97% only works if liquidation does.
Lending at the top of the ladder leaves two points between the moment liquidation starts and the moment the protocol takes a loss. Everything on this page exists to keep positions inside that gap — and to be honest about what is not yet proven.
Nothing here is audited. POTUSFI is a specification, the contracts are skeletons, and the parameters below are targets that no published risk model has validated yet.
- CollateralTier 1 asset
- $100
- Maximum borrow97% LTV
- $97
- Liquidation begins98% LTV
- $98
- Insolvency / bad debt100% LTV
- $100
The $2 between liquidation and insolvency is the entire margin for error.
Competitive liquidation
Independent liquidator bots compete to wind positions down, so no single keeper has to be fast enough alone. Competition is what makes a narrow margin viable at all.
Partial and incremental
A capped share of a position may be closed per block, whoever is calling and however many times. One transaction cannot take the whole position, so a small breach costs a small amount rather than everything.
Real-time, low-latency oracle
At these thresholds latency is the binding risk. Feeds are validated for staleness and adjusted for corporate-action multipliers; a stale price cannot authorise new borrowing, and no collateral is ever seized at a price the oracle will not vouch for. Collateral it cannot price is valued at zero rather than skipped, so one dark feed cannot freeze the rest of a position.
Halt awareness
Equities halt and gap. When an asset is halted, repayment and deposits stay open while new borrowing against it pauses — the protocol does not pretend it can price something that is not trading.
Insurance reserve
Protocol revenue funds a reserve for losses liquidation cannot recover. It stands between a shortfall and the lenders; it cannot conjure money to cover a hole.
Asset and supply caps
Per-asset exposure and supply caps bound how much of the book any single name can become, so one bad listing cannot dominate the protocol.
The ladder, asset by asset
| Asset | Tier | Max LTV | Liquidation | To bad debt |
|---|---|---|---|---|
| SPY | Very liquid | 97% | 98% | 2 pts |
| AAPL | Large cap | 96% | 98% | 2 pts |
| MSFT | Large cap | 96% | 98% | 2 pts |
| AMZN | Large cap | 96% | 98% | 2 pts |
| NVDA | High volatility | 95% | 97% | 3 pts |
| TSLA | Very high volatility | 93% | 96% | 4 pts |
97% is an aggressive protocol ceiling, not a claim of universal safety. The LTV an asset receives is set by its volatility, liquidity, oracle quality and observed liquidation performance.
Who can do what
The guardian can
- Pause borrowing
- Pause new collateral
- Pause borrowing
- Pause a compromised asset
The guardian cannot
- Move pool funds
- Withdraw treasury
- Change governance
- Change ownership
Emergency power is deliberately pause-only. A guardian that can also move value is an admin backdoor with a better name. Privileged changes otherwise queue behind a timelock, with a longer delay for upgrades and issuance policy than routine parameters.
Protocol invariants
The properties that must hold for the system to be solvent. They are intended to be enforced in code and fuzz-tested, not merely asserted here.
Audit status
- Contracts implemented
- No — skeletons only
- Deployed
- No
- Audited
- No
- Published risk model
- No
- Bug bounty
- Not open
- Comet licence review (BUSL-1.1)
- Resolved — now GPL-2.0-or-later
This table will look better over time. Until then it is the accurate one.
Read the technical detail.
The docs cover the risk engine, oracle behaviour, liquidation mechanics and the full invariant list.