[ARFC] Revenue-indexed deficit offsets for Umbrella

Summary

Umbrella makes deficit handling explicit and mechanically enforceable. Once a reserve deficit is realized on-chain, the protocol applies a senior, DAO-backed first-loss layer (the deficitOffset) before any impairment is passed through to Umbrella stakers. Conceptually, the deficitOffset is the protocol’s equity buffer: it is the amount of realized loss the DAO is willing to absorb in that reserve before invoking the backstop.

The core issue is not the existence of this equity layer, but its calibration. Today, deficitOffset is not systematically linked to the protocol’s own realized upside from the same liquidation machinery that occasionally generates deficits. This disconnect is notable because liquidation recapture has never been intended as “free revenue” in isolation. Protocol liquidation fees and, more recently, SVR, have always served a dual purpose: they are mechanisms through which the protocol internalizes part of the liquidation surplus, not only to align incentives, but also to strengthen the system’s ability to absorb future losses. In other words, liquidation-linked profitability has always been conceptually part of the protocol’s security and coverage loop; an earnings stream meant to reinforce resilience over time.

This paper proposes a Risk Oracle that updates deficitOffset per reserve as a function of realized liquidation-linked recapture, specifically liquidation protocol fees and SVR, attributed to the debt reserve whose positions are being unwound. The objective is to convert realized liquidation profitability into continuously “earned” first-loss capacity, rather than treating deficitOffset as a static governance parameter that can drift away from the protocol’s actual earnings power and incentive intent.

Motivation

Aave liquidations are often discussed as a pure solvency mechanism, but economically, they function as a decentralized execution engine. The protocol effectively delegates liquidation execution to third parties through a liquidation bonus, and in return, the system obtains two meaningful forms of realized value: protocol-level liquidation fees and value recaptured through SVR. In aggregate, liquidation activity therefore exhibits a familiar risk-return structure: frequent, generally positive cash flows punctuated by rare tail losses when liquidation is incomplete, delayed, or occurs under adverse microstructure.

Umbrella changes the allocation of those tail outcomes. Deficits, once realized, can immediately translate into slashing unless buffered by deficitOffset. Meanwhile, the positive cash flows generated during the same regimes accrue to the DAO treasury. Over time, this can create a skewed payoff profile: the treasury retains most of the “upside” from liquidation activity, while Umbrella participants are positioned as the primary absorbers of the downside from the liquidation tail.

The deficitOffset layer is intended to mitigate exactly this problem by placing an equity buffer ahead of the stakers. But if deficitOffset is not responsive to realized earnings from liquidation activity, it may understate the DAO’s effective capacity to absorb moderate losses, leading to slashing in regimes where the protocol is net-profitable and where a more coherent risk-sharing arrangement would have funded the loss through retained liquidation earnings.

Empirical intuition

The misalignment becomes most visible during stress events, when liquidation volumes surge and the protocol simultaneously experiences both “wins” and “losses.”

During the October 10th, 2025 market dislocation, long-tailed collateralized debt positions produced reserve deficits of approximately $10K in USDT, $22K in USDC, and $18K in WETH, with an aggregate deficit of around $500K across all reserves (primarily CRV and ENS). Over the same period, the DAO generated roughly $1M in liquidation fees and approximately $1M in SVR-related recapture stemming from $180M in aggregate liquidation volume, implying roughly $1.5M in net profit. The system was highly economically profitable, yet the deficits produced exactly the type of realized loss that can mechanically propagate into Umbrella slashing if the deficitOffset buffers are not sized to reflect that profitability. The result is a counterintuitive allocation: the engine generates surplus in aggregate, but the backstop tranche can still be asked to absorb the loss leg of the same regime.

A similar pattern occurred in the BAL crash on February 2nd, 2026, when BAL experienced a rapid price collapse and large fractions of the frozen reserve were offloaded, resulting in a $28K USDC deficit, climbing its currentDeficit value to $51K; just $50K less than the configured Deficit offset. In that same window, BAL-specific liquidations generated roughly $15K in liquidation fees, and aggregate liquidation-linked recapture across recent days with USDC debt was close to $1M. Again, a single volatility regime produced both meaningful realized upside to the DAO and a localized realized loss that can be charged to Umbrella unless adequately buffered.

