Vault Credit Risk

TL;DR

For an ERC-4626 vault, the share price is the depositor's mark-to-market. When it falls below entry, the depositor takes a loss that reflects a shortfall inside the vault. Every input to that shortfall, oracle prices, liquidation execution, available pool depth, gas costs, network congestion, is endogenous to the vault's mechanical environment. None are fixed. Several are adversarially targeted in stress.

The framework from Anastasiia (@mathy_research), "DeFi Lending Credit Risk: A Three-Part Framework" (Vault Summit, April 2026), measures these mechanical channels directly across five dimensions. It is not a replacement for standard credit-risk analysis, it is a correction for the parts standard analysis assumes away.

Why mechanical risk needs its own framework

TokenIntel's DeFi Risk Methodology follows Anastasiia's three-layer taxonomy: mechanical risk (Layer 1), governance risk (Layer 2), and code-integrity risk (Layer 3). This page focuses exclusively on Layer 1, the losses a vault can take while the contracts work as designed and the governance process behaves as expected. The five channels below do not score audit depth, upgrade authority, parameter-setting quality, or bridge dependencies. Those live in the other two layers.

A single ordering rule governs all of it, and it is easy to get wrong: measure Layer 3 first. If annualized code-integrity failure probability over your horizon exceeds the expected Layer 1 loss over the same horizon, tuning the mechanical channels is not rank-ordering your risk, it is rearranging deck chairs on a boat whose dominant failure mode is something else entirely. Clear Layer 3, then measure Layer 1.

The five metrics

Each metric corrects a specific simplification that traditional credit-risk analysis carries over into DeFi without checking whether the simplification still holds. The attributions below summarize Anastasiia's framing; the intuition and worked examples are TI's.

The five channels in the wild: a 2025-2026 incident catalog

The channels are abstractions. They become concrete in the incidents that actually cost depositors money over the past year. Each of the five recent stress events below maps cleanly onto one or more V-channels, and reading them as channel exposures (rather than as one-off accidents) is the point of the framework. Where an incident touches multiple channels, those are the multiplicative interactions a multiplicative VCS would have flagged.

Stream Finance / xUSD collapse (November 2025)

Channels exposed: V1 (coverage), V3 (liquidity), V4 (oracle). xUSD was a synthetic stablecoin accepted as collateral across Morpho and Euler vaults, holding $520M in TVL backed by only $160M in actual user deposits. The protocol was running roughly 3.25x leverage at the structural level before any individual user looped. When an external fund manager lost $93M, the asset depegged on secondary markets to a 70-80% discount, but the xUSD oracle feeds stayed pegged to $1, blocking the liquidations that would have contained losses (V4 latency). Vault utilization hit 100% as depositors raced for the exits (V3 stress), and stress-effective coverage on positions backed by xUSD collapsed (V1). Direct loss was $93M; ecosystem cascade through curator-managed vaults pushed total impact into the hundreds of millions. (Source: Castle Labs, "Vaultification of Finance," May 2026.)

Resolv / USR exploit (March 2026)

Channels exposed: V1 (coverage), V4 (oracle). An attacker minted roughly 80M unbacked USR tokens through a compromised signing key with only ~$100K-$200K of real collateral. USR and wstUSR depegged on secondary markets immediately, but Morpho and Fluid continued valuing wstUSR near the pre-depeg oracle price of ~$1.13. Traders bought cheap USR on the open market and deposited it at face value to drain the affected vaults. Bad debt cascaded across 15 Morpho vaults (~$10M) plus ~$21M on Fluid. The pre-existing Resolv worked example under V4 above covers the oracle-latency mechanism; this entry adds the cross-protocol fan-out: 16+ vaults across two protocols absorbed loss from a single oracle-stale window. (Source: Castle Labs, May 2026.)

Aave wstETH CAPO incident (March 2026)

Channels exposed: V4 (oracle), V2 (recovery). Aave's CAPO risk oracle priced wstETH at ~1.19 ETH while the market was at ~1.23 ETH, a 3.3% gap. The pricing error triggered the liquidation of 34 fully-collateralized accounts in a single block, generating $27.78M in erroneous liquidations before the error was corrected. The protocol mechanically did exactly what it was configured to do; the oracle just told it wrong (V4). Recovery endogeneity (V2) compounded the loss because the affected positions had to clear into the same block-level execution environment that liquidations under genuine stress would. The combined exposure is the right reading: a single channel weakness, in this case V4, triggered cross-channel propagation. (Source: Castle Labs, May 2026.)

