CDP lending: when you borrow from the protocol, not a pool

Our piece on lending aggregation made the general case: on-chain credit is fragmented, and the 1delta API collapses thousands of disjoint markets into one queryable surface. The Midnight piece then poked at the deepest assumption on that surface - that lending happens in a pool - and showed the first market that replaced the pool with an order book.

There is a second, much older way to leave the pool behind: the collateralized debt position, or CDP. It predates pooled lending entirely - MakerDAO's DAI, live since 2017, is the original DeFi lending primitive - and it answers the question "where does the borrowed money come from?" in the most radical way possible: from nowhere. There is no supplier on the other side of your loan. You lock collateral in a position you own and the protocol mints its stablecoin against it.

This article is about what that flip does to lending mechanics, told through the four CDP designs we index: Sky, the original MakerDAO system itself; Liquity V2, the modern reference design, together with its friendly-fork family (USDaf, Felix, Nerite, Quill, Ēnosys Loans, Soneta, Ebisu); River, which carries the older Liquity V1 lineage forward; and Frankencoin, the outlier that runs a CDP without a price oracle at all.

No depositors, no utilization curve

Pooled lending - Aave, Compound, Morpho Blue, Euler - has one substrate: suppliers deposit into a shared pot, borrowers draw from it, and a utilization curve maps how full the pot is to a floating interest rate. Every borrow is funded by someone else's deposit, so the pool must price the tug-of-war between the two sides every block.

A CDP protocol has no pot. Opening a position - Maker calls it a vault, Liquity a trove - means locking collateral and minting brand-new stablecoins as debt. Three things fall out of that immediately:

• Borrow liquidity isn't someone's deposits. Nobody has to supply the borrow asset before you can borrow it. There's no utilization spike when a whale withdraws, and no "pool is 100% drawn" failure mode - supply is bounded only by explicit debt ceilings where a deployment sets them.
• Nothing discovers the interest rate. With no supply-and-demand for deposits, a rate doesn't emerge - someone has to choose it. This is exactly where CDP designs diverge, and the axis along which our four protocols spread out: governance votes it (Sky), each borrower sets their own (Liquity V2), the protocol fixes it (River), or the position's creator hard-codes it and you pay it upfront (Frankencoin).
• The protocol must defend its own peg. Pool lenders hand out assets that already exist; a CDP mints one into existence and now owes the market a mechanism that keeps it at par. Redemptions, swap modules, challenge auctions - this too gets a different answer from every design, and it's a risk surface pooled lending simply doesn't have.

Sky: the original, where the rate is monetary policy

Sky is MakerDAO under its current name, and its Multi-Collateral DAI system is still the reference point every later CDP defined itself against. Its answers to the design questions are the most institutional of the four:

• Markets are collateral and risk tier. Each market - an ilk, in Maker's vocabulary - is a collateral type at one parameter set, and the same collateral appears at several: ETH-A, ETH-B and ETH-C are all ether vaults, differing in minimum collateral ratio and fee, so a borrower picks their own leverage-versus-cost point. Positions are numbered CDPs held through a manager - transferable, and many per wallet.
• Governance votes the rate. The stability fee accrues continuously into the debt like interest, but no market discovers it - MKR/SKY governance sets it per ilk, and uses it openly as a policy lever. Today that policy is striking: fees sit at 8.85-13.98%, far above pooled markets, deliberately priced to move borrowers to the newer venues in Sky's own ecosystem. A CDP's rate can be a steering instrument in a way no utilization curve ever is.
• The peg is held by a swap module, not redemptions. DAI's par value is defended by the PSM - a module holding billions of USDC that anyone can swap against 1:1 in either direction. Arbitrage through the PSM pins the peg tightly, and no borrower's collateral is ever touched to do it: unlike everything in the Liquity lineage, a healthy Maker vault cannot lose collateral to peg defense.
• Liquidations are auctions on a deliberately slow oracle. Collateral prices arrive through an oracle module that delays every update by about an hour - a feature, not a limitation: borrowers can see the liquidating price coming and react before it takes effect. Below the minimum ratio, collateral is sold in Dutch auctions.
• The earn side is the Savings Rate. DAI holders lock into the savings module and earn a governance-set rate funded by protocol revenues - the ancestor of every "savings vault" in DeFi, and yet another number set by vote rather than by a curve.

