Thin Liquidity, Thick Mistakes: A Review of 6 Stress Events Rooted in DEX Price Discovery and Single Constraint that Addresses Them

1. Lending Protocols and DEX-Based Price Discovery

Lending protocols on permissionless chains share a common architecture. A user deposits a collateral asset and borrows another asset against it, up to some loan-to-value ratio. A price oracle determines the relative value of the two assets and signals when the collateral is no longer sufficient. For major assets such as ETH or BTC, oracles aggregate prices across many venues, and the cost of manipulating that aggregate is high. For long-tail tokens, ecosystem governance assets, and assets on emerging chains, no institutional oracle exists. The price information must come from somewhere, and in most cases it comes from a decentralized exchange.

This is the DEX-as-oracle pattern. A constant product, concentrated liquidity or stableswap pool, often the deepest available venue for the asset, serves as the input to the lending protocol's pricing function. The pool sometimes also serves a second role: when a position becomes liquidatable, the seized collateral is sold into the same pool. The pool therefore can function both as the source of valuation and as the venue of liquidation.

When pool liquidity is large relative to the positions accumulating in the protocol, these two functions coexist without interference. When pool liquidity is thin in relation to the open positions in lending protocol, two outcomes are observable.

The first is a price manipulation event. An actor with sufficient capital trades against the pool in a way that moves the price beyond what arbitrageurs can immediately correct. The lending protocol reads the moved price and permits borrowing against an inflated collateral valuation.

The second is a liquidation cascade. A position becomes liquidatable through ordinary price movement. The liquidator seizes the collateral and sells it into the same pool that produces the price feed. The sale moves the price downward. The downward move places additional positions below their liquidation thresholds. Subsequent liquidations sell further into the pool, and the process continues until either the available collateral is exhausted or external arbitrage intervenes.

Both outcomes converge on a single observation: the relationship between pool liquidity and the maximum collateral volume that can flow through it in a single event is the variable that determines whether the system remains within its design assumptions.

2. Six Incidents Between April 2022 and August 2025

A number of incidents during this period have been publicly documented in sufficient detail to study the mechanism. The six described below differ in scale, in chain, in protocol architecture, and in whether an external actor was involved. They share a common structural feature.

Inverse Finance / INV. April 2, 2022

A swap of 500 ETH for 1.7k INV took place on the Sushiswap INV/WETH pool, which held approximately 432 INV and 46 ETH before the trade. The resulting price movement was reflected in the Keep3r TWAP oracle through a sampling window that did not fully average across the affected blocks. 1,746 INV, corresponding to approximately 644K USDat the prevailing wider-market price, was deposited as collateral, against which $15.6M was borrowed across ETH, WBTC, DOLA, and YFI.

Sources: Inverse Finance incident report, CertiK analysis

Rari Capital Fuse Pool #136 / ICHI. April 11, 2022

ICHI was listed on a permissionless Fuse Pool with a collateral factor of 85% and no supply cap. As market conditions softened, positions became liquidatable, and seized collateral was sold into the prevailing DEX venue for ICHI. The volume of liquidation sales exceeded the depth of available DEX liquidity, producing a continued price decline that maintained successive positions in a liquidatable state. The pool's available liquidity contracted to zero during the event.

A note from the protocol developer described the conditions: "A collateral factor of 85% is extremely high. Additionally, the team didn't use supply caps and allowed an infinite amount of $ICHI to be used as collateral. If you see collateral in a pool significantly in excess of what can be liquidated, this is a red flag."

Sources: CoinDesk post-mortem

Mango Markets / MNGO. October 11, 2022

A series of trades across three exchanges that fed the Mango oracle produced a thirteen-fold movement in the reported MNGO price over approximately thirty minutes. The inflated valuation of MNGO-denominated swap collateral permitted borrowing of approximately $117M against it. The price reverted shortly thereafter through external arbitrage.

Sources: CFTC complaint, Chainalysis analysis

Aave V2 / CRV. November 22, 2022

A single position held approximately 40M USD of CRV as collateral against USDC debt. As the CRV price moved against the position, the standard liquidation engine engaged. Liquidators seized CRV and sold it into the CRV/USDC DEX pool, the venue also referenced by the protocol's oracle. The size of the position relative to the pool's absorption capacity produced sustained downward price pressure during the unwind, and the liquidation process generated approximately 1.6M USD of bad debt by the time the position closed. A subsequent academic paper by Warmuz, Chaudhary, and Pinna formalized the dynamics as a "toxic liquidation spiral."

Sources: "Toxic Liquidation Spirals" — Warmuz, Chaudhary, Pinna

UwU Lend / sUSDe. June 10, 2024

The sUSDe price feed was constructed as the median of eleven sources, five of which were Curve pools of varying depth. A flash-loaned position was used to move spot prices in the thinner pools, which shifted the median. Borrowing was conducted at the suppressed median price and liquidation at the inflated price, in a sequence that resulted in approximately $23M in losses across two events that week.

Sources: SlowMist analysis, QuillAudits decoding

Bonzo Finance / BONZO. August 6, 2025

A position holding approximately 5–6M BONZO tokens against approximately 640K USD in USDC debt became liquidatable through ordinary price movement. The initial liquidation seized BONZO and the liquidator sold approximately 119K BONZO into the SaucerSwap V2 pool, which was the venue also referenced by the protocol's oracle. The resulting price movement returned the position to a liquidatable state at the new oracle reading. The sequence repeated through several rounds, producing approximately $112K of bad debt before stabilizing.

