Loan that can defend its own collateral

Author: Jayesh Yadav, Compiled by: Block unicorn

I’ve been reading David Graeber’s Debt: The First 5,000 Years recently, and the book opens by exploring the ancient nature of debt and its human essence. It explains debt as a relationship that assumes both the lender and the borrower have a future. Throughout the loan period, the debt account remains open because both parties assume they will continue to exist.

But the modern debt model has long deviated from that original intention. On-chain lending makes this contrast even more absurd: even if the borrower is not at fault, the loan can be terminated. If your collateral price drops below a preset price, the position will be forcibly liquidated and a penalty imposed. Ironically, this could happen just one day before the collateral price recovers and far exceeds the loan amount. Simply because of a temporary “negative equity,” the borrower is deemed insolvent and penalized.

As a crypto supporter, I expected blockchain technology to do better. As it stands, the liquidation mechanism goes against the original purpose of debt, which is to maintain a cooperative relationship during uncertain times, not to terminate it at the first sign of trouble.

So, how can we construct a loan that honors its promise to the borrower rather than working against them? A loan that can flexibly adapt during difficult times instead of collapsing?

In today’s guest article, Jayesh argues that the answer has actually existed in traditional finance for 40 years. He takes a technique called “Constant Proportion Portfolio Insurance” (CPPI) – the same concept behind the principal-protected products that banks have sold for decades – and applies it to on-chain lending, creating a loan that protects its own collateral.

This is an honest article, because while proposing a solution, it also soberly acknowledges the potential shortcomings of that solution.

Most on-chain loans fail the same way: collateral depreciates, the price breaks a threshold, liquidators take a penalty and close the position, and the borrower incurs losses – assets that often recover a week later. We’ve spent five years making credit pricing more reasonable, but we’ve devoted almost no effort to the liquidation process that actually causes people to lose everything.

I want to propose a different loan structure, one that borrows from a concept that has existed in traditional finance for 40 years – Constant Proportion Portfolio Insurance (CPPI). This loan structure can protect its own collateral instead of waiting for liquidation. Curve and f(x) have already proven this idea works on-chain. However, no one has yet clearly explained its mechanics, connected it to the right variables, and given borrowers the power to decide risk.

Let me walk you through the past of lending, what this primitive technology is, the math that makes it work, where it can fail, and how protocols can actually build it.

On-chain Lending Innovation

First-generation on-chain lending used variable interest rates, and this remains the cornerstone of the entire on-chain lending space. Compound v2 launched in May 2019. ETHLend launched in 2017, rebranded to Aave in 2018, and transitioned to a liquidity pool model with Aave V1 in early 2020. Both set lending rates the same way: based on algorithms and utilization. When funds in a pool are borrowed, interest rates rise along the interest rate curve, attracting more supply and suppressing new borrowing. Rates are floating for all participants in the pool and update every block as borrowing demand changes.

This variable-rate model has been overwhelmingly successful and still holds the majority of the market share. By mid-2026, Aave alone had deposits of about $13 billion; Compound, now under its independent market architecture called Comet, had just over $1 billion in deposits. Notably, even for mature platforms, improving interest rates is not easy. Aave once offered a stable-rate borrowing option, but in November 2023, it stopped new stable-rate borrowing due to a bug discovered in the stable rate logic, and completely deprecated the option via governance in 2024. Today, the mainstream model for on-chain lending remains variable rates, and it has hardly changed for years.

The current frontier is fixed-rate lending, which is where most design talent has gathered recently. Pendle is the most typical example and the leader in this space, with assets expected to reach about $1.3 billion by mid-2026. Pendle operates by splitting a yield-bearing asset into a Principal Token and a Yield Token. The Principal Token functions like a zero-coupon bond: you can buy it at a discount and redeem it at face value at maturity, locking in a fixed return. In May 2026, Morpho released the Midnight whitepaper, a fixed-rate, fixed-term protocol. In this protocol, lending is conducted as trades of credit and debt units, with returns similar to zero-coupon bonds and no capital locked before settlement. Midnight was just released and open-sourced, clearly indicating that real developers are turning their attention to the fixed-rate space.

So, it’s necessary to compare the two dimensions of innovation side by side. In the credit cost dimension, we have moved from floating costs to fixed costs, building a practical toolkit in the process. In the dimension of what happens when collateral depreciates, there has been almost no change. Since the vast majority of on-chain debt is still protected by hard liquidations, even a slight price movement can cause your position to be liquidated and penalized. My focus is on the gap in this neglected second dimension.

Exceptions That Have Already Pointed the Way

Two protocols deserve full credit for addressing this issue earlier than anyone else.

