DeFi Insurance Protocols: Risk Modeling, Underwriting, and Claims

Traditional insurance covers:
- Physical assets (houses, cars, inventory)
- Liability (professional, product, general)
- Business interruption
- Cyber (limited, excludes crypto)

DeFi risks NOT covered by traditional insurance:
- Smart contract bugs → $1.9B lost in 2025
- Oracle manipulation → $400M lost
- Stablecoin depeg → $8B+ impact (UST collapse)
- Governance attacks → $200M lost
- MEV exploitation → $1B+ extracted
- Slashing → 50K+ ETH slashed
- Bridge hacks → $2B+ across 20+ incidents

Smart Contract Cover (70% of market):
  - Covers: Bugs, exploits, logic errors
  - Premium: 1-5% of covered value
  - Typical coverage: $100K-$5M per protocol
  - Examples: Nexus Mutual, Sherlock, InsurAce

Stablecoin Depeg Cover (15% of market):
  - Covers: Peg deviation beyond threshold (>5%)
  - Premium: 0.5-3%
  - Typical coverage: $10K-$1M
  - Examples: Unslashed, InsurAce

Slashing Cover (10% of market):
  - Covers: Validator slashing penalties
  - Premium: 1-8% (varies by validator quality)
  - Typical coverage: 10-500 ETH
  - Examples: Staked, Unslashed

Custody/Bridge Cover (5% of market):
  - Covers: Bridge hacks, custody failures
  - Premium: 2-8%
  - Typical coverage: $500K-$10M
  - Examples: Nexus Mutual, InsurAce

Capital Providers (LPs)
  │
  ▼
Deposit DAI/USDC → Underwriting Pool
  │
  ├──→ Risk 1 (Protocol A): 20% allocation
  ├──→ Risk 2 (Protocol B): 15% allocation
  ├──→ Risk 3 (Protocol C): 25% allocation
  └──→ Unallocated: 40% (buffer)

  LPs earn: Premiums from active policies
  LPs risk: Claims against allocated capital

  ┌──────────────────────────────────────────────┐
  │  Underwriting Pool Token Model                │
  │                                                │
  │  Pool token (e.g., NXM) represents:            │
  │  - Proportional claim on pool capital           │
  │  - Governance rights (vote on claims)           │
  │  - Right to participate in underwriting         │
  │                                                │
  │  Token price = pool_assets / pool_tokens       │
  │  Token price increases when:                   │
  │    - Premiums collected > claims paid           │
  │    - Capital grows without dilution             │
  │  Token price decreases when:                   │
  │    - Claims > premiums + reserves               │
  └──────────────────────────────────────────────┘

// Simplified capital allocation for underwriting
contract UnderwritingPool {
    struct Risk {
        address protocol;
        uint256 allocatedCapital;
        uint256 activeCoverage;
        uint256 premiumRate;  // e.g., 2% = 200 basis points
        uint256 riskScore;    // 1 (safest) to 10 (riskiest)
    }

    Risk[] public risks;
    uint256 public totalPoolCapital;
    uint256 public minCapitalUtilization = 30;  // 30%
    uint256 public maxCapitalPerRisk = 15;       // 15% per protocol

    function calculateMaxCoverage(Risk storage risk) internal view returns (uint256) {
        // Max coverage = min(risk allocation, 5% of protocol TVL)
        uint256 allocation = (totalPoolCapital * risk.allocatedCapital) / 100;
        uint256 tvlCap = protocolTVLs[risk.protocol] * 5 / 100;
        return Math.min(allocation, tvlCap);
    }

    function assessDiversification() public view returns (bool) {
        // Check: no single risk exceeds maxPerRisk%
        uint256 totalAllocated = 0;
        for (uint256 i = 0; i < risks.length; i++) {
            require(
                risks[i].allocatedCapital <= maxPerRisk,
                "Over-concentrated"
            );
            totalAllocated += risks[i].allocatedCapital;
        }
        require(totalAllocated <= 80, "Must keep 20% buffer");
        return true;
    }
}

class ProtocolRiskScorer:
    """Assess protocol risk for premium pricing."""

    def __init__(self):
        self.history = HistoricalExploitDatabase()
        self.audit_repository = AuditScoreDB()
        self.tvl_oracle = TVLOracle()

    def score_protocol(self, protocol_address: str) -> dict:
        """Compute comprehensive risk score."""

