中文版 · Blockchain learning guide · Previous article
Blockchain learning · Article BC079
A token can become a vault asset, the vault can issue a receipt, and that receipt can become collateral elsewhere. Each layer can have a correct local record while still depending on the same underlying resource. Adding the displayed quantities may therefore count one economic dependency several times.
The practical task is to draw the claims in the right direction. Which asset supports which receipt? Who can redeem what? Which valuation feeds several decisions? Which administrator can interrupt more than one exit path?
This lesson follows a fictional three-layer arrangement through two supplied valuation shocks and two separate operational dependencies. It is an evidence and accounting exercise, not a strategy for using protocols, borrowing against receipts or earning returns. No real assets, counterparties or investment choices are involved.
Choose your reading route
In this guide
- 1. Composability connects obligations as well as software
- 2. Build the first two layers
- 3. Add pledged collateral without calling it a new reserve
- 4. Why 100 plus 60 plus 40 is not 200 units of backing
- 5. First shock: lower recovery reaches the pledged position
- 6. Second shock: a collateral-only gap is not a complete loss allocation
- 7. Add a shared valuation dependency
- 8. Add a shared redemption-control dependency
- 9. Atomic execution does not remove the continuing claim chain
- 10. Write a dependency report that a reader can audit
- 11. Exercises with answers
- 12. Frequently asked questions
- 13. Sources and further reading
- Read sections 1–3 to build the nested-claim map and identify its separate quantities.
- Work through sections 4–6 to avoid double counting and calculate the supplied shocks.
- Read sections 7–9 to separate valuation, redemption access and atomic execution.
- Use the exercises and FAQ to test whether the resulting conclusion is about a token count, a resource, a dependency or an actual loss.
Back to contents · Next section
1. Composability connects obligations as well as software
Composability means that components can be combined so that one system’s output becomes another’s input. In a financial application, that input may itself be a claim rather than an independent reserve asset.
The Financial Stability Board’s report of 16 February 2023 discusses interconnectedness and other vulnerabilities in decentralised finance. We use that as a dated risk framework, not as a claim about the current size of any market.
A useful analysis moves beyond saying that everything is connected. It identifies the particular edge that carries the consequence. A receipt can depend on an issuer’s redemption resources; a lending calculation can depend on a receipt’s value; several applications can depend on one valuation input.
Those edges do different work. A decline in realizable backing is not the same event as an unavailable redemption function. An incorrect displayed value is not the same thing as a change in token supply. A shared operator is not proof that a failure has happened.
The following model gives each connection a specific meaning so that we can trace consequences without turning every problem into an undefined cascade.
Back to contents · Next section
2. Build the first two layers
Fictional issuer I holds 100 units of a reference resource and has issued 100 receipt tokens R. At the baseline, the model gives each R a claim associated with one reference unit. Ownership, applicability and the relevant programme rules are supplied assumptions, not real legal findings.
Vault V holds 60 of those R tokens. It issues 60 shares S, each representing a claim on one R under this deliberately simple fixed-ratio model. The remaining 40 R are held outside V.
V has no other assets, fees, liabilities or special share classes in the exercise. Its 60 S are therefore another layer of claims on the 60 R it holds, not an additional 60 reference units created outside I’s reserve.
ERC-4626 is a real standard that distinguishes tokenised vault shares from an underlying token. Our example uses that conceptual distinction but does not claim to implement the standard or its complete behavior.
The important labels are now clear: reference-resource units, R token quantities and S share quantities are different objects. At the baseline they have a supplied one-to-one relationship, but that relationship is an assumption to track rather than a reason to erase the labels.
Back to contents · Next section
3. Add pledged collateral without calling it a new reserve
Participant P owns 40 of the S shares and has pledged them to lending arrangement L. L holds those 40 S as collateral against P’s debt of 30 reference-currency units. The other 20 S are held outside that pledge.
The collateral remains a pledged claim in this model. It is not described as an unencumbered reserve freely owned by L for every purpose. Rights to realise it depend on the supplied collateral arrangement; the later stress calculations will explicitly assume a particular realisation for comparison.
The 30-unit loan is a separate funding and repayment relationship. It does not add 30 to I’s underlying reserve. Likewise, L’s recorded loan claim is not a new copy of the assets backing R.
The look-through chain for the pledged position is: 40 S refer to 40 of V’s 60 R, and those R depend on the specified portion of I’s 100-unit backing arrangement. No extra backing resource appears merely because L can recognise the shares as collateral.
This is a map of a particular exposure, not a complete system balance sheet. We have not supplied every holder’s other assets, every funding source or the full liabilities of L. The report must not claim to have measured them.
Keeping that scope explicit is how a small model avoids becoming a misleading total for an entire ecosystem.
Back to contents · Next section
4. Why 100 plus 60 plus 40 is not 200 units of backing
A dashboard might show 100 at issuer I, 60 at vault V and 40 in L’s pledged position. Arithmetic can add those numbers to 200, but that sum does not represent 200 distinct reference units backing R.
