Hello,
I’ve been reading David Graeber’s ‘Debt’ lately, and it opens by exploring how old and how human debt actually is. It explained debt as a relationship that assumed a future for both lender and borrower. The tab remained open throughout the loan tenure, assuming both parties would be around.
But the modern version of debt has drifted far away from that. On-chain lending makes the contrast look more ridiculous: a loan can be closed out without the borrower’s fault. If your collateral dips and a predetermined price level is crossed, the position is liquidated at a penalty. Ironically, this could happen just a day before the collateral recovers and rises well above the loan level. For being briefly underwater, the borrower is assumed to be insolvent and penalised.
The crypto advocate in me expects blockchains to do much better. In its current form, liquidation defeats the purpose of debt, which was to keep a relationship open through uncertainty rather than slam it shut at the first sign of trouble.
So what would it look like to build a loan that keeps faith with the borrower instead of betting against them? A loan that bends when things get hard rather than breaking?
In today’s guest essay, Jayesh argues that the answer has been sitting in traditional finance for 40 years. He takes a technique called Constant Proportion Portfolio Insurance (CPPI), the same idea behind capital-protected products banks have sold for decades, and maps it onto on-chain lending to produce a loan that defends its own collateral.
It is an honest piece because it offers a solution while remaining clear-eyed about where it can still fail.
On to Jayesh’s story,
Prathik
Most on-chain loans die in the same dull and predictable way, where the collateral falls, a threshold is crossed, a liquidator closes the position at a penalty, and the borrower is left holding the loss on an asset that very often recovers a week later. We have spent five years making the price of credit smarter, and almost none of that energy on the thing that actually wipes people out: the liquidation itself.
I want to propose a different loan structure that borrows a 40-year-old idea from traditional finance called Constant Proportion Portfolio Insurance (CPPI). It produces a loan that defends its own collateral instead of waiting to be liquidated. Curve and f(x) have already shown the instinct works on-chain. What nobody has done yet is name the mechanism for what it is, drive it off the right variable, and hand the borrower the dial that decides its risk.
Let me walk through where lending has been, what this primitive is, the math that makes it work, where it can fail, and how a protocol could actually build it.
Innovation of On-chain Lending
The first generation of on-chain lending was variable rate, and it still anchors the entire category. Compound v2 went live in May 2019. ETHLend, which launched in 2017, rebranded as Aave in 2018, and moved to a pooled liquidity model with Aave V1 in early 2020. Both set the borrowing rate in the same way: algorithmically based on utilisation. When more of the pool is borrowed, the interest rate rises along the interest rate curve, attracting additional supply and discouraging new borrowing. The rate floats for everyone in the pool and updates every block as borrowing demand shifts.
This pooled variable model won decisively and still anchors the largest part of the market today. Aave alone holds around $13 billion in deposits in mid 2026, and Compound, now on its isolated market design called Comet, sits a little above $1 billion. It is worth noting how hard it has been to improve the rate side, even for the established ones. Aave shipped a stable rate borrowing option years ago, then disabled new stable rate borrows in November 2023 after a vulnerability was found in the stable rate logic, and fully deprecated it through governance in 2024. The dominant on-chain lending experience today remains variable rate, and that has barely changed in years.
The current frontier is fixed-rate lending, and this is where most of the recent design talent has gone. Pendle is the clearest example and the category leader, holding around $1.3 billion in mid 2026. It works by splitting a yield-bearing asset into a Principal Token and a Yield Token. The Principal Token behaves like a zero-coupon bond: you buy it at a discount and redeem it at face value at maturity, locking in a fixed yield. In May 2026, Morpho published the Midnight whitepaper, a fixed-rate, fixed-maturity protocol in which lending and borrowing are expressed as the trading of credit and debt units whose payoff is analogous to that of zero-coupon obligations, with offers that do not lock up capital until settlement. Midnight is freshly released and open-sourced, and it squarely signals that serious builders are pointing at the rate.
So it is worth looking at the two axes of innovation side by side. On the axis of what credit costs, we have moved from variable to fixed and built a genuine toolkit along the way. On the axis of what happens when the collateral falls, almost nothing has changed. Since the overwhelming majority of on-chain debt is still protected by hard liquidation, a single line change in price could get your position closed and penalised. This neglected second axis is the gap I care about.
Exceptions that Already Point the Way
Two protocols deserve full credit because they addressed this exact problem before anyone else.
