A DeFi risk rating estimates how likely you are to lose a deposit in a given protocol, pool or token, and how badly. It is usually a letter grade or a number, and you can produce one yourself. This page is for players and depositors who move game tokens, stake, farm or bridge, and who want a repeatable way to score a protocol before putting money in.
Most people get the target wrong. They score the code, and the code is no longer where most of the money leaves. In the first half of 2026 DeFi lost $1.3 billion to hacks, according to crypto.news. The two largest incidents, Drift Protocol ($285 million) and KelpDAO ($290 million), together came to about 44% of that. Neither started with a bug in an audited contract. Both started with someone obtaining keys they should never have had.
What a risk score measures, and what it skips
A protocol risk score combines several separate questions into one figure: can the contracts be broken, can the people who control them be fooled or replaced, does the protocol depend on something else that can fail, will the token hold value once insiders can sell, and is there enough liquidity to get out. How a scoring system weights those questions decides what its grade means. The weighting is also where most systems go wrong.
The academic baseline comes from a six-dimension taxonomy published in 2022 by Moody's Analytics and Gauntlet. A 2026 paper from ZWING Intelligence AG in Zug, Toward a Risk Assessment Framework for Institutional DeFi, adds three dimensions to it:
- Composability risk. The risk that comes from depending on other protocols.
- Comprehension debt. The name points to systems complicated enough that nobody fully understands their failure modes.
- Temporal risk dynamics. Risk that changes over time instead of staying fixed at launch.
The paper also adds a transparency confidence modifier, which keeps two things apart: how bad the risk looks, and how sure the assessor can be about that. The authors tested the framework retrospectively against 12 incidents from 2024 to 2026, about $2.5 billion in direct losses. Five of the 12 needed at least one of the new dimensions to explain the root cause. The two largest systemic events in the set needed them too. Put plainly, a six-box scorecard would have rated the worst blowups in the sample as less risky than they were. The paper's summary does not list the original six dimensions, so this page does not either.
The gap in practice is the one CertiK's Ronghui Gu describes:
A protocol can pass a flawless code audit and still lose millions because of a compromised admin key.
There are three ways to get a rating. You can read a third-party grade, run an automated scanner, or score the protocol yourself. They answer different questions, and the cheapest of them is also the least complete.
| Third-party letter grade | Automated token scanner | Your own scorecard | |
|---|---|---|---|
| Example (Credora site; CoinLaw, Sept 10, 2026) | Credora, A+ to D scale | Rug-pull detection tools for new tokens | This page's method |
| What it models (Credora; CoinLaw) | Default and loss risk in lending markets and vaults, 100,000 Monte Carlo runs per market | Known on-chain rug patterns in a token's contract and pool | Keys, dependencies, token unlocks, liquidity, track record, your own approvals |
| Coverage (Credora site; CoinLaw) | 108 vaults, 177 lending markets, 51 assets | Detects 25 of 34 documented rug-pull root causes (73.5%) | Any protocol whose docs and contracts you can read |
| Can you check the method? (Credora site) | Frameworks documented publicly; scoring engine proprietary | Varies by tool | Yes, you wrote it |
| Blind spots (crypto.news, Sept 2026; CoinLaw) | Anything outside the rated list, which includes most game tokens | Nine root causes, including fake LP locks and hidden fee mechanisms, evade every tool | Your time, and whatever the team does not disclose |
| Best for | Comparing lending markets before a large deposit | A first filter on a brand-new token | Game economies, bridges, staking tokens, anything unrated |
On Credora, the company's line is "APY tells you what you might earn. Credora tells you what you might lose." That framing is correct. The vendor claim to keep in perspective is the calibration: probability-of-default curves fitted to more than 30 years of traditional credit data. Thirty years of corporate credit history contains no admin key phished by a fake trading firm, and an outsider has no way to check how the model accounts for that while the engine stays closed. Treat the grade as one input, especially for lending markets, where it is strongest.
Scoring a protocol yourself
Here is the method. It works for a lending market, a liquid staking token, a farm or a game's token pool. Score each dimension 0 to 3, where 0 is the least worrying, and write down how confident you are in each score. Some findings are knockouts: if the protocol fails one, stop and walk away whatever the total says.
