Liquidations
What liquidations are (and what they are not)
Liquidations are the last-resort, rules-based unwind when a borrower does not cure a margin call on PoV-backed Energy/Carbon collateral We sell the pledged NFT(s) for EDSD, repay debt and accrued interest, charge a bounded penalty, return any surplus to the borrower, and close. There is no tokenized IOU, no off-rail workout, and no way to force Trade cashflows to release early.
Non-negotiables
No EMT, no funds (liquidations never bypass milestones)
One-Claim stays intact (no double monetization)
Locked EDSD → Unlocked EDSD only on proof (loan ops don’t touch settlement)
50% protocol-fee burns happen on market fills/retirements and Trade releases—not on loan or liquidation actions
1) Triggers & state machine
Health Factor (HF)
Margin call HF ≤ 1.10 (governed) → cure window (e.g., 24–48h)
Liquidation eligible HF ≤ 1.00 or call not cured by deadline
Hard stops collateral FROZEN (revocation/mirror) blocks execution until cleared; calls continue to apply
Lifecycle
HEALTHY → CALLED → (CURED | LIQUIDATING) → CLOSED
Cures (any combination) repay, add collateral, swap to higher-LS bucket (if allowed)
2) What we liquidate (and what we don’t)
Liquidated collateral Energy (1 MWh) and Carbon (1 tCO₂e) NFTs held in CollateralVault (canonical on EDMA; not wrapped)
Not liquidated ETT (proof-only), EMTs, receivables/RA (they reassign, they don’t “sell”), EDSD (platform stable), or any FROZEN token (must unfreeze first)
3) Pricing & oracles
Marks come from the same oracle stack as lending (§22.1) bucket TWAP (72h default) with liquidity/dispersion filters; guardrails keep starts below last trade
If marks stale (>24h p95) the bucket is disabled or haircutted; positions are called, not liquidated blindly
4) Execution paths
A) Dutch auction (preferred, price discovery)
Kick any actor or the system can start a lot (subset of pledged tokens) when eligible; kicker earns a small fee (e.g., 0.2% of recovered debt) paid from penalty
Start price min(mark × (1−kickPenalty), bestAsk + ε)
Decay step every Δt seconds down to a governed floor
Fill any taker can buy the lot for EDSD at current price
Duration max Tmax; leftover rolls to a new lot or backstop
B) Order-book sweep (high-liquidity buckets)
Place IOC sell orders into the Tokens book across price bands within governed slippage partial fills allowed; residual goes to Dutch
Backstop (governed) can take final residual at floor−ε to guarantee closure; it immediately lists/resells on the book
5) Proceeds waterfall
Debt + accrued interest (to the lending pool / facility)
Liquidation penalty (governed, e.g., 5–10% of repaid debt) → Backstop/Insurance pool (and kicker fee if used)
Costs (auction gas/ops, capped)
Surplus → borrower in EDSD
Events defi.liq.started, defi.liq.filled {proceeds, repaid, penalty}, defi.liq.closed {surplus}
6) Special cases & blockers
Mirror/Revocation FROZEN liquidation waits; margin call stays active; timer pauses until status UNFROZEN or REPLACED
Bucket disabled (oracle stale) no liquidation; raise call level; require cure or partial repay
Thin books limit lot size, slow decay; prioritize RFQ block to approved buyers
Multiple pledges liquidate smallest lots first (minimize penalty & market impact)
Cross-currency N/A—credit and proceeds are EDSD only
7) EMT receivables (RAs): what “liquidation” means
RAs are allocations of future Releases; there is nothing to sell until the EMT mints and the buyer has must-funded If the borrower defaults or HF falls
We reassign RA priority to the financier/backstop (or keep as is)
When the stage releases, the RA auto-settles by waterfall
If the stage is canceled before proof, RA cancels per MPA (no payout, no on-rail loss) This is a novation, not an auction; the rail never forces an EMT
8) Governance knobs
HF thresholds (call/liquidate), cure window, kick fee, penalty %, Dutch decay Δt / floor, lot caps, RFQ allowlist, backstop size
Oracle windows/filters, bucket enable/disable, aging/vintage haircuts
Exposure caps per bucket/borrower, utilization caps per program
Cannot liquidate frozen tokens; bypass PoV/One-Claim; settle Trade cashflows; discount or redirect protocol burns
9) APIs & webhooks
APIs
GET /v1/defi/health/{loan} → HF, marks, call timersPOST /v1/defi/liq/kick { pledge_id, lot }POST /v1/defi/liq/bid { auction_id, price, qty } (Dutch)POST /v1/defi/repay { loan_id, amount_edsd } (cure)POST /v1/defi/pledge/release { pledge_id } (when debt=0)
Webhooks
defi.margin.call (deadline, HF, required cure)defi.liq.started / defi.liq.filled / defi.liq.closeddefi.pledge.frozen / defi.pledge.unfrozen (mirror/revocation signals)
10) Risk controls & coverage
Backstop/Insurance pool (treasury-funded, bounded) absorbs timing & tail-liquidity risk; earns penalties/kickbacks
Assurance Pool (Trade) is separate bridges must-fund gaps; not used for collateral sales
Circuit breakers halt new liquidations in a bucket on oracle outage; require governance wake-word to resume
11) KPIs & SLOs
Liquidation loss rate (principal) 0 (target)
Time from eligible → started p95 ≤ 30 min
Time from started → filled p95 ≤ 6 h (per lot; bucket-dependent)
Kick participation ≥ 70% of auctions community-kicked (not only system)
Backstop take rate ≤ 10% (means auctions/OB are clearing)
Oracle freshness p95 ≤ 24 h; staleness incidents 0
12) Worked example
Borrower pledges 10,000 t VERRA ARR 2026; mark $18/t; Base LTV 55%; borrows $90,000 EDSD
Price drops to $15 → HF = (150k×0.60)/90k ≈ 1.00 → eligible (call uncured)
Dutch auction lot 2,500 t: start $16.00 → decays to $15.50; bought by takers for $38,750
Proceeds waterfall: repay $38,000 debt slice + $300 interest; $1,900 penalty (5%) → backstop; surplus back to borrower
HF recomputed; if still ≤1.00, kick next lot; else CLOSED (healthy)
Plain recap
Last updated