Liquity (LUSD + BOLD) vs UPD: The Closest Competitor We Have

April 5, 2021. The Liquity team deploys LUSD on Ethereum mainnet and throws away the keys. Nearly five years later the core contracts still have no admin, no pause, no upgrade path, no governance, no freeze. Troves work the same way on day 1,825 as they did on day one (Liquity blog).

This is the first stablecoin in our comparison series that we'd actually call a peer. Everything before this, USDT, USDC, PYUSD, DAI, USDe, USDD, had a specific structural break we could point to. Liquity doesn't have one of those. It's a serious attempt at non-freezable dollar money on Ethereum, and BOLD V2 (May 2025) extended that attempt to liquid staking tokens while keeping the immutable core.

So what's different about UPD? The honest answer is: not the non-freezability claim. That's approximately equal. What differs is the stabilizer-NFT architecture, the direct-liquidation model with an insurance backstop, and the integration path into the Universal Private Pool for shielded transfers and ASP-compatible compliance. None of those make UPD "better" across the board. They make it different in ways that matter for specific users.

This post walks through what Liquity does well, what BOLD V2 added in 2025, and where UPD's design diverges.

Key Takeaways

• LUSD V1 has been live since April 5, 2021 with immutable core contracts, no admin keys, and no governance over risk parameters. It's the closest thing in DeFi to "deploy and walk away" stablecoin infrastructure (Liquity docs).
• BOLD V2 launched May 26, 2025 with multi-collateral branches (WETH, wstETH, rETH) and user-set interest rates. Governance can only direct 25% of borrowing revenue; it cannot upgrade or reparameterize the core (V2 whitepaper).
• In early 2025, a "Stability Pool scare" forced the Liquity team to advise users to withdraw because the immutable core couldn't be patched in place. Immutability removes governance capture risk and removes emergency response at the same time (Protos).
• Liquity uses a pooled Stability Pool that burns LUSD or BOLD to absorb liquidations. UPD uses per-position direct liquidation where a liquidator swaps UPD for stETH straight from the position, with an InsuranceEscrow covering any shortfall.
• UPD is pre-audit and Sepolia-stage, stETH-only. Its structural differentiators are the stabilizer-NFT model (collateral provider and minter are separate parties), an explicit upgrade path as a trade-off for incident response, and integration with UPP for shielded transfers.

What Does Non-Freezable Actually Mean for Liquity?

Both LUSD and BOLD are non-freezable at the token layer and the reserve layer. Token contracts have no blacklist, no freeze, no admin balance adjustment. Troves sit one-per-user, non-custodial, immutable. There's no reserve entity above them. No 5-of-7 multi-sig with discretionary authority over billions in collateral. No USDC-heavy basket that could turn against the token during a banking incident.

That combination is rare. DAI has no token freeze but its collateral is USDC-heavy, so the SVB depeg in March 2023 dragged DAI down to about $0.85. USDD has no token freeze but the TRON DAO Reserve quietly moved 12,000 BTC of backing in August 2024 without a governance vote. Liquity doesn't have either exposure. The token can't be frozen and nobody has authority to reshape the reserves.

The LQTY Token Doesn't Own the Protocol

LQTY captures protocol revenue and, in V2, votes on a 25% revenue share going to bribed liquidity initiatives. That's it. LQTY does not control collateral types, interest parameters, liquidation thresholds, or upgrade paths on the core contracts. Most of those things can't be changed by anyone, ever, because the core contracts are not upgradeable.

This is an important property to state plainly. It's the real deal.

How Does Liquity V1 (LUSD) Work?

Troves hold ETH collateral and let their owners borrow LUSD against them. The minimum individual collateral ratio is 110% in normal mode, notably more capital-efficient than MakerDAO's 150% ETH floor (Liquity docs). Borrowers pay a one-time fee at mint time. There's no recurring interest, ever.

Stability happens through three mechanisms: the Stability Pool, Recovery Mode, and protocol-level redemption.

The Stability Pool is LUSD that users deposit voluntarily as liquidation backstop. When a Trove falls below 110%, the Pool burns LUSD equal to the Trove's debt and receives the Trove's collateral pro-rata. Because Troves usually get liquidated just below 110%, Pool depositors tend to earn a small premium on each liquidation.

Recovery Mode triggers when the system-wide collateral ratio falls below 150%. In that state, the per-Trove minimum rises to 150%, and lower-ratio Troves get liquidated aggressively until the system re-stabilizes.

