
Essence
The Dual-Oracle Exponential Decay (DOED) Architecture represents a critical architectural response to the volatility-induced systemic risk inherent in fully decentralized margin systems. It is a liquidation mechanism that hybridizes the security of a decentralized, time-delayed on-chain oracle with the speed of a low-latency, off-chain keeper network price feed. This dual-source approach is designed to strike the necessary balance between speed ⎊ required for instantaneous protocol solvency protection ⎊ and fairness, which is essential to prevent oracle manipulation and subsequent bad debt socialization.
The fundamental shift is from a binary liquidation event to a continuous, algorithmically controlled deleveraging process.

Functional Imperatives
The architecture’s design prioritizes two competing functional imperatives. The first is Capital Efficiency , allowing for higher leverage ratios by narrowing the gap between the maintenance margin and the liquidation threshold, which is possible only with a highly reliable and fast liquidation path. The second is Systemic Resilience , achieved by introducing time-friction into the liquidation process itself, making it unprofitable for malicious actors to execute rapid, high-impact oracle attacks that trigger mass liquidations.
The DOED Architecture converts the liquidation cliff ⎊ a discrete, high-risk event ⎊ into a controlled, continuous algorithmic deleveraging slope.
The system treats a margin breach not as a single point of failure but as a transition into a controlled decay state ⎊ a state where the collateral’s effective value, for the purpose of margin calculation, begins to decline exponentially based on a predefined function. This forces the user to confront the insolvency risk over a brief but measurable period, allowing for a controlled exit or collateral top-up.

Origin
The genesis of hybrid liquidation models lies in the painful lessons learned from cascading liquidations during high-volatility events in 2020 and 2021.
Early DeFi derivatives protocols, reliant on single-source, low-latency oracles for speed, became susceptible to flash loan attacks and price manipulation that exploited the short time window between a price update and the liquidation execution. This led to protocols accumulating significant bad debt , which was then covered by a socialized insurance fund or token inflation, imposing costs on all users.

The Liquidation Cliff Problem
The original liquidation design was a liquidation cliff ⎊ a binary, all-or-nothing event. A user’s collateral either maintained solvency or was seized entirely, often with a large penalty fee, creating a high-value target for liquidators. This adversarial environment led to the rise of Maximal Extractable Value (MEV) strategies where liquidators front-ran transactions, causing unnecessary market impact and worsening the debt spiral for the user.
- Single Oracle Reliance: Protocols used one fast oracle, sacrificing robustness for speed, making them targets for price manipulation.
- Instantaneous Seizure: The entire collateral was liquidated in a single transaction, maximizing market impact and slippage.
- Socialized Losses: Insufficient liquidation penalties or a lack of immediate liquidity meant bad debt was passed to the protocol’s insurance fund.
The DOED design emerged from the realization that solvency must be protected by a fast trigger, but the actual market execution of the liquidation must be governed by a price that is robust against short-term manipulation ⎊ a clear split of duties between the two oracle types.

Theory
The theoretical foundation of the DOED Architecture rests on a synthesis of control theory and quantitative finance, specifically by replacing a discrete-time threshold model with a continuous-time decay function. The Exponential Decay Function Veff(t) = Vcoll · e-λ(t-t0) is central, where Veff is the effective value of the collateral for margin calculation, Vcoll is the actual collateral value, t0 is the time of the initial margin breach, and λ is the decay constant, or the liquidation slope.

Protocol Physics and Dual-Oracles
The dual-oracle system functions as a two-stage filter, minimizing false positives and high-impact liquidations. The Secondary Oracle (off-chain, low-latency) acts as the high-pass filter, quickly identifying a potential breach of the Maintenance Margin Threshold (MMT). This is a low-cost, high-speed signal.
The Primary Oracle (on-chain, high-latency TWAP) acts as the low-pass filter, confirming the price trend and governing the actual execution price.
| Oracle Type | Latency | Purpose | Security Model |
|---|---|---|---|
| Primary (TWAP/VWAP) | High (e.g. 30 min) | Liquidation Execution Price | Time-Averaging Robustness |
| Secondary (Signed Feed) | Low (Real-time) | Liquidation Sequence Trigger | Keeper Network Cryptographic Signature |

Quantitative Deleveraging Mechanics
When the Secondary Oracle triggers the breach, the system does not immediately sell collateral. Instead, it begins to calculate the effective margin using the decaying Veff. The λ parameter ⎊ the decay constant ⎊ is critical.
A high λ results in a steep, fast liquidation, prioritizing protocol safety in volatile markets. A low λ results in a gentle, slow deleveraging, prioritizing user capital efficiency in stable markets. The strategic challenge is setting λ based on realized volatility and the protocol’s total system leverage.
The liquidation slope λ acts as a dampening factor, dynamically linking the speed of deleveraging to the system’s prevailing volatility and risk tolerance.
This architecture inherently shifts the focus from a single, high-stakes price point to the time-until-insolvency ⎊ a more manageable risk metric for both the protocol and the user.

Approach
The current implementation of the DOED Architecture involves a three-stage, automated process, transforming the adversarial liquidation into a predictable, internalized service. This approach is grounded in the strategic understanding that liquidity should be preserved and market impact minimized.

