Author: AiPlot Research Institute

Focus: RWA / Digital Assets / In-depth Analysis of Financial Infrastructure

1. Investment Conclusion: This is not a new rating, but a new risk language

The market views the S&P VRA interpretation as the scoring mechanism for the "S&P Global's DeFi Vault Risk Rating" and believes that the highest rating AAA(v) will facilitate institutional funds entering underlying lending markets such as Aave, Morpho, Euler, etc.

This judgment captures the direction of the event but requires an important correction:

VRA stands for Vault Risk Assessment, which is the vault risk assessment, not a traditional credit rating.

S&P has clearly stated that VRA is a forward-looking, relative opinion on the risk of loss or reduction in value of the position held by investors in lending vaults; it does not evaluate yields, nor is it equivalent to traditional credit ratings, does not guarantee the credit quality of the vault, and certainly does not represent investment advice.

Therefore, the value of VRA is not to tell investors "this product will not lose money," but to provide a more structured framework for comparison:

• What assets and collateral the vault has accepted;
• Whether it can exit in a timely manner during a run;
• Whether the Curator has sustained management capability;
• Whether the blockchain infrastructure is reliable;
• Whether the lending protocols and smart contracts are robust;
• Whether permissions, multi-signatures, upgrades, and security controls are transparent.

This differs from the analytical methods commonly seen in on-chain markets in the past. On-chain data tells us "what happened," whereas VRA attempts to answer: How will the risks of the vault evolve if the market environment changes?

2. Why VRA is needed now: The scale of on-chain assets has entered a new phase

S&P's official press release shows that the total deposit scale of digital asset lending vaults is about $10 billion as of September 2026, compared to about $1.5 billion two years ago.

This indicates that on-chain vaults are no longer just small-scale DeFi experiments, but are beginning to take on functions similar to traditional financial products:

• Money market instruments;
• Private credit funds;
• Structured yield products;
• Hedge fund-like strategies;
• Institutional liquidity management tools;
• Lending pools backed by digital assets and RWA as collateral.

The basic structure of a vault typically is:

1. Investors deposit funds into the on-chain vault;
2. The vault enters the lending market according to a predetermined strategy;
3. Funds allocation is managed by smart contracts or Curator;
4. Borrowers provide crypto assets or RWA as collateral;
5. Investors receive Share Tokens representing their interests;
6. Profits, liquidation, and redemption are determined by the protocol rules and relevant parties.

This structure has certain similarities to traditional managed fixed-income funds, but on-chain vaults introduce new technological and governance variables:

• Smart contracts can be attacked;
• Permissioned accounts can modify parameters;
• Oracles may exhibit price errors;
• Collateral may lack a secondary market;
• The chain itself may experience congestion or reorganization;
• Redemption assets and underlying market liquidity may mismatch.

In the past, investors typically only looked at APY, TVL, and historical yields. As the principal scale increases, these metrics alone are no longer sufficient.

3. Six risk factors of VRA

S&P VRA covers six core risk dimensions:

​​​​​​​

The value of this framework lies in its analysis of “credit risk” in traditional finance alongside the unique “code, chain, and governance risks” inherent in DeFi.

1. Good assets do not equate to vault safety

A vault may hold government bond tokens or high-quality fund tokens but may still incur losses due to the following reasons:

• The redemption mechanism relies on a single service provider;
• Price oracles malfunction;
• The upgrade privileges of smart contracts are too broad;
• Assets can only be offloaded by a small number of approved participants;
• Loan liquidations cannot be completed in a stressed market;
• The Curator can expand the allocation of high-risk assets.

Thus, the underlying credit quality of RWA is merely a part of the vault risk.

2. Technical security does not equate to investment safety

An audited set of smart contracts can still incur losses due to rapid declines in collateral prices, liquidity exhaustion, failure of liquidation parameters, or improper management of permissions.

The importance of VRA lies in this: it does not treat "code audit approval" as the entirety of security but incorporates protocol, asset, governance, and market structure into its analysis.

4. What AAA(v) really means

S&P's VRA uses letter grades suffixed with “v,” ranging from AAA(v) to D(v). Among these, AAA(v) represents the lowest relative risk in the VRA system, and S&P defines it as: the vault portfolio has extremely low credit risk, and even under stressed market conditions, the possibility of a loss occurring in investor positions is very low.

However, AAA(v) should not be misinterpreted as:

• The vault will not incur losses;
• The yield is guaranteed;
• The smart contract is absolutely secure;
• Investors can redeem at any time;
• The issuer or protocol will definitely repay all principal;
• It is equivalent to traditional bonds' AAA credit rating.

S&P explicitly states that VRA does not evaluate yields and does not judge whether the vault can fully meet its payment obligations.

