WETH/USDC: the token is not the risk, ETH's occasional volatility is

Selling the whole $12.5m cap costs about 0.7% against a 14% buffer, and the oracle sees a new price within a minute. The weak input is ether itself: a 39% fall in seven days in February 2026. The market layer scores at the top, with two inputs sitting on a boundary.

Eligibility

The grade above is recomputed from the current component reviews every time the site is built. No governance-approved parameters recorded for this market yet.

What the market is

WETH posted as collateral against USDC on Morpho Blue (Ethereum), at an LLTV of 86%, for the Stake DAO USDC Core vault. The market was created on 2 February 2026 and replaced an older WETH/USDC 86% market that has since been all but emptied. On 28 September 2026 it held $16.9m of WETH collateral against $7.9m of USDC borrowed, at 90% utilisation, read onchain through the Morpho API.

No platform layer applies. WETH is a plain token held directly as collateral: it passes through no LP token, wrapper vault or strategy. Morpho is the venue of the market and of the vault, not part of the collateral's chain, so it is not scored here. The market grade is therefore the lower of the WETH asset review (S+) and this market layer (S+).

Sub-pillar results

Inside liquidation ability:

Why ether's price path is the input that matters

The token carries no admin risk (see A-008). What this market has to absorb is the speed and depth of ether's own moves.

Volatility. The criterion takes the standard deviation of the last 30 daily returns, scaled to one month: 12.9% for ether, about 45% annualised, or 0.92 of the 14% buffer. A one-standard-deviation month consumes most of the buffer but not all of it. The top score requires 0.80 or less.

Drawdown. The worst seven-day fall over two years was -39.4%, into 5 February 2026: a daily close of $1,824 against $3,012 on 28 January, CoinGecko daily data. That is 2.82 times the buffer, scored 3. The next largest episodes were -25.5% (10 March 2025), -22.7% (8 April 2025), -22.4% (6 June 2026) and about -20% in February, October and November 2025. On a one-day horizon the worst move on the feed itself over a year was -15.3%.

The two scores are averaged and rounded down, which gives 4. Depth then compensates: the liquidation-ability grid returns 6 when liquidity scores 6 and fluctuation 4.

Why depth compensates: what stands in front of a forced seller

"Liquidity in front of" WETH counts the counter-asset in pools against WETH, never the WETH side, and excludes ether-correlated assets such as liquid staking tokens. Read onchain on 28 September 2026:

Uniswap v4, whose pool manager holds $64m of USDC and $80m of USDT across all pools, is left out because it cannot be attributed pool by pool without an indexer. So are Fluid, Balancer and private market makers. The total is a floor.

Off-chain depth. Unwrapping WETH into ether is one call that nobody can refuse, so a liquidator holding seized WETH has the whole ether market one transaction away. Ether futures open interest was $16.97bn on 23 September 2026, a Santiment figure reported in the press. About $8.5bn on the long side is counted, for $8.75bn in front of WETH. The same convention was applied to WBTC, where it is weaker because the path to bitcoin runs through a custodian's redemption gateway. For WETH there is no gateway.

WETH already deposited in lending, read onchain: about $7.5bn (Aave v3 core $5.58bn, Spark $1.59bn, Compound v3 USDC and USDT markets $0.26bn, Aave v3 Prime $0.05bn, Morpho $17.6m). Most WETH on Aave and Spark is supplied to be borrowed by liquid-staking loops, not pledged against stablecoins, and deposits are not additive with supply. Subtracting every deposit from the liquidity in front still leaves about $1.3bn, a hundred times the cap.

Selling the cap. Paraswap and KyberSwap public quote APIs, WETH sold for USDC, on 28 and 29 September 2026:

The same tools priced a $25m WBTC sale at 2.95%: onchain, WETH is about twice as deep as WBTC. A purely onchain floor, Uniswap v3 alone through its quoter and split optimally across pools, gives about 2% for $25m.

The oracle: an SVR feed read through its secondary proxy

The oracle uses one feed. It describes itself as "ETH / USD", but it is not the canonical Chainlink proxy: its aggregator reports DualAggregator 1.0.0, the contract behind Chainlink's Smart Value Recapture feeds. Chainlink's reference directory lists the address the oracle reads as the secondary proxy of the "ETH / USD shared SVR" feed: risk category low, heartbeat 3,600 s, deviation threshold 0.5%.

What SVR changes. Each new report first goes through a private auction (Flashbots MEV-Share), so the searcher who liquidates behind the update pays for the privilege and part of that value returns to the protocol. We read the aggregator code: the secondary proxy returns the latest report delivered on the public path, or, if that is older than cutoffTime, the latest private report older than cutoffTime. The cutoff was set once, to 60 seconds, on 1 August 2025, read from the CutoffTimeSet event since there is no getter.

Measured lag. Over the 60 days to 28 September 2026, 1,984 rounds reached the secondary path, onchain: median 12 seconds, 99th percentile 48 seconds, maximum 72 seconds.

One year of answers, rebuilt from 15,618 onchain answers between 26 September 2025 and 28 September 2026:

No USDC/USD leg. The oracle assumes USDC is worth $1. If USDC traded below a dollar, WETH would be valued below its true USDC value and positions would be liquidated early: the error falls on borrowers, not on lenders. The WBTC market of the same vault divides by USDC/USD.

How a liquidation on this market plays out

The window. A position becomes liquidatable when its debt exceeds 86% of its collateral. With a 4.38% incentive, liquidation stays fully profitable until the loan-to-value reaches 1/1.0438 = 95.8%, roughly the first 10% of price decline after the threshold is crossed.

In ordinary conditions the frictions consume well under 1% of that 10% window. In the worst minute observed in a year, about half of it.

What becomes liquidatable. Morpho API collateral-at-risk curve for this market:

The three largest positions held about two thirds of the collateral, so the curve moves in steps. A 35% fall makes about $8m liquidatable, which sells for well under 1%. The February 2026 episode is not itself a liquidation risk, since liquidations clear in minutes; it shows how fast positions can be pushed through the threshold. The constraint would be the speed of a crash relative to the oracle, not the depth of the market.

Who bears a loss. If a position goes underwater, Morpho Blue realises the bad debt immediately against the market's suppliers, pro rata. In the USDC Core vault, that means its depositors, in proportion to the vault's share of the market.

Where the grade depends on judgement

Every call below is defensible, and every one could be scored the other way. They are listed so a reader can recompute the layer.

Any one of the first, second, third or fifth calls taken alone moves the layer from S+ to S. A fluctuation alternative combined with the slippage alternative gives A.

Our reading. We agree with counting off-chain depth for WETH. On aggregation and on the volatility window the arguments balance: volatility describes normal conditions and drawdown a historical tail, but the drawdown speaks most directly to whether the buffer survives. On slippage, the honest description is that S+ sits on the boundary at $12.5m and clears it comfortably at $10m.

Rules revised during this review. WETH served as a calibration case, and four market-layer rules changed while it was assessed, for every market of the vault: the volatility formula was corrected (it understated volatility about 5.5 times) and moved to a monthly scale with thresholds 0.80, 0.95, 1.2, 1.5 and 2.0; price fluctuation moved from worst-of to a rounded-down average; both slippage criteria are now divided by the buffer; and the liquidity sub-pillar is rounded rather than rounded down. The volatility correction cut against WETH (6 before, 5 after). Under the rules as they stood on 28 September 2026, a strict reading of this market gave B.

Parameters and re-assessment triggers

Parameters proposed, not yet approved by governance: cap $12.5m, LLTV 86%. This is the only liquid WETH/USDC market on Morpho Ethereum and the one chosen by Gauntlet, Steakhouse and kpk. A 77% market would lift the drawdown score from 3 to 4 but has no borrowing demand. A $10m cap, the one proposed for WBTC in the same vault, would clear the slippage boundary in every measurement we made. Either cap exceeds the market's current supply of $8.8m, so borrowing demand, not risk, binds in the first months.

A new Market review is triggered by:

• A full-cap sale above 0.70% on the best aggregator, measured repeatedly: liquidity falls to 5 and the layer to S.
• Monthly volatility above 13.3% (ratio 0.95): volatility falls to 4 and the layer to S.
• A seven-day fall beyond -42% (ratio 3): drawdown falls to 2.
• Any change to the SVR configuration of the ETH/USD feed (CutoffTimeSet, aggregator change on the secondary proxy) or to its Chainlink risk category.
• USDC trading below $0.99, since the oracle assumes $1.
• A change in collateral concentration on the market.

Time-based. The February 2026 episode leaves the two-year drawdown window in February 2028. Without a seven-day fall beyond -28% in the meantime, the drawdown score rises from 3 to 4.

Grades are point-in-time assessments and are not credit ratings.

Onchain reference

wstETH: every unbounded power behind a nine-day governed path that stETH holders can veto

wstETH itself is an immutable wrapper; every power that matters sits in Lido's upgradeable core. None of it can be used in less than nine days: an Aragon vote of five days, then a timelock of four, during which stETH holders can freeze the proposal and leave. The core was upgraded in July 2026, which sets Lindy at its lowest passing score on the publication date.