A note on USDS, Sky's newer stablecoin, because it's easy to assume it comes with new vault machinery: it doesn't. The vaults still mint DAI, and USDS is a second ERC-20 exit on the same ledger - a permissionless, fee-less converter swaps the two 1:1 in either direction, so DAI and USDS are two skins over one balance sheet with an identical peg and backing story. Only the newest modules mint USDS directly.

And that points at the last lesson Sky teaches: read a mature CDP's balance sheet carefully, because the minting has moved. The system reports over $12B of debt, but the overwhelming bulk is protocol plumbing - and the biggest pipe is the allocator system: governance-approved credit lines that mint the stablecoin straight into other venues. The largest, Spark's, has drawn roughly $2.5B of freshly minted USDS into the SparkLend pool - so a borrower taking USDS there receives, at the margin, newly minted stablecoin without ever opening a vault. It's a pool-shaped front door on a mint-backed credit line: the borrower owes the pool at the pool's rate, and Sky's counterparty is the venue, not the borrower. Add the PSM and tokenized real-world assets, and the actual user vault book is a few hundred million - and the two-door rate policy (direct vaults at 8.85-13.98%, the allocator-fed venue far cheaper) is precisely how the original steers borrowers off its own front porch. A CDP's stablecoin supply and its user lending book are different numbers everywhere, and nowhere more so than at the original.

Liquity V2: the modern reference design

Liquity V2 (Ethereum, minting BOLD) is the cleanest statement of the modern CDP - and on the rate question it is Sky's exact opposite: where Maker prices debt by vote, V2 hands the rate to each individual borrower. Its structure:

• One branch per collateral. WETH, wstETH and rETH each get a full, isolated contract set - their own trove registry, price feed, liquidation machinery and Stability Pool. Branch risk parameters differ (roughly 110% minimum collateral ratio for WETH, 120%+ for the LSTs), and a failing branch can be shut down without touching the others.
• Troves are NFTs, and you can have many. A trove is an ERC-721 with its own collateral, debt and health. One wallet can run several troves per branch - a conservative one and an aggressive one, say - which is why we model troves as sub-accounts rather than one position per wallet.
• You set your own interest rate. This is V2's signature move. Every trove carries a borrower-chosen annual rate, adjustable at any time within deployment bounds. Interest accrues continuously into the trove's debt. Why would anyone volunteer to pay more than the minimum? Because of redemptions - more on that in a moment. Borrowers who don't want to manage the rate can delegate it to a batch manager, who charges a small management fee (capped at 10%/yr) on top.
• The fees are few and knowable. An upfront fee on opening and on every debt increase (about seven days of the branch's average interest rate, applied to the new debt), the continuous interest at your chosen rate, and a matching fee if you change your rate within the seven-day cooldown - after the cooldown, rate changes are free. Repaying is free, any time. Closing burns the full live debt and returns all collateral.
• The earn side is the Stability Pool. BOLD holders deposit into a branch's Stability Pool and receive 75% of that branch's borrow interest, paid in BOLD, plus liquidated collateral at a discount when liquidations hit. This is the yield surface a CDP offers instead of a deposit rate - and unlike a pool deposit, it never collateralizes anything.

The result is a borrow market with a strange and interesting shape: the "borrow rate" is not one number but a distribution of self-chosen rates, and the branch's average moves as borrowers reposition.

Redemptions: Liquity's answer to the peg

A protocol that mints its own dollar owes the market an answer to "why is this worth $1?" Liquity's answer is redemption: anyone can hand BOLD to the protocol and receive $1 worth of collateral per token, paid out of live troves at the oracle price. If BOLD trades below par, arbitrageurs buy it, redeem it, and close the gap. It's a hard floor, not vibes.

The crucial - and most misunderstood - property: redemption is not liquidation. Your trove can be redeemed against while perfectly healthy. The redeemed borrower loses collateral and has their debt reduced by the same dollar value - roughly USD-neutral, but their collateral exposure shrinks, which is precisely what a leveraged ETH borrower didn't want.

Who gets redeemed first is where the two Liquity generations split:

• Liquity V2 orders redemptions by interest rate - lowest-rate troves first. Your chosen rate is therefore a bid in a continuous auction for redemption protection: pay more, stand further back in the line. A borrower can watch the "debt in front" of their rate and reposition. This is what turns the user-set rate from a gimmick into a market: the redemption queue prices peg protection.
• The V1 lineage (River today) orders redemptions by collateral ratio - lowest CR first. Protection means holding more collateral, not paying a higher rate.

