The Same Bad Debt, Five Loss-Recognition Points: Who Bears DeFi Vault Losses?

The vault loss routing map does not answer "will there be a loss?" It only answers what happens after a loss: when it is recognized on the books, which balance the loss lands on first, what absorption layers sit in between, what depositors ultimately see, and who cannot get out.

Every strategy sub-vault should fill in one row of this table before its first deposit.

The same bad debt, five loss-recognition points

Suppose there is $3 million in bad debt against $100 million in deposits.

In a Morpho isolated market, the moment the last batch of collateral is liquidated, all depositors immediately bear a 3% loss.

In Aave's shared liquidity pool, which is pooled by asset, depositors' aToken balances do not change on the books. The bad debt is written off, the pool records a deficit, and the buffer stake in Umbrella is slashed. Any remaining shortfall after coverage is borne by depositors as residual insolvency, rather than by directly reducing deposit balances pro rata. Note: Umbrella is Aave's bad-debt buffer mechanism: users stake assets to earn rewards, at the cost that when the protocol suffers bad debt, the corresponding stake can be slashed to fill the gap.

In a curated vault under Morpho Vault V1.1, the share price does not move at all, and the last depositors to run leave the loss to those who remain.

Queue-based vaults are priced by valuation reports periodically submitted by an oracle. Until the next valuation comes out, nothing changes on the books. If the valuation drop exceeds the preset suspicious range, the report is quarantined and the vault is frozen outright.

In a tranched structure with a 10% junior layer, the entire $3 million bad debt lands on the $10 million junior layer; the junior layer loses 30%, and the senior layer is unaffected.

The loss amount is the same every time. What changes is the path the loss takes and when it is recognized. When a loss is recognized, just like which layer it lands on, determines who ultimately pays.

As long as a loss has already occurred but has not yet been booked, those who can exit at the old price will shift their share of the loss onto those who remain.

Five questions for every structure

The diagram asks the same five things of every structure:

Trigger: What event causes the loss to be recognized on the books?

It is not enough that "the asset has actually lost value"; an on-chain event must write the loss into the accounting. Bad-debt liquidation, a valuation report, an impairment, or a governance vote can all be trigger points. If the trigger does not occur, the loss remains off the books.

First landing: Which balance does the loss hit first?

After the loss is recognized, which number changes first? It may be the market's total deposits, the pool's deficit, the vault's share price, or a particular junior layer. Different first landing points mean completely different bearers downstream.

Absorption layers: What stands between the first landing point and depositors?

Losses do not necessarily fall directly on depositors. In between there may be offsets, slashable stake, junior layers, or first-loss layers. The thicker these layers, the smaller the loss depositors see; only when the layers are exhausted do depositors come into play.

Reach: What do depositors actually see?

Book performance and the real loss may not be the same thing. Depositors may see a falling share price, a frozen redemption queue, or a balance still displayed at face value even though the claim behind it has already been impaired.

Loss-recognition point: When does this loss count?

Is it recognized immediately in the same block, or only on the next interaction, the next report, a governance vote—or never? The later the recognition, the more people have a chance to exit at the old price and leave the loss to those who stay.

As long as the oracle keeps quoting collateral at face value, the system cannot see that the collateral has already depreciated, and bad-debt liquidation will not be triggered. The loss will not be booked and will remain off the books until someone forces a liquidation or forces a price update.

Lending markets: where losses land first

Isolated markets

In a Morpho isolated market, after the liquidator takes the borrower's last batch of collateral, if the debt is still not fully repaid, the remainder is written off in the same call and borne pro rata by all depositors in that market.

The bad-debt formula can be written as:

BD = D − C·p / LIF

where D is debt, C·p is collateral value, and LIF is the liquidation incentive.

Example: $10 million in debt, collateral price falls to $7.3 million, LIF is 1.044, and LLTV is 86%:

10 − 7.3 / 1.044 ≈ $3 million, or 3% of the $100 million market.

Between the bad debt and depositors there is no reserve or fund to absorb it first; the loss falls directly on depositors in that market. In principle, the loss-recognition point is the same block in which the liquidation occurs. But three conditions must be met at the same time:

• First, the oracle must determine that the position is undercollateralized and unhealthy;
• Second, the liquidator must consider the last bit of collateral still worth taking over, so that it is not a loss after deducting the liquidation incentive;
• Third, the oracle call must not revert.