TL;DR

• Grade S, no red flag at the review date. Issuer S+, Asset and token S, Operational S. The layer is set by three criteria at 5: reserves, bridge risk and asset class (liquid staking).
• The admin powers are unbounded but slow. Lido's governance can upgrade the stETH contract, every proxy around it and the external mint cap. The shortest path is an Aragon vote (5 days) followed by the Dual Governance timelock (3 days, then 1 day): at least nine days, with no faster route found onchain. Admin score 6.
• stETH holders hold a veto. Since June 2025 Dual Governance lets holders of 1% of stETH delay any DAO proposal (5 to 45 days) and holders of 10% exit before it executes. Among the assets we have reviewed, wstETH is the only one whose holders have an onchain say over the issuer's changes.
• The core was upgraded on 24 July 2026 (Staking Router v3), which changed how Lido accounts for validator balances, the input of the wstETH exchange rate. Lindy is 2 on the review date and would have been 1, a red flag, before 24 October 2026.
• The audit record is the deepest we have seen. Three audits of the July 2026 code (Certora, Statemind, MixBytes), four of Lido V3, four reviews of Dual Governance including OpenZeppelin. Audits 6.
• Things a reader should not miss. LDO turnout is low (45 to 67 million LDO per vote, against a 50 million quorum). A large node operator, MetaMask Staking, disclosed an infrastructure compromise on 30 September 2026 and exited its Lido validators; no slashing and no negative rebase had been observed onchain as of 19 October.

What the asset is

wstETH is the non-rebasing wrapper of stETH, the token Lido issues against ether staked on the beacon chain. stETH balances grow every day with staking rewards; wstETH holds a fixed number of stETH shares, so its value in stETH grows instead (1.2467 stETH per wstETH on 19 October 2026). Anyone can wrap and unwrap at any time, and redeem stETH for ether through Lido's withdrawal queue, normally in one to five days. About 3.69 million wstETH circulate on Ethereum, wrapping 4.61 million stETH out of 9.67 million (about $11.0bn and $23.2bn).

Assessment data as of 19 to 20 October 2026; onchain reads dated where they appear. This review grades the asset alone. It does not opine on any market, oracle, cap or LLTV.

Pillar results

Criterion by criterion

How the pillars combine, as set in the scoring sheet: Issuer takes the better of Social and Decentralisation; Asset and token takes the worst of its criteria; Operational is the average of its six criteria, rounded to the nearest (here 5.33, rounded to 5). The layer takes the worst pillar. The two Issuer criteria are left out of the red-flag count. Lindy enters an average, so even at 1 it would not have set the pillar to 1; it would have acted through the red-flag count, capping any market using wstETH at A.

Two contracts, one of them upgradeable

wstETH (0x7f39C581…2Ca0) was deployed on 19 February 2021 and has no proxy, no owner and no privileged function: wrap, unwrap, and a direct ether deposit that stakes and wraps in one step. Its value is entirely what the stETH contract reports for its shares. Everything this review grades therefore sits in stETH and around it.

stETH (0xae7ab965…fE84) is an Aragon application behind an AppProxyUpgradeable. Its implementation is replaced through the Aragon Kernel's setApp, which requires APP_MANAGER_ROLE. Replaying every SetPermission event of the Aragon ACL shows that nobody holds that role at rest: the Agent, which manages it, grants it to itself inside an upgrade transaction and revokes it in the same transaction. The Kernel's SetApp history gives the implementation changes:

The other contracts that shape stETH's supply and accounting (VaultHub, Accounting, the accounting oracle, the withdrawal queue, the staking router, the burner) are OssifiableProxy contracts whose admin is the Agent. Their DEFAULT_ADMIN_ROLE is held by the Agent alone, read by replaying every RoleGranted and RoleRevoked event on 19 October 2026.

Who can do what: a nine-day path, and a veto

Every unbounded power (upgrading stETH or a proxy around it, raising the share of stETH that stVaults may mint, changing the oracle committee or the staking modules) belongs to the Agent. Since 30 June 2025 the only address allowed to make the Agent act is the Dual Governance Admin Executor; Aragon Voting itself no longer holds EXECUTE_ROLE or RUN_SCRIPT_ROLE.

The path, read onchain:

1. An Aragon vote of 5 days, the last 2 of which only allow objections; quorum 5% of LDO (50 million), majority 50%.
2. Submission to Dual Governance, then to its Emergency Protected Timelock: 3 days after submission, then 1 more day after scheduling.
3. During that window, holders of 1% of stETH locked in the veto escrow start veto signalling, which suspends execution for 5 to 45 days depending on support; at 10%, rage quit lets them withdraw their ether before anything executes (60 to 180 days withdrawal delay inside the escrow).

The governance state was "Normal" on 19 October 2026.

No faster route was found. The emergency committees cannot execute new actions: the activation committee (Safe, 4 of 7) can freeze execution, and the execution committee (Safe, 5 of 7) can execute already scheduled proposals or reset governance to an emergency mode whose proposer is the same Aragon vote, through the same timelock, without the stETH veto. This protection expires on 20 June 2027. The CircuitBreaker and the Reseal committee can pause the withdrawal queue, VaultHub and other contracts for a bounded time (21 days for the CircuitBreaker), which is reversible; the stETH token itself is not on the CircuitBreaker's list. Easy Track motions run bounded operational changes (deposit reserve target, stVault tiers and fees) with an LDO objection window.

What one party can do on its own: nothing, and nothing quickly. The largest single LDO voter seen in 2025 and 2026 held 31.1 million LDO, below the quorum, and any majority must still survive four days in which stETH holders can freeze it.

How it was scored. Admin capabilities: unbounded powers under an onchain vote of five days, 5. Key custody: decentralised onchain governance, 6, because the LDO vote cannot act alone and the stETH holders form a second, independent constituency with a veto. Crossed: 6.

The weak point: LDO turnout

Dual Governance is a strong mitigant; the LDO vote underneath it is thin. Over votes 184 to 206 (March 2025 to October 2026), turnout ranged from 45 to 67 million LDO, 5% to 7% of supply, against a 50 million quorum. The ten largest voters seen hold about 45 million LDO between them (31.1, 10.0, 7.2, then several holders at exactly 5.0 million), and most are not publicly identified. Read alone, that is "onchain governance with low decentralisation, unidentified signers can execute", which scores 3 for custody and 5 for the admin score. It would not change the pillar, which is set at 5 by three other criteria.

How stETH is backed, and what can change it

stETH is backed by the balances of Lido's validators on the beacon chain, the ether buffered in the protocol (533 ETH on 19 October 2026) and, since Lido V3, by ether held in stVaults that mint stETH as "external shares" (4,540 ETH, 0.05% of pooled ether, under a cap of 30% set by the DAO).

Beacon-chain balances are not readable by an Ethereum contract directly. They are reported once a day by an oracle committee of nine members, five of which must agree. The report is bounded by an onchain sanity checker: an annual balance increase limit of 10% and a maximum positive rebase of 0.075% per report, so a colluding committee could inflate the exchange rate by no more than that per day, visibly. The 63 daily rebases from mid-August to 19 October 2026 were all positive, between 2.17% and 2.34% annualised.

Redemption runs through the withdrawal queue: not paused, no bunker mode, 8,248 stETH waiting on 19 October 2026. Reserves visible onchain, not instantly redeemable: 5.

The July 2026 upgrade and Lindy

The Staking Router v3 upgrade (Aragon vote 203, executed through the timelock on 24 July 2026) replaced the Lido implementation. According to the design proposal (LIP-35), Lido stopped storing a single consensus-layer balance and validator count and now tracks active validator balances and pending deposits, protects a governance-set deposit reserve, and lets the staking router pull ether from Lido. These inputs determine totalPooledEther, which is exactly what the wstETH exchange rate divides. We treat it as a material change to the asset's economic system.

The day after, the oracle under-reported one rebase by a single 32 ETH deposit in flight (2.04% annualised instead of 2.15%), corrected in the next report, with no funds affected, according to Lido. A full post-mortem was announced.

Lindy reaches 3 on 24 January 2027 and 4 on 24 July 2027, unless the core is upgraded again.

Bridges

The scope is Ethereum wstETH and anything that could create it or dilute its backing. wstETH reaches other networks through canonical lock-and-release bridges: 87,533 wstETH (2.4% of supply) sat in Ethereum escrows on 19 October 2026, chiefly Arbitrum (45,507), Base (24,853) and Optimism (15,652), with Linea, Unichain, zkSync, Scroll, Mantle and Soneium below 700 each. The escrows' proxy admin is the Agent. An exploit of a bridge would release wstETH already in circulation; none of them can mint Ethereum wstETH or stETH. Scored 5, the same treatment as WBTC (A-007) and cbBTC (A-009).

Audits

Lido publishes its reports in a public repository. For the code deployed today:

Three audits of the current core, one of them by a tier 1 firm: 6. Certora and Consensys Diligence were added to our tier 1 list, and Statemind and MixBytes to tier 2, in October 2026. Under the previous list the same record would have read as three tier 2 audits, 5, with no effect on the pillar.

Other operational signals

Bug bounty. Immunefi programme, critical findings paid 10% of funds directly affected, up to $2m, last updated 29 June 2026; its scope covers Lido's core repository and its deployed contracts. Scored 6.

External ratings. CertiK Skynet rates wstETH 83.46 (A), stETH 91.36 (AA) and the Lido DAO 91.03 (AA). Credora rates wstETH A+. Two ratings above 80% on the asset and its underlying: 6.

Peers. On the Morpho wstETH/USDC market, read through each vault's adapter on 19 October 2026: Steakhouse, Gauntlet, kpk, Sky (Spark) and Yearn. wstETH is also collateral on Aave, on Curve's mint markets and on Inverse's FiRM. Eight reference curators: 6.

Operational events in 2026, not scored

• KelpDAO stress, April 2026. After the rsETH exploit on 18 April, stETH traded down to about 0.993 ETH and recovered by late May, according to Lido; the lowest Chainlink stETH/ETH answer over the year was 0.9925.
• MetaMask Staking, September 2026. MetaMask Staking (formerly Consensys Staking), one of Lido's node operators, disclosed an infrastructure compromise on 30 September and exited its Lido validators by 7 October. A third-party estimate puts the validators concerned at about 523,000 ETH; neither company has confirmed it. A small diversion of block rewards was reported. No slashing was reported and no negative rebase appeared onchain up to 19 October 2026. A correlated slashing of that size would cost in the order of 0.2% of pooled ether under standard penalty rules and a network stake of about 35 million ETH, an assumption.