A more accurate understanding is:
AAA(v) is a relative low-risk judgment of the risk of loss to investor positions within the scope of VRA assessment objects and methodology, rather than a principal insurance.

This is also why it is necessary to retain the “(v)” suffix when disseminating in the market. It represents Vault Risk Assessment and should not be confused with the traditional credit rating of AAA.

5. How S&P forms VRA: The institutional significance of a four-step method

S&P's methodology breaks down the formation of VRA into four steps.

Step 1: Assess the initial risks of configurable assets and markets

S&P first assesses the assets and lending markets that the vault can configure rather than solely looking at the actual holdings at a specific point in time. The initial assessment uses a risk score from 1 to 6, where 1 is the lowest risk and 6 is the highest risk.

This is important:
The risk of the vault depends not only on what it holds today but also on what it is permitted to hold in the future.

If the vault currently holds safer assets but the smart contracts allow for a significant portion of funds to be shifted to higher risk markets, the actual risk cannot be determined by the current snapshot.

Step 2: Include Curator and liquidity mismatch assessments

The initial risk score will be further influenced by two factors:

• The ability of the Curator to design, manage, and control strategies;
• The vault’s ability to meet investors' redemption demands.

S&P states that the intermediate VRA cannot be more than two grades better than the worst among Curator risk or liquidity mismatch risk. This means that no matter how good an asset portfolio is, if there are significant flaws in management capability or redemption design, the final result will also be constrained.

Step 3: Assess the security of blockchain, protocol, and governance

S&P independently assesses:

• The resilience, adoption level, and technical maturity of blockchain infrastructure;
• The design of the protocol, integrity, and transparency of smart contracts;
• The operational control, security, and governance transparency at the vault level.

The one with the highest risk among the three can form an upper limit constraint on the intermediate VRA. In other words, the system will not allow a vault to mask severe governance or technical vulnerabilities with good underlying asset quality.

Step 4: Form the final VRA

Finally, S&P maps the risk scores to letter results and may adjust according to factors that are not fully captured and comparable vault analyses.

This four-step method reflects an institutional change:

On-chain risk analysis has shifted from "looking at TVL and yield" to "looking at asset boundaries, management capabilities, exit paths, and the system's weakest links."

6. Why RWA will benefit from VRA, but not all RWA will benefit directly

RWA, such as government bonds, funds, and private credit, which are easier to explain credit quality, naturally find it easier to gain institutional acceptance.

This judgment's direction is reasonable, but it is essential to further distinguish the two roles of RWA in the vault.

1. Direct holding of Tokenized RWA: In principle, it does not belong to the core scope of VRA

S&P FAQ explicitly states that if a vault directly configures Tokenized RWA, such as tokenized bonds or funds, this type of direct holding exposure, in principle, does not fall within the scope of VRA and may be more suitable to use other assessment criteria like fund credit quality.

This indicates that VRA is not a unified rating tool for all RWA products. An investment product holding government bond tokens may have core questions like:

• What are the underlying assets;
• Who are the issuers and custodians;
• How are redemptions and bankruptcy isolation arranged;
• Are the assets subject to securities or fund regulations.

These questions differ from the bad debt risk of lending vaults.

2. Using Tokenized RWA as collateral for lending: Enters the core scope of VRA

If the vault uses Tokenized RWA as collateral for lending, the situation changes. At this point, risks not only come from the RWA itself but also from:

• Whether the collateral can be sold in a timely manner;
• Whether there are real buyers at the time of liquidation;
• Whether tokens can only be transferred among permitted participants;
• Whether there are authorized participants committing to buy in during trigger liquidations;
• Whether relying on a single entity for redemption or liquidation creates counterparty risk.

S&P specifically points out that many Tokenized RWA have limited transfer scopes and can only be purchased by approved participants. Even with high underlying asset quality, if there is not enough secondary market during liquidation, collateral may still fail to be realized at a reasonable price.

This leads to an important conclusion:

The biggest obstacle for RWA entering the DeFi lending market may not be the asset credit quality, but who is willing to take over during liquidation.

7. The real risks of RWA collateral: Liquidity is more important than yield

1. Tokenization does not equal automatic liquidity creation

RWA tokens can be transferred on-chain 24/7, but the underlying assets may only be tradable on weekdays or may only be held and redeemed by a limited number of compliant institutions.

Therefore, it is necessary to distinguish three types of liquidity:

• On-chain transfer liquidity: Whether tokens can be transferred by wallets and smart contracts;
• Secondary trade liquidity: Whether there is sufficient market depth and buyers;
• Underlying redemption liquidity: Whether it can be exchanged for cash or underlying assets through issuers, custodians, or authorized participants.

Only the first type of liquidity cannot guarantee that the vault can cope with large-scale redemptions or liquidations.

