# Introduction

Grace is an L2-first cross-margin lending protocol that fairly distributes losses if they occur, making it resilient to oracle manipulation, volatility and exploits.

## The bankrun problem

1. **Bad debt is accrued.** A lending protocol experiences some loss either due to vulnerable code, collateral price volatility or oracle manipulation.
2. **Liquidity is consumed.** The first lenders to withdraw the remaining the liquidity share none of the losses while those unlucky enough to withdraw last lose their entire deposit.
3. **Everyone runs for the exit.** This incentivizes a bank run because even a loss as small as 1% of the protocol’s TVL can cost a depositor 100% of their deposit if they're too late to withdraw.
4. **The protocol becomes unusable.** Any new lenders entering the pool would be adding exit liquidity for existing stuck lenders, allowing them to transfer their previous losses to the new lenders.

## The Graceful solution

1. **Prepare for the worst.** The lending protocol must expect and be able to absorb any amount of loss. Grace achieves this by immediately distributing any loss equally among lenders.
2. **Manage exposure.** Exposure to each collateral in the pool must be limited and predictable. Grace caps total exposure to each collateral in dollar terms.
3. **Compensate risk.** Borrowers should compensate lenders for the collateral risk they're taking. Grace charges borrowers a yearly fee based on their choice of deposited collateral and uses the proceeds to compensate lenders for their risk.
4. **Implement circuit breakers.** Even in the presence of a loss distribution mechanism, the protocol should minimize potential losses. A Pessimistic Price Oracle renders most oracle manipulation attacks unprofitable against Grace. A global daily borrow limit also caps the maximum possible damage by an attack over a single day.