Why Smart Contract Risk Isn't the Real Threat to Vaults Anymore

Summary

Sun Raghupathi, CEO of Veda, explains the three-party vault model (infrastructure, curator, distributor) and maps the full risk stack for onchain vaults. He notes that smart contract risk has declined, while operational key management and governance risks have become the primary threat, citing Kelp and Drift as examples. He also discusses loss absorption mechanics, skepticism around unproven vault insurance, and the need for operational standards and third-party rating agencies to help users evaluate risk.

• Vaults involve three parties: infrastructure provider, curator, and distributor.
• Smart contract risk has decreased significantly; now the main danger is operational key management and governance failures.
• Recent major exploits (Kelp, Drift) were operational, not code-level.
• Economic risk includes collateral value crashes that outpace liquidation.
• Vault insurance exists but remains unproven—no major claims have been tested yet.
• Users should not be expected to assess complex operational risk; rating agencies like Credora and S&P are starting to fill that gap.
• Best practices for key management include multi-sig, time locks, and hardware signing devices.