Why it matters
A bank lends against a borrower's income, its balance sheet and, if all else fails, a court. An onchain lender has none of those. The counterparty is an address, the loan agreement is a contract that cannot sue, and the only thing standing between a supplier and a loss is an asset the protocol can seize and sell without asking anyone. So the credit decision collapses into two numbers: how much more collateral than loan the protocol demands, and how quickly it can turn that collateral into repayment when the ratio breaks.
Most of the other risks people identify in onchain credit reduce to a failure of one of those two numbers. An oracle that lags reports a collateral value that was never true. Thin secondary liquidity means the sale clears below the price the haircut assumed. Correlated collateral means positions break together. The parameters are usually described as plumbing, and they are doing the work that credit assessment does elsewhere.
How it works
Each collateral asset carries a maximum loan-to-value, which caps what can be borrowed against it, and a liquidation threshold slightly above that, which is the point at which the position becomes eligible to be closed. The distance between the two is the borrower's headroom. Protocols summarise the position in a single ratio, so that a value below one means the debt now exceeds what the threshold allows and anyone may act.
Acting is open to anybody, which is the design's most important feature and the source of its costs. A liquidator repays part of the debt and receives collateral at a discount, the liquidation bonus, which is the fee the system pays for a standing promise to show up in a crash. Liquidations are usually partial, closing enough of the position to restore the ratio rather than seizing the whole holding.
When the sale does not cover the debt, the shortfall is a deficit, and where it lands is a matter of protocol design rather than accident. Aave's first loss layer is a per-asset offset funded by the DAO. Below that sits Umbrella, in which depositors stake aTokens or GHO and are slashed pro rata when a pool's deficit exceeds the offset, with a 20-day cooldown before they can withdraw; slashed assets go to the Aave Collector. Containment tools sit alongside the waterfall: supply caps, isolation mode, which confines a risky asset to its own market, and efficiency modes that widen the loan-to-value for collateral and debt that move together.
Economic mechanism
Overcollateralisation is a capital charge, and it is paid by the borrower rather than held by the lender. The haircut is priced off volatility and market depth, not off anything about the borrower, which is why the same protocol will lend more freely against a Treasury fund token than against a governance token held by four addresses. In principle the haircut plus the liquidation bonus has to cover the worst plausible gap between the last price the protocol believed and the price at which the collateral actually clears. Where that sum exceeds what a borrower will pay, the market does not exist, and a large part of onchain credit is confined to a narrow set of assets for exactly this reason.
The bonus is a transfer, not a cost the system avoids. It leaves the borrower and arrives with whoever wins the race to execute, which puts liquidation in the same economic territory as any other contested ordering opportunity: the size of the bonus determines how much is worth spending to capture it.
The residual is where onchain and conventional credit part company. A bank absorbs an unrecovered loss into equity in a defined order. A protocol must choose, in advance and in code, whether a deficit is socialised across all suppliers of that asset or isolated to the market where it arose, and the choice is worth real money. Aave's own incident report modelled bad debt of $123.7m if losses were spread uniformly and $230.1m if they were confined to layer-2 markets, against a treasury of $181m at the time.
Participants
Borrowers post collateral and pay for the headroom. Suppliers provide the loan and, in most designs, are the party that eventually bears an unrecovered loss. Liquidators are unaffiliated, uncontracted and paid per event, so their participation is an assumption rather than an obligation. Oracles decide when the ratio has broken, which makes them a credit input rather than a data feed. Governance sets every parameter, usually asset by asset, and in practice is also the crisis committee.
Who is the residual claimant varies, and it is worth reading the stack rather than the marketing. Sky states it explicitly: USDS holders are senior, below them sits a surplus buffer, and below that the protocol mints and auctions SKY to cover a shortfall, diluting holders. Maple's secured lending pools state it differently, because a default reduces pool net asset value directly and there is no mutualised backstop underneath. Aave's answer is Umbrella first and, if that is exhausted, whatever governance can assemble.
Examples
Aave is the largest instance. DefiLlama recorded total value locked of $13.038bn, active loans of $10.248bn and GHO supply of $598.49m on 25 July 2026, with annualised fees of $937m against annualised protocol revenue of $124m; the gap is what depositors keep for bearing the risk.
