sIMD CDP risk parameter review

As of 14 October 2026. This is a parameter recommendation from the system facts in the assignment, compared with public protocol documentation, governance proposals, and source code. A comparable protocol's value is evidence of practice, not proof that it is suitable for sIMD.

Immediate hazards

The most dangerous settings are the six-hour liquidation grace period, the 24-hour primary-price staleness limit, and the 20% per-update deviation cap. A six-hour delay lets a position deteriorate while liquidation is explicitly blocked. A 24-hour-old answer is not a usable collateral mark when the only market has already moved 44.6% in a day. And the 20% cap has already stranded a paid request after the market moved outside its accepted band. These interact: stale values persist, then the feed cannot catch up in one paid update, while liquidations wait.

The 150% minimum collateral ratio is also unsafe for the stated volatility if liquidation needs to tolerate a one-day move of similar size. The 10% liquidation bonus is misleadingly high on paper: after the flagger and protocol allocations, the liquidator receives only 5.67% of repaid debt at face value, before pool impact and financing costs.

Recommendations at a glance

Parameter	Current	Recommendation	Assessment
Minimum collateral ratio	150%; 200% under stress	250% initial floor (40% max LTV), subject to lowering debt caps if executable pool depth cannot support liquidation	150% is too low; 200% still leaves only 110.8% after a 44.6% fall
Liquidation bonus	10%; 10% flagger, 33.33% protocol	20% to liquidator, protocol share at most 10% of bonus; separate small fixed/capped flag bounty	Current liquidator take is only 5.67% of debt at face value
Grace period	6 hours, 0 in stress	0 for unsafe positions; at most a short, explicit alert window that never blocks emergency liquidation	Six hours is too long for this asset
Primary deviation cap	20%	Do not use one fixed cap as both a security bound and catch-up mechanism. Pause risk-increasing actions on breach; recover by bounded, quorum-backed steps	Current setting is already known to reject legitimate catch-up
Primary staleness	24 hours	At most 1 hour, with a minutes-level target and hard pause threshold tied to the paid-update SLA	24 hours is not defensible without a heartbeat or keeper
Spot bound / staleness	5% / 1 hour	Treat spot as a circuit-breaker signal, not an independent oracle; refresh it continuously or make it non-authoritative	5% can halt on an ordinary market move; a one-hour-old spot can miss a fast move
Stability fee	200 bps/year	Use 800 bps/year as a provisional pricing floor, then calibrate roughly 8–12% to demand and loss modelling; never count it as solvency protection	2% is low versus Maker's documented volatile-collateral rates
Redemption fee	50 bp floor, 500 bp cap; increment redeemed/supply/4; 12 h half-life	50 bp floor and 12 h half-life match Liquity V1; raise cap materially (Liquity permits up to 100%); use /2 as the proven baseline unless simulation justifies /4	The 500 bp redemption cap is not Liquity's; /4 is half its response

The 250% ratio is a provisional floor, not a complete calibration. The reported $14.9m is the value held by the sIMD vault, not the amount that can be sold into the Uniswap pool without material price impact. Exact pool reserves, tick liquidity, executable depth, fee tier, expected liquidation lot sizes, and a downside-volatility distribution were not supplied. Debt ceilings must therefore be set from measured sell-side depth and stress-tested auction/swap execution, not from vault TVL.

1. Liquidation bonus and participation

No: 10% is not a credible incentive here as currently divided. A liquidator advances the stablecoin, receives sIMD, and must finance and sell it into the only market. Let the 10% bonus be measured against the debt repaid: the flagger takes 1 percentage point and the protocol takes 3.333 points, leaving 5.667 points for the liquidator at oracle value. Even a 5.7% market impact, before gas, borrowing cost, adverse price movement, or capital risk, removes that nominal margin.