Protocol-level redemption is the peg anchor. Any LUSD holder can redeem at protocol for $1 of ETH, minus fees, regardless of secondary market price. That creates hard arbitrage whenever LUSD trades above par and soft pressure on the lowest-ratio Troves whenever it trades below par.

The 200 LUSD Liquidation Reserve

Each Trove carries a 200 LUSD liquidation reserve added to the debt balance, refunded on full repayment. This reserve covers gas compensation to liquidators and ensures the system doesn't create bad debt even in thin-liquidity windows. It's a small design detail that makes the whole thing work without an external keeper subsidy.

What Did BOLD V2 Change in 2025?

BOLD V2 launched on May 26, 2025 with three changes: multi-collateral LST support, user-set interest rates, and a governance module restricted to revenue allocation (V2 whitepaper).

Multi-collateral means each supported asset, WETH, wstETH, rETH, gets its own collateral branch with its own TroveManager and Stability Pool. A shared BoldToken contract and CollateralRegistry route actions to the right branch. Redemption still works across the whole system at $1 par, so the peg mechanics stay unified even as collateral types multiply.

User-set interest rates are the bigger conceptual shift. Instead of Liquity V1's one-time fee, BOLD borrowers choose their borrowing rate. If BOLD trades below peg, borrowers have a market signal to raise their rates (which increases the cost of maintaining short BOLD positions, reducing supply). If it trades above peg, they can lower rates. It's monetary policy delegated to users instead of a DAO committee.

Governance is scoped tightly. 75% of borrowing revenue flows natively into Stability Pools as Protocol Incentivized Liquidity. LQTY stakers vote to direct the remaining 25% to "initiatives", typically liquidity mining programs for BOLD pairs on Curve, Balancer, and elsewhere (V2-gov repo). The process is epoch-based and permissionless, with veto power to block malicious proposals.

Critically, governance cannot change collateral types, minimum collateral ratios, or anything about the core borrowing contracts. Those are immutable. A 2025 Coinspect audit of the governance module found a medium-risk bribe-token bug that could lock bribes via an overflow in BOLD accounting; the team mitigated by restricting arbitrary bribe tokens (Coinspect). The finding is instructive: immutable cores plus permissionless governance layers create attack surface at the seam between them, even when each piece is individually sound.

How Does Liquidation Differ: Stability Pool vs Direct Liquidation?

This is where the structural difference is largest. Both systems avoid bad debt. Both let anyone trigger a liquidation. The mechanism underneath is very different.

Liquity's Pooled Model

In Liquity V1, when a Trove drops below 110% ICR, a liquidator calls liquidate(). The Stability Pool burns LUSD equal to the Trove's debt and receives the collateral pro-rata across Pool depositors. Because the Trove is usually close to 110% at trigger time, Pool depositors get roughly 10% more ETH value than the LUSD they burned (Liquity blog).

If the Pool doesn't have enough LUSD to cover the Trove's debt, the remaining debt and collateral redistribute pro-rata across all other active Troves. Those Troves take on extra debt and extra collateral. Their ratios shift. The system stays solvent but risk propagates through the borrower base (Liquity GitHub).

BOLD V2 keeps this pattern per-branch. Each branch has its own Stability Pool. If a pool runs dry, the V2 design adds a second tier: the liquidator can supply BOLD from their own balance before the system falls back to redistribution. It's the same philosophy, applied per asset.

UPD's Direct-Liquidation Model

UPD doesn't use a pooled stablecoin backstop. The system enforces a 125% collateral-ratio floor; stabilizers choose their own initial CR above it. Cautious operators might run 150-175%; aggressive ones around 130%, leaving a 5% margin before liquidation opens up. When a position's ratio drops below the liquidation threshold for a given liquidator's NFT ID, anyone with UPD can trigger the liquidation directly against that one position:

// StabilizerNFT.sol
function liquidatePosition(
    uint256 liquidatorTokenId,     // 0 = no NFT, uses permissionless floor
    uint256 positionTokenId,       // The position being liquidated
    uint256 updAmountToLiquidate,
    IPriceOracle.PriceAttestationQuery calldata priceQuery
) external nonReentrant onlyMainnetOrSepolia;

The liquidator transfers UPD to the contract, which burns it, and pulls stETH out of the position's PositionEscrow. The default payout is 105% of par value in stETH (admin-configurable between 105% and 200%). If the position is still overcollateralized enough at liquidation time, the liquidator gets 105% and any excess above that goes to the InsuranceEscrow. If the position is too underwater to pay 105%, the InsuranceEscrow tops up the shortfall best-effort, up to its balance.

