Decentralized Finance (DeFi)
Trilemma with Explicit Trade-offs:
Efficiency, Safety, Composability
Overview
- You cannot maximize all three at once.
Each lever has a cost elsewhere. Aim to
sit on the Pareto frontier for your
users and market regime.
- How to reason: define levers (tunable
knobs), metrics (to price the cost),
and guardrails (risk budgets, circuit
breakers). Make trade-offs explicit and
measurable.
Understanding the Three Vertices
1) Capital Efficiency: The Holy Grail
- Definition: value per unit of locked
capital.
- Traditional finance (TradFi) bounds:
Mortgage ($100k→1 loan), Margin
($100k→~$200k), Fractional reserves
($100k→~$900k loans).
- DeFi boosters: recursive lending; yield
stacking; flash-loan amplification;
cross-protocol reuse.
- Peak example:
$100k ETH → stETH (4%) → Aave collateral
(borrow $80k) → Curve LP (15%) → Convex
staking (20%) → Abracadabra collateral
(borrow more). Outcome: 40%+ gross,
$150k+ total borrow on $100k base.
Trade-off levers → costs
- Higher collateral factor, tighter
liquidation threshold (LT) → higher
liquidation probability and tail
losses.
- Collateral reuse across protocols →
correlation and contagion risk.
- Deeper recursion/leverage → complex
unwind and price impact.
- Looser oracle windows, slower cadence →
manipulation and lag risk.
- Incentive boosts (token emissions) →
reflexivity, emissions overhang, and
mercenary liquidity.
Key metrics
- Risk-adjusted yield (RAY) =
(GrossYield − ExpectedLoss − Gas/
operations (Ops) − Funding/
IncentiveDecay) / RiskCapital
- Probability of liquidation (PDliq),
loss given liquidation (LGDliq)
- Drawdown at Risk (DaR), Expected
Shortfall (ES), oracle failure prob.
2) Safety: The Foundation
- Dimensions: Protocol (smart contract,
economic design, governance), Systemic
(failure isolation, orderly
liquidations, exit liquidity), User
(predictability, error protection,
recovery).
- Trade-off levers → costs:
- Higher collateral ratio (CR),
conservative rate curves → idle
capital, lower yields.
- Isolated/segmented pools → reduced
composability and capital reuse.
- Strict oracles (time-weighted average
price (TWAP), quorum) → slower
response, missed opportunities.
- Whitelisted integrations, audits →
slower innovation, higher coordination
cost.
- Limits/circuit breakers → execution
frictions, opportunity cost in calm
regimes.
- Key metrics: security margin to attack
thresholds; blast-radius index (max
value at risk per module); time-to-
recovery; exception resolution rate.
3) Composability: The Innovation Engine
- Modes: Technical (Ethereum Request for
Comments (ERC-20, ERC-721), atomicity,
permissionless hooks); Financial
(cross-collateral, routed decentralized
exchange (DEX) liquidity, derivatives
referencing others); Innovation (lego-
like building, emergent products).
- Trade-off levers → costs:
- Permissionless integrations, collateral
listings → larger attack surface, risk
opacity.
- Deep cross-protocol dependencies →
correlated failures, audit complexity.
- Cross-chain bridges/intents → bridge
security/maximal extractable value
(MEV) risks, data availability
assumptions.
- Metrics: dependency directed acyclic
graph (DAG) depth/width; critical
dependency score; audit complexity
index; gas/user experience (UX)
overhead; failure-propagation factor.
The Fundamental Tensions
Efficiency ↔ Safety: The Leverage Dilemma
- Max efficiency: 10x recursion, ~110%
CR, aggressive LTs, multi-protocol
routes → tiny moves liquidate;
cascades; thin liquidation liquidity.
- Max safety: 200%+ CR, isolated pools,
conservative oracles, simple flows →
idle capital, lower returns, users
chase risk elsewhere.
- Guardrails:
- Cap recursion depth; target PDliq ≤ 2%
per week under 95% Value at Risk
(VaR) stress.