Aave's risk documentation says lower-liquidity and smaller-cap collateral warrants higher liquidation incentives; it gives 15% YFI versus 5% ETH as a high-bonus example, while its most volatile collateral methodology targets 35–40% LTV and 65% liquidation threshold. Its YFI onboarding discussion also records an 8.5% proposed bonus under isolation mode and a limited debt ceiling, and a risk contributor recommended against listing YFI at that time because the risk/reward and market metrics were not sufficient. Treat 15% as a published comparator example, not an independently verified current YFI setting. (Aave risk parameters; Aave Insights FAQ; Aave YFI listing discussion)

Current Aave Ethereum Core settings put WETH at a 5% bonus, WBTC at 5%, and wstETH at 6%, all with deeper markets and multiple liquidation routes. A 2026 LlamaRisk review reports its protocol fee currently takes 10% of most bonuses (20% for USDC/DAI) and recommends moving only those deep collateral markets to 20%; it warns against broader increases because thin BAL collateral sold through DEX liquidity showed negative modeled net results at 20% and 30%. That supports a higher gross bonus for sIMD's unusually thin market, but argues strongly against a large protocol skim. (Aave 2026 collateral review; Aave 2026 liquidation fee review)

Recommendation: set a 20% bonus payable to the liquidator, with a protocol take no greater than 10% of that bonus. Pay any flag bounty as a separate, fixed and capped amount (or gas reimbursement), rather than removing 10% of the proportional bonus. At a 20% bonus and 10% protocol share, the liquidator retains 18% of debt value before execution costs. This is a starting incentive, not a guarantee of participation; if pool-impact simulations show greater than that net margin, use a Dutch auction/market-maker route, smaller liquidation lots, or a backstop. Raising the bonus alone cannot create liquidity.

2. Minimum collateral ratio

The normal protocol method is to set the liquidation threshold from adverse price movement over the time needed to detect, trigger, and complete liquidation, plus execution slippage and the liquidator's required incentive. Aave's published risk methodology names volatility and market liquidity as direct drivers: volatile collateral receives lower borrowing capacity, and lower liquidity calls for higher incentives. The figure must be based on the joint stress of price move and executable liquidation depth, not a universal 150% convention. (Aave risk methodology)

Using only the assignment's observed 44.6% one-day rise as a symmetric one-day stress proxy (an inference, not evidence of an equivalent historical decline), a 150% position falls to 83.1% collateralization after a 44.6% decline: 1.50 × (1 − 0.446). The stressed 200% value falls to 110.8%. Neither leaves much room to repay debt, pay a liquidation incentive, or absorb a thin-pool discount.

For a proposed 20% bonus and an illustrative 10% execution haircut, the opening CR needed to retain debt plus bonus after that shock is:

(1 + 0.20) / ((1 − 0.446) × (1 − 0.10)) = 2.407, or 240.7%.

Rounding up gives a 250% minimum CR (40% max LTV). At that ratio, a 44.6% loss leaves 138.5% at oracle mark, and a further 10% execution haircut leaves about 124.7% of debt value—just enough for debt plus the 20% bonus under these assumptions. This is why 250% is a floor and why it must be raised, or borrowing disabled, if actual pool impact exceeds 10%, the liquidation horizon is longer, or downside stress exceeds 44.6%.

The assumptions matter: a one-day positive return does not estimate downside tail risk, and the six-hour grace period could extend the stress horizon. Measure pool depth and historical drawdowns before enabling meaningful debt. The monotone 0.027%/day vault yield is negligible against this tail risk.

