Motivations

The following is an explanation of the motivations behind the various design elements of openLend, starting from a toy lending primitive and expanding into the actual openLend structure.

​

Simple lending protocol

Imagine a lending protocol where a borrower requests a loan by specifying an interest rate, loan amount, and term. They also specify collateral token, borrow token, and collateral amount. The request is live after they deposit their collateral into the smart contract. Any lender can accept this request, sending loan amount of borrow token to the borrower. If the borrower doesn’t pay back the loan plus interest by the end of the term, they forfeit the entire collateral amount to the lender. Without a way to liquidate an underwater loan, the borrower has an option just before the term ends. If the collateral is worth more than the loan plus interest, they pay back the debt and receive their collateral. If the collateral is worth less, they don’t pay back the debt, and the lender receives less value than they were owed. In principle, this design can work, so long as the loan starts with enough buffer between the collateral and loan amounts over the given term, because it is unlikely the collateral value falls enough that the borrower exercises their option. On the other hand, the design struggles with capital efficiency and cost: borrowers lock up excess collateral and lenders demand higher interest rates to compensate for tail risk.

​

Liquidations

If the lender is able to claim the borrower’s collateral when the loan is underwater, tail risk drops. Borrowers are able to get loans using less collateral than before, and lenders don’t demand exorbitant rates. Typically, the loan’s underwater status includes a haircut, often called a liquidation threshold. For example, if only 85% of the collateral is counted against debt, the lender has an equity buffer of ~15% when they are first able to claim collateral.

​

Price oracle

Deciding when the loan is underwater requires a price oracle. Many are familiar with popular solutions: Chainlink, Pyth, and AMM-derived (e.g. Uniswap v3 TWAP) to name a few. Using one of these price oracles can be simple: when the price oracle says the loan is underwater, the lender can claim the collateral. Popular solutions have their limitations, however. Chainlink-style price oracles trust a whitelisted and KYC’d committee of reporters. While AMM-derived price oracles have fewer trusted third parties, they still struggle with multi-block MEV and security scaling. You can think of security scaling as a question: to what extent is liquidity in the price oracle a stable function of liquidity in the downstream dependent position? For example, AMM liquidity can either vanish or be too small to secure very large positions. In openLend, we use openOracle as our price oracle, which is a permissionless, time-locked limit order escalation game. A price report is capital posted to trade both ways at a quoted price, and to take one of the orders (dispute) you have to replace both, larger, at a new price of your choosing. When the most recent orders survive for long enough, the price is considered valid. In openLend, the borrower can decide exactly how much liquidity their oracle game starts with, so they can scale security to the size of their collateral. Also, where a single bad trade can poison an AMM oracle’s observation history, a dispute in openOracle fully replaces the price state, so a false report only survives if every valid dispute is censored across the entire settlement window. Lenders underwrite the oracle terms and incorporate the implications of the game into their minimum interest rate. Now we update the toy lending design: once the lender thinks the collateral is underwater, they create an oracle game with the initial report attesting to that underlying price, adhering to the borrower’s size requirement. If the game ends implying the loan is underwater, the lender can claim the collateral. If not, the loan continues unabated.

​

Repaying debt and topping up collateral

Without a way to repay debt or top up collateral before the term ends, the borrower is in a dangerous position. If their collateral value falls far enough, they lose the equity buffer above the liquidation threshold. The borrower is back to needing excessive collateral for safety. Allowing the borrower to repay debt or top up collateral before the term reduces the capital requirement.

​

Freezing the loan during liquidation

In isolation the oracle game is costly. Starting a game implies locking two limit orders for the oracle’s settlement time, typically 30 minutes or more. If the market price of those two assets moves enough, your stale price is traded against. If the borrower can cure their position after the liquidation report is on-chain, the lender can be griefed, since they can lose money in the oracle game with no real chance of earning the collateral’s equity buffer. Accordingly, we freeze the borrower’s position until the oracle game completes, meaning they cannot repay debt or top up collateral until then.

​

Denial-of-service and delay

Freezing the borrower’s position during liquidation introduces a denial-of-service vector. Each new oracle report in a given liquidation game refreshes the freeze timer. DoS is primarily mitigated by three factors: oracle game fees, escalation, and a liquidator stake. An oracle game timer refresh implies one of the previous orders was traded against, on which we can levy oracle game fees. We can then split the accrued fees between lender and borrower. Escalation enables geometric growth in oracle game fees, since each new oracle round’s posted sizes must be larger than the last, e.g. 1.4x each round. The first round of the oracle game is not a swap: the lender simply posts the orders, so there is no fee to levy. Instead, we will use a liquidator stake. Any time a loan is liquidated, the lender must wager some percentage of the borrower’s collateral that the liquidation will resolve successfully. If the borrower’s position is not liquidated after the oracle game completes, the lender forfeits the stake into the borrower’s collateral. The combination of these three factors can make spurious denial-of-service a net benefit to the borrower. DoS at the end of a term (prevent repayment until the term expires so the lender claims all collateral) is mitigated with a grace period: if a liquidation oracle game finishes close to (or past) the term’s end, the borrower is granted a grace period to cure their loan. A borrower may want to think twice about using this feature to extend their own term, since the geometrically growing oracle game fees are split with the lender.

​

Interest rate

In our current toy model, the borrower specifies an interest rate, but since they can repay debt at any point, this introduces an option problem: if the market interest rate drops, the borrower can repay debt fully, then initiate a new borrow at the now-lower market rate. If the market rate rises, they do nothing, benefiting from the lower-than-market rate on their loan. The lender must incorporate this option value into their minimum interest rate, increasing costs for borrowers who don’t intend to be active. If we require that the borrower pay full-term interest no matter when they repay, the option value goes away, but this decreases the borrower’s flexibility by adding a guaranteed prepayment penalty. Instead of picking a side, we allow the borrower to choose what fraction of the full-term interest they commit to paying. If the borrower wants more flexibility, they pay for it in higher rates. Committed interest is factored into total debt for the purpose of liquidation immediately upon loan origination to remove a second borrower option: escaping committed interest in tail price scenarios. The toy model’s interest rate architecture still has a problem. How can the borrower know the fair market rate for their bespoke loan configuration? If set too low, no one will lend. If set too high, they get a bad deal. The borrower is filled on average at worse-than-market rates. To solve this, we use a Dutch auction: the borrower’s interest rate starts low and increases over time on a curve, up to a max rate. The first lender to originate the loan locks in the rate at that time. This way the lending market reveals the true market-clearing rate at its lowest possible level.

​

Refinancing

The toy lending protocol has matured, but there are still some ergonomic issues. Currently a borrower must fully repay debt and request a new deal to extend their loan, borrow more, or withdraw excess collateral. This has unnecessary capital requirements and friction. Here we introduce refinancing: a borrower can request a refinance during the loan’s term. A lender accepting the request pays out the previous lender fully and a new loan starts. The borrower can choose to borrow more or withdraw excess collateral as well as change other loan terms. The payout to the previous lender includes committed interest, so refinancing does not allow a borrower to dodge the floor interest mechanic. Refinancing after the prepayment penalty window seamlessly rolls debt with no penalty.

​

Outsourcing liquidations

Thus far, the lender is fully responsible for initiating liquidations. If instead the lender would prefer to outsource this function, they can. Upon accepting a request, they specify a fraction of the equity buffer awarded to any third-party liquidator. The third-party liquidator must front the liquidator stake and oracle initial report liquidity but shares in the upside. They are also granted a share of geometric oracle game fees, along with lender and borrower. If the lender would like to handle liquidations themselves, they can set the third-party share to 0.