Skip to main content
[ DOCS · FAILURE PATTERNS ]

Failure Patterns

These pages capture failure-class geometry — depeg-and-redemption-run, LST-lending contagion, stablecoin hedge-loss cascade — modeled against minimal forks. They are illustrative explainers, not case studies of any production protocol. Each entry has a deterministic rerun and a canonical hash, but the framing is class-level, not incident-level.

Overview

Failure patterns model the shape of a class of failures: the named state variables, the price/redemption/liquidation pressure path, and the invariant that fires when the geometry crosses its boundary. They are not claims about any particular production protocol.

Each entry below ships a deterministic rerun and a canonical hash so reviewers can re-execute the geometry locally. The wording on this page is intentionally narrower than the /case-studies/ surface: failure patterns describe a class, case studies describe a named incident shape with sourced public references.

Discipline: these are illustrative geometry. They tell you what the failure shape looks like in a deterministic primitive. They do not tell you whether any production protocol — Marinade / Jito / Sanctum / Kelp / Lido / Kamino / Marginfi / UXD / USDH / Ondo USDY — will or will not exhibit this geometry.

Liquid Staking Depeg Redemption Run

[ illustrative geometry · failure-class explainer ]

This liquid-staking protocol class matters because a slash-driven exchange-rate drop can become a redemption run when reserves cannot absorb exit demand. The geometry resembles staked-asset depeg and withdrawal-queue stress patterns: first the backing ratio moves, then exit pressure turns into an explicit queue.

Invariant fire. no_slash_during_healthy_run first fires at tick 3 — field=`pool.cumulative_slashed` observed=2000.0 == expected=0.0. Total firings recorded: 2 across this run.

canonical hash 5bdc5f7c7bd8bef8b1a350c76ebaa0b8fbfc3954d3b26882aa89ab54e9fda704

mirrored from fixtures/replays/liquid-staking-depeg-redemption-run/ at commit 2bca411f1a8a09313db0e4afcadf822e3442a73f.

Rerun script

curl -fsSL https://riptide.run/install | sh

#!/bin/sh
# Riptide — reviewer-ready rerun recipe.
#
# Simulation evidence with explicit boundaries.
# Regenerates the accompanying simulation-result.json from committed inputs.
# Expects to be run from this file's directory or anywhere; it cds to the repo
# root and then executes the documented invocation. POSIX sh only — no bashisms.
set -eu
here=$(cd "$(dirname "$0")" && pwd)
cd "$here/../../.."

# scenario: replay:liquid-staking-depeg-redemption-run (kind inferred from the SimulationResult)
# canonical hash: 5bdc5f7c7bd8bef8b1a350c76ebaa0b8fbfc3954d3b26882aa89ab54e9fda704

exec riptide replay fixtures/replays/liquid-staking-depeg-redemption-run/config.json \
  --allow-invariant-violations
What this failure pattern does not represent
  • **Nothing about mainnet risk of any specific LST program.** This is a simulation against a minimal fork that captures the failure geometry. It cannot tell you whether any production pool (Kelp, Marinade, Jito, Sanctum, Lido, …) will or will not depeg.
  • **No cross-protocol contagion.** The proof does not model LST collateral in a downstream lending market, rehypothecation into leverage protocols, or AMM-pool depth for the LST–native pair. Those are separate bundles.
  • **No oracle staleness dynamics.** The bound oracle receives real admin-mock bytes per the declared trajectory; the engine's generic path does not currently expose a per-tick oracle-lag knob, so the proof does not stress the redemption-vs-stale-price gap.
  • **Not a fork of any real LST codebase.** The `liquid-staking` program is a minimal surface chosen for determinism and clarity of the failure shape, not production fidelity.

LST Lending Contagion Proof

[ illustrative geometry · failure-class explainer ]

This cross-protocol collateral class matters because an upstream liquid-staking markdown can travel through an oracle boundary and become downstream lending bad debt. The geometry resembles LST-as-collateral contagion: a staking-side loss crosses into a lending market once collateral value falls through the liquidation threshold.

Invariant fire. liquid_staking:no_slash_during_healthy_run first fires at tick 3 — field=`liquid_staking.pool.cumulative_slashed` observed=4000.0 == expected=0.0. Total firings recorded: 2 across this run.

canonical hash d04feab99390d63de6625bad4994a05e89cede359b4599431e815fe327cd0aeb

mirrored from fixtures/replays/lst-lending-contagion-proof/ at commit 2bca411f1a8a09313db0e4afcadf822e3442a73f.