Where the grade depends on judgement

What would change the grade

• Any new upgrade of the Lido implementation or of a core proxy resets Lindy: 1 for three months, a red flag.
• A change to the Dual Governance thresholds or timelock delays, or the end of emergency protection on 20 June 2027, calls for a re-read of the admin score.
• An increase of the external-share cap above 30%, or a large share of stETH minted by stVaults, changes the reserve picture.
• A slashing of Lido validators or a negative rebase from the MetaMask Staking incident, or a delayed or failed oracle report, calls for a re-read of reserves and operational criteria.
• Publication of the identities behind the largest LDO voters would settle the custody alternative in either direction.

Grades are point-in-time assessments and are not credit ratings.

Onchain reference

cbBTC: USDC's token code under Coinbase's keys, with no timelock and no second party

cbBTC runs Circle's USDC token code, unchanged since August 2024, and every power over it (upgrade, unlimited mint, freeze) sits with Coinbase alone, in plain addresses, with no delay. The grade rests on what those addresses are: Coinbase's institutional key management. That cannot be proven onchain, but everything onchain is consistent with it, including an orderly rotation of every Coinbase wrapped-asset key between August and October 2026.

TL;DR

• Grade S, no red flag. Issuer S+, Asset and token S, Operational S+. The grade is set by one criterion, the admin score.
• One company holds every power. Coinbase can upgrade the token, mint without limit and freeze any address, instantly. There is no timelock, no multisig, no second organisation anywhere in the stack. Admin capabilities score 2, the lowest level for a token that is not malicious by design.
• The keys are plain addresses, which Coinbase says are institutional keys. Coinbase states that these roles require approval from several people, that no individual controls a key, and that its custody runs on multi-party computation with key shares spread across separate locations. None of this is visible onchain: an MPC key and a single key look identical. We scored the custody 6 under the grid's "institutional MPC wallet / key sharding" row; under the plain "EOA" row the asset would be A.
• What onchain behaviour shows supports that reading. The upgrade key was not used once in 25 months. Between 13 August and 2 October 2026 Coinbase replaced every privileged key except the compliance one on cbETH, cbDOGE, cbXRP and cbBTC, on three chains at the same minutes, with gas paid from its own infrastructure, without minting, upgrading or pausing anything. No announcement was made; the reason is not public.
• The token code is USDC's. The implementation is source-identical to the FiatTokenV2_1 that held USDC on Ethereum from 2021 to 2023. No audit of cbBTC itself is public; the code was reviewed on the USDC deployment (Callisto Network, 2023) and the minting contracts by OpenZeppelin (2022). Audits score 3.
• Reserves are published, redemption is gated. 95,805.67 BTC reported against 95,794.92 cbBTC across all chains on 29 September 2026. Redemption runs through a Coinbase account, not onchain.
• Things a reader should not miss. The same key controls a role on Ethereum, Base and Arbitrum at once. The blacklister has frozen over a thousand addresses since launch. Half the supply is issued natively on other chains from the same reserve.

What the asset is

cbBTC is Coinbase's wrapped bitcoin, launched on Ethereum and Base in September 2024 and since issued on Solana and Arbitrum, with further chains reached through Chainlink CCIP. Each cbBTC is backed by one bitcoin held in custody by Coinbase. A Coinbase customer mints by withdrawing bitcoin from their account to a supported network as cbBTC, and redeems by depositing cbBTC back to their account, where it is converted one for one. About 46,000 cbBTC circulate on Ethereum, out of about 95,800 on all chains.

Assessment data as of 30 September to 19 October 2026; onchain reads dated where they appear. This review grades the asset alone. It does not opine on any market, oracle, cap or LLTV.

Pillar results

Criterion by criterion

How the pillars combine, as set in the scoring sheet: Issuer takes the better of Social and Decentralisation; Asset and token takes the worst of its criteria; Operational is the average of its six criteria, rounded to the nearest. The layer takes the worst pillar. Since October 2026 the two Issuer criteria are left out of the red-flag count: because the pillar takes the better of the two, a 1 on one of them is offset by design, and a 1 on both would set the pillar, and the layer, to 1 anyway. Under the previous count, Decentralisation at 1 would have been a red flag and capped any market using cbBTC at A.

The token: USDC's code, Coinbase's roles

The cbBTC address is a FiatTokenProxy pointing to a FiatTokenV2_1 implementation, deployed on 20 August 2024 and never upgraded: the proxy has emitted no Upgraded event, read on 19 October 2026. This is Circle's stablecoin contract, the one behind USDC.

We compared the verified source of the cbBTC implementation with two references. It matches Circle's public repository at tag v2.1.0 file by file, and all nineteen of its source files appear verbatim in the verified source of the USDC implementation on Ethereum (0xa2327a93…bcdf), once comments and whitespace are removed. Only a compiler setting differs. The token logic that secures cbBTC is the logic that secured USDC on Ethereum from 2021 to late 2023.

The contract carries six roles, each held by one address:

Daily minting goes through the MintForwarder, a Coinbase contract that caps its single caller at 3,500 cbBTC per rolling 24 hours. That cap limits what a compromised operational key could mint. It does not limit the master minter, the owner or the proxy admin, which can bypass the forwarder in one transaction each.

Who can do what: the single-actor analysis

The question that organised the WBTC review was what one party can do on its own. For cbBTC the answer is short: Coinbase can do everything, and nobody else can do anything.

• Mint without backing: the master minter appoints a new minter with an unlimited allowance; the owner can appoint a new master minter; the proxy admin can replace the code. Each is one transaction, executed immediately.
• Freeze: the blacklister can freeze any address, including a lending protocol's contract. None has been frozen; the function is used for sanctions screening.
• Move the reserve: the bitcoin sits in Coinbase custody.

There is no second organisation to collude with, no separation of duties on chain, no delay, no guardian. Every safeguard is inside Coinbase. This is why admin capabilities score 2, and why the grade turns entirely on how Coinbase holds its keys.

An unbacked mint would not need to be sold to be extracted: posted as collateral in a lending market, it can be borrowed against in the same transaction. The amount at risk is bounded by borrowable liquidity, not by how visible the mint is.

Who holds the keys: institutional key management, as far as can be seen

Every role holder is an externally owned account: a single onchain address that signs with one ECDSA key. On a block explorer it looks the same whether the key sits on one laptop or is split by multi-party computation across several data centres and requires several approvers. The onchain record can neither confirm nor refute how the key is held.

What Coinbase says.

What third parties wrote. LlamaRisk, in the Aave onboarding of cbBTC in September 2024, noted that the contract "is owned by a simple address", that "Coinbase reports using MPC wallets, but this is not possible to verify through block explorers", and concluded that "few better entities could hold these roles". Steakhouse Financial's "Wrap Battle" relays that each action under these roles requires approval from security, engineering and finance teams.

How it was scored. The key custody grid gained a row in October 2026 for "institutional MPC wallet / key sharding", at the level of a multisig with more than four signers. Crossed with a regulated, listed key holder it gives 6. We applied it to cbBTC on two conditions: a public statement by the issuer that explicitly covers the admin keys, which exists, and onchain behaviour consistent with institutional cold keys, which the next section describes. Read under the "EOA" row instead, custody scores 5, the admin score 4 and the layer A.

The 2026 key rotation, read onchain

Between 29 September and 2 October 2026, every cbBTC role except the blacklister moved to new addresses. A rotation of an admin key is a moment worth checking: it is also what a compromise would look like. We read it on Ethereum, Base and Arbitrum, and on Coinbase's other wrapped assets.

It was not a cbBTC event. The same pattern appears on cbETH on Ethereum (owner, proxy admin, master minter and pauser, 13 and 14 August 2026, their first change since 2022) and on cbDOGE and cbXRP on Base (master minter, owner and proxy admin, 28 and 29 September). In every case the blacklister stayed in place.

The gas came from Coinbase. Each old key received 0.009 ETH a few minutes before its one rotation transaction. The cbETH and cbBTC rotations were funded by the same distribution address, which is itself funded by a Safe whose first deposit came from the address Etherscan tags as "Coinbase 10", the exchange wallet that also receives most cbBTC mints.

Nothing else happened. No new minter, no allowance change, no upgrade, no pause, before, during or after. As of 19 October 2026 none of the new owner, proxy admin, master minter or pauser addresses has sent a transaction. The old proxy admin's only transaction in 25 months was handing over its role.

What we read into it. A compromise would be followed by a mint, not by a methodical rotation across five tokens and three chains over seven weeks, paid from Coinbase's own wallets. The pattern is that of planned key hygiene, or of a migration to a new key infrastructure, which Coinbase has done before. Coinbase has not said which. It also shows two design choices: one key per role per asset (cbDOGE and cbXRP have their own), and the same key for that role on every chain, so a single compromised key reaches every deployment at once.

Reserves and redemption

Coinbase publishes a proof-of-reserves page listing twenty bitcoin addresses. On 29 September 2026 it showed 95,805.67 BTC against 95,794.92 cbBTC in circulation: 46,775.34 on Base, 45,968.53 on Ethereum, 2,961.30 on Solana and 89.75 on Arbitrum. The Ethereum totalSupply() read onchain the next day was within the day's mints of that figure. We could not query the bitcoin balances ourselves: the explorers available to this review were blocked.

Redemption is not onchain. A holder deposits cbBTC to a Coinbase account, where it is converted to bitcoin one for one, subject to account eligibility (Coinbase customers in good standing in the United States excluding New York, the United Kingdom, the EEA, Singapore, Australia and Brazil). Reserves visible onchain, not instantly redeemable: 5.

