Revenue concentration risk

interface RevenueEvent {
  id: string;
  timestamp: number;
  sourceType: 'CUSTOMER' | 'ASSET' | 'CHANNEL' | 'PROTOCOL';
  sourceId: string;
  amount: bigint; // Use bigint for precision in digital assets
  currency: string;
  metadata: Record<string, unknown>;
}

class ConcentrationMetrics {
  calculateHHI(events: RevenueEvent[], windowMs: number): number {
    const now = Date.now();
    const windowEvents = events.filter(e => e.timestamp >= now - windowMs);
    
    const sourceTotals = new Map<string, bigint>();
    let totalRevenue = 0n;

    windowEvents.forEach(e => {
      const key = `${e.sourceType}:${e.sourceId}`;
      const current = sourceTotals.get(key) || 0n;
      sourceTotals.set(key, current + e.amount);
      totalRevenue += e.amount;
    });

    if (totalRevenue === 0n) return 0;

    let hhi = 0;
    sourceTotals.forEach(amount => {
      const share = Number(amount) / Number(totalRevenue);
      hhi += share * share;
    });

    return hhi;
  }

  calculateTopNConcentration(events: RevenueEvent[], windowMs: number, n: number): number {
    const now = Date.now();
    const windowEvents = events.filter(e => e.timestamp >= now - windowMs);
    
    const sourceTotals = new Map<string, bigint>();
    let totalRevenue = 0n;

    windowEvents.forEach(e => {
      const key = `${e.sourceType}:${e.sourceId}`;
      const current = sourceTotals.get(key) || 0n;
      sourceTotals.set(key, current + e.amount);
      totalRevenue += e.amount;
    });

    if (totalRevenue === 0n) return 0;

    con

st sorted = Array.from(sourceTotals.values()) .sort((a, b) => (a > b ? -1 : 1)) .slice(0, n);

const topNRevenue = sorted.reduce((sum, val) => sum + val, 0n);
return Number(topNRevenue) / Number(totalRevenue);

