Parameters as a System: Why Lending Protocols Need a Joint-Constraint Framework

Risk parameters in lending protocols are conventionally set in sequence. A loan-to-value ratio is anchored on the asset's volatility profile. A liquidation bonus is calibrated by reference to peer protocols. Supply and borrow caps are set against circulating supply or recent on-chain volume. Interest-rate parameters are usually drawn from a template. Each of these choices has a clear local rationale. What happens when those locally-rational choices fail together is the subject of a companion piece reviewing six stress events from 2022 to 2025.

The framework presented in this series begins from a different starting point: the observation that all of these parameters enter, directly or indirectly, into a single inequality. Every breached position must be liquidatable profitably before it generates bad debt. Treating that inequality as the binding constraint across all parameters jointly, rather than as a property each parameter satisfies on its own changes what gets calibrated against what, what gets validated against history, and what gets stress-tested forward.

This post sketches the inequality, the trade-off surface it implies, and the seven-step pipeline that operationalises it. The pieces are covered in depth in posts that follow.

The one constraint that binds

A position becomes liquidatable when its loan-to-value ratio crosses the liquidation threshold. A liquidator repays a fraction of the debt and seizes the corresponding collateral plus a liquidation bonus. The collateral is then sold into a pool to recover the debt repayment plus the bonus.
The maximum size of a profitable liquidation is a property of the exit pool. For a constant-product AMM with collateral-side reserve $x$ and a liquidation bonus $LB$ net of fixed costs $f$, the maximum debt that can be profitably cleared in a single liquidation is bounded by
$$\Delta x \leq \frac{LB - f}{1 - (LB - f)} \cdot x.$$
Call the right-hand side $C_D$ the conservative debt cap on the route. Below this line, the liquidator's bonus covers the slippage of selling the seized collateral. Above it, the slippage exceeds the bonus and the residual debt remains uncovered.
The route-adequacy condition is the statement that, for every collateral $C$ and every debt asset $X_i$ borrowable against $C$,
$$BC(X_i) \leq C_D(C, X_i).$$
This is the inequality the framework treats as binding. Every other risk parameter: LTV, liquidation threshold, liquidation bonus, supply cap, interest-rate slope either enters this inequality directly or is constrained by it through its effect on the inputs.

How parameters interact through the inequality

The structure of the inequality determines how the parameters move together.
Changing the liquidation bonus changes the net budget $LB - f$, which changes $C_D$ proportionally. Every borrow cap previously calibrated against $C_D$ is therefore also a function of $LB$. A change to $LB$ alone shifts the ceiling for every cap that exits through that route.
Changing the LTV changes two terms simultaneously. It raises the maximum liquidation size for any given supply cap, since the liquidatable debt is $CF \cdot LTV \cdot SC$, where $CF$ is the close factor. It also reduces the overcollateralisation buffer $(1 - LTV)$ that enters the capital-efficient cap. Both effects tighten route adequacy in the same direction.
Changing the supply cap changes the maximum aggregate liquidation demand on every route through which the collateral can be unwound. A change to $SC$ alone requires rechecking the route-adequacy condition against every debt asset that can be borrowed against that collateral, not only the most active one at the time of the change.
Changing the binding pool reserve through structural LP exit, fee-tier migration, or fragmentation moves $C_D$ directly. The same set of parameters that was route-adequate against yesterday's pool may not be route-adequate against today's.
These interactions are visible only when the parameters are read together through the inequality. Read separately, each parameter's local rationale remains intact while the joint configuration may drift outside the region the inequality defines.

The visible face: the cap–LTV trade-off surface

When route adequacy is treated as the binding constraint, the supply cap and LTV are not independent recommendations. They lie on a curve. Setting the maximum single liquidation $CF \cdot LTV \cdot SC$ equal to $L_{\max}$, the largest liquidation the binding pool can absorb at acceptable slippage,
$$SC = \frac{L_{\max}}{CF \cdot LTV}.$$
This is a hyperbola in $(LTV, SC)$-space. Every point on the curve satisfies route adequacy at the same $L_{\max}$. Moving right along the curve raises LTV at the cost of a tighter cap. Moving up to a higher curve through a deeper pool, a larger liquidation bonus, or external arbitrage credit opens the space above.
The framework treats the curve, rather than a single point on it, as the output. Governance reads the surface and chooses an operating point against its growth-versus-risk preference, with the property that any point on the curve is route-adequate by construction.
The surface also makes dependency closure operational. If $LB$ is raised, the curve shifts up. If the binding pool reserve falls 25%, the curve shifts down, and operating points previously on it may now sit above it. If a new debt market is added, a new pool reserve $x_i$ enters the system and a new curve appears; the binding curve is the lowest of them. Each of these is a walk along the same inequality, not a re-derivation from first principles.

