Crypto loans: why over-collateralization is the DeFi standard

That constraint explains why most crypto loans begin with excess collateral.

The model is not based on trust. It is based on liquidation math. A user deposits a volatile asset, borrows another asset against it, and must maintain a position whose collateral value remains above a protocol-defined boundary. If the boundary is crossed, the protocol permits third parties to repay debt and seize collateral. The borrower’s identity is irrelevant. The code needs only prices, balances, and a transaction that can execute.

This is the operating logic behind decentralized money markets such as Aave and Compound. It is also why “borrow against your crypto” is an incomplete description. The actual product is a collateralized debt position with variable funding costs, oracle dependency, liquidity constraints, and liquidation risk.

Over-collateralization is not a conservative preference in DeFi. It is the substitute for legal recourse.

The structural problem: lending without a borrower profile

Traditional credit has several layers of loss control. Banks assess income, credit history, jurisdiction, existing liabilities, and the probability of recovery through legal enforcement. DeFi protocols generally have none of these inputs. An address can supply collateral, borrow liquidity, and disappear from the interface. The contract cannot distinguish an institution from a newly created wallet.

The protocol therefore solves a narrower problem: it does not need to know whether the borrower is trustworthy if it can liquidate the position before the debt becomes undersecured.

That is the reason for overcollateralized loans. A borrower deposits more value than they initially withdraw. The surplus is a buffer against price movement, interest accrual, oracle updates, and the practical cost of liquidation. It is not a guarantee against loss. It is a buffer designed to make prompt liquidation economically rational.

The distinction matters because collateral ratios are often discussed as if they were static. They are not. A position can become less collateralized through several routes:

• The collateral asset declines in the protocol’s reference currency.
• The borrowed asset rises relative to the collateral.
• Borrowing interest rates accrue and increase the outstanding debt.
• A borrower adds debt or withdraws collateral.
• Governance changes a risk parameter, where the protocol’s rules permit such changes.
• An oracle update reprices either side of the position after a period of market movement.

A borrower who deposits ETH and borrows a stablecoin is not simply exposed to ETH. They are exposed to the relationship between ETH, the borrowed stablecoin, the protocol’s oracle, the interest-rate model, and the liquidation parameters assigned to that market.

This is why a simple loan to value ratio is insufficient as a complete risk metric. LTV describes debt relative to collateral value at a point in time. It does not, by itself, describe the threshold at which a protocol begins liquidation.

Borrow limit and liquidation threshold are different controls

Protocols use related but distinct parameters. Their labels vary, and interface design often blurs the difference. The underlying functions do not.

Compound III, for example, defines a borrow collateral factor as a percentage of supplied collateral value. Its documentation uses WBTC with an 85% borrow collateral factor as an example: up to 85% of the supplied WBTC value may be borrowed in the base asset. That is a protocol-specific example, not a standard for crypto loans.

Aave’s documentation separates its health factor calculation from the user-facing concept of borrowing capacity. Its health factor is calculated as:

total collateral value × weighted-average liquidation threshold ÷ total borrow value

The result is an operational liquidation metric. A health factor below 1 means the position is eligible for liquidation under the protocol’s rules.

The difference between a borrow limit and a liquidation threshold creates the initial safety buffer. A borrower may be prevented from opening a position at the maximum point where liquidation would immediately become possible. But that buffer can narrow quickly in volatile markets. It is a mechanical gap, not a promise of safety.

Health factor is a liquidation trigger, not a comfort score

Aave provides a straightforward example: $10,000 of ETH collateral, an 80% liquidation threshold, and $6,000 of GHO debt. The health factor is:

($10,000 × 0.80) ÷ $6,000 = 1.333

The number looks stable only if the inputs remain stable. They do not.

If the collateral value declines while the debt remains near $6,000, the numerator contracts. At an $8,000 collateral value, the health factor becomes approximately 1.067. At $7,500, it reaches 1. The position is now at the liquidation boundary.

This is the central feature of the system. Protocols are not trying to predict whether an asset will recover. They are trying to prevent a collateral shortfall from becoming a protocol loss. Once the health factor falls below 1, liquidation shifts from a theoretical risk to an executable transaction.

A liquidation is often described as a penalty. From the protocol’s perspective, it is a debt-repayment mechanism. A third-party liquidator repays some or all of the borrower’s debt and receives collateral, generally with an incentive that compensates for execution risk, gas costs, and price volatility. The borrower loses collateral because the system needs someone to close the deficit before it expands.

