727 FinanceFrom Morpho to Aave: the same bad debt, five points of loss recognition, determine who ultimately bears the DeFi vault losses.
Written by: @definikos
Compiled by: AididiaoJP, Foresight News
The vault loss routing map does not answer "will there be a loss." It only answers what happens after a loss: when it is recognized on the books, which balance absorbs it first, what intermediate absorption layers exist, what depositors ultimately see, and who cannot get out.
Every strategy sub-account should fill in one row of this table before the first deposit.
Assume $3 million in bad debt against $100 million in deposits.
In an isolated Morpho market, at the moment the last batch of collateral is liquidated, all depositors immediately bear a 3% loss.
In Aave's shared pool, which is aggregated uniformly by asset, depositors' aToken balances do not move on the books. The bad debt is written off, the pool records a deficit, and the buffer stake in Umbrella is slashed. Any shortfall remaining after coverage is borne by depositors as residual insolvency, rather than by directly reducing deposit balances pro rata. Note: Umbrella is Aave's bad debt buffer mechanism: users stake assets to earn rewards, at the cost that when the protocol incurs bad debt, the corresponding stake is slashed to fill the gap.
In a curated vault under Morpho Vault V1.1, the share price does not move at all, and the last depositors to run leave the loss to those who remain.
Queued vaults are priced by valuation reports periodically submitted by an oracle. Until the next valuation comes out, nothing changes on the books. If a valuation decline exceeds a preset suspicious range, the report is quarantined and the vault is frozen outright.
In a tranched structure with a 10% subordinated layer, the full $3 million bad debt falls on the $10 million subordinated layer, which loses 30%, while the senior layer is unaffected.
The loss amount is the same every time. What changes is which path the loss takes and when it is recognized. When it is recognized, like which layer it lands on, determines who ultimately pays.
As long as a loss has already occurred but has not yet been booked, those who can exit at the old price will shift their share of the loss onto those who remain.
This map asks the same five questions of every structure:
Trigger: What event causes the loss to be recognized on the books?
It is not enough that "the asset actually lost money"; an on-chain event must write the loss into the accounting. Bad debt liquidation, valuation reports, impairment, and governance votes can all be triggers. If the trigger does not occur, the loss remains off the books.
First landing: Which balance does the loss land on first?
After the loss is recognized, which number changes first. It could be the market's total deposits, the pool's deficit, the vault's share price, or some subordinated layer. Different first landing points mean completely different bearers downstream.
Absorption layers: Between the first landing point and depositors, what stands in the way first?
Losses do not necessarily fall directly on depositors. In between there may be offsets, slashable stake, subordinated layers, and first-loss layers. The thicker these layers, the smaller the loss depositors see; only when the layers are exhausted does it reach depositors.
Reach: What do depositors actually see?
Book performance and real losses may not be the same thing. Depositors may see the share price fall, the redemption queue freeze, or the books still showing face value while the claim behind it has already been impaired.
Loss recognition timing: When does this loss count?
Is it recognized immediately in the same block, or does it wait for the next interaction, the next report, a governance vote, or even never? The later the recognition, the more people have a chance to exit at the old price and leave the loss to those who remain later.
As long as the oracle keeps quoting collateral at face value, the system cannot see that the collateral has already depreciated, and bad debt liquidation will not trigger. The loss will not be booked and will remain off the books until someone forces liquidation or forces a price update.
Isolated markets
In an isolated Morpho market, after the liquidator takes the borrower's last batch of collateral, if the debt is still not fully repaid, the remaining portion is written off in the same call and borne pro rata by all depositors in that market.
The bad debt formula can be written as:
BD = D − C·p / LIF
where D is debt, C·p is collateral value, and LIF is the liquidation incentive.
Example: $10 million debt, collateral price falls to $7.3 million, LIF is 1.044, LLTV is 86%:
10 − 7.3 / 1.044 ≈ $3 million, or 3% of a $100 million market.
Between the bad debt and depositors, there is no reserve or fund standing in front. The loss falls directly on the depositors in that market. In theory, the loss recognition point is the same block in which liquidation occurs. But this requires three conditions to be met simultaneously:
First, the oracle must determine that the position is already undercollateralized and unhealthy;
Second, the liquidator must consider the last bit of collateral still worth taking over, without losing money after deducting the liquidation reward;
Third, the oracle call must not revert.