Three operational implications

Reading parameters through the joint constraint produces three properties that distinguish the framework's outputs from a sequence of locally calibrated values.
The first is that LTV and pool depth enter separately. LTV is bounded above by the asset's own risk characteristics: its tail-loss profile and the structural exit cost on its binding pool. These produce a ceiling, $LTV_{\max}$, that is independent of pool depth. Pool depth then enters in a separate step that produces the cap–LTV curve. The two are sequential. Holding LTV fixed at a value inherited from a peer protocol removes the degree of freedom that the pool-depth step needs.
The second is that the calibration is validated against the historical trajectory of depth, not only against today's snapshot. Today's pool depth is one draw from a distribution. A historical reconstruction step replays Mint, Burn, and Swap events to rebuild per-tick liquidity at each historical timestamp, recomputes $L_{\max}(t)$ along the way, and uses a low quantile of the resulting series, typically the 10th percentile as the operating $L_{\max}$. Where today's depth is the high-water mark, this typically tightens the recommended cap by 30 to 60 percent.
The third is that the calibration is stress-tested against price paths that have not yet been realised. A simulation step generates synthetic paths for the collateral, the debt asset, and the counterparty asset in the binding pool, typically through a GARCH(1,1) model with Student-t innovations to capture volatility clustering and joint tail dependence and computes the bad-debt distribution under the chosen parameter set across ten thousand or more paths. The output is a probabilistic guarantee at a chosen tolerance, against the parameter configuration as a whole.

The seven steps, briefly

The full pipeline that operationalises this is seven steps. The first five produce a calibration against the current state of the world. The last two validate that calibration against, respectively, the historical record of depth and the distribution of price paths that have not yet been realised.
1. Due diligence - qualitative review of fundamentals across team, audits, oracle architecture, tokenomics, and technical risk. Produces a verdict and a list of unresolved structural concerns, each contributing to a discretionary haircut.

2. Market microstructure characterisation - six metrics across volatility (daily 99% CVaR, mean absolute return) and liquidity (maximum drawdown, median volume, median market cap, Amihud illiquidity) over a 365-day window.

3. Risk grading - min-max normalisation against a reference universe of the top 1,000 assets by market capitalisation, producing dimension-level scores alongside the composite.

4. Haircut composition - volatility and liquidity haircuts applied to the protocol's reference LTV, binding through $\max(\cdot)$, producing $LTV_{\max}$.

5. Joint cap: LB–LTV derivation - enforces the route-adequacy condition against the current pool state, producing the cap–LTV trade-off surface and a co-calibrated LB.

6. Historical pool-depth evolution - Mint/Burn reconstruction of $L_{\max}(t)$, producing a depth-adjusted operating value that feeds back into step 5.

7. Price and liquidation simulation - GARCH-driven synthetic paths against the calibrated parameters, producing the bad-debt distribution.

Each step has explicit monitoring triggers that retrigger the pipeline from the affected step downward when its inputs drift. A pool reserve falling beyond a threshold retriggers step 5. A score crossing a bin boundary retriggers step 4. A sustained price-ratio shift into a stress regime retriggers the regime weighting in step 6. The framework is a maintained system: its outputs are the trajectory of parameters under change, not a single calibration at a single moment.

What follows

Posts in this series develop the individual steps in depth: the supply-cap derivation that anchors step 5, the haircut composition in step 4, the historical depth reconstruction in step 6, the simulation methodology in step 7, the cap–LTV trade-off surface as a governance tool, and the framework's extensions across protocol architectures from isolated markets to curator vaults. The pieces are connected; the order in which they are read is not.