Risk that acts before liquidation, not after
Most DeFi losses are slow and watchable: drift to liquidation, a widening depeg, a lagging oracle. We argue block-time monitoring plus pre-emptive deleverage beats post-hoc liquidation, and map five risk surfaces to their watch-and-act response.
A liquidation is a receipt. By the time it prints, the decision that mattered was already made, blocks earlier, when the position drifted toward a limit and nothing moved it back. Most onchain risk tooling is built around that receipt. It tells you the health factor crossed the line, the oracle diverged, the stablecoin slipped, after the loss is booked. It is a ledger of what already went wrong.
The claim of this post, stated so you can falsify it: the losses that actually destroy DeFi positions are overwhelmingly slow and watchable, drift to a liquidation threshold, a depeg that widens over minutes, an oracle that lags a fast market, and a watcher that reads state every block and acts pre-emptively beats post-hoc liquidation on the only metric that matters: realized drawdown. Not every risk is catchable. But the catchable ones are the expensive ones, and they are catchable precisely because they unfold in observable time.
Why now
The conditions a leveraged position lives inside do not hold still. The yield on a single pool can swing by multiples within a month, and the volatility, funding, and price that drive a hedge move at least as fast. A risk model that samples daily, or that only wakes up when an alert fires, is reading a blurred photograph of a position that is changing block to block.
The other half of the answer is that the work can now run where it belongs. Reading chain state on every new head, recomputing a health factor, and emitting a signed action is exactly the shape of verifiable off-chain compute. The monitoring is continuous and cheap; the action is rare, signed, and auditable. That split, watch always, act seldom, prove both, is what makes pre-emption practical rather than aspirational.
Endogenous vs exogenous: the framing that decides the response
Not all risk is the same kind of object, and the response differs by kind. We split every risk surface into two classes.
Endogenous risk originates inside the position. Leverage drift toward a liquidation threshold, a hedge that has gone off-ratio, a funding bill that quietly compounds. These are continuous and self-caused: they move smoothly, you own both sides of the trade, and you can act on your own position without anyone's permission. Endogenous risk is where pre-emption is strongest. The watcher trims, repays, or resizes before the limit, and the action is fully under your control.
Exogenous risk originates outside the position. An oracle that diverges from true price, a stablecoin that depegs, a bridge that halts, a venue that pauses withdrawals. These are discontinuous and other-caused: they can gap rather than drift, and you cannot fix the dependency, you can only reduce your exposure to it. Here the correct pre-emptive move is not to repair but to de-risk: cut leverage, exit the affected leg, or pause new entries the moment the dependency degrades.
The mistake most tooling makes is treating both classes as the same post-hoc alert. They are not. Endogenous risk wants a corrective action; exogenous risk wants a defensive retreat. The watcher needs both verbs.
Mechanism: watch every block, act before the limit
A Priime watcher runs a tight loop. On each new block it reads the position's live state, collateral, debt, hedge ratio, the relevant oracle prices, the funding rate, the peg of any stablecoin leg. It recomputes the health factor and the hedge delta from that state, not from a cached snapshot. Then it compares against two bands, not one.
The first band is the target: the health factor the position is supposed to sit at, and the delta it is supposed to hold. The second is the act band: a buffer above the liquidation threshold (and above any depeg or divergence tolerance) at which the watcher emits a signed action before the limit is reached. The action is sized to return the position to target, a partial deleverage, a hedge resize, a leg exit, not to the brink. Liquidation thresholds are where someone else acts on you; the act band is where you act on yourself, with margin to spare.
This is the whole difference. Post-hoc liquidation fires at the threshold, at a forced size, at a penalty. Pre-emptive deleverage fires before the threshold, at a chosen size, with no penalty, and it does so because it was watching the drift the entire time, not waiting for the receipt.
The risk-surface mapping below is qualitative and reflects the watcher's design, not a backtest. No drawdown, recovery, or performance figures appear on this surface; the design is the claim, and the live behavior is auditable on-chain.
