DEVIANT — Failure Mode Typology

Abstract

Why category matters more than date.

A chronological registry of financial events records what occurred and when. A typological reference records what categories of dependency exist in the conventional system. The first answers the question "what happened?" The second answers the more useful question "what kinds of things can happen, and why?"

The seven categories enumerated below are the structural exposure classes the Deviant Equilibrium Asset construction renders inapplicable by its construction. Each category includes representative historical events drawn from publicly documented filings, but the categories are the substance of the page; the events are illustrations.

No category claims that the MBA construction is superior, preferable, or destined to replace the instruments it contrasts with. Each category claims only that the named dependency is structurally absent from the MBA construction, and therefore the corresponding category of failure cannot occur by the same mechanism. The contrast is a property of the bytecode.

Note to readers in regulatory or supervisory roles

If you are reading in an official capacity, this typology is offered as a clarifying reference.

The seven categories below describe dependencies that, in our reading, your existing supervisory and enforcement frameworks were designed to address. The MBA construction does not contain those dependencies. We do not argue that this makes the construction preferable, nor that it renders supervisory frameworks unnecessary in the broader system. We simply observe that the dependencies your frameworks address are not present in this specific construction.

The bytecode is published. The chipnet validation history is reproducible. We are available for technical discussion of any category below or any property of the contract. The note is offered in the spirit of clarity, not contention. An honest reference is more useful to both of us than ambiguity.

Index of categories

Seven structural exposure classes.

01. Custodial discretion over redemption 02. Issuer insolvency converting claim into creditor right 03. Reserve-asset dependency chain 04. Stabilization mechanism dependent on secondary markets 05. Asymmetry between authority and autonomous code 06. Ledger divergence from on-chain reality 07. Governance capture and upgrade-key compromise

Custodial discretion over redemption

Class · Operational
Layer · Custodian

The exposure

A holder's right to redeem an instrument depends on the continued operational willingness and capacity of a custodial party. The custodian may pause, suspend, condition, or restrict redemption at its discretion or by regulatory direction. The holder's recourse is administrative or legal — not technical.

The discretion is the dependency. Even a well-capitalized, well-intentioned custodian retains the capacity to pause redemption when it judges conditions to require it. The capacity is the structural exposure regardless of whether it is exercised.

The MBA contrast

A DEA holder's redemption is a standard P2PKH spend of a UTXO they control directly. The backing satoshis are inside the UTXO. No party signs, approves, processes, or could pause the transaction. There is no entity at any point in the redemption path that holds discretion.

The contract has no administrative function capable of pausing, freezing, or conditioning a redemption. The property is structural, not procedural.

Representative documented events

2022-06-12Celsius Network paused withdrawals, swaps, and transfers, citing extreme market conditions. Customer redemption rights were unavailable for the duration of the pause and subsequently transitioned to bankruptcy claims under Chapter 11 proceedings.
2022-11-08FTX suspended customer withdrawals in the days preceding its Chapter 11 filing.
2022-06-13Babel Finance suspended withdrawals and redemptions for retail customers citing unusual liquidity pressures.

Issuer insolvency converting claim into creditor right

Class · Financial
Layer · Issuer

The exposure

The redemption value of an instrument depends on the continued solvency of an issuing entity. When the issuer becomes insolvent, the holder's contractual redemption right transitions to a general unsecured creditor claim in bankruptcy proceedings. Recovery is subject to the statutory priority order and the available estate.

The exposure is not that issuers always fail. The exposure is that the holder's economic position contains a dependency on the issuer's continued existence as a going concern, regardless of whether that existence is ever interrupted.

The MBA contrast

A DEA has no issuer in the legal sense. The contract was deployed by a party who is not a counterparty to any holder, holds no funds, and has no continuing obligation to any holder. The backing for each DEA unit is BCH satoshis held on the network, not assets held by an entity.

If the party who deployed the contract were to become insolvent, file for bankruptcy, or cease to exist, the holders' redemption rights would be entirely unaffected. There is no estate that contains them.