3. Protocol share of liquidation proceeds

A 33.33% take from the bonus is too large for this execution path. Combined with the 10% flagger share, it leaves 56.67% of the bonus to the liquidator. Relative to Aave's currently reported 10% protocol-only fee, where 90% of the bonus remains with the liquidator, this allocation reduces liquidator proceeds by 37% (1 − 56.67/90) before pool impact. Aave's 2026 risk review recommends raising that fee to 20% only for deep WBTC/WETH/wstETH markets, and reports that extending 20–30% to thinner DEX-dependent BAL collateral produced modeled negative net results. The result is not a universal elasticity estimate, but it is direct evidence that a 33.33% skim can suppress the very liquidations a thin collateral market needs. (Aave 2026 liquidation fee review)

Aave currently reports a 10% protocol fee on most Ethereum Core collateral bonuses (20% for USDC/DAI). Aave's code computes this as a configured fraction of the bonus and transfers it to the reserve treasury. Maker uses a different arrangement: the liquidation penalty is a protocol charge, while Liquidations 2.0 separately configures keeper kick incentives; MIP45 gives chip = 2% of the debt/penalty amount as an example parameter. That architecture is not equivalent to taking a third of the liquidator's bonus. (Aave 2026 fee review; Aave liquidation implementation; Maker MIP45)

There is no public evidence establishing a universal participation elasticity for a one-third skim. But in this system the reduction is mechanically measurable: it takes an already marginal net incentive from 9% (if only a 10% protocol share were taken from a 10% bonus) to 5.67% after also paying the flagger. Recommend at most Aave's 10%-of-bonus protocol share and a separately budgeted fixed flag reward.

4. Deviation cap, update cadence and stale prices

The 20% cap is already operationally wrong: the panel refused a requested update after the market left its answerable band. With no heartbeat or keeper, every retry costs money and may again fail if the market moves. A small cap is not protective if it makes the true price unreachable. But simply raising it to 50% or removing it would let a compromised signer publish a very large price jump. The cap and payment cadence therefore cannot safely be treated as one static knob.

Chainlink's primary documentation describes a different model: its data feeds update when the deviation threshold is crossed or a configured heartbeat expires. Consumers are told to check updatedAt, monitor extreme volatility, and pause or switch to an alternate mode when the answer is stale. That is a useful operational pattern; it is not an equivalent oracle and its parameter thresholds vary by feed. (Chainlink Data Feeds overview)

Recommended behavior:

1. When a move breaches the normal cap, immediately stop minting, collateral withdrawal, and other actions that increase exposure. Do not accept the stale value as fresh collateral value.
2. Permit catch-up through multiple individually signed, quorum-checked steps with a short retry window, recording each update and its source evidence. Keep risk-increasing actions paused until the feed reaches the independently checked market range. Liquidations should use a conservative valid price or an auction/backstop rule, never a fabricated midpoint.
3. Design and fund a heartbeat/keeper or subsidized update service. If paid updates remain on-demand, make the maximum staleness an explicit service-level bound: after that bound, freeze borrowing and withdrawals; 24 hours is far too long for this token.
4. Do not automatically widen the maximum deviation as the feed ages. Staleness increases uncertainty and manipulation opportunity, so it should tighten permissions and trigger recovery/pause controls, not relax signer bounds. If larger steps are needed to recover from a true jump, use separate quorum, independent evidence, rate-limited staged recovery, and a paused borrowing state.

The separate 5% primary-to-spot bound can halt a legitimate move, particularly when the primary feed is stepped and the spot market reprices immediately. Conversely, the one-hour spot age permits a stale cross-check. Since the spot is the same single Uniswap pool that constitutes the market, it is not independent confirmation and may be manipulable. Make it a monitor/circuit-breaker with freshness measured in minutes or blocks, and define explicit recovery logic for divergence; do not treat a 5% match as proof that either answer is sound. The USD collateral mark also depends on both legs of IMD/ETH × ETH/USD; enforce freshness and validity on both inputs, then apply the ERC-4626 share-to-underlying conversion using the 24-decimal sIMD scale and current vault exchange rate. Do not hard-code the share ratio: its stated daily yield makes it change over time.

