PRODUCT UPDATE

DeFi Base Rate Update: Adding Liquity V2

We have updated how pigi.finance calculates its DeFi base rate. As of 20 May 2026, the stablecoin base rate is the average of four venues — the three Aave pools it has always used, plus Liquity V2's BOLD Stability Pool. After April 2026's wave of exploits, a benchmark resting on a single protocol was a risk we no longer wanted to carry. Here is what changed, and why.

Why we updated the base rate

April 2026 was a hard month for DeFi. According to the pigi.finance hacks tracker, roughly $304.7M was lost across five separate exploits:

2026-04-18  KelpDAO         $280.0M
2026-04-21  Rhea Finance    $18.4M
2026-04-21  Volo Vault      $3.5M
2026-04-25  Purrlend        $1.5M
2026-04-23  Giddy           $1.3M
-----------------------------------
Total                       $304.7M

Months like this are not anomalies. pigi.finance's own research has put DeFi exploit losses at roughly 3.37% of all deposited capital every year — see DeFi Insecurity vs TradFi Banking Failures. DeFi has no genuinely risk-free venue, and pretending otherwise is how people get hurt.

That has a direct consequence for a base rate — the benchmark every other yield on pigi.finance is measured against. Until now, our stablecoin base rate came entirely from Aave. A benchmark built on a single protocol is distorted by any exploit or stress event at that protocol — and it is distorted at exactly the moment accuracy matters most.

So we changed it. The rest of this post explains what a base rate is, how we calculate it, how Liquity V2's BOLD works, why Liquity is the most secure protocol in DeFi, and the exact update we shipped.

1. What is a DeFi base rate?

In traditional finance there is a clean answer to "what is the risk-free rate?" — the US Treasury Bill. A T-Bill is backed by the US government and is treated as having effectively zero default risk. Every other investment is priced as the T-Bill rate plus a risk premium.

DeFi has no equivalent. There is no on-chain venue with zero risk. Smart-contract risk, oracle risk, and governance risk never fully disappear — April 2026 is just the latest reminder. So a DeFi base rate is not a risk-free rate. It is something more modest but still useful:

The baseline yield a depositor can realistically earn from the safest, deepest, and simplest venues available on-chain — the floor against which every riskier strategy's premium is measured.

When a strategy on pigi.finance shows 14% APR, the base rate is what tells you how much of that is genuine compensation for extra risk and how much is simply the going rate for parking stablecoins on-chain. Without a base rate, every APR is just a number.

That makes the choice of venues that define the floor important. In our view a base-rate venue should have:

Real yield        paid by borrowers or users, not token emissions
Deep liquidity    large, withdrawable at any time
Low complexity    a depositor can actually understand it
Few trust assumptions   minimal admin keys, upgrades, off-chain parts
Transparent accounting  fully on-chain and verifiable

See the glossary entries for DeFi Base Rate and T-Bills Risk-Free Rate for the formal definitions we use across the site.

2. How pigi.finance calculates it

Until this update, pigi.finance computed the stablecoin base rate as the simple average of the 30-day moving-average APR of three Aave v3 pools:

Stablecoin base rate (before) = mean(
  Aave USDC   30-day MA APR,
  Aave USDT   30-day MA APR,
  Aave DAI    30-day MA APR
)

The 30-day moving average smooths out daily noise, so the benchmark reflects a trend rather than a single volatile day. There is a parallel ETH base rate built from Lido stETH, and a risk-adjusted variant of each that applies a haircut (around 0.41 percentage points) to account for DeFi-specific risk. The rates are recomputed daily and served to the site through a single endpoint.

Aave was a reasonable foundation: it is the largest lending market in DeFi, its yield is real interest paid by borrowers, and it has a long operating history. But look closely at the inputs and two forms of concentration stand out:

Concentration 1  -  all three inputs were the SAME protocol (Aave)
Concentration 2  -  all three assets are CENTRALIZED stablecoins
                    USDC (Circle), USDT (Tether), DAI (Sky/Maker)

A benchmark built entirely on one protocol cannot tell you whether a low reading means the whole market is calm or that that one protocol is stressed. And a benchmark resting entirely on fiat-backed stablecoins inherits the off-chain risk of three centralized issuers. Neither was a glaring problem in quiet markets. April 2026 made the first one impossible to ignore — and it is exactly what this update addresses. The new formula is in section 5.

3. How BOLD and the Liquity V2 Stability Pool work

Liquity V2 is a decentralized, immutable borrowing protocol. It has no admin keys and cannot be upgraded. Users mint BOLD, its stablecoin, by depositing ETH, wstETH, or rETH as overcollateralized collateral. BOLD holds its $1 peg through direct redeemability — BOLD can always be exchanged for the underlying collateral at face value.

The yield venue is the Stability Pool. Deposit BOLD into a Stability Pool and you earn from two real sources:

1. Borrower interest   75% of the interest ETH borrowers pay,
                       distributed to the ETH Stability Pool, in BOLD.

2. Liquidation gains   when a position is liquidated, your BOLD buys
                       the collateral at roughly a 5% discount.

There are no token emissions and no lockup — you can withdraw at any time. The yield is the actual price borrowers pay for credit, not a subsidy. There is even a yield-amplification effect: if less than 75% of BOLD supply sits in Stability Pools, effective yields can exceed the average borrow rate.

