Risk Management

Understand the risks of providing liquidity to Flux vaults and learn how to evaluate and mitigate them.

Overview

As a liquidity provider in Flux, you earn yield by lending capital to managers. While Flux implements multiple safety mechanisms, all DeFi lending carries risks. This guide helps you understand and manage those risks.

---

Key Risks

1. Bad Debt Risk

What it is: Managers default and their collateral is insufficient to cover debt.

How it happens:

• Manager's position becomes underwater

• Liquidation occurs too late

• Asset price crashes faster than liquidation

• Illiquid assets cannot be sold quickly

Impact:

• Vault share value decreases

• LPs lose principal

• Cannot be recovered

Mitigation:

// Check vault's bad debt before depositing
uint256 badDebt = vault.getBadDebt();
uint256 totalAssets = vault.totalAssets();

// Bad debt ratio
uint256 badDebtRatio = badDebt * 100 / totalAssets;

require(badDebtRatio < 5, "Excessive bad debt");  // < 5% threshold

2. Liquidity Risk

What it is: Cannot withdraw your funds when needed.

How it happens:

• High vault utilization (>90%)

• Managers holding long-term positions

• Market stress causes everyone to withdraw simultaneously

• Insufficient idle liquidity causes withdrawals to fail

Impact:

• Funds locked temporarily

• Must wait for manager repayments

• Opportunity cost

Mitigation:

// Check utilization before depositing
uint256 utilization = vault.totalBorrowed() * 100 / vault.totalAssets();

if (utilization > 85) {
    // High risk of illiquidity
    revert("Vault over-utilized");
}

// Always keep exit liquidity in mind
uint256 availableLiquidity = vault.totalAssets() - vault.totalBorrowed();

3. Smart Contract Risk

What it is: Bugs or exploits in smart contracts.

How it happens:

• Undiscovered vulnerabilities

• Logic errors in strategy

• Oracle manipulation

• Reentrancy attacks

Impact:

• Complete loss of funds

• Protocol exploit

• Cascading failures

Mitigation:

• Only use audited vaults

• Check audit reports

• Prefer established vaults with TVL history

• Diversify across multiple vaults

4. Oracle Risk

What it is: Price feed manipulation or failure.

How it happens:

• Oracle returns incorrect prices

• Flash loan price manipulation

• Oracle downtime

• Stale price data

Impact:

• Incorrect liquidations

• Undercollateralized positions go unliquidated

• Bad debt accumulation

Mitigation:

// Check oracle configuration
IOracleRegistry oracles = vault.ORACLE_REGISTRY();

// Verify oracle sources
for (uint i = 0; i < assets.length; i++) {
    address oracle = oracles.getOracle(assets[i]);

    // Ensure oracle exists and is reliable
    require(oracle != address(0), "No oracle");

    // Check oracle freshness
    (uint256 price, uint256 timestamp) = IOracle(oracle).getPrice();
    require(block.timestamp - timestamp < 1 hours, "Stale oracle");
}

5. Strategy Risk

What it is: Strategy parameters allow excessive risk-taking.

How it happens:

• Low collateral requirements (minBondRatio)

• Risky allowed assets

• High leverage allowed

• Poor liquidation parameters

Impact:

• Managers take excessive risk

• Higher bad debt probability

• Losses for LPs

Mitigation:

// Evaluate strategy safety
IStrategy strategy = vault.STRATEGY();

// Check bond requirements
uint256 minBondRatio = strategy.minBondRatio();
require(minBondRatio >= 0.2e18, "Insufficient collateral requirement");  // >= 20%

// Check allowed assets
IAsset[] memory allowedAssets = strategy.getAllowedAssets();

for (uint i = 0; i < allowedAssets.length; i++) {
    // Verify each asset is safe
    require(isWhitelistedAsset(allowedAssets[i]), "Risky asset allowed");
}

6. Manager Risk

What it is: Manager behavior causes losses.

How it happens:

• Incompetent trading

• Excessive leverage

• Poor risk management

• Intentional misconduct

Impact:

• Position liquidations

• Bad debt

• Lower returns

Mitigation:

• Research managers before depositing

• Check manager track record

• Monitor manager positions

• Prefer vaults with professional managers

7. Regulatory Risk

What it is: Regulatory action against protocol or participants.

