The two risk lines
Correlated stress: both risks fire together
Depeg and smart-contract/counterparty risk aren't independent — a severe market event can trigger both at once. This is the joint worst case, not the expected annual loss.
Risk-adjusted yield across vault tiers
Same headline APY, different risk tiers — this is why the highest-APY vault is rarely the best risk-adjusted choice.
| Tier | Expected loss/yr | Risk-adj APY (at your headline) |
|---|
Why the headline APY on stablecoin vaults is a trap
Stablecoin vaults are marketed as the "safe" corner of DeFi — a dollar in, a dollar-plus-yield out. But the yield has to come from somewhere: lending spread, real-world-asset carry, a perpetual-futures basis trade, or a newer protocol paying above-market rates to bootstrap liquidity. Every one of those sources carries its own depeg and counterparty risk, and none of it shows up in the number the vault's landing page advertises. A vault paying 8% with 3% annual depeg odds and 15% loss severity has roughly the same expected loss as a vault paying 5% with lower odds — the raw APY ranking says one thing, the risk-adjusted ranking can say the opposite.
The two risk categories aren't the same shape. Depeg risk is mechanism-specific: fiat-backed stablecoins depeg from banking or custody failures, crypto-collateralized ones from liquidations racing thin liquidity, and synthetic yield-bearing tokens like sUSDe from a stressed unwind of their hedge during a fast market move. Smart-contract and counterparty risk is about code and custodian trust — audits, upgrade keys, and who actually holds the underlying collateral. Both matter, and pricing only one gives a false sense of safety.
The correlated stress scenario above exists because real blowups rarely stay contained to one risk category. A liquidity crunch that stresses a stablecoin's peg is often the same event that stresses the protocols holding it as collateral — which is why institutional risk desks underwrite a larger joint drawdown than either risk in isolation would suggest. If that joint number looks uncomfortable relative to what you'd actually accept losing, that's the real signal — more useful than the APY on the landing page.