        # 1. Code complexity (proxy for bug surface)
        code_metrics = self._analyze_code_complexity(protocol_address)
        complexity_score = (
            code_metrics["n_transfer_functions"] * 0.3 +
            code_metrics["n_external_calls"] * 0.3 +
            code_metrics["n_upgrade_proxies"] * 0.2 +
            code_metrics["lines_of_code"] / 10000 * 0.2
        )

        # 2. Audit history
        audit_score = self.audit_repository.get_score(protocol_address)
        audit_quality = (
            (audit_score["n_audits"] >= 3) * 0.3 +
            (audit_score["top_tier_auditor"] >= 1) * 0.3 +
            (1 - min(audit_score["critical_findings"], 5) / 10) * 0.4
        )

        # 3. Operational history
        ops_history = self.history.get_protocol_history(protocol_address)
        ops_score = max(0, 1 - (
            ops_history["incidents_12m"] * 0.4 +
            ops_history["total_lost_12m"] / 100_000_000 * 0.3 +
            ops_history["near_misses_12m"] * 0.1 +
            (1 if ops_history["has_paused"] else 0) * 0.2
        ))

        # 4. TVL stability
        tvl_data = self.tvl_oracle.history(protocol_address, days=90)
        tvl_stability = 1 - (tvl_data["std_dev"] / tvl_data["mean"])

        # 5. Governance quality
        gov_quality = self._assess_governance(protocol_address)

        # Weighted composite score (0-10, lower = safer)
        risk_score = (
            complexity_score * 0.15 +
            (1 - audit_quality) * 0.25 +
            (1 - ops_score) * 0.35 +
            (1 - tvl_stability) * 0.10 +
            (1 - gov_quality) * 0.15
        )

        return {
            "risk_score": min(10, risk_score * 10),
            "complexity": complexity_score,
            "audit_quality": audit_quality,
            "operational_safety": ops_score,
            "tvl_stability": tvl_stability,
            "gov_quality": gov_quality,
            "recommended_premium": risk_score * 0.5 + 0.5,  # 0.5-5.5%
        }

def calculate_premium(
    risk_score: float,      # 1-10
    coverage_amount: float, # USD
    coverage_period: int,   # Days
    pool_utilization: float, # Current pool utilization (0-1)
    protocol_tvl: float,    # Protocol total value locked
    is_parametric: bool,    # Parametric vs discretionary
) -> float:
    """Calculate insurance premium in USD."""

    # Base rate from risk score
    base_rate = 0.005 + (risk_score * 0.005)  # 0.5% to 5.5%

    # Time scaling (30 days minimum)
    time_factor = max(30, coverage_period) / 365

    # Pool utilization adjustment (higher utilization → higher premium)
    utilization_factor = 1 + (pool_utilization - 0.3) * 0.5

    # Protocol TVL factor (higher TVL → slightly lower risk)
    tvl_factor = max(0.8, 1 - (protocol_tvl / 10_000_000_000))

    # Parametric discount (faster claims, less human judgment)
    parametric_discount = 0.9 if is_parametric else 1.0

    # Minimum premium
    min_premium = 100  # $100 minimum

    premium = (
        coverage_amount *
        base_rate *
        time_factor *
        utilization_factor *
        tvl_factor *
        parametric_discount
    )

    return max(min_premium, premium)

DeFi insurance claim assessment is fundamentally harder than traditional:

Traditional: Adjuster visits site, takes photos, interviews witnesses
→ Verifiable physically → Hard to fake

DeFi: "Protocol was exploited for $10M"
→ All on-chain but... was it really an exploit or was it a feature?
→ Was it a bug in the code or intentional user action?
→ Did the protocol take adequate precautions?
→ Is this a legitimate claim or a coordinated attack on the insurance pool?

// Optimistic claims assessment
contract OptimisticClaimAssessor {
    struct Claim {
        uint256 id;
        address claimant;
        address protocol;
        uint256 amount;
        bytes32 evidenceHash;
        uint256 submissionTime;
        uint256 challengeDeadline;
        bool paid;
        bool challenged;
    }

    mapping(uint256 => Claim) public claims;
    uint256 public challengeWindow = 14 days;
    uint256 public challengerBond = 5_000e18;  // 5000 DAI bond

    function submitClaim(
        address protocol,
        uint256 amount,
        bytes32 evidenceHash
    ) external {
        claims[nextId] = Claim({
            id: nextId,
            claimant: msg.sender,
            protocol: protocol,
            amount: amount,
            evidenceHash: evidenceHash,
            submissionTime: block.timestamp,
            challengeDeadline: block.timestamp + challengeWindow,
            paid: false,
            challenged: false
        });

        emit ClaimSubmitted(nextId++, msg.sender, protocol, amount);
    }

    function challengeClaim(uint256 claimId) external payable {
        Claim storage claim = claims[claimId];
        require(block.timestamp < claim.challengeDeadline, "Window expired");
        require(msg.value == challengerBond, "Bond required");

        claim.challenged = true;

