Supplier-Denominator Integrity and Thin-Market Fee Socialization

Name: supplier-denominator integrity and thin-market fee socialization
Category: lending-market accounting reference / fee-routing checklist / reserve-denominator design note / thin-market quarantine companion
Summary: In rebasing lending markets and other reserve-backed claim systems, the next unit of reserve-side value is never neutral. Flash-loan premiums, over-repayments, rescue transfers, direct donations, liquidation leftovers, bridge repayments, and treasury top-ups all ask the same security question: when is reserve-side value allowed to become supplier-side claim value, and over what denominator? Healthy systems answer that question explicitly. Unhealthy systems let thin or attacker-owned supplier state capture the next unit of value as if it were ordinary yield, then let that printed claim become collateral or withdrawal truth. This note exists to preserve the positive design target behind Radiant, HopeLend, Starlay, ZeroLend, zkLend, and dTRINITY: reserve inflows need typed routing, denominator floors, and thin-market fail-closed behavior before they are allowed to socialize into supplier-side wealth.
Why this note exists:
- supplier-index-inflation already preserves the negative exploit family where dust supplier state captures liquidityIndex, lending_accumulator, or equivalent supplier-scaler growth.
- empty-market-exchange-rate-inflation preserves the broader tiny-denominator family across Compound-style and rebasing designs.
- What still deserves a narrower positive-design note is the policy boundary underneath those incidents: which reserve-side inflows count as supplier earnings at all, how thin denominators are quarantined, and how real-balance changes stay aligned with the denominator receiving them.

What this note means by supplier-denominator integrity

Supplier denominator means the quantity over which reserve-side value is distributed to suppliers: totalSupply, scaledTotalSupply, live share count, raw balance sum, or any equivalent claim denominator.
Reserve-side value means any asset increase or accounting credit that could raise supplier claims: flash-loan premiums, interest revenue, direct transfers, over-repayment, liquidation residue, bridge settlement, recapitalization, or operator rescue capital.
Fee socialization means the rule that decides whether those inflows become supplier-side value, treasury value, quarantined pending value, or something else.
Thin-market state means the denominator is too small, too concentrated, too fresh, or too attacker-ownable for the next unit of reserve-side value to be safely treated as ordinary supplier yield.
The core rule is simple: no reserve-side inflow should become supplier-side collateral or withdrawal truth unless the receiving denominator is large enough, diverse enough, and accounting-aligned enough to deserve it.

Three reserve-side promotions thin-market reviewers should not collapse

Reserve-side value arrived
- A premium, donation, over-repayment, rescue top-up, liquidation leftover, or other inflow increased reserve-side inventory or accounting value.
- This is only the statement that value showed up somewhere on the reserve side, not yet that suppliers earned it.
Supplier-side value was recognized locally
- The protocol decided that some portion of that reserve-side value now belongs in supplier accounting rather than in treasury, suspense, recovery, or another non-supplier bucket.
- Even this stronger statement is still not the same thing as the resulting supplier value already deserves immediate collateral, liquidation, withdrawal-at-mature-state, or recursive-borrow authority.
System-wide economic authority was granted
- Sibling markets, collateral engines, liquidation math, and loop paths are now allowed to treat that newly recognized supplier value as money-good solvency truth.
- Thin-market exploits often hide in the gap between steps 2 and 3: teams notice the denominator problem at recognition time, but still forget that locally recognized supplier value may need a later and narrower promotion before the rest of the lending system may trust it.

The design target is to keep these promotions explicit. A healthy reserve should be able to answer separately: what value arrived?, what if any part of it did suppliers earn locally?, and what part of that local supplier value is already allowed to become cross-market debt authority?

The six separations healthy designs should preserve

1. Reserve-side inflow provenance versus supplier-earned yield

A protocol should not collapse all reserve-side balance growth into one generic yield happened event.
Flash-loan premiums, over-repayments, accidental direct transfers, treasury top-ups, rescue capital, and bridge repayments are economically different objects.
Healthy designs type these inflows before deciding whether suppliers, treasury, bad-debt buffers, or nobody should receive immediate credit.
The unsafe default is letting any asset increase that touches reserve balance silently raise the supplier index.

2. Fee generation authority versus fee recipient authority

If one actor can both manufacture reserve-side revenue and dominate the denominator receiving it, the protocol is printing claims for that actor.
This is the thin-market danger in Radiant, HopeLend, dTRINITY, and ZeroLend: the attacker effectively decides both when fees exist and who owns them.
Healthy designs separate those roles with denominator floors, treasury routing, caps, or quarantine whenever supplier breadth is too thin.