Curve’s crvUSD introduced soft liquidation through a mechanism called LLAMMA - the Lending Liquidating AMM Algorithm. Instead of one liquidation price, your collateral is spread across a set of discrete price bands, anywhere from four to 50 of them, and each band acts as its own small liquidation zone. As the price falls through a band, that band’s collateral is progressively sold into crvUSD. As the price recovers within a band, the crvUSD buys back the collateral. Curve calls this de-liquidation. Arbitrageurs do the actual trading because LLAMMA quotes prices offset from the oracle, making rebalancing against external markets profitable. The position is never slammed shut at a single threshold, and its exposure is instead continuously shifted between the volatile asset and the stablecoin. crvUSD has run real borrowing through this design.
f(x) Protocol does something structurally similar with its Liquidation Brake. When a leveraged position approaches its liquidation price, the protocol burns part of the position’s debt, sells some backing collateral, and pulls the leverage ratio back down. This reduces risk while keeping the user’s directional exposure, rather than closing them out. External keepers monitor positions and trigger the sale when needed. The protocol holds roughly $90 million in mid 2026.
Irrespective of how they describe themselves, both are simply doing portfolio insurance on collateral. They de-risk into a decline and re-risk into a recovery. That is the exact reflex of a strategy traditional finance formalised in the 1980s, and once you see the connection, a cleaner and more general version of the loan falls out.
What is CPPI?
Constant Proportion Portfolio Insurance (CPPI) was developed by Perold in 1986, extended to equities by Black and Jones in 1987, and formalised by Black and Perold in 1992. The idea is simple and is built to protect a floor.
You define a floor, which is the value your portfolio must not fall below. You measure the cushion, which is how far you currently sit above that floor.
Cushion = Portfolio Value - Floor.
You then hold an amount of the risky asset equal to a multiplier times that cushion, and you park the rest in a safe asset.
risky exposure = m × (portfolio value - floor)
The strategy’s behaviour follows from that single line, and it plays out intuitively as markets move. When the cushion is fat, you hold a lot of the risky asset. As losses eat into the cushion, your risky exposure mechanically shrinks toward zero, which moves you into the safe asset before you can breach the floor. When the cushion rebuilds, you lean back into the risky asset. The strategy sells into weakness and buys into strength.
Mapping that same structure onto a loan makes the correspondence exact. The floor sits just above the debt, at the debt plus a small gap margin I size later. That’s because the collateral must never actually fall below the debt, which, if it does, you have a bad debt and a liquidation. The cushion is your collateral value minus the floor, and acts as the safety buffer that every borrower watches. The risky asset is the volatile collateral, ETH or a BTC wrapper or SOL, and the safe asset is a stablecoin. A CPPI loan holds its collateral as a managed basket of the two, and it rebalances that basket as the cushion breathes. As your collateral falls toward the floor, the basket steps out of the volatile asset and into the stablecoin, defending it. As the cushion grows, it steps back into the volatile asset, handing you the upside. What changes is that the ordinary dips that would liquidate a normal position no longer kill this one because it de-risks instead of crossing a single line. The loan fails only if you stop paying interest, miss maturity, or the market gaps so violently that the basket cannot rebalance in time, which is the gap risk at the heart of this design.
The Math and the Numbers
Take the simplest possible example, where your collateral is worth $100, and the loan is $70. Set the gap margin aside for this first pass, so the floor sits at the debt of $70. That makes the cushion $30. Suppose you want to start with your position fully in the volatile asset, so all $100 sits in BTC at origination. That choice sets your multiplier (m).
Risky exposure = m × cushion; so, $100 = m × $30, which means m ≈ 3.33.
In the real design, the floor level sits slightly above the debt. That shrinks the cushion and increases the multiplier required for the same starting exposure. However, the mechanism is identical.
That multiplier is not a cosmetic setting but the entire risk profile of the loan, and it is governed by the well-known gap-risk property of CPPI. It does two jobs at once. First, it sets how much of your collateral starts in the volatile asset, which is m times the cushion, capped at the whole position. Second, it sets the size of the gap you can survive between rebalances, which is 1/m. With m ≈ 3.33, that gap is 30%. So the loan defends its floor against any drop up to 30% that happens gradually enough to rebalance, and it breaks the floor on a gap larger than that before the basket can react. A more conservative borrower who picks m = 2 starts with only 60% in the volatile asset, since exposure is 2 × $30 = $60, allocating the other $40 in stablecoins from the start. This move buys a wider 50% gap tolerance in exchange for upside. An aggressive borrower who picks m = 5 also starts fully in BTC, since 5 × $30 = $150 is capped at the $100 they hold, but the higher multiplier de-risks the basket faster once price slips and tightens its gap tolerance to 1/m, or 20%. This is the primary dial. It is a single, legible number that lets a borrower choose how much downside protection they are buying and how much upside they are forgoing. Later, the floor gives a second dial, for how large a safe reserve to keep. Currently, no on-chain lending protocol exposes either of these.
