A lending protocol can become insolvent if it values collateral using an execution price that ignores market slippage. In a low-liquidity pool, a leveraged borrow may move the price enough that the acquired collateral is worth less than the debt it creates. The immediate failure is that the loan is authorized on stale economics, leaving the protocol underwater and exposed to loss.
How slippage turns leveraged borrowing into a solvency problem
Slippage is the gap between the price you expect and the price the trade actually clears at. In a leveraged borrow, that gap matters because the protocol is usually relying on the post-trade asset value to justify the debt it is creating. If the borrow itself moves the market, the protocol can lend against a valuation that no longer exists the moment execution completes.
That failure is not just “bad pricing”, it is a broken collateral test. A low-liquidity pool can make the execution price materially worse than the quoted price, so the protocol ends up treating inflated collateral as sufficient backing for a larger liability. Once that happens, the protocol’s accounting, liquidation assumptions, and reserve protection all start from the wrong base.
Protocols that want a concrete control model for this issue should treat execution-price risk as part of IETF-style protocol design discipline, where state changes must remain valid under the conditions in which they execute, not only under ideal quotes.
What actually breaks in the lending logic
The first thing to fail is the invariant that debt remains safely below recoverable value. If the protocol lets a leveraged borrow proceed using a stale or optimistic valuation, then the position may already be underwater at the instant it is created. From there, liquidations may not restore solvency because the asset received in the trade was never worth enough to cover the debt plus fees and market impact.
The second failure is incentive distortion. Borrowers can be unintentionally rewarded for consuming depth in the very pool the protocol depends on, because the protocol is treating a self-induced price move as if it were external market value. That creates a path where the protocol subsidises value extraction rather than enforcing a real collateral threshold.
This is also why execution-aware controls need to be checked against authoritative protocol references such as the IETF Datatracker for standards maturity, and against market integrity assumptions rather than only implementation convenience.
For broader control and audit expectations around borrowing, pricing, and access to protocol functions, practitioners often map the issue to CIS Controls v8 because the core problem is still control failure around safe operation, not just market design.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 5 — Account Management | Borrow execution and valuation need bounded, controlled financial actions. |
| CIS 8 — Audit Log Management | Slippage failures require traceable execution and pricing evidence for post-trade review. | |
| Recommendation — Restrict borrow paths to approved, size-bounded execution rules that preserve solvency margins. Log quoted price, execution price, and resulting collateral ratio for every leveraged borrow. | ||
| NIST CSF 2.0 | PR.AC — Access Control Management | The protocol is authorising debt creation based on a control decision that must remain valid at execution. |
| RC.IM — Improvements | Execution-price failures should feed back into tighter borrowing limits and liquidity checks. | |
| Recommendation — Enforce execution-time approval rules that reflect real market impact before releasing borrowing capacity. Update lending parameters when observed slippage shows current execution assumptions are too weak. | ||
Practitioner Guidance
What to verify: Price the borrow against execution outcomes, not quoted spot price alone. If the protocol cannot bound slippage, it should bound leverage, cap trade size, or refuse execution when liquidity depth is insufficient for the intended borrow path.
Decision rule: If the borrow can move the market enough to change the collateral ratio materially, treat the transaction as a solvency event, not a normal loan origination. The right response is to reduce exposure before you optimize user convenience.
What good looks like: The protocol should be able to prove, before execution, that worst-case price impact still leaves the position safely collateralised after fees, oracle latency, and liquidation haircuts are applied.
Practitioner takeaway: Leveraged borrowing is only safe when the protocol underwrites the executed price, because quoting a position at a price the market cannot actually sustain is how solvency breaks.
Related resources from NHI Mgmt Group
- What breaks when service account ownership is unclear during recovery?
- What breaks when service desk staff are allowed to use judgment during account recovery?
- What breaks when a crypto protocol relies on one compromised signer or admin account?
- What breaks when Keras safe mode fails open during Lambda deserialization?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