Bridges and other chains

The scope is Ethereum cbBTC and anything that could create it or dilute its backing.

• No bridge can mint Ethereum cbBTC. The only minter ever active on Ethereum is the MintForwarder; the full MinterConfigured and MinterRemoved history shows nothing else since September 2024. Ethereum is not a CCIP lane.
• Chainlink CCIP, Coinbase's exclusive bridge for wrapped assets since December 2025, uses a lock-and-release pool on Base as its hub and burn-and-mint pools on Aptos, Katana, Monad, Robinhood Chain and Tempo. On Monad the token roles sit behind a Chainlink timelock of three hours run by Chainlink's signer set, with no Coinbase EOA, according to Aave Labs' June 2026 assessment. These chains are backed by the Base pool and cannot reach Ethereum.
• Native issuance by Coinbase on Base, Solana and Arbitrum draws on the same bitcoin reserve, about 52% of the supply. A compromised mint key on one of those chains could create cbBTC redeemable against the common reserve. It is the same issuer and the same key system as on Ethereum, already scored in the admin score.

One unified bridge with correct owners and no path into Ethereum: 5.

Audits: the same code as USDC

No audit of cbBTC itself has been published. Coinbase's cbBTC whitepaper refers to "heavily audited and battle tested smart contracts (like USDC and cbETH)". We looked for every review of the exact code.

Together the first two cover the full scope once: under the audit grid, which counts half the scope plus the other half as one audit, that is 3. A tier 1 report on FiatToken v2.1 would give 4.

Other operational signals

Bug bounty. Coinbase runs an onchain programme on Cantina since July 2025, covering every contract it deploys for a product, with cbBTC named in Tier 0 and critical findings paid up to $5m. Its scope is smart contracts; key management is off-chain and outside it. Scored 6.

External assessments. CertiK Skynet rates Coinbase as an exchange at 81.97 (A); the token has no page of its own. Credora rates the collateral by construction of its Morpho methodology; its values sit behind its application. Scored 6.

Peers. On the Morpho cbBTC/USDC market, read onchain on 30 September 2026 through each vault's adapter: Steakhouse, Gauntlet, Sky (Spark), kpk, RockawayX and Yearn. cbBTC is also collateral on Aave v3. Seven reference curators: 6.

Lindy. Reference date 20 August 2024, the deployment, since the implementation has never changed. Two other candidates were considered and not retained: the adoption of CCIP in December 2025, which added no minter on Ethereum, and the key rotation of September and October 2026, which changed no code and no economic rule.

Where the grade depends on judgement

What would change the grade

• A timelock on the owner, master minter and proxy admin. Three days moves admin capabilities from 2 to 4 and the admin score to 5 under either custody reading; seven days gives 6.
• A written description from Coinbase of the approval quorum behind the role addresses, or of the reason for the 2026 rotation, would settle the custody reading that this grade depends on.
• Any role change outside an orderly, multi-asset rotation, or any new minter, allowance increase or upgrade on Ethereum, calls for a re-read of the admin score.
• Publication of a tier 1 audit covering FiatToken v2.1 moves audits to 4.
• A use of the blacklister against a lending protocol's contract would freeze every position in it. It has not happened.

Grades are point-in-time assessments and are not credit ratings.

Used in

• M-009, cbBTC/USDC: an oracle that sees bitcoin, a market that leans on one borrower, and thin onchain depth that sets the cap S

Onchain reference

WETH: sixty immutable lines that nobody controls

About sixty lines of immutable code with no owner, no administrator and no way to create a token other than depositing one ether. Every pillar scores at the top; the only judgement call that could move the grade is how to treat a bug bounty for code that cannot be fixed.

What the asset is

WETH9 is the canonical contract that wraps ether into an ERC-20. It holds ether and issues one WETH per ether deposited; it burns WETH and returns ether on withdrawal. It has no issuer, no governance and no administrator. Stake DAO's own grading guide uses it as the example of the top grade, which made it a useful calibration case.

This review grades the asset alone. It does not opine on any market, oracle, cap or LLTV.

Pillar results

Criterion by criterion

How the pillars combine, as set in the scoring sheet since its September 2026 revision: Issuer takes the better of Social and Decentralisation; Asset and token takes the worst of its criteria; Operational is the average of its scored criteria, rounded to the nearest. A criterion recorded as not applicable is left out of the average and is not a red flag. The layer takes the worst pillar.

The token: sixty lines that nobody controls

WETH9 (0xC02aaA39…) was deployed on 12 December 2017 by a DappHub address and compiled with Solidity 0.4.19. We read the contract creation record and the Etherscan verified source.

What is absent matters more. There is no owner, no restricted function, no pause, no blacklist, no mint path other than deposit(), and no proxy (Etherscan reports Proxy = 0). Nobody can change anything in the contract, including its authors. No single actor and no coalition can mint unbacked WETH, freeze a holder or move the reserve. There is no key to steal and no multisig to identify.

Reserves by construction. Because totalSupply() is the ether balance, there is nothing to report: on 28 September 2026 both read 2,061,169.294, onchain, about $5.5bn. They can diverge in one direction only. Ether forced into the contract without calling deposit() raises the balance without minting tokens, so WETH can be over-backed, never under-backed. Zellic's formal verification proved exactly this property. Any holder can redeem one for one, at any time, in one transaction.

Two behaviours integrators should know, neither of which affects the asset's value:

• withdraw() uses transfer, which forwards 2,300 gas. A recipient contract that needs more gas to receive ether cannot unwrap directly; its WETH is not lost and can be unwrapped from another address.
• transferFrom skips the allowance check when the caller is the source. Trail of Bits noted it as a deviation from common ERC-20 behaviour in 2017.

What WETH inherits from Ethereum. Execution rules change through hard forks: Pectra (7 May 2025), Fusaka (3 December 2025), and Glamsterdam, targeted for the fourth quarter of 2026 according to press reports. A fork changing the gas semantics withdraw() relies on would be the one relevant scenario; it would affect a very large number of contracts and would be debated long before activation. A consensus failure would hit WETH and every other asset on the chain alike. The framework does not score the chain.

Bridges. Mainnet WETH can only be created by depositing ether into WETH9. Rollup and sidechain bridges escrow ether or WETH on mainnet and issue their own representations elsewhere. An exploit there would release or strand stock, a price event, never a solvency event for mainnet WETH. This is the opposite of custodial wrappers such as WBTC, whose native deployments on other chains share the same reserve.

Three reviews of the same sixty lines

WETH9 predates the audit culture of 2018 onwards. We looked for every independent review of this exact code, then checked who signed each one, its scope, and whether it can be tied to the deployed bytecode.

A false friend: Trail of Bits' separate Sai assessment (September to October 2017) does not cover WETH, although Sai used it as collateral. Under the audit grid as revised in September 2026, two audits including one tier 1 grade 5. Counting Zellic as a third would give 6. Nine years in production, no loss attributed to the contract.

Bug bounty. The Ethereum Foundation's programme (up to $1m) covers clients, specifications, the Solidity and Vyper compilers and the deposit contract, not token contracts. Nothing covers WETH9. The criterion is published as not applicable: a bounty pays for disclosure so code can be fixed, and WETH9 cannot be fixed. The standing incentive to find a flaw in it is the $5.5bn it holds.

Peers. Gauntlet, Steakhouse and kpk supply the Morpho WETH/USDC market, read onchain through the Morpho API on 28 September 2026. Stake DAO also counts Aave, Curve's crvUSD mint markets and K3 Capital, which accept WETH in their own venues.

Where the grade depends on judgement

On the bug bounty: scored 1, it lowers the Operational average to 5 and the layer to S, and it adds a red flag that, through the cap by count, would hold any market using WETH at A or below. That is why the treatment matters more here than the score suggests. We agree with publishing it as not applicable.

What would change the grade

• Very little at the token level: the contract cannot change, Lindy and TVL are at their maximum.
• A hard fork altering the gas semantics of transfer would call for a re-read of the reserves criterion.
• A change in the treatment of bug bounties for immutable contracts, or in how reviews predating 2018 are counted, would move the Operational pillar as set out above.

Grades are point-in-time assessments and are not credit ratings.

Used in

• M-008, WETH/USDC: the token is not the risk, ETH's occasional volatility is S+

Onchain reference

WBTC: an immutable token whose risk lives in three multisigs

WBTC's risk is not in the code. It sits in three multisigs, two on Ethereum and one on Bitcoin, in who holds their keys, and in a custody arrangement renegotiated in August 2024 and announced for renegotiation again in March 2026. Grade S on the reading of the admin score recorded in the sheet; B on the strict worst-path reading.

What the asset is

WBTC is the oldest and largest wrapped bitcoin on Ethereum: about 116,000 WBTC on mainnet, an ERC-20 minted 1:1 against bitcoin held by a custodian. Minting runs through a permissioned workflow between three roles. A merchant (a KYC'd institution; 48 are registered) requests a mint after sending bitcoin; the custodian (one registered address, a BitGo wallet) confirms once the bitcoin has arrived; the Factory contract then mints to the merchant. Burns run the same way in reverse. A registry contract holds the custodian address and the merchant list.

Assessment data as of 16 to 30 September 2026; onchain reads dated where they appear. This review grades the asset alone. It does not opine on any market, oracle, cap or LLTV.

Pillar results

Criterion by criterion

How the pillars combine, as set in the scoring sheet since its September 2026 revision: Issuer takes the better of Social and Decentralisation; Asset and token takes the worst of its criteria; Operational is the average of its six criteria, rounded to the nearest. The layer takes the worst pillar.

