The Freeze Function: Inside the 24-Hour Window That Became the Bear Market's Real Money Story

The Modifier at 2:40 a.m.

I found it again at 2:40 in the morning, the way you find a familiar scar — half-remembered, then suddenly vivid.

I was hunched over a decompiled view of FiatTokenV2_2, the implementation contract that sits behind every USDC balance you have ever held, tracing what actually happens when you tap "send." Not the wallet UI. Not the spinner. The state machine. And three lines deep in the inheritance chain, the machine says this:

modifier notBlacklisted(address _account) {
    require(!isBlacklisted[_account], "Blacklistable: account is blacklisted");
    _;
}

That is it. That is the whole gate. Every transfer on the most institutionally beloved dollar token in crypto passes through a boolean lookup against a mapping that a single address on the other side of the world can flip. There is no timelock on the flip. There is no dispute window. There is no vote. The block confirms in twelve seconds, and a balance that existed a moment ago is now a number that can be read but never moved again.

The wallet still shows the money. The explorer still shows the money. The chain still stores the money. It is simply, permanently, unreachable by its owner.

I have written about this mechanic before, in a series I built with three former audit-firm partners back in 2024 called "Trust, but Verify." We broke down MPC custody and multi-sig quorums for institutional readers, and the freeze function was always the slide that made the room go quiet. Not because it was surprising. Because it was boring. It was a require statement. It did not look like a risk. It looked like a seatbelt.

Two years later, in the middle of a drawdown that has stripped leverage out of every corner of this market, that require statement has become the most important line of code in the industry. The bear market did not reprice stablecoins because of what they can do. It repriced them because of what they are permitted not to do.

Here is the signal I keep finding in the static of this new wave: the thing everyone is arguing about — whether a stablecoin is "decentralized" — is not the thing that determines whether your capital survives. The thing that determines whether your capital survives is a two-part question. Who holds the blacklister key, and who holds the upgrade key. Everything else is branding.

Three Cycles of a Dollar That Isn't a Dollar

To understand why a single modifier matters so much right now, you have to go back through the narrative cycles that produced it. Stablecoins have been through three distinct eras, and each era left a scar that shaped the contract you are reading today.

Era One: The Ambiguity Premium

The first era was offshore, opaque, and enormously profitable for the people running it. Tether established the template in 2014 and 2015: a token that promised one dollar, backed by reserves that were described in vague and evolving language, issued from a jurisdiction chosen for its flexibility. For years, the market treated the ambiguity as a feature rather than a bug, because the token's utility — being the only deep dollar liquidity on exchanges that could not get a US bank account — outweighed any concern about what was behind it.

That era ended, at least in narrative terms, with the New York Attorney General's investigation and the 2021 settlement, which forced a public breakdown of reserves and a quarterly attestation regime. What the market learned from that episode was not "stablecoins are dangerous." What the market learned was that an attestation is not an audit, and that the difference between the two is where most people's assumptions quietly break. An attestation says: as of a date, an accountant looked at a signed statement and agrees it is consistent. An audit says: we tested the underlying assets, we verified existence and ownership, and we can defend that conclusion against challenge. Those are not the same sentence, and the gap between them is exactly where the second era's competitive positioning was built.

Era Two: Compliance as a Product

Circle and Coinbase launched USDC in 2018 under a joint entity called Centre, and the entire pitch was the inverse of Tether's. Regulated. Audited. Transparent. Monthly attestations from a major accounting firm. Reserves in US-dollar-denominated instruments held at US-regulated custodians. A published reserve policy. It was, in effect, a product built on the premise that institutional money would pay a premium for reduced ambiguity.

And it worked, spectacularly, in the specific environment of 2020 to 2021. As DeFi Summer unfolded, USDC became the collateral asset of choice — not the biggest, but the most composable in the places that mattered to institutions and to sophisticated funds. When you are depositing into a lending market, borrowing against it, and looping the position three times, you care less about the token's philosophical purity and more about whether the oracle will price it cleanly and whether the protocol's risk team will accept it as collateral.

That period also built the second layer of dependency, the one that is now being stress-tested. USDC did not become systemically important because people held it. It became systemically important because people owed it. Once a token is a debt unit in a lending market, freezing an address stops being a story about one person's wallet and becomes a story about a pool's solvency.