There is no Stability Pool. There is no pro-rata distribution across other Troves. Each position lives or dies on its own collateral plus the InsuranceEscrow backstop.

Tiered Thresholds by NFT ID

UPD has a twist that Liquity doesn't: the liquidation threshold depends on the liquidator's stabilizer NFT ID.

• No NFT (ID 0): threshold = 110%. Anyone with UPD can liquidate a seriously underwater position.
• NFT ID 1: threshold = 125%. The earliest stabilizer can catch positions before they slip past the minimum ratio.
• NFT ID N: threshold = 125% minus (N-1) * 0.5%, floored at 110%.

So early stabilizers get privileged liquidation access: they can catch a sliding position earlier, before it becomes a bigger problem for the system. Latecomers, and anyone without a stabilizer NFT at all, can still liquidate, but only when the position has already fallen below 110%. It's a built-in incentive for being an early operator without giving anyone an exclusive right.

There's one more guard: the position's ratio must also be below the system-wide ratio. That prevents anyone from liquidating positions that are above-average just because they're technically below a threshold. Healthy-relative-to-the-system positions are protected.

Where the Risk Sits Differently

Liquity's model spreads liquidation risk across Stability Pool depositors (voluntary) and other Trove owners (involuntary, via redistribution). UPD's model isolates each position. Shortfalls hit the InsuranceEscrow, not other positions.

Both models avoid creating bad debt. The trade-off is capitalization. Liquity's Stability Pool is typically well-funded because Pool depositors earn liquidation premia. UPD's InsuranceEscrow has to be funded by the protocol, primarily via the overcollateralization above 105% that gets seized at liquidation time, plus an initial seed. That's a smaller, different funding loop. It scales differently under stress.

Neither approach is obviously superior. They're honest alternatives.

What Happened in the 2025 Stability Pool Scare?

In early 2025, Liquity V2 hit a moment that's worth discussing. The team discovered a potential issue in Stability Pool logic and publicly advised users to withdraw funds because the immutable core couldn't be paused or patched (Protos). BOLD TVL fell sharply from the roughly $85M it had reached shortly after launch.

No exploit occurred. The incident was a false alarm, or at least a precautionary alarm. But it illustrated the real cost of immutability. You can't push an emergency fix when there's no upgrade path. The only incident response is tell users to withdraw, wait for the issue to be confirmed or cleared, and possibly redeploy a patched version as a separate system.

This is the trade-off that every stablecoin design has to pick a side on. Immutability removes governance capture, parameter mis-configuration, and admin-key risks. It also removes the ability to fix things. UPD has picked the other side.

How Does UPD's Stabilizer-NFT Model Differ From a Trove?

Here's the UPD token surface, in full:

// UPDToken.sol (Solidity 0.8.29)
bytes32 public constant CONTROLLER_ROLE = keccak256("CONTROLLER_ROLE");

function mint(address to, uint256 amount) external onlyRole(CONTROLLER_ROLE) {
    _mint(to, amount);
}
function burn(uint256 amount) external onlyRole(CONTROLLER_ROLE) {
    _burn(msg.sender, amount);
}

One role. Mint to an address. Burn from the caller's own balance. No freeze, no blacklist, no admin balance adjustment. The CONTROLLER_ROLE is granted to StabilizerNFT on mainnet (or BridgeEscrow on L2). The UPDToken contract itself is not upgradeable. Balances cannot be rewritten.

Two Parties, Not One

The structural difference from Liquity is above the token. In Liquity, a user opens a Trove. They deposit ETH, they borrow LUSD, they own both sides. The collateral provider and the borrower are the same person.

In UPD, those roles are split. The stabilizer owns an NFT and deposits stETH into their StabilizerEscrow (unallocated buffer) and PositionEscrow (allocated collateral backing minted UPD). Stabilizers sit in a priority queue, ordered by NFT ID. When a minter calls mint on StabilizerNFT, the contract walks the queue pulling collateral from stabilizers' PositionEscrows until the minter's requested UPD is fully overcollateralized. The stabilizer earns the stETH yield on their allocated collateral via Lido rebasing. The minter gets the dollar liquidity.

What's the practical consequence? UPD supports marketplace-style collateral provision. One party brings balance sheet as a stabilizer. A different party needs dollar liquidity as a minter. Stabilizers are compensated by stETH yield plus any liquidation premia. Minters hold the stablecoin.