Curve’s crvUSD introduced soft liquidation through a mechanism called LLAMMA (Lending-Liquidating AMM Algorithm). Instead of a single liquidation price, your collateral is distributed across a series of discrete price ranges, from 4 to 50, each acting as a separate liquidation zone. When the price falls below a certain range, the collateral in that range is gradually sold into crvUSD. When the price recovers into the range, crvUSD buys back that collateral. Curve calls this “de-liquidating.” Since LLAMMA’s quotes deviate from the oracle price, arbitrageurs can execute actual trades, profiting from rebalancing against the external market. Positions are not forcibly closed at a single threshold but continuously shift between volatile assets and stablecoins. crvUSD has achieved actual lending transactions through this design.

The f(x) protocol’s liquidation brake mechanism is structurally similar. When a leveraged position approaches the liquidation price, the protocol burns part of the position’s debt and sells part of the collateral, reducing leverage. This lowers risk while preserving the user’s directional exposure, rather than closing the position entirely. External stewards monitor positions and trigger sales when necessary. The protocol is expected to hold about $90 million in assets by mid-2026.

Regardless of what they call it, they are essentially providing portfolio insurance on collateral. They reduce risk in response to market declines and increase risk in response to market recoveries. This is exactly the embodiment of a strategy established in traditional finance in the 1980s. Once you understand the connection, a clearer and more general lending model naturally emerges.

What is CPPI?

Constant Proportion Portfolio Insurance (CPPI) was proposed by Perold in 1986, extended to stocks by Black and Jones in 1987, and formalized by Black and Perold in 1992. The idea is simple: it aims to protect a minimum floor.

You need to set a floor, which is the level below which your portfolio value cannot fall. Then you measure the cushion, which is how much your current portfolio value exceeds this floor.

Cushion = Portfolio Value – Floor.

Then, you hold a multiple of that cushion in risky assets, and invest the remainder in safe assets.

Risk Exposure = m × (Portfolio Value – Floor)

The strategy follows this simple straight line and naturally emerges as the market moves. When the cushion is large, you hold a lot of risky assets. As losses erode the cushion, your risk exposure mechanically approaches zero, moving you into safe assets before falling below the floor. When the cushion rebuilds, you re-add risky assets. The strategy sells when prices fall and buys when prices rise.

Mapping the same structure to a loan yields a perfect correspondence. The floor is set slightly above the debt, specifically the debt plus a small buffer. This is because the collateral value must never fall below the debt, otherwise bad debt would occur, requiring liquidation. The cushion is the collateral value minus the floor; it acts like a safety buffer that every borrower watches closely. The risky asset is the volatile collateral, e.g., ETH, BTC wrapped, or SOL, and the safe asset is a stablecoin. A CPPI loan treats the collateral as a managed basket of these two assets, rebalancing the basket as the cushion grows or shrinks. When the collateral value approaches the floor, the basket subtracts stablecoins from volatile assets, providing protection. As the cushion grows, the basket moves back into volatile assets, capturing upside gains. The difference is that a decline that would normally cause a liquidation of a typical position now does not, because it reduces risk instead of breaking a fixed boundary. The loan only fails if you stop paying interest, miss a maturity, or if the market gap is so violent that the basket cannot rebalance in time – gap risk is the core of this design.

The Math and Numbers

Take a simple example: your collateral is worth $100, and the loan is $70. In a first attempt, set aside some buffer so that the floor is the $70 debt. Thus, the cushion is $30. Suppose you want to put all your money into volatile assets initially, i.e., all in Bitcoin at the start. This choice determines your multiplier (m).

Risk Exposure = m × Cushion; therefore, $100 = m × $30, which means m ≈ 3.33.

In actual design, the floor is set slightly above the debt level. This shrinks the cushion and requires a higher multiple to achieve the same initial risk exposure. However, the mechanism is the same.

This multiplier is not an irrelevant setting; it embodies the overall risk profile of the loan, controlled by CPPI’s well-known gap risk properties. It serves two roles. First, it determines how much of your collateral is allocated to volatile assets, i.e., m times the cushion, capped at the full position. Second, it determines the size of a gap you can withstand between rebalances, which is 1/m. Since m≈3.33, this gap is 30%. Therefore, the loan can withstand any slow decline of up to 30%, as long as it is gradual enough to rebalance; when a gap exceeds 30%, the loan breaks through the floor before the portfolio can react. A more conservative borrower chooses m = 2, initially allocating only 60% to volatile assets because risk exposure is 2×$30=$60, and the remaining $40 is in stablecoins from the start. This trades higher upside potential for 50% gap tolerance. An aggressive borrower chooses m = 5, initially all in Bitcoin because 5×$30=$150 is capped at their $100 holding. But a higher multiple reduces risk faster during declines and tightens gap tolerance to 1/m, i.e., 20%. This is the main control point. It’s a clear, understandable number through which the borrower chooses how much downside protection to buy and how much upside to give up. The floor then provides a second control point for setting how much safety reserve to maintain. Currently, no on-chain lending protocol exposes these two control points.

