> For the complete documentation index, see [llms.txt](https://docs.trilobyte.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.trilobyte.finance/protocol-mechanics/default-and-risk-management.md).

# Default & Risk Management

Trilobyte has multiple layers of protection to manage risk and protect investors when borrowers fail to repay — anchored by the tranche structure itself.

## Risk Layers

```
Layer 1: Junior first-loss cushion → Absorbs losses before senior does
Layer 2: Late Fees                 → Financial penalty for overdue payments
Layer 3: Grace Period              → Time buffer before default
Layer 4: Manager Collateral        → Skin in the game — slashed on default
Layer 5: Borrower Collateral       → Optional pledge, seized on default
Layer 6: NAV Write-Down            → Early warning signal before formal default
Layer 7: Delinquency Tracking      → Blocks risky managers from new vaults
Layer 8: Renegotiation             → Restructure terms to avoid default
Layer 9: Credit & Exposure Limits  → Cap manager and borrower exposure
```

## Late Fees

When a payment is overdue (`now > next_due`), the Pool Manager can apply a **late fee**, governed by the Globals `late_fee_bps` setting (default 18% p.a.). The fee is split pro rata across the senior and junior arrears buckets. See [Fees](/protocol-mechanics/fees.md).

## Grace Period

Every vault has a configurable **grace period** (in seconds; default 30 days). This is the window between a missed payment's contractual due date and when default can be triggered.

* The contractual due date is `schedule_start + (payments_made + 1) × period_seconds` — an anchor independent of `apply_late_fee`, reset only by a successful renegotiation
* During the grace period, the borrower can still make payments to prevent default
* The manager can apply late fees and attempt to resolve the situation
* After the grace period expires, **anyone** can call `check_default()` to trigger default

## NAV Write-Down — an early warning, before default

Before a loan is formally in default, its senior and junior tranche **NAV** (net asset value) can already reflect distress. `get_senior_nav()` and `get_junior_nav()` apply a **linear write-down** to outstanding principal, applied junior-first:

$$
\text{writedown\_pct} = \text{clamp}\left(\frac{\text{days late} - \text{writedown\_grace\_days}}{\text{writedown\_max\_days}}, 0, 1\right)
$$

`writedown_grace_days` (default 45) and `writedown_max_days` (default 120) are Globals settings, snapshotted per vault at creation. The write-down is **view only** — no tokens move — and **reverses automatically** if the borrower catches up on arrears. An overdue reporting covenant (see [Covenants, Exposure and Compliance](/protocol-mechanics/covenants-exposure-and-compliance.md)) also counts as one missed period toward this calculation.

## Default Trigger

Default is triggered by calling `check_default()` when:

1. The vault is in the **Active** phase
2. The current time exceeds the contractual due date plus `grace_period`

Default is **permissionless** — anyone can trigger it. This prevents managers from colluding with borrowers to avoid consequences.

## Consequences of Default

When default is triggered:

| Action                      | Detail                                                                                   |
| --------------------------- | ---------------------------------------------------------------------------------------- |
| **Phase transition**        | Vault moves to `Defaulted`                                                               |
| **Collateral slashed**      | Manager's locked collateral for this vault is transferred into the vault's recovery pool |
| **Pledge seized**           | Any borrower collateral pledge is seized to the recovery party                           |
| **Delinquency flag**        | Manager is marked delinquent in Globals                                                  |
| **Outstanding decremented** | Manager's and borrower's outstanding principal are reduced in Globals                    |
| **Events emitted**          | `VaultDefaulted`, `ManagerMarkedDelinquent`                                              |

## Recovery — senior first, always

```mermaid
sequenceDiagram
  autonumber
  participant X as Anyone
  participant V as Vault
  participant GL as Globals
  participant E as Collateral escrow
  participant I as Investor
  X->>V: check_default()
  V->>GL: slash_collateral(manager, collateral_amount, vault)
  opt borrower pledge exists
    V->>E: seize(pledge_id, recovery_party)
  end
  V->>GL: mark_delinquent(manager), decrement_outstanding
  Note over V: phase -> Defaulted
  X->>V: distribute_recovery()  [once]
  Note over V: allocates vault balance:<br/>1 senior principal, 2 senior interest,<br/>3 junior principal, 4 junior interest,<br/>5 residual -> manager, then borrower
  I->>V: claim_recovery(investor, tranche)
  V->>I: pro-rata share of that tranche's recovery pool
```

Once `distribute_recovery()` has run (permissionless, once per vault), each tranche's investors pull their own share via `claim_recovery`. **Junior cannot recover anything until senior's principal and interest are fully covered.** See [Defaulted](/protocol-mechanics/vault-lifecycle/defaulted.md) for the full mechanics.

## Manager Collateral

Pool Managers must deposit collateral before creating vaults. This is their "skin in the game" — and the anchor of the vault's junior tranche:

* **Deposit**: `deposit_collateral(manager, token, amount)` — stake tokens in Globals, in a collateral-whitelisted asset
* **Lock**: When a vault is created via the Factory, collateral is locked proportional to the principal, and counted toward the junior target
* **Release**: On `FullyRepaid`, the locked collateral is released
* **Slash**: On `Defaulted`, the locked collateral is slashed into the vault's recovery pool, behind any borrower pledge but ahead of the manager's own residual claim

## Delinquency Tracking

Managers with defaulted vaults are flagged as **delinquent**:

* The Factory checks `is_delinquent(manager)` before allowing vault creation
* Delinquent managers are **blocked** from creating new vaults
* Only an **Operations Admin** can clear delinquency via `clear_delinquency(caller, manager)` after review
* A `delinquency_count` tracks the total number of defaults per manager

## Credit Limits and Exposure Caps

Each Pool Manager has a **credit limit** (`max_credit`), and the protocol as a whole tracks **borrower and manager exposure** against total outstanding principal — see [Covenants, Exposure and Compliance](/protocol-mechanics/covenants-exposure-and-compliance.md) for the full set of caps enforced at vault creation.

## Renegotiation as a pre-default workout

Renegotiation is a **pre-default** tool — a way to restructure a struggling loan *before* it tips into default:

* While a loan is **Active**, the manager can `propose_renegotiation` with a new rate and term, bounded by both the global rate floor/ceiling and a maximum single-round rate cut.
* Approving now requires **both** the manager and the borrower to authorize the call.
* If approved, the shared installment is recalculated on the **current total outstanding** and the vault stays Active.
* Once a loan has **defaulted**, it is terminal — the manager's collateral has already been slashed, so a defaulted loan cannot be renegotiated.

{% hint style="info" %}
Trilobyte's risk model is inspired by traditional structured finance, where a first-loss junior tranche, manager and borrower collateral, credit/exposure limits, and pre-default workouts (renegotiation) work together to protect senior investors.
{% endhint %}

*As of September 2026.*