Mint debt against crypto collateral

Overcollateralized vaults issue stablecoin debt; positions liquidate when collateral falls below a safety ratio.

A collateralized debt position (CDP) stablecoin is created when a user locks crypto worth more than the debt they want to issue. The protocol mints the stablecoin against the collateral. If the collateral falls below the configured safety ratio, anyone can liquidate the position by repaying the debt and seizing the collateral at a discount. The peg is held by a mix of arbitrage incentives, direct on-chain redemption, and (in many systems) a Peg Stability Module — a PSM, which exchanges the stablecoin 1:1 against an upstream stablecoin.

The design moves reserve management on-chain and lets anyone inspect the books in real time. That transparency comes with three pinned dependencies: a working oracle, working liquidations, and working governance.

stress: collateral cascade (DAI, Mar 2020)

How it works

The flow, step by step

Crypto collateral
A user deposits ETH, an LST, BTC, or — where allowed — another stablecoin into a vault. The minimum collateral ratio (110% for Liquity v1, 130–175% for most Maker vaults, system-set in Aave V3 for GHO) sets the safety buffer.
Vault / PSM
The user mints stablecoin against the collateral up to the protocol's debt ceiling. Most systems also operate a PSM that swaps an upstream stablecoin (typically USDC) for the new stablecoin at 1:1. That second path tightens the peg in calm markets and imports upstream-stablecoin risk in stressed markets.
Stablecoin minted (or position liquidated)
If collateral breaches the minimum ratio, the vault is liquidated — auctioned (Maker), absorbed by a Stability Pool — the on-chain pool that buys the seized collateral at a discount using deposited stablecoin (Liquity, BOLD) — or soft-arbitraged by an internal AMM (LLAMMA for crvUSD, which continuously rebalances collateral across price bands rather than liquidating at a single threshold). On-chain redemption also lets holders swap the stablecoin for $1 of collateral from the riskiest vault, functioning as a hard price floor.

Tracked examples

Live coins using this design

Decommissioned

Designs that broke and stayed broken

Kava USDX2022-06
Cosmos-native multi-collateral CDP — mint USDX against BTC, XRP, BNB, or KAVA. Peaked at $176M before UST's implosion exposed the design flaw: USDX had on-boarded UST as collateral. The peg cracked to $0.55 and never healed. The textbook example of collateral on-boarding rewriting solvency overnight.
Raft R2023-11
CDP minting R against wstETH and rETH collateral. A smart-contract exploit drained $3.3M in ETH — the hacker netted only ~$1.6M due to a slippage error of their own. Raft halted minting, offered a 42% recovery plan, and was abandoned. Code surface, not collateral, was the failure point.
Prisma mkUSD2024-11
LST-backed CDP that took an $11.6M exploit in March 2024 and never recovered confidence. Governance approved PIP-46 to decommission the protocol — debt ceiling to zero and a PSM-style wind-down. A controlled funeral, but a funeral.
Legacy BOLD2025-02
The first casualty of Liquity v2's own immutability principle. A Stability Pool vulnerability surfaced weeks after launch. The contracts could not be patched, so the team redeployed everything from scratch. Immutable code is a feature until the bug appears.
JPEG'd PUSD2024-06
CDP that minted against NFT collateral. Declined alongside the NFT market itself; the protocol token stopped trading and the project was effectively abandoned. Collateral concentration in an illiquid asset class did exactly what the risk surface predicted.
US Permissionless Dollar2025-12
Over-collateralized stETH CDP exploited via a "Clandestine Proxy In the Middle of Proxy" attack in December 2025, allowing the attacker to mint ~98M fraudulent USPD and drain ~237 stETH. Legitimate supply never exceeded $500K; the proxy admin surface was where the design failed, not the collateral.
YU (Yala)2025-11
BTC-backed CDP that survived its first death — a September 2025 mint-authorization exploit produced 120M unauthorized YU and the team injected $5.5M to claw back the peg. Two months later, runaway borrowing drained all liquidity pools and YU collapsed to $0.44. The mint surface was patched; the bank-run surface was not.

Full obituaries, peak market caps, and post-mortems in the stablecoin cemetery.

Where the design fails

Known failure modes

Liquidation cascade in a fast collateral crash: On 12 March 2020 ("Black Thursday"), ETH fell roughly 50% over a 24-hour window, gas prices spiked above 200 gwei, and Maker's auction-keeper system processed liquidations at near-zero bids because rival keepers could not get transactions confirmed. Per MakerDAO's own post-mortem, the protocol ended up with a shortfall of more than 5.4M DAI and ran a series of debt auctions that minted and sold 20,980 MKR for ~5.3M DAI to recapitalize the system. Liquidation infrastructure is part of the peg, not separate from it.
Oracle failure or manipulation: Liquidations trigger on an oracle price. A stale, manipulated, or single-source price can liquidate solvent positions or let insolvent ones escape. Modern systems use medianizers and circuit breakers; older designs were vulnerable to flash-loan attacks on thin oracles.
Governance and PSM attack surface: A CDP that can on-board new collateral types via governance vote can have its solvency rewritten faster than its risk team can react. PSMs additionally hard-couple the stablecoin to upstream tokens (USDC for DAI, sUSDC/sUSDT for GHO), so any upstream depeg shows up on the CDP's books.
Collateral concentration: Single-asset CDPs (LUSD: 100% ETH; BOLD: WETH + wstETH + rETH only) inherit the concentration risk of that asset. Multi-collateral systems trade that risk for governance complexity.

Variations

Sub-flavors within the archetype

Pure ETH-only CDP: LUSD and BOLD. The simplest, most legible exposure: ETH price falls, redemption activity rises, peg defended at $1 of ETH per token. Immutable code, no governance, no PSM. Single-asset concentration is the price of that simplicity.
Multi-collateral CDP with PSM: DAI/USDS and GHO. The most common modern shape; PSMs make the peg feel tighter in calm markets and import upstream-stablecoin risk during stress. Pharos tracks each PSM coupling as a `mechanism` Dependency Risk.
Soft-liquidation and savings wrappers: crvUSD's LLAMMA continuously arbitrages collateral between paired bands rather than liquidating at one threshold — collateral attrition during chop instead of a one-shot liquidation in a crash. sDAI, sUSDS, and scrvUSD wrap the underlying CDP stablecoin in a savings vault that routes protocol revenue to holders.

What to watch on Pharos

Signals that matter most

01
Active depeg cap on the Safety Score. Severe active depegs hard-cap the grade; for CDPs this is the most common failure mode.
02
Chain tier and oracle dependency in the report card. Non-Ethereum CDP deployments carry an explicit chain-infra penalty on Decentralization.
03
Redemption Backstop route family. CDPs usually show `collateral-redeem` or `psm-swap`. Liquity-style forks expose `liquity-v1` and `liquity-v2-branches` live adapters with on-chain capacity.
04
Dependency Risk via PSMs. DAI ↔ USDC, GHO ↔ USDC/USDT, USDS ↔ USDC are tracked as `mechanism` dependencies — the upstream stablecoin's grade ceilings the CDP's.
05
Governance Quality tier. `immutable-code` (LUSD, BOLD) sits at the top; `dao-governance` (DAI, USDS, GHO, crvUSD) drops a band; `multisig` drops further.
06
Live Reserve view. Systems with live-reserve telemetry (Maker, Liquity v1/v2, GHO, crvUSD) show the 4-hourly vault and PSM composition instead of a quarterly snapshot.

Tracked universe

95 tracked stablecoins in this archetype

See all in the screener

+3 upcoming+1 frozen