DeFi/CeFi failure-mode taxonomy — what actually breaks yield venues

TL;DR — the decision rule

A corpus of ~40 stablecoin depegs and DeFi/CeFi blowups, classified by root cause and mapped to our rubric. The honest finding: you cannot rank “most common cause” from this data (it is thematically sampled and visibility-biased), but the consequence pattern is clear and actionable.

The largest single blow-up is reflexive token economics (Terra) — but that is one outlier. The largest robust permanent-loss cluster is opaque off-chain counterparty insolvency / re-hypothecation / attestation failure (Celsius, Voyager, Genesis, BlockFi, Babel, Orthogonal — multiple independent billion-dollar events). Bridges and smart-contract exploits dominate the headlines but are heavily recovered (high gross, lower permanent loss). Treat off-chain solvency & attestation dependencies as the top under-priced risk in any eval — it is both the most reliable permanent-loss signal and our framework’s biggest blind spot. Never size off a “most common by count” claim.

Scope & caveat (read first — every eval citing this inherits it)

This is a thematically-sampled, visibility-biased corpus — five category lists, curated. So:

• No “most common by count” claim is valid. Category counts are an artifact of how many lists targeted each theme; loud, timestamped exploits are over-counted while quiet failures — soft depegs that recovered, redemption pauses, share-price haircuts, graceful wind-downs — are systematically invisible (they leave no exploit tx to index).
• Use this for mechanism lessons and framework coverage-gap mapping, not base rates.
• Loss figures are as reported by third-party sources, not independently on-chain-verified.

Taxonomy (root-cause categories)

• A — Reflexive / emissions economics: peg or yield backed by the protocol’s own token, or paid from emissions/new deposits.
• B — Oracle manipulation: spot/thin price used as truth; flash-loan-skewed feed drives bad liquidations or over-borrowing.
• C — Smart-contract bug: reentrancy, missing health check, rounding — usually amplified by flash-loan capital.
• D — Key / governance / OPSEC compromise: weak multisig, flash-loan governance, or signer-device/supply-chain attack.
• E — Off-chain counterparty insolvency / re-hyp / attestation failure: backing depends on an off-chain entity whose solvency or attestation is unverifiable on-chain.
• F — Bridge / cross-chain compromise: the messaging/custody layer under an asset is drained.
• G — Bank-run / liquidity-mismatch depeg: liquid liabilities, illiquid backing; the buffer exhausts and the queue freezes.

What the corpus supports (ranked honestly)

• Largest single event: A — reflexive (Terra, ~$45–50B UST+LUNA as reported). One observation carrying the dollar lead → read as “the worst tail is a reflexive death spiral,” not “most frequent.”
• Largest robust permanent-loss cluster: E — off-chain insolvency (Celsius ~$1.2B deficit; Voyager ~$1.3B; Genesis multi-billion; BlockFi; Babel; Orthogonal). Multiple independent billion-dollar events → the most reliable dollar signal, more so than the single Terra outlier.
• Most over-represented by visibility / most recovered: B + C + F — loud and individually nameable, but heavily netted by recovery (Poly Network ~$0 net, Wormhole replenished, Euler ~$197M largely returned, Angle agEUR recovered). High gross, lower permanent loss.
• Most frequent technical mechanism (bin-dependent, do not cite as “most common”): oracle manipulation (B) and key/governance compromise (D).
• The under-counted tail: quiet soft-depegs that recovered (USDC/SVB, USDD, DAI/USDT wobbles), redemption pauses (TUSD), and pro-rata haircuts (Maple pools). These are the modal bad outcome and are nearly absent from any list like this.

Framework coverage map

Plain rubric section names; coverage is for catching the failure pre-incident.

Recommended framework changes (ranked)

1. Off-chain counterparty solvency & re-hypothecation Hard-no — applied in this change to the Governance & counterparty section, with the playbook principle “trace every off-chain leg to an audited balance sheet, or treat it as a discretionary promise.” Highest leverage: it maps to the most robust permanent-loss cluster (E) and generalizes to every RWA / CeFi-backed / delta-neutral product. Would have flagged Celsius, the Maple defaults, msUSD.
2. Bridge sub-checklist (proposal) — evaluate the bridge under an asset as a first-class entity (security model: light-client vs multisig vs MPC vs optimistic; signer composition + jurisdiction; upgrade/init safety; audit-of-deployed-version).
3. Signer-OPSEC clause (proposal) — in the key-compromise section: blind-signing, developer-device compromise, payload substitution.
4. Oracle-feed wording fix (proposal) — extend the Oracle & liquidity dimension to explicitly cover the protocol’s internal liquidation/valuation feed, not only our exit pricing.
5. Pre-mortem step (proposal) — one line forcing “name the narrative that would make us wrong,” to counter classification capture.

Methodology

Appendix — selected incidents (sourced)

Bridges (Ronin, Wormhole, Nomad, Harmony, Multichain, BNB Bridge, Poly Network) are in the full workflow corpus (run wf_4c410b6f); omitted from this table pending a dedicated bridge sub-study, since they are the framework’s other major blind spot and warrant their own checklist (recommendation #2).