Era Three: The Bank Run That Rewrote the Risk Model

Then came March 2023, and the disclosure that roughly $3.3 billion of the reserves backing USDC were sitting at Silicon Valley Bank at the exact moment SVB failed.

I remember the weekend with a physical clarity. USDC traded down to somewhere around 87 cents on secondary markets. Curve pools went wildly imbalanced. Aave's USDC market filled with people trying to exit a token whose peg was a rumor and whose backing was a question mark heading into a Monday that nobody could predict. Every DeFi dashboard I had open showed the same thing: the "safe" asset was the most dangerous asset on the screen.

The resolution — the federal backstop of uninsured depositors, and Circle's ability to resume normal operations — is usually told as a story about government intervention. It is not. It is a story about correlated risk between the token and the banking system it depends on. The compliance posture that made USDC attractive to institutions had welded it to the exact institutions that fail in a credit event.

I have thought about that weekend constantly during this drawdown. Because the lesson people took from it was wrong. The lesson people took was "Circle is solid, the peg recovered, buy the dip." The lesson that actually matters is that a compliance-first stablecoin is not a lower-risk instrument than an opaque one. It is a differently correlated instrument. Its risk is not counterparty opacity. Its risk is that its entire reserves structure, its redemption rails, and its settlement windows all terminate in the same handful of regulated entities that share a balance sheet logic with each other.

Era Four: The One We Are Living In

Now we have the fourth era, and the bear market is its defining condition.

Between those earlier cycles and now, several things happened in quick succession. Bitcoin spot ETFs launched in January 2024 and wrapped the asset in an institutional liquidity channel with two-way plumbing. In mid-2025, comprehensive US stablecoin legislation moved through Congress and was signed into law, giving dollar tokens something close to a federal framework. Circle went public on the NYSE in June 2025 at $31 a share, closed its first session up roughly 168%, and briefly traded at a valuation that implied the stablecoin business was a category, not a company. Then the equity gave back a large portion of that premium, and the market began the slow, unglamorous work of figuring out which parts of the story were real.

That is where we are. Not a collapse. A repricing. And repricings are better than collapses for exactly one reason: they let you examine the machinery while it is still running.

What a Freeze Actually Is

Let me get precise, because precision is the only thing that survives a narrative cycle.

USDC on Ethereum is a proxy contract. FiatTokenProxy stores the state; FiatTokenV2_2 holds the logic; an admin address controls which logic the proxy points at. The implementation inherits from a contract called Blacklistable, which maintains a mapping of addresses flagged as blocked. The transfer path applies notBlacklisted(from) and notBlacklisted(to) alongside whenNotPaused. Minting applies the same check on the recipient. Burning applies it on the source. Allowances do not bypass it.

The practical consequence is total. A blocked address cannot send, cannot receive, cannot mint, cannot burn, and cannot be used as a counterparty by anyone else. It is not that transfers out are blocked and transfers in are allowed. It is that the address is removed from the graph.

Now the part that requires actual technical care, because this is where most commentary goes soft.

The "24 hours" is not a protocol parameter. It is an operational reality that has been informally reported, and the code does not enforce it. A blacklist call is a single transaction. If the blacklister key is live and someone signs, the block lands in twelve seconds. The reason the industry talks about a day is that institutions need time to route a request through whatever compliance process authorizes the signature — internal review, legal sign-off, sometimes law-enforcement correspondence. That process is real. It is also entirely discretionary.

I have watched the role graph closely since I started doing custody work with audit people, and the structure in FiatTokenV2_2 is worth laying out plainly because it is more distributed than the "Circle controls everything" narrative suggests, and less distributed than the "it's just a smart contract" narrative implies.

There is an owner. There is a pauser, who can stop all transfers globally. There is a blacklister, who can flag individual addresses. And there is a masterMinter, who authorizes and configures individual minter addresses and sets their minting allowances. Each of these roles can be reassigned by the current holder of the corresponding role, via updatePauser, updateBlacklister, updateMasterMinter, and an ownership transfer function that requires action from both sides.

The separation exists for operational hygiene: the key that mints a billion dollars should not be the key that sits in a compliance queue. But separation of roles is not separation of control. All four of these addresses ultimately derive from the same issuer, and the identity of the holders is not something a third party can verify on-chain in any ongoing way. You can see the addresses. You cannot see the humans, the quorum, the hardware, or the policy.

