Security, governance & risk

A plain summary of who controls what in Liquidium, what can go wrong, and what you can check yourself. For the engineering details, see Atomicity & WAL and Authentication.

Custody

Liquidium has no company wallet that holds user funds. Supplied assets sit in Liquidium's pool canisters (smart contracts) on the Internet Computer:

• BTC, ETH, USDC, and USDT are held as ckBTC, ckETH, ckUSDC, and ckUSDT. These chain-key assets are minted and redeemed 1:1 by the Internet Computer's ckBTC and ckETH minters, which control the native coins with threshold signatures.
• ICP is held on the ICP ledger.
• Bitcoin for small withdrawals is also held at the BTC Pool's own Bitcoin address, signed with threshold ECDSA, so small withdrawals can be paid out in batches.
• Ethereum deposit and repay addresses are controlled by the Deposit Accounts canister, also with threshold ECDSA.

With threshold signatures, a key is split across the nodes of an Internet Computer subnet. No Liquidium team member holds a private key to these funds.

Your position is tied to your profile. Wallet users authorize withdrawals and borrows by signing a message with their own wallet. Internet Identity users authorize them through their Internet Identity. See Use Liquidium without the app.

Who controls the canisters

Every Liquidium protocol canister listed on Use Liquidium without the app has the same two controllers:

• The Orbit multisig station w6olv-caaaa-aaaag-awjoq-cai. Canister upgrades and admin actions go through it, so no single key can push a change. See Who can upgrade the Liquidium canisters?.
• cpbhu-5iaaa-aaaad-aalta-cai, a status-checker canister that has no controllers of its own and can only read canister status.

The same Orbit station is the only admin of the Lending Canister. You can check both with dfx canister --network ic info <canister-id> and the Lending Canister's get_admins query.

Controllers can change canister code. You are trusting the multisig, and every upgrade it approves, not only the code that runs today.

Admin powers

The admin can:

• Freeze a pool in an emergency. A frozen pool rejects new borrows and withdrawals from that pool. Repayments, supplies, and liquidations keep working, so you can always reduce your debt.
• Pause all new borrowing across the protocol.
• Change pool settings: Max LTV, liquidation threshold, liquidation bonus, protocol liquidation fee, supply and borrow caps, interest rate curve, reserve factor, activation fee, overpayment refund minimum, and same-asset borrowing.
• Add or remove pools.
• Manage admins and the liquidator allowlist, through its role as controller.

A position that was safe can become liquidatable if a liquidation threshold is lowered. Current values are shown on the Insights page.

Prices

Prices come from the Internet Computer's Exchange Rate Canister (XRC, uf6dk-hyaaa-aaaaq-qaaaq-cai), which is controlled by ICP's NNS governance, not from a Liquidium server. The Lending Canister refreshes each asset's price every 30 seconds.

If a price the protocol needs is older than 120 seconds, borrows, withdrawals, and liquidations that depend on it are rejected until a fresh price arrives. Supplies and repayments do not need a price and keep working.

There is no admin method that sets prices on mainnet.

Liquidations

A position can be liquidated once its Health Factor drops below 1.0. A liquidator repays up to 50% of the debt in one asset and receives collateral worth that amount plus the liquidation bonus, minus the protocol's share of the bonus (currently 5% of it). At a Health Factor of 0.975 or lower, up to 100% of that debt can be repaid. See Liquidations.

Anyone can liquidate. Liquidators on Liquidium's allowlist are processed immediately; everyone else waits one extra round of consensus, which gives allowlisted liquidators a head start. Liquidations happen on the Internet Computer and do not wait for Bitcoin or Ethereum blocks.

Audits

Trail of Bits reviewed Liquidium's ICP canisters for cross-chain lending. The review reported 25 findings; 24 are resolved and the remaining one is informational. Read the announcement.

Liquidium's lending canister code is not open source. The Liquidium SDK is public.

To report a security issue, see Does Liquidium have a public bug bounty?.

Main risks

• Smart contract risk. Bugs in Liquidium's canisters, or in a future upgrade, can cause losses.
• Governance risk. The Orbit multisig can upgrade code, freeze pools, and change risk settings.
• Infrastructure risk. Liquidium depends on the Internet Computer, its chain-key minters, and the Exchange Rate Canister.
• Liquidation risk. Prices can move fast. A liquidation can happen as soon as your Health Factor drops below 1.0, with no margin call or grace period.
• Liquidity risk. If most of a pool is borrowed, withdrawals from it can wait until borrowers repay or new supply arrives.

Company

Liquidium is built by the team on the company page. Use of the app is subject to the Terms.