Vault Risk Methodology
How we score vault risk and decide what’s safe to list
Risk Tiers
Each vault receives a risk score from 0–100 (higher = riskier), which maps to a tier:
Safety Grade
The headline signal on every vault is a letter grade from A+ to F. It’s computed from a safety score (0–100, the inverse of the risk score — so higher is safer), then mapped to a grade:
Hard caps stop solid engineering from masking an active problem: a vault in the medium-risk range can’t grade above B+, the high-risk range above C+, and one in the critical range — or with a blocking redemption state — is capped at D no matter how well-built it is.
What We Measure
The risk score is a weighted blend across several dimensions. No single dimension can dominate — a high score reflects multiple dimensions pointing the same way. We weigh:
Smart-contract and protocol track record, including any history of incidents.
Quality of the underlying collateral and how stably the vault’s share price holds its peg.
Who controls the vault — admin keys, multisig vs. single-owner, and upgrade authority.
Whether holders can actually redeem — available liquidity, utilization, and any redemption gates.
Contract verification, security-audit coverage, and automated code-risk analysis.
Returns, drawdowns, capital flows, and signs of dormancy or decline.
Listing Verdict
The verdict combines the risk score with hard gates: any blocking flag (or a closed / locked redemption state) forces “Do not list” regardless of score.
Withdrawal Risk Levels
Redemptions are fully closed — no exit possible.
Paused, or a lockup period is in effect — funds can’t be withdrawn until it clears.
Nominally open, but there isn’t enough liquidity to redeem at current size.
Withdrawals work but face friction — high utilization, queues, or an enforced delay before redemption completes.
Key Risk Flags
Contract source code is not verified on the block explorer.
Withdrawals are currently disabled.
No meaningful activity for an extended period — likely abandoned.
Vault owned by a single externally-owned account (no multisig / timelock).
Contract can be upgraded by an admin.
No known security audits for this vault.
High recursive-lending exposure, which amplifies losses under stress.
Underlying asset or share price is showing depeg risk.
Vault has negative lifetime returns.
Very small total value locked.
Recently deployed, with limited track record.
Data Sources
Strategy classification, APY, returns, and volatility.
Current share prices and protocol total value locked.
Available redemption liquidity and market utilization rates.
Source-code verification and on-chain contract configuration.
Automated code analysis, contract-level risk, and deployer reputation.
Want this data via API?
Every score, grade and signal on this page is available through the Webacy API — plug it straight into your own product.
