When DeFi encounters problems, how to determine the attribution of losses?

*Original Title: [How loss travels to the holder of onchain product](https://x.com/mathy_research/status/2118048605982404791)*

*Original Author: mathy_research*

*Original Compilation: AididiaoJP, Foresight News*

In recent years, the risk rating of digital assets has expanded rapidly. Rating agencies and on-chain risk service providers now assess stablecoins, protocols, and lending vaults, with most work focusing on the products themselves and their components: their reserves or portfolios, the managers responsible for operations, and the code they run.

These assessments provide holders with a wealth of information about the products. However, what holders really need to know is more specific: if a problem occurs in a certain link of the underlying structure, how much of their claim will be lost, how long it will take to recover the remaining part, and which holders will ultimately bear the loss.

The answers to these three questions depend on how the failure transmits from those components to the claims held by the holders. This article proposes a method to trace this path, applicable to various products, based on four core principles.

### Four Principles

* Product-agnostic. The analysis starts from one question: how much can the holder claim upon exit, and what determines that. Vault shares, tokens redeemable at face value, and promissory notes are placed in the same framework, and the product label does not change the method.

* Loss and delay path. Failures will traverse through various layers between the assets and the holders—code, individuals who can change rules, and automatically executed rules. Each layer can absorb it, slow it down, or pass it on. The same event may yield drastically different results for two holders.

* Who bears the loss. The terms of the claim determine whether the loss is absorbed by buffers, debtors, or holders; the exit rules can shift losses from those who exit early to those who remain.

* Path. Some weaknesses can compensate for each other, such as good collateral offsetting a weak borrower, which can be scored collectively. However, some weaknesses are stuck on the critical path: no matter how good the collateral is, a single administrator key without a time lock can transfer it away, making the quality of the collateral irrelevant. Such weaknesses cannot be averaged with strengths; they themselves determine the upper limit.

* The following unfolds in this order: what the claim is, what operational layers are in between, how losses traverse them, and finally how they aggregate into conclusions.

### Step One: What Can Holders Recover

The first question is: what determines how much holders can claim upon exit. There are actually only a few types of claims, each clearly indicating at which link the loss will fall on the holders.

Let’s compare three groups. When holding pool shares, holders receive a portion based on the current value of the pool; when the asset depreciates, the loss immediately falls on them—most lending vault shares work this way. When holding promissory notes, regardless of how much the underlying assets earn, the debtor owes a fixed amount, and holders only suffer losses if the debtor defaults. When holding tokens redeemable at face value, losses occur when redemption fails or when prices break. Other claims are similar: understanding what determines the amount reveals where the losses come in.

The type of claim determines what the failure means for the holder. In the case of a borrower defaulting: for pool shares, it is an immediate write-down; for priority promissory payments, as long as the buffer below the claim has not been exhausted, the payment amount remains unchanged. However, what supports the claim, who controls it, and what code runs it are equally critical—these aspects will be analyzed in the layers below but do not change the type of claim itself. Because the method starts from the claim, it treats vaults, stablecoins, or tokenized assets equally.

### Step Two: The Five Layers Between Assets and Holders

Once the claims are clarified, the next step is to see: what lies between the claims and the assets that ultimately repay them. Counting from the bottom up, there are five layers. The bottom layer is the underlying exposure, which is the part of the asset that generates value and absorbs losses first. The top layer is the holder's claim, which is the right and exit terms that determine what the holder can actually receive.

Three operational layers are in between. Closest to the assets are the smart contracts and infrastructure, including the code holding the assets and the systems it relies on, such as oracles, cross-chain bridges, and the chain itself. The next layer up is control, referring to entities that can change the exposure, terms, or valuations, and where the boundaries of their changes lie. Closest to the holders is the mechanism, which refers to rules that automatically transfer value without requiring anyone to make decisions, such as liquidation and withdrawal limits.

The reason for layering is that each layer fails in different ways. Code and infrastructure can fail without any decisions being made: the chain halts, or the oracle fails, and regardless of the issuer's willingness, exits will be stalled, and assets will be mispriced. Failures in the control layer stem from human decisions, so what really matters is the extent of each power's range and how much delay there is before it takes effect. The mechanism layer responds to pressure according to rules; behavior can be derived from parameters and market conditions; once conditions change faster than the rules, it will fail.