Aave’s published liquidation mechanics illustrate how granular these rules can be. When the health factor remains above 0.95 and both the collateral and debt sides are at least $2,000, up to 50% of the debt may be liquidated. When the health factor is 0.95 or lower, or when either side is below $2,000, up to 100% may be liquidated. A partial liquidation must also leave at least $1,000 of both collateral and debt; otherwise, the position must be fully cleared.

Those conditions are not incidental implementation details. They address a specific failure mode: uneconomic residue. A position with trivial remaining debt or collateral can become too small for liquidators to process efficiently. The protocol then carries an impaired position because the market has no reason to close it.

A liquidation system fails before insolvency if liquidators cannot profitably execute it.

The health factor also conceals a concentration issue. A weighted-average liquidation threshold may look adequate across a portfolio of collateral assets while masking dependence on one volatile token. The formula aggregates value. It does not eliminate correlation. In a broad market drawdown, several collateral assets can decline together, while stablecoin debt remains fixed in nominal terms. That is when liquidation queues become crowded and the theoretical buffer faces actual market execution.

Nor is a health factor above 1 universally “safe.” It simply means the position is not yet below that protocol’s stated liquidation boundary. It says nothing about oracle latency, abrupt price gaps, liquidity depth, governance changes, or the speed at which a user can alter the position during congestion.

Borrowing interest rates are a liquidity control mechanism

Collateral protects the protocol against borrower default. Interest rates solve a different problem: preserving liquidity for withdrawals and regulating demand for borrowed assets.

In decentralized money markets, borrowing interest rates are usually variable. They move with utilization: the share of supplied liquidity currently borrowed. Compound III defines utilization as total borrows divided by total supply. If a pool contains 100 million units of a base asset and 70 million are borrowed, utilization is 70%.

As utilization rises, the remaining liquidity available to depositors and new borrowers falls. A protocol that leaves borrowing cheap at very high utilization invites a bank-run-like condition: suppliers may seek withdrawals while the pool’s assets are tied up in loans. The contracts may remain solvent on paper while the market lacks immediately available liquidity.

Rate curves are designed to make that state expensive.

Both Compound III and Aave use utilization-sensitive models. Compound’s rate models include a utilization “kink,” a point above which rates increase more rapidly. Interest accrues every second using block timestamps. Aave likewise states that displayed borrowing rates are influenced by borrow utilization and adjust as users borrow or repay; interest begins accruing immediately after a borrow transaction.

The logic can be stated without interface terminology:

1. Low utilization means abundant pool liquidity. Borrowing rates can remain relatively low.

2. Rising utilization reduces the idle liquidity available for withdrawals and new loans.

3. At the kink, the protocol treats additional utilization as materially riskier.

4. Above the kink, rates accelerate to discourage new borrowing and attract fresh supply.

5. If utilization falls, rates can decline again because the pressure on pool liquidity has eased.

The kink is therefore not a cosmetic chart feature. It is a liquidity-defense parameter. Set it too low, and the protocol can impose high costs while there is still adequate liquidity. Set it too high, and the pool can approach an illiquid state before borrowing demand is meaningfully constrained.

This structure creates an interaction often missed in leverage calculations. A borrower can be correct about collateral direction and still face a deteriorating position because debt grows faster than expected. When utilization spikes, the borrowing APR can reprice upward. Debt then increases continuously. If collateral is flat or declining, the health factor falls without any new borrowing transaction.

Yield compression follows from the same mechanism. A leveraged strategy may initially show a spread between supplied yield and borrowed cost. If pool utilization rises, borrowing rates can absorb that spread. If the supplied asset’s yield declines simultaneously, the position can move from positive carry to negative carry while retaining full liquidation exposure.

The protocol does not care whether the strategy was intended as yield farming, hedging, or liquidity management. It tracks collateral value and debt value. The interest rate model adds debt every second.

Liquidation is an auction for execution capacity

The common description of liquidation is incomplete because it ignores the liquidator. The protocol can define a liquidation threshold, but it cannot force an external actor to supply capital during a market dislocation. The design must create a profitable execution path.

That path depends on several components operating at once:

• Reliable pricing. The protocol needs an oracle price close enough to executable market value. A stale or manipulable price creates attack vectors on both sides: wrongful liquidation or bad debt.
• Liquid collateral. The asset seized by a liquidator must be saleable or usable at a value near the protocol’s internal price.
• Sufficient incentive. The liquidation bonus must cover gas, slippage, price movement, and capital costs.
• Available repayment capital. Liquidators need the borrowed asset, or access to it, at the moment the opportunity appears.
• Network execution. In a congested blockspace environment, a liquidator may need to compete for transaction inclusion while prices continue moving.

