LUSD
An automated structural risk report on LUSD: every number below is read from Ethereum at block 26107477 and can be reproduced (see the verify page).
The finding ?The three figures that summarise this report, read at block 26107477; the written summary arrives with the prose stage.
Notice: gate failure (entry LUSD:17, first fired 2026-10-02)
The structural-zero flag is set because no trove reaches the minimum collateral ratio on the ruled grid; the first liquidation occurs at an ETH shock of -82.55% (minimum ICR 6.3044 -> 1.1), recovery mode activates at -79.66% (TCR 7.3744 -> 1.5), and TCR falls below MCR at -85.08%, while Liquity v1 is wound down to 70 troves.
The token is backed by $192.9M of collateral, of which $26.2M backs the supply; all backing can be checked directly on-chain (100.0%). Forced sales are zero relative to exit liquidity of $8.3M, and off-venue DEX liquidity totals $12.6M, with 0.4% lying outside modeled venues.
Where the backing sits ?The collateral behind LUSD, across all Liquity troves, split by how far its value can be checked on-chain, at block 26107477.
No one can change the rules: the contracts are immutable.
The token's backing is held entirely in assets whose value can be checked directly on-chain, accounting for 100.0% of the total reserve. This single class contains all collateral, with Ethereum being the only asset listed in the node details.
No portion of the reserve relies on wrappers that require checking one layer down or depends on issuer disclosures to verify its value. Consequently, there are no disclosure-dependent nodes and no staleness metrics to report for this structure.
The admin qualifier banner states that no admin power can alter backing, making it immutable. The entire perimeter covers all troves with an exact identity.
What could break it ?The headline stress scenario and the grid around it: collateral price falls of 20–70% with liquidity-provider flight of 0–60%, across all Liquity troves, at block 26107477.
The headline scenario is a 50% fall in the price of volatile collateral, with no extra discount on liquid-staking tokens and liquidity providers staying put: the one scenario the archetype memo names as the headline (memo §6.2.6).
In that scenario liquidations leave $0 of bad debt (0 of supply), structurally zero on this grid because no trove reaches MCR on the ruled grid; first liquidation at an ETH shock of -82.55% (min ICR 6.3044 -> 1.1), recovery mode at -79.66% (TCR 7.3744 -> 1.5), TCR below MCR at -85.08%; Liquity v1 is wound down to 70 troves, and require selling $0 into $8.3M of exit liquidity.
| price fall | no LP flight | 30% LP flight | 60% LP flight |
|---|---|---|---|
| -20.0% | 0 | 0 | 0 |
| -35.0% | 0 | 0 | 0 |
| -50.0% | 0 | 0 | 0 |
| -70.0% | 0 | 0 | 0 |
Each cell: collateral that must be sold ÷ liquidity available to absorb it; “exit exhausted” = no liquidity left at that level of liquidity-provider flight. ?Each cell divides the collateral liquidations must sell by the exit liquidity left in that scenario, across all Liquity troves, at block 26107477; above 100% the sales cannot all be absorbed.
0 under 0.1% under 10% under 100% 100% or more exit exhausted
At a 50% fall, forced sales use 0 of available exit liquidity; at a 70% fall, forced sales use 0 of available exit liquidity; and if 60% of liquidity providers leave at a 70% fall, forced sales use 0 of available exit liquidity.
Prices may lag the market by up to 0.50%: the largest update threshold among this token's price feeds (ETH).
Who can change the rules ?Who holds each administrative power over the protocol's contracts and how long a change takes to take effect, read at block 26107477.
- No one holds any admin power: every contract is immutable and ownership was renounced.
How it trades ?Webacy's view of how this token trades, fetched at the time shown under the chart; not read at this report's block and not verified by this pipeline.
How to check this ?Every figure is pinned to block 26107477; the verify page lists the calls that reproduce them.
Every figure on this page comes from one data table built from on-chain reads at a single block. Reproduce any of them from the verify page. Verify page · report fingerprint ba9b2bb87138655e
The behavioral tier — how the token trades — is shown under "How it trades", from Webacy's data fetched at a timestamp rather than read at this report's block. This report is the structural tier only: what backs the token, how far that backing can be checked on-chain, and how it holds up under stress.
