Liquidation Without Loss: A Live-Book Decomposition of Aave v3

In a looped DeFi lending book, the figure a stress test flags as "at-risk" is liquidationeligible debt, and it is separated from the protocol's protocol bad debt by two distinct gaps that we measure separately. First, eligible debt is not executed volume: under a partial close factor a position is liquidated in parts and re-buffers, so at a 5% de-peg the $1.36B of eligible debt in the live loop cluster produces about $0.69B of executed repayment and $0.72B of seized collateral, not $1.36B of selling. Second, executed volume is not protocol bad debt: a loop is liquidated under the parameters of the mode it is held in, and when its liquidation threshold and bonus satisfy LT (1+b) < 1, a loop that crosses HF = 1 on a continuous price path is removed while its collateral still covers the bonus-grossed debt, so the protocol books no bad debt at any de-peg depth. Aave v3 satisfies this invariant in every e-mode category: the ETH-correlated category that carries the liquid-staking loops is LT 0.95 with a 1% liquidation bonus (the category bonus, read from the Pool contract, not the 6% wstETH reserve bonus), giving LT (1+b) = 0.9595; reaching the loss-on-crossing regime would require a bonus above 5.26%, five times what Aave sets, and all eight live e-mode categories carry a comparable margin. On one live Aave-v3 Ethereum block (17,419 borrowers, $6.5B debt), a 5% de-peg of the liquid-staking slice therefore flags $1.38B as liquidation-eligible while the continuous-path protocol bad debt is $0 (the pure-loop core carries $1.36B of that eligible debt at $0 bad debt; the 1.76% mixed-collateral remainder is discussed in the body). This $0 is not an empirical robustness finding but a consequence of the LT (1+b) < 1 invariant on an unbroken continuous path (a loop removed at its solvent crossing books nothing at any glide depth), so the load-bearing risk analysis is the boundary D * and the channels that break the path, below, not the depth of the de-peg. We characterize the boundary in closed form, D * = max 1-1/HF 0 , 1-(1+b)LT /HF 0 , matched to a cascade engine to one grid step; for the live e-mode anchor D * = 7.4%, and its median across the live slice is 6.9% (8.8% debt-weighted). Protocol bad debt appears only when something breaks the continuous path, and we size each channel on the live cluster: a discrete price gap (a jump no liquidator can step through) books $0.1M at a 5% gap but $47M at 10%; partial liquidation into a finite $2B pool books $3.0M at a 5% gap where full liquidation books $0; measured June-2022 oracle staleness adds up to $5M at an 8% gap; and secondary-market depth sets the magnitude past the boundary ($30M at infinite depth rising to $0.70B at a $1B pool for a 15% gap). A reflexive de-peg, in which the forced selling moves the peg itself, runs the peg to near-total collapse with the redemption queue frozen, yet still books $0 because the loops exit solvent as the peg runs away; a live withdrawal backstop is the control, not the threshold. Three real episodes are consistent with the invariant: pre-event Aave-v2 stETH/WETH (−6.8%) and the March-2023 USDC pin both reconstruct to $0, and the March-2026 Aave CAPO event liquidated ≈$26M of wstETH e-mode with no protocol bad debt. We are precise throughout that zero protocol bad debt is not zero economic cost: the same episodes transfer value to liquidators (the bonus), impose losses on the liquidated borrowers, and can trigger DAO compensation; our claim is about the protocol’s balance sheet, not borrower or third-party welfare. The operative controls are therefore oracle-deviation and heartbeat bounds, supply caps, and the withdrawal backstop, not the liquidation threshold. The directional-crash overstatement (6.53× at −5%) is a netting convention, not book risk. We formalize a mechanism recent Aave e-mode liquidations have already shown in the wild, not claim to discover it.