What a reader should know before accepting the S

1. Two Ethereum multisigs can each mint WBTC on their own, without any bitcoin moving. A 6-of-10 owns the token controller and can re-point the minter; a 5-of-9 owns the merchant and custodian registry and can appoint itself to both roles. Six of the ten and two of the nine signers are not publicly identified, and the six unidentified ones alone reach the first multisig's threshold.
2. The 6-of-10 was installed on 28 March 2025 without a pull request, an announcement or any press coverage. The WBTC GitHub still lists the previous 8-of-13.
3. The bitcoin reserve sits in a 2-of-3 multisig that the best public evidence puts at two keys for BitGo and one for BiT Global. A post on WBTC's own Medium account on 2 March 2026 announced the reverse, effective 1 May 2026. Nothing confirms it happened, nothing denies it.
4. The admin score was taken from the bitcoin wallet, not from the weakest path. Scoring every path and taking the worst gives 3, which would move the asset layer to B. Both readings are set out below.

What is solid: the token contract is immutable and has nothing in it that can be upgraded; reserves exceed supply and the Ethereum figure matches the contract exactly; no bridge can mint mainnet WBTC.

The token: immutable, and not where the risk is

The WBTC contract is a Solidity 0.4.24 contract deployed on 24 November 2018, verified, not a proxy. It combines the OpenZeppelin mintable, burnable and pausable patterns. There is no blacklist. finishMinting() is hard-coded to return false, so minting can never be locked off; renounceOwnership() reverts, so the privileged role can never be given up. Its owner is the Controller contract, which exposes mint and burn (callable only by the Factory) and pause, setFactory and setMembers (callable only by the Controller's owner). All of this is read from the verified source.

Reserves. The wbtc.network transparency dashboard listed every custody address with a Blockstream link and showed, on 3 September 2026, 116,512.0029 BTC in reserve against 116,499.2018 WBTC in circulation across all chains, of which 116,132.1827 on Ethereum. The Ethereum figure matches totalSupply() on the token exactly. Reserves exceed supply by about 12.8 BTC. Redemption is not atomic (merchant plus custodian confirmation), which is why the criterion scores 5 rather than 6.

Who can mint: the single-actor analysis

The question that organised this review was not "how many signers" but "what can one party do on its own". Every path to an unbounded mint was traced through the verified source.

The 5-of-9 registry owner, alone. setCustodian() and addMerchant() carry no check preventing the same address from holding both roles. addMintRequest() accepts any amount and any string as the bitcoin transaction id; the only check is that a deposit-address string matches one the custodian itself registered. confirmMintRequest() then calls controller.mint(). Nothing on Ethereum verifies that bitcoin moved. The 5-of-9 can appoint itself custodian and merchant and mint without limit.

The 6-of-10 controller owner, alone. setFactory() is owner-only; pointing it at a contract that calls controller.mint() gives unlimited minting. setMembers() replaces the registry outright, overriding the 5-of-9.

The custodian plus any one merchant. A merchant requests an arbitrary amount, the custodian confirms. Two organisations, one of which can be any of the 48 merchants. HTX, Justin Sun's exchange, was added as a merchant in November 2024.

The bitcoin multisig. Whoever holds two of the three keys can move the entire reserve.

The merchant and custodian separation is real at the operational level and worth nothing against the body that assigns both roles. An unbacked mint does not need to be sold on the spot market to be extracted: posted as collateral in a lending market, it can be borrowed against in the same transaction, so the amount at risk is bounded by borrowable liquidity rather than by how visible the mint is.

Who holds the keys

The 6-of-10 (0x972eEd35…, a Gnosis MultiSigWallet from 2017, not a Safe; threshold and owners read onchain on 16 September 2026). Four signers identified against the WBTC DAO's GitHub member list and their 2022 verification tweets: Balancer (an address resolving to solarcurve.eth, a contributor's personal wallet rather than an institutional one), BitGo, Chainlink and Tom Bean of B.Protocol. Six unidentified: one Safe and five externally owned accounts. Those six reach the threshold of six without any identified signer.

The 5-of-9 (0x4dbbbFb0…, same contract type, owner of the registry since June 2019). Three identified from the GitHub merchant and custodian lists: Kyber, the BitGo custodian address, Aave. Four attributed by Protos in February 2026, a third-party attribution: Maker, Tom Bean, and two BitGo wallets (both WalletSimple contracts, consistent with what we read onchain). Two unattributed, one of which also sits on the 6-of-10. Protos identified the five signatures that approved HTX as a merchant as Kyber, Tom Bean and three BitGo addresses: BitGo plus any two others can add a merchant.

The migration nobody announced. The OwnershipTransferred log on the Controller reads: 22 December 2018 to an 11-of-18; 10 January 2023 to the 8-of-13 (0xB33f8879…), with a GitHub pull request, a tweet from every new member and press coverage; 28 March 2025 to the current 6-of-10, with nothing. Six months after the BiT Global joint venture, nine of the thirteen members (Kyber, Compound, Loopring, RiskDAO, Krystal, Badger, Gopax, and the defunct Multichain and Ren) were replaced by six addresses that were never named. The transfer was executed by the 8-of-13 itself, so it was a legitimate DAO action. The DAO's own audit guide tells members to verify the controller owner against the GitHub; that check has failed against their own documentation for eighteen months.

The bitcoin custody. Five independent sources from August 2024 to March 2025 (Blockworks, AmbCrypto, Protos, NYDIG, Steakhouse Financial's "Wrap Battle") converge on the arrangement adopted after the community backlash of August 2024: BitGo holds two keys (BitGo Inc. in the US, BitGo Singapore Pte Ltd), BiT Global holds one in Hong Kong. This is the reverse of the initial proposal that would have given BiT Global two keys, which is what caused MakerDAO to remove WBTC as collateral that autumn. Then, on 2 March 2026, WBTC's Medium account published a post datelined Hong Kong and framed as a BiT Global announcement: a "next phase" transition, targeted for 1 May 2026, under which BiT Global would hold both the user key and the backup key and BitGo one. An exact-phrase search returns only that post: no BitGo statement, nothing on wbtc.network, no coverage. For a change of key control over roughly $9bn, after an episode in 2024 that generated dozens of articles and a Sky exit, that silence is itself a fact.

A Bitcoin multisig proves a threshold over a set of raw public keys and nothing more. Who holds which key is always an off-chain disclosure by the parties. The 2024 arrangement is corroborated; the 2026 one is a single announcement without a trace.

The admin score: what was scored, and what the worst path gives

The September 2026 grid scores admin capabilities as impact crossed with execution delay, then crosses that with the custody infrastructure of the keys. Applied to each path separately:

Stake DAO scored the criterion 5, on the bitcoin wallet. The reasoning recorded in the sheet: the two Ethereum multisigs contain a good share of identified external signers, so a fraudulent mint requires a knowingly wrongful signature; the size of the asset makes a large extraction visible; the 6-of-10 can push a rapid pause; and a $100m unbacked mint would dilute backing by about 1.1%. On that reading only the bitcoin custody, the deepest and best-defended key set, is scored.

The other reading: worst-of is the framework's own rule; the 6-of-10 is itself one of the attack paths and would not pause an action it took; and extraction through a lending market is atomic, not slow. On that reading the criterion is 3, the Asset and token pillar is 3 and the asset layer is B. The two readings converge the day the WBTC DAO publishes its signers: with ten identified organisations the 6-of-10 moves to 4 or 5 on custody infrastructure and the worst path scores 4.

BitGo's standing is a fact in both readings: it listed on the New York Stock Exchange on 22 January 2026 under BTGO and holds a national trust bank charter from the OCC. BiT Global is a Hong Kong TCSP licensee associated with Justin Sun.

Bridges

The bitcoin-to-Ethereum wrap is WBTC's business and is scored above. Downstream of mainnet, three families, measured on 23 September 2026:

• Lock-and-mint escrows. Arbitrum gateway 7,367 WBTC, Wormhole 2,546, Polygon PoS 1,940, Optimism 703, Linea, Scroll and Movement under 42 combined: about 12,600 WBTC, 10.8% of the Ethereum supply. None of these addresses is in the 48-entry merchant list. They hold stock; an exploit releases it onto the market, a price event, and cannot mint mainnet WBTC or touch the reserve.
• LayerZero OFT. The Ethereum leg is WBTCOFTAdapter, a lockbox holding 949.79 WBTC. Its owner and LayerZero delegate are one BitGo wallet. Sends to BSC and Avalanche require three of three DVNs (LayerZero Labs, Nethermind, BitGo) with 15 confirmations, read from EndpointV2.getConfig. The destination OFT contracts have no merchant or custodian functions, so OFT WBTC cannot be redeemed for bitcoin without first unlocking mainnet WBTC: exposure is capped by the lockbox.
• Native deployments. About 367 WBTC circulate outside Ethereum as custodian-minted tokens sharing the reserve, around 100 of them on a dormant Tron contract. This is the only channel that could dilute mainnet backing, bounded by its size and by the custodian's off-chain reconciliation.

Scored 5. Mainnet WBTC is structurally insulated; the residual is the small native legs.

Operational signals

Audits. One audit covers the full Ethereum stack: ChainSecurity, October 2018, before launch, two findings resolved before deployment. Nothing since on the core contracts. One full-scope audit scores 3 under the grid revised on 29 September 2026.

Bug bounty. None covers the WBTC contracts: nothing on Immunefi or HackenProof, no security policy in either WBTC repository. BitGo runs a Cantina programme since March 2026, up to $75,000 for a critical finding, scoped to its own wallet repositories, with "trust assumptions involving BitGo-operated multisignature ownership" explicitly excluded. Because the registered custodian, the OFT adapter owner and two signer seats are WalletSimple instances, the wallet code holding those keys is in scope; the contracts that mint, burn, pause or re-point WBTC are not. Scored 2 on that indirect coverage.