### Step Three: How Losses Travel to Holders

With the layers set, the transmission path becomes clear. Pressure starts from the underlying exposure and moves toward the holders, carrying two things: the loss of value and the time it will take to recover that value. Each time it passes through a layer, a portion of these two items is cut off, and only what remains continues upward.

Pressure may also generate internally within a certain layer. A code failure or a bad decision does not have to start from the bottom; it can emerge from a middle layer and still transmit all the way to the claims.

Underlying exposure. The starting point of transmission is default, price drops, reserve shortages, or custodian failures, which reduce the value supporting the claims. How much can be recovered and how quickly depends on collateral, buffers, and legal recourse; the unrecoverable portion continues upward. In reality: a borrower defaults, and the collateral sells for less than the debt; a custodian fails, and segregated assets take months to return; reserve assets depreciate, and tokens fall below face value.

Smart contracts and infrastructure. The first operational layer next to the assets consists of the code holding the assets and the facilities that carry transactions and prices. Code defects, privileged operations, chain halts, cross-chain bridge failures, and service interruptions can occur without warning. The extent to which an event can affect value depends on on-chain limits, delays, and redundancies; what actually reaches the claims manifests as stolen funds, trapped funds, mispricing, or halted exits. Upgrades without delay can directly replace vault logic; if a cross-chain bridge is compromised, the collateral from the past may be worthless; if the chain halts, no one can exit until it restarts.

Control. Above that is the control layer, where human decisions come into play. If someone changes configurations, parameters, or valuations, that decision will alter the exposure, value, or liquidity within the constraints. What really needs to be compared here is the delay before the changes take effect and the time required for holders to exit. If holders can leave before the changes take effect and the exit channel accommodates everyone, they can refuse that risk; if not, a bad or malicious decision will directly impact the claims. Managers allocate funds into a market that later generates bad debts; operators fail to recall funds, and exit queues exceed buffers; compromised signers change limits without delay.

Mechanism. Closest to the holders is the mechanism layer, where rules automatically respond to incoming pressure. Price changes, withdrawal surges, and funding rate changes come in, interest rates adjust accordingly, liquidations trigger, queues fill up, and interest continues to accrue. How quickly pressure transmits and how much is absorbed is determined by parameters. When rules fail, pressure turns into losses or delays: collateral drops faster than liquidation sales, leaving bad debts; utilization peaks, withdrawals get blocked; exit assets fall below face value while interest rates continue to rise.

Holder's claim. The pressure that traverses the lower layers and ultimately reaches the claim terms is determined by those terms regarding who absorbs it: the holders, buffers, or debtors. Whether holders can legally or by code enforce payment determines whether they receive money; exit rights and exit assets determine what and when they receive it. This layer can also transfer losses among holders. If the gate closes, but the book value still reports at face value; or if early exiters leave at full value before impairment confirmation, the losses fall on those who remain. What each person bears is more than just the proportion they should bear.

Looking along the entire path, the same underlying event may yield vastly different results for two holders. A borrower default in one product may be absorbed by buffers, in a second product may result in delayed write-downs, and in a third product may trigger a run, pushing losses onto those who exit later. Therefore, risk assessments must follow the path—just looking at the event itself does not reveal what kind of outcome holders will encounter.

### Step Four: Each Type of Risk Must Be Viewed Layer by Layer

Each layer can only tell you where the pressure passes through, but it cannot reveal what type of harm it causes. The second dimension of assessment is the type of harm: credit risk, market risk, liquidity risk, plus those unique to on-chain claims. These two dimensions do not correspond one-to-one; forcing them to correspond obscures most paths through which risk reaches the claims.

Take liquidity as an example. It has multiple entry points: the underlying asset is one, exit rights and exit assets are another, withdrawal mechanisms and settlement queues are another, and the operators who must recall funds are yet another, along with the on-chain or off-chain services relied upon for exits. Therefore, a vault can have deep liquidity in the market but still block holders at other entry points. Credit risk is similar: it comes from the borrower, as well as from decisions, rules, and loss-sharing terms between the borrower and holders. Each type of risk must be traced through every layer it may pass through to clearly assess what holders face overall.

Risk types can also interact with each other. When credit deteriorates, withdrawals often increase simultaneously, forcing assets to be sold in a declining market to meet exits, compounding losses.