5. Stability fee and redemption fee

Stability fee

At 200 bps/year, the fee is not enough to compensate for the stated volatility and liquidation risk by itself. Maker's official governance proposal set ETH-A to 7.75% and WBTC-A to 12.75% in February 2025; fees are collateral-specific, governance-set market/risk choices, not universal minimums. A reasonable starting price inference for sIMD is 8% annually, with an 8–12% calibration range after debt-demand and expected-loss modelling. That range borrows a market anchor from Maker but does not imply the same portfolio or backstops. Liquity V1, by contrast, charges no recurring interest and relies on one-off borrowing/redemption fees, an entirely different model. (Maker February 2025 executive proposal; Liquity V1 borrowing FAQ)

That comparison does not establish a precise sIMD fee. A fee influences borrowing demand and protocol revenue; it does not make a liquidator's sale executable or repair bad debt after a price gap. The 8% starting point is therefore an inference, not a standard parameter; selecting an APR requires modeling stablecoin demand, competing yields, and expected loss. Set collateral ratio, debt ceiling, oracle liveness, and liquidation mechanics first.

Redemption fee shape

Liquity V1 is the closest public match to this design. Its documented redemption fee has a 0.5% floor, its base rate increases by redeemed LUSD / (2 × total supply), and it decays with a 12-hour half-life. That means the proposed 50 bp floor and 12-hour decay match the V1 design, while /4 makes the same redemption raise the base rate only half as much as the Liquity /2 rule. (Liquity redemptions FAQ)

The 500 bp cap is a mismatch: Liquity caps its borrowing fee at 5%, but its redemption fee can rise to 100% (min(0.5% + baseRate, 100%)). That is one protocol's extreme upper bound, not a general standard, but it shows the intended distinction: redemptions must be able to become unattractive enough under severe pressure, while new borrowing fees have a separate cap. A 5% redemption cap could leave continued redemptions cheap during a serious contraction. Consider a much higher cap, potentially 100%, together with user-specified maximum fee protection and simulation of redemption behavior.

The /4 divisor is defensible only as an explicit, tested choice to make fees less responsive. It is not the Liquity V1 parameter and weakens the stabilizer when redemptions are large. Use /2 as baseline unless historical supply/redemption simulations show /4 controls churn without leaving the peg unsupported. The 12-hour half-life matches V1 and has a clear precedent; it is not a universal standard. Liquity V2 itself changes the half-life to six hours and the increment to redeemed amount divided by supply, illustrating that fee calibration is a protocol design choice. (Liquity V2 redemptions FAQ)

Evidence limits and loss history

Facts supplied by the assignment: the sole Uniswap v4 market, the vault's approximate TVL, the 44.6% one-day increase, on-demand $4.25 oracle updates, the failed request, and the current values. They were not independently verified here. In particular, the vault's assets under management do not disclose pool depth.

Inferences: the 250% MCR is calculated from a symmetric 44.6% shock, a 20% liquidator bonus, and a 10% execution haircut. The 10% haircut is illustrative because actual sell-side depth is absent. A historical rally alone does not prove a same-size drop; downside and gap-risk data are needed for final sizing.

Loss precedent: Maker's Black Thursday liquidation failure is a relevant warning about depending on liquidator participation during a fast market and network stress. A 2022 Japanese FSA research report records approximately $8.32m of ETH collateral won for zero DAI on 12 March 2020 amid price collapse, congestion, and gas spikes. Maker later replaced its English auction design with Liquidations 2.0's Dutch auctions and composable instant settlement; the MIP45 design includes keeper incentives and specifies a 2% chip example. This is a post-loss mechanism redesign, not evidence that the 2% example was calculated from or alone remedied the $8.32m loss; MIP45 is marked obsolete by a later MIP. (FSA incident account; Maker MIP45; Maker auction documentation)

Unanswered for final calibration: exact v4 pool liquidity by tick and stablecoin side; trade impact for liquidation lot sizes; observed downside volatility and maximum adverse move over update plus liquidation latency; panel signing threshold and source diversity; update SLA and denial frequency; stablecoin outstanding/supply and expected redemption size; whether seized sIMD can be redeemed promptly for IMD without additional exit limits. Until these are measured, cap debt to demonstrated liquidation capacity and do not treat these recommendations as a substitute for a launch limit.