        // Freeze payout, enter dispute resolution
        emit ClaimChallenged(claimId, msg.sender);
    }

    function finalizeClaim(uint256 claimId) external {
        Claim storage claim = claims[claimId];
        require(block.timestamp > claim.challengeDeadline, "Still challengeable");

        if (!claim.challenged) {
            // No challenge → automatic payout
            claim.paid = true;
            _payout(claim.claimant, claim.amount);
            emit ClaimApproved(claimId);
        }
    }
}

class ClaimsCommittee:
    """Claims assessment committee with weighted voting."""

    def __init__(self):
        self.members = {}  # address -> MemberInfo
        self.claims = {}
        self.threshold = 0.6  # 60% majority

    def submit_claim(self, claimant, protocol, amount, evidence_hashes):
        """Submit a claim for committee assessment."""

        # 1. Verify coverage exists (policy was active at incident time)
        assert self.verify_coverage(claimant, protocol)

        # 2. Create assessment
        claim_id = len(self.claims)
        self.claims[claim_id] = {
            "status": "pending",
            "votes_for": 0,
            "votes_against": 0,
            "voters": set(),
            "evidence": evidence_hashes,
        }

        # 3. Notify assessors (weighted by staked NXM)
        eligible_assessors = [
            m for m in self.members.values()
            if m.staked_amount >= MIN_ASSESSOR_STAKE
        ]

        for assessor in eligible_assessors:
            assessor.notify(claim_id, evidence_hashes)

        return claim_id

    def vote(self, claim_id, assessor, approve: bool, justification: str):
        """Cast weighted vote on claim."""
        claim = self.claims[claim_id]
        assert assessor not in claim["voters"]

        weight = self.members[assessor].voting_power

        if approve:
            claim["votes_for"] += weight
        else:
            claim["votes_against"] += weight

        claim["voters"].add(assessor)

        # Fast resolution: check if threshold reached
        total_votes = claim["votes_for"] + claim["votes_against"]
        if total_votes >= MIN_VOTES and (
            claim["votes_for"] / total_votes >= self.threshold or
            claim["votes_against"] / total_votes >= self.threshold
        ):
            self.resolve_claim(claim_id)

        return {"claim_id": claim_id, "vote": approve, "weight": weight}

    def assessor_rewards(self, claim_id, outcome):
        """Reward honest assessors, slash dishonest ones."""
        claim = self.claims[claim_id]
        for voter in claim["voters"]:
            voted_correctly = (
                (outcome == "approved" and voter in claim["voters_for"]) or
                (outcome == "denied" and voter in claim["voters_against"])
            )

            if voted_correctly:
                # Reward: claim fee + reputation
                self.members[voter].reputation += 1
                self.members[voter].pending_rewards += CLAIM_REVIEW_FEE
            else:
                # Slash: lose reputation
                self.members[voter].reputation -= 2

Nexus Mutual Architecture:

Capital Pool (DAI):
  - LPs deposit DAI → receive NXM (pool token)
  - NXM token price = pool_assets / total_shares
  - Token price floor = 1 DAI (can always redeem at 1:1)

Products:
  1. Protocol Cover (covers smart contract risks)
     - 30-day to 1-year policies
     - Covers direct loss from exploits
     - Max coverage per protocol: 5M-50M

  2. YB Cover (Yield Bearing Protocols)
     - Covers loss of deposited funds
     - Parameterized by protocol type

  3. Custody Cover
     - Covers exchange custodian failures
     - Highest premiums (5-10%)

Claims Process:
  1. Claim submitted with evidence (tx hashes, analysis)
  2. 24h cooling period → Assessors review
  3. 72h voting period → 60% majority
  4. If approved → paid from pool in 7 days
  5. If denied → claimant can appeal to broader membership

Risk Assessment:
  - Risk Assessment Team (RAT) provides initial scoring
  - Protocol scoring: code quality, team, TVL, operational history
  - Premium = base_rate × risk_multiplier × time × amount

Insurance pool math:

Pool Capital: $100M
Total Coverage Sold: $30M (30% utilization)
Annual Premiums: $30M × 2.5% = $750K
LP Returns: $750K / $100M = 0.75% APY   ← LOW!