2. Liquidation is the stress test for RWA entering the lending market

In normal markets, RWA token prices may appear stable, and interest rates and yields may be attractive. However, in stressed markets, the vault must answer:

• When the collateral ratio hits the liquidation threshold, who will sell the assets;
• Whether selling requires KYC or whitelist approval;
• Whether market depth can withstand large orders;
• Whether oracle prices reflect real executable prices;
• Whether the redemption time is shorter than the borrower’s default spread time;
• Who bears the risk during cross-chain and cross-platform settlement delays.

This is also the reason why S&P lists liquidity mismatch as a separate risk factor.

3. A single liquidity provider will amplify risks

S&P FAQ mentions that if a single liquidity provider accounts for more than 20% of asset supply in a certain lending market, its market risk assessment will typically not be better than grade 3, and only at most one-third of that market's allocated value will be counted towards adjusted available liquidity.

This standard is particularly important for the RWA market. Many compliant RWA markets in early stages rely on a small number of issuers, market makers, banks, or authorized participants. If exit paths are concentrated in a single institution, the market looks liquid, but could quickly freeze under stressed conditions.

8. How VRA will force DeFi upgrades

To achieve a high rating, DeFi vaults must enhance the transparency and controllability of asset concentration, redemption mechanisms, oracles, liquidations, management privileges, multi-signatures, and upgrade rights.

This is the potential industry impact of VRA.

1. Shift from result transparency to mechanism transparency

Blockchain can publicly display:

• TVL;
• Wallet balances;
• Transaction records;
• Interest rate changes;
• Liquidation records.

But these still represent “result transparency.” Institutions also need to know:

• What markets the vault can configure in the future;
• Who can modify parameters;
• Who can upgrade contracts;
• Whether there is a queue for redemption;
• Which oracle provides pricing;
• Whether liquidation relies on a single market maker;
• Who responds in the event of a security incident.

VRA will push projects to organize these rules, privileges, and constraints into data that can be externally analyzed.

2. Asset caps and risk boundaries need to be written into contracts

S&P methodology emphasizes the range of assets the vault can qualify and allocation caps. For projects, the most convincing risk controls are not the Curator’s verbal commitment on the webpage of “we will not over-allocate,” but:

• List of configurable assets written into smart contracts;
• Single market allocation caps written into smart contracts;
• High-risk collateral ratios being restricted;
• Permission changes being time-locked;
• Upgrades must go through a transparent governance process;
• Changes in risk parameters can be tracked.

This will convert governance commitments from soft constraints into verifiable hard constraints.

3. Multi-signature is not the end point

Multi-signature can reduce single private key risks, but it does not automatically prove governance security. Attention should also be paid to:

• Whether multi-signature members are independent;
• Whether a single entity controls the majority of signatures;
• Whether multi-signature can immediately upgrade contracts;
• Whether upgrades require time locks;
• Whether users can exit before upgrades;
• Whether emergency pause privileges could freeze redemptions.

For institutions, governance risk is not as simple as "is there multi-signature," but whether the permission structure matches asset scale and the consequences of losses.

9. Impact on lending protocols such as Aave, Morpho, Euler

VRA will not automatically bring institutional funds to any protocol, but it may change how institutions enter underlying lending markets.

1. What institutions need is not the highest yield, but comparable risk profiles

Traditional institutions typically require when allocating assets:

• Risk classifications for investment targets;
• Quality analysis of assets and collateral;
• Management and operational processes;
• Liquidity and redemption mechanisms;
• Legal and governance documents;
• Ongoing monitoring and triggering mechanisms.

DeFi’s APY may be high, but without a unified risk language, it is difficult for institutions to include one vault alongside another in the same investment committee materials.

The role of VRA is to provide an external risk opinion to assist institutions in:

• Whitelist screening;
• Setting risk limits;
• Horizontal comparisons between vaults;
• Internal governance and approvals;
• Asset allocation and monitoring.

2. Institutional funds may preferentially flow to clearly structured vaults

The introduction of VRA may cause market stratification:

• Vaults with high transparency, low permissions, and clear asset boundaries will find it easier to gain institutional attention;
• Vaults relying on a single Curator, high asset concentration, and poor liquidity may have higher funding costs;
• Vaults with high yields but complex risk structures may continue to rely primarily on crypto-native capital;
• RWA collateral vaults need to demonstrate liquidation paths, not just prove the existence of underlying assets.

This will shift the competition in DeFi from "who offers the highest APY" to "who can secure more stable capital with lower risk."

3. The risks of lending protocols do not equate to the risks of vaults

It is imperative to avoid another misconception: VRA assesses the overall risk faced by investors in a particular lending vault and does not equal granting a unified credit rating to the underlying lending protocols or individual assets.

In the same protocol, different vaults may exhibit different risks due to:

• Diverse configurable markets;
• Diverse collateral;
• Diverse lending assets;
• Diverse Curators;
• Diverse redemption mechanisms;
• Diverse permissions and governance.

