Risk

Risk is the path from a failed assumption to a changed asset, claim, or loss allocation. A risk label is useful only when it names the trigger, affected state, propagation path, controls, and ultimate loss bearer.

failed assumption → invalid or delayed state transition
invalid state     → asset or claim mismatch
mismatch          → blocked exit, bad debt, or lower claim value
loss allocation   → named holder, reserve, backstop, or counterparty

Controls reduce a defined exposure; they do not prove a protocol safe. Audits, tests, monitoring, caps, pauses, diversification, timelocks, and insurance each cover different assumptions and leave residual risk.

Concepts in this family

• Smart-contract risk connects code and configuration failures to unauthorized transfers, false claims, and blocked exits.
• Oracle risk follows stale, manipulated, unavailable, or mis-scaled data into valuation and settlement decisions.
• Liquidity risk separates quoted or accounting value from executable conversion under a size and deadline.
• Solvency risk compares realizable assets and committed backstops with recognized liabilities and claims.
• Governance risk identifies every actor and role that can change financial rules or exercise emergency control.
• Bridge risk reconciles cross-chain messages and destination claims with source-chain state and backing.
• Integration risk tests the assumptions where tokens, protocols, routers, adapters, and callbacks meet.
• Accounting risk checks whether assets, liabilities, shares, debt, fees, profit, and loss still reconcile.
• Upgrade risk follows code and storage changes through existing balances, approvals, claims, and integrations.
• MEV risk explains how transaction inclusion and ordering can change execution and transfer value.

A reusable risk trace

For any protocol or product, record:

1. the assumption that can fail and the observable trigger;
2. the first contract, balance, price, claim, or control state affected;
3. every dependent protocol and layered claim reached by the failure;
4. preventive, detective, limiting, recovery, and compensation controls;
5. control authority, response timing, liquidity, and failure conditions; and
6. who ultimately loses principal, access, time, optionality, or control.

Do not collapse probability, exposure, liquidity, and maximum loss into one word such as “safe.” Compare risks only after their scope, horizon, units, assumptions, and loss allocation use compatible definitions.