# sIMD CDP risk-parameter recommendation

Date: 2026-10-14  
Scope: one USD-denominated CDP, sIMD collateral, one thin Uniswap v4 market, an on-demand signed oracle, and the stated current parameters.

## Executive conclusion

The dangerous parameters are the **24-hour primary staleness limit, six-hour liquidation grace period, and 20% per-update oracle cap**. Together they can leave the system valuing collateral at an old price while liquidators cannot liquidate, and can prevent the feed from ever catching up after the observed one-day move. The 5% primary/spot bound is not a substitute: the spot is the same single market and is not an independent price source.

My initial, deliberately conservative settings are:

| Parameter | Current | Recommendation | Direction |
|---|---:|---:|---|
| Minimum collateral ratio | 150% | **250%** (40% max LTV) | up |
| Gross liquidation bonus | 10% | **20%**, with a stress range 20–25% | up |
| Protocol share of bonus | 33.33% | **10% of bonus**; do not increase until execution data supports it | down |
| Grace period | 6 hours; 0 in stress | **0–15 minutes**, never a multi-hour grace in this market | down |
| Oracle deviation cap | 20% | **50% provisional**, with a separately governed emergency path for larger moves | up, but bounded |
| Primary staleness | 24 hours | **1 hour hard stop** for minting and new risk; liquidation needs an independent emergency price path | down |
| Spot staleness | 1 hour | **15 minutes** if used as a circuit breaker | down |
| Stability fee | 2%/year | **8%/year initial floor**, with a stress surcharge or governance review | up |
| Redemption floor / cap | 0.5% / 5% | **0.5% / 20%** | cap up |
| Redemption spike | redeemed supply / 4 | **redeemed supply / 2** as the Liquity-v1 comparator | stronger |
| Redemption decay | 12-hour half-life | **12 hours is defensible**; 6 hours is the faster live-v2 choice | unchanged initially |

These are recommendations, not a claim that a single parameter set makes an illiquid collateral safe. The missing pool reserves, expected maximum liquidation size, debt ceiling, and measured execution slippage prevent a fully calibrated number. The 250% figure is an initial limit pending those measurements.

## 1. Liquidation bonus

**Answer: 10% is not enough as a base case for this market. Use 20% gross, and test 25% for stress.** A liquidator must source USD/stablecoin inventory, repay debt, receive sIMD, and sell into one pool. The relevant margin is not the nominal bonus; it is the bonus minus gas, funding/inventory cost, adverse price movement while holding sIMD, and AMM price impact. A 44.6% one-day move is strong evidence that the last two terms are not small.

Live comparators are materially lower because their execution environments are better:

* Liquity V1 uses a 10% collateral loss at liquidation (the borrower receives collateral worth 110% of debt); its docs explain that instantaneous Stability Pool offset is what permits the low 110% MCR. [Liquity borrowing FAQ](https://docs.liquity.org/liquity-v1/faq/borrowing)
* Maker's historic ETH-A liquidation penalty was 13%. Maker's own auction documentation describes the penalty and auction mechanism. [Maker auctions documentation](https://docs.makerdao.com/auctions/the-auctions-of-the-maker-protocol)
* Aave governance proposals commonly use 5–10% liquidation bonuses, with 10% liquidation protocol fee on the bonus. For a riskier non-stablecoin, Gauntlet recommended 10% LB for GNO and 10% LPF, while recommending 5–6% for more liquid majors. [Aave Gnosis parameter recommendation](https://governance.aave.com/t/arfc-aave-v3-deployment-on-gnosischain/14695)
* Aave's FBTC listing proposal used 7.5% LB and 10% LPF, and explicitly treated supply/liquidity caps and oracle quality as part of the risk design. [Aave FBTC proposal](https://governance.aave.com/t/arfc-add-fbtc-to-aave-v3-main-market-on-ethereum/19937/5)

Those figures are comparators, not proof that 10% works for sIMD. Liquity has an internal Stability Pool and Maker/Aave have larger, more liquid keeper/market ecosystems. A 20% gross bonus leaves 18% after a 10% protocol share; that is a more credible starting margin for a one-pool liquidation. If measured AMM impact plus hedge/holding cost consumes more than 15–18%, the correct answer is to reduce debt exposure or improve liquidity, not to assume a still larger bonus fixes it.