The Key Behind the Key

Here is the part that I think most people still have not internalized, and it is the actual thesis of this piece.

Freezing is not the deepest power in the USDC contract. Upgradeability is.

The proxy can be pointed at a new implementation by whoever holds the admin role. That person does not need the blacklister. They do not need the pauser. They do not need to argue about whether a specific address should be blocked. They can ship new logic — new transfer rules, new balance accounting, new freeze semantics — and the state follows.

I want to be careful and fair here, because this is a structural property of virtually every major upgradeable token, not an accusation against one issuer. A frozen balance is a polite outcome. It preserves the ledger, it preserves everyone else's claims, and it is reversible with a second transaction. It is, in a strange way, the conservative exercise of authority. The upgrade path is the unbounded one, and it is the one that never appears in a risk disclosure because it does not look like a risk. It looks like maintenance.

In my work on custody architectures, we used to run an exercise with institutional clients: draw the trust graph, then draw it again assuming every role holder is a single point of failure, then draw it a third time assuming every role holder is honest. The middle diagram is the one that matters. A system's real decentralization is measured at the second diagram, not the first.

What a Freeze Does Downstream

A frozen wallet is a small event. A frozen wallet inside a leveraged position is not.

Consider the standard shape of on-chain credit in this market. A user deposits USDC into a lending market. They borrow an asset against it. They swap that asset for more USDC. They deposit again. The health of that position is a ratio computed from oracle prices, and the whole structure assumes that the collateral can be liquidated if the ratio breaks.

Now freeze the user's address. The USDC is still in the pool, still counted in the pool's total supply, still earning interest if that is how the market is configured. But the account can no longer repay, withdraw, or top up. If the borrowed asset appreciates, the position crosses its liquidation threshold, and the liquidator steps in.

Except the liquidator's job is to seize collateral and repay debt. If the collateral transfer executes against a blocked address, the transfer reverts. Not silently — it reverts, and the liquidation transaction fails.

The protocol does not gracefully absorb this. Depending on the implementation, you get a stuck position, a bad-debt entry, or a cascading failure in a market that was already thin. I have seen this pattern in post-mortems from smaller incidents, and the mechanism is always the same: the freeze does not stay contained to the frozen party, because on-chain debt is a graph, not a list.

And this is happening in a liquidity environment where the margin for error has already been priced away. In a bull market, a stuck position gets socialized across a protocol's reserves, everyone grumbles, and the token price recovers. In a bear market, the reserves are already drawn down, the insurance funds are thinner than the governance forum claims, and a single bad-debt event changes the risk parameters for everyone who uses that market.

This is why I keep coming back to the debt framing. The question that matters in a drawdown is not how many people hold a stablecoin. It is how many people owe it.

The Composability Tax Nobody Prices

There is a second-order cost that almost never makes it into risk frameworks, and I want to name it clearly because I think it is the most underpriced thing in this entire sector.

When an asset is conditionally transferable — meaning transferability depends on a state variable controlled by a third party — every protocol that touches that asset inherits the condition. Oracles price it. Lending markets accept it as collateral. AMMs hold it in pools. Yield aggregators route through it. Vaults build strategies on top of it. Bridges lock or burn it.

Each of those integrations implicitly assumes the asset behaves like a bearer instrument. A bearer instrument has one property that everything else depends on: whoever holds it can move it. Remove that property, and every downstream assumption becomes a conditional assumption that nobody wrote down.

I have audited integration checklists. They ask about decimals, proxy patterns, reentrancy, oracle sources, upgrade delays. I have never seen one that asks: what is the blast radius if the issuer flags the top LP in this pool at 3 a.m. on a Sunday? The answer, in most cases, is that the team has never modeled it, the market has never priced it, and the incident response plan is a Telegram group.

That is the real composability tax: not fees, not slippage, but a contingent liability that sits in every integration and appears on no balance sheet.

The Reserve Plumbing and the Custody Layer

You cannot understand the freeze function without understanding what backs the token, because the freeze is the operational arm of a reserve structure that terminates in regulated finance.

Circle's reserves have been structured, since 2022, primarily through a government money-market fund managed by BlackRock and administered by a custodian bank, with cash held at systemically important US banks and short-dated Treasuries making up the balance. The design goal was to compress duration risk and credit risk to near zero, and by conventional standards it succeeded. The fund does not take credit risk in the way a prime fund would. It holds the stuff that everyone holds when they stop believing in everything else.

