Resilience

Three explicit, design-enforced promises: lenders are not exposed to bad debt, borrowers cannot be flash-liquidated, and the lender-side withdrawal buffer is preserved. The promises hold under modeled stress through six concrete mechanisms — a TWAP read from a permanent (LP-burned) market, a 24h grace window, per-block velocity caps, a 50% close factor, a reserve-funded bad-debt absorber, and an automatic per-account borrow cap that activates during high-volatility windows. The reserve, not lenders, is the first-loss capital layer — closer in shape to Aave's Umbrella than to Morpho Vault V2's pro-rata socialization.

Promises to users

The protocol makes three explicit promises:

1. Lenders are not exposed to bad debt. Any shortfall a liquidator cannot recover is absorbed by the protocol reserve. Lenders receive principal plus accrued interest at withdrawal regardless of individual borrower outcomes.
2. Borrowers cannot be flash-liquidated. A position whose health factor crosses 1 has 24 hours of grace before any liquidator can fire. Single-block oracle noise will not take a solvent position.
3. The lender-side liquidity buffer is preserved. The variable rate curve makes 100% utilization deeply unattractive to borrowers, ensuring there is always withdrawable QOM in normal conditions.

The rest of this page is the failure-mode analysis behind those promises.

How bad debt is absorbed — the reserve

The reserve grows from three sources: the borrow-interest reserve factor $\phi = 25\%$, origination fees on every loan, and the protocol's 4 pp share of every liquidation bonus. Each block, the lent fraction of the pool generates interest; the reserve takes its share before lenders are paid. Each new loan contributes its origination fee. Each liquidation contributes its 4 pp protocol share.

Schematically, the reserve $\mathcal R$ moves as

$$\Delta \mathcal R \;=\; \phi \cdot \text{interest paid} \;+\; \text{origination fees} \;+\; b_{\text{reserve}} \cdot \text{liquidation volume} \;-\; \text{absorbed losses}.$$

Until the reserve crosses its target solvency ratio, the protocol enforces a TVL cap that relaxes in tiers as the reserve accumulates. The cap is mechanical, not discretionary — it derives from a target multiple of expected loss given the active risk parameters. The combination ensures the reserve is always sized for modeled bad-debt scenarios with cushion, regardless of growth trajectory.

Scenario A — Sharp collateral drawdown

A 50% drop in ZAP price over a short window puts a large set of Direct loans underwater simultaneously.

Mechanism	What it contributes
30-min TWAP	Time-weighted price softens the trigger velocity. Pool cannot see the spot crash inside one block. Crucially, the underlying market cannot be removed: LP is burned at QomX, no signer committee, no off-chain feed.
24-hour grace period	Top-up window during which $\mathrm{HF}<1$ does not actually liquidate.
Per-block velocity cap ($v = 5\%$)	Caps cascade speed; spreads any wave of liquidations across multiple blocks.
Reserve-funded bad-debt absorption	Any positions that cannot be processed in time have their shortfall absorbed by the reserve, not by lenders.

The combination keeps a sharp drawdown from becoming a liquidation cascade. The velocity cap $v$ caps total liquidated notional per block at $v \cdot D_{\text{pool}}$; combined with the close factor $\theta = 50\%$, a wave of underwater positions necessarily clears across multiple blocks. Bad debt cannot compound faster than the cap allows, and no single keeper can sweep the entire pool in one go.

Scenario B — Oracle manipulation

An attacker tries to manipulate the QomX ZAP/QOM spot to inflate apparent collateral and over-borrow.

The 30-minute TWAP requires sustained dollar-volume on the underlying market over the full window for the average to move. The cost of doing so at the market's depth is well above any meaningful borrow profit — and unlike a typical TWAP, this one can't be subverted by removing the LP, because the LP is burned. The relevant 2024–25 attack class is single-source / shallow-liquidity oracles, which accounted for ≈17% of major DeFi exploits and over 165M USD in disclosed losses — the LP-burn property eliminates the entire LP-removal vector from that class.

Additional protection: an automatic per-account borrow cap activates during high-volatility windows (when the TWAP delta exceeds a configured threshold over 30 minutes), shrinking maximum borrow size while the market is unstable. This is the same mechanism Aave v3 uses for its volatile-tier asset caps, applied dynamically rather than statically.

Scenario C — Smart-contract risk

The lending pool is upgradeable behind a UUPS proxy with admin functions guarded by timelocks and a rapid-pause path for emergencies.

Pre-launch:

• Independent third-party audit before mainnet deployment.
• Source code verified on the QOM block explorer at deployment, under Business Source License 1.1 (the same license used by Aave v4, Morpho, Euler v2, Fluid, Silo, Maple, and Ajna). BUSL-1.1 keeps the source fully readable for users and auditors, while restricting commercial copy-fork-deploy by competitors during the license window; converts to an open license afterward.
• Verified-source links and the deployed bytecode hash will be published on this site at launch.

Post-launch:

• Bug bounty program at launch.
• Pause path can stop new originations within a single block while leaving repays and liquidations open — preserving solvency during an investigation window.