The 60 R inside V are part of the 100 R already issued. The 40 S pledged at L are claims on part of those 60 R. The later entries describe nested relationships to the original backing, rather than independent additions to it.
The correct answer depends on the question. If someone asks for the distinct backing resource supporting all 100 R under the baseline assumptions, it is 100. If they ask how many S are issued, it is 60. If they ask how many S are pledged in this position, it is 40.
Each number is useful with its own label. The error is to change the question during addition, treating a reserve amount, a receipt quantity and a collateral quantity as three independent reserves.
This does not mean every aggregate measure across protocols is useless. An activity or gross-position measure may intentionally count several layers, but its methodology must say so. It should not be presented as a count of unique underlying resources without removing the repeated references.
Our exercise does not estimate any real platform’s total value. It simply shows why a defined denominator and a claims map are necessary before a sum can be interpreted.
Back to contents · Next section
5. First shock: lower recovery reaches the pledged position
In an independent scenario, the model supplies a proportionate realizable value of 0.8 reference units per R. This is a stated teaching assumption: no fees, preferential claims or different treatment between R holders. It is not a legal prediction or a market forecast.
I’s 100 R now correspond to a total realizable resource of 80. V still holds 60 R, whose supplied realizable value is 48. V still has 60 S outstanding, so each S has look-through value 0.8 under the same assumptions.
L’s pledged 40 S therefore have look-through value 32. Against P’s unchanged debt 30, that is a collateral-only excess of 2 in this simplified comparison.
The quantities did not change: 100 R exist, V holds 60 R, 60 S exist and 40 S are pledged. What changed was the supplied value that travels through those claim relationships.
The collateral-only excess does not prove that immediate repayment will occur. Realisation conditions, access and execution are separate. Nor does a 20% decline at I mean L necessarily loses 20% of its 30 loan. The loan amount and the collateral value are different quantities.
The correct report identifies the value 32, the debt 30 and the assumptions required to compare them. It does not jump directly from an upstream percentage to a downstream realised loss.
Back to contents · Next section
6. Second shock: a collateral-only gap is not a complete loss allocation
Reset to the original baseline, then supply a separate proportionate realizable value of 0.6 per R. Do not apply this after the 0.8 case as a second sequential percentage reduction.
I’s total backing value is now 60. V’s 60 R have value 36, and each of its 60 S has look-through value 0.6. The 40 pledged S therefore have value 24.
Debt remains 30. If the pledged position could be realised for exactly 24 with no additional costs, the collateral-only gap would be 6. That is the calculation the model supports.
It does not automatically tell us who ultimately bears 6. P might have other repayment resources in a fuller arrangement, L might have other protections, or different rights and costs might apply. None of those facts is supplied here. The exercise reports the uncovered amount relative to this collateral, not a final legal recovery or depositor-loss allocation.
The distinction matters because contagion analysis can exaggerate as well as understate. It is wrong to ignore the upstream dependence; it is also wrong to count the same impairment repeatedly and call every appearance a new independent loss.
A useful map tracks both the underlying event and the separate claims affected by it. It then states which cash flows or loss-allocation rules have actually been provided.
Back to contents · Next section
7. Add a shared valuation dependency
Now examine a separate evidence variation. Both V’s reporting interface and L’s collateral calculation use the same valuation source O. The supplied correct look-through value is 0.6 per S, but O’s report still says 1 in this hypothetical case.
If those consumers simply apply O’s reported number, V’s display may show 60 and L’s collateral display 40, rather than the look-through values 36 and 24. The error propagates through a shared input even though the token quantities themselves remain unchanged.
This is a conditional statement about the specified consumers. We are not claiming that every vault or lending implementation reads the same feed, or that the mere presence of an oracle proves its value is wrong.
The graph should therefore show a valuation edge from O to each consuming decision, distinct from the claim edges linking S to R and R to I’s backing. Fixing a display input would not replenish I’s reduced resources. Restoring resources would not, by itself, prove that a stale display has updated.
A second interface that uses the same O is not automatically independent corroboration. Agreement can arise because both repeat one input. To assess corroboration, identify the source relationship rather than count matching screens.
This makes the map more informative than a list of applications: it shows which conclusion depends on which observation.
Back to contents · Next section
8. Add a shared redemption-control dependency
In another independent variation, administrator A has the configured ability to pause I’s redemption function and V’s redemption function. The exercise supplies no ability to erase balances or transfer reserves through that pause action.
If both pauses become effective, the named redemption paths are unavailable under the model while the pauses remain active. The R and S quantities need not change. The existence of a claim and the current ability to process its redemption are different observations.
This does not prove that the underlying assets have disappeared, that the pause will be permanent or that a particular holder has lost all rights. It identifies a shared control affecting access through two layers.
The graph should label the edge as pause authority, not pretend it is another asset holding. Likewise, the fact that A can act does not establish that A has acted. Capability evidence and effective-state evidence must be separated.
A report might say: “Both exit paths share a configured pause controller; in this variation both pauses are supplied as effective. No reserve loss is established by the pause fact alone.” That is more precise than either “two independent protocols” or “everything has failed.”
The purpose is to identify a common dependency, not to recommend administrative actions or explain how to invoke them.
