Tiger Research：DeFi 借貸模塊化了，風險沒有
- 核心觀點：隨著RWA資產上鏈與機構投資者湧入，DeFi借貸市場正從早期共享資金池架構轉向以風險隔離為核心的模塊化架構，將基礎執行層與運營風險管理層分離，Morpho、Aave V4和Euler V2等協議分別通過不同的技術路徑實現了這一轉型。
- 關鍵要素：
- 傳統金融的教訓：2008年雷曼危機暴露單一共享資金池或集中中介的風險，引發系統性傳染，後通過將執行、託管、風控等職能分離來構建制度性保障。
- DeFi演進路徑：早期協議（如Compound、Aave V1-V3）將所有借貸機制壓縮至單一代碼庫，雖降低中介成本，但風險集中，迫使治理保守、資本效率低下。Silo Finance首創單資產獨立借貸池，驗證了模塊化隔離的可行性。
- RWA推動變革：代幣化國債、私募信貸等RWA資產在交易時間、預言機、監管要求上差異巨大，傳統共享資金池無法統一管理，催生了將清算結算層與風險運營層分離的模塊化架構需求。
- 主流協議實踐：Morpho Blue採用完全外部化模式，將市場創建和風控外包給策展人，類似主經紀商分工制；Aave V4採用Hub-Spoke混合模式，保持流動性共享同時通過信貸額度隔離風險；Euler V2通過EVK和EVC實現單資產獨立與跨抵押品靈活性的多策略結構。
- 運營層成核心競爭力：隨著基礎設施趨同，鏈上借貸市場的競爭將集中在運營層——誰能更高效地評估抵押品、設計風控參數、應對監管並建立業績紀錄，誰就能吸引機構資本。
This article is written by Tiger Research. As institutional investors enter the on-chain lending market, DeFi is moving away from a single shared liquidity pool architecture towards a new structure with risk isolation and specialized operational layers.
Key Takeaways
- The Lehman crisis and the Kelp DAO incident exposed the same type of structural flaw: a single shared liquidity pool architecture amplifies the risk of a single asset, turning it into a systemic crisis. Traditional finance's response was to separate each functional layer of the financial system.
- The DeFi ecosystem is moving in the same direction, building a modular architecture centered on risk isolation.
- This shift has accelerated as RWA assets begin to flow on-chain.
- In a modular architecture, the ability to manage the operational layer that actually handles products becomes a key differentiator.
1. Lessons from the Lehman Crisis
In September 2008, the collapse of Lehman Brothers triggered an unprecedented crisis. The Reserve Primary Fund (RPF), the world's third-largest money market fund, suspended all redemptions in a single day.
At the time, RPF's investment in Lehman Brothers debt constituted only 1.2% of its assets under management. Lehman's bankruptcy rendered this 1.2% unrecoverable, causing the fund's total asset value to drop from 100% of par value to 98.8%. This was enough to break the fundamental principle of the money market fund industry of maintaining a stable net asset value of $1 per share. The fund's per-share value fell below $1, to $0.97.
Once the principal loss became apparent, panic spread almost immediately. Fearing greater losses from waiting, a run of unprecedented scale ensued, with redemption requests reaching $40 billion in just two days. Unable to withstand such immense pressure, the fund froze its assets and halted all withdrawals.
The Lehman Brothers bankruptcy forced a comprehensive restructuring of traditional capital markets. In the money market fund sector, risk-tiered liquidity buffers and redemption restriction guidelines were completely overhauled. In the hedge fund space, the industry learned from Lehman's rehypothecation risk, which involved a single prime broker centrally holding client assets.
As a result, assets and credit were structurally adjusted away from concentration in a single intermediary. Separating execution infrastructure from risk management and diversifying risk exposure across multiple prime brokers became the global standard for risk isolation. It was on this institutional foundation of separating infrastructure from risk to contain contagion that the asset management industry was able to rebuild operational trust and resume growth.
2. How Traditional Capital Markets Solved This Problem
In 2014, the U.S. Securities and Exchange Commission restructured the money market fund (MMF) framework. Funds were categorized based on their capital nature, with different standards applying to each category. This aimed to prevent a run or collapse in one fund category from spreading to other fund types or the entire system, as each category had its own dedicated buffer mechanism.
The core philosophy of traditional financial risk control methods is separation. Power is decentralized, avoiding risk concentration in a single link, and independent verification mechanisms are introduced at every stage of capital flow.
The prime brokerage business in capital markets best exemplifies this principle. Investment decision-making authority rests with the hedge fund, while risk oversight authority is exercised by the broker. These two functions are deliberately separated. In traditional lending markets, the same logic applies: credit assessment, underwriting, collateral management, and custody are handled by different, independent institutions.
However, when asset management and lending began migrating to DeFi, the multi-layered intermediary structure built by traditional finance was compressed into a single layer. Early DeFi protocols focused on eliminating the intermediaries required by this separation structure, encoding the relevant mechanisms directly into smart contracts and automating processes previously handled by multiple parties.