If any one of the three conditions is missing, the loss will not be recognized at that moment and may remain off the books, becoming "never recognized."

Shared liquidity pool

Since v3.3, Aave burns the remaining debt if an account's collateral is reduced to zero after liquidation and debt remains, and records a deficit on the reserve.

This deficit is booked separately and does not directly change the aToken exchange rate. So when depositors open their accounts, the balance they see is still the original face value and does not immediately shrink.

Next, Umbrella fills the hole. The order is: first use the deficit offset allowance pre-reserved by the DAO, which acts as the first buffer layer; if that allowance is exhausted and the shortfall remains, UmbrellaCore automatically slashes the aTokens staked by users in that asset pool to fill the remaining gap.

Note that even if a staker has already requested withdrawal and is waiting out the 20-day cooldown period for unlocking, that stake can still be slashed. The cooldown period is not a safe period.

What remains after the two layers is residual insolvency, which only governance can recapitalize.

Each depositor's uncovered shortfall can be written as:

h = max(0, B − O − Z) / S

where B is bad debt, O is the offset, Z is slashable stake, and S is total deposits.

Example: $5 million bad debt, $100,000 offset, $3 million staked, and $500 million deposits:

(5 − 0.1 − 3) / 500 = 0.38%.

The 0.38% is only a calculated average shortfall; no one will have 0.38% deducted directly from their account. As long as there is still money in the pool, withdrawals are still paid 1:1, and those who leave first get back face value. The hole does not disappear; it is simply left to those who have not yet left. Whoever still holds a deposit position at the end bears the entire uncovered loss.

Vault accounting: the same bad debt, different loss-recognition points

Curated vaults sit on top of isolated markets. The market is responsible for recognizing the loss; the vault version determines when the share price sees the loss.

Vault V1.0: The loss is recognized on the spot, and everyone shares it pro rata immediately.

As soon as the bad-debt liquidation occurs, the share price is cut immediately. For example, if a $100 million vault loses $4 million, the share price immediately drops 4%. All current holders bear it pro rata, whether or not you have run.

Vault V1.1: The loss is booked but the price is unchanged; the last to leave bears it.

When bad debt occurs, the loss is recorded in the lostAssets line item, but the share price does not move. Those who withdraw first still get paid at the old price, effectively exiting at face value. The hole stays in the vault and is borne by those who have not yet left—unless the curator puts in their own money to cover the gap.

Vault V2: Recognition waits until the next interest accrual, when actual assets are found to be below book assets.

V2 does not book the loss at the moment of bad-debt liquidation, but waits until the next interest accrual cycle. At that point the system compares the adapter's actual assets with the vault's recorded total book assets: if actual assets are already below total book assets, the difference is recorded as a loss.

Deferral turns the loss into a queue. Suppose X is deferred, vault assets are A, and W is withdrawn at face value before recognition; the loss borne by those who remain is:

h = X / (A − W)

Example: a $100 million vault loses $4 million, and $60 million is withdrawn first:

4 / 40 = 10%, whereas if it were booked immediately it would be only 4%.

V2 has its own version of this. Before the market recognizes the bad debt, the bad loan continues to accrue interest, pushing the share price up. New depositors enter at that price, and early leavers take away interest that has no corresponding assets. Setting maxRate to 0 can stop further accrual, but what has already been accrued cannot be recovered.

Vaults with redemption queues: losses wait for a valuation report to be recognized

In a vault architecture with strategy permission controls, no venue writes the loss directly into the share price. The loss only lands with the next report: when the submitter values each position, they mark the position price down. Security parameters then determine how it is routed.

• If the move falls within the suspicious range, it is accepted as usual.
• If it falls between the suspicious range and the maximum deviation, the report is quarantined, and deposits, redemptions, and fees are all frozen until an independent reviewer signs off.
• If it exceeds the maximum deviation, it is rolled back outright.

Any redemption batch priced according to a report that does not yet include the loss is still paid at the old price.

Nested vaults: the loss is recognized twice

A parent vault puts money into a child vault, and the child vault then invests in the underlying assets. After the child vault loses money, the loss must first be recognized at the child-vault level; the parent vault only passes the loss up when its own next interest accrual or report occurs. This means the same loss is recognized twice, with a time lag in between.

