Why is the result of the same fault so different for different holders?

Written by: @mathy_research

Translated by: AididiaoJP, Foresight News

In recent years, the expansion of risk ratings for digital assets has been rapid. Rating agencies and on-chain risk service providers are now assessing stablecoins, protocols, and lending vaults, with most of the work focusing on the products themselves and their components: their reserves or investment portfolios, the managers responsible for their operation, and the code that runs them.

These assessments provide holders with a wealth of information about the products. However, what holders really need to know is more specific: If a problem occurs in some underlying link, how much of their claim will be lost, how long it will take to get back the remaining part, and ultimately, which holders will bear the losses.

The answers to these three questions depend on how the fault is transmitted from the components to the claims in the hands of the holders. This article proposes a method to track this path, applicable to various products, with four core principles.

Four Principles

• Product Agnostic. The analysis starts with one question: How much can holders claim upon exit, and what determines that? Vault shares, tokens redeemable at face value, notes promising payment, are put into the same framework, with product labels not changing the method.
• Loss and Delay Path. Failures can pass through various layers between the assets and holders - code, those who can change the rules, and the rules that are automatically executed. Each layer can absorb it, slow it down, or pass it along. The same event may yield completely different results for two holders.
• Who Bears. The claim terms determine whether the losses are absorbed by buffers, debtors, or holders; exit rules can transfer losses from those who exit early to those who remain.
• Path. Some weaknesses can compensate for each other; for example, strong collateral can offset a weak borrower, which can be scored collectively. But some weaknesses are on the critical path: no matter how strong the vault's collateral is, a single administrative key without a time lock can move it, making the quality of collateral irrelevant. Such weaknesses cannot be averaged with strengths, as they solely determine the limit.
• The following unfolds in this order: What is a claim, what operational layers are in between, how losses traverse them, and finally how they consolidate into conclusions.

Step One: What Can Holders Recover

The first question is: What determines how much holders can claim upon exit? Claim rights actually have only a few types, each clearly stating where the losses will fall on the holder.

Let's contrast three groups. When holding a pool share, holders receive a portion according to the current pool value; if the asset depreciates, the loss immediately falls on them - this is how most lending vault shares work. When holding a note promising payment, regardless of how much the underlying assets earn, the debtor owes a fixed amount, and holders are at a loss only if the debtor defaults. When holding a token redeemable at face value, losses occur when redemption fails or the price breaks below par. Other claims work similarly: figuring out what determines the amount tells us where the losses come from.

The type of claim determines what a fault means for holders. In the case of a debtor defaulting: for pool shares, it is an immediate write-down; for priority payment commitments, as long as the buffer below the claim is not exhausted, the payment amount remains unchanged. However, what supports the claim, who controls it, and what code it runs are also crucial - these will be analyzed in the layers below but do not change the nature of the claim itself. Because the method starts from the claim, it treats vaults, stablecoins, or tokenized assets equally.

Step Two: The Five Layers Between Assets and Holders

Once the claims are clarified, the next step is to see what lies between the claims and the assets that ultimately repay them. Counting from the bottom, there are five layers in total. The bottom layer is the underlying exposure, which is the part of the asset that generates value and absorbs losses first. The top layer is the holders' claim rights, which are the rights and exit terms that determine what holders can actually retrieve.

Three operational layers are sandwiched in between. The layer closest to the assets is the smart contracts and infrastructure, including the code that holds the assets and the systems it relies on, such as oracles, cross-chain bridges, and the chain itself. One layer up is control, referring to the entities that can change the exposure, terms, or valuation, and where their boundaries for change lie. The layer closest to the holders is the mechanism, which is the rules that automatically transfer value without requiring anyone to make decisions, such as liquidation and withdrawal limits.

The reason for layering is that each layer fails in different ways. Code and infrastructure can fail without any decisions made: if the chain stops or the oracle disconnects, regardless of whether the issuer is willing, exits will be frozen, and the asset will be mispriced. Failures at the control layer, however, stem from human decisions, so what truly matters is how extensive each authority's power is and how much delay there is before it takes effect. The mechanism layer responds to pressure according to rules; behaviors can be inferred from parameters and market conditions; once the conditions change faster than the rules, it fails.

Step Three: How Losses Traverse to Holders

With the layers established, the transmission path is clear. Pressure starts from the underlying exposure heading toward holders, carrying two things: the loss of value and the time to wait to recover this value. As it passes through each layer, a part of each of these two things gets cut off, with only whatever remains continuing upward.