3. From Shared Pools to Modular Architecture
Early DeFi's approach of compressing all lending mechanisms into a single smart contract lowered intermediary costs but also concentrated all risks within one protocol. Since credit assessment, underwriting, and collateral management all operate within the same codebase rather than as independent functions, a default or liquidation failure of a single asset could directly paralyze the entire system's liquidity.
This potential contagion risk forced protocol governance to conservatively set risk parameters. Assets with short track records or high volatility, and any asset beyond Bitcoin and Ethereum, were structurally excluded from collateral eligibility. Compressing functions into a single contract ironically led to lower capital efficiency: asset diversity was limited, and market access was restricted.
Silo Finance addressed the risk concentration of unified asset pools by introducing independent lending pools for each asset. By confining price manipulation or value collapse to within a single collateral pool and preventing risk from spreading to other pools, Silo demonstrated that it could lower governance approval thresholds and open up new lending markets more quickly. This architecture showed that a single large pool could be split, risks could be isolated at the market level, and it laid the foundation for subsequent layered modular structures.
The modular system pioneered by Silo became the foundational standard for on-chain lending, especially as RWA assets, including tokenized treasuries and private credit, began flowing heavily onto the chain. Each type of RWA has fundamental differences in trading hours, oracle reliability, regulatory requirements like KYC and AML, and liquidation procedures. The early shared pool model, which required managing such diverse assets with a single, uniform set of parameters, was clearly infeasible.
The influx of Real World Assets (RWA) created a need beyond simple asset isolation. It demanded transplanting the complex risk control frameworks of traditional finance into the on-chain environment. As assets diversified, the risks appearing on-chain also became increasingly complex. To control these risks, a structural separation was needed: on one side, an immutable infrastructure layer responsible for liquidation and settlement; on the other, an operational layer with real-time authority to adjust and assume risk parameters.
Early DeFi compressed the middle layers of finance into a single codebase. With the influx of RWAs and the maturation of the lending market, the development path changed: Liquidation and settlement efficiency were delegated to the blockchain, while risk oversight authority was separated into an independent layer. To cope with increasingly complex assets, on-chain lending ultimately formed an architecture similar to traditional financial systems (e.g., prime brokers and independent credit assessment), where investment and risk monitoring are separated. This modular architecture has become the new standard for the on-chain lending market.
4. Institutional-Grade Risk Isolation and Convergence
Although the modular architecture originated within the DeFi ecosystem itself, it perfectly aligns with the risk control standards demanded by institutional participants.
Morpho's decision to prioritize complete risk isolation at the base infrastructure layer, even at the cost of some capital efficiency, catalyzed institutional demand. This demand became a turning point, prompting other major lending protocols, especially those initially using shared pool structures, to move in the same direction.
4.1 Morpho Blue: The Prime Broker
Morpho initially started as an intermediary layer optimizing interest rates on top of first-generation DeFi lending protocols like Aave and Compound. In this model, it couldn't exist independently. In 2023, Morpho published the Morpho Blue whitepaper, and in early 2024 launched Morpho Blue and Morpho Vaults, officially declaring its independent operation.
This shift abandoned the previous structure where governance handled all market risk decisions, separating market creation and risk assessment from the protocol itself. This separation became the structural foundation for institutional participants to select and control risks according to their own compliance standards.
Architecture
- Morpho Blue: An immutable protocol. When a market is created, five parameters are fixed: collateral asset, borrowable asset, Liquidation Loan-to-Value (LLTV), price feed, and interest rate model. Anyone can create a market permissionlessly. The protocol itself only executes pre-written code.
- Morpho Vaults: A risk management layer where independent curators select eligible markets, set supply limits, and allocate funds. Each vault has a unique risk profile.
- Lenders: Depositors with varying risk tolerances, including DAOs, protocols, individuals, and hedge funds, choose vaults matching their situation and provide capital.
Traditional prime brokers typically perform four functions: clearing, custody, leverage provision, and risk monitoring. Using smart contracts, Morpho automates clearing and leverage provision at the protocol level. However, due to its non-custodial structure, it cannot provide the custodial environment institutional investors need to meet regulatory requirements. Therefore, integration with external custodians like Coinbase or Anchorage is necessary.
Similarly, risk monitoring doesn't depend on the protocol itself but rather on each custodian's ability to select assets and manage risk exposure. This creates a persistent risk: the varying quality of custodians. The xUSD and Stream Finance incidents in 2025 directly exposed this vulnerability. Multiple Morpho vaults had exposure to xUSD and incurred bad debt. Following these events, the market began scrutinizing custodians' asset selection capabilities and real-time risk management more strictly, with institutional capital concentrating on top-tier, high-performing custodians like Steakhouse, Gauntlet, and Sentora.
Traditional brokerage integrated clearing, custody, leverage, and collateral management within a single institution. Morpho replaces this model with a division of labor, distributing these functions among specialized participants within the ecosystem rather than centralizing them in one institution.
Institutional adoption is happening at scale, and it started with centralized exchanges.
- Coinbase: A USDC lending service built on Morpho Blue, with custody services provided by Steakhouse Financial.
