You deposit 1 ETH into a lending protocol, borrow $500 in stablecoins against it, and then ETH drops 40% while you sleep. At some point during that drop, a stranger's bot repaid part of your loan, kept a chunk of your ETH as a reward, and the protocol thanked them for it. Nobody asked for your permission. Nobody sent you an email. The contract just executed.
That is on-chain lending in one paragraph. No loan officer, no credit check, no recovery department — just collateral, a ratio, and a public rulebook that anyone can enforce. To actually use it without getting surprised, you need to understand three things: what collateral is worth to the protocol (not to you), how the health factor turns that into a single number, and what happens the moment that number crosses one.
This is Part 4 of the DeFi from First Principles series. If you are new to this whole world, start with what DeFi actually is and then wallets, gas, and approvals before going further — the mechanics below assume you have signed a transaction before.
Why on-chain lending exists at all
Traditional lending rests on identity. A bank knows who you are, where you live, and what your paycheck looks like, so it can lend you money you do not currently have and chase you if you disappear. A smart contract knows none of that. It cannot sue you, garnish your wages, or even send a strongly worded letter.
So on-chain lending flipped the model. Instead of trusting the borrower, the protocol trusts the collateral. You lock up something valuable — ETH, a liquid staking token, a blue-chip stablecoin — and the contract lets you borrow a fraction of its current market value. If the collateral's value falls toward the debt, the contract forcibly sells enough of it to make the lenders whole, paying a bounty to whoever does the work. No human in the loop.
This is called overcollateralized lending, and it is the dominant design across Aave, Compound, Morpho, Spark, and most forks of them. You always post more value than you borrow. Why would anyone do that? Usually to keep exposure to an asset while unlocking spending power — borrowing stablecoins against ETH to pay a bill without selling, or looping a staked asset for extra yield. Sometimes it is to short an asset by borrowing it and selling it. Almost never is it because someone genuinely has no other way to get a loan.
The collateral factor: your ETH is not worth what you think it is
The first counterintuitive number is the collateral factor. When the oracle tells the protocol your ETH is worth $2,000, the protocol does not let the full $2,000 back a loan to the edge of liquidation. It applies a haircut.
A typical ETH liquidation threshold is around 82.5%. That means for every $1 of ETH value, only $0.825 counts toward keeping you above the liquidation line. The remaining 17.5% is a buffer — space for the price to move before liquidators get involved. Riskier collateral (volatile small-cap tokens, illiquid liquid-staking tokens) gets lower thresholds; governance sets these based on how liquid the asset is and how badly it can gap on a bad day.
Note that protocols like Aave publish both a Max LTV (how much you can initially borrow — often a couple of percentage points below the liquidation threshold) and a Liquidation Threshold (the line that triggers liquidations). The gap between them is your built-in margin if you max out. Treating the Max LTV as a safe borrow target is exactly how people get liquidated on the first red candle.
The health factor: one number to watch
The health factor (HF) compresses your entire position into a single ratio:
HF = (collateral_value × liquidation_threshold) / debt_value
Above 1, you are safe. At or below 1, you are liquidatable. That is the whole rule. Everything else is just plugging numbers in.
Let's walk a real position from open to liquidation.
Opening the position. You deposit 1 ETH at $2,000 and borrow $500 USDC. ETH's liquidation threshold is 82.5%.
HF = (1 × $2,000 × 0.825) / $500
= $1,650 / $500
= 3.30
An HF of 3.30 is comfortable. ETH would have to fall a long way before the protocol cared.
ETH drifts down to $700. You got distracted. The debt has not moved — you still owe $500 in stablecoins, because stablecoins are, approximately, stable. But your collateral's dollar value did.
HF = (1 × $700 × 0.825) / $500
= $577.50 / $500
= 1.155
HF of 1.155 is the danger zone. A 15% further drop wipes out your buffer entirely. This is the moment to act — repay part of the loan, add more collateral, or close the position. Most people do not act, because they are asleep, because they are hoping, or because gas is expensive and acting costs real money.
ETH drops to $600. Now the math turns on you.
HF = (1 × $600 × 0.825) / $500
= $495 / $500
= 0.99
HF is below 1. The position is open for liquidation.
What a liquidator actually does
A liquidator is just a bot (or a person, usually a bot) watching the protocol for positions with HF < 1. When it finds one, it calls a public liquidationCall function on the contract. There is no auction, no queue, no fairness — whoever lands the transaction first wins.
The liquidator repays part of your debt in the borrowed asset and claims an equivalent value of your collateral plus a liquidation bonus (often 5%). On Aave V3, the close factor — how much of the debt can be repaid in a single call — is up to 50% when HF is above 0.95 and both collateral and debt exceed $2,000; otherwise (HF at or below 0.95, or the position is small) up to 100% can be liquidated at once.