But look at the dependency graph that produces.

Up to 2023, the reserve chain terminated in a handful of regional and money-center banks. Now it terminates in BlackRock, a custodian bank, and the US Treasury market. That is a genuinely more resilient structure. It is also an even more correlated one, in the specific sense that all four legs of that chain are exposed to the same monetary and fiscal conditions. The token's backing is now maximally aligned with the health of the US sovereign balance sheet. That is a feature in most states of the world and a concentrated risk in exactly one: the state where the sovereign balance sheet itself is the source of stress.

This is not a prediction. It is a structural observation, and it is the kind of thing that a bear market forces you to actually sit with rather than nod past.

The second piece of plumbing that has changed materially is the audit-versus-attestation gap I mentioned earlier. The industry has moved toward more frequent and more granular disclosure since 2022, and the largest issuers now publish reserve breakdowns regularly. But the fundamental architecture has not changed: the verification is still periodic, backward-looking, and performed by an entity selected by the issuer. In a market where the token is used as the settlement leg of real payment flows, that is a different standard than in a market where it is used as a trading chip. If you are moving payroll, you are not relying on a monthly accounting statement. You are relying on redemption working on a weekday afternoon.

Which brings me to the thing I actually watch.

Redemption Is the Real Peg

Everybody talks about the peg. Almost nobody talks about the queue.

The peg is a secondary-market price. It is what traders will pay each other for the token on an exchange or in an AMM. It can be wrong in both directions. During the SVB weekend, it was wrong on the downside by thirteen cents, and it snapped back in days.

Redemption is different. Redemption is the path by which a token becomes a bank deposit. It runs through the issuer, through a banking partner, through settlement hours, and through compliance review. It is the mechanism that disciplines the peg, and it is the mechanism that has never been fully stress-tested at the scale the market now assumes.

In my experience covering these structures, the risk that gets ignored is never the dramatic one. It is the boring operational one. Exchanges close. Cutoffs pass. Compliance review takes a day. The banking partner in one corridor is not the banking partner in another. A stablecoin does not break because someone freezes an address. It breaks because the redemption queue does not clear on a day when everyone wants it to clear at once.

Native, Bridged, and the Fragmentation Tax

There is a version of the freeze question that people in this market have quietly solved by pretending it does not exist, and it is the bridged-token problem.

When USDC moves across chains, there are two ways it can do so. It can be issued natively — the issuer mints on the destination chain and burns on the source — or it can be wrapped. A wrapper means a bridge holds native USDC in a contract on one chain and issues a claim on another. The claim is usually branded with the same name and the same three letters. It is not the same asset.

For years, a huge share of circulating "USDC" on non-Ethereum chains was wrapped liquidity, and the market treated the two as interchangeable because the price was the same to four decimal places. Protocols gradually started distinguishing them — some lending markets ran separate markets for bridged and native versions, some deprecated the bridged variant outright as native liquidity matured.

That migration is the correct direction, and it exposes something uncomfortable about how the market computes risk. A wrapped version of a freezable asset is not less freezable. It is freezable in more places. The issuer's blacklister does not need to reach the wrapped token on the destination chain — it can reach the reserve that backs it on the source chain, and the wrapper becomes a claim on something that no longer moves. The wrapper's own contract is irrelevant at that point. The backing is gone, and the wrapper becomes a promise.

I have watched teams model bridge risk as smart-contract risk for years. The interesting failure mode is not the contract. It is the reserve composition, and specifically the question of what fraction of the reserve is native, unblocked, and held by an entity with no relationship to the frozen party.

The Subsidy Cliff and the Bear Market's Real Test

I want to change register for a moment, because the freeze function is only half of the story I have been watching, and the other half is the reason this drawdown feels structurally different from 2022.

When I look across the lending and DEX landscape right now, the thing that jumps out is not the price. It is the composition of the liquidity.

For most of the last five years, a large share of on-chain liquidity was not organic. It was purchased. Emissions programs distributed a governance token to whoever deposited assets into a pool, and the yield that depositors actually kept was, in most cases, dominated by that emission rather than by the fees the pool generated. The headline APY number was a subsidy expressed as an interest rate.

