The Dai Stablecoin System
Executive summary
Christensen's 2017 whitepaper is the foundational document of decentralised stablecoin design. It introduced the over-collateralised CDP (collateralised debt position) mechanism, the dual-token system (Dai as the stable asset, MKR as the recapitalisation backstop), and the global-settlement and emergency-shutdown procedures that have appeared in every credible decentralised-stablecoin design since. The paper is conservatively right about most things and quietly wrong about a few that proved load-bearing. Multi-Collateral Dai shipped in 2019, the system survived Black Thursday in March 2020 with bruises but no total failure, and Dai grew to become the second-largest decentralised stablecoin by 2026. DI rates the paper a nine on category-defining influence and a six on robustness of formal analysis; the ideas are correct, the rigor is more typical of 2017 ICO-era documentation than the seriousness the system would eventually require.
Background and motivation
By 2017, the stablecoin landscape was bifurcated between centralised dollar-backed designs (Tether, with its perpetual reserve-quality questions) and a sparse academic literature on algorithmic alternatives. Robert Sams's 2014 'A Note on Cryptocurrency Stabilisation: Seigniorage Shares' had sketched an algorithmic mechanism using a two-token system, but no implementation had survived stress. NuBits, BitUSD, and other early efforts had launched and depegged. The landscape made decentralised stablecoins look unsolvable. Christensen's contribution was to step away from algorithmic seigniorage-shares designs and instead borrow from traditional finance: over-collateralisation, akin to a margin loan or repo agreement. The CDP mechanism is, mechanically, a margined long position on the underlying collateral, with the loan denominated in dollars and rolled forward by a stability fee. The paper's framing is unusual for the 2017 ICO era. It does not promise revolution or yield. It frames a specific technical problem — how to issue a dollar-pegged decentralised credit instrument with hard collateral — and proposes a specific mechanism. The lineage is clearer in retrospect: Bitshares' BitUSD had attempted something similar in 2014 but with liquidation parameters that produced cascading failures; Christensen's design hardened those parameters with overcollateralisation (initially 150%) and added a recapitalisation mechanism via MKR dilution. The 2017 context also matters because Ethereum was the only viable smart-contract platform — Cardano, Solana, Polkadot were not yet live — and the paper assumes Ethereum settlement throughout. The paper's economic model section is the most ambitious passage and the one that has aged most variably. It discusses TRFM (target-rate feedback mechanism) as the primary peg-defense tool, with stability fees adjusted in response to Dai's market price. TRFM was removed from the spec early in the system's life, partly because manual governance proved more flexible and partly because reflexivity around rate-driven peg correction was harder than the paper anticipated.
Core technical contributions
The CDP architecture is the paper's central contribution and has aged remarkably well. A user deposits collateral (initially ETH only, later WBTC, USDC, RWA, etc.), specifies a draw amount in Dai, and receives Dai as a freshly-minted obligation. The collateralisation ratio (deposited collateral value / outstanding Dai) must remain above a per-collateral liquidation threshold (Liquidation Ratio, originally 150%); if it falls below, the position is liquidated by a keeper who buys the collateral at auction. The mechanism is conceptually a margin loan with auctioned liquidation, but implementing it on-chain required novel infrastructure: oracle price feeds (the Medianizer module), a keeper market for liquidations, and stability-fee accrual that does not require active maintenance from CDP holders. The dual-token design pairs Dai with MKR. MKR holders govern parameters (which collateral types are eligible, what stability fees apply, what liquidation ratios bind) and receive system revenue via stability-fee payments which are used to burn MKR (deflationary token model). When the system has bad debt — a CDP is liquidated below outstanding Dai — MKR is minted and auctioned to recapitalise. This makes MKR the equity tranche of the protocol: it absorbs first-loss in exchange for cash-flow rights on stability fees. Liquidation auctions are described in two forms: collateral auctions (forward auctions, keepers bid Dai for the seized collateral) and debt auctions (reverse auctions, keepers bid the smallest amount of newly-minted MKR to receive system Dai used to pay off bad debt). The auction designs are sketched in the paper; the actual implementations evolved substantially across MakerDAO's history (Liquidations 2.0, deployed 2021, replaced English-style auctions with a Dutch-style stair-step mechanism after Black Thursday revealed flaws in the original).