3. Real reserve balance versus index-update denominator

Many rebasing designs let one code path read actual token balance while another socializes value over scaled supply or an internal liquidity measure.
If flash loans, repayments, or withdrawals look at a larger real balance than the denominator used to update supplier claims, the system has already split reserve truth into two exploitable ledgers.
Denominator integrity means those ledgers either reconcile continuously or fail closed before any mismatch can become supplier-side wealth.

4. Local accounting readability versus collateral-grade supplier value

Even if a reserve can compute a larger supplier index, that does not mean the increment should become immediate collateral or liquidation truth.
Thin-market fee socialization often matters most because the resulting indexed balance is honored by sibling markets.
Healthy systems keep supplier-side publication, local withdraw semantics, and downstream collateral admission on separate trust timelines.
The sharper reminder is that suppliers were credited locally is still not the same thing as the protocol now owes ordinary mature-state debt authority against that credit.

5. Thin-market state versus ordinary yield distribution

Ordinary supplier-yield rules are designed for mature denominators, not for 1 wei, one meaningful wallet, or a reserve that has been empty for months.
A reserve with negligible or singular supplier state is economically closer to a fresh market or recovery state than to steady state.
Healthy systems therefore stop using ordinary fee-socialization rules once denominator integrity falls below a declared threshold.

6. Recovery capital versus yield

If a reserve is damaged, dust-sized, or recapitalized, incoming assets may be repair capital rather than yield owed to surviving suppliers.
Letting recovery capital socialize over residual dust is just another thin-denominator windfall.
low-supply-recovery-and-recapitalization-discipline is the sharper companion when the incoming value is meant to repair a damaged reserve rather than reward a healthy supplier base.

What sound design looks like

1. Typed inflow handling at the reserve boundary

Every path that increases reserve-side value should declare its economic type before it can affect supplier claims.
The design question is not did assets arrive? but what kind of assets arrived, and who if anyone should get indexed credit for them?
Healthy systems distinguish at least: ordinary interest, flash-loan premiums, liquidation residue, direct transfer / donation, over-repayment, rescue top-up, and recovery capital.

2. Supplier-index growth requires denominator health, not just positive balance delta

Supplier-side accrual should depend on a minimum denominator threshold, minimum breadth, or both.
If scaledTotalSupply, meaningful-holder count, or effective exit depth is too small, reserve-side inflows should route somewhere safer: treasury, suspense accounting, a pending bucket, or no-op recognition until the market is re-seeded.
The design target is that the next unit of reserve-side value cannot become attacker-owned just because almost nobody else is there.

3. Real balance and claim denominator stay on one ledger story

Flash-loan capacity, withdrawal capacity, utilization math, and supplier index updates should agree on what reserve-side value exists and what portion of it is supplier-owned.
If raw token balance can outrun internal liquidity accounting, the protocol needs explicit reconciliation before any of that gap is lendable or yield-bearing.
Even after local supplier recognition, a healthy design may still delay flash-loan activation, mature withdrawal terms, or sibling-market collateral visibility until denominator-health and reserve-coherence checks pass.
This is the same boundary problem preserved by ZeroLend and the dTRINITY direct-transfer path.

4. Thin markets fall back into quarantine automatically

Once supplier breadth collapses toward dust, ordinary fee-socialization rules stop applying.
A healthy reserve can freeze collateral credit, route new premiums away from suppliers, cap index growth, or require reactivation review until denominator integrity is restored.
The key operational point is that thin-market quarantine may need to survive past local supplier recognition: we can explain the credit locally is still weaker than the market has re-earned full activation.
effective-freshness-reclassification-and-dormant-market-quarantine is the lifecycle companion once the reserve becomes economically fresh again.

5. Fee-generation paths cannot self-mint collateral

Flash-loan premiums, same-reserve fee loops, and other user-generated reserve inflows should not let the fee generator also monopolize the supplier-side accrual.
Good designs cap per-block index growth, require denominator health before fee socialization, or route thin-market fees to treasury or insurance buffers instead.
The sharper downstream companion is collateral-admission-lag-and-borrow-side-quarantine once the question becomes how long printed supplier value should stay non-borrowable.

