We rate DeFi assets on a AAA–C scale using five weighted pillars. Weights shift by asset class to reflect where risk actually lives. Eight hard override rules can cap any rating regardless of score.
TL;DR — We rate DeFi assets on a AAA–C scale using five weighted pillars. Weights shift by asset class to reflect where risk actually lives. Eight hard override rules can cap any rating regardless of score. Here's the full system in plain English.
USDC and USDT both hold a $1 peg. DAI and FRAX are both called "algorithmic." Yet the risk profiles are fundamentally different. The DeFi ecosystem lacks a shared vocabulary for why one asset is safer than another — not just that it is.
This framework fills that gap with a structured, replicable methodology modelled on credit ratings but built for on-chain assets.
Each class has a different primary risk driver, which is why a single weight set would be inadequate.
| Asset Class | Examples | Primary Risk Driver |
|---|---|---|
| Fiat-backed stablecoin | USDC, USDT, PYUSD | Reserve quality & custodian integrity |
| Algorithmic stablecoin | DAI, FRAX, USDe | Peg mechanism robustness & contract logic |
| Liquid staking / restaking token | stETH, rETH, eETH | Validator concentration & slashing coverage |
| Tokenised RWA | PAXG, BUIDL, OUSG | Custody quality & collateral integrity |
| Wrapped token | WBTC, cbBTC, wstETH | Custodian single-point-of-failure risk |
Scores map to letters as follows. Override rules (see below) can only move a rating down.
| Rating | Score | Meaning |
|---|---|---|
| AAA | 90–100 | Highest safety. Verified reserves, top audits, deep liquidity, full compliance, clean track record. |
| AA | 80–89 | Very strong. Minor gap in one pillar only. No structural weaknesses. |
| A | 70–79 | Strong. Some limits in governance or liquidity, but collateral and contracts are solid. |
| BBB | 60–69 | Adequate. Investment-grade floor. Acceptable across the board; monitoring warranted. |
| BB | 50–59 | Speculative. Meaningful weakness in one or more pillars. |
| B | 35–49 | High risk. Multiple structural gaps. |
| C | < 35 | Distressed / unrateable. Fundamental failure or hard override triggered. |
BBB is the investment-grade threshold. Below it, an asset is unsuitable as collateral or treasury reserve without an explicit risk mandate.
Score = ROUND( (P1×W1 + P2×W2 + P3×W3 + P4×W4 + P5×W5) × 10, 1 )
Each pillar is scored 0–10. Weights vary by asset class:
| Pillar | Fiat | Algo | LST | RWA | Wrapped |
|---|---|---|---|---|---|
| P1 — Collateral quality | 35% | 20% | 25% | 40% | 30% |
| P2 — Smart contract risk | 15% | 35% | 25% | 10% | 25% |
| P3 — Liquidity & redeemability | 20% | 25% | 20% | 20% | 20% |
| P4 — Governance, ops & regulatory | 20% | 10% | 20% | 20% | 15% |
| P5 — Market & track record | 10% | 10% | 10% | 10% | 10% |
The heatmap below shows exact weights across all five pillars and asset classes at a glance — darker blue means heavier weighting.
The inversion between P1 and P2 is the key structural insight: where collateral weight is highest, contract weight is lowest — and vice versa. RWA puts 40% on collateral and only 10% on contracts; Algo Stable reverses that almost exactly. P5 (Track Record) is flat across every class at 10% — it is a maturity signal, not a primary risk driver.