Representative documented events

2022-07-13Celsius Network filed Chapter 11; customer claims transitioned from redemption rights to creditor positions.
2022-11-11FTX Trading Ltd. et al. filed Chapter 11 in the District of Delaware; customer deposits became part of the bankruptcy estate.
2022-07-05Voyager Digital filed for Chapter 11; customer crypto deposits subject to bankruptcy proceedings.

Reserve-asset dependency chain

Class · Structural
Layer · Reserve · Banking

The exposure

The stable value of an instrument depends on reserve assets held at one or more intermediary institutions. The redemption right therefore depends on the continued operational solvency of each link in the chain — the reserve custodian, the banking partner, the deposit insurance authority, and any further parties holding instruments in the reserve composition.

A failure at any point in the chain can propagate to the instrument's peg, even when the issuer itself is solvent and operating normally. The dependency chain is the exposure, not the failure of any specific link.

The MBA contrast

The DEA construction places the backing satoshis inside the UTXO that represents the unit. There are no reserve custodians, banking partners, or deposit insurance authorities in the redemption path. The backing is not held with anyone — it is held on the network, controlled by the unit's holder, observable on a public block explorer.

The dependency chain has length zero. The redemption path traverses no institutions.

Representative documented events

2023-03-10Silicon Valley Bank closure created brief reserve-access disruptions for stablecoin issuers banking with the institution; downstream effects on the peg of at least one major dollar-denominated stablecoin during the period before federal authorities invoked the systemic-risk exception.
2023-03-13Signature Bank closed by New York state regulators with similar concerns for stablecoin issuers and crypto firms relying on its settlement rails.

Stabilization dependent on secondary markets

Class · Algorithmic
Layer · Stablecoin operator

The exposure

An instrument's peg is maintained not by direct backing but by an algorithmic stabilization mechanism that depends on rational arbitrage between two related markets. When the secondary market becomes disorderly, the stabilization mechanism cannot operate, and the peg fails.

The exposure is the conditional nature of the redemption value. Holders are redeeming a claim whose honoring depends on conditions external to the instrument itself — specifically, the orderly functioning of a related market.

The MBA contrast

The DEA construction does not rely on arbitrage, secondary markets, or stabilization mechanisms of any kind. Each unit's redemption value is a fixed satoshi quantity held inside the UTXO. The redemption is a single transaction, not a market interaction.

There is no secondary market whose behavior the redemption value depends on, because the backing is held within the unit itself rather than referenced through a separate token.

Representative documented events

2022-05-09 / 2022-05-12TerraUSD (UST) and LUNA: the algorithmic stablecoin lost its dollar peg over approximately three days; the associated reserve token used by the stabilization mechanism declined from prior trading ranges to a fraction of one cent in the same period.
2023-08-02Curve Finance pool events affected several decentralized stablecoins relying on liquidity-pool depth for de-facto peg maintenance.

Asymmetry between authority and autonomous code

Class · Jurisdictional
Layer · Sovereign · Developer

The exposure

When a regulator or sovereign authority seeks to alter the behavior of a deployed autonomous contract, the contract itself has no party empowered to comply. Enforcement therefore reaches only the secondary actors — developers, interface operators, end users — while the bytecode continues to execute as written.

This is a structural asymmetry, not a moral position. It applies to autonomous contracts whose construction is benign as well as those whose construction is problematic. The asymmetry is a property of the technology, recognized across multiple jurisdictions as a question requiring legal development.

The MBA contrast

The DEA construction shares the autonomous-contract property the asymmetry describes. The contract has no administrator, no upgrade path, no selfdestruct, no multisig. There is no party empowered to alter the bytecode.

The same property has a second consequence the registry highlights: the autonomy cuts in both directions. No party — including the founder — possesses the authority to alter a holder's position. The same asymmetry that complicates external alteration also guarantees that the holder's redemption right is preserved.