Get these ready before you start.
-
The protocol's official URL, confirmed from at least two places you already trust
FinCEN reports counterfeit websites and apps that copy real platforms. A score for the real protocol does nothing for you on a fake site.
-
The block explorer for the chain
Etherscan, BscScan or Polygonscan for EVM chains, each with an approval checker.
-
A separate wallet that holds only what you are willing to lose
Your main holdings never sign anything for a protocol you are still scoring.
-
An approval revocation tool
MetaMask lists Revoke.cash, Unrekt, approved.zone and EverRevoke, plus the revoke feature in MetaMask Portfolio for Ethereum, Polygon and BNB Chain.
-
Enough of the chain's gas token for at least two transactions
A revocation is an on-chain transaction and costs gas.
-
A notes file
You will score from what you wrote down, not from memory of a Discord thread.
Ten checks, in order
-
Find out who can move the money
Read the docs and the contract's owner or admin roles on the explorer. You need a plain answer: one key, a multisig (and how many signers it needs), or nobody. What it looks like when it worked: you can name the address or contract that can upgrade the protocol or move funds, and you know how many signatures it takes. A single key scores 3. For bridges, crypto.news reports that 47% of LayerZero applications rely on a single signer for verification, so do not assume a well-known bridge has fixed this.
-
Check whether there is a delay before admin actions take effect
Look for any waiting period between an admin action and its execution. In the Drift breach, attackers who had obtained admin credentials drained funds through a whitelisted token in 128 seconds. crypto.news found no delay between key compromise and extraction in most 2026 incidents. Worked if: you find a stated delay in the docs and can see it in the contract. No delay, or a delay the admin can skip, scores 3.
-
Read the audit's scope, not just the fact that one exists
Open the actual report. Check which contracts and which version it covered, and whether the deployed code matches. An audit covers code. It does not cover how the team stores keys or who can phish them. Worked if: the audited contracts are the ones holding your deposit. No audit scores 3. An audit of a different version scores 2. A matching audit scores 1 at best, because operational security is still unexamined.
-
List every protocol yours depends on
Write down each bridge, wrapped asset, restaked token and collateral market between your deposit and its withdrawal. This is composability risk, and KelpDAO is the case study. Compromised developer session keys let attackers poison bridge verification and mint 116,500 unbacked rsETH. That triggered a cascading $6.28 billion TVL loss across Aave, a protocol that was not the one hacked. Worked if: you can draw the chain of dependencies on one line. Each bridge in it adds a point.
-
Read the token's supply and unlock schedule
Find total supply, the team and investor allocations, vesting (linear, cliff, graded, milestone or price-based), and whether liquidity, team and treasury tokens are locked in contracts you can verify on-chain. Streamflow's example of the well-built end is Heavenland, which put 97% of supply on five-year linear vesting with cliffs on every allocation. Worked if: you can say how many tokens unlock in the next few months, and who receives them. On Solana, also check whether the token keeps a freeze authority. Freeze-authority abuse appears as its own rug category in the research.
-
Read where the yield comes from
Either the protocol earns fees and passes them on, or it prints its own token and calls the result yield. Emission-funded rewards last as long as buyers keep absorbing the emissions. Streamflow's verdict on the 2025 GameFi bust is "Emissions without structure kill games." If you farm, the mechanics of liquidity pools and APY calculations are the part to understand before you score this line. Worked if: you can name the revenue source in one sentence. If you cannot, score 3.
-
Check the TVL and liquidity trend over quarters
One day's TVL tells you nothing. Look at the direction over several quarters, and at how much liquidity sits in the pool you would exit through. Liquid staking TVL fell from $76 billion in Q3 2025 to $33.4 billion in Q2 2026, a 56.1% drop across three consecutive quarters, per a ForesightNews report carried by Bitget News. A shrinking base means thinner exits and a higher chance of depeg under stress. Worked if: you know the trend and roughly what share of the pool your exit would be.