During this period, the parent vault's share price is still displayed at the old price. Those who can exit at the old price leave the loss to those who remain afterward.

The loss translated to the parent vault level is the parent vault's weight invested in the child vault multiplied by the child vault's loss. For example, if 20% of the parent vault's assets are invested in the child vault and the child vault loses 10%, that is a 2% loss at the parent vault level.

Absorption layers you write into the structure yourself

Tranched structures

With a junior layer J, losses are allocated as follows:

L_J = min(Loss, J), L_S = max(0, Loss − J)

Pool of 100, junior layer of 10, loss of 15: the junior layer is wiped out, and the senior layer bears the remaining 5; with senior principal of 90, the loss is about 5.6%.

But the trigger is usually not in your hands. Neutrl suspended NUSD minting and redemptions on August 13 and reopened on September 17 at a redemption rate of 0.51. On Strata, jrNUSD, which accounts for about one-fifth of the structure, was wiped out, and srNUSD bore the remainder. During the suspension, NUSD's tracking price remained around 0.998, so before the issuer provided a new price, the loss-allocation waterfall could not start at all.

First-loss staking

A sponsor's stake is only a junior layer if someone actually burns it. Otherwise it loses pro rata alongside the other shares.

Example: a $200 million vault, with a looping sub-vault accounting for 10% of NAV at 4x leverage, and collateral marked down by 10%:

10% × 4 × 10% × $200 million = $8 million loss.

If $3 million of stake is burned:

(8 − 3) / 197 ≈ 2.5%, borne by depositors.

If the stake is burned one report later than the write-down, the group caught in the middle and priced at the old price absorbs the loss first, and the burned stake compensates those who remain.

Losses decided by others

Looping sub-vaults

A leveraged sub-vault amplifies the loss first, then routes it. The approximate relationship is:

ΔE/E ≈ L·w

With 4x leverage and a 10% collateral markdown, the sub-vault's equity takes a direct 40% loss, plus liquidation incentives and unwind slippage. The vault does not see it until the next report.

Collateral issuers

For cross-chain LRTs, synthetic dollars, and RWA funds, the size of the loss is decided by the issuer, the manager, or a vote, often weeks after the event itself.

When a cross-chain bridge mints unbacked tokens, the issuer decides whether all holders share the shortfall or whether the wrapped asset on one chain bears it alone. Aave's rsETH incident report calculated the uniform-allocation case:

112,204 / (629,689 + 112,204) ≈ 15.1%.

Synthetic dollars rely on a reserve fund to absorb two types of losses: negative funding fees, and backing shortfalls when the underlying collateral is insufficient to support liabilities. But the reserve fund is not unlimited; the documentation usually only says it is used to cover losses, not what happens after it is exhausted.

Neutrl's actual answer was to cut the redemption rate. NUSD suspended minting and redemptions on August 13; when it reopened on September 17, the redemption rate was set at 0.51. In other words, 1 NUSD was no longer redeemed for $1; holders could only get back $0.51. The portion the reserve fund could not cover was transferred to holders in one go through the redemption rate.

This shows that a synthetic dollar's "one dollar" is not a guarantee but a target. When the reserve fund is thick, the peg looks stable; after the reserve fund is exhausted, how losses are shared depends on how the issuer sets the redemption rate. The documentation not mentioning it does not mean the risk does not exist; it only means the rules are decided by the issuer on the spot.

Private credit

Private credit takes the opposite path. On Maple, lenders who withdraw during an impairment turn the impaired value into a permanent loss; any subsequent recovery is distributed pro rata to the lenders who remain.

$1 million with a 10% impairment: those who leave get $900,000. If the borrower later repays, those who remain recover to $1 million, while those who left have locked in the loss.

Here, early leavers lock in the loss, and only those who remain can receive the recovery.

Loss routing map

Summary

For the same bad debt, which balance it lands on, how many buffer layers sit in between, whether depositors see a falling share price or an unchanged book value, and when the loss is recognized—these determine who ultimately pays.

Before the first deposit, every strategy sub-vault should spell out the five questions: what event triggers the loss, where the loss hits first, what absorption layers sit in between, what depositors actually see, and when the loss is recognized.

If the five questions are not clearly filled in, you may think you are buying yield, but what you are actually buying is a place in the queue left behind after others have run at the old price.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps