> For the complete documentation index, see [llms.txt](https://docs.ensemble.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ensemble.io/safety/risk-framework.md).

# Risk framework

How market, liquidity, software, and governance risks affect a vault.

Losses can come from the market, failed execution, software defects, or changes to how the vault operates. Each risk needs its own control.

```mermaid
flowchart TB
    Market["Market and leverage risk"] --> Loss["Share-value loss"]
    Execution["Funding, spread, slippage, and rebalance risk"] --> Tracking["Tracking residual"]
    Liquidity["Buffer and route capacity risk"] --> Delay["Limited redemption"]
    Contracts["Contract and integration risk"] --> Failure["Unexpected behavior"]
    Governance["Role and upgrade risk"] --> Change["Changed or paused operation"]
    Data["Stale or partial data"] --> Decision["Incorrect user decision"]
```

## Market and leverage

Leverage makes an adverse price move more costly. A correctly functioning vault can still lose money.

Controls can bound execution and emergency behavior, but they cannot prevent losses from an adverse market view.

## Strategy and execution

Your share return will not exactly match a simple multiple of the basket return.

Buffers, funding, fees, execution prices, rebalance timing, and pending actions can change the result. The gap between the observed return and a simple strategy benchmark is called the tracking residual. It does not by itself establish an error.

## Liquidity and access

The vault may be unable to pay your requested withdrawal immediately.

EVM liquidity, route limits, pending work, pauses, and emergency state can limit immediate deposits or redemptions.

## Contracts and dependencies

A vault relies on other contracts and services. A failure in one of them can affect holders.

Vaults depend on periphery contracts, proxies, tokens, precompiles, HyperCore, and optional cross-chain systems. Compatibility checks can reject known mismatches. They cannot detect every defect.

## Governance and operations

People with privileged roles can change how the vault operates within their permissions.

Current contract checks and signer review processes can constrain or scrutinize administrative actions. They do not eliminate the risk of privileged changes, upgrades, or automation failures. See [Governance and roles](/safety/governance-and-roles.md).

## Data quality

A stale price or incomplete history can lead to a wrong decision.

Every public number needs source, block or observation time, freshness, and coverage. Unknown values remain unknown.