External assessments. CertiK Skynet 90% (A). Credora rates the asset by construction of its Morpho methodology; its values sit behind its application. Scored 6.

Peers. Fifteen reference curators on the Morpho WBTC/USDC market by Stake DAO's count. Beyond Morpho, WBTC is collateral on Aave and was reactivated on SparkLend in March 2026 after an 18-month review that followed the 2024 custody episode. Scored 6.

Where the grade depends on judgement

The scoring sheet's issuer comment records the May 2026 key split as effective. This review does not: it is a single announcement that no other source confirms.

What would change the grade

• Publication by the WBTC DAO of the ten and nine signers, with an updated GitHub, lifts the weakest Ethereum path from 3 to 4 or 5 and removes the gap between the two admin readings.
• A statement from BitGo on the bitcoin key distribution, and whether the March 2026 announcement was executed, settles the question this page cannot. If BiT Global now holds two of three keys, the custody-infrastructure column changes, the admin score should be re-read, and so should the Lindy reference date.
• A bug bounty scoped to the WBTC issuance contracts, or a second audit of the registry and Factory in light of the same-address custodian-and-merchant path, would move the Operational pillar.

Grades are point-in-time assessments and are not credit ratings.

Onchain reference

crvUSD: an immutable token inside a system that keeps changing

The token contract cannot be changed and its minter has been locked since May 2023. The grade is set by everything around it: a bridge footprint across three families, a minting perimeter that has changed a dozen times in a year, and no reference curator taking the asset as collateral.

What the asset is

crvUSD is Curve's CDP stablecoin, live since May 2023, with a circulating supply around 209m at the assessment date. It is minted against collateral in soft-liquidation markets (LLAMMA), by peg keepers, and since September 2025 through a credit line to Yield Basis. The token contract is a plain Vyper contract with no proxy, no pause, no freeze and no blacklist.

This review grades the asset alone. It does not opine on any pool, market, cap or LLTV.

Pillar results

Criterion by criterion

How the pillars combine, as set in the scoring sheet: Issuer takes the better of Social and Decentralisation; Asset and token takes the worst of its criteria, with admin capabilities and governance security first averaged and rounded down; Operational is the average of its six criteria, rounded down. The layer takes the worst pillar.

The token is not where the risk is

Read from the verified source and the complete event history:

• The token contract is immutable. No pause, no freeze, no blacklist and no upgrade path anywhere in the source.
• The minter role has been locked to the ControllerFactory since 14 May 2023: only two SetMinter events exist, and the factory contains no call path back to set_minter.
• Supply changes exist only at system level, through set_debt_ceiling, and require a seven day public vote with a 30% quorum, which needs several independent large holders to reach. There is no timelock contract; the vote is the delay.
• Since 11 November 2025 the factory admin is a DualAdmin contract. The Emergency DAO, a 5-of-9 Safe, acts instantly but is restricted onchain to risk-reducing supply actions: it can lower ceilings, not raise them, and cannot mint, freeze or add markets. It can, however, swap the monetary policy and change fees at once, which affects borrowers rather than holders.

Bridges: small, but in three families

crvUSD is mintable only on Ethereum. About 2.37M crvUSD, roughly 1.1% of supply, sat in Ethereum escrows on 16 July 2026, about 99% of it behind canonical rollup bridges. Curve also operates LayerZero-based bridges and a FastBridge overlay, whose Ethereum-side owner is a DAO-controlled proxy with a kill-only emergency admin. No externally owned account was found in control of any Curve-operated bridge contract checked, and Curve halted its LayerZero infrastructure preventively in April 2026 after an unrelated exploit, then resumed. Bridge risk to mainnet holders is small; the score of 3 reflects the number of families and owners, not the amount.

A minting perimeter that keeps moving

Lindy is anchored on the extension of the Yield Basis credit line to 1B crvUSD in December 2025, the most material standing change to how the asset can be issued. It is one of about a dozen perimeter changes between March 2025 and April 2026: new peg keepers, a tripled peg-keeper capacity, the Emergency DAO extension, a new monetary policy, a larger flash-loan cap and a change to the aggregated price oracle. The code is immutable; what it is wired to is not.

What would change the grade

• Lindy crosses twelve months on 12 December 2026 and would then score 4, provided the minting perimeter does not change again first. The Operational average would reach 4, but the Asset and token pillar would hold the layer at B.
• The Asset and token pillar is bound by bridge risk at 3: a consolidation of the bridge families, or ownership arrangements the grid scores higher, would be needed to lift it.
• A reference curator accepting crvUSD directly as collateral would lift Peer reviews.
• Any governance change adding an uncollateralised minting pathway would call for an immediate re-assessment.

Scored under the grids in force at the assessment date. Not yet re-run under the September 2026 revision.

Onchain reference

sDOLA: sound governance, held at B by a young peg module and a single audit

Governance is onchain, dispersed and guarded. The grade is set by the operational record: a peg stability module redeployed five months before the assessment, one formal audit of a narrow scope, and a middling external rating.

What the asset is

sDOLA is the yield-bearing wrapper over the DOLA Savings Account, which streams rewards to staked DOLA and compounds them. DOLA is Inverse Finance's CDP stablecoin, live since 2021 and governed onchain by INV holders. The sDOLA contract is not a proxy (read onchain).

This review grades the asset alone. It does not opine on any pool, market, cap or LLTV.

Pillar results

Criterion by criterion

How the pillars combine, as set in the scoring sheet: Issuer takes the better of Social and Decentralisation; Asset and token takes the worst of its criteria, with admin capabilities and governance security first averaged and rounded down; Operational is the average of its six criteria, rounded down. The layer takes the worst pillar. Bridge risk is not a criterion in the template version used for this assessment.

Why Lindy and audits weigh most

Lindy. The reference date is the December 2025 redeployment of the peg stability module, which carries DOLA minting rights. Verified onchain at the assessment date: the module had minted zero DOLA, operates on a non-permissionless mechanism, and is capped by governance vote at 10M DOLA. The criterion is time based and was always going to improve.

Audits. Formal audit coverage is limited to three files, audited by yAudit in January 2024. The December 2025 module redeployment has no formal external audit, only internal review layers, which do not substitute for one.

Governance

Governance is fully onchain, with voting power split roughly 75% community, 13.85% to the named founder and 11.4% to the rest of the team. A dual-stage guardian requires the founder to authorise a cancellation and a team multisig to confirm it. That raises the bar on executing an unauthorised proposal without removing governance risk: unbacked minting through a governance attack remains the structural risk of the asset, mitigated by dispersed voting power and the guardian.

What would change the grade

• Lindy crossed six months around 20 June 2026 and now scores 3. The Operational average reaches 3.67, which still rounds down to 3: the grade does not move on Lindy alone.
• A formal external audit of the redeployed peg stability module would lift Audits. At 4, with Lindy at 3, the Operational average reaches 4 and the layer A.
• A material change in the distribution of voting power, or in the guardian's composition, would call for a re-read of Decentralisation and governance security.

Scored under the grids in force at the assessment date. Not yet re-run under the September 2026 revision.

Onchain reference

sUSDS: the grade is set by who can upgrade the contract, not by its size

The largest asset in the series, with the strongest operational record. The grade is set by the token's technical design: an upgradeable proxy whose admin is governance behind a delay of sixteen to thirty hours, in a vote where one delegate held about 45% of the power.

What the asset is

sUSDS is the savings token of the Sky protocol (formerly MakerDAO): holders deposit USDS and receive a share that accrues the Sky Savings Rate. About 5.93bn sUSDS were outstanding at the assessment date, redeemable for roughly 6.5bn USDS. The token is an ERC-1967 proxy (read onchain) upgradeable under the UUPS pattern by the protocol's governance pause proxy.

This review grades the asset alone. It does not opine on any pool, market, cap or LLTV.

Pillar results

Criterion by criterion

How the pillars combine, as set in the scoring sheet: Issuer takes the better of Social and Decentralisation; Asset and token takes the worst of its criteria, with admin capabilities and governance security first averaged and rounded down; Operational is the average of its six criteria, rounded down. The layer takes the worst pillar. Bridge risk is not a criterion in the template version used for this assessment.

What sets the grade

Two structural elements, both about control rather than about the asset's economics.

An upgradeable token behind a short delay. sUSDS is an upgradeable proxy whose admin is the protocol's governance pause proxy. Any executive vote that passes can replace the implementation after a delay of sixteen to thirty hours. Upgradeability and pause behind a delayed admin is ordinary practice in production DeFi, and under this grid it still scores admin capabilities at 2, which caps the technical sub-pillar at 3 and the layer at B.

Concentrated voting power. Governance is onchain and active, but the largest delegate held about 45% of effective voting power and two delegates together about 80%. That holds Decentralisation at 5 rather than 6. It does not move the grade, because the Issuer pillar takes the better of its two halves, but it is the dominant qualitative risk to watch: the delay is only as protective as the diversity of the voters behind it.

The tail scenario, quantified

A risk-capital tranche (stUSDS) funds a collateralised borrowing module whose largest positions are concentrated. Sky's documentation states that the tranche absorbs bad debt first and is isolated from savings-token holders, while also acknowledging that slashing it could still affect other parts of the system. Worked through at the assessment date: a borrowed portion of about 138m, 70m absorbed by the surplus buffer, an unabsorbed residual near 68m, or 0.58% of the 11.7bn stablecoin supply, which protocol revenue would replenish in two to three months. It is reflected through the Decentralisation and Lindy criteria and through monitoring, not through a separate downgrade.

What would change the grade

• Only a change in the technical design moves the layer: a non-upgradeable token, or a materially longer delay with a wider set of independent voters, would lift the technical sub-pillar.
• A further concentration of voting power in one or two delegates would lower Decentralisation, and through it the case for the current reading of governance security.
• Lindy crossed twelve months on 4 September 2026 and now scores 4; the Operational pillar stays at 5.
• Any loss absorbed by stUSDS large enough to reach savings-token holders would call for an immediate re-assessment.