Liquity's Trove model collapses both roles into one user. Simpler, and well-suited to ETH-rich DeFi participants who want leverage on their own holdings. Less natural as a substrate for marketplace lenders, structured products, or institutional liquidity providers who don't want to also hold the stablecoin they back.

Upgradeability as a Deliberate Trade-Off

UPD's escrows are BeaconProxy instances pointing to an UpgradeableBeacon per escrow type. A single beacon.upgradeTo(newImpl) call propagates a new implementation to every existing PositionEscrow proxy atomically. No iteration, no re-minting NFTs. The PriceOracle is UUPS upgradeable on its own schedule.

This is the honest asymmetry against Liquity V1. UPD can ship a patch if a flaw is discovered in escrow logic. Liquity V1 can't. The 2025 Stability Pool scare shows the cost of the immutable path. UPD accepts upgrade authority as the cost of the response path.

Is that centralization? Partly. The admin role that executes beacon upgrades is a trust assumption. UPD is pre-audit and Sepolia-only today, so this is an accepted property of the current stage rather than a promise about eventual decentralization. Over time, upgrade authority should move to a timelock, then to a governance structure, then possibly to nothing at all, matching the stablecoin's progression toward maturity. That's a roadmap, not a live claim.

Where Does UPD's Scope Extend Beyond Liquity?

Liquity is fully public ERC-20. Every LUSD transfer, every BOLD transfer, every Trove action sits on-chain forever, visible to chain analytics, competitors, and MEV bots. That's fine for DeFi-native users who value maximum transparency. It's a blocker for institutional desks that need counterparty pseudonymity, for payroll flows that shouldn't reveal wages, and for compliance teams that need to prove obligations without token-level seizure tools.

UPD is designed to operate inside the Universal Private Pool (UPP). Deposits into UPP produce shielded notes; transfers inside the pool are ZK-private; withdrawals re-expose to public ERC-20 if needed. The pool also exposes an Association Set Provider pattern: compliance teams operate as ASPs that screen membership sets, and users can prove inclusion in a specific ASP's set as part of their withdrawal proof, without ever revealing the underlying transfer history (ASP vs Proof of Innocence).

This is adjacent to what Liquity was built to do. Liquity solved censorship-resistant borrowing. That's a complete product on its own. UPD's scope is censorship-resistant dollar, shielded transfers, and compliance-ready entry control, all integrated. Different design goal, different tooling, different audience. Neither replaces the other.

Head-to-Head Comparison

Which Risk Profile Fits Your Use Case?

When Liquity Fits

• ETH-native DeFi users who want leverage against their existing holdings
• Maximum immutability is a hard requirement. You'd rather have "deploy and walk away" than any upgrade path, full stop.
• No institutional compliance requirement. You're comfortable with fully-public, fully-permissionless operation.
• You're fine with the trade-off that the core can't be patched in an emergency. You manage incident risk by monitoring and being ready to withdraw quickly.
• You want a multi-year live operational record before putting real capital at risk.

When UPD's Risk Profile Fits

• You need shielded transfers on the dollar leg of a payment or settlement flow
• Your team needs an ASP-compatible compliance story and token-level freezes are disqualifying
• Your use case benefits from separating collateral provision from stablecoin minting, treating the stabilizer as a counterparty rather than yourself
• You accept upgrade authority as a trade-off for incident response capability during the pre-mainnet and early-mainnet phases
• You accept pre-audit and no operational history as a starting-point risk

These aren't exclusive categories. Some users will hold both, treating them as complementary tools with different scopes.

Frequently Asked Questions

Is Liquity really immutable? Even the V2 governance module?

The V1 core and the V2 core are both immutable. No upgrade, no pause, no admin. What V2 adds is a separate governance module that directs 25% of borrowing revenue to bribed liquidity initiatives. That module has its own contracts and can evolve, but it cannot touch the core borrowing, collateralization, or liquidation logic. If you dislike the governance module, you ignore it and the core still works (V2 whitepaper).

If LUSD is non-freezable and has five years of live operation, why would I use UPD at all?

You probably wouldn't, if your only requirement is a non-freezable crypto-backed dollar that's been live for years. LUSD solves that problem. UPD is worth considering when you also need shielded transfers through UPP, when your compliance team needs ASP-based entry control, or when your protocol architecture benefits from separating stabilizer (collateral provider) from minter (stablecoin receiver). If none of those apply, Liquity's maturity advantage is real.