If any one of the three conditions is missing, the loss will not be recognized at that moment and may remain off the books indefinitely, becoming "never recognized."
Shared pools
Since v3.3, Aave burns the remaining debt if an account's collateral goes to zero after liquidation and debt remains, and records a deficit on the reserve.
This deficit is accounted for separately and does not directly change the aToken exchange rate. So when depositors open their accounts, the balance they see is still the original face value and does not immediately shrink.
Umbrella then fills the hole, in this order: first, the deficit offset allowance pre-reserved by the DAO, which acts as the first buffer layer; if that is insufficient, UmbrellaCore automatically slashes the aTokens staked by users in that asset pool to fill the remaining gap.
Note that even if a staker has already requested exit and is waiting in a 20-day cooldown period for unlock, that stake can still be slashed. The cooldown period is not a safety period.
What remains after the two layers is residual insolvency, which only governance can recapitalize.
Each depositor's uncovered gap can be written as:
h = max(0, B − O − Z) / S
where B is bad debt, O is the offset, Z is slashable stake, and S is total deposits.
Example: $5 million bad debt, $100,000 offset, $3 million stake, $500 million deposits:
(5 − 0.1 − 3) / 500 = 0.38%.
0.38% is only the calculated average gap; no one's account is directly debited by 0.38%. As long as there is still money in the pool, withdrawals are still honored 1:1, and those who leave first get back face value. The hole does not disappear; it is left to those who have not yet left. Whoever still holds a deposit position at the end bears the full uncovered loss.
Curated vaults sit on top of isolated markets. The market is responsible for recognizing the loss, and the vault version determines when the share price sees the loss.
Vault V1.0: The loss is recognized on the spot, and everyone shares it pro rata immediately.
As soon as bad debt liquidation occurs, the share price is cut immediately. For example, if a $100 million vault loses $4 million, the share price immediately falls 4%. All current holders bear it pro rata, whether or not you have run.
Vault V1.1: The loss is booked but does not change the price; the last to leave bears it.
When bad debt occurs, the loss is recorded in the lostAssets account, but the share price does not move. Early withdrawers still get paid at the old price, effectively exiting at face value. The hole remains in the vault, and those who have not yet left at the end bear it. Unless the curator fills the gap with their own money.
Vault V2: Recognized only at the next interest accrual, when actual assets are found to be below book assets.
V2 does not book at the moment of bad debt liquidation, but waits until the next interest accrual cycle. At that point the system compares the adapter's actual assets with the vault's recorded gross book assets: if actual assets are already below gross book assets, the difference is recorded as a loss.
Deferral turns the loss into a queue. Suppose X is deferred, vault assets are A, and W is withdrawn at face value before recognition; the loss borne by those who remain is:
h = X / (A − W)
Example: a $100 million vault loses $4 million, and $60 million is withdrawn first:
4 / 40 = 10%, whereas if booked immediately it would be only 4%.
V2 also has its own version. Before the market recognizes bad debt, the bad debt loan continues to accrue interest, pushing up the share price. New depositors enter at that price, and early leavers take out interest that has no corresponding assets. Setting maxRate to 0 can stop further accrual, but what has already been accrued cannot be recovered.
On vault architectures with strategy permission controls, no venue directly writes losses into the share price. The loss only lands at the next report: when the submitter values positions item by item, they mark the position price down. Safety parameters then determine how it is routed.
If the fluctuation falls within the suspicious range, it is accepted as usual.Falls between the suspicious threshold and the maximum deviation: the report is quarantined, and deposits, redemptions, and fees are all frozen until an independent reviewer signs off.
Exceeds the maximum deviation: automatic rollback.
Any redemption batch priced on a report that does not yet include the loss still pays out at the old price.
The master vault puts money into sub-vaults, and the sub-vaults invest in the underlying assets. After a sub-vault takes a loss, it must first be recognized at the sub-vault level; the master vault, however, does not pass the loss up until its own next interest accrual or report. This means the same loss must be recognized twice, with a time lag in between.
