Lending protocols were designed around collateral that trades continuously. Price moves, health factor moves, a liquidator acts, the position closes. Every part of that loop assumes a market is open. Tokenised equities break the assumption in a specific and knowable way, and the designs now going live are built around the break rather than pretending it is not there.
What a 24/5 feed does to a 24/7 market
When Aave V4 opened on Base with seven Coinbase-issued tokenised stocks as collateral, the risk provider's parameter note described the price feeds plainly: they publish from Sunday evening to Friday evening Eastern time and hold the last published value over weekends and market holidays. The lending market does not pause.
Two consequences follow, and they pull in opposite directions. While the feed is frozen, the collateral value cannot move, so a position's health can only deteriorate through interest accrual — a slow, predictable drift. But when the feed resumes, every piece of news that arrived during the closure is priced in one step, and a position that the gap pushes under water becomes liquidatable only at that moment.
In practice the first opportunity to liquidate a position that deteriorated on a Friday afternoon is the Sunday evening reopen, and the first opportunity to hedge the seized collateral in a deep book is the Monday open. The liquidator carries the asset across that gap, which is why the liquidation bonus in such a market is sized on the cost of the exit path rather than on volatility alone.
The design response in that market was to restrict what can be done rather than to model the gap away: the equities are collateral only and cannot be borrowed, a single stablecoin is the only borrowable asset, and suppliers who want the exposure opt into a separate hub rather than carrying it inside the general market.
Why liquidation parameters fail in the conditions they exist for
Close factors and bonuses are usually set against historical depth — how much could be sold, at what slippage, based on how the book has behaved. The problem is that depth thins exactly when liquidations are needed, and it thins faster than governance adjusts parameters. When the bonus no longer covers the liquidator's cost, liquidators simply decline to act, and the position stops being somebody's opportunity and becomes protocol loss.
Dynamic parameters that respond to measured depth exist and are used by a minority of protocols. The rest rely on governance reacting within hours, which has repeatedly not happened — and a market whose safety depends on a vote completing over a weekend has a weekend-shaped hole in it.
What to establish before supplying into such a market
| Question | What a good answer looks like |
|---|---|
| When does the price feed publish, and what happens when it does not? | Stated hours, an explicit hold behaviour, and parameters sized around it |
| Can the collateral be borrowed as well as supplied? | Collateral-only removes a whole class of reflexive failure |
| Is the exposure ring-fenced? | A separate hub or market means suppliers opt in deliberately |
| How is the liquidation bonus derived? | From the cost of each exit path a liquidator can actually take |
| Do caps and parameters move automatically? | A cooldown measured in hours beats a governance vote measured in days |
| What happens during a corporate action? | A stated pause on the affected reserve, not an assumption that nothing happens |
Portfolio-wide collateral changes the shape of the failure
Consumer products are moving the same way. A protocol that rebuilt its application around borrowing against the whole portfolio rather than a single asset removed the usual reason retail users sell at the wrong moment — raising cash no longer requires unwinding a position. The other half of that sentence is less advertised: a liquidation event is then portfolio-wide rather than confined to one collateral type.
Neither property is a defect. They are a trade, and the trade is only visible to someone who has read how liquidation works in that particular market rather than assuming it works the way it did in the last one.
The oracle is usually outside the audit
Most large losses on audited code this year involved an interaction outside the reviewed scope, and oracle behaviour under illiquidity is top of that list — correct code fed a manipulated price. Scope is negotiated on price: a protocol paying for two weeks of review on four contracts gets exactly that, and the report says so on page one.
Which makes the price feed an item to check separately rather than something covered by the badge. Whose feed is it, at what deviation threshold and heartbeat, what does it do when the market is shut, and is a cap applied to the stablecoin side as well as the volatile one.
Questions
- Can a position be liquidated while the stock market is closed?
- Yes. The lending market runs continuously even when the feed is frozen, so a position can cross the threshold through interest accrual and be liquidated at any hour. What cannot happen during the closure is a change in the collateral's price.
- What is the risk of a 24/5 price feed?
- That information arrives while the feed is held and is priced in a single step at the reopen. A position that deteriorated on a Friday afternoon first becomes liquidatable on Sunday evening, and the liquidator cannot hedge in a deep book until Monday.
- Why do liquidations fail exactly when they are needed?
- Because close factors and bonuses are calibrated against historical depth, and depth thins faster than parameters adjust. When the bonus stops covering the liquidator's cost they decline to act, and the shortfall becomes protocol loss rather than somebody's profit.
- Does an audit cover the price feed?
- Usually not. Oracle behaviour under illiquidity is one of the interactions that most often sits outside a reviewed scope, which is why most large losses on audited code involve correct code fed a bad price.