## 2. Minimum collateral ratio

**Answer: 150% is not defensible on the stated facts. Use 250% initially.**

A protocol sets MCR by asking whether collateral value after a specified adverse price move, oracle delay, and liquidation execution loss still covers debt plus the liquidation incentive. A transparent first-pass calculation is:

`required CR ≈ target post-shock CR × (1 + execution/bonus buffer) / (1 - adverse move)`.

Using the observed 44.6% move as a symmetric stress, a 110% post-shock solvency target, 20% gross liquidation incentive, and only 5% execution buffer gives:

`1.10 × 1.25 / 0.554 = 248%`.

That rounds to 250%. At 150%, the same move leaves only `150% × 0.554 = 83.1%` before liquidation costs: already below the debt, let alone a liquidator's margin. Even if the 44.6% observation is treated as an upside-only event and discounted as a volatility proxy, 150% leaves too little room for oracle lag and one-pool impact.

The calculation is intentionally not a claim that 44.6% is the correct tail quantile. It is a floor-like scenario check. A final MCR should use a historical downside distribution, pool-reserve snapshots, liquidation-size simulations, and a debt ceiling. If those show 10%+ price impact for the intended liquidation size, 250% is still too low; reduce the debt ceiling or raise MCR.

Liquity's 110% MCR is not a relevant safety precedent without its instant Stability Pool mechanism. Maker's whitepaper states the general rule: a higher liquidation ratio reflects higher expected collateral volatility. [Maker whitepaper, risk parameters](https://makerdao.com/whitepaper/White%20Paper-The%20Maker%20Protocol_%20MakerDAO%E2%80%99s%20Multi-Collateral%20Dai%20%28MCD%29%20System-FINAL-%20021720.pdf)

The current health-index rule that rises to 200% under stress is directionally right but too slow and too low if the feed can be stale. Stress mode should activate before, not after, the 44.6%-type move; it should also stop new borrowing and withdrawals.

## 3. Protocol share of the liquidation bonus

**Answer: 33.33% is unusually aggressive and will reduce participation exactly when the market is hardest to unwind. Use 10% initially.** A one-third cut of a 10% bonus leaves the liquidator 6.67% gross; after gas, price impact, inventory financing and adverse movement, that may be negative. With a 20% bonus, a 10% share leaves 18% gross to the liquidator, which is more credible.

The clearest live comparator is Aave: its governance material describes the liquidation protocol fee as **10% of the liquidation bonus**, and Gauntlet recommended 10% for non-stablecoins while warning that higher relative fees can disincentivize liquidators. [Aave Gnosis proposal](https://governance.aave.com/t/arfc-aave-v3-deployment-on-gnosischain/14695/), [Aave explanation of LPF](https://governance.aave.com/t/temp-check-integrate-oval-for-the-bal-snx-ethereum-v3-markets/16475/22)

Aave's later risk analysis is useful evidence rather than a universal rule: it modeled 10%, 20%, 30% and higher shares and concluded that revenue peaks before very high fees because some liquidations cease to be profitable; it treated 30% as a hard ceiling in that particular Ethereum-Core dataset. [Aave LPF analysis](https://governance.aave.com/t/arfc-liquidation-protocol-fee-increase-for-wbtc-weth-and-wsteth-on-aave-v3-ethereum-core/25470)

**Post-mortem example:** Maker's March 12, 2020 “Black Thursday” event left vault owners with losses and prompted an official compensation poll. Maker later changed auction timing and liquidation limits; a 2022 executive proposal shortened auction cycles and reduced several local liquidation limits, explicitly to improve throughput. This is evidence that keeper capacity and auction timing are risk parameters, not afterthoughts. It is not evidence that Maker's 13% penalty would work for sIMD. [Maker compensation poll](https://vote.makerdao.com/polling/QmZKAqzN), [later auction-parameter change](https://vote.makerdao.com/executive/template-executive-vote-collateral-auction-parameter-changes-momc-parameter-adjustments-recognized-delegate-compensation-for-september-october-14-2022)

**Inference:** the 33.33% cut is not automatically fatal, but it measurably compresses the only available private execution margin. The protocol should optimize total successful liquidation value, not gross fee per successful event. A temporary 0% share during oracle or liquidity stress is safer than a fixed one-third tax.

