Problem Statement: A Solvency Machine With No Risk Officer
Frames a DeFi lending protocol as four cooperating planes whose joint job is to keep every position over-collateralized without any human credit decision.
Problem statement
Design a decentralized lending and borrowing protocol where users deposit digital assets into pooled markets to earn interest, while other users borrow those assets against posted collateral. The protocol must set interest rates algorithmically from supply and demand, detect under-collateralization from live price feeds, seize and auction collateral through permissionless liquidation when positions become unsafe, and survive violent price crashes without producing bad debt or a global meltdown.
This is not a bank with better software. A bank has credit officers, KYC files, loan covenants, and the ability to call a borrower at 2 a.m. A DeFi lending protocol has none of those. It is an anonymous, permissionless, always-on machine where the borrower can be anyone, the collateral can drop 40% in an hour, and the only enforcement mechanism is code. Solvency therefore rests on exactly three cooperating invariants: over-collateralization at origination, price freshness from oracles, and permissionless liquidation the moment the math flips. If any one of the three fails, the protocol books bad debt and socializes losses across depositors.
Why the problem is distinctive
A centralized exchange can pause withdrawals during a crash. A DeFi lending protocol that pauses carelessly creates a different catastrophe: if liquidation stops while prices keep falling, every marginal position slides into bad debt. The design must therefore separate market progress from solvency enforcement. Deposit, borrow, and withdraw flows may degrade, freeze, or cap; the liquidation path and the price path that feeds it must keep functioning, or fail in a direction that protects depositors.
Public evidence shows the category is real and large. Aave has operated pooled liquidity markets since January 2020 and reached multi-billion dollar TVL across Ethereum plus several L2s; Compound shipped the algorithmic interest-rate cToken model in 2019 and pivoted to the single-borrow-asset Comet architecture in 2022; MakerDAO (now Sky) has run over-collateralized Vaults and liquidation auctions since 2019. These protocols have also produced the industry's most instructive failures: MakerDAO's Black Thursday in March 2020 booked roughly $8.3M of bad debt when liquidations stalled under network congestion, Cream Finance lost about $130M to a flash-loan price manipulation in October 2021, and Euler Finance had $197M exploited in March 2023 through a donation-style attack on its reserve accounting. Every architecture decision below is shaped by those events.
Design assumptions
For capacity planning this answer assumes a mature protocol with $5B total value locked, 200K monthly active wallets, 25K daily active wallets, 250K protocol operations per day on average, and a five-times volatility spike multiplier. Fifteen markets across four chains: Ethereum mainnet, Arbitrum, Optimism, and Base. Unless a number is tied to a published figure, it is a stated design assumption, not a claim about any protocol's private state.
The four architectural planes
- Settlement plane: the on-chain smart contracts. Markets, positions, debt tokens, collateral tokens, interest accrual, and state transitions. Atomic, strongly consistent at block granularity, and the only writer of balances.
- Price plane: oracles. External price feeds, freshness gates, deviation checks, manipulation defenses, and failover policy. The settlement plane never invents a price; it consumes one with a validity envelope.
- Enforcement plane: keepers and liquidators. Off-chain bots that monitor health factors, compete in the mempool, and execute liquidations. The protocol's solvency depends on this plane being permissionless, profitable, and redundant.
- Governance plane: risk parameters, asset listings, caps, upgrades, emergency response. Slow by design, bounded by timelocks, constrained by hard parameter caps, and audited by a security council.
A strong interview answer keeps these planes separate. It lets the governance plane move slowly without weakening enforcement, lets the enforcement plane race without touching settlement correctness, and lets the price plane degrade into a defined stale policy instead of silently feeding bad numbers to liquidation math.
Key Highlights
- •Solvency rests on three invariants: over-collateralization, price freshness, and permissionless liquidation; none may silently fail.
- •Liquidation and price paths must keep working during a crash even if borrow and withdraw flows freeze.
- •Aave, Compound, and MakerDAO provide the operating baseline; Black Thursday, Cream, and Euler define the threat model.
- •Assumed mature scale: $5B TVL, 200K monthly wallets, 250K operations/day, five-times volatility spike.
- •Four planes: settlement (contracts), price (oracles), enforcement (keepers), governance (parameters).
Section Rescue Kit
Buzzwords to use:
Safe statements:
- "I will separate market progress from solvency enforcement: deposits and borrows may degrade, but liquidation and price paths fail closed in favor of depositors."
- "Before drawing boxes, let me name the three invariants whose joint failure creates bad debt."