USDC Deficit Accrual over time

These episodes suggest a general principle: if Umbrella is the mechanism-level absorber of deficits in a given debt reserve, the equity buffer in front of Umbrella should evolve with the realized cash flows generated by liquidating that same debt reserve across regimes. Since the launch of Umbrella, USDC and USDT reserves are effectively responsible for generating 95% of liquidation-related revenue on Ethereum, at $4.9M and $5.9M respectively, or rather $3.3M and $4.2M when adjusting for SVR’s denomination in WETH and the associated collateral assets via liquidationProtocolFee. [grid]

[/grid]

Attribution nuance: multi-debt positions and separating “revenue generation” from “loss realization”

The ambiguous case is a cross-margined borrower with multiple Umbrella-covered debt assets. Consider an account with USDC and WETH debt. Liquidators may repay USDC first because it is operationally cheaper or more liquid to source, while WETH ends up realizing the deficit because collateral continues to decline after the initial liquidation. A naïve fairness argument would suggest that liquidation-linked recapture should be credited to the reserve that ultimately experiences the deficit (here, WETH), since that is the reserve whose backstop capital is eventually impaired.

This quantification intentionally does not implement that mapping. The primary objective is not to allocate revenue according to the realized “loss leg” of a particular liquidation path; it is to systematically reinvest liquidation-derived upside into first-loss capacity using a rule that is observable, stable, and aligned with the mechanism that generated the revenue. The most defensible primitive is the liquidation event itself: liquidation-linked recapture is produced at the moment debt is repaid, and positions are unwound, and that action is parameterized by the debt asset that is being repaid. Crediting revenue to the repaid debt asset, therefore, follows the causal structure of the process that generates the cash flow.

There is also a substantive economic argument for this choice in multi-debt accounts. When a liquidator repays one portion of a debt stack (e.g., USDC), the account’s leverage and liquidation risk are reduced. That reduction is path-dependent: it changes the subsequent evolution of the position under further price moves, and in expectation it reduces the magnitude of future deficits that could otherwise arise across the remaining debt stack. In the USDC/WETH example, the USDC liquidation is not merely “a liquidation that happened before WETH went bad”; it is an intervention that likely prevented worse outcomes by deleveraging earlier. Under that interpretation, it is coherent that liquidation profitability realized through repaying USDC contributes to building USDC’s equity buffer, because USDC liquidations are precisely the actions that systematically reduce insolvency risk and produce protocol revenue in that reserve.

For these reasons, the specification uses a simple, event-driven accounting convention: liquidation-linked recapture is credited to the debt reserve that is repaid in the liquidation event, and reinvestment is expressed as growth in that reserve’s deficitOffset. Deficits, meanwhile, are handled where they occur: reserves that realize deficits consume their offset capacity accordingly.

What deficitOffset should represent in a mature Umbrella design

DeficitOffset is already the correct abstraction: it is a reserve-specific equity tranche that determines how much first loss the DAO absorbs before passing losses to backstop capital. The missing component is the “capital formation” logic. In a well-aligned system, deficitOffset should represent a conservative estimate of the reserve’s accumulated, realized capacity to absorb losses and the capacity directly funded by liquidation-linked earnings during profitable periods.

This proposal reframes deficitOffset as a parameter that should be earned and maintained, rather than merely set. When liquidation activity generates meaningful net revenue for a debt reserve, a portion of that revenue should be converted into additional first-loss capacity for that same reserve. When liquidation revenue is weak, uncertain, or absent, deficitOffset should grow more slowly and remain conservative. This produces an equity layer that is endogenous to realized protocol economics, and therefore better aligned with the actual distribution of risks borne by Umbrella stakers.