} }

#### Step 3: Policy Engine
Decouple risk rules from business logic. Use a configuration-driven approach to define thresholds and actions.

```typescript
interface RiskPolicy {
  id: string;
  metric: 'HHI' | 'TOP_N';
  windowMs: number;
  threshold: number;
  action: 'BLOCK' | 'RATE_LIMIT' | 'ROUTE_DIVERSIFY' | 'ALERT';
  params: Record<string, unknown>;
}

class PolicyEngine {
  evaluate(metrics: ConcentrationMetrics, policies: RiskPolicy[]): RiskAction[] {
    const actions: RiskAction[] = [];
    
    policies.forEach(policy => {
      let currentMetric: number;
      if (policy.metric === 'HHI') {
        currentMetric = metrics.calculateHHI(events, policy.windowMs);
      } else {
        currentMetric = metrics.calculateTopNConcentration(events, policy.windowMs, policy.params.n as number);
      }

      if (currentMetric >= policy.threshold) {
        actions.push({ type: policy.action, severity: 'HIGH', policyId: policy.id });
      }
    });

    return actions;
  }
}

Step 4: Enforcement Architecture

The enforcement layer must operate in the hot path with minimal latency. Implement a middleware pattern that intercepts revenue-generating requests.

class RevenueGuardMiddleware {
  private metrics: ConcentrationMetrics;
  private policyEngine: PolicyEngine;
  private redisClient: RedisClient; // For low-latency state access

  async handle(event: RevenueEvent): Promise<GuardResult> {
    // 1. Fetch recent events from low-latency store
    const recentEvents = await this.redisClient.getRecentEvents(event.sourceType, 1000);
    
    // 2. Update metrics with current event
    const updatedEvents = [...recentEvents, event];
    
    // 3. Evaluate policies
    const actions = this.policyEngine.evaluate(updatedEvents, this.policies);
    
    // 4. Enforce
    if (actions.some(a => a.type === 'BLOCK')) {
      return { status: 'REJECTED', reason: 'CONCENTRATION_LIMIT_EXCEEDED' };
    }

    if (actions.some(a => a.type === 'ROUTE_DIVERSIFY')) {
      // Logic to route to secondary channels or assets
      const routedEvent = this.applyDiversification(event, actions);
      return { status: 'ROUTED', event: routedEvent };
    }

    return { status: 'ALLOWED' };
  }
}

Architecture Decisions and Rationale

• In-Memory State: Concentration checks require access to recent transaction history. Relying on database queries introduces latency. Use Redis or an in-memory windowing buffer to store the last N events per source type. This ensures sub-millisecond evaluation.
• Event Sourcing: Store all revenue events in an append-only log. This allows replay for audit purposes and accurate metric calculation over arbitrary windows without data loss.
• Decoupled Policy Store: Store policies in a versioned configuration service. This enables risk teams to adjust thresholds without redeploying the application code.
• Fail-Safe Defaults: If the policy engine is unreachable, the system should default to a safe state. Depending on the risk appetite, this may mean blocking transactions or allowing them with a degraded alert. For revenue concentration, blocking is usually safer to prevent irreversible exposure.

Pitfall Guide

1. Correlation Blindness Diversification across multiple tokens or customers is ineffective if they are correlated. Revenue from ETH and BTC may appear diversified by asset, but price movements are highly correlated.

• Mitigation: Implement correlation matrices in the risk engine. Adjust effective concentration by weighting correlated sources. If correlation > 0.8, treat sources as a single cluster.

2. Static Thresholds in Volatile Markets Fixed HHI thresholds may trigger false positives during organic growth or fail during structural shifts.

• Mitigation: Use dynamic thresholds based on volatility and historical baselines. Implement adaptive policies that tighten during high-volatility periods.

3. Race Conditions in Mitigation Concurrent transactions can bypass concentration limits if checks are not atomic.

• Mitigation: Use distributed locks or optimistic concurrency control when evaluating limits. Ensure the check-and-enforce operation is atomic within the transaction context.

4. Data Freshness Lag Batch processing windows create blind spots where concentration can spike and crash before detection.

• Mitigation: Stream processing is mandatory. Use Kafka or Redis Streams to update metrics in real-time. Avoid T+1 batch jobs for risk enforcement.

5. Customer Friction from Over-Enforcement Aggressive blocking can degrade user experience and churn legitimate high-value clients.

• Mitigation: Implement graduated responses. Start with alerts, then rate limiting, then routing diversification, and finally blocking. Communicate limits clearly in API responses.

6. Ignoring "Shadow" Concentration Revenue may be diversified across channels, but all channels rely on a single underlying protocol or payment processor.

• Mitigation: Map dependency graphs. Calculate concentration not just on direct sources but on underlying dependencies. Tag events with dependency chains.

7. Replay Attacks on Mitigation Signals In smart contract or API contexts, attackers may replay mitigation signals to block legitimate revenue.

• Mitigation: Sign all policy updates and mitigation actions. Use nonces and timestamps to prevent replay. Validate signal integrity before execution.

Production Bundle

Action Checklist

• Define canonical RevenueEvent schema covering all income sources and assets.
• Implement HHI and Top-N concentration calculators with sliding window support.
• Deploy low-latency state store (Redis/Memcached) for recent event retention.
• Build policy engine with configurable thresholds and action types.
• Integrate RevenueGuardMiddleware into the transaction processing pipeline.
• Map correlation matrices for assets and customer segments.
• Conduct chaos engineering tests simulating whale withdrawal and channel failure.
• Establish incident response runbooks for concentration breaches.

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
SaaS Enterprise Platform	Top-N Customer Limits with Rate Limiting	Prevents churn shock; rate limiting preserves relationship while capping exposure.	Low engineering cost; potential revenue cap.
DeFi Yield Aggregator	Dynamic HHI with Auto-Rebalancing	Assets are volatile; auto-rebalancing maintains diversification without manual intervention.	Medium engineering cost; gas/transaction fees for rebalancing.
Payment Gateway	Correlation-Aware Channel Routing	Diversifies across processors; correlation awareness prevents systemic processor failure.	High engineering cost; improved resilience and uptime.
Token Launchpad	Hard Caps on Allocation per Wallet	Prevents whale dominance and ensures fair distribution; aligns with tokenomics goals.	Low engineering cost; may limit initial liquidity depth.

Configuration Template

{
  "version": "1.0.0",
  "policies": [
    {
      "id": "pol-hhi-customer",
      "metric": "HHI",
      "scope": "CUSTOMER",
      "windowMs": 86400000,
      "threshold": 0.35,
      "action": "RATE_LIMIT",
      "params": {
        "maxRate": 100,
        "unit": "requests_per_minute"
      }
    },
    {
      "id": "pol-top3-asset",
      "metric": "TOP_N",
      "scope": "ASSET",
      "windowMs": 3600000,
      "threshold": 0.60,
      "n": 3,
      "action": "ROUTE_DIVERSIFY",
      "params": {
        "fallbackChannels": ["channel_b", "channel_c"],
        "correlationThreshold": 0.75
      }
    },
    {
      "id": "pol-single-protocol",
      "metric": "TOP_N",
      "scope": "PROTOCOL",
      "windowMs": 43200000,
      "threshold": 0.50,
      "n": 1,
      "action": "BLOCK",
      "params": {}
    }
  ],
  "correlations": {
    "assets": {
      "ETH": ["WBTC", "USDC"],
      "SOL": ["JTO", "RAY"]
    },
    "customers": {
      "enterprise_a": ["subsidiary_b"]
    }
  }
}

Quick Start Guide

1. Initialize Risk Library: Install the concentration risk module and import the core classes.

   npm install @codcompass/risk-engine
   

2. Configure Policies: Create a risk-config.json file using the template above. Adjust thresholds based on your risk appetite and business model.
3. Wire Middleware: Attach the RevenueGuardMiddleware to your revenue ingestion endpoint or smart contract entry point. Ensure the middleware has access to the state store and policy configuration.
4. Seed State Store: Populate the Redis state store with historical events to establish baseline metrics. Configure the retention window to match your policy windows.
5. Verify and Deploy: Run integration tests using the provided test harness. Simulate concentration breaches and verify that mitigation actions trigger correctly. Deploy to production with monitoring dashboards for HHI and Gini metrics.

Revenue concentration risk is not a financial abstraction; it is a system property that must be engineered. By implementing real-time detection, correlation-aware quantification, and automated enforcement, developers can transform concentration from a latent threat into a managed constraint. This approach ensures platform resilience, protects liquidity, and enables sustainable growth in complex digital asset environments.