6. Recapitalization and rescue are explicit non-ordinary states

If reserve-side value arrives during repair, migration, or incident recovery, that value should not automatically socialize over the live supplier denominator.
Healthy systems make recovery capital legible as its own object and delay supplier or collateral recognition until the reserve re-enters a healthy state.
low-supply-recovery-and-recapitalization-discipline is the sharper repair-mode companion.

7. Minimum-unit arithmetic is paired with denominator policy

If one scaled unit can become economically huge, burn math and fee socialization are part of the same problem.
A healthy design does not fix only the under-burn edge while still allowing one fee event to make each surviving unit absurdly valuable.
minimum-unit-burn-rounding-and-low-decimal-asset-discipline is the arithmetic companion when monetization depends on coarse units or floor rounding.

Implementation patterns that age better than ad hoc fee routing

1. Suspense-bucket first, supplier accrual second

When reserve-side value arrives during thin-market conditions, the safest default is usually do not socialize it yet.
Route flash-loan premiums, direct transfers, liquidation leftovers, and over-repayments into an explicit pending or suspense bucket that is not immediately part of supplier index growth, collateral value, or flash-loanable liquidity.
Release that bucket into supplier earnings only after denominator-health checks pass again and the reserve has exited effectively-fresh status.
This is often cleaner than trying to encode dozens of case-by-case if supply is tiny, maybe still socialize exceptions into steady-state accrual math.

2. Treasury-first routing for attacker-manufacturable inflows

Some reserve-side inflows are too attacker-steerable to ever be safe as immediate supplier yield when the denominator is weak.
Flash-loan premiums, same-reserve loop fees, donation-like balance changes, and similar attacker-manufacturable inflows should often route to treasury, insurance, or protocol-owned buffers until a stronger denominator exists.
The point is not that suppliers never deserve fee income; it is that the protocol should not let the same actor both manufacture the fee event and monopolize the supplier-side recipient set.
If the protocol later wants to socialize part of that value, it should do so through an explicit reallocation step rather than through ambient reserve math.

3. Collateral visibility should lag local accrual visibility

Even when a reserve decides to credit suppliers locally, sibling markets should not have to trust that new indexed value immediately.
A healthy design can let local accounting update first while still keeping borrow power, liquidation value, and recursive-collateral use under a separate seasoning delay, cap, or quarantine.
This keeps the protocol from turning the reserve can explain this increment locally into the whole system must treat it as mature solvency truth right now.
collateral-admission-lag-and-borrow-side-quarantine is the sharper companion once the reserve-side routing question turns into downstream borrow authority.

4. Effective-freshness checks should be mechanical, not narrative

Thin-market safety fails when teams treat fresh market, dormant market, recovered market, and mature market as descriptive labels instead of code-level states.
Denominator health should be computed from explicit thresholds: minimum non-burnable seed, minimum scaled supply, minimum breadth, maximum concentration, and sometimes minimum time since reactivation.
The reserve should fall back into its effectively-fresh policy automatically when those conditions break, even if the market is old, branded blue-chip, or governance-listed.
This is the lifecycle bridge back to effective-freshness-reclassification-and-dormant-market-quarantine.

Operational guardrails worth automating

1. Treat `reserve-side value arrived without matching denominator growth` as a first-class alert

Direct transfers, over-repayments, liquidation leftovers, bridge repayments, treasury top-ups, and flash-loan premiums should all produce typed telemetry before any supplier-side index update occurs.
The dangerous alert is not only balance changed. It is balance changed on a path that did not mint matching supplier state, and the reserve is still thin enough for that delta to matter.
A healthy production posture should page on three facts together: reserve delta source, denominator health, and which downstream modules still treat the reserve as collateral-relevant.

2. Pre-commit the authority-reduction ladder

Thin-market incidents move faster than governance theater, so the protocol should decide in advance what happens when denominator health breaks.
A useful ladder is: route new inflows to suspense → freeze collateral credit → disable recursive borrow pairs → reduce borrow caps / debt ceilings → pause flash loans or the whole reserve if ledger coherence is suspect.
The important property is monotonicity: once the market is thin enough to stop deserving ordinary fee socialization, the protocol should only gain trust back through explicit reactivation rather than through ambient new deposits or revenue.

3. Track supplier concentration, not just total supply

scaledTotalSupply > 0 is a weak safety signal when one address owns nearly all of it.
Monitoring should include holder concentration, effective exit depth, seed-share proportion, and whether the next unit of supplier-side value would still land mostly on one wallet or operator cluster.
This matters because attacker-owned denominator health often hides behind a nonzero supply number that looks superficially fine in dashboards.