- Dynamic CR/LT via regime detection;
auction backstops, slippage caps.
- Concentration limits per asset/pool;
loan-to-value ratio (LVR) caps for
volatile pairs.
- Pricing:
- Expected loss (EL) = PDliq × LGDliq +
oracle fail prob × oracle loss
- Optimize RAY subject to ES95 ≤ limit
and blast radius ≤ budget.
Safety ↔ Composability: Isolation Paradox
- Max composability: any collateral,
limitless hooks → infections, opaque
risk, huge attack surface.
- Max safety: isolation, whitelists,
strict params → lego effect fades, slow
innovation.
- Guardrails:
- Collateral/integration tiering (green/
amber/red) with per-tier caps and
dynamic downgrades under stress.
- Quorum-gated adapters; circuit
breakers that sever cross-protocol
calls on anomalies.
- Pricing:
- Composability Cost Index (CCI) =
f(path length, dependency criticality,
audit debt, gas/latency)
- Require marginal RAY gain > CCI
hurdle.
Composability ↔ Efficiency: Complexity Trap
- Max integration: infinite strategies,
auto-optimizers → risk unmeasurable;
gas/UX pain; audit scope balloons.
- Direct/simple paths: predictable,
efficient execution → fewer
opportunities; potential
underperformance.
- Guardrails:
- Strategy allowlists; path-length ≤ N;
gas/latency budgets.
- Intent/route simulators with worst-
case slippage caps.
- Pricing:
- Only compose when ΔRAY > ΔCCI and EL
does not increase beyond budget.
Real-World Manifestations
Case 1: Anchor (Terra)
- Pushed efficiency + composability
(subsidized 20% yield, ubiquity);
underpriced safety → reflexive unwind,
death spiral, $60B collapse.
Case 2: Compound V2
- Prioritized safety + measured
composability (isolated, conservative)
→ durable but lower efficiency; risk-
seeking users migrated.
Case 3: Euler
- Balanced attempt (permissionless lists,
risk-tiered pools) → added complexity
widened attack surface; one exploit
drained ~$200M.
Current Approaches to the Trilemma
1) Risk Tranching
- Align user risk appetites to frontier
points (senior/mezz/junior). Price
safety as an insurance-like premium.
2) Dynamic Parameters
- Regime-aware tuning of CR/LT, rate
curves, LVR caps; throttle composability
during stress.
3) Modular Architecture
- Core (safety), Strategy (efficiency),
Integration (composability); define
contracts and kill-switches between
layers.
4) Insurance Layers
- Protocol insurance, smart-contract
cover, systemic pools; transfer part of
the safety cost to premia.
The Philosophical Divide
Maximalists
- Efficiency: “10x TradFi” → accepts
failures, chases growth.
- Safety: “Never lose funds” → conservative,
compliance-first.
- Composability: “Permissionless forever”
→ open integrations, resist censorship.
Pragmatists
- Retail: safety-first.
- Institutional: balanced mix with
service level agreements (SLAs) and
observability.
- Experimental: efficiency/composability
in sandboxes with total value locked
(TVL) caps.
Future Directions (move the frontier)
Technical
- Zero-knowledge (ZK) proofs: composability
with selective disclosure → safety up
with minimal leakage.
- Cross-chain with fault containment
(asynchronous Inter-Blockchain
Communication (IBC), insured bridges)
→ composability up with bounded blast
radius.
- Artificial intelligence (AI) risk
managers: predictive liquidations,
regime detection → more efficiency
within safety budgets.
Regulatory Integration
- Embedded compliance (protocol-level
Know Your Customer (KYC) / Anti-Money
Laundering (AML), reporting) → safety
up while preserving UX.
- Sandboxes → time-boxed risk for high-
efficiency experiments.
Social
- Risk disclosure standards, unified
metrics → better pricing of trade-offs.
- Reputation systems → lower information
asymmetry across protocols and users.
The Uncomfortable Truth
- The trilemma is not “solved”; it is
managed. We must: (1) accept trade-offs,
(2) build in layers, (3) embrace
heterogeneity, (4) evolve continuously.