The Three-Phase Execution
- Pre-Liquidation Warning and Fee: The Secondary Oracle’s price feed signals the MMT breach. The protocol immediately imposes a small, non-material fee on the position ⎊ a cost of risk ⎊ and sends an event log for off-chain keepers to monitor. This is the user’s final warning before the automated decay begins.
- Algorithmic Decay Initiation: The effective collateral value Veff begins its exponential decline. The user’s margin ratio drops gradually, creating a time window for the user to add collateral. This time-friction is the key defense against rapid oracle exploits.
- Automated Batch Sale: If the user remains underwater after the decay period, the system initiates a series of small, fixed-size sales of collateral (e.g. 0.5% to 1.0% of the total position per batch). These sales are executed against the price provided by the robust, slow-moving Primary Oracle and are often routed through the protocol’s internal liquidity pool or a pre-approved decentralized exchange. This Batch Liquidation minimizes slippage and avoids the large market orders that destabilize prices.

Incentive Alignment
The DOED shifts the liquidator role from a predatory arbitrageur to a Keeper Service Provider. Keepers are not incentivized by a massive, one-time liquidation bonus but by a small, predictable fee on each successful batch sale. This aligns their incentives with the protocol’s stability, preferring consistent, low-impact liquidation volume over sporadic, high-impact events.
| Mechanism | Liquidator Incentive | Systemic Risk | Market Impact |
|---|---|---|---|
| Liquidation Cliff (Legacy) | Large, fixed bonus (5-10%) | High (Front-running, MEV) | High (Single, large order) |
| DOED Batch Sale (Hybrid) | Small, variable fee (0.5-1.5%) per batch | Low (Internalized, time-delayed) | Low (Multiple, small orders) |

Evolution
The path to the DOED Architecture was marked by a series of iterative improvements, moving from simplistic, CEX-like models to complex, on-chain control systems. The first significant evolution was the introduction of Decentralized Liquidation Pools ⎊ a mechanism where liquidators pre-commit capital, reducing the need for on-chain bidding wars and transaction spam. This addressed the MEV problem but still relied on a binary trigger.

From Auction to Algorithm
The critical conceptual leap was the transition from a market-driven liquidation (Dutch Auctions, English Auctions) to a protocol-governed liquidation (Algorithmic Decay). Auctions are inherently adversarial and price-discovering, which is undesirable during a solvency event. The DOED rejects the need for external price discovery during a liquidation; it assumes the TWAP price is sufficient and focuses solely on minimizing the market impact of the necessary sale.
This is a profound shift in thinking ⎊ treating liquidation as a systems engineering problem, not a market problem.
The modern liquidation system treats solvency events as a systems engineering problem ⎊ governing flow and rate ⎊ rather than a market problem requiring price discovery.
The architecture also represents the maturing of Protocol Game Theory. Early designs failed to account for the rational, adversarial behavior of liquidators. The DOED, by distributing the liquidation fee across numerous small batches and linking the execution price to a slow oracle, effectively disincentivizes the high-capital, high-risk attacks, preferring the predictable, low-margin operations of professional keepers.
The resulting stability is a direct consequence of aligning the keeper’s self-interest with the protocol’s health.

Horizon
The future of Hybrid Liquidation Architectures will center on dynamic adaptation and cross-chain coherence. The next iteration of DOED will likely involve Adaptive Liquidation Slopes ⎊ a move beyond a static decay constant λ.
The protocol will utilize on-chain data to calculate a Systemic Risk Index (SRI) , which will feed directly into the decay function.

Dynamic Risk Adjustment
The SRI will be a composite metric, incorporating:
- Protocol Leverage Ratio: The aggregate debt-to-collateral value across all open positions.
- Realized Volatility: The 24-hour historical volatility of the underlying asset.
- Oracle Divergence: The instantaneous spread between the Primary (TWAP) and Secondary (Real-time) oracle prices.
If the SRI is high ⎊ signaling extreme volatility or high system leverage ⎊ the decay constant λ will increase, accelerating the deleveraging process to protect the protocol. If the SRI is low, λ will decrease, providing users with maximum time to manage their positions.

Cross-Chain Solvency Management
The greatest challenge lies in extending this architecture to a multi-chain environment. Liquidation of a position collateralized on one chain but with debt on another requires atomic, verifiable settlement across asynchronous state machines. This necessitates a Liquidation Proof of Solvency (LPS) ⎊ a cryptographic proof generated on the debt chain that is instantly verifiable on the collateral chain, triggering the batch sale. The complexity here involves not just price feeds but the protocol physics of cross-chain message passing and ensuring the entire process remains non-revertible, a genuine frontier of decentralized systems design. The question remains whether the latency of inter-chain communication can ever be low enough to satisfy the demands of high-frequency options liquidation.

Glossary

Crypto Options Derivatives

Maintenance Margin Threshold

Mev-Resistant Design

Decentralized Finance Infrastructure

Systemic Risk

Execution Price

Protocol Solvency Protection

Capital Efficiency Optimization

Cross-Chain Message Passing