## 4. Oracle cap, cadence, and stale prices

**Answer: 20% is dangerous here; 24 hours is dangerous; widening on staleness without a second control is dangerous.** A 44.6% market move cannot be represented by one 20% update. Even under compounding, two 20% upward steps reach 44% only before considering timing and the fact that every intermediate update must be answerable and paid for. The reported refused request demonstrates the operational failure, not merely a theoretical one.

Standard oracle practice is to combine a deviation trigger with a heartbeat and a consumer-side freshness check. Chainlink documents that feeds update on deviation or heartbeat and tells consumers to check `updatedAt`; if a feed is not recent enough, the consumer should pause or switch modes. [Chainlink feed overview](https://docs.chain.link/data-feeds/overview)

For this on-demand, expensive feed I recommend:

1. Set the ordinary cap to **50%**, chosen to cover the observed one-day move with one paid update while still bounding a single bad attestation. Do not treat 50% as a truth guarantee.
2. Add an **emergency catch-up path** for a move beyond 50%: independent market evidence, a quorum/attestation with a separate circuit-breaker rule, and a bounded transition that pauses minting and withdrawals. Do not simply disable the cap or accept repeated stale-panel answers.
3. On a cap violation, immediately pause new minting and collateral withdrawal; keep repayment and risk-reducing actions open. Allow liquidation only against a conservative emergency price or a fresh, independently corroborated price. A manual/governance escape hatch is preferable to silently carrying an impossible stale price.
4. Do **not** widen the cap automatically merely because the feed is stale. Staleness means uncertainty is higher, so the normal response is a halt or conservative floor/ceiling, not a larger trusted jump. If governance chooses a stale-mode cap, it must be temporary, one-way toward a conservative valuation, and paired with a pause.

The 5% primary-versus-spot halt can remain as an alert/circuit breaker, but it is not independent protection because the spot is the same single Uniswap market and can be manipulated or become stale. The 1-hour spot limit is therefore not enough to validate a 24-hour primary answer. Chainlink's feed-selection guidance specifically flags single-source, low-liquidity markets and recommends freshness checks, bounds, circuit breakers and fallback behavior. [Chainlink selecting quality data feeds](https://docs.chain.link/docs/selecting-data-feeds)

The current six-hour grace period is also unsafe. It turns a price/oracle lag into guaranteed additional exposure. Use no grace, or at most 15 minutes for transaction propagation, and never make the stressed value zero the only protection: stress should also disable minting and withdrawals and use a conservative price.

## 5. Stability fee and redemption fee

### Stability fee

**Answer: 200 bps/year is too low as a risk price, though it is not a solvency backstop. Use 8%/year initially, review it against utilization and peg data, and increase it in stress.** The collateral's stated share yield is about 0.027% per day, approximately 9.86% simple annualized; a 2% fee therefore leaves a strong carry incentive to lever a volatile, thinly traded token. Fee income also cannot repair a one-day liquidation gap quickly enough.

There is no universal stablecoin “standard” here. Maker governance has used materially higher ETH-A stability fees, including a documented increase from 5.25% to 6.74%; Maker's whitepaper describes the fee as an annual charge and ties risk parameters to collateral volatility. [Maker governance vote](https://v2.vote.makerdao.com/executive/template-executive-vote-stability-fee-changes-psm-pax-a-debt-ceiling-reduction-reth-a-offboarding-parameters-finalization-sbe-parameter-changes-hv-bank-dao-resolution-spark-proxy-spell-january-24-2024), [Maker whitepaper](https://makerdao.com/whitepaper/White%20Paper-The%20Maker%20Protocol_%20MakerDAO%E2%80%99s%20Multi-Collateral%20Dai%20%28MCD%29%20System-FINAL-%20021720.pdf)

Liquity V2 takes a different, live design choice: borrowers set their own rates; its docs use 5% as an example and say the rate is also a redemption-risk choice. [Liquity V2 borrowing FAQ](https://docs.liquity.org/v2-faq/borrowing-and-liquidations) That is not evidence that 5% is safe for sIMD, but it shows why comparing one fixed fee across protocols is misleading.