Representative documented events

2022-08-08OFAC designation of Tornado Cash addresses: U.S. Treasury sanctions of autonomous smart contract addresses; the contracts continued to execute despite the designation, generating subsequent litigation (Van Loon v. Department of the Treasury) regarding the scope of authority over autonomous code.
2024-11-26Fifth Circuit ruling in Van Loon: court found OFAC exceeded statutory authority in designating immutable smart contracts as "property" of a sanctioned entity; outcome under continued review.

Ledger divergence from on-chain reality

Class · Custodial
Layer · Exchange

The exposure

Customer holdings on a centralized exchange exist as database entries in the exchange's internal ledger, not as customer-controlled positions on chain. The internal ledger and the actual on-chain reserves may diverge — through error, through internal use of customer assets, through commingling, or through fraud. The divergence is undetectable to customers until the moment withdrawal requests can no longer be honored.

The exposure is the existence of a private ledger as the authoritative record, distinct from the public chain that customers cannot directly inspect against their balance.

The MBA contrast

A DEA holder's position is not a database entry on any platform. It is a UTXO on the BCH network, controlled by the holder's private key, observable on any public block explorer, with backing satoshis held within the UTXO. There is no private ledger that could diverge from the on-chain state because the on-chain state is the position.

An exchange may list DEA for trading, but the listing does not custody it in any sense relevant to redemption — redemption is exercised against the contract, not against the exchange.

Representative documented events

2022-11-17FTX Chapter 11 filings: declaration by court-appointed restructuring officer documented material commingling of customer funds and discrepancies between exchange records and actual reserves.
2014-02-28Mt. Gox filed for bankruptcy protection citing the disappearance of approximately 850,000 bitcoins from customer accounts; subsequent investigation revealed multi-year divergence between exchange records and actual holdings.
2019-04-25Bitfinex / Tether: New York Attorney General action documented an undisclosed loan of customer funds between affiliated entities; resolved via settlement in 2021.

Governance capture and upgrade-key compromise

Class · Protocol
Layer · Smart contract

The exposure

A contract that nominally enforces holder rights but retains an administrative function — upgrade path, multisig, governance token, owner address — depends on the continued integrity of the parties controlling that administrative function. If the function is captured, voted to a malicious outcome, key-compromised, or used contrary to user expectations, holder positions can be altered without their consent.

The exposure is the existence of the administrative function itself. Whether it is exercised benignly, maliciously, or never, its presence is the structural exposure.

The MBA contrast

The DEA contract has no administrative function. No upgrade path. No selfdestruct. No multisig. No governance token controlling its parameters. No owner address. The constructor parameters set at deployment are invariant. The bytecode does not contain code paths that would permit alteration by any party.

The property is verifiable by reading the deployed contract. There is no administrative function that could be captured, because there is no administrative function at all.

Representative documented events

2022-03-23Ronin Bridge: compromise of validator keys controlling the bridge multisig led to loss of approximately $620 million in customer assets; recovery dependent on subsequent reimbursement by the operating entity.
2023-07-30Curve Finance: Vyper compiler vulnerability affecting upgradeable pools led to loss of approximately $73 million across multiple protocols; some funds recovered via whitehat negotiation.
VariousGovernance attacks on DAO treasuries: documented cases in which acquired governance tokens were used to vote unilateral transfers of protocol-controlled assets to the acquiring party.

Principle

What the typology offers.

The seven categories above describe dependencies built into the conventional system by design. None of those dependencies is inherently malicious; each exists because the system was constructed to permit human oversight, intervention, and remedy. The dependencies are features as much as exposures, and the supervisory frameworks built around them reflect this dual character.

The MBA construction simply does not contain those dependencies. The construction has its own properties, its own constraints, and its own limitations. The contrast is descriptive, not prescriptive. A reader who values the supervisory frameworks attached to conventional instruments may correctly conclude that the MBA construction is not for them. A reader who values the absence of those dependencies may correctly conclude that it is.

The typology will be amended as additional categories are identified, as additional historical examples meet the inclusion criteria, and as developments in the legal treatment of autonomous code clarify the standing of category 05.