Over-collateralization supports this process by leaving value for the liquidator after debt repayment. But large buffers do not solve every failure mode. During a rapid drawdown, collateral can gap through the threshold. If the discount available to liquidators is too small relative to market slippage, liquidations can be delayed. The result is the risk protocols are designed to avoid: systemic insolvency, where collateral recovered is insufficient to cover outstanding debt.

This is also why collateral is not interchangeable merely because two assets have the same market capitalization. A token’s risk profile inside a lending market includes price volatility, on-chain liquidity, market depth, oracle design, concentration among holders, bridge exposure, and correlation with existing collateral. A governance token with shallow liquidity can be far more dangerous than a larger, more liquid asset even if both have a superficially similar historical price range.

The collateral factor is an architectural judgment about all of these risks. It is not a statement that an asset is objectively worth a given percentage of its spot price.

Flash loans are the exception that proves the model

Not every DeFi loan is overcollateralized. Flash loans are the documented exception, and they work because they do not expose the pool to persistent borrower default risk.

ERC-3156, created in November 2020, defines a flash loan as a smart-contract transaction in which the borrowed amount, plus an optional fee, must be returned before the transaction ends. If repayment does not occur, the entire transaction reverts. The pool’s state returns to its pre-transaction condition.

That atomicity replaces collateral.

A flash borrower can obtain substantial liquidity without posting assets because the protocol never carries the borrower’s debt across blocks. There is no open position, no health factor, and no liquidation threshold in the ordinary sense. The loan exists only as an intermediate state inside one transaction.

The distinction is structural:

Flash loans do not remove risk from DeFi. They move it. The lending pool is protected against non-repayment by atomic execution, but protocols interacting with flash liquidity can face other attack vectors. A contract that assumes a price, voting balance, reserve level, or collateral state cannot be altered within one transaction may be vulnerable to manipulation.

The correct conclusion is not that flash loans are inherently malicious. They are a liquidity primitive. The relevant question is whether an external protocol has been designed to withstand temporary, transaction-scale capital.

For standard crypto loans, no equivalent atomic guarantee exists. Debt persists. Prices move between blocks. Over-collateralization and liquidation are therefore necessary.

Risk parameters are governance decisions, not natural constants

There is no universal DeFi standard that fixes a single LTV, liquidation threshold, collateral factor, liquidation bonus, or borrowing APR. Parameters vary by protocol, chain, market, base asset, collateral asset, and governance configuration.

That variation is rational. WBTC, ETH, stablecoins, liquid staking tokens, volatile governance assets, and bridged representations do not impose the same risks. Their liquidity profiles differ. Their oracle dependencies differ. Their correlation to borrowed assets differs. Their failure modes differ.

A stablecoin used as collateral may appear less volatile than ETH, but it introduces a distinct depeg scenario. A liquid staking token may have a relatively stable relationship to its underlying asset until withdrawal queues, validator penalties, or secondary-market discounts widen. A bridged asset can inherit risks from the bridge’s custody or messaging design. The protocol must translate such differences into numerical limits.

This is where governance becomes part of the credit engine. A parameter update can alter borrowing capacity, liquidation exposure, supply caps, or rate-curve behavior. The relevant risk is not merely whether governance can vote. It is whether the process can respond at the necessary speed, whether parameter changes are technically sound, and whether the protocol’s users understand that their collateral treatment is governed rather than fixed.

Credit delegation adds another layer of confusion. Aave’s V4 development proposal describes credit delegation being moved into V4 Smart Accounts. That is an architecture proposal, not evidence that unsecured, permissionless borrowing is broadly available to ordinary users in production. Delegated credit does not abolish credit risk. It reallocates it to the entity that grants borrowing power and accepts the resulting exposure.

The same principle applies across all attempts to make DeFi credit look more like traditional unsecured lending. If collateral is reduced, another loss-bearing mechanism must appear: delegated trust, whitelisting, legal agreements, insurance capital, restricted access, or a balance-sheet intermediary. Risk does not disappear because the interface labels a loan “capital efficient.”

The binary conclusion

Over-collateralized crypto loans are not inefficient versions of bank lending. They are a direct response to a system where debt is pseudonymous, code is the enforcement layer, and liquidation must occur before a loss becomes socialized across depositors.

The model is coherent when three mechanisms remain aligned: collateral values are priced credibly, liquidators can close undercollateralized positions, and interest-rate curves keep enough pool liquidity available for withdrawals. Break any one of them, and the nominal collateral ratio becomes less meaningful.

The risk-to-reward verdict is binary. If a lending protocol can maintain credible oracles, liquid collateral markets, executable liquidations, and utilization discipline, over-collateralization is a functional credit design. If those conditions are weak, the collateral buffer is only an accounting number waiting for market stress to test it.