its oracle address cannot be modified","u":"https://docs.morpho.org/learn/concepts/oracle/","d":"2026-09-28"},"rate_authorship":{"s":9,"q":"The only IRM that has been governance-approved is the AdaptiveCurveIRM | close to a target of 90% | As with every parameter of a Morpho Market, the IRM address is immutable. This means that neither governance nor market creators can change it at any given time.","u":"https://docs.morpho.org/learn/concepts/irm/","d":"2026-09-28"},"blast_radius":{"s":9,"q":"Morpho Vault V2 implements an automatic loss socialization mechanism where losses - including bad debt from underlying adapters - are detected and distributed proportionally across all shareholders through share price depreciation.","u":"https://docs.morpho.org/learn/concepts/liquidation/","d":"2026-09-28"},"shortfall_record":{"s":7,"q":"On June 1, 2023, GothicShanon89238 reported an issue concerning the AaveV3-ETH Optimizer | has paid out a bounty of 285,000 USD as a reward","u":"https://morpho.org/blog/vulnerability-report-june-2023","d":"2026-09-28"}},"euler":{"oracle_liquidation_price":{"s":7,"q":"The library supports feeds such as Chainlink, Chronicle, Pyth, and RedStone, as well as onchain and rate-based sources | The router's fallback is not automatic failover for a broken primary feed.","u":"https://docs.euler.finance/learn/price-oracles","d":"2026-09-28"},"rate_authorship":{"s":8,"q":"A two-slope utilization curve increases linearly to a kink and then more steeply above it. | The curve does not adapt automatically. A governed vault can replace its IRM if market conditions or its mandate change; a finalized (ungoverned) vault cannot","u":"https://docs.euler.finance/curate/interest-rate-models","d":"2026-09-28"},"blast_radius":{"s":9,"q":"Vaults have bad debt socialisation enabled by default | This prevents bank-run scenarios as it socializes losses to all depositors | The cool-off period prevents an account from being liquidated inside a block where it was previously healthy.","u":"https://docs.euler.finance/curate/vaults/evk/security","d":"2026-09-28"},"shortfall_record":{"s":8,"q":"Stream Finance borrowed much of it. Weeks later, Stream defaulted. | The entire Plasma deployment was effectively wiped out | The markets simply sit there, accumulating bad debt that no one can resolve.","u":"https://www.euler.finance/blog/euler-q1-2026","d":"2026-09-28"}},"kamino":{"oracle_liquidation_price":{"s":6,"q":"For each asset on Kamino, Scope cross-validates both providers in real time. | If a provider’s feed goes stale, deviates significantly from other providers, or fails a validation check, Scope automatically falls back to the next-best source.","u":"https://kamino.com/docs/security/oracles","d":"2026-09-28"},"rate_authorship":{"s":8,"q":"Kamino employs a poly-linear interest rate curve | The Risk Council calibrates curve parameters to achieve a target utilization for each asset.","u":"https://kamino.com/docs/risk/safeguards/interest-rates","d":"2026-09-28"},"blast_radius":{"s":9,"q":"If a borrower defaults and creates bad debt in a reserve, lenders — including the vault — absorb losses proportional to their share of that reserve. | Curators manage vault allocations with discretion — no governance approval is required for allocation changes.","u":"https://kamino.com/docs/products/lending-vaults/risks","d":"2026-09-28"},"shortfall_record":{"s":7,"q":"Kamino has operated since November 2023 with $0 bad debt across every market condition | October Correction Oct 10, 2025 $20M $0 | SOL -18% Crash Feb 5–6, 2026 $19.36M $0","u":"https://kamino.com/docs/risk","d":"2026-09-28"}},"compound":{"oracle_liquidation_price":{"s":6,"q":"The protocol’s prices are updated by Chainlink Price Feeds. | priceFeed: The ERC-20 address of the Chainlink price feed contract for the