How to Determine Loss Attribution When DeFi Issues Arise?

Why do different holders have such varying outcomes from the same failure?

Written by: @mathy_research

Compiled by: AididiaoJP, Foresight News

In recent years, the risk rating of digital assets has expanded rapidly. Rating agencies and on-chain risk service providers now assess stablecoins, protocols, and lending vaults, with most work focused on the products themselves and their components: their reserves or portfolios, the managers responsible for operations, and the code that runs them.

These assessments provide holders with a wealth of information about the products. However, what holders really need to know is more specific: if an underlying link encounters a problem, how much of their claim will be lost, how long it will take to recover the remaining portion, and which holders will ultimately bear the losses.

The answers to these three questions depend on how the failure propagates from those components to the claims held by the holders. This article proposes a method to trace this path, applicable to various products, based on four core principles.

Four Principles

• Product-agnostic. The analysis starts from one question: how much can a holder claim upon exit, and what determines that amount? Vault shares, tokens redeemable at face value, and promissory notes can all be placed in the same framework, with product labels not altering the method.
• Loss and delay path. Failures can traverse various layers between assets and holders—code, individuals who can change rules, and automated rules. Each layer can absorb, slow down, or pass on the failure. The same event can yield drastically different results for two holders.
• Who bears the loss. Claim terms determine whether losses are absorbed by buffers, debtors, or holders; exit rules can shift losses from those who exit early to those who remain.
• Path. Some weaknesses can compensate for each other, such as good collateral offsetting a weak borrower, which can be scored collectively. However, some weaknesses are bottlenecks: no matter how good the vault's collateral is, a single administrator key without a time lock can transfer it away, rendering the quality of that collateral irrelevant. Such weaknesses cannot be averaged with strengths; they determine the upper limit on their own.
• The following sections will elaborate in this order: what claims are, what operational layers exist in between, how losses traverse them, and how they ultimately aggregate into conclusions.

Step One: What Can Holders Recover?

The first question is: what determines how much a holder can claim upon exit? There are only a few types of claims, each clearly indicating at which stage losses will fall on the holder.

Consider three comparisons. When holding a pool share, the holder receives a portion based on the pool's current value; if the asset depreciates, the loss immediately falls on them—most lending vault shares work this way. When holding a promissory note, regardless of how much the underlying asset earns, the debtor owes a fixed amount, and the holder only suffers a loss if the debtor defaults. When holding a token redeemable at face value, losses occur when redemption fails or prices break. Other claims follow the same logic: understanding what determines the amount reveals where the losses come from.

The type of claim determines what a failure means for the holder. In the case of a borrower defaulting: for pool shares, it results in an immediate write-down; for priority promissory payments, as long as the buffer below the claim remains intact, the payment amount does not change. However, what supports the claim, who controls it, and what code runs it are equally crucial—these aspects will be analyzed in the following layers but do not change the type of claim itself. Because the method starts from the claim, it treats vaults, stablecoins, or tokenized assets equally.

Step Two: The Five Layers Between Assets and Holders

Once the claims are clarified, the next step is to examine what lies between the claims and the assets that ultimately repay them. Counting from the bottom up, there are five layers. The lowest layer is the underlying exposure, which is the portion of the asset that generates value and absorbs losses first. The top layer is the holder's claim, which determines what the holder can actually receive and the exit terms.

Three operational layers are sandwiched in between. Closest to the assets are the smart contracts and infrastructure, including the code holding the assets and the systems it relies on, such as oracles, cross-chain bridges, and the blockchain itself. The next layer up is control, referring to entities that can change exposures, terms, or valuations, and the boundaries of their modifications. Closest to the holders is the mechanism, which consists of rules that automatically transfer value without requiring any decisions, such as liquidation and withdrawal limits.

The reason for layering is that each layer fails in different ways. Code and infrastructure can fail without any human decision: if the chain halts or the oracle fails, regardless of the issuer's willingness, exits will be stalled, and assets may be mispriced. Failures in the control layer stem from human decisions, so what truly matters is the extent of each power's range and how much delay there is before it takes effect. The mechanism layer responds to pressure according to rules; behaviors can be derived from parameters and market conditions; once conditions change faster than the rules, it will fail.

Step Three: How Losses Propagate to Holders

With the layers established, the propagation path becomes clear. Pressure starts from the underlying exposure and moves towards the holders, carrying two things: the loss of value and the time it takes to recover that value. Each time it crosses a layer, a portion of these two items is cut off, and only what remains continues upward.

Pressure can also generate internally at a certain layer. A code failure or a bad decision does not have to start from the bottom; it can emerge from a middle layer and still propagate all the way to the claims.

Underlying exposure. The starting point of propagation is defaults, price drops, reserve shortages, or custodian failures, which reduce the value supporting the claims. How much can be recovered and how quickly depends on collateral, buffers, and legal recourse; the unrecoverable portion continues upward. In reality: a borrower defaults, and the collateral sells for less than the debt; a custodian fails, and isolated assets take months to return; reserve assets depreciate, and tokens fall below par.

Smart contracts and infrastructure. The first operational layer adjacent to the assets consists of the code holding the assets and the facilities that support transactions and prices. Code flaws, privileged operations, chain halts, cross-chain bridge failures, and service interruptions can occur without warning. The extent to which an event can affect value depends on on-chain limits, delays, and redundancies; what truly reaches the claims manifests as stolen funds, trapped funds, mispricing, or halted exits. Upgrades without delays can directly replace vault logic; if a cross-chain bridge is compromised, the collateral from the past may become worthless; if the chain halts, no one can exit until it restarts.

