When DeFi goes wrong, how should losses be allocated?

A new framework from mathy_research proposes tracing how losses travel from a DeFi product’s underlying exposure through five layers—smart contracts and infrastructure, human control, and automated mechanisms—to the holder’s claim, arguing that risk ratings focused on reserves, managers and code miss the path that determines actual recoveries. The method sorts claims into a few types (pool shares, fixed-payment notes, par-redeemable tokens) because the same borrower default means an immediate writedown for share holders but no change for senior noteholders until the buffer beneath them is exhausted. It stresses that failures can originate inside any layer, not just the asset base: an upgrade without a timelock can swap vault logic instantly, a bridge exploit can zero out bridged collateral, and a chain halt blocks all exits regardless of issuer intent. Control-layer risk turns on whether the delay before a change takes effect exceeds the time holders need to exit, while mechanism-layer rules such as liquidation and withdrawal queues determine how fast stress becomes loss or delay. The framework also warns that some weaknesses cannot be averaged against strengths—a vault’s ample collateral is irrelevant if an untimelocked admin key can move it—and that liquidity risk enters through multiple gates (asset, exit terms, queue design, operator recall, settlement infrastructure), so deep market liquidity alone does not prevent a holder lockup. The same underlying event can produce absorbed losses, delayed writedowns or a run that dumps losses on late exiters depending on the claim structure, so the next step is applying the layer-by-layer mapping across credit, market and liquidity risk to compare products.