Conclusion: The Ongoing Experiment
- Pick your frontier point, price each
lever, add guardrails, and iterate as
regimes change. Winners will state
their stance, run sustainable models,
adapt fast, and deliver value beyond
speculation.
去中心化金融(DeFi)三难困境(含权衡)：效率·安全·可组合性
概览
- 核心思路：三者不可同时极致。每推一端
都要在另一端付出成本。目标是在
你的用户与所处周期的帕累托前沿
上选点。
- 方法：定义“旋钮”（可调参数）、“度量”
（用于给成本定价）、“护栏”（风险预
算/熔断）。让权衡显性、可计价、可管。
理解三个顶点
1) 资本效率：圣杯
- 定义：单位锁定资本的产出价值。
- 传统金融（Traditional Finance, TradFi）
的边界：按揭（$100k→1 笔）、保证金
（$100k→~$200k）、部分准备金（$100k
→~$900k 放贷）。
- DeFi 提升器：递归借贷、收益叠加、闪
电贷放大、跨协议复用。
- 峰值示例：
$100k ETH→stETH(4%)→Aave 抵押（借
$80k）→Curve LP(15%)→Convex 质押
(20%)→Abracadabra 抵押（再借）。
结果：总收益 40%+；总借款 $150k+；
原始资本 $100k。
权衡旋钮 → 成本
- 抵押因子更高、清算阈值（Liquidation
Threshold, LT）更紧 → 清算概率与尾部
亏损上升。
- 抵押品跨协议复用 → 相关性与传染风险
上升。
- 杠杆/递归更深 → 退出更复杂、价格冲
击更大。
- 预言机窗口放宽或更新变慢 → 被操纵与
滞后风险更高。
- 高额激励（代币排放）→ 反身性、抛压、
雇佣流动性问题。
关键指标
- 风险调整收益（Risk‑Adjusted Yield,
RAY）=（总收益−预期损失−Gas/运维−资
金成本/激励衰减）/ 风险资本。
- 预期损失（Expected Loss, EL）；清算概
率（Probability of Liquidation, PDliq）；
清算损失率（Loss Given Liquidation,
LGDliq）。
- 回撤在险（Drawdown at Risk, DaR）、
预期短缺（Expected Shortfall, ES）、
预言机失败概率。
2) 安全性：地基
- 维度：协议（合约/经济/治理）、系统（故
障隔离、清算有序、退出流动性）、用户
（可预期、防差错、可恢复）。
- 旋钮 → 成本：
- 更高抵押率（Collateral Ratio, CR）、
更保守利率曲线 → 资本闲置、收益走低。
- 隔离/分段池 → 可组合性与资本复用下降。
- 严格预言机（时间加权平均价 Time‑
Weighted Average Price, TWAP；法定
仲裁/多方投票）→ 响应变慢、错失机会。
- 白名单集成、严格审计 → 创新变慢、协
调成本更高。
- 限额与熔断 → 执行摩擦、平稳期机会成本。
- 指标：安全裕度；爆炸半径（单模块最大
风险敞口）；恢复时间；异常解决率。
3) 可组合性：创新引擎
- 形态：技术（以太坊标准建议 Ethereum
Request for Comments, ERC‑20/721；原子
性；无许可钩子）、金融（跨抵押、多池
路由、去中心化交易所 Decentralized
Exchange, DEX 流动性、衍生品引用）、创
新（积木式构建、涌现产品）。
- 旋钮 → 成本：
- 无许可集成、自由上币/抵押 → 攻击面扩
大、风险不透明。
- 深度跨协议依赖 → 相关性故障、审计复杂。
- 跨链桥/意图系统 → 桥接安全、最大可提
取价值（Maximal Extractable Value, MEV）
与数据可用性风险。
- 指标：依赖有向无环图（Directed Acyclic
Graph, DAG）深度/宽度、关键依赖分数；
审计复杂度指数；Gas/用户体验（User
Experience, UX）开销；故障传播系数。
基本张力
效率 ↔ 安全：杠杆困境
- 极致效率：10x 递归、~110% 抵押率（CR）
、激进清算阈值（LT）、多协议路径。
后果：小幅波动即清算；级联；清算流动
性不足。
- 极致安全：200%+ CR、隔离池、保守预言机
、简单路径。后果：资本闲置、回报走低
、用户外流。
- 护栏：
- 限制递归层数；在 95% 在险价值（Value
at Risk, VaR）压力下，周度 PDliq ≤ 2%。
- 基于状态识别动态调 CR/LT；拍卖后备与
滑点上限。
- 资产/池集中度限制；高波动交易对的贷
款价值比（Loan‑to‑Value Ratio, LVR）上限。
- 定价：
- 预期损失（EL）= PDliq×LGDliq + 预言机
