Liquidation and bad debt
How far a price may fall before a liquidation stops covering the debt, what an earnings minute does to a tier 2 branch, and the three layers that absorb the shortfall.
Spec v0.9.1, reviewed 2026-09-08
A liquidation is meant to be a transfer: the pool pays the debt, takes the collateral, keeps a discount. It stops being a transfer when the collateral is worth less than the debt by the time anyone can act. This page is about that distance, how often it is crossed, and who pays when it is.
The distance, per tier
A position sitting exactly at its liquidation threshold is still solvent. The margin is the threshold minus what the buyer is paid, and it is fixed by the tier.
Solvency tolerance
tolerance = 1 − (1 + discount + slippage reserve) ÷ threshold
tier 1: 1 − 1.05 ÷ 1.15 = 8.7%
tier 2: 1 − 1.065 ÷ 1.22 = 12.7%
tier 3: 1 − 1.08 ÷ 1.40 = 22.9%
Read it this way: a position at the threshold survives a fall of that size between two moments at which the protocol can act. Since the price is recomputed continuously and a flag takes 90 seconds, those moments are minutes apart, not a session apart. That is the whole reason the design liquidates at every hour rather than waiting for an opening.
On an index in a continuous session, no thirty-minute window since 1987 has produced a fall of 8.7% outside a halt. On a single stock at an earnings release, falls larger than 12.7% in one minute are ordinary.
The earnings minute, worked through
Take a tier 2 branch at $1,500,000 of debt. A position opened at the tier ceiling of 75% has a collateral ratio of 133.3%. The stock reports and falls 25% in sixty seconds, on every venue at once.
| Position opened at | Ratio after −25% | What happens |
|---|---|---|
| The tier ceiling | 100.0% | Fully liquidated. The pool pays the debt and receives collateral worth exactly the debt: no discount, no gain |
| 130% | 97.5% | Fully liquidated. The pool pays the debt and receives less than the debt |
| Either of them, once the pool has nothing left to pay with | Under 100% | Whatever collateral remains goes to the reserve, and the shortfall is recorded as bad debt |
On that branch, with roughly 40% of positions under the ratio that survives the event, the design's own arithmetic puts the loss to the Stability Pool at 6 to 12 thousand dollars and the bad debt at about 7 thousand, on 1.5 million of debt.
Risk
This is not a tail scenario. A release of that size happens several times a year across the tier 2 names taken together. The loan-to-value grid on tier 2 produces bad debt in a realistic case, the specification says so in those words, and it does not change the grid. What it changes is what happens next.
Rule R-6.1.3, scenario 14.4
Tier 3 absorbs the same event. At a threshold of 140% and a ceiling of 65%, a 25% fall leaves a position at 115% and produces a partial liquidation at a normal discount. It takes a fall of about a third before tier 3 loses money.
That difference is why the tier assignment is itself a risk decision rather than a label. NFLX sits in tier 3 with TSLA, PLTR and COIN, on the measured ground that it falls further than tier 2's margin covers, and it therefore carries a threshold of 140%, a ceiling of 65% and a last debt step of $1,000,000 rather than the tier 2 figures. Tier 2 keeps the six mega caps, the silver fund, AVGO, AMD, CSCO, LLY and XOM.
What the daily borrowing limit changes here
The ceiling is not the figure a borrower actually gets. The limit of the day is recomputed from the volatility of the last 7 and 30 days, and on a stock with an earnings profile it sits well below the ceiling: over three years of history NVDA would have averaged 72.8% and TSLA 61.6%.
A position opened at 62% rather than 75% comes out of the same 25% fall at a ratio of 121% instead of 100%. It is liquidated, partially, and the pool is paid. The mechanism is on Volatility and the borrowing limit.
Risk
The daily limit reduces the anticipated loss; it does not remove it. It cannot protect a position that was opened before the volatility rose, because the liquidation threshold of an open position never moves — deliberately. And it does not help at all when the fall is larger than the margin it left: NVDA on the day it fell 18.6% liquidated positions that had been opened at the limit of that morning.
Rules R-19.16.4, R-19.16.7
The three layers that absorb a shortfall
Bad debt is fyUSD in circulation with no collateral behind it. Three layers take it, in a fixed order, all of them permissionless.
One: the reserve. A fyUSD reserve whose target is 2% of the debt outside the peg module, filled before anything is paid to FBR stakers. Anyone can call the function that burns it against the shortfall.