How it happens:

• DeFi regulations change

• Sanctions on addresses

• Geographic restrictions

• Compliance requirements

Impact:

• Access restrictions

• Forced liquidations

• Legal liability

Mitigation:

• Understand your jurisdiction's regulations

• Use compliant vaults if necessary

• Consider KYC'd vaults for regulatory certainty

• Monitor regulatory developments

---

Risk Assessment Framework

Vault Safety Checklist

struct VaultRiskAssessment {
    // Contract Safety
    bool isAudited;
    uint256 auditScore;         // 0-100
    uint256 ageInDays;          // Older = more battle-tested

    // Strategy Safety
    uint256 minBondRatio;       // Higher = safer
    uint256 liquidationBuffer;   // Higher = safer
    bool hasRiskyAssets;        // False = safer

    // Historical Performance
    uint256 badDebtRatio;       // Lower = safer
    uint256 avgUtilization;     // Lower = more liquid
    uint256 tvl;                // Higher = more established

    // Oracle Safety
    bool hasReliableOracles;
    uint256 oracleFreshness;    // Recent = safer

    // Overall Score
    uint256 riskScore;          // 0-100, higher = riskier
}

Computing Risk Score

function calculateRiskScore(address vault) public view returns (uint256) {
    IFluxVault v = IFluxVault(vault);
    IStrategy s = v.STRATEGY();

    uint256 score = 0;

    // Bad debt penalty (0-30 points)
    uint256 badDebtRatio = v.getBadDebt() * 100 / v.totalAssets();
    score += badDebtRatio > 10 ? 30 : badDebtRatio * 3;

    // Utilization penalty (0-20 points)
    uint256 util = v.totalBorrowed() * 100 / v.totalAssets();
    score += util > 90 ? 20 : util / 5;

    // Bond ratio (0-25 points)
    uint256 bondRatio = s.minBondRatio();
    score += bondRatio < 0.1e18 ? 25 : bondRatio < 0.2e18 ? 15 : 5;

    // Oracle risk (0-15 points)
    score += hasReliableOracles(vault) ? 0 : 15;

    // Age penalty (0-10 points)
    uint256 age = getVaultAge(vault);
    score += age < 30 days ? 10 : age < 90 days ? 5 : 0;

    return score;  // 0-100, lower is safer
}

Risk Categories

Risk Score	Category	Recommendation
0-20	Low Risk	Safe for conservative LPs
21-40	Medium Risk	Acceptable for moderate risk tolerance
41-60	High Risk	Only for risk-tolerant LPs
61-100	Very High Risk	Avoid unless expert

Diversification Strategies

Don't Put All Funds in One Vault

// ❌ BAD: All funds in one vault
vault1.deposit(10000e6, user);

// ✅ GOOD: Diversified across multiple vaults
vault1.deposit(3000e6, user);  // Conservative vault
vault2.deposit(3000e6, user);  // Moderate vault
vault3.deposit(2000e6, user);  // Different asset
vault4.deposit(2000e6, user);  // Different strategy

Diversification Dimensions

1. Different base assets: USDC, WETH, DAI

2. Different strategies: Conservative vs aggressive

3. Different protocols: Not just Flux

4. Different risk profiles: Mix safe and risky

Portfolio Allocation Example

Conservative Portfolio:
- 40% Low-risk Flux vault (bond ratio >30%)
- 30% Moderate Flux vault (bond ratio >20%)
- 20% Established DeFi protocol (Aave, Compound)
- 10% Stablecoins (safety reserve)

Moderate Portfolio:
- 30% Low-risk Flux vault
- 40% Moderate Flux vault
- 20% High-yield Flux vault
- 10% Stablecoins

Aggressive Portfolio:
- 20% Low-risk Flux vault
- 30% Moderate Flux vault
- 40% High-yield Flux vault
- 10% Experimental strategies

---

Monitoring Your Positions

Daily Monitoring

function dailyHealthCheck(address vault) external view returns (bool healthy) {
    IFluxVault v = IFluxVault(vault);

    // 1. Check share price hasn't decreased
    uint256 currentPrice = v.convertToAssets(1e18);
    require(currentPrice >= lastKnownPrice, "Share price decreased");

    // 2. Check bad debt hasn't increased significantly
    uint256 badDebt = v.getBadDebt();
    uint256 badDebtRatio = badDebt * 100 / v.totalAssets();
    require(badDebtRatio < 5, "Bad debt too high");

    // 3. Check utilization is reasonable
    uint256 util = v.totalBorrowed() * 100 / v.totalAssets();
    require(util < 95, "Vault over-utilized");