失败概率×预言机损失。
- 在 ES95 与爆炸半径约束下，最大化 RAY。
安全 ↔ 可组合性：隔离悖论
- 极致可组：任意抵押、无限钩子。后果：
跨协议感染、风险不透明、攻击面巨大。
- 极致安全：隔离、白名单、严格参数。后
果：乐高效应消退、创新变慢、效率损失。
- 护栏：
- 抵押/集成分层（绿/黄/红），分层限额；
压力期动态降级。
- 门限适配器；异常时熔断跨协议调用。
- 定价：
- 可组合性成本指数（Composability Cost
Index, CCI）= f(路径长度、依赖关键度、
审计债务、Gas/延迟)。
- 要求边际 RAY 增益 > CCI 门槛。
可组合性 ↔ 效率：复杂性陷阱
- 极致集成：策略爆炸与自动优化。后果：
风险难估；Gas/体验变差；审计范围膨胀。
- 直接/简路径：更可预测与高效。后果：机
会更少；可能跑输。
- 护栏：
- 策略白名单；路径长度 ≤N；Gas/延迟预算。
- 意图/路由模拟器；最坏滑点上限。
- 定价：
- 仅当 ΔRAY > ΔCCI 且 EL 不超预算时，才
进行组合。
现实体现（权衡视角）
案例 1：Anchor（Terra）
- 用补贴拉满效率与可组；安全定价偏低
→ 反身性崩塌与死亡螺旋，约 $60B 归零。
案例 2：Compound V2
- 安全 + 适度可组优先 → 长寿稳健但效率
偏低；风险偏好用户外流。
案例 3：Euler
- 试图平衡三者；复杂性扩大攻击面 → 单
次利用即损失约 $200M。
现行应对路径（权衡工程）
1) 风险分层
- 用高/夹/次级层映射不同风险偏好；将安
全显性计为“保险费”。
2) 动态参数
- 按市场状态调 CR/LT、利率曲线、LVR 上限
；压力期降级可组合性。
3) 模块化架构
- 核心层（安全）、策略层（效率）、集成层
（可组）；设定层间熔断与合约约束。
4) 保险层
- 协议/合约/系统性保险；把安全成本转化
为保费。
哲学分歧
- 极致主义：
效率至上、接受失败；安全至上、重合规
；可组至上、抗审查与开放。
- 实用主义：
面向零售：安全优先。
面向机构：三者平衡 + 服务等级协议
（Service Level Agreement, SLA）与可观测。
面向试验：在沙盒追求效率/可组，并设总
锁仓量（Total Value Locked, TVL）上限。
未来方向（移动前沿）
技术
- 零知识证明（Zero‑Knowledge, ZK）：选择性
披露下提升可组与安全，泄露最小化。
- 跨链容错（异步跨链通信 Inter‑Blockchain
Communication, IBC；投保桥）：在限定爆炸
半径下提升可组。
- 人工智能（Artificial Intelligence, AI）风控：
预测清算、状态识别；在安全预算内提升
效率。
监管融合
- 嵌入式合规（协议级客户尽调 Know Your
Customer, KYC／反洗钱 Anti‑Money
Laundering, AML；报送）：提升安全并保持体
验。
- 监管沙盒：为高效率试验设置时间有限的
风险边界。
社会层
- 风险披露标准与统一指标：更好为权衡定
价。
- 声誉系统：降低协议与用户间的信息不对
称。
不那么舒适的真相
- 三难困境不是被“解”，而是被“管”：1 接
受权衡；2 分层构建；3 拥抱异质；4 持续
演化。
结论：一场持续的实验
- 选定前沿点；为每个旋钮定价；设好护栏
；随周期迭代。胜出者将清晰定位、可持
续运营、快速适应，并提供超越投机的真
实价值。
Trade-off matrix (compact)
- Lever: Collateral ratio (CR)
- Effects:
- Efficiency ↓ Safety ↑ Composability →
- Metrics: Probability of liquidation
(PDliq), Expected Shortfall (ES)
- Guardrail: CR bands; auto raise in
volatility
- Lever: Recursion depth
- Effects:
- Efficiency ↑ Safety ↓ Composability ↑
- Metrics: PDliq vs Value at Risk (VaR)
- Guardrail: Cap depth; PDliq ≤ target
- Lever: Oracle window (shorter)
- Effects:
- Efficiency ↑ Safety ↓ Composability →
- Metrics: Oracle failure probability
- Guardrail: Min time window; quorum rule
- Lever: Pool isolation (more)
- Effects:
- Efficiency ↓ Safety ↑ Composability ↓