Methodology and rigor
The paper is best characterised as a thorough engineering specification rather than a formal mechanism-design paper. Mechanisms are described with sufficient precision for implementation, but security properties are stated rather than proven, and stress-test scenarios are illustrative rather than exhaustive. The collateralisation buffer (150% ratio) is justified by intuition rather than VaR or worst-case-drawdown analysis. The auction mechanism is described in plain English, with English-style ascending bids assumed; the actual auction-theory literature on optimal liquidation auctions is not engaged. The TRFM section asserts that stability fees can adjust to keep Dai pegged but does not model the reflexive dynamics that arise when fees affect collateral demand which affects collateral price which affects collateral ratios. These are real reflexivity loops that the system would later encounter. Where the paper is rigorous is in failure-mode enumeration. Section 7 (Risks and Mitigation) is genuinely thoughtful: it walks through oracle failure, keeper market failure, MKR dilution attacks, governance attacks, and global-settlement triggers in a way that few 2017 whitepapers attempted. The Global Settlement procedure — a designed-in 'graceful shutdown' that lets Dai holders redeem at the prevailing oracle price — is unusually responsible for an early-stage protocol design. Most projects of the era assumed perpetual operation; Christensen designed for the case where the system needs to wind down. The empirical methodology is essentially nil — the paper was published before mainnet — and the assumptions about ETH as collateral were optimistic about volatility and pessimistic about governance friction. Both gaps would matter.
Strengths
The CDP primitive's most enduring strength is composability. CDPs work as an on-chain primitive that other protocols can build on top of: yield-bearing Dai (sDAI, 2023) is built on the same CDP machinery; institutional Dai partners (Maple Finance, BlockTower) interact with CDP-style vaults; flash-mint Dai (introduced 2021) is a CDP variant. The fact that Dai exists as a fungible ERC-20 separate from its issuance mechanism — unlike, say, Synthetix's sUSD which has fluctuated with debt-pool dynamics — means downstream integration is essentially friction-free. The dual-token MKR/Dai design correctly separates the price-stable instrument from the recapitalisation backstop, allowing each to be priced and held by users with different risk tolerances. This separation is now standard (Liquity's LQTY and LUSD, Frax's FXS and FRAX, Synthetix's SNX and sUSD) but Maker shipped it first in a generalised CDP form. The Global Settlement design has been validated by multiple emergency events without ever being triggered: the system has come close (Black Thursday 2020) but the failure-mode enumeration and graceful-shutdown infrastructure made every governance decision under stress easier. Not having to invent the emergency-response mechanism during the emergency was a critical advantage. The paper's conservatism is itself a strength. By starting with single-collateral ETH-only Dai (called SAI later), the team kept the initial deployment simple enough to debug. Multi-collateral Dai launched in 2019 only after SAI had proven itself. This staged rollout is now considered best practice in DeFi but was unusual in 2017.
Weaknesses and limitations
The paper's weaknesses are largely the weaknesses of its era. Oracle dependency is acknowledged but not deeply analysed; the system's reliance on a small set of price oracles (later expanded to Chainlink) is a concentration risk that the original paper underweights. Black Thursday (March 12, 2020) revealed the depth of this issue: Ethereum congestion caused oracle price feeds to lag, keepers could not access auctions due to gas-price spikes, and zero-bid auctions occurred in which keepers acquired collateral for essentially free. The paper's auction design assumed efficient keeper markets and bounded gas costs; both assumptions broke under genuine stress. Liquidations 2.0, deployed 2021, was a major redesign in response. Second, the TRFM mechanism never worked well in practice and was effectively retired. The paper's central peg-defense story relied on TRFM, but governance manual-adjustment of stability fees, plus DSR (Dai Savings Rate) introduced in 2019, became the actual peg-defense tools. The paper anticipated neither of these. Third, the collateral-quality question is essentially absent. Section 3 lists 'high-quality collateral' as a system requirement but offers no formal framework for what 'high-quality' means or how to measure it. The eventual addition of USDC as collateral (post-Black Thursday) was a major centralisation step — 50%+ of Dai backing has at times been USDC-derived — and the paper provides no framework for evaluating that tradeoff. The Endgame Plan (2022) and SkyMaker rebrand (2024) are tacit acknowledgments that the original collateral framework needed substantial extension. Fourth, governance economics are only sketched. The paper assumes MKR holders will govern responsibly because they bear first-loss; in practice, governance has had episodes of low participation, contentious votes, and concentration concerns. The recent transition to subDAOs and SKY/USDS is a multi-year governance redesign that the original paper did not foresee.