During this period, the master vault's share price is still displayed at the old price. Those who can exit at the old price leave the loss to those who remain.
The loss translated to the master vault level is the weight of the master vault's investment in the sub-vault multiplied by the sub-vault's loss. For example, if the master vault has 20% of its assets invested in a sub-vault and the sub-vault loses 10%, the loss at the master vault level is 2%.
Tranche structure
When there is a subordinated layer J, losses are allocated as follows:
L_J = min(Loss, J), L_S = max(0, Loss − J)
Pool of 100, subordinated 10, loss of 15: the subordinated layer is wiped out entirely, and the senior layer bears the remaining 5; senior principal is 90, a loss of about 5.6%.
But the trigger power is usually not in your hands. Neutrl paused NUSD minting and redemptions on August 13 and reopened on September 17 at a redemption rate of 0.51. On Strata, jrNUSD, which accounts for about one-fifth of the structure, was written down to zero, and srNUSD bore the remainder. During the pause, NUSD's tracking price remained around 0.998, so the loss-allocation waterfall could not even begin until the issuer set a new price.
First-loss staking
Sponsor staking is only a subordinated layer when someone actually burns it. Otherwise, it absorbs losses pro rata alongside other shares.
Example: a $200 million vault, with looping positions accounting for 10% of NAV, 4x leverage, and a 10% haircut on collateral:
10% × 4 × 10% × $200 million = $8 million loss.
If $3 million of staking is burned:
(8 − 3) / 197 ≈ 2.5%, borne by depositors.
If the staking burn comes one report later than the write-down, then those caught in between, priced at the old price, absorb the loss first, and the staking burn compensates those who remain.
Losses decided by others
Looping positions
Leveraged positions amplify losses first, then route them. The approximate relationship is:
ΔE/E ≈ L·w
With 4x leverage and a 10% collateral haircut, the position's equity takes a direct 40% loss, plus liquidation incentives and unwind slippage. The vault does not see it until the next report.
Collateral issuers
For cross-chain LRTs, synthetic dollars, and RWA funds, the size of the loss is decided by the issuer, manager, or a vote, often weeks after the event itself.
When a cross-chain bridge mints unbacked tokens, the issuer decides whether all holders share the shortfall or whether the wrapped asset on one chain bears it alone. Aave's rsETH incident report calculated the uniform-allocation scenario:
112,204 / (629,689 + 112,204) ≈ 15.1%.
Synthetic dollars rely on a reserve fund to absorb two types of losses: negative funding costs, and the backing shortfall when underlying collateral is insufficient to support liabilities. But the reserve fund is not unlimited; documentation usually only states that it is used to cover losses, not what happens after it is exhausted.
The actual answer Neutrl gave was to cut the redemption rate. NUSD paused minting and redemptions on August 13, and when it reopened on September 17, the redemption rate was set at 0.51. In other words, 1 NUSD no longer redeems at $1; you can only get back $0.51. The portion the reserve fund cannot cover is transferred to holders in one stroke through the redemption rate.
This shows that the "1 dollar" of a synthetic dollar is not a guarantee but a target. When the reserve fund is thick, the peg looks stable; after the reserve fund is exhausted, how losses are allocated depends on how the issuer sets the redemption rate. The documentation not saying so does not mean the risk does not exist; it only means the rules are decided by the issuer on the spot.
Private credit
Private credit works the opposite way. On Maple, lenders who withdraw during an impairment period turn the impaired value into a permanent loss; any subsequent recovery is distributed pro rata to the lenders who remain.
$1 million with a 10% impairment: those who leave take $900,000. If the borrower later repays, those who remain are restored to $1 million, and those who left have locked in their loss.
Here, leaving early locks in the loss, and only those who remain can receive the recovery.
For the same bad debt, which balance it lands on, how many buffer layers lie in between, whether depositors see the share price fall or the book value stay flat, and when the loss is recognized determine who ultimately pays.
Before the first deposit, every strategy position should spell out five questions clearly: what event triggers the loss, where the loss hits first, what absorbing layers lie in between, what depositors actually see, and when the loss is recognized.
If the five questions are not filled out clearly, what you think you are buying is yield, but what you are actually buying is a place in line left behind after others have run off at the old price.