JELLY incident on Hyperliquid HLP (Q1 2026)

Channels exposed: V5 (execution viability), V2 (recovery endogeneity). An attacker opened $4.05M in longs and a $4.1M short on JELLY at 20x leverage, covering roughly 40% of the token's circulating supply, then pumped JELLY spot across exchanges to liquidate their own short and trap the HLP on the losing side. HLP could not clear the position in the open market (V5 execution viability under stress, V2 recovery endogeneity at the limit of a thin venue). Hyperliquid's team manually delisted JELLY, closing the short for a $700K gain and avoiding a worst-case loss of more than $13M. The clean V5/V2 reading: when execution viability requires an action the smart contract cannot autonomously take, human override becomes the recovery mechanism, and the "decentralized" framing shows its limits. (Source: Castle Labs, May 2026.)

Venus zkSync wUSDM Donation Attack (March 2025)

Channels exposed: V1 (coverage), via an ERC-4626 mechanical pathway. An attacker exploited the share-rounding edge case in ERC-4626's standard implementation. By depositing 1 wei to a fresh vault to mint 1 share, then directly transferring (not depositing) a large amount of the underlying asset, the attacker inflated the share-to-asset ratio so that subsequent depositors below the threshold minted zero shares due to integer rounding and their assets accrued to the existing share pool, which the attacker controlled entirely. Roughly $700K of wUSDM was extracted before mitigations were applied. Strictly speaking this is a code-pathway attack rather than a mechanical V1 failure, but its effect on depositor coverage is identical: deposit assets, get zero share value back. The mitigation is internal balance tracking inside the vault rather than reading the underlying token balance at deposit time. (Source: Castle Labs, May 2026.)

Redemption-tier frameworks: codifying the issuer-side guarantee

The five-channel framework above is a vault-level instrument. It scores how a given lending market converts environmental stress into depositor loss. A second pattern lives one layer up: how an issuer with a backing book codifies the liquidity guarantee it makes to redeemers. The two problems are different, the underlying architectural move is the same, and the second is becoming the more interesting half of the picture in 2026.

The pattern

An issuer with a backing book (a stablecoin issuer, a tokenized-RWA fund, a vault that promises instant withdrawal) faces a structural mismatch: redemptions arrive on a one-day horizon while the assets behind them clear on horizons that range from one day (Treasuries, USDC) to many days (private credit, lending positions). The classical answer is discretionary: "we will manage redemption operationally." That answer is functionally a request for the holder to trust the issuer's judgment under stress, which is exactly when judgment is hardest.

The codified answer partitions the backing book by settlement horizon, measures coverage against empirical worst-case redemption flow at each horizon, and ties a public response (extend the cooldown, throttle the queue) to a published threshold. Three components matter:

1. Tier the book by settlement horizon, not by asset class. Blue-chip stablecoins, the live mint/redeem balance, and any one-day-settling buffer make up Tier 1. Two-day-settling assets (yield-bearing stables, withdrawable lending exposure, tokenized RWAs with short redemption queues) make up Tier 2. Slower-clearing positions are Tier 3+. The depositor's question is not "what are the assets?" but "how fast can each piece of the book turn into cash?"
2. Calibrate against empirical P99 redemption flow, not a fixed percentage of supply. The right buffer floor is large enough to absorb the 99th-percentile observed redemption day at each horizon, multiplied by a safety factor. A 1.5x multiplier is the published example. The benchmark moves as the issuer's redemption history grows.
3. Tie the cooldown response to coverage, not to discretion. If Tier 1 alone clears the one-day floor with margin, the cooldown stays at one day. If it cannot, the cooldown extends to two days (and Tier 2 is the binding bucket), then five days (and Tier 3 is in play). The response is mechanical, the rules are public, and the discretion shrinks.

Worked example: Ethena's dynamic sUSDe cooldown (March 2026, April stress test)

On March 16, 2026, Ethena replaced the static sUSDe cooldown with this structure. Tier 1 holds blue-chip stables, the USDtb instant buffer, and the live mint/redeem balance. Tier 2 holds yield-bearing stablecoins, withdrawable lending exposure, and (from June 2026) tokenized RWAs including Janus Henderson's AAA CLO ETF (JAAA) and Securitize's STAC. Tier 3 is the residual loan book. The P99 benchmarks: 4.1% of USDe supply in one day, 9.2% over three days, 12.0% over seven days, each scaled by 1.5x.

The April 2026 KelpDAO bridge incident (covered from the Aave side on the Morpho research page) drove $1.97B of correlated redemptions through Ethena over six consecutive days. Tier 1 contracted 51.9%, from $2.75B to $1.32B. At the tightest point, headroom above the one-day buffer floor was $1.08B and one-day coverage was 5.47x. The framework held; the operational cooldown stayed at one day; no codified threshold was breached.

The case is not closed by one stress event, but the empirical record is now non-zero. TI's Ethena page documents both the framework mechanics and TI's pushback on the slow-bleed pattern visible in the post-stress recovery.

TradFi anchors and why the pattern is legible

The structure is not novel as financial engineering. It is the onchain version of two mature regulatory frameworks:

• Money-market fund Rule 2a-7 (US SEC, 1983 baseline, 2014 amendments). Caps weighted-average maturity at 60 days and weighted-average life at 120 days. Imposes daily and weekly liquidity floors (10% daily, 30% weekly) so that a fund can clear a published share of redemptions inside known horizons. The 2014 amendments added swing pricing and gating mechanisms that look exactly like Ethena's cooldown-extension logic.
• Basel III Liquidity Coverage Ratio (LCR). Banks must hold high-quality liquid assets sufficient to cover 30 days of net cash outflows under a calibrated stress scenario. The HQLA categorization (Level 1, Level 2A, Level 2B) is the same shape as redemption tiering, just calibrated for a longer horizon and a different liability mix.

Onchain redemption-tier frameworks are reinventing this pattern from first principles because the alternative, discretionary management, does not survive contact with depositors who can withdraw atomically. The TradFi parallels are useful for two reasons: they tell a sophisticated holder what to ask for in any issuer's framework, and they give the issuer's design a reference point for what good actually looks like.

What to look for in any issuer's framework

• Are the tiers defined by horizon, not by asset name? Asset-name tiering ("blue-chip stables vs RWAs") collapses different settlement profiles into a single bucket and obscures the real exposure.
• Are the P99 benchmarks empirical or assumed? A benchmark calibrated against the issuer's own redemption history is harder to game than one set by analogy to "typical" stablecoin flows.
• Is there a safety factor, and is it documented? A 1.5x multiplier on the P99 is a defensible floor. Numbers below 1.2x suggest the issuer is using the benchmark as a target rather than a floor.
• Is the cooldown response mechanical or discretionary? The point of the framework is to remove the issuer's discretion at the moment when the issuer most wants to exercise it. A framework that includes a "we may extend the cooldown" clause is operationally identical to no framework.
• What is the relationship between the headline coverage and Tier 1 in isolation? A healthy multi-tier coverage number can mask a depleted Tier 1 buffer when a recovery is funded through slower-settling backing. The holder who relies on one-day instant redemption is exposed to Tier 1, not the headline.

Who is building this in production for tokenized RWAs

The pattern is implemented today by six distinct products. Each picks a different cost structure, KYC posture, and asset surface, and each carries its own counterparty risk. The differences are real and they matter for any depositor sizing a position.

• RedStone Settle (April 2026): KYC-verified solver auction. A user requests redemption, whitelisted solvers bid USDC, the winning solver fills at T+0 and is reimbursed at T+1 or T+2 once the issuer settles. Pricing is auction-driven; the winning bidder's margin captures both the duration risk and any post-settlement carry. Atomic, cross-chain, and the solver list is permissioned but grows over time.
• Upshift Clear (May 2026): Vault-funded redemption. The Clear vault holds USDC posted by lenders, who earn a fee spread plus underlying yield accrual during the settlement window. Flat 50 bps fee to the redeemer. Initial asset surface is Superstate USCC, with a stated path to broader Carry-Fund-style products.
• Grove Basin (May 2026): Institutional-grade redemption corridor with named partners (BlackRock BUIDL, Janus Henderson JTRSY) and capacity sized to $1B daily. Tokenization workflow via Securitize and Centrifuge, access through Anchorage, Galaxy, and FalconX. Built for regulated counterparties that cannot use permissionless solver auctions. Pricing is bilateral and not publicly posted. The Sky-Star perspective on Basin is documented on TI's Sky ecosystem section.
• Agra: Central limit order book for tokenized credit. Makers post bids below NAV, capture the discount plus accrued yield, and either hold to maturity or resell. Takers swap one asset for another at the prevailing book. Effective fee depends on the depth at trade time. Current markets include wmtUSDC (Wintermute via Wildcat) and ACRDX (Anemoy Apollo Diversified Credit Fund).
• 3F: Targets the looping use case specifically rather than redemption-generic. Externalizes the gap to two protocol-defined roles: one fronts capital for position entry and provides exit-side liquidity, the other handles instant unwind on the user's own deposit. Spread is priced into the loop economics. $7.7M in net loop AUM as of writing.
• Fission: Instant redemption protocol for ACRED, ACRDX, JAA. The simplest of the six designs and the most expensive: a flat 564 bps fee, materially higher than Settle (auction-priced) or Clear (50 bps). Practically liquidity-thin, which compounds the headline fee through slippage on larger redemptions.

The chicken-and-egg honest note

Every product on this list solves the redemption gap by accepting duration risk in exchange for a spread, and needs enough capital on the supply side to make that spread sustainable. In practice they all face the same circular problem: thin liquidity raises slippage, which discourages flow, which keeps liquidity thin. The duration-risk-for-spread economics should eventually clear because the spread is real and the risk is bounded, but the current state is one in which the products designed to solve a coverage problem are themselves coverage-constrained. The depositor's read-through is that "instant redemption" for tokenized RWAs today is most credible at the auction (Settle) and the institutional corridor (Basin); the others trade convenience for cost, sometimes by a lot.