### Redemption shape

**Floor:** 50 bps is standard-like and defensible. Liquity V1 uses `baseRate + 0.5%`.  
**Cap:** 500 bps is too low for a stress throttle: it saturates quickly and then no longer prices larger redemption pressure. Liquity V1's implementation caps the fee at 100%, while Liquity V2 documents a 0.5% floor and 100% maximum. A 100% maximum is an outer bound, not a recommendation for sIMD; **20%** is a more usable initial cap for a thin market. [Liquity V1 redemption FAQ](https://docs.liquity.org/liquity-v1/faq/lusd-redemptions), [Liquity V2 redemption FAQ](https://docs.liquity.org/v2-faq/redemptions-and-delegation)
**Increase per redemption:** Liquity V1 uses `redeemed LUSD / (2 × total LUSD)`. The current divisor 4 creates half the immediate deterrence. It is defensible only if the aim is to preserve redemption liquidity and the system can tolerate faster repeated redemptions; with one thin collateral market, I recommend **divisor 2** initially. [Liquity V1 formula](https://docs.liquity.org/liquity-v1/faq/lusd-redemptions)
**Decay:** Liquity V1 uses a **12-hour half-life**; Liquity V2 changed to **6 hours** and alpha 1. Thus the current 12 hours is a real live precedent, not inherently wrong. Keep 12 hours until redemption observations exist; shortening to 6 hours would let fee pressure cool faster but may invite repeated bursts. [Liquity V1](https://docs.liquity.org/liquity-v1/faq/lusd-redemptions), [Liquity V2](https://docs.liquity.org/v2-faq/redemptions-and-delegation)

The shape should include user-supplied maximum-fee/slippage protection, as Liquity does, so a pending redemption cannot unexpectedly charge a much higher rate. The formula is a peg/liquidity throttle, not a liquidation reserve. It cannot compensate for stale collateral valuation.

## Facts, inferences, and open questions

**Facts supplied for this review:** sIMD is a 24-decimal ERC-4626 wrapper over 18-decimal IMD; the vault holds about 1.752m IMD / $14.9m; there is one live Uniswap v4 pool; IMD moved +44.6% in about one day; the oracle is signed, on-demand, deviation-capped, costs about $4.25 per update, and has already refused a request; current values are those listed in the brief.

**Sourced facts:** comparator parameters and oracle design practices are linked inline above. Protocol parameters are choices made for different liquidity, liquidation, and governance systems; they are not direct safety proofs for sIMD.

**Inferences/calculations:** 150% becomes 83.1% after a 44.6% adverse move; the 250% recommendation is the stated stress formula; 20% gross less a 10% protocol share leaves 18% gross to the liquidator; 0.027% daily yield is about 9.86% simple annualized.

**Unanswered questions required for final calibration:** live v4 reserves and depth at 5%, 10%, and 20% price impact; expected maximum debt and liquidation batch size; historical downside returns and volume; signed-panel quorum and failure mode; whether the spot reading is independently sourced; stablecoin inventory/flash-loan availability; and whether redemptions transfer collateral directly or require AMM sale.

## Bottom line

The protocol should first fix freshness, catch-up, and liquidation timing. Then set debt exposure around a 250% initial MCR and a 20% gross bonus while retaining most of that bonus for liquidators. A 10% protocol share is comparable practice; 33.33% is a stress-time participation risk. A 2% stability fee and a 5% redemption cap are too gentle for the stated carry and tail risk; a 0.5% floor, 20% cap, divisor 2, and 12-hour decay is a defensible starting shape, subject to measured redemption and peg data.