This is also why I am reluctant to oversell the CPPI concept, because CPPI has a famous and instructive failure mode. The portfolio insurance strategies that were blamed for exacerbating the crash on October 19, 1987, Black Monday, were precisely the synthetic put options and dynamic hedging schemes that sold index futures on the way down, creating a feedback loop. Authoritative post-mortems, including the Brady Commission, concluded that portfolio insurance exacerbated, not caused, the crash. On the day of the crash, portfolio insurance companies accounted for about 40% of all non-market-maker futures selling. Strictly speaking, CPPI was not directly identified as the culprit, because the 1987 schemes were option replication types. But CPPI shares the same reflexivity of selling risk on the way down and gap risk. Therefore, the issue is not that the mechanism itself is flawed. Gap risk is real; you must set the multiplier based on how violently the asset can move between rebalances, and you cannot rebalance through a true gap.

This is a mechanism that actually works in traditional finance.

CPPI is far from dead after 1987; it remains active and widely used, serving as the standard engine behind principal-protected securities. These products are a significant part of traditional finance, with structured product sales approaching nearly $1.4 trillion in 2024, an all-time high, according to Structured Retail Products. CPPI issuance began to recover that year, making it a modern practice, not an outdated technique.

For us, what matters is that traditional finance has spent decades learning how to control CPPI’s gap risk, by keeping multipliers conservative, charging premiums to guarantee the floor, layering options on the underlying, and rebalancing frequently to shrink the gap. These are the tools that protocols will inherit, the same gap risk that is openly exposed on-chain in protocols that have pioneered soft liquidation.

What Is the Honest Price?

If I propose this, I must tell you all the drawbacks, because they are not hypothetical; there are three:

1. This erosion comes from repeated trading of the basket. Continuously selling volatile assets as prices fall and buying them as they rise is mechanically buying high and selling low, and when prices oscillate within the rebalancing range, this operation erodes value. Curve directly documented this for crvUSD and frankly stated that the loss is hard to quantify because it depends on the number of ranges, the speed of price movements, and the liquidity depth of the collateral. They gave an example where a position spending more than half its time in soft liquidation suffered a 6.37% loss and noted that this erosion accumulates during both declines and recoveries. CPPI loans also inherit this convexity cost. Effectively, you are short volatility and paying a premium for price swings.

2. Upside losses occur because positions that reduce risk near the bottom and only partially repurchase during a rebound have sold on the way down. The borrower gives up the chance for a full recovery in exchange for certainty that they won’t be liquidated. This is a real trade-off that some borrowers may not accept. The most notable form of this cost is cash lock, where the portfolio becomes fully converted to USDC and the cushion is zero. Even if a large rebound occurs, the position cannot be rebuilt, and its upside is frozen. In perpetual funds, this state is almost permanent, but in loans, it is more like an exit path than a trap. This is because the borrower can add more collateral to inject new cushion and re-risk, or simply hold the USDC safely, slightly above the debt, and repay at maturity. If the borrower wants more room to maneuver, they can set a higher floor in advance, so that the locked position is well above the debt, as I will discuss later.

3. Gap risk is the most critical and the most specific of the three. Soft liquidation is a buffer, not a guarantee, and crvUSD still retains a hard liquidation mechanism that forces closure once health drops to zero. We saw this on October 10, 2025, when the crypto market crashed, with about $19 billion in single-day liquidations, a record high. Curve’s CRV long LlamaLend market could not bridge the gap fast enough, leading to about $700k in bad debt, with recovery collateral value at about 70% of book value. Subsequently, in April 2026, a market-based recovery mechanism was proposed. This is not a reason to abandon the current design, but proof that any formal CPPI loan must come with hard liquidation safeguards and sufficient capital reserves to cover gaps that the math cannot.

Why This Technology Should Go On-Chain and How It Brings New Capital

The core of the argument is about the form of risk rather than its magnitude, because CPPI loans do not guarantee being safer than holding the raw asset. They change the form of risk. They turn an otherwise discontinuous, one-time liquidation with heavy penalties into a continuous, smaller, and more predictable cost that the borrower can anticipate and price.

This structure is exactly what risk-averse capital prefers. The entire principal-protected product industry exists because a vast pool of money is willing to accept lower expected returns in exchange for a guaranteed floor and avoidance of sudden crashes. So far, on-chain lending has offered almost nothing to this pool of capital except a liquidation cliff. A loan that protects its own collateral with a floor is the on-chain manifestation of a product structure that this capital already understands and commits over $1 trillion annually to.