Detail for specialists
Collateral nodes whose backing depends on disclosures or stops at a truncation
Supply, what was originated, and the residual with its named causes
| figure | value |
|---|---|
| supply | 26,160,997.85 |
| originated supply | 26,160,997.85 |
| supply the tree covers | 26,160,997.85 |
| residual (supply − originated) | 0 |
| unexplained after named causes | 0 |
| stabilizer debt ÷ supply | 0 |
| protocol stabilizer debt | 0 (0 of supply) |
| ceiling aggregate: the upper bound of the protocol stabilizer slice | 0 (0 of supply) |
Every figure in the headline scenario
| metric | value |
|---|---|
| collateral coverage before the shock | 3.6872 |
| collateral coverage after the shock | 3.6872 |
| coverage restored by the liquidation mechanism | 0 |
| bad debt | 0 |
| bad debt as a share of supply | 0 |
| collateral that must be sold | 0 |
| exit liquidity | 8,324,384.17 |
| forced sales ÷ exit liquidity | 0 |
Mechanism state in the headline scenario
| quantity | value |
|---|---|
| the counterfactual lines printed with this scenario | Tellor_fallback |
| exit liquidity in this scenario | 8,324,384.17 |
| share of liquidity providers leaving in this scenario | 0 |
| whether the system collateral ratio after the shock is below the Recovery Mode threshold | no |
| debt passed to surviving troves when the Stability Pool cannot absorb it; a reallocation, not an absorption | 0 |
| redistributed trove debt left below full collateral, which is how bad debt is defined for LUSD | 0 |
| Stability Pool balance available to absorb liquidations in this scenario: the balance less the scenario's liquidity-provider flight share | 7,568,229.65 |
| system collateral ratio after the shock | 3.6872 |
Redemption capacity
| field | LUSD that can be redeemed against troves before the redemption fee reaches its ceiling, or the reason none is counted |
|---|---|
reason | crash path excluded |
value | 0 |
What changes under the counterfactual assumptions
| counterfactual | affects | as modelled | under the counterfactual |
|---|---|---|---|
| Tellor fallback | none | — | — |
The counterfactual where the price feed falls back from Chainlink to the Tellor oracle affects the measure that relies on instant observation of the PriceFeed at the report's block. This change alters how the price basis is calculated, shifting it from a bundle's own total collateral value divided by the total collateral amount to a re-simulated fresh price-feed read. The metric changes because only a fresh price-feed read rewrites the last good price, whereas the fallback introduces a lagged moving-average price line that does not exist in Liquity v1.
Exit liquidity at four price-impact levels
The LUSD system uses the Stability Pool and redemptions to handle liquidations, a mechanism that prevents forced sales on the absorption path. Because no trove reaches the minimum collateral ratio on the ruled grid, bad debt is structurally zero; the first liquidation occurs only at an ETH shock of -82.55%, where the minimum internal collateral ratio drops from 6.3044 to 1.1.
Collateral coverage remains at 3.69 before and after the shock, with no share of assets falling below 100% in either state. The system collateral ratio after the shock is also 3.69, which stays well above the Recovery Mode threshold.
Exit liquidity stands at $8.3M, while the volume of collateral that must be sold is $0. Consequently, the ratio of forced sales to exit liquidity is 0, indicating no pressure on the exit venues in this scenario.
A depeg of the paired stablecoin fits this token's mechanism because it is structurally insulated by construction, meaning its internal collateral ratio remains zero while exposure flows through exit venues. In the Member-2 headline scenario where the paired stablecoin trades at its middle target of 0.93, forced sales total $0 and the resulting ratio is 0. The available exit liquidity in this baseline case is $7.7M.
When the paired stablecoin price drops to 0.88, the exit liquidity curve shows $6.1M at a 0.5% price impact, rising to $7.8M at a 5.0% price impact. At a price of 0.97, the corresponding depths are $6.8M at 0.5%, $7.5M at 1.0%, $8.1M at 2.0%, and $8.6M at 5.0%. These figures illustrate how liquidity availability shifts as the paired asset price moves away from parity.