In our example, the liquidator repays $250 of your $500 USDC debt. At a 5% bonus, they are entitled to $250 × 1.05 = $262.50 worth of ETH. At $600 per ETH, that is $262.50 / $600 = 0.4375 ETH seized from your position.
What is left: you owe $250 in stablecoins, and your collateral is now 1 - 0.4375 = 0.5625 ETH, worth $337.50.
HF = (0.5625 × $600 × 0.825) / $250
= $278.44 / $250
= 1.11
The position is back above 1 — barely. The liquidator walks away with roughly $12.50 of gross profit (minus gas), and you walk away with a smaller position, a chunk of lost principal, and a visceral understanding of why people who use lending protocols check their phone a lot.
If ETH keeps falling, another liquidator will come along and repeat the process. Each round shrinks your collateral and your debt, but the bonus is paid entirely from your side of the ledger.
The supply side: where the borrowed money comes from
Every borrowed dollar is some lender's deposit. When you supply USDC to a lending pool, you receive an interest-bearing receipt token that tracks your share of the pool. Interest rates float based on utilization — the ratio of borrowed to supplied capital. High utilization means high rates for both sides; low utilization means cheap borrows and thin yields for suppliers.
Lenders get paid because borrowers pay interest, not because the protocol prints anything. The protocol itself usually takes a small reserve factor as treasury income. Suppliers can be liquidators too — in fact, many are, because they already hold the borrowed asset.
This is structurally different from an AMM, where liquidity providers earn from swap fees. There is no impermanent loss in pure lending, but there is counterparty risk: if the borrowers collectively default and liquidations fail to cover the debt, suppliers eat the shortfall.
Risks to understand before you participate
On-chain lending has a clean rulebook, but the rulebook runs on top of messy infrastructure.
Liquidation cascades. When an asset drops fast, many positions cross HF = 1 at once. Liquidators sell the seized collateral into the market, pushing the price lower, which liquidates more positions. The April 2026 Aave stress event was triggered by an exploit affecting Kelp DAO's rsETH on April 18, 2026: the fallout pushed Aave's WETH pool to 100% utilization and left the protocol carrying a reported $177M–$200M in bad debt, with the AAVE token dropping sharply on the day. If the network is congested during an event like this, your save-the-position transaction may simply not land.
Oracle manipulation. The protocol does not look at market prices directly — it reads an oracle, usually Chainlink or the protocol's own TWAP. If that oracle lags, gets stuck, or can be pushed around (thin-liquidity pairs are especially vulnerable), positions get liquidated that should not be, or do not get liquidated when they should and leave bad debt behind. Several of the largest DeFi exploits in history were oracle attacks, not contract bugs.
Smart contract risk. The code is the bank. A bug in the liquidation logic, the interest accrual, or the collateral accounting can drain deposits in a single block. Audits help; they do not eliminate risk. Forks of well-audited protocols with a few "small changes" have been drained many times.
Protocol bad debt. When liquidations cannot clear a position fast enough — usually during a cascade — the protocol is left holding debt with no collateral behind it. Governance has to decide whether to socialize the loss across suppliers, tap an insurance fund, or write it off against future revenue. Suppliers sometimes wake up to find their receipt token is worth less than par.
Counterparty risk disguised as self-custody. Your funds are in the contract, not in your wallet. You hold a receipt token. That is better than leaving assets on an exchange, but it is not the same as cold storage — you are trusting the contract, the oracle, and the governance set that can change parameters.
How to borrow safely (if you are going to borrow at all)
If you read the risks section and still want to borrow: keep HF comfortably above 2 for volatile collateral, do not borrow the same asset family you posted (borrowing ETH against staked ETH means a depeg liquidates you twice), and never borrow anything you cannot repay quickly if the network is congested. Set price alerts at the HF = 1.5 level, not at HF = 1.05. Decide your unwind plan before you open the position, not during the drawdown.
And remember the basic accounting: every dollar you borrow is a short on the collateral you posted. If you would not take that trade directly, you are probably not taking it on purpose here either.
Key takeaways
- On-chain lending is overcollateralized: you always post more value than you borrow, and the protocol applies a haircut (liquidation threshold) to what counts.
- The health factor = (collateral × liquidation threshold) / debt. Above 1 is safe; at or below 1, anyone can liquidate you.
- Liquidators repay part of your debt and seize collateral plus a bonus (often 5%), capped at 50% of the debt per call near the liquidation line.
- A worked example: 1 ETH at $2,000 backing $500 debt starts at HF 3.30, hits danger at $700 (HF 1.155), and liquidates at $600 (HF 0.99) — losing 0.4375 ETH to the liquidator.
- The real risks live outside the math: cascades, oracle failures, contract bugs, and bad debt. The April 2026 Aave-Kelp stress event was a reminder that the rulebook is fast, but the infrastructure underneath can still break.