The tell was always in the ratio. In a healthy market, fee revenue is a meaningful fraction of total incentives. In the markets that grew fastest, it was often a single-digit percentage. The rest was dilution paid by existing holders to rent capital that had no other reason to be there.

I have a habit of tabulating this whenever incentives change, because the response is so consistent it is almost boring. When a major emissions program is cut, TVL does not drift down. It falls off a ledge. The capital that leaves is not the capital that was paying attention to the protocol's roadmap. It is the capital that was reading a number on a dashboard and moving to wherever the next number is larger.

In a bear market, that dynamic inverts in a way that flatters nobody. Emissions cut, TVL drops, fee revenue drops because there is less to trade, and the governance token that funded the whole arrangement falls further, which reduces the real value of whatever emissions remain. Every leg of the structure is pro-cyclical, and there is no stabilizer anywhere in the loop.

This is the real survival question in this drawdown, and it is not about stablecoins at all. It is about which protocols have users who would still be there if the token paid zero.

I have started asking teams a version of this directly, and the answers are revealing. The teams that survive the question are the ones who can name, precisely, the fee revenue attributable to non-incentivized activity. Most cannot, because most have never separated the two. Their analytics dashboards show total TVL, total volume, total fees, and nowhere does the structure distinguish between a depositor who came for the yield and a depositor who came for the product.

The freeze function matters in this context because it is the same category of question. Both are about hidden conditionalities — properties that everyone assumes away until the condition is triggered. In the subsidy case, the condition is the emission schedule. In the freeze case, the condition is a signature.

The Wall Street Wrapper and the Two-Way Pipe

There is one more layer, and it is the one that has changed the macro behavior of this entire market.

Spot Bitcoin ETFs launched in January 2024 and did something that no prior crypto product had done: they put a redemption mechanism directly into the hands of institutional allocators. Before, a fund that wanted exposure had to buy coins and custody them, or buy a trust with locked creation. After, it could create and redeem shares daily, and the underlying coins sit with a custodian in a structure that is, from the market's perspective, indistinguishable from any other ETF.

I have spent a lot of time thinking about what that actually means, and I keep landing on the same conclusion, which is uncomfortable for people who still describe Bitcoin as peer-to-peer electronic cash.

The ETF turned Bitcoin into a liquidity instrument with a two-way institutional pipe, and that pipe has its own velocity that has nothing to do with the network's monetary properties.

In an upcycle, the pipe fills and the coin's price reflects demand that is structurally new. In a downcycle, the pipe drains, and the draining is mechanical. Redemptions happen because an allocator is rebalancing, or a model portfolio is shifting, or a risk committee is cutting an asset class's weight. None of those decisions are made by someone reading a whitepaper. They are made in a meeting about portfolio construction, and the result is that supply hits the market at the exact moment sentiment is worst.

This is why the drawdown we are in behaves differently from the ones before it. Previous bear markets were largely internal — the leverage was on-chain, the liquidation cascades were on-chain, and the forced sellers were on-chain. This one has a Wall Street leg, and that leg responds to a different clock.

The signal I keep finding in the static here is that the two pipes now interact. On-chain leverage depends on stablecoin liquidity and lending rates. Institutional flows depend on macro conditions and portfolio construction. When they align, the move is violent in both directions. When they diverge, the market chops sideways and everyone argues about whether the four-year cycle is broken. The four-year cycle is not broken. It has been partially replaced by a flows cycle, and the two do not have the same period.

The Contrarian Cut: The Freeze Is Not the Risk

Now let me make the argument that actually needs making, because everything above is the setup and this is the punchline.

Everyone in this industry argues about the freeze function as if it were the central flaw of compliant stablecoins. Commentators point at the blacklist modifier and say: see, it is not decentralized. Institutions point at the same modifier and say: good, we need it. Both sides are having the wrong conversation.

Here is my contrarian position, and I have held it since the custody work I did in 2024, though the bear market has sharpened it considerably. The freeze function is not the risk. The freeze function is the visible symptom of the actual risk, which is that the entire dollar-token stack terminates in a banking corridor that a small number of institutions control, and that corridor is not governed by any of the contracts the industry spends its time arguing about.

Think about what actually has to happen for a dollar token to be worth a dollar. A user must be able to convert it into a bank deposit, on a day they choose, at a bank that will accept it, at a rate that clears. Everything upstream of that moment — the modifier, the blacklist, the pauser, the upgrade key, the minters, the reserve fund — exists to make that moment possible and to make it safe for the institutions that facilitate it.