4. Split local accounting publication from downstream spendability in monitoring too

The reserve may still need to publish a local index or rate for exits, accounting, or recovery, but downstream consumers should expose a separate flag for whether that mark is borrowable, liquidatable, or recursion-eligible.
The operational failure pattern is the dashboard shows a number, so every integration assumes the number is money-good.
Healthy systems surface both states explicitly: local accounting visible and cross-market solvency authority enabled.

Minimal reserve-socialization state machine worth encoding

State	What is true	What must still be false	Typical controls
`ordinary-socialization`	Reserve-side inflows may be recognized as ordinary supplier yield because denominator health, breadth, and ledger coherence are intact	One actor or one dust-sized supplier set must not be able to manufacture and capture the next meaningful unit of reserve-side value	ordinary accrual, normal flash-loan fee routing, steady-state collateral rules
`thin-local-only`	The reserve may still publish local accounting or let operators inspect incoming value, but denominator health has degraded or provenance is not yet trusted	Fresh supplier-side credit must not yet become ordinary collateral, liquidation, or recursive-borrow authority	collateral factor cuts, isolated mode, local accounting visible, borrow-side quarantine still on
`suspense-routing`	Reserve-side inflows are being captured as typed pending or recovery-side value instead of immediate supplier earnings	New inflows must not silently enlarge supplier index growth, flash-loanable capacity, or mature-state withdrawal assumptions	suspense bucket, treasury-first routing, flash-loan disablement, direct-transfer quarantine
`reactivation-review`	The reserve is being re-seeded, recapitalized, or reclassified after dust-state, dormancy, or repair	A restored balance alone must not automatically imply `ordinary supplier yield rules are back`	explicit denominator-health checks, holder-breadth review, reserve-ledger reconciliation, staged caps
`ordinary-socialization-restored`	Typed inflows, denominator health, and downstream collateral policy have all been re-earned	Historical age or one fresh top-up must not be the only reason the market regained full trust	explicit re-enable step, staged collateral restoration, monitoring still armed

The design goal is not to force every lending market into the same exact labels. It is to make reserve-side value arrived, we can explain that value locally, and suppliers now own it as mature borrowing power advance through a state machine rather than through ambient accounting side effects.
Healthy systems usually allow forward movement into thin-local-only, suspense-routing, or reactivation-review automatically when denominator health breaks, while movement back toward ordinary-socialization-restored should be explicit and harder to reach.
The practical exploit-family shortcut is blunt: if a reserve can jump from one attacker-controlled unit remains or direct transfer landed straight to ordinary supplier wealth and cross-market collateral power updated, then the socialization state machine is still mostly implicit.

Recovery sequence after a thin-denominator hit

Classify the inflow before socializing it
- Decide whether the arriving value is ordinary revenue, attacker-manufacturable fee flow, rescue capital, migration inventory, or ambiguous balance drift.
- If classification is uncertain, default to suspense rather than to supplier yield.
Stop the reserve from exporting fresh printed value
- Cut collateral factor, isolate borrowing, disable recursion, or pause the reserve before a locally explainable index jump becomes sibling-market debt authority.
- If reserve ledgers may already disagree, also narrow flash-loan and withdrawal paths until reconciliation finishes.
Reconcile numerator, denominator, and live obligations
- Confirm what actual assets arrived, what internal liquidity or index state changed, which wallets own the denominator, and what outstanding debts or withdrawals could still monetize the gap.
- This is the step that decides whether the problem is thin-market fee capture, ledger divergence, recovery-capital handling, or several at once.
Choose the recapitalization / re-seeding policy explicitly
- If the market needs repair, decide whether new capital belongs to treasury, fresh seed state, migrated claimants, or legacy suppliers.
- Do not let the answer emerge accidentally from whichever residual dust holders happened to remain live when the new assets landed.
Re-enable in layers, not in one jump
- Restore local accounting first if needed, then local exits, then collateral visibility, then broader borrowing and recursion only after denominator health and ledger coherence are proven again.
- This is where low-supply-recovery-and-recapitalization-discipline, fresh-market-seeding-and-activation-discipline, and collateral-admission-lag-and-borrow-side-quarantine become the practical follow-on notes.

