How to Build a Lending Protocol: Architecture and Risk Management

Building a lending protocol is one of the most technically complex and highest-stakes projects in DeFi. Aave and Compound have survived years of attacks; many imitators have been exploited within months. This guide covers the architecture and risk decisions that matter most.

Core Components

A lending protocol requires: a Pool contract (manages deposits, borrows, and accounting), an interest rate strategy (algorithm for computing borrow/supply rates), a price oracle (trusted prices for all supported assets), a health factor calculation (determines when positions are liquidatable), and a liquidation executor (mechanism for external liquidators to close undercollateralized positions).

The Collateral Registry

Every supported asset needs a configuration: LTV (Loan-to-Value, e.g., 80% — borrow up to 80% of collateral value), liquidation threshold (e.g., 85% — liquidatable if borrow value exceeds 85% of collateral), liquidation bonus (e.g., 5% — liquidators receive 5% bonus for closing positions), reserve factor (% of interest that goes to protocol treasury), and borrow cap + supply cap (limits on how much can be borrowed/supplied).

Interest Rate Model Design

The standard kink model: define optimal utilization (e.g., 80%). Below optimal: rates increase linearly and slowly. Above optimal: rates increase steeply (the kink). At 100% utilization, borrow rate should be high enough to make it unprofitable to keep the pool fully utilized. The supply rate = borrow rate × utilization × (1 - reserve factor). Parameters: base rate, slope1 (below kink), slope2 (above kink), and optimal utilization.

Liquidation Design

Liquidation is the most security-critical mechanism. Design requirements: fast to execute (positions should be liquidatable before they go insolvent), profitable enough to attract liquidators even during gas spikes, bounded (max liquidation per call to prevent full position liquidation in one transaction). Standard: liquidators repay up to 50% of a position's debt (close factor), receive collateral at a discount equal to the liquidation bonus.

Oracle Risk

Your oracle choice determines your protocol's greatest security risk. Use Chainlink for any asset it covers. Supplement with TWAP circuit breakers (if Chainlink and TWAP deviate by more than X%, pause the affected market). Hard-code oracle freshness checks (reject prices older than 1 hour). Never use a single oracle source for protocol-critical operations.

Asset Listing Risk Management

Each new asset added to a lending protocol is a new risk vector. The asset could be illiquid (hard to liquidate collateral), manipulable (thin oracle market), or have supply mechanics that allow infinite minting. Aave uses an Asset Listing Process with formal risk assessment. Start with a short list of well-understood assets (ETH, WBTC, USDC, USDT). Add new assets with conservative parameters and supply caps. Gradually relax constraints as market conditions are better understood.

Insurance and Bad Debt

All lending protocols eventually accumulate some bad debt — undercollateralized positions that couldn't be liquidated in time. Aave uses a Safety Module: AAVE token stakers backstop the protocol, with up to 30% of their stake slashable to cover shortfalls. Alternative: protocol-owned insurance fund funded by the reserve factor. Design this before launch — discovering you have bad debt with no insurance mechanism is a crisis.