Rerun script

curl -fsSL https://riptide.run/install | sh

#!/bin/sh
# Riptide — reviewer-ready rerun recipe.
#
# Simulation evidence with explicit boundaries.
# Regenerates the accompanying simulation-result.json from committed inputs.
# Expects to be run from this file's directory or anywhere; it cds to the repo
# root and then executes the documented invocation. POSIX sh only — no bashisms.
set -eu
here=$(cd "$(dirname "$0")" && pwd)
cd "$here/../../.."

# scenario: replay:multi:lst-lending-contagion-proof-upstream (kind inferred from the SimulationResult)
# canonical hash: d04feab99390d63de6625bad4994a05e89cede359b4599431e815fe327cd0aeb

exec riptide replay fixtures/replays/lst-lending-contagion-proof/config.json \
  --allow-invariant-violations
What this failure pattern does not represent
  • Generalized multi-program persona sweeps (replay only; no population-driven scenario engine).
  • Real production protocol adapter coverage (this is `liquid-staking` + `lending_pool`, not Kamino / Marginfi / Marinade / Jito / Sanctum / Kelp).
  • Arbitrary cross-program transaction graphs (the bridge is scalar observation → scalar oracle write with an explicit transform).
  • Stablecoin or governance contagion (backlog).
  • Cascade-graph dashboards, Cloud monitoring, or alerting.
  • A forensic reproduction of any specific mainnet incident — the geometry is tuned so the bridged oracle crosses the lending liquidation-threshold boundary cleanly.

Stablecoin UXD Style Collateral Cascade

[ illustrative geometry · failure-class explainer ]

This stablecoin protocol class matters because delegated collateral and hedge losses can turn a fully-backed accounting surface into a redemption queue. This geometry resembles the failure shape seen in delta-neutral stablecoin hedge-loss incidents such as UXD's Mango exposure, but it does not claim to reproduce UXD's on-chain history.

Invariant fire. no_hedge_loss_during_healthy_run first fires at tick 3 — field=`pool.cumulative_hedge_loss_bps` observed=4000.0 == expected=0.0. Total firings recorded: 3 across this run.

canonical hash ef99f49ecf5581e11652d22a287f72cb257dbc8e036000c82d634c3d86f6bb6c

mirrored from fixtures/replays/stablecoin-uxd-style-collateral-cascade/ at commit 2bca411f1a8a09313db0e4afcadf822e3442a73f.

Rerun script

curl -fsSL https://riptide.run/install | sh

#!/bin/sh
# Riptide — reviewer-ready rerun recipe.
#
# Simulation evidence with explicit boundaries.
# Regenerates the accompanying simulation-result.json from committed inputs.
# Expects to be run from this file's directory or anywhere; it cds to the repo
# root and then executes the documented invocation. POSIX sh only — no bashisms.
set -eu
here=$(cd "$(dirname "$0")" && pwd)
cd "$here/../../.."

# scenario: replay:stablecoin-uxd-style-collateral-cascade (kind inferred from the SimulationResult)
# canonical hash: ef99f49ecf5581e11652d22a287f72cb257dbc8e036000c82d634c3d86f6bb6c

exec riptide replay fixtures/replays/stablecoin-uxd-style-collateral-cascade/config.json \
  --allow-invariant-violations
What this failure pattern does not represent
  • **Nothing about mainnet risk of any specific stablecoin program.** This is a simulation against a minimal fork that captures the failure geometry. It cannot tell you whether any production stablecoin (UXD, Perena, Parrot, USDH, Ondo USDY, Ethena USDe, …) will or will not lose its backing.
  • **No live hedge-venue integration.** The UXD real-world failure carried its delta hedge on an off-program perps venue (Mango); this proof internalizes the hedge-gap as a narrow program-local mutation (`apply_hedge_loss(loss_bps)`) rather than modeling a cross-program stablecoin ↔ perps composition. Live venue plumbing is explicitly out of scope for this bundle.
  • **No cross-protocol contagion.** The proof does not model the stablecoin's propagation into a downstream lending market, an LST collateralized position, or an AMM liquidity pool for the stablecoin's native pair. Those are separate bundles.
  • **No oracle staleness or NAV-drift dynamics.** The bound oracle receives real admin-mock bytes per the declared trajectory, but the shipping `stablecoin` processor does not read the oracle — backing is driven by on-account state only. A later bundle can add oracle-gated pricing without reshaping this fixture.
  • **Not a fork of any real stablecoin codebase.** The `stablecoin` program is a minimal surface chosen for determinism and clarity of the failure shape, not production fidelity.