Source-linked AI summary
Pricing the DeFi Tail: Do Protocols or Depositors Price Operational Risk?
Nils Bundi
TL;DR
DeFi exposes depositors to substantial operational risk without mandatory protocol capital, raising whether buffers or supply-yield premia adequately price the tail. The paper fits a per-sector Basel loss-distribution model to a new event dataset and tests both margins against it. Buffers and premia move in the right direction, but both leave most of the tail unfunded, especially for retail depositors, motivating standardized disclosure rather than capital mandates.
Problem
DeFi lacks evidence jointly comparing protocol capital buffers and depositor risk premia against a quantified operational-risk tail.
Method
The paper assembles and deduplicates a multi-source DeFi event dataset, fits per-sector Basel loss-distribution models, and tests buffers and risk premia against the benchmark.
Results
At the ten largest Lending venues, four buffers cover 5% of modeled VaR99.9 on average, while unbuffered venues carry a +54-bps supply-yield premium that remains more than an order of magnitude short.
Takeaways & Limitations
The market prices operational risk in the right direction but leaves the tail overwhelmingly unfunded, disproportionately burdening retail depositors and supporting standardized disclosure.
Takeaways & Limitations
Public-loss data omit sub-threshold and privately resolved incidents, and the analysis assumes one common loss process per sector allocated by TVL share.
Abstract
from arXiv · showhide
Similar to banks, DeFi protocols expose depositors to operational risk (USD 9.45 billion across 1,075 events since 2020). Unlike banks, they are not required to hold capital against it. A protocol may maintain a buffer voluntarily. Absent one, the risk falls on the depositor, who should then demand a risk premium in the supply yield. I quantify the underlying tail on one benchmark, a per-sector Basel loss-distribution approach fitted to a new operational risk event dataset, and test both margins against it. Tails in the four core sectors are no heavier than the Moscadelli banking band $[0.85, 1.39]$. Bridge, Derivatives, and the residual Other sector exhibit cyber-loss-level tails ($\hatξ\approx 1.6$), with point estimates past the infinite-mean boundary. The Lending tail implies a $\mathrm{VaR}_{99.9}$ capital buffer of 18% of TVL and of the ten largest Lending venues, the four holding a buffer cover on average 5% of it. Under market discipline, depositors should demand a higher yield in compensation where a venue does not maintain a buffer. I find that venues without a buffer pay a higher premium than those with (a 125-bps gap in medians): evidence the market discriminates in the right direction. However, the premium falls far short of an adequately priced tail. This unpriced tail falls disproportionately on the retail depositor, who sees only the posted rate but lacks the information and skills to price it. Because these products are not bank-regulated, I recommend disclosure over capital mandates: protocols, and any service providers that front access to it, should publish standardized losses, existing capital buffers and tail coverage.
1 Introduction
DeFi exposes depositors to operational losses without the regulatory capital protection required of banks, leaving protocols and depositors to respond through buffers and risk premia. The paper quantifies this tail and tests whether either response is adequately sized.
- Motivation: DeFi lacks the bank requirement to hold capital against operational risk, leaving no regulated buffer between a loss event and the depositor’s claim.Operational risks include failed processes, people, systems, and external events.
- Motivation: USD 9.45 billion across 1,075 events records depositor-facing gross DeFi losses between 2020-02-11 and 2026-05-29.The losses arise from operational-risk events on DeFi protocols.
- Motivation: Depositors should demand a higher supply yield when they bear operational-risk exposure without a protocol buffer.Market discipline requires disclosure that retail depositors typically lack.
- Research question: The paper asks whether protocol buffers or depositor risk premia are adequately sized for the operational-risk tail.The two responses are substitutes made by different participants and are not regulator-disciplined.
- Contributions: The study assembles a public event dataset, fits per-sector Basel loss-distribution models, and benchmarks DeFi tails against banking operational risk.It also tests protocol capital buffers and depositor risk premia against the common benchmark.
- Contributions: Venues with buffers pay lower risk premia, but the premium is an order of magnitude below the modeled tail.The direction is statistically significant, while the paper closes with policy recommendations.
2 Related Work
The paper connects banking operational-risk modeling, empirical DeFi security, and deposit pricing, addressing a gap in jointly analyzing protocol capital and depositor pricing against one quantified tail.
- Operational-risk modeling in banking: Banking research established heavy operational-risk tails, while cyber-loss studies report tail indices near 1.60 and highlight model and stationarity problems.Banking benchmarks include Moscadelli’s ˆξ ∈[0.85, 1.39] range across business lines.
- Empirical DeFi security: DeFi-security research surveys attack surfaces and incidents but has focused primarily on qualitative systematization and specific attack mechanisms.The Zhou corpus contains 181 incidents through April 2022, while other work examines flash-loan and oracle manipulation.