-
Check the team's track record
Has this studio or team shipped and run a product before, through a bad quarter? ChainPlay's 2025 report, cited by Streamflow, puts 93% of GameFi projects at effectively dead. A 2026 study of 6.4 million Solana tokens, cited by CoinLaw, found most show rug-pull characteristics within one hour of launch. A launch with no history scores 3 on this line by default, and the score improves only with time.
-
Rate your confidence separately
Next to each score, mark high, medium or low confidence. This is the transparency modifier from the ZWING paper in a simple form. A protocol that scores well only because you could not find the bad parts has not scored well. Worked if: every line with low confidence is marked as unresolved, not treated as safe.
-
Enter small, with a capped approval, then revoke
If the protocol passes, deposit from the separate wallet. When the approval prompt appears, set a custom spending cap equal to the deposit instead of accepting the unlimited default. MetaMask flags infinite allowance requests, and you should treat that flag as a stop sign. When you leave, revoke the approval: disconnecting the dapp is not enough (see below). Worked if: the approval checker on the explorer shows the cap you set, and later shows nothing.
Add up the lines and keep the knockouts separate. A total is only useful for comparing two protocols scored the same way on the same day. It does not predict loss. The weights below are this page's own and do not come from any rating agency.
Scoring a hypothetical game-token farm
Say a new on-chain game offers a farm for its token paired with a stablecoin. The game launched four months ago, and the farm sits on a bridged version of the stablecoin. Each line is scored 0 (least worrying) to 3, with confidence in brackets. The maximum is 24.
| Who controls funds: 3-of-5 multisig, signers named | 1 (medium) |
|---|---|
| Admin delay: none found in docs or contract | 3 (high), knockout |
| Audit: covers an earlier contract version | 2 (high) |
| Dependencies: one bridge for the stablecoin | 2 (medium) |
| Token unlocks: team tokens on a 12-month cliff, LP lock claimed but not verifiable | 2 (low) |
| Yield source: token emissions, no fee revenue | 3 (high) |
| Liquidity trend: TVL down two quarters running | 2 (medium) |
| Track record: first product from this studio | 3 (high) |
| Total | 18 of 24, one knockout |
The knockout settles it before the total does. Admins who can move funds with no delay mean an outcome like Drift's is possible on day one. The low-confidence LP lock line also matters: fake LP locks are one of the root causes CoinLaw reports no automated tool catches. Do not deposit. If the team adds a delay and publishes a verifiable lock, score the farm again from step 1.
The mistakes that cost money
Treating "audited" as a grade. You can recognize this one when the audit badge is the only evidence you collected. The 2026 losses moved from code bugs to compromised credentials and social engineering, crypto.news reports, and both of the year's largest breaches are attributed to the Lazarus Group's TraderTraitor subunit. The fix is steps 1 and 2: score the keys and the delay before you open the audit.
Reading APY as the score. You can recognize it when the first number you wrote down was the yield. A high APY funded by emissions is a cost to the token, not a feature of the protocol. Score where the yield comes from, step 6, and let the APY decide nothing.
Trusting a scanner's green light. Per CoinLaw's compilation, existing detection tools cover 25 of 34 documented rug-pull root causes. Fake LP locks and hidden fee mechanisms are among the nine that evade all of them. A clean scan rules out the patterns the scanner already knows about, and nothing more.
Disconnecting instead of revoking. MetaMask's documentation draws the line clearly. Disconnecting a dapp removes its ability to see your address and balance. Revoking the approval removes its ability to move your tokens. If you clicked disconnect after something felt wrong, the approval is probably still live. Check it on the explorer and revoke it, which costs gas. MetaMask recommends reviewing approvals monthly.
Accepting the unlimited default. Wallet drainers do not break into wallets. They get you to sign an approval, then call transferFrom() later from a separate wallet. According to MetaMask's page on malicious approvals, attackers often drain slowly so nobody starts investigating. You can recognize the problem from an approval checker that shows "unlimited" next to contracts you used once. The fix is custom caps when you approve and revocation when you leave.