Back to contents · Next section
9. Atomic execution does not remove the continuing claim chain
Suppose a fictional application groups several internal state updates into one transaction and supplies an all-or-nothing rule: either every tracked update succeeds, or those updates are rolled back. This is an execution property within the stated boundary.
A successful atomic result can show that the updates were applied consistently under the supplied rules. It does not make I’s external backing larger, remove V’s reliance on R or guarantee later redemption access.
Similarly, a failure that rolls back those application updates does not undo an unrelated earlier impairment of I’s reserve or an already effective pause outside that transaction. The rollback boundary must be named rather than imagined to cover the whole economic system.
This is why software composability and economic independence are different questions. Components can fit together cleanly while sharing an issuer, valuation source or administrator. A transaction can be internally consistent while the claims it moves retain external dependencies.
The lesson is not that atomicity is useless. It answers a valuable question about the consistency of a bounded execution. It simply cannot answer every question about the resources and institutions on which the resulting positions continue to depend.
Do not treat an execution success label as an economic guarantee.
Back to contents · Next section
10. Write a dependency report that a reader can audit
Begin with the distinct underlying resource, then list each receipt layer with its units and holder. Mark collateral as pledged, and separate the loan obligation from the assets referenced through the pledge.
Next label non-asset edges: valuation inputs, redemption routes and administrative powers. State whether each is a capability, an observation or an assumed effective state.
For a shock, write the supplied assumption before propagating it. In our 0.6 case, equal realizable value per R gives V 36 and pledged collateral 24. The 6 gap is relative to debt 30 and this collateral-only resource comparison.
Finally state what remains unknown: actual timing, alternative repayment resources, fees, senior claims, loss allocation or changes in configuration. Do not fill those gaps with optimistic recovery or automatic collapse.
The existing FinanceOS confidence and liquidity article discusses broader propagation. This worksheet adds a particular nested-token exposure with labels that prevent repeated counting.
For mainland China readers, the PBOC-led notice 银发〔2026〕42号 of 6 February 2026 provides relevant virtual-currency business restrictions. Technical analysis of a fictional arrangement does not imply permission to access or operate it.
Back to contents · Next section
11. Exercises with answers
Exercise 1: Identify the repeated resource
Why is 100+60+40 not 200 distinct units backing R?
Answer: V’s 60 R are part of I’s 100 issued R, and L’s 40 pledged S refer to part of V’s 60 R. The latter layers are nested claims, not independent additions to I’s backing.
Exercise 2: Propagate the 0.8 case
What are V’s look-through value and the pledged position’s value?
Answer: V has 60×0.8=48; the pledged 40 S have 40×0.8=32. Against debt 30, the collateral-only excess is 2 under the stated realisation assumptions.
Exercise 3: Keep the 0.6 case independent
What is the collateral-only gap in the separate 0.6 scenario?
Answer: V’s value is 36, pledged collateral value 24 and debt 30, giving gap 6. This is not a second sequential haircut after 0.8 and does not determine ultimate loss allocation.
Exercise 4: Interpret two matching dashboards
V and L both repeat O’s incorrect report of 1. Does their agreement independently validate that value?
Answer: No. The shared input explains agreement. The graph must identify common sourcing before treating multiple displays as corroboration.
Exercise 5: Separate a pause from a loss
Both named redemption functions are paused. Does that prove all backing has vanished?
Answer: No. It establishes unavailable paths under the supplied effective pause state. Asset loss and eventual rights require separate evidence.
Exercise 6: State the atomicity boundary
Does one successful all-or-nothing application transaction remove the issuer dependency?
Answer: No. It describes tracked execution consistency. The receipt and collateral still depend on the underlying claim and its resources after the transaction.
Back to contents · Next section
12. Frequently asked questions
Is every extra receipt layer an independent asset?
It may be a distinct claim, but that does not make its referenced backing an additional independent resource. State which quantity you are counting.
Does a vault standard guarantee economic value?
No. ERC-4626 also distinguishes ideal conversion calculations from actual exchange conditions. A standard interface does not establish every external backing or redemption fact.
Does one shared dependency mean failure is certain?
No. It identifies a channel to examine. The exercise supplies particular shocks or effective states only where stated; capability alone is not an event.
Can we calculate a complete system loss from this graph?
No. The model lacks a complete balance sheet and loss-allocation framework. It supports the specified look-through and collateral-only comparisons.
Back to contents · Next section
13. Sources and further reading
Sources checked on 12 October 2026. All quantities, parties and shock assumptions are fictional.
- FSB, The Financial Stability Risks of Decentralised Finance: 16 February 2023; dated vulnerability framework.
- ERC-4626: Final; created 22 December 2021; shares, underlying assets and ideal-conversion distinctions.
- FinanceOS: Confidence, Liquidity and Panic Propagation: broader background.
- PBOC-led notice 银发〔2026〕42号: 6 February 2026; mainland context.
A useful composability map does not merely draw more arrows. It names what each arrow carries, follows the same underlying resource through its claims and stops short of conclusions the evidence cannot support.