If 60% utilization:
  Premiums: $60M × 2.5% = $1.5M
  LP Returns: $1.5M / $100M = 1.5% APY  ← Still low vs DeFi lending (5-10%)

The gap: Insurance pools offer lower returns with higher risk
→ Capital providers expect 10-15% returns
→ Pool utilization needs to be 80%+ for competitive returns
→ But 80% utilization leaves only 20% buffer for claims → high insolvency risk

class CapitalEfficiencyStrategies:
    """Strategies to improve insurance pool capital efficiency."""

    @staticmethod
    def dynamic_pricing(utilization: float) -> float:
        """Increase premiums as utilization rises to incentivize capital."""
        base_premium = 0.02  # 2%
        if utilization < 0.3:
            return base_premium * 0.5  # 1% discount when under-utilized
        elif utilization < 0.6:
            return base_premium
        elif utilization < 0.8:
            return base_premium * 1.5  # 3% when moderately full
        else:
            return base_premium * 2.5  # 5% when near capacity

    @staticmethod
    def yield_farming_on_reserves(pool, allocation: dict):
        """Generate yield on unallocated capital."""
        # 30% liquid (DAI in pool)
        # 40% low-risk yield (Aave DAI supply, 4-6%)
        # 20% medium-risk (stETH, 5-8%)
        # 10% high-yield (LP positions, 8-15%)

        total = pool.total_capital
        returns = (
            allocation["liquid"] * 0 +
            allocation["low_risk"] * 0.05 +
            allocation["medium_risk"] * 0.065 +
            allocation["high_yield"] * 0.10
        )
        return returns * total  # Additional yield for LPs

    @staticmethod
    def reinsurance_layer(primary_pool, reinsurance_pool, premium_share=0.3):
        """Reinsure tail risk: catastrophic losses beyond threshold."""
        # Primary pool keeps: first 20% loss
        # Reinsurance pool covers: 20-50% loss
        # Primary pool holders: safe from worst scenarios
        # Cost: 30% of premiums go to reinsurance

        primary_pool.premium_split = {
            "claims_reserve": 0.60,
            "operations": 0.10,
            "reinsurance_premium": premium_share,
        }
        return reinsurance_pool

Parametric Trigger Examples:

1. Stablecoin Depeg Insurance:
   Condition: ETH/USDC price on Uniswap < $0.95 for 1 hour
   Payout: Premium × 100 (covers depeg loss)
   Verification: Chainlink oracle + TWAP
   Settlement: Direct transfer in 1 transaction
   → No claims assessment needed → 100% automated

2. Slashing Insurance:
   Condition: Validator receives slashing penalty on Beacon Chain
   Payout: Slashed amount (up to 32 ETH)
   Verification: Beacon chain event
   Settlement: Direct transfer
   → Deterministic, verifiable on-chain

3. Liquidation Insurance:
   Condition: Aave liquidation event on specific position
   Payout: Liquidation penalty (5-15%)
   Verification: Aave liquidation event
   → Fully automated

4. Gas Spike Insurance:
   Condition: Average gas price > 500 gwei for 1 hour
   Payout: Fixed amount per covered transaction
   Verification: Block gas oracle
   → Protects against L1 congestion

Parametric:
  ✅ Instant settlement (minutes)
  ✅ No human judgment needed
  ✅ No governance overhead
  ✅ Transparent triggers
  ❌ Can't handle edge cases
  ❌ Limited to simple conditions
  ❌ Oracle manipulation risk

Discretionary (Mutual):
  ✅ Can evaluate complex scenarios
  ✅ Handles edge cases
  ✅ Human discretion
  ❌ Slow (days-weeks)
  ❌ Governance attacks possible
  ❌ Assessor apathy

Best for:
  Parametric → Stablecoins, slashing, liquidation
  Discretionary → Smart contract bugs, complex exploits

Sherlock Protocol:

1. Auditors compete in audit contests
   → Top auditors earn reputation and rewards
   → Competitive pressure improves audit quality

2. Auditors stake on protocol safety
   → If protocol is exploited, staked capital covers losses
   → Auditors have "skin in the game"
   → Aligns incentives: auditor profits ONLY if protocol stays safe

3. Coverage buyers purchase policies
   → Premiums go to staked auditors
   → Coverage limit = total staked by auditors
   → Real-time coverage availability