- Risk-surface table: design mapping of watch signal to act response; event magnitudes are qualitative by design
- Watcher cadence: state is re-read on each new head and recomputed from raw inputs, not a cached feed
- The watcher is a drawdown tool, not a yield tool; acting early costs gas and slippage and adds no return
| Risk surface | Class | Watch signal (every block) | Act before the limit | Failure if you wait |
|---|---|---|---|---|
| Leverage drift | Endogenous | Health factor approaching threshold | Partial deleverage to target HF | Forced liquidation + penalty |
| Hedge off-ratio | Endogenous | Position delta vs target band | Resize short to re-neutralize | Directional P&L leaks in |
| Funding flip | Endogenous | Funding rate sign + magnitude | Trim hedge / rotate venue | Residual goes negative, compounds |
| Stablecoin depeg | Exogenous | Peg deviation widening | Exit the affected leg, de-risk | Mark-to-market gap, bad-debt |
| Oracle divergence | Exogenous | Feed vs reference spread | Pause entries, cut exposure | Liquidated on a wrong price |
| Bridge / venue halt | Exogenous | Liveness + withdrawal status | Stop new exposure to the leg | Capital trapped behind a halt |
The shape of the trade-off
The point of pre-emption is not that drawdowns vanish; they do not. It is that they are shallower and shorter, because the position is trimmed on the way down instead of liquidated at the bottom. Run the same position through the same stress two ways and the divergence is always in the same direction: the watched position has already trimmed when the shock lands, so it sits shallower and climbs back faster, while the unwatched one rides the drawdown to the threshold and books the penalty.
It is worth being precise about what the watcher buys. It does not add yield. What it buys is a tighter drawdown distribution, a smaller worst case and a faster recovery, paid for with the gas and slippage of acting more often. That is a risk trade, not a return trade, and we report it as one. A fast enough shock can still outrun any watcher.
Risk & failure modes
Pre-emption has its own ways of breaking, and hiding them would defeat the point.
Exogenous risk can gap. The clean drawdown story assumes drift. A genuine exogenous shock, a feed that prints a wrong price in a single block, a bridge that halts instantly, can move faster than any block-cadence watcher can act. For those surfaces the watcher's honest job is not to dodge the gap but to have already reduced exposure on the first sign of degradation, so the gap lands on a smaller position. We size the act band for that, and we still cannot promise the gap never catches us.
The watcher itself is a dependency. A monitor that misses blocks, or whose own price source is the one that diverged, is worse than useless. This is why the watcher reads chain state directly, recomputes from raw inputs rather than a single feed, and emits actions that are signed and verifiable rather than trusted. The monitoring is only as good as its liveness and its inputs, and both are part of what a reader should audit.
Acting early has a cost. Every pre-emptive trim is gas plus slippage, and a watcher tuned too tight will churn the position on noise, bleeding the very residual it protects. The act band is a tuned buffer, not a hair-trigger; set it wrong and pre-emption becomes its own drag. The right band is the one that catches drift without reacting to wiggle, and finding it is an ongoing, observable calibration, not a constant.
Verification
The design claims here are checkable. The watcher's cadence is observable: it reads state on each new head, and the blocks it read are on chain. Its actions are signed and land as transactions you can read on the explorer, with the input state that triggered each one reconstructable from the same block it fired on. The risk-surface mapping in the table is a design document, published, not a backtest result dressed as one.
The live behavior is the evidence that matters: every pre-emptive trim lands as a transaction, and position wallets are on-chain. We would rather you audit the trims than trust that the watcher works.
The takeaway
The expensive losses in DeFi are mostly slow enough to watch and act on, and the cheapest improvement available is not a better liquidation engine but moving the decision earlier, into a watcher that reads state every block and trims before the limit instead of after it. Endogenous risk gets a corrective action on your own position; exogenous risk gets a defensive retreat from a dependency you cannot repair. The design aims for a bounded drawdown and a faster recovery, bought with the cost of acting more often, and adding no yield, exactly as a risk tool should. Whether it achieves that in any given regime depends on market conditions and user and partner decisions.
The open question we are testing live: how much of the designed drawdown reduction survives real gas, real slippage, and the genuinely discontinuous shocks that no watcher can fully outrun, at size. A liquidation is a receipt for a decision you did not get to make. The whole point is to make it first.
Put the stack to work.
Priime Pools turns any liquidity pool into a delta-neutral position. Priime Loop runs leveraged carry, hedged every block. Self-custodial, exit any time.