asset.","u":"https://docs.compound.finance/helper-functions/","d":"2026-09-28"},"rate_authorship":{"s":9,"q":"These are separate interest rate models, and set by governance. The supply and borrow interest rates are a function of the utilization rate of the base asset.","u":"https://docs.compound.finance/interest-rates/","d":"2026-09-28"},"blast_radius":{"s":7,"q":"Each absorption is paid for by the protocol’s reserves of the base asset. | which automatically protect users from bad debt | This function uses the price returned by the protocol’s price feed.","u":"https://docs.compound.finance/liquidation/","d":"2026-09-28"},"shortfall_record":{"s":8,"q":"Despite the haircut, total L2 bad debt is limited to ~$202K because Compound’s rsETH exposure on L2s was already modest. | Estimated shortfall: ~$3.4M | Total 36 $63,924,466 $71,545,495","u":"https://www.comp.xyz/t/update-on-the-rseth-exploit/7783","d":"2026-09-28"}},"fluid-protocol":{"oracle_liquidation_price":{"s":6,"q":"Pulls on chain Uniswap TWAP price (on-chain price) | Checks this price against the Chainlink (difference check) | If the TWAP is within parameters it will use on-chain otherwise it will use the Chainlink price.","u":"https://fluid.guides.instadapp.io/liquidity-layer/risks","d":"2026-09-28"},"rate_authorship":{"s":8,"q":"No, The team cannot make major changes to the rates at any given point of time without going through a governance proposal. | the team multisig has ability to change the rates by not more than 20% once in 96 hours. This enables the Fluid protocol to react faster than its normal 4 day execution.","u":"https://fluid.guides.instadapp.io/vault-protocol/protocol-details","d":"2026-09-28"},"blast_radius":{"s":8,"q":"As a liquidity layer, all protocols built on Fluid draw liquidity from the same pool. | Excessive access to liquidity or significant asset devaluation can affect the liquidity layer, causing depositors to become under-collateralized.","u":"https://fluid.guides.instadapp.io/liquidity-layer/risks","d":"2026-09-28"},"shortfall_record":{"s":7,"q":"Fluid incurred ~$21M in bad debt due to the Resolv incident. | Resolv will cover ~$9.7M | ~$8.2M will be covered by the Fluid governance treasury | zero-incident security track record","u":"https://gov.fluid.io/t/post-mortem-treasury-actions-and-forward-strategy-following-resolv-incident/1774","d":"2026-09-28"}},"aave":{"oracle_liquidation_price":{"s":6,"q":"Each reserve within the Aave Protocol is associated with an oracle contract | Correlated Assets Price Oracle (CAPO) | (time-based, deviation-based, etc.)","u":"https://aave.com/docs/ecosystem/oracle","d":"2026-09-28"},"rate_authorship":{"s":9,"q":"At the current 92.8% utilization, the post-change variable borrow rate would be 4.34% APR, down from 4.39% under the current IRM, and the supply rate would be 3.63% APR, down from 3.67%. | Grossed up for the 25% reserve factor that applies to USDe on all five reserves","u":"https://governance.aave.com/t/risk-stewards-cap-and-irm-changes-on-aave-v3-2026-09-28/25718","d":"2026-09-28"},"blast_radius":{"s":6,"q":"If a deficit occurs in a given asset, Umbrella enables the corresponding staked assets to be burned and offset the bad debt | USDT staking has a 100,000 USDT offset, meaning the Aave DAO covers the first 100,000 USDT of bad debt before any staker assets are affected.","u":"https://aave.com/docs/aave-v3/umbrella","d":"2026-09-28"},"shortfall_record":{"s":7,"q":"On 2026-04-18 at 17:35 UTC (Ethereum block 24,908,285), an attacker exploited Kelp’s LayerZero V2 Unichain to Ethereum rsETH route, which was configured as a 1-of-1 DVN. | Scenario 1: Uniform socialization of losses | The scenarios and calculations presented herein are hypothetical","u":"https://governance.aave.com/t/rseth-incident-report-april-20-2026/24580","d":"2026-09-28"}}}}