The logic behind the weights:
| Pillar | What we assess | Score range signals |
|---|---|---|
| P1 — Collateral | Reserve composition, custody segregation, PoR frequency, validator diversity (LSTs), allocated vs pooled (metals) | 9–10 = Big-4 monthly, bankruptcy-remote; 1–2 = self-attested or own-token backed |
| P2 — Smart contract | Audit coverage & firm quality, bug bounty, upgrade controls (timelock/proxy), oracle stack | 9–10 = 3+ top firms, formal verification, $1M+ bounty; 1–2 = no audit, known vulnerabilities |
| P3 — Liquidity | DEX depth, CEX listings, primary redemption speed, withdrawal queue (LSTs), minimum redemption size | 9–10 = $500M+ on-chain, <0.1% slippage on $1M; 1–2 = no DEX, redemption suspended |
| P4 — Governance & reg | Licence status, multisig quality, AML/KYC, attestation cadence, incident response | 9–10 = multi-jurisdiction licensed, HSM 7-of-11 multisig, Big-4 monthly; 1–2 = EOA control, active enforcement |
| P5 — Track record | Protocol age, incident history, TVL trend, peg deviation history, whale concentration | 9–10 = 3+ years, zero incidents, >$5B TVL, survived major stress; 1–2 = <3 months or prior catastrophic failure |
Override rules are categorical disqualifiers — failure modes so severe that no pillar score compensates.
| Trigger | Action |
|---|---|
| No third-party smart contract audit | Cap at BB |
| No proof of reserves / attestation stale >6 months | Cap at BB |
| Active regulatory enforcement or government seizure | Cap at BBB, watch status |
| Peg deviation >5% sustained 24+ hours | Immediate C, under review |
| Algo stablecoin with <100% collateral ratio | Cap at B |
| Single-custodian wrapped asset, no decentralisation roadmap | Cap at A, disclose |
| Protocol relaunched after prior catastrophic failure | Cap at BB, disclose history |
| Contract exploited with user losses in past 12 months | Cap at B, pending full review |
After scoring, the analyst can apply a one sub-grade adjustment (with documented rationale):
| Factor | Rule |
|---|---|
| Protocol age | Assets <12 months get a P5 sub-grade penalty; <3 months cannot receive AAA or AA |
| Incident history | A >5% depeg blocks overall rating above A until 24 months clean |
| Whale concentration | Top 5 wallets >50% supply → disclose governance risk (no direct score change) |
| Oracle dependency | Single-oracle algo stable → analyst may deduct 1 point from P2 |
| Regulatory trajectory | Forward-looking governance penalty if issuer faces SEC scrutiny or equivalent |
Ratings are not certainties — they are structured, evidence-based opinions. The five pillars capture the full risk surface of a DeFi asset when weighted correctly. The eight overrides ensure categorical failures are never buried inside a high composite score. The qualitative layer preserves analyst judgement where numbers fall short.
Framework criteria are subject to revision as market standards evolve.
For informational purposes only. Not financial or investment advice. DeFi assets carry significant risks. Ratings are point-in-time assessments and may change.
DeFi Sentinel rates assets (stablecoins, liquid staking tokens, RWAs, wrapped tokens) on an AAA-to-C scale using five weighted pillars whose weights vary by asset class. Scores are computed as (P1×W1 + P2×W2 + … + P5×W5) × 10, then mapped to letters. Eight hard override rules can cap any rating regardless of the numeric score.
P1 Collateral Quality — what backs the asset. P2 Smart Contract Risk — audit and code health. P3 Liquidity & Market Depth — exit feasibility at size. P4 Governance & Compliance — issuer transparency and regulatory standing. P5 Track Record — peg stability and incident history. Each pillar scores 0-10 and is weighted by asset class.
Different asset classes carry their primary risk in different places. A fiat-backed stablecoin lives or dies on reserve quality (P1 = 35%). An algorithmic stablecoin lives on contract soundness (P2 = 35%). An LST depends on validator concentration and slashing coverage (P1 = 25%, P4 = 20%). A single weight set would systematically misprice some asset classes.
Eight hard overrides can cap a rating regardless of numeric score: unverified reserves, unaudited core contracts, single-point-of-failure custodian, recent peg break, frozen-funds events, anonymous core team, sanctioned-jurisdiction listing, and active enforcement action against the issuer. Overrides can only move a rating down, never up — a high score does not absolve a structural failure.
BBB (score 60-69) is the floor at which an asset is considered acceptable as collateral or treasury reserve for a risk-averse mandate. Below BBB, an asset is speculative — usable for tactical positions or yield-seeking allocations, but not as a foundational holding for an institution or a treasury that needs predictable behaviour through stress events.
Specializing in DeFi security audits and risk assessment with 5+ years of experience.