Control. Above that is the control layer, where human decisions come into play. If someone changes configurations, parameters, or valuations, that decision will alter exposures, values, or liquidity within the constraints. What truly matters here is the delay before changes take effect and the time required for holders to exit. If holders can leave before changes take effect, and the exit channel accommodates everyone, they can refuse that risk; if not, a bad or malicious decision will directly impact the claims. A manager allocates funds into a market that later generates bad debts; an operator fails to recall funds, and the exit queue exceeds the buffer; a compromised signer changes limits without delay.

Mechanism. Closest to the holders is the mechanism layer, where rules automatically respond to incoming pressure. Price changes, withdrawal surges, and funding rate fluctuations come in, interest rates adjust accordingly, liquidations trigger, queues fill up, and interest continues to accrue. How quickly pressure propagates and how much is absorbed is determined by parameters. When rules fail, pressure turns into losses or delays: collateral drops faster than liquidation sales, leaving bad debts; utilization hits a ceiling, withdrawals get blocked; exit assets fall below par while interest rates continue to rise.

Holder claims. The pressure that traverses the lower layers and ultimately reaches the claim terms is determined by those terms, which decide who absorbs the losses: holders, buffers, or debtors. Whether a holder can enforce payment legally or by code determines whether they receive funds; exit rights and exit assets determine what and when they receive. This layer can also transfer losses among holders. If the gates close while the book value still reports at par; or if early leavers exit at full value before impairment confirmation, the losses fall on those who remain. What each person bears is more than just the proportion they should bear.

Looking along the entire path, the same underlying event can yield vastly different results for two holders. A borrower default in one product may be absorbed by a buffer, in another product it may result in delayed write-downs, and in a third product it may trigger a run, pushing losses onto late leavers. Therefore, risk assessments must follow the path—merely looking at the event itself does not reveal which outcome a holder will encounter.

Step Four: Every Risk Must Be Viewed Layer by Layer

Each layer can only tell you where pressure passes through but cannot reveal what type of damage it causes. The second dimension of assessment is the type of damage: credit risk, market risk, liquidity risk, along with several types unique to on-chain claims. These two dimensions do not correspond one-to-one; forcing them to correspond obscures most paths through which risk reaches the claims.

For example, liquidity has multiple entry points: the underlying asset is one, exit rights and exit assets are another, withdrawal mechanisms and settlement queues are another, and the operator that must recall funds is yet another, along with the on-chain or off-chain services relied upon for exit. Thus, a vault may have deep liquidity in the market but still block holders at other entry points. Credit risk is similar: it comes from the borrower, as well as from decisions, rules, and loss-sharing terms between the borrower and holders. Each type of risk must be traced through every layer it may pass through to clarify what the holders face overall.

Risk types can also interact with each other. When credit deteriorates, withdrawals often increase simultaneously, forcing assets to be sold in a declining market to meet exits, compounding losses.

Measuring a type of risk typically requires two indicators to answer two questions. One is a flow indicator, such as expected annual credit loss or annual de-pegging probability, which tells holders how much loss and how many events to expect on average each year. The other is an event indicator, such as losses under stress scenarios, which tells holders how bad the worst day can be. A product may appear harmless from the flow indicator but severe from the event indicator, which is a typical manifestation of tail risk. The two indicators should be presented side by side, but cannot be summed or directly compared: annual expectations and single scenario losses measure different things. For certain risks, such as exit runs, annual averages do not convey much, while scenario numbers reveal the issues.

There are also two rules to prevent distortion of indicators. If a single stress is triggered by multiple risk types, it should only be counted once. An indicator that no one can estimate should be recorded as missing, never as zero—zero can be misinterpreted as safety.

Step Five: To What Layer Should Risk Assessment Penetrate?

The above assumes you know what the vault actually holds. However, the answer is rarely visible in one step. Behind a vault share may lie a balance sheet of an issuer; this sheet allocates funds to various locations, which operate markets, and those markets lend out collateral. The underlying exposure is at the end of this chain, and risk assessment must trace all the way there—just as banking capital rules require banks to penetrate fund holdings and conservatively treat opaque holdings. This leads to two practical questions: how deep to trace, and what to do if you cannot trace.

Tracing must cover every position important to the claims, stopping where residual risks can be judged as a whole: an asset that genuinely repays the claims, an exposure that has already been credibly assessed by others, or a portion that no one can see into. These rules do not regard product labels; they simply differ in the types of nodes along the path, and how deep to analyze depends on the structure itself.

In this process, two details are crucial. The first is concentration points. An oracle, a cross-chain bridge, a custodian, or an administrator key may simultaneously press down on several seemingly unrelated exposures. Each path passing through it may seem small, but together they all rely on the same thing. Therefore, even if no single path is particularly large, concentration points must be traced; they only count once and are treated as the weakest link—what relies on them cannot be stronger than them. If a vault is spread across two lending markets, but both markets share one oracle, then it has no diversification concerning that oracle.

The second is unknown exposures. Undisclosed strategies and configurations without enforced limits cannot be overlooked—overlooking them is equivalent to assuming they are