Pressure may also arise internally at a certain layer. A coding fault or a bad decision does not necessarily have to start from the bottom layer; it can emerge in any intermediate layer and still transmit all the way to the claims.

Underlying exposure. The starting point of the transmission is a default, price drop, reserve shortage, or custodian failure, which diminishes the value underpinning the claims. How much can be recovered and how quickly, depends on collateral, buffers, and legal recourse; the portion that cannot be recovered continues moving upwards. In reality: a debtor defaults, and the collateral cannot be sold for the debt value; a custodian fails, and isolated assets will take months to return; reserve assets depreciate, causing the tokens to fall below par.

Smart contracts and infrastructure. The first operational layer closest to the assets consists of the code that holds the assets and the facilities that facilitate transactions and pricing. Code flaws, privileged operations, chain stoppages, cross-chain bridge failures, and service interruptions can all occur without warning. The extent to which an event impacts value depends on limits, delays, and redundancies on the chain; what truly reaches the claims manifests as stolen funds, trapped funds, mispricing, or halted exits. Upgrades without delays can directly replace vault logic; if a cross-chain bridge is breached, collateral locked in the past may become worthless; when the chain halts, no one can exit until it restarts.

Control. Moving up to the control layer, the impact comes from human decisions. Someone alters the configuration, parameters, or valuation, and this decision will change exposure, value, or liquidity within the constraint range. What truly matters here is the delay before the changes take effect and how much time holders need to exit. If holders can leave before the changes take effect, and the exit pathway can accommodate everyone, they can refuse this risk; if not, a bad or malicious decision will directly affect the claims. The manager allocates funds to a market that later generates bad debts; the operator fails to recall funds, leading to exits queuing beyond the buffer; a compromised signer instantly changes the limits without delay.

Mechanism. Closest to the holders is the mechanism layer, where rules automatically respond to the pressure that has passed through. Price changes, withdrawal surges, and funding rate fluctuations come in, leading to interest rate adjustments, triggering liquidations, and filling queues. How quickly pressure is transmitted and how much is absorbed is determined by parameters. When rules fail, pressure turns into losses or delays: collateral falls faster than liquidation can sell, leaving bad debts; utilization hits a peak, withdrawals are blocked; exit assets drop below par, yet interest rates continue to rise.

Holders' Claim Rights. The pressure traversing through the lower layers, ultimately landing on the claim terms, determines who absorbs the losses: holders, buffers, or debtors. Whether holders can compel payment under the law or via code determines whether they can retrieve funds; exit rights and exit assets dictate what and when they receive. This layer also allows for the transfer of losses among holders. If the gates close, yet the book value still reports at face value; or if someone exits at full amount before impairment confirmation, losses will fall upon those who remain. Each person's burden is not merely the proportion they should bear.

Looking along the entire path, the same underlying event may yield vastly different results for two holders. A debtor default, in one product could be absorbed by a buffer, in another product turns into delayed write-downs, or in a third could trigger a run, pushing the losses onto later redeemers. Therefore, risk assessments must follow the path - just looking at the event itself does not disclose what type of result holders will encounter.

Step Four: Every Type of Risk Must Be Viewed Layer by Layer

Each layer can only tell you where the pressure passes through, but cannot indicate the type of damage it causes. The second dimension of assessment is the type of harm: credit risk, market risk, liquidity risk, along with a few others unique to on-chain claims. These two dimensions do not correspond one-to-one; forcing them into correspondence obscures most pathways for risk to reach the claims.

For liquidity, for example, there are multiple entry points: the underlying asset is one, the exit rights and exit assets are one, the withdrawal mechanism and settlement queue are another, and the operating party that must recall funds is another, with on-chain or off-chain services relied upon for exits being yet another. Therefore, a vault may have deep liquidity in the market while still blocking holders at other entry points. Credit risk is similar: it comes from the debtor, but also from decisions, rules, and loss-sharing terms between the debtor and holders. Each type of risk must be traced through every layer it might pass through to clearly assess what holders face as a whole.

Types of risks can also interact with each other. When credit deteriorates, withdrawals often increase simultaneously, forcing the assets to sell in a declining market to accommodate exits, leading to compounded losses.