Proposed Risk Oracle: revenue-indexed deficitOffset per debt reserve

The oracle continuously tracks realized liquidation-linked revenue and uses it to update deficitOffset per reserve. The accounting stance is intentionally simple: deficitOffset should be derived from a conservative measure of recent realized liquidation earnings, adjusted downward when the DAO actually spends that equity layer to cover deficits.

The revenue inputs are:

Liquidation protocol fees. These are mechanically collected as part of liquidation flows and routed to protocol-controlled accounting. Even if the fee is collected on the collateral side, the economic driver is the liquidation of a debt position. If repaying and unwinding debt in a given reserve systematically generates fee revenue for the protocol, that reserve should accumulate more first-loss capacity ahead of its Umbrella stakers.

SVR revenue. SVR is explicitly a liquidation-adjacent revenue stream that exists because the protocol produces time-sensitive liquidation opportunities and uses oracle infrastructure; absent recapture, that value tends to leak externally. When SVR revenue is realized in liquidation-heavy regimes, it is economically appropriate to treat it as part of the same liquidation-linked earnings base that can fund equity capacity.

The output is expressed in the reserve’s underlying units, consistent with how deficits and slashing are accounted for in Umbrella.

Design and guardrails

The goal is not to maximize deficitOffset with respect to reserve revenue, but to keep it economically defensible and operationally safe. The oracle is intentionally simple: it observes and aggregates realized liquidation-linked revenue attributable to a given reserve, defined as the debt asset being repaid, across two sources: liquidation protocol fees and SVR revenue. It then applies a conservative “reinvestment” factor (e.g., 30%) and uses that to incrementally increase the reserve’s deficitOffset on a periodic schedule.

Importantly, while deficitOffset is expressed in the debt asset’s units, liquidation-linked revenue is realized in different units: liquidation protocol fees are collected from the collateral side of liquidations, and SVR proceeds are realized in WETH regardless of the debt asset that was repaid. Converting these revenue streams into a debt-asset-equivalent buffer can introduce measurement noise and, therefore, requires an optimized valuation scheme. For instance, when aggregating revenue with respect to the current collateral/WETH price, compared to the liquidation-reported collateral/WETH price, underlying revenues in dollar terms are 33% and 29% lower for USDC and USDT, respectively, given the underlying delta risk employed.

The “meaning” of those revenues as future deficit coverage capacity depends on the treasury’s instantaneous risk posture. The DAO does not hold a purely stable-denominated treasury; it holds a mix of stables and volatile assets. As a result, the effective amount of liquidation-linked revenue that can be credibly treated as first-loss capacity for a stable-denominated deficit depends on the delta the treasury is currently running, i.e., how exposed it is to ETH/BTC price moves relative to what is already stable.

For that reason, the oracle does not treat revenue denomination as a simple spot conversion. Instead, it explicitly conditions the credited value of liquidation-linked revenue on the treasury’s current asset distribution by maintaining an effective delta profile in BTC and WETH derived from observed holdings (~0.5). Liquidation-linked revenues are then valued through that lens: the oracle values the portion of revenue that is effectively “stable-equivalent” given the treasury’s current delta, and uses that adjusted amount to drive deficitOffset denomination, and thus growth. This makes the buffer calibration consistent with the DAO’s actual capacity to absorb future deficits under its prevailing balance-sheet exposure, rather than assuming away conversion and mark-to-market risk.

The following plot portrays this effective growth in deficit offset for USDC and USDT subject to the constraints and valuation techniques expressed above:

On the contrary, assets such as WETH and GHO exhibit materially lower effective revenue from liquidation events, and, as such, expected deficit offset growth will be smaller. From GHO’s perspective, the underlying reserve itself is considerably smaller, thus in relative terms the scaling of deficit offset should somewhat align with observed USDC and USDT behavior, while for WETH, the underlying risks stemming from uncorrelated collateralized WETH debt positions are materially smaller than that of USDC and USDT given the absolute demand differences, and alternatively liquidations stemming from hypothetical slashing events can induce considerable effective deficit offset growth in this sense.

