How is loss attribution determined when DeFi encounters problems?

Written by: mathy_research

Compiled by: AididiaoJP, Foresight News

Over the past few years, the expansion of digital asset risk ratings has been rapid. Rating agencies and on-chain risk service providers now evaluate stablecoins, protocols, and lending vaults, with most work focused on the product itself and its components: its reserves or portfolio, the operators managing it, and the code it runs.

These evaluations provide holders with extensive information about the products. However, what holders truly need to know is more specific: how much their claims would lose if a component fails at the bottom layer, how long the remainder would take to recover, and which holders ultimately bear the loss.

The answers to these three questions depend on how failures propagate from those components through to the holders' claims. This article proposes a method to trace this path, applicable to all types of products, centered on four core principles.

Four Principles

• Product-agnostic. The analysis starts with one question: How much can a holder withdraw upon exit, and what determines that amount? Vault shares, redeemable tokens at par value, and coupon-bearing notes are placed within the same framework; product labels do not change the methodology.
• Path of Loss and Delay. Failures traverse the layers between assets and holders—code, humans who can alter rules, and automated rule enforcement. Each layer can absorb the shock, delay it, or pass it down. The same event can yield drastically different outcomes for two different holders.
• Who Bears It. Claim terms determine whether losses are absorbed by buffers, debtors, or holders; exit rules can then shift those losses from early leavers to remaining participants.
• Path Dependency. Some weaknesses can substitute for each other—for example, strong collateral compensating for weak borrowers—which allows for combined scoring. But some weaknesses lie on a critical path: no matter how well-collateralized a vault is, if an unprotected admin key can drain it, the quality of collateral becomes irrelevant. Such weaknesses cannot be averaged out with strengths; they alone dictate the ceiling.
• The following sections unfold in this order: what the claims are, what operational layers exist in between, how losses traverse them, and finally, how to synthesize conclusions.

Step 1: What Holders Can Claim

The first question is: what determines the amount a holder can claim upon exit. In reality, there are only a few types of claims, each clearly specifying where and how losses fall on holders.

Consider three comparisons. When holding pool shares, holders receive a portion based on the pool's current value; depreciation immediately translates to losses—a structure common to most lending vault shares. When holding coupon-bearing notes, the debtor owes a fixed amount regardless of underlying asset performance; holders only suffer if the debtor defaults. When holding redeemable tokens at par, losses occur when redemption fails or the peg breaks. The same logic applies to other claims: once you understand what dictates the payout amount, you know where losses originate.

The type of claim dictates what a failure means for holders. Take a single borrower default: it triggers an immediate write-down for pool shares, but for senior coupon claims, the payout remains unchanged as long as the buffer below hasn't been exhausted. However, what underpins the claim, who controls it, and what code governs it are equally crucial—these factors will be analyzed in the subsequent layers without altering the fundamental nature of the claim itself. Because this methodology originates from the claim, it treats vaults, stablecoins, and tokenized assets uniformly.

Step 2: The Five Layers Between Assets and Holders

Once the claim structure is clear, the next step is to examine what lies between the claim and the ultimate assets that repay it. Counting from the bottom up, there are five layers. The bottommost layer is the underlying exposure—the assets that generate value and absorb losses first. The topmost layer is the holder's claim, encompassing the rights and exit terms that dictate what holders actually receive.

Sandwiched in between are three operational layers. Closest to the assets is smart contracts and infrastructure, including the code holding the assets and the systems it relies on, such as oracles, cross-chain bridges, and the blockchain itself. Above that is governance/control, referring to entities capable of altering exposures, terms, or valuations, along with the boundaries of their authority. Closest to holders are mechanisms, the rules that automatically transfer value without human intervention, such as liquidation triggers and withdrawal limits.

Layering is necessary because each layer fails differently. Code and infrastructure can fail without any human decision: a chain halts, oracles go offline, and regardless of the issuer's preference, exits freeze and assets misprice. Governance failures stem from human decisions, so the real focus is on the scope of authority and the delays before changes take effect. Mechanisms handle stress according to predefined rules; their behavior can be derived from parameters and market conditions. They fail when market conditions change faster than the rules allow.

