Kadia Lending: risks

Not live yet

Kadia Lending v1 is in development, unaudited and not on mainnet, and not live yet on any network. This page describes the design that will launch. Every figure marked as a launch parameter is illustrative until it’s set before deployment, and can change.

Source: kadia-lending at commit f9c0bdd (f9c0bdd766155fa8afa24e29e0e0cc13508e2d05), with corrections checked by kadia-lending against 66f4aca, with D60 (rs-coins priced at their underlying coin) from 8a94705: docs/specs/economic-model-v1.md (EM v1), docs/specs/lending-v1-architecture.md (Arch), docs/specs/lending-client.md (“Risk disclosures”, with the bridged-coin disclosure from 8a94705) and docs/specs/lending-design.md (LD).

The specification lists its security properties as design intentions, not claims, until verification completes (LD §15).

Everyone

• Unaudited contracts. The contracts aren’t final and haven’t been audited. Bugs can lose funds.
• Governance keys. A guardian group (2 of 5 keys) can pause new supply and new loans for up to 30 days at a time, and an upgrader group (3 of 5 keys) can wind a pool down at once (exits only from then on), or replace the code after 14 days’ notice, until the sunset about two years after launch. A pause never stops lender withdrawals, repayments, adding collateral or liquidations. It does pause new supply, new loans, and removing collateral from a loan that still has debt (EM v1 §8). An upgrade replaces the code itself, which is why it’s public for 14 days before it takes effect: read it in that time (D46, EM v1 §8).
• You trust Ergo consensus and your wallet. Read what your wallet shows before you sign.

Lenders

• Shared collateral risk. A pool’s lenders share the risk of every collateral it accepts. Losses on one collateral are bounded by its debt ceiling, and losses on the bridged coins together by their group ceiling (EM v1 §5, D51).
• A known loss can wait. If a collateral becomes worthless while its price feed still values it, as in a bridge failure, nothing on chain recognises the loss until an upgrade does, and after the sunset nothing will. Until then the pool’s value still counts that debt (EM v1 §5.3, D54).
• First to leave escapes it. Lenders who withdraw first are paid at full value. The lenders who remain take the whole loss when it’s recognised (D17, D54).
• Notices are run windows. An upgrade is announced 14 days before it takes effect. During that time new supply and new loans pause in the pools it touches, and lenders can withdraw only cash that isn’t lent out (EM v1 §8, D54).
• Bad debt. If a loan’s collateral falls faster than it can be liquidated, the reserve absorbs the shortfall first, then every lender’s share value. There’s no insurance and no backstop (EM §7).
• Withdrawals wait for cash. When the pool is fully lent, you wait for repayments or new supply.
• A pool whose asset is priced by a feed depends on that feed. A false low price for the borrowed asset would let every collateral borrow too much at once, and no ceiling short of the whole pool bounds that (EM v1 §5.2).
• How bridged coins are valued. rsBTC, rsETH, rsADA, rsDOGE and rsBNB are valued at the underlying coin’s price (BTC, ETH, ADA, DOGE, BNB), not at the bridged token’s own market price. They carry the bridge’s risk: if the Rosen bridge fails, a bridged coin can lose its value while its price still shows the underlying coin. The oracle’s bridge warning then pauses new loans against it, but the loss isn’t recognised until an upgrade (EM v1 §3.1, §5.3, D60).
• How USE is valued. On mainnet, it will be valued from the Kadia oracle’s USE feed: a fast depeg can still outrun liquidation. On testnet, tUSE is valued at $1: if it trades below $1, loans backed by it can become unrecoverable while still counted healthy, and lenders of the USE pool, who hold USE, bear a fall below $1. USE collateral carries a lower limit and a ceiling on both networks for that reason (EM v1 §3.5, D53).

Borrowers

• Liquidation. If your collateral’s price falls, or the borrowed asset’s price rises, far enough, anyone can liquidate part or all of your loan, and the liquidator takes a bonus from your collateral. See Loan-to-value and liquidation.
• A variable rate. The rate rises when the pool is busy, and it can rise quickly.
• Oracle warnings pause new loans. When a price feed shows a large unconfirmed move, a fast move, a peg or bridge problem, or is out of date, new loans and removing collateral from loans with debt wait. Repaying and adding collateral always work. Liquidations on an out-of-date price are suspended until it’s fresh again (EM v1 §3.6). See The oracle and stale prices.

LP market

• The LP market follows Kadia DEX. Its collateral value depends on the DEX pool’s reserves.
• Launch guards: new LP borrowing is limited while the market builds a track record (LD D18, D40, D44):
  • a debt ceiling;
  • a cap on how much of the DEX pool’s LP can be posted;
  • a minimum pool depth. These limit new loans only. Repaying, adding collateral and liquidation are always open.
• Slower liquidations. Liquidators receive LP tokens and may need time to turn them back into ERG and USE, which is why the LP market’s bonus is higher.

The bridged coins

• The rs-coins depend on Rosen. A bridge failure can leave a coin worthless while a feed still prices the native coin. That’s the “known loss can wait” case above.
• Prices don’t show a bridge failure. Every rs-coin is priced at its underlying coin, whether by a Kadia feed or by cannonQ’s AVL multi-feed, which Kadia binds by its NFT and trusts (LD D39). A broken bridge shows only as the oracle’s peg-or-bridge warning, which stops new loans against that coin but recognises no loss (EM v1 §3.1, §5.3, D60).