FOLLOW THE MECHANISM
- 1Authority
Identify who or what can authorize transfers and changes.
- 2Mechanism
Check the rules that transform assets and obligations.
- 3Dependencies
- 4Recovery
Determine what remains accessible when a component fails.
A conceptual sequence. Real implementations can add steps, intermediaries, and conditions.
Begin with the control layer
A stolen signing key can authorize transfers that the chain considers valid. A lost key can leave assets inaccessible. Custodians replace personal key management with reliance on their own operations and obligations. Administrative keys can control upgrades, pauses or minting permissions even when ordinary users hold their own wallet keys. These are different authorities. A diagram that labels every box decentralized hides the exact permissions that determine what an attacker or operator can do.
Correct execution can still produce loss
A smart-contract bug can permit unintended transfers, but economic failure does not always require a coding error. An AMM can execute its formula correctly while an LP underperforms holding. A lending contract can liquidate according to its rules after an adverse price move. A stablecoin can lose its market peg because redemption is slow or backing is impaired. Separating software defects from intended but risky behavior makes an explanation more useful than saying that all losses are hacks.
Dependencies transmit failures
A lending market may accept a liquid staking receipt that relies on validators, a pool, an oracle and a bridge. Failure in any upstream layer can impair the local collateral while the lending code continues to run. Shared operators and common assets can correlate exposures that appear diversified by brand name. Liquidity can disappear when many users try to exit through the same market. The right unit of analysis is the dependency chain and its consolidated claims, not simply the number of tokens held.
Evidence has a scope
An audit examines particular code and assumptions at a particular time. Formal verification proves specified properties under a model. A reserve report checks a defined set of facts and may omit liabilities or subsequent changes. None is a universal certificate of safety. Useful evidence names the version, deployment, privileges, unresolved issues and limits of the check. This atlas uses fictional balances so readers can inspect failure paths without signing transactions, sharing secrets or risking real assets.
MAKE IT CONCRETE
A layered failure example
A bridge loses backing for a wrapped token used as collateral. Its local token contract can still transfer normally, but the claim’s recovery value falls. That economic impairment can trigger lending losses without any bug in the lender.
FAILURE PATHS & COMMON MISREADINGS
Where the model can break
- An audit’s existence is not a guarantee about every deployed component.
- Several tokens can share the same hidden point of failure.
KEEP EXPLORING