Economic model:
  Auditor stake $10M on Protocol A
  Protocol A pays $200K/year premium
  Auditors earn: $200K / $10M = 2% APY on stake
  If Protocol A gets hacked for $2M:
    Auditors lose: $2M from stake ($8M remaining)
    Coverage buyer receives: $2M payout

contract ProtocolOwnedCover {
    // Protocol allocates treasury funds to cover user losses
    uint256 public insuranceFund;  // ETH
    uint256 public coveragePerUser;  // Max coverage per user

    function depositToInsurance() external payable {
        // Protocol treasury deposits
        // Usually from protocol fees
        insuranceFund += msg.value;
        emit InsuranceFundDeposited(msg.value);
    }

    function claimCoverage(address user, uint256 lossAmount) external {
        // Simplified: protocol admin verifies loss
        // More sophisticated: on-chain verification
        require(lossAmount <= coveragePerUser, "Exceeds max coverage");
        require(insuranceFund >= lossAmount, "Insufficient fund");

        insuranceFund -= lossAmount;
        payable(user).transfer(lossAmount);

        emit CoverageClaimed(user, lossAmount);
    }
}

Correlated risk scenarios:

1. Broad market crash (e.g., May 2021, Nov 2022):
   ┌────────────────────────────────────────────────────┐
   │  Effect on all DeFi protocols:                      │
   │  - TVL drops 50%+ (protocol becoming illiquid)      │
   │  - Liquidations cascade                             │
   │  - Oracle price feeds stressed                      │
   │  - Governance token crash (protocol can't respond)  │
   │  → Multiple protocol failures CORRELATED             │
   └────────────────────────────────────────────────────┘

2. Common dependency failure:
   ┌────────────────────────────────────────────────────┐
   │  If Compound's comptroller is exploited:            │
   │  → Every protocol FORKING Compound is affected      │
   │  → 50+ protocols share the same codebase           │
   │  → All fail simultaneously                          │
   └────────────────────────────────────────────────────┘

3. Infrastructure failure:
   ┌────────────────────────────────────────────────────┐
   │  If Ethereum L1 halts (not likely but possible):    │
   │  → EVERY protocol on Ethereum halts                 │
   │  → All insurance policies triggered                 │
   │  → Pool wiped out                                   │
   └────────────────────────────────────────────────────┘

class ReinsuranceLayer:
    """Catastrophic loss reinsurance for DeFi insurance pools."""

    def __init__(self):
        self.layers = [
            {"tier": 1, "cover_from": 0, "cover_to": 0.20, "premium": 0},  # Primary
            {"tier": 2, "cover_from": 0.20, "cover_to": 0.50, "premium": 0.30},  # Reinsurance
            {"tier": 3, "cover_from": 0.50, "cover_to": 0.80, "premium": 0.20},  # 2nd layer
            {"tier": 4, "cover_from": 0.80, "cover_to": 1.00, "premium": 0.10},  # 3rd layer
        ]

    def calculate_coverage(self, loss_percentage: float):
        """Calculate which layer covers what portion of loss."""
        coverage = []
        remaining_loss = loss_percentage

        for layer in self.layers:
            if remaining_loss <= 0:
                break

            layer_capacity = layer["cover_to"] - layer["cover_from"]
            if remaining_loss >= layer_capacity:
                coverage.append({
                    "tier": layer["tier"],
                    "covered": layer_capacity,
                    "percentage": layer_capacity,
                })
                remaining_loss -= layer_capacity
            else:
                coverage.append({
                    "tier": layer["tier"],
                    "covered": remaining_loss,
                    "percentage": remaining_loss,
                })
                remaining_loss = 0

        return coverage

class SlashingInsurancePool:
    """Insurance against validator slashing."""

    def __init__(self):
        self.premium_rates = {
            "solo_staker": 0.01,        # 1% — lowest risk
            "liquid_staking_pool": 0.02, # 2% — medium risk
            "cex_validator": 0.03,       # 3% — higher risk
            "high_density": 0.08,        # 8% — highest risk (all validators same infra)
        }

        self.historical_slashing_rate = 0.001  # 0.1% of validators slashed/year

    def calculate_premium(self, validator_type, coverage_amount, period_days):
        """Calculate slashing insurance premium."""
        base_rate = self.premium_rates[validator_type]

        # Time factor
        time_factor = period_days / 365

        # Historical adjustment (if available)
        historical_factor = self.historical_slashing_rate / 0.001

        # Coverage limit adjustment
        coverage_factor = min(1, coverage_amount / 32)  # Max 32 ETH

        premium = coverage_amount * base_rate * time_factor * historical_factor * coverage_factor

        return {
            "premium_eth": premium,
            "coverage_eth": coverage_amount,
            "rate": base_rate,
            "valid_for_days": period_days,
        }

    def trigger_slashing_payout(self, validator_index, slashed_amount):
        """Automatic payout on slashing event."""
        # Verified via beacon chain event
        # Payout = min(slashed_amount, coverage_amount)
        return slashed_amount