MakerDAO Liquidations 2.0

Summary

Liquidations 2.0 (MIP45, "LIQ-2.0") was MakerDAO's ground-up redesign of the auction machinery that sells vault collateral when loans become undercollateralized — the engine that ultimately defends DAI's solvency. It was motivated by the failure of the original English-auction system on "Black Thursday" (March 12–13, 2020), when network congestion and a keeper-capital crunch let bidders win ~$8M of ETH collateral with zero-DAI bids, forcing Maker to mint and auction MKR to cover roughly $4M+ of bad debt. MIP45 was proposed on February 3, 2021, ratified by governance on March 25, 2021, and its activation executive vote went live on April 19, 2021, with collateral types migrated in phases. The Maker Foundation described it as the last major technical contribution the Foundation would hand to the DAO before dissolving. The new system swapped English auctions for falling-price Dutch auctions with instant settlement and flash-loan composability, and it passed its first live stress test — the May 19, 2021 crash — with near-zero losses.

Design (Mechanism)

From English to Dutch. Liquidations 1.x used two-phase ascending English auctions (tend/dent on "Flipper" contracts): keepers had to pre-fund DAI, lock it for the auction duration, and outbid each other over hours. Liquidations 2.0 inverts this: the Dog contract's bark() confiscates an unsafe vault's collateral and kick()s an auction on a per-collateral Clipper contract, which offers the entire lot at a price that starts above market and falls deterministically over time. Any buyer calls take() to buy any amount instantly at the current price — no bidding rounds, no capital lockup.

Price curves (Abacus). Starting price is the (delayed, OSM-fed) oracle price times a buf multiplier (e.g., 1.2 = start 20% above market). The decay path is a pluggable "Abacus" contract: LinearDecrease, StairstepExponentialDecrease, or ExponentialDecrease, tuned per collateral by governance.

Auction resets as oracle defense. If an auction runs longer than tail seconds or the price falls below a cusp fraction of the starting price (e.g., 60%), it must be reset via redo(), re-anchoring to the current oracle price. This bounds how stale or how cheap an auction can get — a direct answer to Black Thursday's zero-bid outcomes.

Keeper incentives. Callers of bark() and redo() earn a flat DAI fee (tip) plus a percentage of the liquidated debt (chip), paid by the protocol — making liquidation-triggering profitable even for small actors, while parameter choice guards against incentive-farming (self-liquidation for rewards).

Circuit breakers. A global Hole and per-collateral hole cap the total DAI of debt that can be in auction simultaneously (tracked by dirt), throttling fire-sale cascades during systemic crashes.

Flash-loan-native settlement. take() accepts an optional callee: collateral is delivered first to an external contract (e.g., a DEX router), which can sell it and return DAI within the same transaction. Anyone can be a keeper with zero starting capital, so the bidder set scales with DEX liquidity rather than with pre-funded keeper balance sheets.

Outcome

Exactly one month after the activation vote, the May 19, 2021 crash (~45% ETH drawdown intraday) provided a live trial: the system settled about $41M of debt across 177 auctions, earned ~$5.1M in liquidation penalties, and incurred only two loss-making auctions totaling ~$12K. Most ETH-A auctions cleared in 30–70 minutes versus the multi-hour, congestion-fragile process of the old system. No repeat of Black Thursday's zero-bid failures occurred. The architecture was audited by ChainSecurity and Quantstamp (April–May 2021), was subsequently tuned via governance (e.g., auction-duration tradeoff debates), and weathered the far larger 2022 deleveraging cycles (UST collapse, 3AC/FTX cascades) without a solvency event. The Dog/Clipper/Abacus design remains the liquidation engine of the protocol through its 2024 rebrand to Sky, and its Dutch-auction-with-resets pattern became a reference design copied across DeFi lending. MIP45 itself is now formally "obsolete" only in the bureaucratic sense (superseded by the MIP102 consolidation), not functionally.

Why it worked

• It removed the capital bottleneck. Flash-loan composability turned "who has pre-funded DAI and a bot" into "who can route to any DEX," massively widening the keeper set precisely when liquidity is scarcest.
• Falling-price auctions fail safe. In an English auction, no bids means the last (possibly zero) bid wins; in a Dutch auction, no takers just means the price keeps falling until it crosses real market demand — and cusp/tail resets stop it from falling into the abyss.
• Explicit incentives with explicit throttles. tip/chip guarantee liquidations get triggered promptly; Hole/hole guarantee they can't all hit the market at once.
• It was battle-scarred design. Every mechanism maps to a specific observed failure from March 2020, then was double-audited and phased in per collateral type.

Limitations and criticisms

The system succeeded at its core mandate, but with caveats:

• Parameter dependence. Safety hinges on governance-set values (buf, cut, step, cusp, Hole, penalty). Mis-tuned decay curves either overpay keepers (value leaks from vault owners) or stall auctions; the forum's "auction duration tradeoffs" debate shows this was contested, not solved.
• Oracle-delay inheritance. Auctions anchor to the OSM's delayed price; in a fast crash the starting price can be materially stale, relying on buf and resets to compensate.
• Residual losses and MEV. Small loss-making auctions still occurred even on May 19, 2021, and instant-settlement Dutch auctions concentrate the purchase decision into a single block, making keeper competition largely a priority-gas/MEV game rather than a price-discovery contest.
• Throughput cap tradeoff. Hole protects markets but queues liquidations; during a deep, sustained crash, deferred auctions could execute at worse prices.

Lessons

• Auctions that require bidders to lock capital in advance are structurally fragile in crises — the moment liquidations spike is the moment keeper capital and blockspace are scarcest. Design so that participation needs liquidity access, not inventory.
• Choose mechanisms by their no-participation failure mode. English auctions degrade to zero-bid theft; Dutch auctions degrade to "wait longer." Assume the worst block conditions, not the average.
• Pay for the actions you need (triggering, resetting) and cap the aggregate you can survive — explicit micro-incentives plus macro circuit breakers beat implicit assumptions that "keepers will show up."
• Postmortem-driven redesign works. Each Black Thursday failure (congestion, capital lockup, stale prices, unbounded fire sales) got a named, testable countermeasure, and the redesign was validated within a month by a real crash.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial hypothesis, not established fact. A modern redesign might attack the two residual weaknesses: MEV capture and parameter brittleness. First, replace the single-taker take() race with a batch-clearing step (e.g., short sealed or frequent-batch windows, or order-flow-auctioned liquidation rights) so the spread between auction price and true market price is competed back to the protocol and vault owners rather than to block builders. Second, make the decay curve endogenous: tie buf and decay rate to realized volatility and onchain liquidity depth (e.g., steeper decay when DEX depth is high, automatic widening of Hole throttles as auctions clear profitably), reducing dependence on slow governance re-tuning. Third, pre-commit backstop liquidity — a Liquity-style stability pool that absorbs the first tranche of any liquidation instantly, with Dutch auctions as the second-line mechanism — would combine instant deterministic clearing for common cases with open-market price discovery for tail events.