High-signal contrast cases

Radiant Capital native USDC is the clean launch-window reminder that the first supplier should never be allowed to monopolize flash-loan-fee socialization into liquidityIndex.
HopeLend hETHWBTC preserves the dormant-market version: old reserve, dust denominator, same printed supplier-side wealth.
Starlay lUSDC is the useful sparse-disclosure reminder that thin-denominator fee socialization stays dangerous even when public writeups are incomplete.
ZeroLend PT-LBTC is the sharpest real-balance / scaled-denominator divergence case.
zkLend wstETH shows the same family in accumulator form where over-repayment and donation semantics feed supplier-side value directly.
dTRINITY dLEND cbBTC is the later reminder that even after Radiant and HopeLend, protocols were still letting direct transfers and flash-loan premiums socialize over attacker-owned supply.

Design questions worth asking first

Which exact reserve-side inflows can increase supplier-side claim value here: interest, flash-loan premiums, over-repayment, direct transfer, liquidation leftovers, rescue capital, or treasury top-ups?
Where does the code decide whether each inflow counts as supplier yield, treasury value, quarantined pending value, or recovery capital?
What denominator receives that value, and can one actor or a dust-sized supplier set dominate it?
Do flash loans, withdrawals, and utilization read the same reserve ledger that supplier-index updates read, or can real balance outrun the claim denominator?
What happens when scaledTotalSupply, meaningful-holder count, or exit depth falls below a safe threshold?
Can the actor generating the next unit of reserve-side value also capture most of the supplier-side accrual from it?
If a reserve receives assets outside supply(), what changes immediately: flash-loanable balance, index growth, withdrawal capacity, collateral value, or nothing?
Which paths reclassify an old or depleted reserve as too thin for ordinary fee socialization?
What prevents thin-market supplier-side growth from becoming immediate collateral truth in sibling markets?
After local supplier recognition, what exact guard still blocks same-block recursive borrow, mature-state withdrawal semantics, or liquidation-value publication while denominator health remains suspect?
If the reserve is recovering from losses, how is repair capital prevented from becoming a windfall for residual dust holders?

Red flags that usually mean denominator policy is underdesigned

All reserve income belongs to suppliers without asking whether the denominator is healthy enough to receive it
Flash-loan fees are always neutral even when one supplier can generate and capture them alone
Direct transfers help the pool without saying whether they are lendable, yield-bearing, or collateral-visible
The reserve balance is what it is when different code paths read different ledgers for that balance
The market is old, so normal index rules apply even though supplier breadth has collapsed back toward dust
We fixed the withdraw rounding while leaving the same thin-denominator fee-socialization path intact
Treasury can top it up later without defining whether that top-up is yield, rescue capital, or quarantined pending value

Failure-prevention checklist

Type every reserve-side inflow explicitly: interest, flash-loan premiums, over-repayment, direct transfer, liquidation residue, rescue capital, migration receipts, and treasury support should not all collapse into one generic supplier-yield path.
Require denominator health before supplier-side socialization. If totalSupply, scaledTotalSupply, breadth, or exit depth is too small, route new reserve-side value to treasury, suspense, or recovery accounting rather than to ordinary supplier claims.
Keep flash-loanable balance, withdrawal balance, utilization state, and supplier-index denominator on one reconciled ledger story. If those ledgers diverge, fail closed before any path can lend against one and socialize over another.
Treat direct transfers to reserve or receipt-token contracts as hostile until classified. Raw asset arrival should not automatically enlarge flash-loan capacity, supplier yield, or collateral value.
Cap or quarantine supplier-index growth in thin markets. One block of fee accrual should not be able to redefine supplier wealth when supply is attacker-ownable dust.
Reclassify dormant, duplicate, or supply-collapsed reserves as effectively fresh. Ordinary fee-socialization rules should shut off once one actor can again dominate the denominator.
Separate local accrual from downstream admission. Even if supplier accounting changes, keep collateral factor, borrowability, and liquidation authority constrained until denominator health is restored.
Pair denominator safeguards with burn-rounding safeguards. If one unit can become economically large, fix both how value reaches that unit and how much state must be burned to exit it.
Distinguish rescue capital from yield. Treasury top-ups, migrations, and recapitalization should travel through explicit recovery accounting rather than silently enriching residual suppliers.
Monitor for production-impossible states: one meaningful supplier, dust scaledTotalSupply, real reserve balance outrunning internal liquidity, or abrupt index growth after direct balance changes.