The modelling assumptions and the data behind each
| assumption | what it means | data | source |
|---|---|---|---|
stock_only |
Capacity is measured as a stock at the run block; how each mechanism's stock-only reading errs is the bias table below. | bias: Collateral-sell-side bound: see appendix bias mechanism: see appendix bias tokens: crvUSD, GHO bias reason: see appendix … 32 more in table.json |
memo §7.1 |
observation |
Prices are taken as observed instantly at the run block; the oracle table lists each feed's update condition. | deviation: 0.50% | memo §7.2 |
lp_sticky |
Liquidity providers are assumed to stay in their pools unless a scenario applies the liquidity-flight modifier. | LP-flight assumption line: see appendix | memo §6.1.4 |
lp_grid |
Liquidity-provider flight is an assumed modifier of 0%, 30% and 60%, not a measured behaviour. | LP-flight assumption line: see appendix | memo §6.1.4 |
sell_side_bound |
Collateral that liquidations must sell is bounded by the analyst's dated sell-side capacity per volatile collateral. | sell-side bound: ETH: exempt — Stability Pool depositors receive collateral; no forced sale assumption: absorption: see appendix |
memo §6.3 |
par_numeraire |
paired assets counted at 1.00 for depth | base pool virtual price (par numeraire): 1.04 | memo §6.1.3 |
shock_grid_fixed |
The shock grid is fixed by the archetype memo, not tuned per token. | — | memo §6.2.1 |
member2_target |
The depeg scenario targets the paired stablecoin named in the frozen pool set. | Member-2 target: 0xdac17f…1ec7 | memo §6.2.5 |
freeze_reference |
Exit venues are the pool set frozen on the freeze date shown. | freeze date: 2026-09-10 | memo §5.7 |
absorption |
An additional modelling disclosure carried by the stress model; its full text is in the appendix. | assumption: absorption: see appendix | — |
bad_debt_definition |
An additional modelling disclosure carried by the stress model; its full text is in the appendix. | assumption: bad debt definition: see appendix | — |
engagement_thresholds |
An additional modelling disclosure carried by the stress model; its full text is in the appendix. | assumption: engagement thresholds: see appendix | — |
oracle_assumption |
An additional modelling disclosure carried by the stress model; its full text is in the appendix. | assumption: oracle assumption: see appendix | — |
structural_insulation |
A depeg of the paired stablecoin forces no collateral sales for this token by construction, so the ratio is zero; the exposure runs through exit venues and is shown as recomputed depth curves. | assumption: structural insulation: see appendix | — |
How a stock-only reading errs, mechanism by mechanism
stock-only capacity — direction of error per mechanism
| mechanism | tokens | direction | reason |
|---|---|---|---|
| Collateral-sell-side bound | crvUSD, GHO | overstates | full bound treated as immediately absorbable |
| GSM cap headroom (H2.i) | GHO | overstates | full cap headroom treated as instantly mintable |
| Liquidator recycling (H5) | GHO | understates | no multi-round capital recycling |
| Stability Pool refills (H3) | LUSD | understates | no SP deposits between liquidation waves |
| PegKeeper effective headroom (H1) | crvUSD | overstates | full effective headroom treated as deployed within the window; peer co-deployment dynamics omitted — runs conservative |
| H4 redemption capacity | LUSD | overstates | full schedule capacity treated as immediately available; base-rate decay (regenerative, 12h half-life) omitted — runs conservative |
| H5 liquidator appetite (composite) | GHO | both | two named opposite-sign terms; `binding_side` states per cell which dominates |
| Pool exit depth — no LP inflow | all | understates | no LP inflow modeled |
| Pool exit depth — LP sticky at flight-0 | all | overstates | static composition; spread disclosed by the LP-flight grid |
The admin-power table, row by row
No written summary for this section this run: the local model's draft did not pass the figure guard.
| power | holder | type | delay | veto | upgradeable | scope | evidence |
|---|---|---|---|---|---|---|---|
| minting | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) | |
| debt ceilings | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) | |
| contract upgrades | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) | |
| pausing | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) | |
| freezing assets | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) | |
| blacklisting addresses | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) | |
| oracle settings | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) | |
| risk parameters | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) | |
| seizing assets | — | none | none | — | immutable | absence read owner 0x3d32e8…5521 (contract read) owner 0x4c517d…01de (contract read) owner 0x5f9880…8ba0 (absence read) owner 0x66017d…21bb (contract read) owner 0x896a3f…741c (contract read) owner 0xa39739…4bb2 (contract read) owner 0xdf9eb2…3d7f (contract read) |
Price feeds: type, update threshold and heartbeat
| collateral | market or reserve | update rule | threshold | window / heartbeat | staleness |
|---|---|---|---|---|---|
| ETH | 0xa39739…4bb2 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
No notices are open for this token this run.
Audits, bug bounty and counterparties
- Trail of Bits 2021-01: Liquity v1 security assessment
- Coinspect 2021-03: Liquity v1