Step 3: How Losses Propagate to Holders

With the layers established, the propagation path becomes clear. Stress originates at the underlying exposure and moves toward holders, carrying two attributes: loss of value and the time required to recover it. As it crosses each layer, portions of both are absorbed, and only what remains continues upward.

Stress can also originate internally within any layer. A code bug or a bad decision doesn't have to start at the bottom; emerging from an intermediate layer can still propagate straight to the claims.

Underlying Exposure. The starting point of propagation includes borrower defaults, price declines, reserve shortages, or custodian failures, all of which reduce the value backing the claims. Recovery amounts and speeds depend on collateral, buffers, and legal recourse; only unrecoverable portions continue upward. Real-world manifestations include: borrower defaults leading to collateral sales that don't cover debts; custodian failures requiring months to return segregated assets; or reserve depreciation causing tokens to trade below par.

Smart Contracts & Infrastructure. The first operational layer adjacent to assets comprises the code holding them and the facilities processing transactions and pricing. Code vulnerabilities, privileged operations, chain halts, bridge failures, or service interruptions can occur without warning. The value impacted depends on on-chain limits, delays, and redundancies; what ultimately reaches claims appears as stolen funds, trapped capital, mispricing, or frozen exits. Instant upgrades can directly replace vault logic; if a bridge is compromised, bridged collateral may become worthless; if a chain freezes, no one can exit until it restarts.

Governance/Control. Moving up, the control layer operates through human decisions. Changes to configurations, parameters, or valuations alter exposures, values, or liquidity within defined bounds. The critical comparison here is the delay before changes take effect versus the time needed for holder exits. If holders can leave before changes activate and the exit channel accommodates everyone, they can sidestep the risk; otherwise, a poor or malicious decision lands directly on claims. Examples: managers allocating capital to a market that later sours with NPLs; operators failing to recapitalize leading to queues exceeding buffers; compromised signatories altering limits instantaneously.

Mechanisms. Closest to holders, the mechanism layer automatically responds to incoming stress via preset rules. Price swings, withdrawal surges, or funding rate shifts trigger interest rate adjustments, liquidations, full queues, and ongoing accruals. The speed and absorption of stress depend on parameters. When rules break down, stress converts to loss or delay: collateral falls faster than liquidation can sell, leaving bad debt; utilization caps block withdrawals; exit assets trade below par while accrual rates keep rising.

Holder Claims. Pressure traversing all lower layers and ultimately hitting the claim terms is allocated by those terms: to holders, buffers, or debtors. Whether holders can legally or contractually enforce payment determines payout eligibility; exit rights and exit assets dictate what is received and when. This layer also transfers losses among holders. If gates close while book values remain reported at par, or if early leavers exit at full principal before impairment is confirmed, losses land on those who stay. Everyone bears more than their pro-rata share.

Tracing the entire path, the same underlying event can yield vastly different results for two holders. A borrower default might be absorbed by a buffer in Product A, turn into a delayed write-down in Product B, or trigger a run in Product C, shifting losses to late leavers. Therefore, risk assessments must follow the propagation path—evaluating the event alone won't tell you which outcome holders face.

Step 4: Analyze Every Risk Through Each Layer

Each layer only indicates where stress passes, not the type of damage it causes. The second dimension of assessment is precisely the damage type: credit risk, market risk, liquidity risk, plus categories unique to on-chain claims. These two dimensions do not map one-to-one; forcing a direct correlation obscures most paths by which risk reaches claims.

Take liquidity. Its entry points are numerous: underlying assets, exit rights and assets, withdrawal mechanisms and settlement queues, operators forced to recall capital, and on/off-chain services relied upon for exits. Thus, a vault can exhibit deep market liquidity yet still trap holders at entirely different entry points. Credit risk operates similarly: it enters via borrowers, but also through decisions, rules, and loss-sharing clauses between borrowers and holders. For every risk type, tracing it through all possible layers is essential for scoring to accurately reflect what holders collectively face.

Risk types also interact. As credit deteriorates, withdrawals often surge simultaneously, forcing asset fire sales in declining markets, compounding losses.