- Binance: Adopted the same structure, with Steakhouse Financial and Gauntlet acting as curators.
Users clicking the 'Borrow' button in the Coinbase or Binance app can get a loan. The world's two largest exchanges by trading volume chose the same architecture. This architecture has also expanded to traditional financial institutions.
- SG-FORGE: Deployed MiCA-compliant stablecoins EURCV and USDCV on Morpho.
- Apollo: Brought the private credit fund ACRED on-chain and used it as collateral on Morpho.
- Bitwise: Conducts risk management directly on top of Morpho Vaults.
If tokenization opened the door to acquiring assets, Morpho has opened the path to converting these assets into productive capital. The trajectory set by Morpho is gradually revealing a new evolutionary direction that lending protocols with vastly different starting points find hard to ignore.
4.2 Aave V4: The Universal Bank
Aave, originally named ETHLend as a peer-to-peer lending matching platform, evolved through versions V1, V2, and V3, progressively developing into a shared liquidity pool architecture. In March 2026, Aave activated V4 on the Ethereum mainnet, a modular architecture. Unlike Morpho's structural separation of infrastructure and operations, Aave V4 opted for a hybrid model, controlling risk while maintaining liquidity efficiency.
Aave recognized a trade-off between risk isolation and capital efficiency. Moving towards risk isolation curtails the spread of bad debt but weakens liquidity network effects and reduces capital efficiency. V4's design aims to structurally address this trade-off.
Architecture
- Hub: The core layer integrating liquidity and accounting. It assigns credit limits and debit capacities to each Spoke, restricting the amount of liquidity extractable from any specific market. Basic risk firewalls are formed by these Spoke limits and local parameters.
- Spoke: An independent lending market, with each asset having its own independent parameters. When an issue arises in a specific Spoke or asset, governance and risk managers can reduce exposure by adjusting that Spoke's credit limit cap, restricting new borrowing, or activating emergency controls. Since the maximum risk exposure is fixed by the credit limit cap, the structural spread of contagion is limited by design.
In traditional finance, this structure resembles a universal bank's internal credit line allocation system. The head office allocates credit lines to each department, and when a department faces difficulties, the head office adjusts these lines to control the spread. The central Hub plays the role of the head office, while each Spoke operates like an independent business division. Unlike Morpho's fully isolated model, where capital is strictly locked within each asset pair, this hub-and-spoke structure allows unused liquidity in one Spoke to be flexibly reallocated to more efficient Spokes through the Hub's credit lines. The result is higher capital efficiency.
This structure becomes a significant advantage in the RWA market. Emerging RWA markets often struggle to attract initial liquidity, but in Aave V4, the existing liquidity center can serve as a seeding mechanism for new Spoke markets. By structuring a tokenized asset as an independent Spoke with a credit limit cap set at the Hub, it leverages the liquidity base of safer assets to launch a new asset class into the market with lower startup costs, while keeping initial exposure within the credit limit.
Institutional adoption primarily revolves around Horizon. Initially an independent RWA lending instance built on Aave v3.3, Horizon's design philosophy aligns with V4's direction of unified liquidity and risk separation. As Horizon integrates more deeply with V4's credit line structure, it will likely become further embedded as Aave's institutional RWA layer.
Horizon aims to allow regulated tokenized treasuries, money market funds, and institutional funds to serve as collateral for stablecoin lending, with potential expansion into asset classes like tokenized equities and ETFs.
Because approved institutional assets within Horizon connect to the same institutional liquidity layer, any newly added RWA can immediately utilize the existing stablecoin liquidity.
The role division within this liquidity layer is as follows:
- Issuers: Investor onboarding and KYC/AML allowlist management.
- Risk Manager (LlamaRisk): RWA due diligence, risk frameworks, and parameter recommendations.
- Oracle (Chainlink): Provides on-chain price feeds.
- Protocol (Aave): Smart contract execution.
In a traditional Aave market, adding a new asset requires deliberation and a vote by the DAO governance council, which slows down the process. Horizon separates these responsibilities: issuers handle compliance for each asset, LlamaRisk performs risk due diligence, and Chainlink handles price verification. This architecture enables institutional asset onboarding and risk adjustment at a much faster pace than if all decisions go through DAO governance council approval.
Morpho minimizes governance involvement and outsources market creation and risk management, opting for speed and choice; Aave chose a different path: controlled governance delegation and shared liquidity to maintain capital efficiency.
Both approaches are coherent solutions for transplanting traditional finance's risk allocation concepts into the on-chain environment, but it remains to be seen which way the RWA market will ultimately lean.
4.3 Euler V2: The Multi-Strategy Hedge Fund
In March 2023, Euler suffered a $197 million loss. The attack exploited a vulnerability in the smart contract code. Because multiple asset markets were connected within the same protocol's accounting and liquidation structure, the losses spread across multiple assets.
After about three weeks of negotiations, most of the stolen assets were recovered. Nevertheless, Euler chose to rebuild its architecture rather than just fix it, subsequently repositioning itself as flexible institutional lending infrastructure.