Redemption is Liquity's answer, though - not the definition of a CDP. Sky holds its peg with the PSM and never touches a healthy vault; Frankencoin, as we'll see, has no redemptions either. When you evaluate a CDP venue, "can a healthy position lose collateral to peg defense?" is a question to ask, not an assumption to carry over.

Two more involuntary events complete the Liquity risk picture. Liquidation hits troves whose collateral ratio falls below the branch minimum: the Stability Pool absorbs the debt and takes the collateral at a penalty (5% in vanilla V2; 10-20% if the pool is empty and the debt is redistributed to other troves), with anything above the penalty returned to the borrower as claimable surplus. And in V2, a redemption that shrinks a trove below the minimum debt (2,000 BOLD on mainnet) puts it in a zombie state - out of the redemption queue entirely until the owner tops it back up or closes it.

The forks: one design, many deployments

Liquity published V2 as a reference implementation with a friendly-fork program, and an ecosystem grew around it. We index seven forks alongside the original - nine deployments, 45 collateral branches, seven chains:

The pattern in that last column is the interesting part. No fork changed the mechanics. User-set rates, rate-ordered redemptions, branch isolation, the Stability Pool split - all of it survives every fork. What forks actually touch is the parameter sheet: minimum debt, collateral ratios, rate bounds, gas compensation, debt caps, the oracle stack, whether contracts are immutable or upgradeable, and which collateral gets wrapped. A fork is a configuration of the design, not a new design.

For an aggregator this is the good kind of fragmentation. Because the write surface is identical, one integration covers the whole family, and each fork is a config row - addresses, deviation parameters, and nothing else. The deviations that do exist (Felix's mutable ratios, Nerite's debt caps that can block a borrow even at healthy collateral, non-standard price-feed scaling on some branches) live in metadata that a generator re-validates against the chain, not in code.

River: the older lineage, still shipping

Not everything CDP-shaped descends from V2. River (the rebranded Satoshi Protocol, minting satUSD on BNB, Base and Hemi) carries the Liquity V1 design forward through the Prisma lineage - and it's a useful contrast, because nearly every axis V2 opened up, V1 had fixed:

• One trove per wallet per market, keyed by address. No NFTs, no trove ids - your address is your position. Simpler, but you can't run a conservative and an aggressive position side by side.
• The protocol sets the rate. Borrowers pay a protocol-set interest rate (currently 0% across River's markets) plus a one-off mint fee on opening and on each debt increase - a base rate that decays with a 12-hour half-life between 0.5% and 5%, spiking when redemption volume spikes. Cheap, predictable, nothing to manage - and no rate market.
• Redemptions are CR-ordered, so the defense is capital, not interest (the right-hand ladder above).
• One Stability Pool per chain backstops every market, rather than one per branch - and with rates at 0% its yield is liquidation gains plus incentive emissions, not interest.
• A global Recovery Mode kicks in if the whole system's collateral ratio drops below 150%: collateral withdrawals pause, debt increases are restricted, and liquidation thresholds tighten. V2 replaced this system-wide brake with per-branch safety modes and shutdown - branch isolation instead of shared fate.

Frankencoin: the CDP with no oracle

Every design so far - Sky's delayed feeds, Liquity's branch price feeds, River's - leans on a price oracle to decide when a position is undercollateralized. Frankencoin (Ethereum, minting ZCHF - pegged to the Swiss franc, not the dollar) asks a heretical question: what if the protocol never learns the price at all?

• Markets are position contracts, cloned permissionlessly. A minter proposes an original position - collateral token, liquidation price, rate premium, reserve contribution, minimum size, expiry - and it stands unless the protocol's governance token holders veto it during a challenge window. Once live, anyone can clone it: the clone inherits the original's terms and becomes your own contract with your own collateral and debt. Listing new collateral requires no committee - just capital willing to stand behind the terms.
• The liquidation price is declared by the owner - and policed by a Dutch-auction challenge game instead of an oracle. Anyone who thinks a declared price is too high posts collateral to challenge it. The owner can avert by buying the challenger's collateral at the declared price - putting money where their price is. Otherwise the auction runs: if bids reach the declared price, the challenge fails; if they fall short, the market has spoken, and the position is liquidated with the challenger earning a 2% reward.
• The consequence is genuinely alien: repaying debt does not protect you. A challenge disputes your price, not your health - it can be filed against a position with almost no debt, and the only defense is lowering the declared price (which reduces how much you can mint). Every health-factor intuition from oracle-based lending quietly breaks here.
• Interest is charged upfront, and positions expire. The rate - a system base rate plus the original's risk premium - is paid at mint time, pro-rata to the position's expiry, and a reserve contribution of 10-40% of the mint is held back (credited when you repay). Mint 1,000 ZCHF face debt and you might receive ~700-900 - the CDP as a discount instrument, closer to a bond than to an open credit line. Past expiry, anyone may buy the collateral at a declining forced-sale price.
• The backstop is equity, and the earn side is a savings module. There are no redemptions; shortfalls are absorbed by the protocol's equity capital (holders of which earn fees for bearing that risk), and ZCHF holders can park in a savings module earning an interest rate funded by the system - Frankencoin's analogue of Sky's Savings Rate.