Scored under the grids in force at the assessment date. Not yet re-run under the September 2026 revision.

Onchain reference

scrvUSD: governance-run savings vault, held at B by its operational record

A sound issuer and a token that governance, not a multisig, controls. The grade is set by the operational record: one audit covering the vault code actually deployed, no curator yet using it as collateral, and a connected system that changed four months before the assessment.

What the asset is

scrvUSD is the savings vault of crvUSD, Curve's CDP stablecoin. Holders deposit crvUSD and receive a share whose value rises as the vault receives part of the stablecoin's fees. The vault is a Yearn V3 vault (release 3.0.3) whose admin is Curve's onchain governance. Redemption into crvUSD is permissionless; the reserves are visible onchain but are not instantly redeemable into dollars.

This review grades the asset alone. It does not opine on any pool, market, cap or LLTV.

Pillar results

Criterion by criterion

How the pillars combine, as set in the scoring sheet: Issuer takes the better of Social and Decentralisation; Asset and token takes the worst of its criteria, with admin capabilities and governance security first averaged; Operational is the average of its six criteria, rounded down. The layer takes the worst pillar. Bridge risk is not a criterion in the template version used for this assessment.

Why the operational pillar sets the grade

• Audits score 2. The Yearn V3 release actually deployed, 3.0.3, includes the self-reporting mechanism that makes this asset what it is, and it is not covered by the audits of the earlier releases (3.0.0 and 3.0.1). Counting those audits by adoption would give a better score and a less accurate one. Two low-severity GitHub security advisories are open on 3.0.3.
• Peer reviews score 2. No other reference curator took scrvUSD as collateral at the assessment date.
• Lindy scores 2. It was read on three levels: the scrvUSD contract (immutable, about 17 months), the crvUSD contract (immutable since May 2023), and the connected economic system, which changed most recently. The reference date is January 2026, when WETH was added to Yield Basis, which is funded through the crvUSD credit line.
• The external-ratings score of 6 is generous on one point: the DeFiSafety figure rates Curve as a protocol, not scrvUSD specifically.

Admin capabilities

The vault's admin is Curve's onchain governance, so any change to the vault goes through a seven day public vote. That is a strong form of control, and the grid still scores admin capabilities at 2, because mint, burn and parameter powers exist behind it. The Curve Emergency DAO, a 5-of-9 multisig, has no direct role on scrvUSD today; its powers were extended in November 2025 over crvUSD economic parameters, which affects the yield rather than solvency.

What would change the grade

• Lindy is time based. Measured from January 2026 it crossed six months in July 2026 and now scores 3. With no other change the Operational average reaches 3.5, which still rounds down to 3: the grade does not move on Lindy alone.
• A dedicated audit of Yearn V3 3.0.3, or of scrvUSD on that release, would lift Audits and with it the Operational pillar.
• A reference curator accepting scrvUSD as collateral would lift Peer reviews.
• Any governance vote giving the Emergency DAO a direct emergency role on the scrvUSD contract would lower Admin capabilities from 2 to 1, a red flag.

Scored under the grids in force at the assessment date. Not yet re-run under the September 2026 revision.

Onchain reference

sfrxUSD: the price per share is an admin-set number

An asset rating we have not closed. We publish the finding that matters for anyone pricing this collateral, and we do not publish a grade while the open items stand.

The headline finding

On Ethereum, sfrxUSD does not behave as a vault. The implementation stores a price per share and a per-second rate and computes the price by continuous compounding. ERC-4626 deposit and redeem are disabled, and supply moves only through whitelisted minters. The setters for those pricing parameters are gated by a role named timelock which is, onchain, a 3-of-6 multisig with no delay and no drift or rate cap. It has been used in production.

The consequence for a lending market is direct: any oracle reading the price per share takes its input from a value that multisig can set arbitrarily, up or down, in a single transaction. Collateral pricing integrity for such a market reduces to trust in that multisig. That is why we are not publishing a grade from a questionnaire reading alone.

Two things we checked, one each way

• An earlier concern that an externally-owned account retained admin over the bridge lockbox is cleared. The deployer held admin only within the deployment block; it resolves to a proxy admin owned by a 24 hour timelock under a 4-of-7 multisig
• The rate limiter announced after the April 2026 bridge incident is verified negative on this lane. The lockbox implementation contains no rate limit and no pause, and the contract has not been upgraded since October 2025. Containment would rely on the owner changing configuration reactively

Onchain reference

Frax Ecosystem Accelerator: a capped vault that lends frxUSD against partner collateral reviewed in a day

A Morpho vault that lends frxUSD against collateral from projects building frxUSD liquidity. Collateral is admitted after a one-day review rather than a full assessment, so what protects depositors is sizing: hard caps, conservative LLTVs and caps that can be cut in minutes.

What the vault is

The Frax Ecosystem Accelerator is a Morpho vault curated by CrossWorlds and sponsored by Frax. It lends frxUSD to borrowers who post LP tokens of Curve pools paired with frxUSD, held through Stake DAO vaults. Its purpose is narrow: give partner projects of the Frax ecosystem a lending market against their frxUSD liquidity early, when a full assessment would come too late or would not pass yet.

The trade-off is explicit. A full assessment tries to measure how likely a loss is. This review asks two questions only:

1. Is there an unbounded risk of total loss? The eliminatory filters answer it.
2. If things go wrong, is the loss survivable at the size we allow? Caps and LLTVs answer it.

Volatility, drawdown and oracle heartbeat are not modelled. Protection comes from size, monitoring and fast cap cuts. A market that needs a cap above its tier goes through a full assessment first, which is also the route towards our graded vaults.

How collateral is admitted

Thirteen filters. A single failure keeps the collateral out. Filters marked with an asterisk can be waived for a newly launched project, under the conditions set out further down.

A few conventions apply to every review. "Identified signer" includes signers whose identity is known to CrossWorlds under a confidentiality agreement; the listing then says so, without naming them. When an asset can be redeemed atomically into another, as sGHO into GHO, the liquidity of the underlying counts towards A12. A13 is settled with each project after the market is accepted in principle.

How a market is sized

Three yes or no tests set the ceiling. They are aligned on the lower scores of our full grids, so that a market can later move to a full assessment without starting over.

The cap of each market is then the lowest of: the tier ceiling; 20% of the vault's total assets; and 30% of the collateral pool's TVL, measured onchain as it stands, loops included. Looped liquidity is not independent exit liquidity, since it unwinds when the collateral falls, which is why the share is held at 30%. LLTV is set by collateral type rather than modelled: 86% for stablecoin LPs, 77% under the derogation.

First-loss deposit. A partner, or Frax, can post 10% of a market's cap in a multisig co-controlled with CrossWorlds. The position is supplied to the market and is junior by agreement: if the market takes bad debt, it compensates the other depositors first, up to its full amount. In exchange it unlocks either one LLTV step (91.5%) or a low-tier ceiling of $1M. Juniority is contractual, not enforced onchain.

New projects. A project launched less than three months ago can be listed at a fixed $200k cap, LLTV 77%, with a mandatory first-loss deposit of $20k, if Frax introduces it and every other filter passes. Liquidity ratios do not apply during that period. At three months the market moves to the standard rules, and its cap follows them.

How risk is managed after listing

Peg readings are sized quotes, the sale of 10% of the market's cap, not quoted prices. A cap at 0 stops new lending but cannot withdraw funds already borrowed; only unborrowed liquidity can be moved. Every market is reviewed at 90 days, or 30 days under the derogation.

First markets

Five markets passed the filters on 20 October 2026. Figures are read from the Curve and Fluid APIs and from onchain calls on that date; caps move with pool depth.

The five caps add up to $3.2M. Until the vault holds $10M, the 20% limit binds before the sfrxUSD ceiling.

frxUSD/sfrxUSD

sfrxUSD is Frax's own savings token. It is placed in the high tier by decision, because Frax sponsors the vault; on the grid alone B1 would fail, since upgrades, minting and the price per share are all set by multisigs without a timelock. On Ethereum the price per share is a number that a 3-of-6 multisig can set, which our open note on this asset describes. The listing is conditional on the signers of that multisig being identified to CrossWorlds. The audit coverage of the January 2026 implementation is still to be confirmed (B2).

frxUSD/USD3

USD3 is the senior tranche of 3Jane's unsecured USDC credit lines. All three B tests fail: no signer identified, no tier 1 audit, and an upgrade on 25 September 2026. Two points are accepted with conditions. Backing is visible onchain as loan positions, but borrower creditworthiness is not, and the loan book is not attested. The price per share falls only when a loss is reported, so the market's oracle has to account for a pending loss.

frxUSD/trUSD

trUSD passes every test, with its signers known to CrossWorlds under a confidentiality agreement. Its Curve pool fell from $3.06M on 6 October to $1.06M on 20 October, which cut the cap from $918k to $319k. Fluid now carries most of the counterparty liquidity. Reserves are held offchain and attested by a third party. Two points are open with the issuer: a timelock contract deployed in September whose code differs from the audited one, and an unidentified administrative call in the same month.

frxUSD/sUSDe

sUSDe passes every test. The token cannot be upgraded, and minting USDe requires a one-day timelock that only defensive actions bypass. The issuer's documentation states a 7-signature multisig and a 7-day delay, where onchain we read a 5-of-10 multisig and one day: we have asked for the difference to be clarified.

frxUSD/sGHO

sGHO passes every test. Its upgrades go through Aave governance plus a one-day delay, and it has no cooldown, so it can be exchanged for GHO at once. The pool itself holds only $119k of frxUSD; a large liquidation would route through GHO.