Subsequent influence
The Maker whitepaper is the most influential single document in stablecoin design. Liquity (2021) is essentially Maker without governance — the same CDP primitive with a fixed liquidation ratio and no MKR-style equity token. Reflexer's RAI (2021) is Maker with a floating peg. Frax v3's transition to RWA-backed design borrows the CDP-vault pattern. Synthetix's debt-pool design takes the dual-token idea further. Outside Ethereum, Solana's UXD and Cosmos's Kava run CDP-style stablecoin protocols whose intellectual debt to Maker is direct. Beyond stablecoin design, Maker's governance and risk-parameter framework — 'how to run a protocol with adjustable parameters under decentralised governance' — has been studied as a model for every parameterised DeFi protocol since. Aave's risk parameters, Compound's interest-rate models, even Uniswap's fee tiers all bear traces of Maker's parameter-governance pattern. The Liquidations 2.0 redesign introduced Dutch-auction liquidation as a standard pattern that has propagated to Aave V3, Compound III, and other lending protocols. The protocol-owned-vault pattern that emerged from Maker's RWA Allocator Vault structure has been imitated by Frax (AMOs), Curve (crvUSD's PSM), and the broader 'stablecoin-issuer-as-balance-sheet' framing that defines 2024-2026 stablecoin design. Beyond mechanism, Maker has been the canonical reference for 'is this stablecoin really decentralised' debates. The paper's original framing (decentralised, on-chain, hard-collateral) and the system's gradual drift (RWA, USDC backing, regulatory arbitrage) is a multi-year case study in the practical limits of full decentralisation.
How it holds up in 2026
Nine years on, the Maker whitepaper holds up better as a category-defining document than as an operating manual. The CDP primitive remains canonical; the dual-token model remains standard; the global-settlement design remains a model for responsible protocol design. But the actual operating system (Dai/Sky/USDS in 2026) has diverged substantially from the paper's design intent. RWA backing is a majority of collateral. SubDAO governance has fragmented decision-making. The Sky rebrand and SKY/USDS token migration represent a strategic pivot toward hybrid centralised-decentralised operation that the original paper would not have anticipated. The system's survival through 2018 ETH crash, Black Thursday 2020, FTX contagion 2022, USDC depeg 2023, and ongoing macro stress is empirical validation of the resilience of the core CDP design — an unusually strong real-world test of any 2017 whitepaper. Dai's market cap stability, in the $4-7B range across the 2022-2026 window, is below the original ambitions but is durable. DI's holistic assessment: a category-defining paper whose ideas are sound, whose implementation has been incrementally hardened across multiple major stress events, and whose strategic evolution into the Sky/USDS form is partly a vindication of Christensen's framework and partly a tacit acknowledgment that pure on-chain decentralisation is a more costly position than the paper assumed. The CDP primitive has aged as well as Bitcoin's longest-chain rule; the ecosystem of governance and collateral choices around it has aged less well. Foundational by every meaningful measure, with caveats about the gap between design intent and operating reality.
Strengths
- CDP primitive composes cleanly with downstream protocols and has aged as a canonical design
- Dual-token MKR/Dai separation correctly priced first-loss equity from price-stable instrument
- Global Settlement mechanism designed responsibly and validated by multiple near-emergencies
- Conservative single-collateral rollout (SAI before MCD) became DeFi best practice
- Failure-mode enumeration in Section 7 unusually thorough for 2017-era whitepapers
- System has survived multiple major macro-stress events with bruises but no total failure
Weaknesses
- Oracle dependency under-analysed; Black Thursday revealed depth of the gap
- TRFM mechanism never worked as specified; governance manual adjustment replaced it
- Collateral-quality framework absent; later USDC/RWA additions had no original analytical scaffolding
- Auction design assumed efficient keeper markets and bounded gas; both broke under stress in 2020
- Governance economics underspecified; participation, concentration, and capture have been recurring issues
- Strategic drift toward RWA and centralised-collateral backing not anticipated and not framed by the paper
Key contributions
- Collateralised Debt Position (CDP) primitive: users lock excess collateral and mint Dai against it, with liquidation if collateral ratio falls below threshold
- Dual-token model: Dai as the soft-pegged stable asset, MKR as governance and recapitalisation backstop with mint dilution under bad debt
- Stability fee mechanism: borrow-rate accrual paid in MKR, creating MKR demand and revenue flow to MKR holders
- Liquidation auctions (collateral auctions and debt auctions) as the on-chain market-clearing mechanism for unhealthy positions
- Target-Rate Feedback Mechanism (TRFM): rate-based price control similar to a central-bank policy rate (later removed from the spec)
- Global Settlement and Emergency Shutdown procedures for orderly system unwinding under terminal failure conditions
- Multi-Collateral Dai roadmap: extension from single-collateral (SAI, ETH-only) to multiple collateral types via per-collateral risk parameters
TL;DR
The 2017 paper that defined the CDP primitive and the dual-token decentralised-stablecoin pattern — its core ideas have aged exceptionally well, even as the operating system has drifted substantially from the original decentralisation framing.
Get DeFi Intel research in your inbox
Weekly long-form coverage of papers, incidents, jurisdictions, chains, tokens and the people building them. Free tier covers headlines; Pro adds the analyst-grade breakdowns.
Sources
External references gathered from the body of this brief. Last reviewed 2026-05-03.