The Vault Credit Score (VCS): one score, two operators

The five channels give you five numbers. A score compresses them into one. Anastasiia proposes two aggregation operators, and which one you use depends on what question you're answering.

Both operators start the same way: map each V-metric to a normalized value in [0, 1], where higher means lower risk (so "1" means the channel is robust; "0" means the channel has failed).

Additive (weighted average)

Right for routine dashboard monitoring when the five channels are partially independent. A weakness in one channel is offset in the score by strength in others, which is the behavior you want when the channels fail mostly independently. A pedagogical nod: the split-credit-ratings literature shows that averaging independent noisy estimates inherits an throughput advantage over any single estimate, the same logic applies here when the stress regimes are genuinely uncorrelated.

Multiplicative (geometric)

By the AM-GM inequality, VCS_mult ≤ VCS_add always, weakly, with equality only when all V-scores are equal. Zero on any single metric forces the score to zero. This is the right behavior for correlated stress regimes, where a simultaneous collateral shock, depth depletion, and gas spike degrade all five channels jointly. In that world, a weak link breaks the chain, and the multiplicative operator honors that.

The gap between them is itself a signal

A large gap between VCS_add and VCS_mult tells you something the additive score alone hides: the vault's risk is concentrated in one or two channels rather than spread evenly across five. The average is masking a weak link. When the gap widens, it usually means a single V-metric is approaching zero while the others are fine, which is exactly the profile that multiplicative scoring is designed to flag.

In practice, if you're only going to track one thing on a vault, track the ratio VCS_mult / VCS_add. It compresses into one number both "how good is this vault?" and "how concentrated is its risk?"

Scope and honest limits

VCS is a Layer 1 structural score. It does not answer:

• Whether the parameters are well-calibrated. A vault with a correctly normalized coverage score of 0.9 under one stress set might score 0.4 under a slightly harsher one. Stress-set design is a Layer 2 / governance-quality question, not a Layer 1 measurement.
• Whether the contracts are secure. If a Layer 3 failure (bug, exploit, unauthorized upgrade) is binding, these channel scores are informational only, the loss path is something they can't see. The DeFi Risk Methodology page covers the Smart Contract and Admin Architecture dimensions that score this.
• Whether Layer 3 is dominant in the first place. The dominance condition belongs earlier in the stack than any mechanical measurement. If your holding-horizon code-integrity failure probability exceeds expected mechanical loss, improving these channels doesn't reduce total expected loss, clearing Layer 3 does.

The right way to use VCS is as a conditional risk score: "given that the contracts execute as designed and the governance process behaves as expected, this is how the vault performs in stress." The full risk picture is VCS plus the Layer 2 and Layer 3 scores sitting on top of it.

The rating-agency layer is forming

A depositor running this framework manually for every vault they consider is not a scalable model. The natural next step is third-party rating: someone else computes a comparable score across vaults, the depositor consumes the rating, and the parameter-by-parameter analysis becomes an audit on the rating agency rather than on each vault. This is how TradFi credit works (S&P, Moody's, Fitch), and an analogous layer is emerging for onchain vaults. None of the firms below are yet at coverage-and-credibility parity with the TradFi incumbents, but each is building a piece of the eventual rating stack.

• Xerberus. Risk ratings for digital assets including vaults. IPOR Fusion vaults are or will be independently risk-rated by Xerberus, providing the third-party verification leg that institutional allocators require before deploying capital.
• Credora. Credit-rating infrastructure originally built for centralized lending counterparties, extending into onchain vault rating. Methodology decomposes each strategy and assigns scores per risk factor.
• Firelight (incubated by Sentora). Risk pricing and insurance products as infrastructure, providing ratings for digital assets including vaults.
• Securitize Vault Registrar. Third-party NAV reporting on tokenized funds, plus an ERC standard mapping each investor to their identity for RWA-in-DeFi compliance. Different layer (identity + NAV) but feeds rating workflows.
• Sentora discovery and risk monitoring. Built on top of Upshift vaults; surfaces risk metrics for the broader vault ecosystem rather than just one curator's products.
• Blockworks vault credit scoring. Develops a standardized framework with the same three-layer structure as Anastasiia's: Mechanical Loss, Governance Quality, and Infrastructure and Code Integrity. Independent convergence on the same taxonomy is mild evidence the taxonomy is the right one.

The market for vault ratings is fragmented, lightly governed, and economically smaller than the asset base it nominally covers. Insurance limits across the ecosystem (Nexus Mutual is the largest onchain provider) remain very small relative to vault TVL, which means a depositor cannot currently buy meaningful coverage as a substitute for doing the diligence themselves. Read the rating agency layer as forming, not formed.