# Several legs at once (/invest/incidents/several-legs)

A vault usually spreads its money over several **legs** (investment positions, each in one protocol), up to 8, the most the program allows. This page shows what happens when problems touch more than one leg, or when one broken leg sits next to healthy ones.

The examples are illustrative vaults in which each share is worth 1 USDC at the start. They were checked in automated tests that load copies of several real protocols together, so the legs run against each real protocol at the same time.

## Example 1: two losses at once [#example-1-two-losses-at-once]

Suppose a vault has 1,000 USDC of Junior and 4,000 USDC of Senior, with 2,000 in each of two legs and the remaining 5,000 − 4,000 = 1,000 as idle cash. Both legs lose 30% at the same moment, which is 2,000 × 0.30 = 600 each.

- The vault adds the two losses together: one loss of 600 + 600 = 1,200.
- Junior takes the first 1,000 and falls to 0. Senior takes the other 1,200 − 1,000 = 200, which is recorded as Senior's impairment (a loss tracked so it can be repaid if value comes back).
- The vault enters Recovery, the state in which new deposits and investments stop, and is frozen: because Senior is impaired, no withdrawal can be funded.

The tests run this on five pairs of real adapters (an adapter is the small program that connects the vault to one protocol): Kamino with Jupiter Lend, Huma with Hastra, Solstice with Maple, OnRe with the syrupUSDC token leg, and the USDG token leg with Kamino.

The takeaway: Junior protects Senior against the total of all losses, not against each leg separately. Two moderate losses can add up to more than Junior.

## Example 2: one broken leg blocks the healthy one [#example-2-one-broken-leg-blocks-the-healthy-one]

Suppose a vault has 1,000 USDC of Junior and two legs of 1,500 each. The protocol account of the first leg disappears, so its adapter fails on every call.

1. A leg is stale when it has not been valued within the vault's limit, at most 150 Solana slots or about one minute. Once the broken leg is stale, even an exit from the **healthy** leg fails with `StaleValuation`. The executor cannot raise cash anywhere.
2. The guardian suspends the broken leg. Nothing is booked: Junior stays at 1,000, and the broken leg keeps its last value of 1,500.
3. The executor, the service that moves cash into and out of legs, takes 500 out of the healthy leg. The vault is Active.

The takeaway: every leg depends on every other leg being fresh, because they are all part of one share price. A suspension is how the guardian cuts a broken leg out of that check.

## Example 3: one failure spreads to another protocol [#example-3-one-failure-spreads-to-another-protocol]

Protocols often depend on each other. Huma keeps its idle cash in Jupiter Lend, through the same Jupiter Earn program the Jupiter leg uses.

- When Jupiter's program goes down, the **Jupiter leg** goes silent.
- The **Huma leg** is still valued, because its adapter reads Huma's own accounts. It still takes deposits, because Huma moves money into Jupiter in its own separate transactions, not inside the vault's transaction. The failure stops at Jupiter.
- The guardian suspends the silent Jupiter leg, and the Huma leg keeps the vault going.

Now suppose PYUSD, the stablecoin Hastra exits through, loses its peg. The Hastra leg raises `PRICE_UNCERTAIN` and refreshing fails with `AdapterFlagged`, so it is suspended. A USDG token leg in the same vault is untouched, because it does not depend on PYUSD.

The takeaway: a failure travels only as far as each adapter actually reads it. An adapter that reads another protocol's accounts can be affected by that protocol; one that does not, cannot.

## Example 4: one leg hacked in a vault with every adapter [#example-4-one-leg-hacked-in-a-vault-with-every-adapter]

Suppose a vault has 2,000 USDC of Junior and 8,000 USDC of Senior, with 1,000 in each of 8 legs, one on every adapter: Kamino, Jupiter Lend, Huma, Hastra, Solstice, Maple, OnRe and the USDG token leg. That is 8 × 1,000 = 8,000 invested and 10,000 − 8,000 = 2,000 idle. Alice is one of the Senior holders.

1. The Solstice leg is robbed of everything, and the guardian marks it at 0 (caps its value at 0). Junior absorbs the 1,000 loss and falls from 2,000 to 1,000; Senior stays at 8,000. The vault is in Recovery but not frozen, because Senior lost nothing.
2. The other seven legs keep working. The executor takes 500 out of the Kamino leg, and Alice withdraws 1,000 Senior shares for 1,000 USDC.
3. The admin starts Settlement, the final wind-down of the vault. Every leg is unwound to cash: Huma's leg leaves through Huma's queue, because Huma refuses instant exits at its current liquidity, and the others leave directly.
4. The marked Solstice leg still sells its eUSX on the market, whose pool has not yet noticed the theft and still pays the old rate. The vault gets back about 1,000 USDC. That cash counts as recovery, and since Senior was never impaired, it repays Junior's loss.
5. Anyone calls `distribute_settlement_cash`, and the cash is split, Senior first.

All eight legs are unwound to cash.

## Advanced details [#advanced-details]

- The freshness check covers every leg except suspended and impaired ones. One stale leg therefore blocks deposits, fundings, allocations and deallocations on every leg.
- Selling a written-off leg's tokens into a market that has not noticed the theft (step 4 of Example 4) is allowed by design. The vault takes back what the market will pay, and the loss moves to that market's liquidity providers. It may be the only recovery there is.