Measuring a risk typically requires two metrics to answer two questions. One is flow metrics, such as expected annualized credit loss or annual de-peg probability, indicating average annual losses or event frequency. The other is event metrics, such as stress scenario losses, revealing how bad the worst day could be. A product might show harmless flow metrics but severe event metrics, typical of tail risk. These metrics sit side-by-side; they cannot be summed or directly compared, as annualized expectations and single-event scenario losses measure fundamentally different things. For certain risks like exit runs, annual averages are meaningless, while scenario figures are telling.

Two additional rules prevent metric distortion. If a single stress event is touched by multiple risk types, it counts only once. An unestimatable metric is recorded as missing, never zero—zero would be misread as safety.

Step 5: How Deep Should Risk Assessment Penetrate?

All of this assumes you know what the vault actually holds. Rarely is this a single-step revelation. A vault share may sit behind an issuer's balance sheet; that sheet allocates capital across venues, venues operate markets, and markets lend against collateral. The underlying exposure sits at the end of this chain, and risk assessment must trace it all the way back—much like banking capital rules require banks to look through fund holdings and apply conservative treatments to opaque positions. This raises two practical questions: how deep to trace, and what to do when you hit an impenetrable wall.

Tracing must cover every position material to the claim, stopping where residual risk can be assessed holistically: a genuine repaying asset, an exposure already credibly evaluated by others, or an impenetrable segment. These rules ignore product labels; they simply recognize different node types along the path. How deep to analyze depends entirely on the structure itself.

Two details stand out during this process. First, concentration points. A single oracle, cross-chain bridge, custodian, or admin key may sit beneath several seemingly unrelated exposures. Individual paths through it may seem minor, yet they all rely on the exact same component. Thus, even if no single path is large, concentration points must be traced; they count only once and are treated as the weakest link—nothing supporting it can be stronger than it. A vault split across two lending markets that share one oracle has no diversification benefit regarding that oracle.

Second, unknown exposures. Undisclosed strategies or unregulated allocations must not be ignored—ignoring them equates to assuming they "average out." The correct approach: treat unknowns proportionally to their weight in the claim as severely as their opacity warrants. Unknowns also degrade the certainty of conclusions: the higher the proportion holders cannot see through, the more provisional any risk assessment becomes.

Step 6: The Weakest Link

Thus far, we arrive at a set of separate assessments. The clearest presentation keeps them distinct, providing one result per risk type. Forcing everything into a single number risks losing the propagation logic entirely.

Averaging allows strengths in one area to cancel out weaknesses in another. This is fine when factors are substitutable: better collateral can offset weaker borrowers regarding expected loss, as both mitigate the same credit exposure. But once these factors sit head-to-tail on the path to holders, averaging fails. No matter how solid the collateral, if an unprotected admin key can drain it, the strength is moot. In such cases, one layer failing is enough; averaging it with a strong layer describes a scenario holders would never encounter.

Therefore, the path dictates aggregation: average substitutable factors; let independent weaknesses that all losses must pass through set their own ceilings. Ceilings are ultimately judgments; too many reduce risk assessment to merely flagging the worst item. The goal is to lay out the assessment visibly for holders: does this conclusion reflect the overall profile, or is it bottlenecked by a single weakness?

What Risk Assessment Cannot Tell You

Conclusions drawn this way rank products by "the degree of protection afforded to holder claims," reflecting the state on evaluation day. They are not probabilities of loss. To convert conclusions into probabilities requires long-term tracking of actual loss frequencies across rating tiers—a record the on-chain market currently lacks. Historical losses mostly stem from a handful of market-wide events sweeping across numerous products; de-pegs are rare, minor incidents go unreported, and litigated claims are exceedingly scarce.

This is precisely where the value of the entire framework lies: originating from claims, it tells holders which failures impact them, potential loss magnitude, recovery timelines, and ultimate burden allocation. It places vault shares, stablecoins, and tokenized notes within a unified framework, making clear whether assessments rely on holistic profiles or are bottlenecked by a singular, unavoidable weakness. No single number can capture this information—which is exactly why losses must be tracked all the way to holders.