Measuring a type of risk typically requires two indicators, as it needs to answer two questions. One is a flow indicator, such as expected annual credit loss or annual de-pegging probability, which tells holders how much loss to expect on average each year and how many events to anticipate. The other is an event indicator, such as losses under stress scenarios, which tells holders how bad the worst day can be. A product may appear harmless from a flow indicator perspective but severe from an event indicator perspective, which is a typical manifestation of tail risk. The two indicators are presented side by side, cannot be summed, and cannot be directly compared: annual expectations and single scenario losses are not measuring the same thing. For certain risks, such as exit runs, annual averages do not convey much; scenario numbers are what matter.

There are also two rules to prevent indicator distortion. If a single stress is triggered by multiple risk types, it is counted only once. An indicator that cannot be estimated is recorded as missing, never as zero—zero can be misinterpreted as safety.

### Step Five: To What Layer Should Risk Assessment Penetrate

All of the above assumes you know what the vault actually holds. But the answer is rarely visible in one step. Behind a vault share may be the balance sheet of an issuer; this sheet allocates money to various places, which operate markets, and those markets then lend out collateral. The underlying exposure lies at the end of this chain, and risk assessment must trace all the way there—just as bank capital rules require banks to penetrate fund holdings and conservatively handle opaque holdings. This leads to two practical questions: how deep to trace and what to do if you cannot trace.

Tracking must cover every position important to the claims and stop where the remaining risk can be judged as a whole: an asset that truly repays the claims, an exposure that has already been credibly assessed by others, or a part that no one can see into. These rules do not look at product labels; they simply differ in the types of nodes along the path, and how deep to analyze depends on the structure itself.

In this process, there are two crucial details. The first is the concentration point. An oracle, a cross-chain bridge, a custodian, an administrator key, may all be pressing down on several seemingly unrelated exposures at the same time. Each path taken by it may seem small on its own, but together they all rely on the same thing for support. Therefore, even if no single path is particularly large, the concentration point must be pursued; it only counts once and is treated according to the weakest link—what relies on it cannot be stronger than it. If a vault is spread across two lending markets, and both markets share one oracle, then there is no diversification concerning that one oracle.

The second is the unknown exposure. Undisclosed strategies and configurations without mandatory limits cannot be overlooked—overlooking them is equivalent to assuming they are "average." The correct approach is to treat them as weak according to their proportion in the claims. The unknown part will also lower the certainty of the conclusion: the higher the proportion that holders cannot see, the more any risk assessment can only be considered a temporary conclusion.

### Step Six: The Weakest Link

So far, what has been derived is a set of separate assessments. The clearest way to present them is to keep them separate, giving each type of risk its own result. If it must be compressed into a single number, summarizing at this step is most likely to lose the logic of transmission.

Taking an average will cause the strength in one area to offset the weakness in another. This approach is fine when several factors can substitute for each other: from the perspective of expected loss, better collateral can compensate for weaker borrowers, as both reduce the same credit loss. However, once these factors connect end to end on the path to the holders, averaging becomes ineffective. No matter how good the collateral is, if an administrator key without a time lock can move it away, that doesn’t signify much. In such cases, one layer of failure is enough; using it to average with a strong layer describes a state that a holder could never encounter.

Thus, the path determines how to summarize: if factors can substitute for each other, take the average; the weaknesses that every loss must pass through can individually set limits. Each limit is ultimately a judgment; the more limits there are, the risk assessment degenerates into only looking at the worst item. The goal is to lay the assessment open for holders to see: does this conclusion reflect the overall picture, or is it stuck by a weakness?

### What Risk Assessment Cannot Tell You

The conclusions drawn in this way rank the "degree of protection of holders' claims" among products, reflecting the state on the day of assessment. However, it is not the probability of losing money. To turn the conclusion into a probability, one must keep a long-term record of how many times each assessed product has actually lost money, but the on-chain market does not have such records yet. So far, most losses have come from a few market events that swept across many products; decoupling is rare, minor incidents often go unreported, and there are very few claims that actually make it to court.

Because of this, the value of the entire analysis lies here: starting from claims, it tells holders which failures could fall on them, how much loss they would incur, how long they would have to wait, and whether they or other holders would ultimately bear it. It puts vault shares, stablecoins, and tokenized notes into the same framework, allowing one to see whether the assessment relies on the overall picture or on a specific weakness that every loss must pass through. A single number cannot contain this information—this is precisely why losses must be traced all the way to the holders.