The April 2026 rsETH episode is the case study, because the loss did not come from a price move at all. A forged LayerZero packet released 116,500 rsETH without a matching burn on the source chain. Aave froze rsETH across all V3 deployments within 85 minutes, which is fast, and still faced the modelled deficits above. The residual gap after recovery efforts was roughly 75,081 ETH, closed by 25,000 ETH from the treasury, 14,570 ETH of contributions from other protocols and named individuals, and a credit facility of up to 30,000 ETH from Mantle. Depositors were made whole by a rescue that governance negotiated, not by a mechanism that fired.
Sky supplies the capital-adequacy view. Its surplus buffer stood at $82.5m at the end of June 2026, 55% of a $150m target, against a book many times that size. S&P assigned the protocol a B- issuer credit rating on 11 August 2025, citing a risk-adjusted capital ratio of 0.4% and the charge attached to its USDe allocation. stUSDS, introduced later, formalises the junior tranche the structure already implied: a larger share of rewards in exchange for a larger share of losses.
Maple shows the ratio at the conservative end. Its secured lending pool ran a 159.1% collateral ratio on $847m of assets on 25 July 2026, with active loans of $2.016bn and assets under management of $4.29bn across the platform, and syrupUSDC paying 4.9%. The collateral is crypto and the borrowers are institutions, so the haircut is doing the work a credit assessment does elsewhere.
Risks and limitations
The first limitation is that the haircut is calibrated against the wrong risk. It is a price buffer, and the losses that have actually threatened these protocols came from a bridge, an oracle or a contract, none of which respect a loan-to-value.
The second is that liquidation assumes a buyer. A bonus set in a calm market is a claim about depth on the worst day, and the collateral most likely to need selling is the collateral least likely to have a bid. A protocol can be perfectly overcollateralised at the last oracle price and undercollateralised at the only price available.
The third is correlation. Staked-ETH derivatives, looped positions in which the borrowed asset is redeposited as collateral, and one synthetic dollar collateralised by another all produce books that look diversified by ticker and behave as one exposure.
The fourth is that the loss-absorbing layer is thin and is usually denominated in the protocol's own token, which is worth least at the moment it must be sold. Minting and auctioning a governance token to cover a deficit is recapitalisation by dilution, and it works only while somebody is willing to buy. S&P's 0.4% figure is the formal version of this observation.
The fifth is that the term itself carries more than it can support. Overcollateralised describes a ratio measured against one price at one moment, realisable only in whatever market is open when the position breaks. It says nothing about the quality of the borrower, the depth behind the collateral or the protocol's capacity to absorb a residual, all of which a credit rating is meant to address.
Key metrics
Read the collateral ratio with its denominator attached: a figure like Maple's 159.1% means something only alongside what the collateral is and where it trades. Then the loss-absorbing layer as a share of the book, and what it is denominated in, since a buffer that falls with the event is not a buffer. Then realised bad debt, which is the only backward-looking number here and the one protocols report least readily. Then the gap between fees and protocol revenue, which says how the return for bearing risk is split between suppliers and the treasury. Then response time, because the rsETH freeze at 85 minutes is a measure of governance capacity rather than of code. Tokenized private credit outstanding sizes the adjacent book in which the collateral is not liquid at all, and where liquidation is a legal process rather than a transaction.
Related research
Aave's rsETH incident report of 20 April 2026 and the subsequent funding update are the fullest public account of an onchain lender absorbing a loss, and the Umbrella documentation sets out the waterfall as designed. S&P's rating of Sky, reported on 11 August 2025, is the first attempt to apply a conventional capital framework to one of these balance sheets, and Sky's own June 2026 update and stUSDS documentation show how the tranching has since been formalised. The protocol pages for Aave, Sky and Maple carry the current figures and the sources behind them.
The data on this site
The series below are the ones that bear directly on this concept. Each carries its own source, cadence and coverage.
We hold fewer than two verified observations for this series, so there is no trend to draw. The underlying figures are published by RWA.xyz. Cadence: daily at source; recorded here irregularly. This page will plot them once the history is long enough to mean something.