It also expands the range of assets you can safely lend against, because in an environment where liquidation risk is high, volatile collateral is very risky – a single price swing can be fatal. Under a CPPI system, collateral self-hedges as its price approaches the floor, allowing more volatile assets to be used as collateral for a given lender safety level, provided the multiplier is set according to the price swing amplitude of each asset.

How a Protocol Can Actually Build This

I would build it as a standalone lending market, following the minimalist, invariant market design that this category is gradually converging toward, composed of four parts.

On top of these four elements, there is a choice: interest rates. CPPI is agnostic to how rates are set, so it can be layered on top of variable or fixed rates, and a variable-rate version is fully valid and worth building. The version I propose combines it with fixed rates and fixed terms, because this fills a quadrant that no one has built yet: a product that is both fixed-rate and self-insured. It closely resembles the principal-protected products from which this idea is drawn.

1. The collateral is not the pure volatile asset; instead, it is a CPPI-managed portfolio comprising volatile assets and stablecoins. The borrower chooses a multiplier at loan origination, and that multiplier is the final product. Conservative borrowers choose a lower multiplier and hold more stablecoins with a larger gap tolerance. Aggressive borrowers choose a higher multiplier to preserve more upside potential but take on a larger gap risk.

2. A rebalancing engine adjusts the portfolio as the cushion changes. You can use the LLAMMA approach, attracting arbitrageurs to rebalance for you through quotes, or an explicit network of stewards via batch auctions or settlement methods like CoW to reduce MEV and slippage, based on robust and manipulation-resistant oracle pricing. Rebalancing frequency is a practical parameter, because more frequent rebalancing reduces gap risk but increases volatility-induced erosion – a trade-off that must be calibrated for each collateral asset.

3. You set the floor above the debt rather than at the debt, with a strict liquidation safeguard in between. The reason the floor is higher is that rebalancing swaps are neither instantaneous nor free. Therefore, slippage or fast moves could cause the collateral to drop below the floor before the basket fully converts to USDC. If the floor were the debt itself, such overshoot would fall directly below the debt, creating bad debt. By setting the floor at the debt plus a moderate margin, when the collateral reaches the floor, the basket is already fully de-risked to USDC, and the margin below the debt acts as a protective layer.

4. This range is also where the liquidator incentive lies, because if the collateral price still breaks below the floor after risk reduction, a hard stop mechanism triggers within the range while the collateral price remains above the debt. The liquidator closes the position and receives a reward from the remaining margin. Lenders still get fully compensated, and bad debt only occurs if the price gaps through the floor and falls below the debt. The margin should be moderate, because an excessively high margin would cause risk reduction too early, losing more upside. Therefore, the size of the margin needs to be calibrated based on expected slippage and the magnitude of price gaps for the asset. Additionally, a surplus pool should be funded from a spread charged to borrowers, serving as the on-chain version of the gap risk premium that structured product desks charge to guarantee the floor.

5. Build it according to how this risk structure develops. Start with blue-chip collateral and conservative leverage ratios, so that gap risk is minimal and the floor is most solid. Target capital that wants yield but fears liquidation cliffs: treasuries, DAOs, and more conservative asset allocators. Let asset managers build vaults on top, customizing leverage and collateral strategies according to risk appetite. The TVL here is not speculators chasing numbers, but patient capital that was never willing to accept liquidation cliffs in the first place, finally finding a model it can embrace.

Conclusion

On-chain lending still mostly uses hard liquidations, so a sharp move can liquidate positions that would recover days later.

CPPI loans hold your collateral as a basket of volatile assets and stablecoins, reducing risk as your cushion shrinks, smoothing toward a floor, so the loan glides down instead of crossing a single liquidation line.

The borrower’s risk exposure is determined by the multiplier (m), where Risk Exposure = m × Cushion, and 1/m indicates the gap the borrower can withstand. So, a higher m means higher risk exposure and less gap protection, and vice versa.

Curve’s crvUSD and f(x) have already demonstrated the feasibility of on-chain soft liquidation, and CPPI is a 40-year-old technique in traditional finance. Therefore, the novelty now lies in naming it, advancing it, and putting control in the hands of the borrower.

It is not free, because it introduces volatility erosion, upside loss, and gap risk, still requiring strong liquidation safeguards. So it only changes risk, not eliminates it.

This smoother shape – gliding instead of cliff – is exactly what conservative capital already buys in traditional finance, and it is the real reason for bringing new capital on-chain.

If you plan to go in this direction, or if you think gap risk will kill it, I would love to hear your reasons. This is only a proposal, not a product, and it will be refined through questioning and criticism.