Measuring a type of risk generally requires two indicators, as it needs to answer two questions. One is a flow metric, such as expected annual credit loss, or annual de-pegging probability, informing holders how much loss and how many events to expect on average each year. The other is an event metric, such as losses under stressful scenarios, informing holders how bad things can get on the worst day. A product may look harmless from the flow metric perspective, but have serious implications from the event metric, which is typical of tail risks. The two indicators placed side by side cannot be added together and cannot be compared directly: expected annualized values and single scenario losses are measuring different things. For some risks, like exit runs, the annual average means little; it’s the scenario figures that illuminate the issue.

There are also two rules to prevent indicator distortion. If a single stress event affects multiple types of risk, count it only once. An indicator that nobody can estimate should be marked as missing, and must never be recorded as zero - as zero might be misread as safety.

Step Five: To Which Layer Should Risk Assessment Penetrate?

All of the above assumes you know what the vault actually holds. However, the answers are rarely visible at a glance. Behind a vault share, there may be a balance sheet of an issuer; this balance sheet allocates money to various locations, places operate markets, and markets then use collateral for lending. The underlying exposure lies at the end of this chain, and risk assessments must trace there - just like how banking capital rules demand banks to penetrate into fund holdings and conservatively handle opaque holdings. This leads to two practical questions: how deep to trace, and what to do if you cannot trace.

Tracking must cover every position important to the claims, stopping at places where residual risks can be judged as a whole: a truly redeemable asset for the claims, an exposure already trusted and assessed by others, or a part that no one can see into. These rules do not regard product labels; the types of nodes on the path differ only, and how deep analysis should go depends on the structure itself.

Within this process, two details are paramount. The first is concentration points. An oracle, a cross-chain bridge, a custodian, an administrative key may simultaneously weigh down several seemingly unrelated exposures beneath them. Each path through it may appear small, but together they all rely on the same thing. Therefore, even if no single path seems particularly large, concentration points must be traced; they count once only, processed as the weakest link - what depends on it cannot be stronger than it. If a vault is dispersed across two lending markets, yet both markets share one oracle, then it has no diversification regarding that oracle.

The second is unknown exposures. Undisclosed strategies and configurations without mandated limits must not be overlooked - overlooking them equates to defaulting to considering them "average." The correct approach is: treat them as weak according to their proportion in the claims. Unknown portions will also lower the certainty of the conclusion: the higher the proportion that holders cannot see into, the more any risk assessment can only be viewed as a temporary conclusion.

Step Six: The Weakest Link

So far, what we've arrived at is a set of separate assessments. The clearest way to present them is to keep them separate, providing a result for each type of risk. If pressed to compress them into a single number, doing so at this step easily loses the transmission logic.

Averaging will cause strengths in one place to offset weaknesses in another. This approach is acceptable when multiple factors can compensate for each other: viewed through expected losses, better collateral can compensate for weaker borrowers, since both reduce the same amount of credit loss. However, once these factors connect end-to-end on the path to the holders, averaging becomes ineffective. Even the best collateral does not mean much if a single administrative key without a time lock can move it. In such cases, the failure of one layer is sufficient; averaging it with strong layers describes a state that a holder cannot possibly encounter.

Thus, the path dictates how to summarize: if factors can compensate for each other, take the average; if weaknesses through which every loss must pass can individually set limits. Each limit ultimately is a judgment, and as the limits increase, risk assessments deteriorate to only considering the worst one. The goal is to open the assessment, allowing holders to see: whether this conclusion reflects the overall situation or is blocked by a weakness.

What Risk Assessment Cannot Tell You

The conclusions drawn this way rank the strength of “claim rights protection for holders” between products, reflecting the state on the day of assessment. However, it does not indicate the probability of losing money. To convert a conclusion into a probability, it requires long-term records of how many times products at each assessment level have actually incurred losses, and the on-chain market lacks such records. To date, most losses have come from a few market events that swept many products; de-pegging is rare, small accidents are often unreported, and truly litigated claims are few.

Because of this, the value of the entire analysis lies here: starting from claim rights, it informs holders which failures could fall on them, how much loss they might incur, how long they might have to wait, and ultimately whether they bear the burden themselves or another holder does. It places vault shares, stablecoins, and tokenized notes into the same framework, also showing: whether the evaluation relies on the overall situation or a particular weak point that every loss must traverse. A single number cannot encapsulate this information - this is precisely why losses must be traced through to the holders.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。