omermaksutii/rugproof/liquidation-cascade

Liquidation cascade detection

When this applies

Trigger on any of:

• Lending / CDP / perp markets with liquidation and a liquidation bonus
• Multiple collateral assets that are correlated (stETH/rETH/cbETH, USDC/DAI/USDT)
• A single insurance fund or backstop covering many isolated or pooled markets
• Bad-debt handling that socializes losses across lenders/LPs
• Collateral priced from a feed that can flash-crash or depeg
• Liquidation incentives or close factors set by governance

Detection patterns

Correlated collateral, no concentration cap (HIGH)

// stETH, rETH, cbETH all accepted, all priced off ETH-correlated feeds
collateralFactor[stETH] = 0.9e18;
collateralFactor[rETH]  = 0.9e18;

Signal: treating correlated LSTs as independent diversification. A single LST depeg (stETH 2022, or an LRT slashing event) crashes many positions at once, overwhelming liquidation throughput. Cap aggregate exposure per risk-cluster, not per token.

Bad debt socialized across markets (HIGH)

A loss in one risky isolated market draining a shared insurance fund or pool that also backs blue-chip markets. Signal: one toxic listing can impair unrelated depositors (the Mango / cross-margin contagion class). Isolate bad debt to the originating market.

Oracle flash-crash mass liquidation (HIGH)

uint256 price = oracle.getPrice(collateral);   // single-block spot, no bounds
if (debt > price * collateral * cf) liquidate();

Signal: a momentary depeg / wick (or manipulated feed) marks thousands of healthy positions liquidatable in one block; liquidators race, price gaps, and survivors eat bad debt. Use TWAP / deviation circuit breakers before liquidating en masse.

Liquidation incentive too low → stuck bad debt (MEDIUM)

If the liquidation bonus < gas + slippage to unwind seized collateral, liquidators don't act; positions go underwater and bad debt accrues silently. Signal: fixed small bonus on illiquid or volatile collateral.

Insurance-fund depletion ordering (MEDIUM / HIGH)

Order of loss absorption matters: if the fund pays liquidator bonuses before covering bad debt, or if multiple markets draw from it without priority, a run drains it. Define and bound the waterfall.

Depeg cascade (HIGH)

Stablecoin-collateralized debt where the stable depegs: liquidations sell the depegging asset, deepening the depeg, triggering more liquidations (UST May 2022). Flag self-reinforcing sell pressure with no circuit breaker.

Severity rubric

Remediation patterns

1. Isolate bad debt per market (Compound III / Morpho-style isolation, Aave isolation mode + debt ceilings); never let a risky listing impair blue-chip depositors.
2. Risk-cluster caps — bound aggregate exposure to correlated assets (all LSTs as one bucket), not per-token.
3. Circuit breakers — pause liquidations on excessive deviation; use TWAP/median so a single wick can't mass-liquidate.
4. Right-size liquidation incentives to gas + realistic unwind slippage on the actual collateral liquidity.
5. Define the loss waterfall explicitly (insurance fund → socialization → governance backstop) with per-market accounting.

False-positive notes

• A protocol with hard per-market debt ceilings and isolated collateral already bounds contagion; note rather than escalate.
• Single-collateral, deeply-liquid markets (e.g. WETH-only) carry low cascade risk.
• A bonus that looks low but on a highly liquid asset may still clear — judge against real unwind cost.

Related

• [[oracle-redundancy]] — flash-crash protection and staleness gating
• [[oracle-manipulation]] — manipulated marks trigger false liquidations
• [[centralization-risk]] — governance-set risk params and pause keys