    // 4. Check your position value
    uint256 myValue = v.convertToAssets(v.balanceOf(msg.sender));
    require(myValue > 0, "Position has no value");

    return true;
}

Red Flags to Watch

1. Share price decreasing: Immediate action required

2. Bad debt increasing: Monitor closely

3. Utilization >95%: Liquidity risk

4. Manager liquidations: Strategy may be too risky

5. Oracle failures: Critical risk

6. Low idle liquidity: May indicate others are exiting

Automated Alerts

// Set up alerts for critical events
event SharePriceDecreased(uint256 oldPrice, uint256 newPrice);
event BadDebtIncreased(uint256 amount);
event UtilizationCritical(uint256 utilization);

// Monitor and alert
function monitorVault(address vault) external {
    IFluxVault v = IFluxVault(vault);

    uint256 sharePrice = v.convertToAssets(1e18);
    if (sharePrice < previousSharePrice) {
        emit SharePriceDecreased(previousSharePrice, sharePrice);
    }

    // ...other checks
}

---

Risk Mitigation Strategies

1. Gradual Entry

Don't deploy all capital at once:

// Week 1: Test with small amount
vault.deposit(100e6, user);

// Week 2: If performance good, increase
vault.deposit(500e6, user);

// Week 3: If still good, deploy more
vault.deposit(2000e6, user);

// Month 2: Full deployment
vault.deposit(7400e6, user);

2. Position Sizing

Never allocate more than you can afford to lose:

Total Portfolio: $100,000

Max allocation per vault: $10,000 (10%)
Max allocation to Flux: $30,000 (30%)
Max allocation to high-risk: $5,000 (5%)

3. Stop-Loss Strategy

Set predetermined exit criteria:

function shouldExit(address vault) public view returns (bool) {
    IFluxVault v = IFluxVault(vault);

    // Exit if share price drops >5%
    uint256 currentPrice = v.convertToAssets(1e18);
    if (currentPrice < entryPrice * 95 / 100) return true;

    // Exit if bad debt >3%
    uint256 badDebtRatio = v.getBadDebt() * 100 / v.totalAssets();
    if (badDebtRatio > 3) return true;

    // Exit if utilization >97%
    uint256 util = v.totalBorrowed() * 100 / v.totalAssets();
    if (util > 97) return true;

    return false;
}

4. Rebalancing

Periodically rebalance based on risk:

// Monthly rebalancing
function rebalance() external {
    // If a vault becomes too risky, reduce exposure
    if (calculateRiskScore(vault1) > 60) {
        reducePosition(vault1, 50);  // Cut by 50%
    }

    // Reallocate to safer vaults
    if (calculateRiskScore(vault2) < 20) {
        increasePosition(vault2);
    }
}

---

Insurance and Protection

Protocol Insurance

Some protocols offer coverage:

• Third-party insurance (Nexus Mutual, Unslashed)

• Protocol-owned insurance funds

• Safety modules

// Check if vault has insurance
function hasInsurance(address vault) external view returns (bool) {
    // Query insurance protocols
    bool nexusMutualCovered = checkNexusMutual(vault);
    bool unslashedCovered = checkUnslashed(vault);

    return nexusMutualCovered || unslashedCovered;
}

Self-Insurance

Set aside a portion of returns as a safety buffer:

// Allocate 20% of profits to safety fund
uint256 profit = currentValue - initialDeposit;
uint256 safetyAllocation = profit * 20 / 100;

// Keep safety fund in stablecoins
safetyFund += safetyAllocation;

---

Emergency Procedures

When to Exit Immediately

1. Share price dropping rapidly

2. Smart contract exploit detected

3. Bad debt >10% of vault

4. Oracle failure

5. Manager misconduct

How to Exit in Emergency

function emergencyExit(address vault) external {
    IFluxVault v = IFluxVault(vault);

    uint256 shares = v.balanceOf(msg.sender);

    // Try standard withdrawal first
    try v.redeem(shares, msg.sender, msg.sender) {
        // Success
    } catch {
        // If that fails, request queued withdrawal
        try v.requestWithdrawal(shares) {
            // In queue
        } catch {
            // Last resort: emergency withdrawal
            v.emergencyWithdraw(shares);
        }
    }
}

---

Further Reading

• Depositing & Withdrawing

• Emergency Withdrawals

• Vault Security

• Liquidation Mechanism