Liquidation & the backstop

When your health factor drops below 1.0, your position is underwater and can be liquidated. A liquidator repays some of your debt and receives collateral plus a bonus. This section explains how liquidation works and what happens if the agent goes down.

How liquidation works

Liquidation is a partial process by default. The liquidator specifies how much USDC they want to repay on your behalf; the vault calculates how much collateral they receive as a result.

The formula: max_repay = your_debt × close_factor ÷ 100%; actual_repay = min(requested, max_repay); seize_value = actual_repay × (1 + bonus%); seize_collateral = seize_value ÷ collateral_price

With a 50% close factor and 5% base liquidation bonus: If you owe $1,200 USDC, a liquidator can repay at most $600 (50% of debt). If they repay $600, they receive $630 worth of collateral ($600 × 1.05). After liquidation, you still owe $600; your position is healthier but not closed. Full liquidation happens automatically if your health factor falls below 0.95: anyone can repay your entire debt at once.

Liquidation bonus

The base liquidation bonus is 5%: the liquidator receives 5% more collateral value than the USDC they repay. This incentivizes liquidators to step in and keep the protocol solvent.

The bonus ramps with depth. If you're very underwater (health factor near zero), the bonus climbs toward a higher maximum (e.g., 15%) to incentivize liquidators to clear bad debt. The deeper you are, the more attractive liquidation becomes. This is a Dutch auction mechanism: if you're slightly underwater, liquidators have a small bonus and won't rush; if you're severely underwater, the bonus is juicy and someone will move fast.

On testnet: agent-only liquidation

Today on testnet, only the Watcher agent can call the vault's liquidate() function. This is because the permissionless backstop (see below) is not yet enabled. If you get liquidated, it's the agent that does it — watching your position and acting to protect you (and the lenders) before you get too underwater.

The permissionless backstop (testnet-proven, mainnet-ready)

When the agent goes down or goes silent, lenders are at risk: underwater positions may not get liquidated, and bad debt can accumulate. The permissionless backstop solves this.

Here's how it works: (1) The agent stamps an on-chain heartbeat every few seconds by calling vault.heartbeat(). This records the timestamp of the last time the agent checked in. (2) If the agent is down, the heartbeat stops updating. After a delay (15 minutes on testnet), the heartbeat is considered stale. (3) Once the heartbeat is stale, any address can call liquidate() and clear underwater positions. The backstop is now open. (4) Any position liquidated via the backstop is marked with a backstop_liquidation event, and a different (higher) liquidation bonus may apply to incentivize the backstop liquidator.

This design protects lenders: even if the agent crashes and never recovers, liquidations will still happen (just with a delay). The backstop does not kick in immediately — it waits for the heartbeat to truly stale — so a momentarily-idle agent does not trigger false liquidations.

The permissionless backstop has been implemented, tested, and proven on an earlier testnet deployment: a non-agent address liquidated a stale-heartbeat position on-chain, raising health from 0.94 to 1.20. It works. On the current testnet (Robinhood Chain), it is not yet enabled (the delay is set to 0). It will be enabled at mainnet after independent audit.

Bad debt

If a position gaps so hard that even after liquidating all collateral, debt remains, that's bad debt. Example: You borrow $1,000 USDC against 10 tTSLA @ $150 = $1,500 collateral. Over a weekend, tTSLA gaps down to $50. Your collateral is now worth $500. The liquidator repays your full $1,000 debt but can only seize $500 of collateral. $500 of bad debt is realized.

When bad debt is realized, the vault emits a BadDebtRealized event. The protocol's 15% reserve factor (skimmed from borrow interest) is the first-loss buffer; any loss beyond the reserve is absorbed by USDC lenders pro-rata. This is why conservative LTVs and the AI risk layer exist: to make bad debt rare, not zero. At mainnet, we will have insurance or a larger safety reserve to absorb anticipated bad debt.

Close factor

The 50% close factor means a single liquidation can clear at most 50% of your debt. This prevents one liquidator from dominating a liquidation and hoarding the bonus. Exception: if your health factor is below 0.95 (very close to insolvency), the close factor is 100% — your entire debt can be repaid in one call.

Collateral liquidation order

If you have multiple types of collateral (e.g., tAAPL and tTSLA), the liquidator chooses which token to seize. They might seize the cheapest token (lowest USD price) to maximize their bonus. You have no say in which collateral is taken — only the liquidator decides. This is standard lending-protocol behavior, but it means you should not assume a particular collateral is safer — all your collateral is at risk of liquidation if you're underwater.