The empirical baseline: access-control bugs accounted for 59% of H1-2025 lending losses ($1.83B), more than oracle and economic-attack losses combined. Mitigation is process — multi-sig discipline, staged upgrades, timelock invariants — not contract logic. The residual risk that no audit can eliminate is acknowledged explicitly in the protocol's risk model rather than papered over.

Scenario D — Bootstrap shortfall

A Bootstrap Loan finishes its lock with debt outstanding because ZAP price or staking emissions tracked below the modeled schedule.

Mechanism	What it contributes
Lien stays open	Position is not released; emissions continue to route to the pool.
.qom as fallback collateral	If continued emissions plus borrower top-up cannot retire the debt, the contract has direct recourse to the .qom itself.
Reserve absorption	Any unrecoverable residual is covered by the reserve, not by lenders.
LTV cushion	Bootstrap LTV is sized so that emissions cover the debt under reasonable assumptions with cushion. The cushion absorbs ordinary noise.

The break-even price for Bootstrap deleveraging (see Bootstrap Loan) is ≈$0.005 — a 97% drawdown from the design point. Above that boundary, the loan retires itself in finite time with no bad-debt exposure.

Scenario E — Liquidator no-show

On smaller ecosystems no liquidator may compete for a particular position before grace closes.

The reserve serves as the backstop liquidator of last resort: when a position passes grace with no keeper, the contract retires the debt against the reserve at the prevailing rate. The protocol absorbs the bonus instead of paying it out — the position closes orderly, lenders are unaffected. This mechanism is functionally equivalent to Liquity v2's stability pool but uses the reserve as the source of pre-deposited capital, avoiding the need to build a separate stability-pool primitive at launch.

Scenario F — Oracle venue persistence

The TWAP reads the ZAP/QOM market on QomX. The LP for that market is burned — its liquidity tokens were sent to a dead address:

• The pool itself can never be removed by the team or any other party.
• Liquidity in the pool can only grow (more LP added) or stay constant; it cannot be withdrawn out from under the protocol.
• The market is permanent for the practical lifetime of QomX as an EVM contract.

This is structurally different from oracles that read a centralized exchange or a market where liquidity can rug at any time. As long as QOM L1 produces a block, the oracle produces a price.

Scenario G — Curator / governance failure

The 2025 lesson from Morpho Vault V2 stress events is that curator vaults without strict withdrawal-cap discipline can break under bank-run conditions even when the underlying markets are healthy. Forge has no curator layer at launch — it is a direct pool, not a vault aggregator. The risk vector is therefore not present in Phase 1. Phase 3's multi-asset listing flow is governed by timelock and listing-fee gating, with isolated-mode default for any asset rated below a defined liquidity threshold — analogous to Aave v3's e-mode isolation.

Compared to peer protocols' bad-debt models

Protocol	Bad-debt absorption	Where Forge lands
Aave v3 (Umbrella)	Slashed staked tokens (stkAAVE/stkAtokens) absorb losses before depositors	Same shape, but funded from reserve factor, not staking
Morpho Vault V2	Pro-rata depreciation across all vault shareholders	Avoided — depositors see clean principal+interest
Compound v3 / Silo / Morpho Blue	Isolated; bad debt stays in the failing market	Single pool at launch; isolation arrives in Phase 3
Liquity v2	Stability pool (pre-deposited stables) instantly offsets bad debt	Reserve-funded analog

The choice of "reserve as first-loss capital" rather than staker-buffer or share-depreciation is deliberate: it keeps the depositor UX maximally simple (no separate token to stake, no rebasing share), while still making bad-debt absorption explicit and bounded.

What is NOT covered

Some risks live outside any lending-protocol design. Listed here so users can size positions accordingly:

• QOM L1 outage or chain halt. No on-chain protocol can solve a stopped chain.
• Counterparty / bridge failure on assets used as collateral. A protocol-level event on a bridged asset that takes the asset to zero produces losses no smart-contract logic can prevent.
• Governance attack on QNS itself (relevant only to Bootstrap Loans). QNS Staking's lien hooks survive most controller-compromise scenarios — the lien holds even if the controller is paused — but a deeper governance attack on QNS could put Bootstrap collateral at risk.

These are inherent to using QOM and its dependent protocols, not specific to Forge.

Solvency framing. For any reserve-funded lending protocol, the reserve is solvency-positive in expectation when its growth rate (as a share of TVL) exceeds the expected annual loss rate. Forge's parameters are chosen so the steady-state ratio sits comfortably above 1×; until the reserve has accumulated to its target, a TVL cap holds the absolute exposure inside the cushion the existing reserve already provides. The cap relaxes mechanically as the reserve grows past each tier's bad-debt-coverage threshold.

caution

Resilience is bounded, not absolute. The reserve is sized for modeled scenarios with cushion. Tail events outside the modeled distribution can still produce loss; the goal is to make those events progressively smaller in expected impact, not to eliminate them.