Skip to main content

Risk Review Methodology: the 8 Risk Dimensions

When you ask Neo to review a lending pool, it runs a structured risk review across eight dimensions. Each dimension asks a specific question, runs named checks against monitored on-chain data, and returns findings with a severity and a plain-language explanation. The review is deterministic: the same pool and the same data snapshot always produce the same result.

This page explains what each dimension looks at and how to read the output. It is written for users of Neo, not as an internal specification.

How to read a finding​

Severity scale​

Every check reports on one ordinal scale:

info · low · medium · high · critical

Higher means more risk. There is no other vocabulary in the severity position — a finding is always one of these five, or it abstains.

Abstention: when Neo says "degraded"​

A check never guesses. If an input is stale, missing, inconsistent, capped, or out of bounds, the check abstains — it names the missing input rather than inventing a number. Crucially, a missing estimate is never rendered as low risk. An absent answer is shown as absent, not as "fine."

Two dimensions (D7 and D8) never emit critical by design: a measurement defect or a historical analogue is information, not a present loss.

Caveats Neo always states​

  • Concentration is a lower bound. Address-derived concentration can understate true entity concentration, because one owner can split across wallets. Neo flags this on every concentration finding.
  • Volume is venue-reported. Secondary-market depth is read from reported trading volume and carries that caveat.
  • Tail figures are stress indices, not probabilities. Simulation outputs describe modeled stress losses; they are never presented as the probability of an event.

The eight dimensions​

D1 — Survival​

Can the pool absorb stress and still honor withdrawals?

Looks at solvency headroom, the liquidation buffer, the share of principal sitting near liquidation, withdrawal runway as utilization rises, and whether governance can pause the pool. A healthy average buffer can still hide a stressed minority, so D1 reports the near-liquidation tail separately rather than letting an average mask it.

D2 — Underlying​

How good is what backs the pool?

Looks at collateral asset concentration, counterparty (borrower) concentration, and the quality and peg stability of the underlying assets. Concentration findings carry the wallet-grain caveat.

D3 — Exit liquidity​

Can the position get out at size — now and through stress?

Looks at how much can be withdrawn relative to free liquidity at your position size, how fast utilization is climbing, whether redemptions are throttled or queued, secondary-market depth, and lender (LP) concentration.

D4 — Oracle​

How robust is the price feed?

Looks at the oracle's reliability tier and the consistency of its configuration. The reason behind a score comes from the feed's actual characteristics (custody model, upgradeability, governance surface), never inferred from the number alone.

D5 — Cross-protocol​

What does this pool depend on elsewhere?

Looks at collateral that is reused from other protocols (e.g. receipt or principal tokens), the health of the pools it depends on, and shared oracle dependencies across the positions you hold.

D6 — Tail​

How much principal does the model put at risk, and where do losses turn convex?

Reads the risk engine's precomputed tail-loss measure. Every D6 figure names its mechanism precisely: a Monte Carlo simulation under a defined volatility shock, reported as an Expected Shortfall at an extreme quantile. Real extremes can exceed the modeled tail — the figure is a stress index, not a probability — and collateral that cannot be priced is disclosed and excluded rather than counted as zero loss.

D7 — Metric design​

Can the numbers be trusted as written?

Checks the integrity of the inputs themselves: data freshness against expected bounds, input sanity (utilization within range, positive totals), denominator robustness (e.g. overlap between lender and borrower wallets), and internal consistency of the scores. If a source goes stale while it was last reading high risk, that escalates — losing sight of a stressed pool is itself a signal. D7 never emits critical.

D8 — Tail analogues​

Has something built like this failed before?

Looks at the documented incident history of the protocol and matches the pool's mechanism against past failures. Counts of recorded incidents are reported as counts with their most recent date — never as frequencies or forecasts. D8 never emits critical.

How the dimensions fit together​

Each input has exactly one owning dimension; the others reference it rather than re-score it. Survival owns utilization, exit liquidity owns withdrawal velocity, the tail score is owned by D6, oracle quality by D4, and incident history by D8. This keeps a single number from being double-counted across the review, and lets each dimension stay focused on its own question.

Want the deeper technical detail?​

For the portfolio-level tail model, see Portfolio Stress methodology.