- Empirical DeFi security: This paper adds a deduplicated, multi-source event dataset tagged to the banking taxonomy and fitted per sector.That design supports severity and frequency estimation for DeFi operational risk.
- Yield pricing and market discipline: Bank market-discipline research treats uninsured-creditor yields and capital as substitute responses, while DeFi studies examine yield behavior and compensation separately.Existing DeFi evidence includes search-for-yield-driven lending supply and insufficient compensation for impermanent loss.
- The gap: Prior work lacks a deduplicated event-level DeFi loss dataset, per-sector severity and frequency parameters, and a joint comparison of capital and yield responses.The paper presents these as three gaps it closes.
3 Data: A Consolidated DeFi Operational-Risk Dataset
The dataset combines seven public feeds into a deduplicated, depositor-facing DeFi operational-risk sample classified by sector and Basel event type. Filtering and reconciliation produce the working sample used for per-sector loss modeling.
- Sources and consolidation: Seven public feeds are normalized, filtered, deduplicated, and consolidated into a 1,164-event DeFi dataset.The feeds include DefiLlama, rekt.news, SunWeb3Sec, kismp123, BlockSec, de.fi, and SlowMist.
- Consolidation: Name clustering within 21 days and matching by date and loss identify cross-source duplicates, with reconciled losses set to the median source amount.The second pass uses a same-date ±7-day window and losses within ±10%.
- Sources and consolidation: 153 events are excluded as Non-DeFi after regex filtering and a curated exclusion pass.Excluded records include CEX events, memecoins, NFTs, custodial-wallet failures, Ponzi schemes, phishing, and wallet-software exploits.
- Sector inference: Each event is assigned to Bridge, Lending, DEX, Yield, Stablecoin, Derivatives, or Other.The sectors cover cross-chain bridges, money markets, exchanges, yield products, stablecoins, derivatives, and residual protocols.
- Risk-category inference: Every record receives a Basel Level-1 event type using textual evidence first and DefiLlama classification as fallback.Employment Practices and Workplace Safety and Damage to Physical Assets are omitted because they lack measurable on-chain analogues.
- Coverage and window: The working sample contains 1,075 depositor-facing events totaling USD 9.45 B after removing 89 events and USD 0.84 B not borne by earn users.536 events, or 50%, carry cross-source confirmation.
4 Methodology: The Loss-Distribution Approach
The paper models DeFi operational losses with a per-sector Basel loss-distribution approach, combining severity, frequency, and compound aggregation. It allocates sector estimates to protocols using TVL shares while capping event losses at protocol exposure.
- LDA framework: 99.9% VaR prices each sector’s annual operational-loss distribution for comparability with banking operational risk.The LDA combines severity, frequency, and compound aggregation.
- Severity model: Individual event losses are modeled as iid severity draws whose upper tails follow peaks-over-threshold generalized Pareto distributions.The threshold and excess-loss distribution are estimated per sector.
- Frequency model: Monthly event counts use negative-binomial models because counts are over-dispersed, then aggregate through twelve monthly draws into annual frequency.Severity and frequency are treated as independent under standard banking-LDA practice.
- Compound aggregation: 2 × 10^5 simulated years per sector produce the actuarial pure premium and VaR99.9, expressed relative to trailing-365-day TVL.Each simulated loss is capped at the largest single-protocol exposure in the sector.
- Per-protocol allocation: Sector losses are allocated to protocols by TVL-weighted event thinning, with each venue retaining the sector severity distribution but receiving its own exposure cap.The exposure cap breaks linear allocation, so per-protocol premiums are simulated rather than scaled directly from sector ratios.
5 Empirical LDA Fitting
The fitted data show heavy-tailed, sectorally heterogeneous DeFi losses and support negative-binomial frequency modeling. Capital estimates are substantial but sensitive to exposure caps and extreme observations, while existing venue buffers cover only a small share of modeled tail capital.
- Loss data: USD 8.79 million is the aggregate mean event loss, versus a USD 0.50 million median and USD 624 million maximum.Sector totals span two orders of magnitude, from Bridge’s USD 3.24 billion to Other’s USD 0.09 billion.
- Frequency fits: Five of seven sectors reject Poisson frequency at p ≤0.02, while cross-sector dispersion is D = 3.27.Annual event rates range from 8.3/yr for Stablecoin to 54.2/yr for DEX.
- Capital estimates: 14–18% of exposure bases is the VaR99.9 capital range for Lending, DEX, Yield, and Stablecoin; Bridge, Derivatives, and Other require 23–32% of TVL under capped losses.Uncapped Bridge VaR99.9 diverges to 673× TVL because its point estimate exceeds the infinite-mean boundary.