This is also where I refuse to oversell the idea, because CPPI has a famous and instructive failure mode. The portfolio insurance strategies blamed for amplifying the Black Monday crash on October 19, 1987, were the synthetic put and dynamic hedging programs that sold index futures into the decline, creating a feedback loop. Reputable postmortems, including the Brady Commission, treat portfolio insurance as having amplified the crash rather than caused it.On the day of the crash, portfolio insurers accounted for roughly 40% of all non-market-maker futures sell-off. Strictly speaking, CPPI was not the named culprit, since the 1987 programmes were the option-replication variety. But CPPI shares the same de-risk-into-declines reflex and the same gap risk. The lesson is not that the mechanism is broken. It is that gap risk is real, that you must set the multiplier with respect to how violently the asset can move between rebalances, and that you cannot rebalance through a true discontinuity.
This is live, working machinery in traditional finance
Far from dying in 1987, CPPI is alive and widely used, serving as a standard engine behind capital-protected products. Those products are a large corner of traditional finance, with structured-product sales hitting a record near $1.4 trillion in 2024 by Structured Retail Products’ count. CPPI issuance specifically was making a comeback that year, which makes it a current practice rather than a museum piece.
What matters to us is that traditional finance has spent decades learning to tame CPPI’s gap risk by keeping the multiplier conservative, charging a premium to guarantee the floor, overlaying options on the underlying, and rebalancing often enough to keep the gaps small. That is exactly the toolkit a protocol would inherit, and it is the same gap risk that showed up on-chain, in public, in the protocol that pioneered soft liquidation.
What the Honest Version Costs
If I am proposing this, I owe you the downsides in full, because they are not hypothetical, and there are three of them:
The bleed comes from trading the basket back and forth. Continuously selling the volatile asset on the way down and buying it back on the way up is, mechanically, selling low and buying high, and it erodes value whenever the price chops sideways inside the rebalancing range. Curve documents this directly for crvUSD and is admirably blunt that the loss is hard to quantify because it depends on the number of bands, the speed of the move, and how deep the collateral’s liquidity is. Their own worked example, for a position that spent more than half its life in soft liquidation, shows a loss of 6.37%, and they note that the erosion accrues both on the way down and on the way back up while you are in range. A CPPI loan inherits exactly this convexity cost. You are, in effect, short volatility, and you pay for the floor protection in whipsaw.
Forgone upside follows because a position that de-risks near the bottom and only partially rebuys on the recovery has sold its dip. The borrower trades the chance to ride a full rebound for the certainty of not being liquidated. That is a real trade, and some borrowers will not want it. The sharpest version of this cost is cash lock, the point where the basket has fully de-risked into USDC, and the cushion is zero. So, even a sharp rally cannot rebuild the position, and its upside is frozen. In a perpetual fund, that state is close to permanent, but in a loan, it is an exit ramp rather than a trap. That’s because the borrower can top up collateral to inject fresh cushion and re-risk, or simply sit safely in USDC just above the debt and repay at maturity. A borrower who wants more room can set a higher floor up front, so the locked position parks well above the debt, a choice I come to later.
Gap risk is the one that matters most, and it is the most concrete of the three. Soft liquidation is a buffer, not a guarantee, and crvUSD still maintains a hard liquidation backstop that closes the position if health reaches zero. We saw that on October 10, 2025, when the crash produced roughly $19 billion of liquidations across crypto in a single day, the largest on record. Curve’s CRV long LlamaLend market could not rebalance quickly enough through that gap, leaving it with about $700,000 of bad debt, backed at roughly 70% of stated value. Later, a market-based recovery was proposed in April 2026. This is not a reason to abandon the design, but rather proof that any honest CPPI loan must ship with a hard liquidation backstop and a funded reserve to cover the gap that the math cannot rebalance.
Why this belongs on-chain, and why it can bring fresh capital
The core of the argument turns on shape rather than magnitude, because a CPPI loan does not promise to be safer than holding the bare asset. What it changes instead is the way the risk is shaped. It converts a discontinuous, all-at-once liquidation cliff that’s complete with a penalty, into a continuous, smaller, and more predictable cost that you can see coming and price in advance.
That shape is precisely what risk-averse capital is built to buy. The entire capital-protected product industry exists because a very large pool of money will accept lower expected upside in exchange for a defended floor and no sudden holes. On-chain lending has, so far, offered that pool almost nothing except a liquidation cliff, whereas a loan whose collateral defends its own floor is the on-chain expression of a product structure that this capital already understands and already allocates more than $1 trillion a year toward.
It also widens what you can safely borrow against, because volatile collateral is dangerous in a hard liquidation world where a single wick is fatal. Whereas in a CPPI world, the collateral self-hedges as it approaches the floor, making a long tail of volatile assets more usable as collateral at a given level of lender safety, as long as the multiplier is set with respect to how violently each asset can gap.
