DeFi lending lets people supply crypto to a shared pool and borrow from it against collateral, with smart contracts setting rates and enforcing the terms. Borrowers must lock more value than they borrow. A liquidation is triggered when a position's health factor falls below 1, usually because the collateral lost value. Anyone can then repay part of the debt and collect that collateral at a discount.
How a lending pool works
A lending pool is a smart contract holding one asset that many people supply and others borrow. There is no loan officer and no matching of one lender to one borrower. Aave, the best-known example of DeFi lending, works like this:
- You supply. You deposit an asset such as USDC or ETH and receive an aToken, a token whose balance grows as borrowers pay interest.
- You enable collateral. Supplied assets can back a loan.
- You borrow. You take out another asset. A debt token tracks what you owe, and it accrues interest.
- You repay or get liquidated. You can repay at any time. If your position becomes too risky, someone else can close part of it.
Why demand more collateral than the loan? Because the protocol knows nothing about you. It can't check your credit or chase you for payment, so the collateral is its only protection. This is over-collateralization, and it also underpins crypto-backed stablecoins.
The numbers below use Aave V3 rules, since V3 is the most documented design. Aave V4 launched on Ethereum in March 2026 with a different structure, and its liquidation bonus varies with position health. Other protocols differ too.
How utilization sets the interest rate
Utilization is the share of a pool that is currently borrowed. Rates follow it automatically. Aave's rate model uses two slopes, with a kink at an optimal usage ratio:
- Below the kink, rates rise gently.
- Above it, rates climb steeply, which pushes borrowers to repay and attracts new suppliers.
Here is that formula with illustrative settings: 90% optimal usage, a 0% base rate, a 4% first slope, a 60% second slope and a 10% reserve factor, the share of interest that goes to the protocol's treasury. Real settings vary by asset and are set by governance.
| Utilization | Borrow rate | Approximate supplier rate |
|---|---|---|
| 45% | 2.0% | 0.81% |
| 90% | 4.0% | 3.24% |
| 95% | 34.0% | 29.07% |
The supplier rate here is the borrow rate times utilization times 90%, since suppliers earn only on what is lent out, minus the treasury's share.
High utilization matters for a second reason. You can only withdraw what hasn't been lent out. When WETH hit 100% utilization on several Aave markets in April 2026, suppliers there had little available to withdraw. A deposit that earns interest isn't always instantly available.
LTV, liquidation threshold and health factor
These three terms get confused constantly, and they do different jobs.
| Term | What it does | When it applies |
|---|---|---|
| Loan-to-value (LTV) | Sets the most you can borrow against an asset | When opening or adding to a loan |
| Liquidation threshold | Sets the point where an existing position can be liquidated | Continuously, after borrowing |
| Health factor | Summarizes how close you are to that point | Continuously |
The formula, from Aave's guide, is:
Health factor = (collateral value × liquidation threshold) ÷ debt value
A common misconception is that borrowing the maximum is safe because the app allows it. With a 75% LTV and an 80% threshold, a maximum loan starts at a health factor of only about 1.07. A 6.25% price drop brings it to 1.
The health factor moves with collateral value, debt value, oracle prices and accrued interest. So your collateral can hold steady and you can still be liquidated, if the asset you borrowed rises or interest builds up. The prices come from oracles, outside feeds the protocol trusts, and those feeds can fail.
A worked liquidation
Take illustrative settings of 75% LTV, an 80% threshold and a 5% liquidation bonus, the discount a liquidator receives. Interest is ignored for simplicity.
Opening the position
- You supply 10 ETH at $3,000, worth $30,000.
- You could borrow up to $22,500, but you borrow $15,000 USDC.
- Health factor: ($30,000 × 0.80) ÷ $15,000 = 1.60.
- Liquidation price: $15,000 ÷ (10 × 0.80) = $1,875 per ETH.
The price falls to $1,800
- Collateral is now worth $18,000.
- Health factor: ($18,000 × 0.80) ÷ $15,000 = 0.96. Anyone can now liquidate.
- Under Aave's rules, a liquidator can repay up to 50% of the debt when the health factor is above 0.95 and both collateral and debt are worth at least $2,000. Below that, up to 100% is allowed.
The liquidation
- A liquidator repays $7,500 of your USDC debt.
- They receive $7,875 of your ETH, which is 4.375 ETH: the repaid amount plus the 5% bonus.
| Before | After | |
|---|---|---|
| Collateral | 10 ETH ($18,000) | 5.625 ETH ($10,125) |
| Debt | $15,000 | $7,500 |
| Health factor | 0.96 | 1.08 |
| Your net value | $3,000 | $2,625 |
You keep the USDC you borrowed, so the real cost is the $375 bonus, plus the ETH you no longer hold if the price recovers.