Therefore, future institutional research units may not say "invest in Aave," but rather "invest in a specific strategy and risk boundary vault on Aave."

10. Three layers of transmission of VRA to RWA development

First layer: Asset issuance layer

Asset issuers will be forced to disclose more information:

• Underlying assets;
• Custody and redemption;
• Holder qualifications;
• Transfer restrictions;
• Market depth;
• Price and valuation sources.

Second layer: Collateral layer

RWA is no longer seen merely as “holdable assets,” but must prove whether it can be lent, collateralized, and liquidated:

• Whether there are authorized buyers;
• Whether there is a clear liquidation waterfall;
• Whether there are stable price sources;
• Whether it can be identified across protocols;
• Whether emergency liquidity exists.

Third layer: Capital allocation layer

Institutional funds may place different vaults into different risk budgets based on VRA and other compliance materials:

• Low-risk vaults for cash management and liquidity allocation;
• Medium-risk vaults for yield enhancement;
• High-risk strategies reserved for higher risk tolerance capital.

This will push RWA from a "directory of on-chain assets" to a financial market with risk layering and capital allocation logic.

11. Limitations of S&P VRA: Standardization does not eliminate risk

1. Initial assessment does not equal real-time safety proof

VRA will be periodically monitored and updated and may enter review status due to changes in asset scope, smart contracts, and liquidity.

However, the speed of changes in on-chain systems may surpass traditional analysis cycles. A vault's contract permissions, asset whitelists, market makers, and lending parameters may change rapidly. Investors still need to track the on-chain status in real-time.

2. Relative risk does not equal absolute risk

AAA(v) indicates relatively lower impairment risk within the VRA system but does not imply no losses will occur in extreme scenarios. On-chain lending markets may still experience:

• Black swan price gaps;
• Oracle anomalies;
• Asset freezes;
• Cross-chain bridge failures;
• Contract vulnerabilities;
• Legal or regulatory events;
• Simultaneous failures in the liquidation market.

3. VRA does not evaluate yields

There is no direct correlation between high VRA ratings and high yields. In fact, lower-risk vaults may yield lower returns because of more conservative assets and strategies; high yields often come from higher leverage, lower liquidity, or more complex strategies.

Thus, “AAA(v) + high APY” cannot be marketed as a risk-free yield combination.

4. Direct RWA assets still need other analytical tools

VRA primarily addresses the risks of lending vaults and collateral and cannot replace:

• Credit analysis of RWA issuers;
• Evaluation of fund or security structures;
• Custody and bankruptcy isolation reviews;
• Regulatory qualifications and investor suitability analyses;
• Valuation and market liquidity studies of underlying assets.

In the future, institutions may need to use VRA alongside stablecoin stability assessments, fund credit quality evaluations, protocol security audits, and on-chain data monitoring.

12. Conclusion: The next step for RWA is not to add more assets, but to establish a collateral market that can be priced for risk

S&P Global Ratings' launch of VRA marks the beginning of traditional financial risk institutions developing a specialized analytical language for on-chain vaults.

The deeper significance of this lies not in "DeFi gaining an AAA label," but in the market beginning to recognize:

• DeFi vaults now have functions similar to investment vehicles;
• The asset scale is now sufficiently large to necessitate independent risk comparisons;
• On-chain transparency cannot replace strategy and risk transparency;
• RWA can only become institutional collateral when they are interpretable at the levels of liquidation, liquidity, and governance;
• The premise for institutional funds entering DeFi is that risks can be understood, limited, and continuously monitored by internal committees.

For RWA, the genuine upgrading path may be:

Asset Onboarding → Asset Standardization → Collateralization → Risk Assessment → Institutional Allocation.

Assets such as government bonds, funds, and private credit indeed have clearer credit quality explanations, but to enter the DeFi lending market, they must also prove their capacity to be sold, redeemed, or taken over by trusted participants during liquidation.

Therefore, the core metrics for future RWA competition will not be limited to TVL, token count, and issuance scale, but will also include:

• Whether the asset possesses clear legal rights;
• Whether the asset can be liquidated under stressed conditions;
• Whether risk parameters are written into smart contracts;
• Whether governance and upgrade permissions are controllable;
• Whether the vault has independent and ongoing risk opinions;
• Whether institutions can include them in their internal risk budgets.

For more data and analysis, please follow Aiplot:
https://aiplot.com/

📖 Community Communication：

Telegram:
https://t.me/+IIYMcJigBAo4Mjg1

The content of this article only represents the author's personal views and does not represent the position of this platform. The viewpoints, conclusions, and suggestions in this article are for investors' reference only and do not constitute any investment advice related to this platform. Markets are risky; investment requires caution.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。