Four designs, side by side

Read the columns left to right and the design space opens up: from fully governed (Sky) through borrower-priced (V2) and protocol-priced (River) to fully market-policed (Frankencoin). Same primitive - mint against collateral - and almost no shared answers.

Making CDPs comparable to pools

The aggregation question, as always: how does something with no deposits, no utilization and four different rate models land in the same unified surface as an Aave market?

• A market is whatever the protocol's risk unit is; positions are sub-accounts. A Maker ilk, a Liquity branch, a River trove manager and a Frankencoin original each surface as one market record. Under it, a user's positions come back as sub-accounts in the protocol's own currency: Sky's numbered CDPs, V2's trove NFTs, River's single address-keyed trove, Frankencoin's clones - plus dedicated sub-accounts for Stability Pool deposits where those exist.
• The rate card tells the truth. A governance-set stability fee, a self-chosen trove rate with its deployment bounds and branch average, a 0% rate with a decaying mint fee, and an upfront charge to expiry are different objects, and we surface each with its own semantics rather than flattening them into one fake APR. Where the borrow cost is upfront (Frankencoin), face debt and actual proceeds are reported separately - a 1,000 ZCHF mint that pays out ~800 must never quote as free money. Utilization, which doesn't exist, is simply not invented.
• Risk signals keep their meaning. Health factors are computed against the price the protocol acts on - for Sky that means the deliberately delayed oracle price, not the live market price. And where the protocol has no price at all, we say so: a Frankencoin position's health factor is our informational estimate of borrowing capacity, while the real liquidation signal - declared price versus market, and any live challenge - is surfaced alongside it. Pretending those are the same number is how users get hurt.
• The action layer absorbs the sharp edges. CDP writes come with protocol-specific ceremony - insert-position hints for Liquity's rate-ordered trove list, fee guards on anything that charges an upfront or mint fee, repayments clamped above minimum-debt floors, closes that burn the live accrued debt rather than a stale quote, plus the long tail (zombie-trove recovery, liquidation-surplus claims). The API quotes and encodes all of it server-side; a consumer calls open, borrow, repay, close like on any other lender.

Four protocol designs, a dozen deployments, one shape - the same trick as three generations of Aave, applied to a protocol family that has been arguing with itself about rate models since 2017.

Why this matters for builders

CDP borrowing is a genuinely different product, not a variant of pool borrowing - and the four designs are different products from each other. Sky offers deep, governance-priced liquidity with no redemption risk (and, today, rates that make it a migrate-from venue: those borrowers can refinance far cheaper, which is exactly what a cross-lender migration API is for). Liquity V2 offers rate control; River near-zero cost; Frankencoin permissionless collateral and a fixed, prepaid cost. In exchange the borrower takes on each design's own involuntary event: redemption, challenge, or a governance vote that reprices the book. For anyone building borrowing UX, margin, or yield products, that's a rich set of trade-offs worth offering next to pooled markets - and with the whole family surfaced through one API shape, offering it costs one integration, not twelve.

One-sentence takeaway

CDP lending replaces the pool with a mint - no depositors, no utilization, and a set of design questions every protocol must answer for itself - and the four live answers we index (governance-priced Sky, borrower-priced Liquity V2 and its seven forks, protocol-priced River, and oracle-free Frankencoin) all surface through the 1delta API as ordinary markets with sub-account positions.

Where to go next

• API reference - endpoints, response shapes, and x-api-key setup.
• Docs site - supported protocols and network coverage.
• Cross-protocol lending aggregation - the general model CDPs plug into.
• When lending leaves the pool - Morpho Midnight's order book, the other departure from pooled lending.
• How we unify fixed-term lending - the same unification story for fixed-rate, fixed-term markets.