A faster crash creates bad debt
Suppose ETH gaps down to $1,400 before anyone acts. The collateral is worth $14,000, less than the $15,000 debt. A liquidator can repay about $13,333 and take all the ETH, since $13,333 plus 5% equals $14,000. The remaining $1,667 of debt has nothing behind it.
Who liquidates, and how flash loans help
Liquidation is permissionless, so anyone may do it, and in practice automated bots compete for the bonus. They need the debt asset up front, and this is where flash loans come in.
A flash loan is a loan with no collateral that must be repaid in the same transaction. If repayment fails, the whole transaction reverts as if it never happened. Aave set the fee at 0.05% at deployment, and governance can change it. A liquidator can borrow USDC, repay your debt, receive ETH, sell it on an automated market maker, repay the flash loan and keep the difference.
Attackers use the same tool to get large capital for an exploit. Flash loans don't create the underlying bug, but they make it far cheaper to attack one.
What is bad debt, and who pays?
Bad debt is a loan with too little collateral left to cover it. Nobody has a reason to liquidate it, so the shortfall sits in the pool, and suppliers are owed money the pool doesn't hold.
Each protocol answers this differently. On Aave V3, Umbrella is the on-chain backstop. People stake aTokens for rewards, and when a deficit appears in that asset, their stake is automatically slashed to cover it, after a first-loss amount covered by the Aave DAO. Beyond that, losses become a question for governance, the treasury and suppliers.
Real incidents
| Date | Incident | What happened |
|---|---|---|
| November 26, 2020 | Compound | DAI briefly rose 30% on Coinbase Pro, the source of Compound's oracle. About $89 million was liquidated that day, and governance voted against compensation |
| November 2022 | Aave CRV | A trader borrowed about $20 million of CRV. Its price jumped about 75% in hours, and the liquidation left about $1.6 million of bad debt |
| March 13, 2023 | Euler | A flash-loan-assisted exploit took about $197 million. The attacker later returned over $177 million |
| March 10, 2026 | Aave wstETH | A price-cap misconfiguration underpriced wstETH by 2.85%, wrongly liquidating about $26 million across 34 accounts. Aave took no bad debt and a refund plan followed |
| April 18, 2026 | Aave rsETH | See below |
The rsETH case shows how lending risk can come from outside the protocol. An attacker exploited the bridge route for Kelp's rsETH, a liquid restaking token, and released 116,500 rsETH from the bridge's reserves, leaving tokens on other chains under-backed. About 89,567 of the released rsETH went onto Aave as collateral, against roughly 82,650 WETH of loans.
Aave's report says its contracts worked as designed. It modeled $123.7 million to $230.1 million of bad debt, depending on how Kelp allocated the loss. Aave's total value locked fell from $26.3 billion to $17.7 billion in the aftermath, and Kelp restored rsETH's collateral by May 25, with support from a relief effort called DeFi United.
What to check before you use a lending protocol
This is education, not financial advice. Tax treatment of borrowing and liquidations varies by country, so ask a qualified professional.
If you borrow:
- Work out your liquidation price before you borrow. Don't only watch the app's health factor.
- Leave a wide buffer. A health factor just above 1 can vanish in a normal day of crypto trading.
- Remember that debt grows with interest, and that rates can jump when utilization rises.
- Plan how you'd add collateral or repay in a crash, when gas fees may be high.
If you supply:
- Check utilization and how much you could withdraw today.
- Look at which assets a pool accepts as collateral. On Ethereum and elsewhere, your risk includes every thinly traded, bridged or liquid staking token that borrowers can post.
- Treat a backstop as limited. It covers only what is staked.
For related explainers, see our DeFi coverage.
Key takeaways
- Lending pools match suppliers and borrowers automatically, with rates driven by utilization.
- LTV caps new borrowing, while the liquidation threshold decides when a position can be closed.
- A position becomes liquidatable when its health factor falls below 1, which is the point where threshold-weighted collateral no longer covers the debt.
- Liquidators repay debt and take collateral at a discount, and the borrower pays that discount.
- Bad debt appears when prices move faster than liquidations, and the loss falls on backstops, treasuries or suppliers.
- Many major incidents began outside the core lending logic, in oracles, thin markets or bridged collateral.
Sources
Get the weekly commit
New blockchain deep dives every week.