Audit prompts

What exact variable is the denominator of supplier wealth in this market, and who can shrink it toward attacker-owned dust?
Which code paths increase the numerator without going through the same path that increases the denominator?
Are flash-loan premiums distributed over scaled liquidity, live supplier count, raw token balance, or some hybrid object that can be made inconsistent?
Can a user directly transfer assets into the reserve or receipt-token contract and thereby alter flash-loan capacity, utilization, or supplier-index growth without a matching supplier mint?
If reserve-side value arrives while supply is tiny, where does it go today: supplier index, treasury, pending bucket, or nowhere?
What exact condition says the market is too thin to socialize new value to suppliers safely?
Can the fee-generating user also be the only meaningful fee recipient? If so, what invariant prevents them from printing collateral?
Which downstream modules consume the resulting supplier-side value as collateral, liquidation truth, or withdrawal authority before denominator health is proven?
How does the protocol distinguish ordinary earned yield from recovery capital, bridge repayment, or rescue transfer?
If the market fell to one meaningful supplier tomorrow, what would happen to the next flash-loan premium or direct top-up?

Lessons that should already be standard

The next unit of reserve-side value is part of the security model. It is not just accounting dust.
Flash-loan fee routing is collateral policy whenever those fees can change supplier-side collateral value.
Mature yield-socialization rules do not survive thin denominators automatically. Dust supply is a different regime.
Suppliers were credited locally is not yet the same statement as sibling markets may now underwrite debt against that credit.
Real balance and supplier denominator must agree on what value exists and who owns it. If one ledger feeds loans and another feeds indexes, the gap is the exploit.
Direct transfers, over-repayments, and rescue top-ups are typed economic events, not benevolent ambient balance changes.
Supplier earned this and reserve received this are not the same statement.
Dormant reserves need fresh-market paranoia. Age does not repair denominator fragility.
If one actor can both manufacture and capture the next fee event, the protocol is delegating claim issuance to that actor.

How to use this note with the exploit corpus

Start here when the sharper design question is who was allowed to capture the next unit of reserve-side value, and why was that still being socialized over a thin denominator?
Pair with supplier-index-inflation when the negative family is already clear and the next question is how supplier-side scalers should have been protected.
Pair with empty-market-exchange-rate-inflation when the denominator failure spans both Compound-style exchange-rate inflation and rebasing-reserve index inflation.
Pair with fresh-market-seeding-and-activation-discipline and effective-freshness-reclassification-and-dormant-market-quarantine when the denominator became attacker-ownable because the market was fresh or economically fresh again.
Pair with collateral-admission-lag-and-borrow-side-quarantine when the sharper downstream question is why the printed supplier-side value became immediate borrow or liquidation authority.
Pair with minimum-unit-burn-rounding-and-low-decimal-asset-discipline when the decisive monetization step is under-burn or coarse-unit rounding after the denominator was already allowed to become absurdly valuable.
Pair with low-supply-recovery-and-recapitalization-discipline when the incoming reserve-side value is repair capital rather than ordinary yield and the real design task is recovery-mode accounting.

Internal linkages

Canonical negative family: supplier-index-inflation.
Broader tiny-denominator family: empty-market-exchange-rate-inflation.
Fresh-market lifecycle companion: fresh-market-seeding-and-activation-discipline.
Effective-freshness lifecycle companion: effective-freshness-reclassification-and-dormant-market-quarantine.
Downstream admission companion: collateral-admission-lag-and-borrow-side-quarantine.
Arithmetic companion: minimum-unit-burn-rounding-and-low-decimal-asset-discipline.
Recovery-mode companion: low-supply-recovery-and-recapitalization-discipline.
Reserve-claim object companion: reserve-backed-claim-truth-security-object.
Strong concrete exemplars: Radiant, HopeLend, Starlay, ZeroLend, zkLend, dTRINITY.

Control surface

The decisive control surface is the policy boundary between reserve-side value arrived and suppliers now own that value.
Healthy systems encode what inflows count, which denominator may receive them, when thin-market conditions suspend ordinary socialization, and how downstream collateral trust lags behind local accounting.
Unsafe systems let a dust denominator, a mismatched ledger, or a self-generated fee event decide what supplier wealth means.
Sources:
Last reviewed: 2026-08-03 UTC

Cowrie Research

Explorer

supplier-denominator-integrity-and-thin-market-fee-socialization