- Metrics: Blast radius (max module value)
- Guardrail: Value caps per pool/module
- Lever: Integration policy (open)
- Effects:
- Efficiency ↑ Safety ↓ Composability ↑
- Metrics: Composability Cost Index (CCI)
- Guardrail: Tiered allowlist; per tier
caps
- Lever: Incentive emissions (higher)
- Effects:
- Efficiency ↑ short term Safety ↓
Composability ↑
- Metrics: Emission per Total Value Locked
(TVL), decay rate
- Guardrail: Halvening schedule; clawback
rules; emission caps
- Lever: Bridge exposure (higher)
- Effects:
- Efficiency ↑ Safety ↓ Composability ↑
- Metrics: Bridge Value at Risk (VaR)
- Guardrail: Insured bridges; spend
limits
- Lever: Liquidation discount (wider)
- Effects:
- Efficiency ↑ speed Safety ↑ order
Composability →
- Metrics: Auction slippage
- Guardrail: Dynamic bands by regime
Radar chart template
- Format: JavaScript Object Notation (JSON)
- Short keys used to keep lines brief
- Legend: eff=efficiency, safe=safety,
comp=composability, liq=liquidity
resilience, gov=governance,
obs=observability
```
{
"protocol": "ExampleXYZ",
"scores": {
"eff": 0.65,
"safe": 0.70,
"comp": 0.55,
"liq": 0.60,
"gov": 0.75,
"obs": 0.50
},
"budgets": {
"PD_week": 0.02,
"ES95": 0.15,
"blast_usd": 25000000
}
}
```
Formula recap
- Expected Loss (EL) =
Probability of liquidation (PDliq) ×
Loss Given Liquidation (LGDliq) +
Oracle failure probability × Oracle loss
- Risk Adjusted Yield (RAY) =
(Gross yield − Expected Loss (EL) − Gas −
Operations (Ops) − Incentive decay) /
Risk capital
- Composability Cost Index (CCI) =
f(path length, dependency criticality,
audit debt, gas, latency)
Spreadsheet columns (suggested)
- asset, pool, Collateral Ratio (CR),
Liquidation Threshold (LT), PDliq,
LGDliq, Expected Loss (EL)
- gross_yield, gas, operations (Ops),
incentives, Risk Adjusted Yield (RAY)
- Composability Cost Index (CCI),
ES95, blast_radius_usd, status, notes
Checklists (quick)
- Before deploy:
publish ranges, stress tests,
risk budgets, rollback plan
- During runtime:
track PDliq, ES95, blast radius,
Composability Cost Index (CCI),
regime label
- Incident response:
pause routes, raise CR and LT,
isolate dependencies, post‑mortem