Risk
The reserve starts at zero. Nobody pays into it at deployment: not the founders, not a company, because neither exists as a payer here. It fills only from revenue, and on the trajectory the design works with it reaches its target somewhere between the end of the second year and the end of the third. How the rest of the protocol gets off zero is on How it starts.
Until then the first layer is thin, and the layer behind it is thinner still: staked FBR sits behind almost nothing rather than behind a funded reserve. In the first months the third layer, redistribution onto the branch's own borrowers, is closer than the ordering suggests.
Anything the reserve holds above its target leaves at the next buy-back rather than accumulating, and if the protocol reaches its terminal mode the residue goes back to Stability Pool depositors in proportion to their deposits, 90 days after that mode opened. Anyone may pay into it voluntarily, and anyone who does should understand both consequences: above the target the money buys FBR, and below it the money is first-loss capital they do not get back.
Two: the staked FBR. After 24 hours with the reserve empty, anyone can seize staked FBR and put it in a 24-hour auction whose proceeds burn the debt. The seizure takes the same fraction of every staked lot, the protocol's own lot of 21,000,000 FBR included, with no ordering between them. The ceiling is 30% of the whole stake over any rolling 7 days, across every branch together, and one branch cannot open a second seizure within 7 days.
Three: redistribution. After 72 hours, or as soon as the auction closes with the reserve still empty, the remaining debt and whatever collateral was recovered are spread across the open positions of that branch only, in proportion to their collateral, by a cumulative index.
Risk
The third layer means a borrower who did nothing wrong can end a Sunday with more debt and more collateral than they had on Friday, and a lower ratio. It is confined to the branch, it is notified with the new ratio, and it is the last line before the stablecoin itself is short.
Rule R-6.8.4
The second layer is thin, and the specification says so rather than dressing it up: 30% of the staked total is a few hundred thousand dollars at a plausible price and an early staking level. It is noise, not insurance, and every staker is inside it from their first day.
What stops a branch from growing into the problem
Two automatic limits, neither of which anybody can lift.
The ladder lock. A branch climbs a four-step debt ladder over its first six months. Once cumulative bad debt passes 0.5% of the branch's current cap, the ladder stops at the step it reached, permanently. A single small loss does not freeze a branch for ever; a second one in the same year does.
The pool requirement. A branch's debt may never exceed what its own Stability Pool can absorb: 0.4× dollars of pool per dollar of debt on tier 1, 0.8× on tier 2 and 0.8× on tier 3. Depositors leaving therefore freezes new borrowing rather than creating an unabsorbable position.
Guarantee
A ceiling that falls below the debt already outstanding blocks new borrowing. It never triggers a liquidation, and it never accelerates one.
Rule R-5.4.5
The rate at which liquidation can happen at all
Three buckets limit throughput, all counted in debt burned, all refilling linearly. The pool itself is unlimited in the full regime, because a pool that absorbs continuously is exactly what avoids a queue building up for a Sunday evening.
| Path | Limit |
|---|---|
| The pool, full regime or three families disagreeing mildly | No bucket |
| The pool, only two sources answering | 0.25× of measured depth per hour, and at most 15% of branch debt per episode |
| A third-party liquidator on one branch | 1.0× of measured depth per hour |
| Every branch together, third parties | 0.6× of the summed depth per hour |
Risk
A bucket that runs out means a position that should have been liquidated waits. On a fast fall with the pool half withdrawn, the design's own simulation leaves a residue at ratios between 108 and 115% with an empty pool, where a further 8% takes them under water. The pool depth a branch needs to absorb a 20% weekend without any third-party liquidator is at least 40% of its debt; with half the pool gone, 80%.
Rules R-6.3.3, scenario 14.3
What a borrower controls
The margin. A position opened at the limit of the day survives a fall of 8% on tier 1 before it becomes liquidatable, and roughly 8.5% on tier 2. A position opened at half the limit survives about a third. That is the only variable on this page that belongs to the borrower, and it is the one that matters most.
The rest is on Manage your position, and the mechanism in full on Liquidations.
Price and oracle
A source set fixed for ever, what it costs to move the median, what five named reporters can and cannot do, and the difference between a branch that stops liquidating and one that stops everything.
Contracts and immutability
Code that has never been audited, has no upgrade path, and cannot be corrected. What immutability buys, what it costs, and what a second version would mean for someone already in the first.