Reviewed and not listed

Four other frxUSD pools were reviewed on the same dates and are not listed. Two missed the $500k pool minimum, one of them together with an admin key held without a timelock or identified signer. One is pending a call with its team on how its supply is backed. One review was postponed. We publish their findings once the projects have had the chance to respond.

What would change a listing

• A filter failing later, including a pool falling below $500k, moves the cap to 0 and stops new lending.
• trUSD and sUSDe caps are set by pool depth: they rise or fall with it, checked daily.
• The sfrxUSD listing lapses if its pricing signers are not identified.
• A project asking for more than its tier allows goes through a full assessment.

Onchain reference

Admin keys: what a role can do, how fast, and who holds the key

Most collateral failures are not code bugs. They are someone with a key doing something the holders did not expect. The admin score reads three things together: the power, the delay, and the custody of the key.

Why one score and not two

Until September 2026 the framework averaged two criteria, admin capabilities and governance security. An average let a strong multisig hide a dangerous power, and a harmless power drag down a well-run issuer. The two now go through a matrix: an unbounded power is acceptable only behind a long delay or a strong key, and a strong key does not make an instant upgrade harmless.

The score covers the whole stack that can change what the token is worth: the token contract, its proxy and upgrade path, the minter and every registry that can re-point it. Not the token contract alone.

Grid 1: what the role can do, and how fast

A delay counts only if it is enforced onchain and cannot be bypassed. A multisig confirmation window is not a delay. An emergency path that can execute unbounded actions cancels the timelock; an emergency path that can only pause does not. A pause behind a timelock is a pause that arrives too late, which is why "reversible only" scores 5 whatever the delay. Forty-eight hours is roughly the time a curator needs to set a cap to zero and reallocate away from a market.

Grid 2: who holds the key

"Needed" is read strictly: the threshold cannot be reached without that signer. The guiding question is not how many signatures, but what one party can do on its own. Wallets of one company, its employees and affiliates count as one party. Unidentified keys that can reach the threshold together count as one party. A separation of duties (minting and custody, minting and allocation) counts only if the roles sit with independent organisations and no single body can reassign both.

Grid 3: the admin score

The admin score enters the Asset and token pillar, which takes the worst of its criteria. When several bodies hold unbounded powers, each path is scored; the worst path is the default reading, and any other reading is written down with the worst-of result next to it.

Institutional key management behind a plain address

In October 2026 the custody grid gained a category for institutional MPC wallets and key sharding, at the level of a multisig with more than four signers.

The reason: some issuers hold their admin roles in plain externally owned accounts whose single key is in fact never assembled in one place. Multi-party computation splits it into shares held in separate environments, and a signature requires several approvers. Treating such an address like a key on one laptop would score a regulated custodian below a five-person multisig of anonymous signers.

The difficulty is that this cannot be seen onchain. An MPC address and a single-key address produce the same signature. So the category is applied on two conditions, both of which must hold:

1. A public statement by the issuer that explicitly covers the admin keys, not only its custody business in general: that the roles require approval from several people, that no individual controls a key, and how the key material is stored.
2. Onchain behaviour consistent with it: privileged keys used rarely and for their stated purpose, gas paid from the issuer's identifiable infrastructure, rotations carried out in an orderly way across products and chains, no economic action (mint, upgrade, pause) around a key change.

If either is missing, the address is scored on the EOA row. In every case the review states what could not be verified, starting with the approval quorum, which no outside reader can see. The first asset scored under this category is cbBTC, whose roles are Coinbase addresses; read on the EOA row it would have been one grade lower.

What we read onchain for every privileged role

• The current holder, through the role's getter or the proxy storage slots, re-read on the day of publication.
• The full history of role changes (OwnershipTransferred, AdminChanged, Upgraded, minter and registry events), not the issuer's documentation, which can lag by months.
• The contract type of each holder: a Safe or older multisig (threshold and owners), a timelock (its delay and its own admin), or an externally owned account (nonce, last use, and who funds its gas).
• Every path from a role to an unbounded mint, traced through the verified source, including registries that can appoint themselves to two roles meant to be separate.
• How an unbacked mint would be extracted. It does not need to be sold: posted as collateral in a lending market, it can be borrowed against in the same transaction. The amount at risk is bounded by borrowable liquidity, not by how visible the mint is.

How we size caps: from observable liquidity to liquidation ability

A cap is a claim about how much collateral can be sold, in a stressed market, before the position goes underwater. Here is how that becomes a number.

Start from the margin, not from the pool

The LLTV fixes the budget. At 91.5% there are 8.5 points between the liquidation price and insolvency, and every cost of unwinding has to fit inside them: the slippage of the sale, the liquidator's incentive, and whatever the price moves while the transaction is in flight. A cap is defensible when a sale of its full size, measured and not assumed, consumes a small fraction of that margin.

Then ask who else is selling

This is the step that distinguishes a usable cap from an arithmetically correct one. Depth is not reserved. If a third of an asset's supply is pledged elsewhere at high LLTV, those liquidators exit through the same venue, at the same moment, for the same reason. So the figure that matters is not total liquidity but liquidity net of the collateral that would be sold in the same event. In one assessment in this series that reduced a comfortable number to nothing the method could count, which is what produced the grade.

And keep the cap honest against the pool

For LP collateral, a cap that is a large share of the pool it sits in creates its own reflexivity: the collateral's value depends on depth that the cap itself is consuming. We hold caps well under a third of pool TVL and treat crossing that as a reason to re-examine pool health rather than a threshold to argue past.

• Measured slippage at 10% and at 100% of the cap, against the liquidation margin
• Exit liquidity outside the collateral pool, as a multiple of the cap
• That same liquidity net of collateral pledged elsewhere at high LLTV
• Cap as a share of pool TVL, and of the assessed asset's total supply
• Provider concentration, because depth held by few hands can leave

Where a measurement cannot be made, it is published as unmade. An unscored criterion is a better disclosure than a scored guess.

Why a single criterion can override three healthy layers

The framework takes worst-of at almost every level, then caps the result by the number of red flags. Averaging would be kinder and would describe the wrong risk.

Worst-of, almost everywhere

A layer takes the worst grade among its pillars, and most pillars take the worst grade among their criteria. The reason is that these are not dimensions of quality that trade off against each other. A deep, well-audited, long-lived asset whose contract can be re-pointed by three signatures is not a good asset with one flaw. It is an asset whose other qualities you hold at someone's discretion.

Three exceptions are written into the scoring sheet, each for a stated reason:

• Issuer takes the better of its two criteria, Social and Decentralisation. An asset needs either an accountable, reputable issuer or a product decentralised enough not to need one. It does not need both.
• Operational is the average of its six criteria, rounded to the nearest. Lindy, TVL, audits, bug bounty, external ratings and peer reviews are signals that corroborate each other; no single one of them describes how the asset can fail.
• Admin capabilities are crossed with key custody in a matrix rather than taken separately: what a privileged role can do, how fast, and who holds the key are read together. Our note on admin keys sets out the grids.

Every review states how its pillars combine, under its criteria table.

One review per layer

Each layer is published as its own review. An Asset review grades one asset, independently of any market it sits in. A Platform review grades one venue in the dependency chain: the AMM, the wrapper, the lending protocol. A Market review grades one Morpho market: its pool, its oracle, and whether the collateral can be sold at the size of the cap before a position goes underwater.

A market's grade is the worst of every review it depends on: each asset in the collateral, each platform, and the market itself. The Market review lists those components with their dates, and the grade is recomputed from them each time the site is published. When an Asset review changes, every market that relies on it changes with it.

Then red flags, which are separate

Any criterion scored D is a red flag, with one exception set out below. Red flags are added up across all the reviews a market depends on, and the total caps the market's grade.

This is what took one assessment in this series to D: its layers bottomed out at C, and four criteria at 1 capped it one step lower. The flags are listed by name in every review and in the market's eligibility table, because a grade compresses and a list does not.

Because flags are added up, a red flag in a Platform review reaches every market that runs on that platform. That is intended: a market is only as safe as everything it runs on.

The one exception: the two Issuer criteria

Social and Decentralisation are not counted as red flags, since October 2026.

The Issuer pillar takes the better of the two, by design. A regulated, listed company that runs everything itself scores at the top on Social and at the bottom on Decentralisation; an ownerless protocol does the reverse. Neither is a warning sign: each is one of the two acceptable ways to answer the question the pillar asks. Counting the low criterion as a red flag would cap every asset issued by a single accountable company at A, whatever the rest of the review found, which is not what the pillar is meant to say.

Nothing is lost by the exception. If both criteria score 1, the pillar itself scores 1, and the Asset layer falls to D through the worst-of rule, which is stronger than any cap.

The change was made while reviewing cbBTC, whose Decentralisation scores 1 and Social 6. No review published before it had either Issuer criterion at 1, so no other grade moved.

A criterion that does not apply

A criterion that does not apply to an asset is published as not applicable, with the reason. It is left out of the pillar's calculation and is not a red flag. The case so far is the bug bounty of an immutable, ownerless contract: a bounty pays for a flaw to be disclosed so it can be fixed, and that code cannot be fixed. An unscored criterion is never published as a scored guess.

What this framework deliberately does not do

• It does not let a strong issuer offset a weak contract. Those are different failure modes, scored in different pillars, and the layer takes the worse of the two
• It does not score an unverified claim as though it were verified. It scores what was evidenced and records the rest as open
• It does not quietly re-score an inconvenient criterion. Where we think a criterion misreads a specific market, the adjustment goes to governance as an explicit vote, with the raw measurement left in the sheet
• It does not treat a grade as permanent. Several criteria are time based and improve on their own, which is why caps and re-assessment triggers carry the weight that a grade alone cannot