On the question of trust, BOLD does well. The independent rating agency Bluechip rates BOLD A- — above both USDC and DAI — citing stronger decentralization and crypto-native design. Liquity V2 has been audited by DeDaub and ChainSecurity. The full mechanics, ratings, and risk breakdown are on our Liquity V2 ETH Stability Pool strategy page.

4. Why Liquity is the most secure protocol in DeFi

A base rate is only as trustworthy as the venues that define it. So before adding Liquity V2 as an input, the fair question is: how secure is Liquity, really? In our view it is the single most security-conscious design in DeFi — and there are three concrete reasons.

1. It has no governance

Liquity is governance-free and immutable. There is no DAO, no admin key, no multisig, and no upgrade path. Once deployed, the contracts cannot be changed — not by the team, not by a token vote, and not by an attacker who compromises a signer.

This matters because governance is one of the most exploited surfaces in DeFi. A large share of the biggest losses trace back to compromised admin keys, malicious or rushed upgrades, and governance attacks — not to bugs in the core lending logic. By having no governance at all, Liquity removes that entire category of risk: there is simply nothing to capture.

2. It has never been hacked

Liquity V1 has run on Ethereum mainnet since April 2021 — more than four years — without a single exploit or loss of user funds. For a protocol holding billions in collateral across a full market cycle, that is a rare record.

Liquity V2 reinforces the point rather than undermining it. A Stability Pool vulnerability was found through an audit contest in February 2025 and fixed before any attacker could use it; a re-audited version was redeployed on May 19, 2025. No user funds were ever lost. Across both versions, Liquity has never been successfully hacked — a sentence very few DeFi protocols can write, and one worth rereading next to April 2026's $304.7M in losses.

3. It has the highest ratings on pigi.finance

This is not just our opinion. Liquity carries the strongest risk profile on pigi.finance — a full 5 out of 5 on every risk-bar dimension, and a top "Best" grade on the factors that matter most for security:

pigi.finance risk rating - Liquity
  Risk rating bars     5 / 5
  Protocol design      Best
  Governance           Best
  Chain (Ethereum)     Best
  History              Best
  Dependencies         Best

Independent rating agencies agree. Liquity V1 scores 96% (AA) on DeFiSafety, 95% (AA) on Certified, and A on Bluechip. BOLD, the Liquity V2 stablecoin, holds an A- from Bluechip — above both USDC and DAI — and 85% (A) on DeFiSafety, while inheriting the same immutable, governance-free design lineage.

Immutability does carry one honest trade-off: a bug cannot be patched in place, which is why the V2 vulnerability required a full redeploy. But that is the point — a protocol that cannot be upgraded has to be designed and audited to be right the first time, and that discipline is exactly what a base-rate venue should be built on.

5. What we changed

As of 20 May 2026, the Liquity V2 BOLD ETH Stability Pool 30-day MA APR is a fourth input to the stablecoin DeFi base rate, averaged alongside the three Aave pools:

Stablecoin base rate (now) = mean(
  Aave USDC                          30-day MA APR,
  Aave USDT                          30-day MA APR,
  Aave DAI                           30-day MA APR,
  Liquity V2 BOLD ETH Stability Pool 30-day MA APR
)

We deliberately complemented Aave rather than replacing it. Here is why that makes the benchmark better:

• Protocol diversification. The benchmark is no longer 100% Aave. A stress event at one protocol now moves the base rate by roughly a quarter, not by the whole thing.
• Issuer diversification. BOLD is crypto-native and decentralized. The base rate is no longer purely a function of Circle, Tether, and Sky.
• Still real yield. BOLD Stability Pool yield is borrower interest — methodologically consistent with the Aave inputs. No token emissions enter the number.
• Immutability. Liquity V2 is governance-free, so the input cannot be altered by a governance vote.

We hold ourselves to honesty, so here is what we are watching now that the change is live:

• Variable yield. BOLD Stability Pool yield depends on borrowing demand and on how much BOLD is deposited in Stability Pools, so it is noisier than Aave's utilization-driven rate. The 30-day moving average and the fact that it is one input of four both dampen this — we are monitoring whether it adds meaningful volatility to the benchmark.
• Short track record. Liquity V2 was redeployed in May 2025. It enters as one equal input of four — never the whole benchmark — and we may revisit the weighting as history accumulates.
• Smaller scale. BOLD's markets are smaller than Aave's stablecoin reserves. Again, it is one input of four; the three larger Aave pools still anchor the average.

One practical note: because the base rate now averages four venues instead of three, the published number may shift slightly. The shape of the metric, its glossary definition, and the data the site serves are otherwise unchanged.

Finally, we think this is bigger than our own dashboard. Any DeFi data provider that publishes a base rate, a benchmark, or a "risk-free" reference should diversify it — across protocols and across stablecoin issuers. April 2026 showed plainly that a benchmark resting on a single protocol is a benchmark with a single point of failure.

Our take, and our ask of other indexers: treat a base rate as a portfolio, not a single quote. Spread it across protocols, across issuers, and across trust models — and treat methodology resilience as part of the metric, not an afterthought.