The freeze function is the price of the banking relationship. It is not the enemy of the banking relationship. It is the banking relationship, expressed in Solidity.

Which means the interesting question is not "should Circle be able to freeze?" It can, and it will, and the alternative is not a freeze-free system — the alternative is a system with no US banking access, which in the current market structure means no institutional adoption.

The interesting question is: what is the concentration of the corridor, and what happens when it narrows?

We have already seen a version of this. In 2023, the banking crisis narrowed the corridor to the point where a token's peg depended on whether the FDIC would guarantee uninsured deposits at a specific bank over a specific weekend. That is the corridor risk. Not the blacklist.

We have seen another version of it in the regulatory fragmentation that followed. Different jurisdictions have taken different postures toward dollar tokens, some permitting them under strict reserve and issuance conditions, others restricting them, others restricting access to them without restricting the tokens themselves. Every jurisdiction that adds a rule narrows the set of banks willing to hold the reserves, narrows the set of entities willing to be the settlement counterparty, and raises the operational cost of redemption.

The freeze function scales with the corridor. The corridor scales with regulation. Regulation does not scale with demand. That is the structural problem, and it is invisible to anyone staring at a blacklist modifier.

The Second Blind Spot: The Wrapper's Wrapper

My second contrarian note is more technical and more specific.

The market has gotten better at distinguishing native from bridged liquidity. It has gotten much worse at distinguishing derived liquidity — the yield-bearing versions, the vault shares, the receipt tokens, the collateralized certificates that sit on top of dollar tokens and are used as collateral in places that never see the underlying.

When you route assets through enough layers of wrapping, the freeze property does not disappear. It gets attenuated — which is worse. A direct freeze is a clean event that everyone can see and price. A freeze that propagates through three layers of vaults and accounting entries produces a slow, ambiguous failure where nobody is sure which claim is impaired and every participant waits for everyone else to move first. That is a run. That is what a run looks like in a system with no deposit insurance and no lender of last resort.

I have watched teams build this architecture because it improves capital efficiency, and I do not think they are wrong to do it. I think they are wrong to not model the frozen-collateral scenario. In my experience, the modeling gap is not laziness. It is that the scenario requires admitting a dependency the whole structure is designed to abstract away.

What I Am Actually Watching Now

The takeaway is not that compliant stablecoins are unsafe, or that the blacklist is an outrage, or that the market is about to break. The takeaway is that this drawdown has made visible a set of dependencies that the previous cycle priced as zero, and dependencies priced at zero are where all of the eventual loss lives.

Four things I am tracking, and none of them is a price.

First, the role graph. Not the addresses — the governance around them. Which issuers publish the human and organizational structure of their key management, which publish a policy for when they will freeze, which publish a process for handling a freeze that affects a protocol's solvency rather than a criminal's wallet. Disclosure of the policy matters more than disclosure of the address, because the address is legible and the policy is not.

Second, the reserve composition through the corridor. Not the headline percentage of Treasuries. The counterparty concentration of the cash leg, and specifically whether the number of banking relationships is growing or shrinking. A token with a growing cash-leg counterparty set is diversifying. A token with a shrinking one is concentrating, and concentration is what turns an operational incident into a peg event.

Third, the redemption queue in the wrapper layer. The derived-token market has grown faster than the transparency around it, and I want to know how many of those instruments have a documented process for handling a blocked underlying. The number is going to be small, and the teams that have done the work are going to be the ones that survive a stress event with their credibility intact.

Fourth, and least fashionable: fee revenue net of emissions. I have been tabulating this for years and it has never been more instructive than it is right now, because in a market with no token price appreciation to hide behind, the number is just a number. It tells you which protocols have a business and which have a subsidy schedule with a dashboard.

I keep finding the signal in the static of this new wave, and it is not the one the headlines are chasing. The headline signal is that something in crypto is broken. The real signal is that the industry has spent a decade building a dollar system whose most important features — the ones that determine whether capital can leave — are implemented in a place that no blockchain explorer renders, no governance proposal reaches, and no token holder can vote on.

That is not a scandal. It is a design. And in a bear market, the only useful question you can ask about a design is: where does it break, and who is holding the bag when it does?

The answer, as always, is whoever assumed the condition away.