How a protocol could actually build this
I would build it as an isolated lending market, in the spirit of the minimal, immutable market designs the category has converged on, with four pieces.
One choice sits above those four pieces: the interest rate. CPPI is independent of how the rate is set, so it can sit on top of either a variable rate or a fixed one, and a variable-rate version is entirely valid and worth building. The version I am proposing pairs it with a fixed rate and a fixed maturity because that completes the one quadrant nobody has built: a loan that is both fixed rate and self-defending. It most closely mirrors the capital-protected products from which this idea borrows.
The collateral is held as a CPPI-managed basket of the volatile asset and a stablecoin, not as pure volatile collateral. The borrower picks the multiplier at origination, which is the product. A conservative borrower picks a low multiplier and starts with more stablecoin and a wider gap tolerance. An aggressive borrower picks a high multiplier, keeping more upside and more gap risk.
A rebalancing engine moves the basket as the cushion changes. You can do this the LLAMMA way, by quoting prices that pay arbitrageurs to rebalance for you, or with an explicit keeper network executing through a batch auction or a CoW-style settlement to blunt MEV and slippage, priced off a robust, manipulation-resistant oracle. Rebalance frequency is a real parameter, since rebalancing more often reduces gap risk but raises the whipsaw bleed, and that tradeoff should be tuned per collateral asset.
You set the floor above the debt rather than on it, and you keep a hard liquidation backstop in the band between them. The floor sits higher because the rebalancing swaps are neither instant nor free. So, a slippage or a fast move can carry the collateral through the floor before the basket has finished converting to USDC, and if the floor were the debt itself, that overshoot would land below the debt and create bad debt directly. By placing the floor at the debt plus a modest margin, the basket is fully de-risked into USDC by the time collateral reaches that floor, and the space down to the debt acts as a protective band.
That band is also where the liquidator incentive lives, because if collateral pierces the floor despite the de-risking, the hard backstop fires inside the band while the collateral still exceeds the debt. So, a liquidator closes the position and takes a bonus from the remaining margin. The lender is still made whole, and bad debt only occurs if price gaps clean through the band below the debt. The margin should be modest, since a wide one de-risks too early and bleeds more upside, so its size is tuned to expected slippage and how violently the asset can gap. You also fund a reserve for residual bad debt from a spread charged to borrowers, which is the on-chain analogue of the gap risk premium that a structured products desk already charges for guaranteeing a floor.
You grow it the way this kind of risk shape wants to grow. Start with blue-chip collateral and conservative multipliers, where gap risk is smallest, and the floor is most defensible. Target the capital that wants yield without a liquidation cliff, which is treasuries, DAOs, and the more conservative end of allocators. Let curators build vaults on top that package multiplier and collateral policies tailored to risk appetites. The TVL story here is not degens chasing a number, but patient capital that was never going to accept a liquidation cliff in the first place, finally being offered a shape it recognises.
TL;DR
On-chain lending is still mostly hard-liquidated, so one sharp wick can close a position that would have recovered days later.
CPPI lending holds your collateral as a basket of the volatile asset and a stablecoin, and de-risks it toward a floor as your cushion shrinks, so the loan glides down instead of crossing a single liquidation line.
The borrower’s dial is the multiplier (m), where risky exposure = m × cushion and 1/m is the gap it can survive. So, a higher m keeps more exposure and less gap protection, and vice versa.
Curve’s crvUSD and f(x) already proved that soft liquidation works on-chain, and CPPI is a 40-year-old technique in traditional finance. So, the new part is naming it, driving it off the cushion, and handing the borrower the dial.
It is not free, since it carries whipsaw bleed, forgone upside, and gap risk that still needs a hard-liquidation backstop, so it reshapes risk rather than removing it.
That smoother shape, a glide instead of a cliff, is exactly what conservative capital already buys in traditional finance, which is the real case for bringing fresh capital on-chain.
If you build in this direction, or you think the gap risk kills it, I want to hear the argument. This is a proposal, not a product, and it gets better by being attacked.
Disclaimer: This piece was first published here.
We will be featuring good writing and writers we love from time to time. If you have recommendations, send them our way.
Token Dispatch is a daily crypto newsletter handpicked and crafted with love by human bots. If you want to reach out to 170,000 subscriber community of the Token Dispatch, you can explore the partnership opportunities with us 🙌
📩 Fill out this form to submit your details and book a meeting with us directly.
Disclaimer: This newsletter contains analysis and opinions of the author. Content is for informational purposes only, not financial advice. Trading crypto involves substantial risk - your capital is at risk. Do your own research.
 |
|