Sources: Bonzo Finance incident report

A common structural feature

The six events span three and a half years and a range of protocol architectures. Half involved an external actor; half did not. The Rari/ICHI, Aave/CRV, and Bonzo cases proceeded entirely through the protocols' own liquidation mechanisms operating as designed, in response to ordinary market conditions. The Inverse, Mango, and UwU Lend cases involved deliberate price movement by an external party. In all six, the binding variable was the relationship between the volume of collateral required to flow through a DEX pool, whether as a manipulation trade or as a forced sale during liquidation and the depth of that pool.

This is the observation that makes the cases relatable across their differences. Whether the trigger originates from above (as in deliberate price inflation) or from below (as in volatility-driven liquidation), the pool's absorption capacity determines whether the system remains within the bounds where bad debt is avoidable.

3. A Formal Model from 2022

The framework for quantifying these relationships was developed in 2022 and published in Entropy in December of that year (Aspembitova & Bentley, 2023). The paper considers a lending protocol that uses a DEX-based oracle and derives, from first principles, the minimum manipulation cost an external actor would require to extract value through inflated borrowing.

The central result expresses the attacker's profitability as a function of collateral value, LTV, and target price manipulation. The break-even condition, after setting profit to zero, takes a compact form:

$\varepsilon \geq \frac{1}{LTV} - 1$

where ε is the fractional price movement required for the manipulation to be net-positive. This describes the minimum price impact an actor must induce on the DEX pool to recover their collateral and extract additional value through borrowing.

The cost of producing the price movement ε depends on the AMM type and the pool's liquidity. For constant product pools (the Uniswap V2 family, including Sushiswap and SaucerSwap), the paper derives the cost analytically in Appendix A. The cost scales with pool depth: deeper pools require more capital to move. The same calculation applies symmetrically to liquidation sales - a forced sale of seized collateral produces price impact governed by the same AMM cost function.

The paper's Section 4 presents an algorithmic procedure that takes protocol parameters (LTV, oracle window size), AMM-specific parameters (liquidity L, type), and an assumed window for arbitrage-free manipulation, and returns two values: the cost AC required to produce the necessary price movement, and the minimum capital C required to make the operation profitable.

The construction provides a calibration: given a pool of liquidity L and an AMM type, the LTV at which any given attack becomes uneconomical can be computed directly. Equivalently, given a target LTV, the minimum pool depth that makes manipulation uneconomical can be derived.

The paper was completed in late 2022, motivated by the incidents observed earlier in that year. Its derivations and constraints have been publicly available since then.

4. The Joint Constraint and the Six Events

The model in the 2022 paper was developed in the context of deliberate manipulation. The constraint it produces — pool liquidity must be deep enough relative to LTV that price movement of size ε is uneconomical — coincides with the constraint that prevents liquidation cascades. This coincidence is not arbitrary. The two phenomena are different applications of the same AMM cost function.

In a manipulation event, ε is the price movement an external actor produces upward. In a cascade, ε is the price movement produced downward by the liquidator's forced sale of seized collateral. The AMM does not distinguish the two cases; the cost function applies symmetrically. The same pool depth that bounds the manipulation cost from below bounds the liquidation cascade severity from above.

A parameter set derived from the joint constraint produces three coupled outputs:

A supply cap anchored to pool token depth, such that the maximum collateral that can accumulate in the protocol — when liquidated under the worst-case single-event assumption — produces price impact less than the liquidation bonus.

An LTV calibrated such that the corresponding ε from Equation 18 exceeds the price movement economically achievable on the pool.

A liquidation bonus sized to the slippage curve, large enough to keep liquidations profitable for liquidators at the volumes the supply cap permits, but bounded above by the LT–LTV spread so that the bonus does not enlarge the per-event sale beyond what the pool can absorb.

Applying this construction to each of the six events:

For Inverse, the Sushiswap INV/WETH pool held approximately 432 INV. A joint calibration anchored to this depth would produce an LTV at which the ε required for profitable manipulation exceeds what could be achieved on the pool with reasonable capital.

For Rari/ICHI, the framework would produce a supply cap as a function of available DEX depth for ICHI, and a collateral factor such that the largest single liquidation produces slippage less than the liquidation bonus. Under these constraints, the conditions that initiated the cascade do not form.

For Mango, the MNGO oracle drew from DEX venues whose combined depth was smaller than the protocol's outstanding borrowable amount. A calibration that bounded the LTV by the binding pool's depth would render the observed thirteen-fold price movement uneconomical.

For Aave V2 / CRV, the $40M position exceeded the CRV/USDC pool's single-event absorption capacity. A supply cap or per-position concentration limit anchored to that pool would not have permitted the position to reach that size.

For UwU Lend, the five Curve pools that fed the median were the binding constraint on oracle integrity. The framework either excludes thin pools from aggregation, or sets LTV by reference to the median-shifting cost, which is itself bounded by the thinnest pools' depth.

For Bonzo, the supply cap had been set as a fraction of DEX TVL denominated in USD. A token-denominated cap anchored to pool liquidity in tokens — together with the LTV implied by the depth — would have produced a single-event seizure within the pool's absorption capacity.

In each case, the same calibration applied at the parameter-setting stage produces parameters that bound the observed outcome. The framework does not predict the specific trigger; it bounds the response of the system to any trigger.

Closing observation

The DEX-as-oracle pattern is a structural feature of permissionless lending on long-tail assets, and likely to remain so as new chains and new collateral types continue to come online. The joint constraint between supply cap, LTV, liquidation bonus, and the pool that serves as both oracle and exit venue is a derivable relationship, calculable from observables. Its derivation has been available in the literature since 2022.

The recurrence of the pattern across six events spanning three and a half years suggests that the constraint is not yet routinely applied at the protocol parameter-setting stage. The events themselves provide the empirical base for studying when and how it should be.