How does UPD liquidate a position without a Stability Pool?

The liquidator transfers UPD to the StabilizerNFT contract, which burns it, and pulls stETH out of the target position at a payout of 105% of par (configurable). If the position was overcollateralized, the excess above 105% goes to the InsuranceEscrow. If the position was underwater, the InsuranceEscrow tops up the shortfall best-effort. Each position is liquidated independently. There's no pool of user-deposited UPD acting as a burn buffer.

Was there ever a Liquity exploit or depeg?

No protocol-level hack on the core contracts. LUSD supply did contract meaningfully during periods of heavy redemptions and strong competing yields (e.g. DAI Savings Rate spikes), and LUSD sometimes traded near $1.10 as redemption demand built up, before arbitrage pushed it back (Yahoo Finance). The 2025 Stability Pool scare was a false alarm but cost meaningful TVL. Independent risk agencies like Bluechip have consistently rated both LUSD and BOLD highly on stability and safety.

Can I use LUSD inside a privacy pool?

Not natively. You'd need to deposit LUSD into a third-party privacy pool like Tornado-style mixers or RAILGUN to get shielded transfers. Those tools work for LUSD as any ERC-20, but they're not integrated with Liquity's design. UPD is the other way around: it's designed from the start to be deposited into UPP, with the compliance layer (ASPs) built into the withdrawal proof logic.

How does BOLD's user-set interest rate compare to UPD's peg mechanism?

BOLD's user-set rate is a market-driven monetary policy tool. Borrowers choose their rate; the distribution of chosen rates affects BOLD supply and therefore peg pressure. UPD doesn't have user-set rates. Its peg mechanism is over-collateralization plus per-position mint and burn with liquidation penalties on the downside and excess collateral redemption on the upside. BOLD's design is more sophisticated on interest dynamics. UPD's is simpler and more mechanical.

Does UPD's upgrade authority make it effectively centralized?

Partly. The admin role that executes beacon upgrades is a trust assumption today. UPDToken balances can't be rewritten regardless (the token contract isn't upgradeable), and escrow upgrades change code, not ownership. But a malicious admin could deploy an escrow implementation that drains stETH. This is a real risk that doesn't exist in Liquity V1. The mitigation path is progressive: admin to timelock to governance to, eventually, immutable. We're at step one.

Is UPD multi-collateral?

Not today. UPD accepts stETH only, same single-collateral profile as LUSD V1 (ETH-only). BOLD V2's wstETH and rETH support is genuinely broader than what UPD provides now. A multi-collateral roadmap may make sense once stETH operations have been audited and proven at scale, but we're not claiming it as a current feature.

Conclusion

Liquity is the most serious non-freezable stablecoin that exists. The V1 core has no admin, no pause, no upgrade path, and it's been running since April 2021. BOLD V2 extended that to LST collateral and gave borrowers market-driven interest rates while keeping the core immutable. Anyone designing in this space has to take Liquity's approach seriously. We do.

UPD isn't trying to beat Liquity at immutability or operational maturity. That fight would be dishonest. UPD is different in specific, verifiable ways: the stabilizer-NFT architecture separates collateral provision from minting, the direct-liquidation model isolates risk per-position with an insurance backstop, the upgrade authority on the oracle and escrows buys incident-response capability at a trust cost, and the integration into UPP adds a privacy and compliance layer that Liquity was never designed to provide.

Pick the design that matches your problem. If you want ETH-native borrowing on a five-year-old immutable system, use Liquity. If you need shielded dollar transfers, ASP-compatible compliance, or the stabilizer/minter split, UPD is worth watching as it moves from Sepolia toward audit and mainnet.

Read the specs. Read the liquidation flows. Test the claims. Decide.

• USDD vs UPD: Why Over-Collateralization Alone Is Not Enough - non-freezable token, discretionary reserve entity
• DAI vs UPD: When Decentralized Isn't Decentralized Enough - non-freezable token, freezable USDC-heavy collateral
• USDe vs UPD: Delta-Hedged Yield or Pure On-Chain Collateral? - CEX-dependent hedge vs on-chain design
• What Is a Non-Freezable Stablecoin? - pillar post on the core property
• UPP vs RAILGUN - privacy architecture comparison
• ASP vs Proof of Innocence - compliance architecture for private pools

UPD is pre-audit and currently deployed on Sepolia. The comparison in this post is architectural and educational, not investment or legal advice.