- Robustness: 0.16–0.5 is the change in ˆξ after dropping the single largest event across sectors, with Lending moving from 0.75 to 0.35.Every sector retains its below/above infinite-mean characteristic under drop-top rules up to 0.5%.
6 Bearing the Tail: Capital Buffers and Depositor Premia
The paper compares protocol capital buffers and depositor risk premia as alternative ways to fund the same operational-risk tail. Buffers and premia move in the expected direction, but both fall far short of the modeled tail.
- The protocol’s response: 18% of TVL is the Lending VaR99.9 capital benchmark used to measure both protocol buffers and depositor premia.The benchmark is applied to the ten largest Lending venues.
- The protocol’s response: 4 of 10 largest Lending venues disclose operational-risk reserves, covering only ∼5% of their modeled capital buffer on average.Coverage ranges from 2% for Venus to 9% for Aave V3.
- The depositor’s response: +54 bps is the average premium at unbuffered venues, approximately matching their 55-bps mean pure premium but not their VaR99.9 tail premium.The implied tail-risk premium ranges from 34–81% of TVL.
- The depositor’s response: +257 bps to −79 bps is the observed premium range, with pure-premium coverage ranging from +497% to −143%.Three venues yield below the risk-free rate while bearing the operational-risk tail.
- Both margins together: −86 bps versus +39 bps is the median premium for buffered versus unbuffered venues, respectively.The difference is statistically significant (one-sided Mann–Whitney p = 0.01), but its scale is inadequate.
- Both margins together: A 125-bps median gap separates unbuffered from buffered venues, while supply APY includes both organic lending yield and incentives.The premium measure is therefore a proxy rather than an identified operational-risk price.
7 Discussion
The modeled Lending tail is much larger than either observed buffer coverage or depositor compensation, leaving retail depositors especially exposed. The paper therefore favors standardized disclosure and flexible calibration over bank-style capital mandates.
- Discussion: ∼18% of TVL is Lending’s VaR99.9 capital requirement, while Bridge and Derivatives reach 32% and 23% but remain cap-determined.Bridge and Derivatives have ξ̂ > 1, making their tails unquantifiable without the single-protocol cap.
- Discussion: The six Lending venues without buffers average +54 bps in supply-yield premium, matching their 55-bps pure premium but not the modeled tail.Coverage ranges from −143% to +497% across those venues.
- Who bears the shortfall: Retail depositors bear the unpriced tail disproportionately because they see only posted rates and lack standardized disclosure.Professional participants can assess the tail, negotiate bilateral terms, and size or exit positions.
- Policy: The recommended remedy is disclosure rather than mandated bank-style operational-risk capital.The proposed disclosures cover standardized losses and yields, buffer coverage, residual tail exposure, and periodic recalibration.
- Policy: Disclosure obligations could attach to front-ends, wallets, aggregators, and custodial earn products when no responsible protocol entity exists.These providers are identifiable access points for retail depositors.
- Policy: A hybrid calibration standard would use the per-sector LDA by default and allow sufficiently data-rich venues to substitute disclosed, periodically recertified protocol-specific models.This mirrors Basel’s standardized and internal-model tiers.
- Where the capital sits: Existing on-chain buffers inherit the code risk of the smart-contract systems they insure, while protocol-maintained and cross-protocol recovery funds are not standard practice.The paper distinguishes idiosyncratic from systematic recovery mechanisms.
- Limitations: Public-loss data omit sub-threshold and privately resolved incidents, while sector homogeneity, gross recoveries, confounding, and non-stationarity also constrain interpretation.The supply-yield spread is a reduced-form proxy, and buffered venues are also larger and older.
8 Conclusion
The paper finds that DeFi operational risk is weakly funded by both protocol buffers and depositor premia. Because the products are not bank-regulated, it concludes that standardized disclosure should reach protocols and the service providers that front access.
- Conclusion: USD 9.45 B across 1,075 events describes the documented DeFi operational-risk exposure, which lacks a bank-style capital requirement.Without a voluntary buffer, the residual risk falls on depositors.
- Conclusion: 5% is the average modeled VaR99.9 coverage provided by disclosed buffers at the ten largest Lending venues.Four of the ten venues disclose buffers.
- Conclusion: +54 bps is the average supply-yield premium at unbuffered venues, short of the tail by more than an order of magnitude.The two margins move in the right direction, but the tail remains overwhelmingly unfunded.
- Conclusion: Standardized loss, yield, and buffer-coverage information is recommended instead of capital mandates.The disclosure duty may apply to protocols or service providers that front access.