Rather than reacting to individual events, the oracle calculates revenue over a rolling window and only applies parameter changes every few days. On-chain constraints provide the primary safety rails: a maximum per-update, per-reserve delta bounds how much deficitOffset can move in a single change, and a timelock/cooldown ensures updates cannot be executed more frequently than the configured interval.

Finally, the mechanism explicitly handles “consumption” of the equity layer. If the DAO ends up covering a realized deficit through the deficitOffset path (i.e., treasury funds are used to repay the offset-layer deficit), the reserve’s deficitOffset is not treated as permanently accumulated. Instead, the parameter reverts (or resets) to a baseline level specified in the associated governance configuration, reflecting the fact that the offset capacity has been utilized and should not be double-counted as continuing first-loss protection.

Why this improves Umbrella’s long-run incentive structure

This mechanism strengthens Umbrella’s economic legibility by tying realized liquidation upside to the equity buffer that sits ahead of stakers. Slashing remains the correct tool for large losses. The improvement is that the protocol’s realized liquidation upside is no longer disconnected from the equity buffer that is explicitly meant to protect stakers from moderate, regime-linked deficits.

Over time, reserves that reliably generate liquidation-linked earnings will mechanically accumulate more first-loss capacity. That makes Umbrella positions in those reserves safer in a principled way: not because risks have disappeared, but because the protocol has consistently generated and retained earnings that can fund first loss. In turn, a stronger, earned equity layer should support more stable participation, improve coverage durability, and reduce the frequency of slashing events that are difficult to justify when the protocol is net-profitable through the same liquidation regimes that produced the deficit.

In short, the oracle converts liquidation profitability into reserve-level capital formation ahead of Umbrella. It aligns the distribution of liquidation “wins” and “losses” with the hierarchy Umbrella already encodes, using a conservative feedback rule that is transparent, auditable, and amenable to governance oversight.

Near-term parameter action

Independent of the long-run oracle policy, current conditions argue for a near-term normalization of deficit offsets on the largest stablecoin debt reserves. Since Umbrella went live, USDC and USDT have been material contributors to protocol revenue through liquidation-linked activity, accounting for 95% of such revenue. Yet the currently configured deficit offsets on these reserves remain relatively low compared to (i) the scale of liquidation-linked revenues they have generated and (ii) the practical role the offset is meant to play as the DAO’s first-loss layer ahead of stakers. In that context, the present configuration risks forcing Umbrella to absorb losses on deficits that are economically small relative to the surplus the protocol has already accumulated from the same liquidation engine.

A pragmatic step is therefore to increase deficit offsets to a higher, more representative level, such that the equity layer meaningfully reflects current protocol earnings capacity and reduces the likelihood of repeated “small-to-mid” slashing episodes in liquidation-heavy regimes. This does not remove slashing as a backstop for severe tail outcomes; it simply ensures that the system’s senior buffer is sized commensurate with the reserve’s demonstrated profitability and the DAO’s balance-sheet intent. Under the revenue quantifications outlined above, that maps naturally to the following concrete offset targets.

Reserve	Instance	Current Deficit Offset	Recommended Deficit Offset
USDC	Ethereum Core	100,000	1,300,000
USDT	Ethereum Core	100,000	1,600,000
WETH	Ethereum Core	50	77
GHO	Ethereum Core	100,000	115,000

In parallel, the DAO should clear the currently outstanding deficits through the offset path via the steward, so that the reserves return to a clean baseline before the oracle-driven regime is introduced. Concretely, this entails covering the following realized deficits:

Reserve	Instance	Current Deficit	Current Deficit ($)
USDT	Ethereum Core	10,134	10,134
USDC	Ethereum Core	51,185	51,185
WETH	Ethereum Core	8.1	18,320
CRV	Ethereum Core	394,356	111,980
ENS	Ethereum Core	5,768	39,400

Once cleared and offsets are raised, the proposed revenue-indexed oracle can operate from a stable reference point, with subsequent offset growth reflecting ongoing realized liquidation-linked revenue and consumption reflecting future deficit-offset usage.

Disclosure

Chaos Labs has not been compensated by any third party for publishing this proposal.

Copyright

Copyright and related rights waived via CC0.