Liquidation Cascade

Liquidation cascade detection

When this applies

Trigger on any of:

• Lending / CDP / perp markets with liquidation and a liquidation bonus
• Multiple collateral assets that are correlated (stETH/rETH/cbETH, USDC/DAI/USDT)
• A single insurance fund or backstop covering many isolated or pooled markets
• Bad-debt handling that socializes losses across lenders/LPs
• Collateral priced from a feed that can flash-crash or depeg
• Liquidation incentives or close factors set by governance

Detection patterns

Correlated collateral, no concentration cap (HIGH)

// stETH, rETH, cbETH all accepted, all priced off ETH-correlated feeds
collateralFactor[stETH] = 0.9e18;
collateralFactor[rETH]  = 0.9e18;

Signal: treating correlated LSTs as independent diversification. A single LST depeg (stETH 2022, or an LRT slashing event) crashes many positions at once, overwhelming liquidation throughput. Cap aggregate exposure per risk-cluster, not per token.

Bad debt socialized across markets (HIGH)

A loss in one risky isolated market draining a shared insurance fund or pool that also backs blue-chip markets. Signal: one toxic listing can impair unrelated depositors (the Mango / cross-margin contagion class). Isolate bad debt to the originating market.

Oracle flash-crash mass liquidation (HIGH)

uint256 price = oracle.getPrice(collateral);   // single-block spot, no bounds
if (debt > price * collateral * cf) liquidate();

Signal: a momentary depeg / wick (or manipulated feed) marks thousands of healthy positions liquidatable in one block; liquidators race, price gaps, and survivors eat bad debt. Use TWAP / deviation circuit breakers before liquidating en masse.

Liquidation incentive too low → stuck bad debt (MEDIUM)

If the liquidation bonus < gas + slippage to unwind seized collateral, liquidators don't act; positions go underwater and bad debt accrues silently. Signal: fixed small bonus on illiquid or volatile collateral.

Insurance-fund depletion ordering (MEDIUM / HIGH)

Order of loss absorption matters: if the fund pays liquidator bonuses before covering bad debt, or if multiple markets draw from it without priority, a run drains it. Define and bound the waterfall.

Depeg cascade (HIGH)

Stablecoin-collateralized debt where the stable depegs: liquidations sell the depegging asset, deepening the depeg, triggering more liquidations (UST May 2022). Flag self-reinforcing sell pressure with no circuit breaker.

Severity rubric

| Pattern | Severity | Notes | |---|---|---| | Toxic-market bad debt socialized to all depositors | High | Cross-market contagion | | Correlated collateral, no cluster cap | High | Simultaneous mass insolvency | | Spot-oracle flash-crash mass liquidation | High | One-block cascade | | Self-reinforcing depeg cascade | High | No circuit breaker | | Insurance-fund waterfall ordering flaw | Medium | Run-depletable | | Liquidation bonus too low → stuck bad debt | Medium | Slow accrual |

Remediation patterns

1. Isolate bad debt per market (Compound III / Morpho-style isolation, Aave isolation mode + debt ceilings); never let a risky listing impair blue-chip depositors.
2. Risk-cluster caps — bound aggregate exposure to correlated assets (all LSTs as one bucket), not per-token.
3. Circuit breakers — pause liquidations on excessive deviation; use TWAP/median so a single wick can't mass-liquidate.
4. Right-size liquidation incentives to gas + realistic unwind slippage on the actual collateral liquidity.
5. Define the loss waterfall explicitly (insurance fund → socialization → governance backstop) with per-market accounting.

False-positive notes

• A protocol with hard per-market debt ceilings and isolated collateral already bounds contagion; note rather than escalate.
• Single-collateral, deeply-liquid markets (e.g. WETH-only) carry low cascade risk.
• A bonus that looks low but on a highly liquid asset may still clear — judge against real unwind cost.

Related

• [[oracle-redundancy]] — flash-crash protection and staleness gating
• [[oracle-manipulation]] — manipulated marks trigger false liquidations
• [[centralization-risk]] — governance-set risk params and pause keys

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: omermaksutii
• Source: omermaksutii/RugProof
• License: MIT
• Homepage: https://omermaksutii.github.io/RugProof

Install and usage instructions live in the source repository linked above.