Break it before
you deposit
The risk lab replays real DeFi crises against what each tier holds right now, lets you build your own, and shows the full range of outcomes rather than one APY. The keeper's own risk rules decide every reaction, and every number says what it's based on.
- Kamino Lend28%
- Jupiter Lend28%
- Kamino Earn12%
- Aave v318%
- Morpho9%
- Idle5%
- Jupiter Lend30%
- Kamino RWA16%
- Perena11%
- Solstice11%
- Exponent11%
- Maple16%
- Idle5%
Replay a real crisis
Eight DeFi disasters, mapped onto the venues each tier holds right now. The keeper's actual risk rules decide what happens on every 10-minute cycle: when it notices, what it pulls, and what it can't get out of.
USDC depeg
10 to 13 March 2023Circle disclosed that $3.3B of USDC's reserves sat at the failed Silicon Valley Bank. USDC traded down to about $0.88 over the weekend and recovered once US regulators guaranteed SVB's deposits.
In Bedrock: Every venue holds USDC, so the whole vault, idle cash included, is repriced in dollars. No venue loses principal.
What happens, cycle by cycle
- Day 1, 07:00 · What happensUSDC starts trading below $1
- Day 2, 02:00 · What happensUSDC bottoms at $0.878
- Day 4, 08:00 · What happensUSDC back within half a cent of $1
Modelled and assumed
- USDC low$0.878 about a day inModelled
- Back above $0.99about 2.5 days laterModelled
- Venue lossesnone; lending markets keep runningAssumed
- Sentinelno rule watches USDC against the dollar; it reacts to nothingModelled
Venue by venue
| Venue | Before | After | Worst verdict | Loss |
|---|---|---|---|---|
| Kamino Lendest. | 28.1% | 28.1% | ok | 0 |
| Jupiter Lendest. | 28.1% | 28.1% | ok | 0 |
| Kamino Earnest. | 11.7% | 11.7% | ok | 0 |
| Aave v3est. | 17.6% | 17.6% | ok | 0 |
| Morphoest. | 9.4% | 9.4% | ok | 0 |
Weights are shares of the tier. Losses are shares of the tier's starting value, after any recovery.
Build your own disaster
Stack the shocks you worry about and watch both tiers respond live. Everything runs in your browser against today's allocations; copy the link to share the exact scenario.
Bedrock
1 venue hit- Day 2, 00:00 · LossJupiter Lend exploited: 30% of deposits lost, 8.45% of the tier
- Day 2, 06:00 · SentinelJupiter Lend pause: exploit listed by an operator (cap 0, exit)
- Day 2, 06:00 · KeeperExit from Jupiter Lend blocked: no free liquidity
- Day 7, 00:00 · What happensJupiter Lend reopens withdrawals
- Day 7, 00:00 · KeeperKeeper pulls 19.72% of the tier from Jupiter Lend
Rapids
1 venue hit- Day 2, 00:00 · LossJupiter Lend exploited: 30% of deposits lost, 9.00% of the tier
- Day 2, 06:00 · SentinelJupiter Lend pause: exploit listed by an operator (cap 0, exit)
- Day 2, 06:00 · KeeperExit from Jupiter Lend blocked: no free liquidity
- Day 7, 00:00 · What happensJupiter Lend reopens withdrawals
- Day 7, 00:00 · KeeperKeeper pulls 21.02% of the tier from Jupiter Lend
The range of outcomes
Thousands of simulated futures for each venue's rate, fitted to up to two years of its own history and correlated across venues, run through the tier's live allocation and net of the performance fee.
Weights stay at today's targets for the whole horizon. The real keeper moves toward better rates, so the median is if anything conservative.
What each venue's rate model was fitted to
Loading rate history...| Venue | Weight | APY now | Long-run | Month-to-month swing | Exploit chance a year | History | From data |
|---|---|---|---|---|---|---|---|
| Kamino LendLending market | 28.1% | 4.40% | 4.40% | ±25% | 0.5% | Prior | 0% |
| Jupiter LendLending market | 28.1% | 4.80% | 4.80% | ±25% | 0.5% | Prior | 0% |
| Kamino EarnCurated vault | 11.7% | 5.60% | 5.60% | ±25% | 1.0% | Prior | 0% |
| Aave v3Lending market | 17.6% | 4.60% | 4.60% | ±25% | 0.5% | Prior | 0% |
| MorphoCurated vault | 9.4% | 4.30% | 4.30% | ±25% | 1.0% | Prior | 0% |
“Month-to-month swing” is the spread of a venue's 30-day average rate, as a share of the rate. “From data” is how much of the fit comes from the venue's own history rather than priors; venues with little history lean on priors fitted to two years of USDC lending rates.
How the lab works
Stress tests and the builder
Each scenario is a list of shocks (an exploit, utilisation locked at 100%, a USDC or synthetic-dollar depeg, a run on deposits, a CCTP halt) replayed on the keeper's 10-minute cycle against the live targets from the keeper's /targets.
On every cycle a copy of the keeper's sentinel (rules-v1 with its hysteresis: utilisation 95%/99%, 7-day TVL -15%/-30%, NAV 0.2%/1% below backing, APY 3x/5x its 7-day median, 30 and 10 minute confirmations, relaxed clear thresholds) reads only the signals the keeper's feeds really report, and the planner's safety exits cut anything above the lowered cap.
Exits wait for free liquidity, take 25% of a crowded venue's free liquidity per cycle for a vault of $10.0M, and take each venue's exit time (CCTP transfers about 30 minutes, Maple's queue a day). Exited funds stay idle.
Yield projections
Each venue's log APY is a slow level that reverts to its long-run mean (half-life about four months) plus fast day-to-day noise, fitted to up to two years of daily history from DefiLlama's yields API, or the keeper's /rates/history where DefiLlama has no pool.
Shocks are correlated across venues by the correlation of their daily rate changes. Short histories are blended with priors fitted to two years of USDC lending rates. Weights stay at today's targets, idle cash earns nothing, and the performance fee is charged only above the high-water mark.
Exploit risk, when on, is an assumption: a yearly chance of 0.15% x risk score^1.7 per venue, losing 10% to 60%.
What this can't tell you
History doesn't repeat exactly. A crisis mapped onto today's venues is an analogy: we keep the shape of what happened and say where we had to guess. The exploit probabilities are not fitted to anything, because there is too little honest data to fit them to.
The keeper's hand-maintained incident list is modelled as an operator acting hours after an event. The real keeper also redeploys exited funds into healthy venues, which this leaves out. It doesn't model smart-contract risk in Aqueduct's own program.