Scoring the protocol but using the wrong site. FinCEN's September 3, 2026 alert describes counterfeit websites and mobile apps built to imitate legitimate investment platforms. These are run by scam centers, mainly in Southeast Asia, that use fake romantic, friendly or business personas to build trust first. If someone you met online pointed you to the protocol, that alone is the risk rating.
Getting worked over the way Drift's team was. Drift's attackers posed as a trading firm and spent months building trust before obtaining admin credentials. The retail version is the same method at smaller scale. Security Boulevard's reading of FBI data is blunt: "The costliest scams skip the hacking entirely...you send the money yourself."
Scoring from dead data. DappRadar shut down on November 17, 2025, BlockchainGamer.biz reported, after seven years of operation. A "2026 DappRadar report" on game token risk cannot be real. If a token's pitch deck cites one, the deck was written by someone who did not check.
Cases that change the score
A brand-new token on a high-throughput chain. Start the score at the worst rating, not at neutral. In a study of 100,063 Solana tokens issued between January and June 2025, Crypto Impact Hub reports 76,469 (76.4%) flagged as rug-pull candidates: 60,402 pump-and-dump, 15,606 liquidity withdrawal, 461 freeze-authority abuse, with a 0.26% false-positive rate. Of more than 7 million Pump.fun tokens, 98.6% ended below $1,000 in liquidity. Here the track-record line outweighs everything else on the card.
Game tokens. The emissions and vesting lines matter most, because that is how game economies have failed. GameFi market cap fell from $23.87 billion at end-2024 to $7.8 billion at end-2025, a 67% decline, per ChainPlay's report as cited by Streamflow (a vesting-tool vendor, which has an obvious interest in vesting being the answer). The underlying point does not depend on who makes it: you can check token locks on-chain, and you cannot check a team's promise.
Bridged assets and cross-chain deposits. Add a dependency point for every bridge. crypto.news counts more than 30 bridge exploits over $3 million each in 2026. KelpDAO showed that a bridge failure can drain protocols that were never attacked directly.
Liquid staking and restaking tokens. These stack dependencies by design. Score the staking provider, the token's own liquidity, and every protocol accepting it as collateral. The mechanics of liquid staking explain where depeg risk comes from. Restaking adds another layer, and re-leveraging staked assets multiplies the dependency line instead of adding to it.
Lending markets. These are the one category where a third-party grade has real coverage, through Credora's 177 rated markets. The ChainAware comparison notes more than 90% of DeFi loans remain overcollateralized. That protects the lender against borrower default. It does not protect against an admin key compromise.
"DeFi risk score" that means your wallet. Some products sold as DeFi risk scores rate wallets, not protocols. ChainAware, Cred Protocol, Spectral (the MACRO score), RociFi, TrueFi and Providence score borrowers. ChainAware's own formula weights fraud probability at 40%, wallet experience at 25%, credit history at 20% and behavior at 15%, per its comparison, which is a vendor ranking itself. Maple Finance still uses manual pool-delegate due diligence. None of these tell you whether a protocol is safe to deposit into.
The numbers, dated
The scoring itself costs nothing but reading time. The money is in the transactions: one approval, one deposit, one revocation, each paying the chain's gas. The sources here do not give a figure for those fees, and they vary by chain and by day.
The case for doing it rests on how losses are concentrated. Rug-pull figures vary because, as DeepStrike notes, "researchers count different behaviors, ecosystems, thresholds, and forms of loss," so no single global number is reliable. The individual numbers are consistent, though. Raydium's soft-rug incidents had a median loss of $2,832. CoinLaw puts the average scam payment at $2,764 in 2025, up from $782 in 2024. FBI-reported crypto investment fraud reached $7.228 billion in 2025, out of $11.37 billion in crypto-tagged complaints.
Recovery is limited. The IC3 Recovery Asset Team froze 58% of the attempted theft it handled in 2025, which counts only cases reported in time for a freeze. The DOJ's Scam Center Strike Force, launched November 2025, has recovered over $800 million and restrained over $700 million. Enforcement does happen: SafeMoon's CEO was sentenced on February 10, 2026 to 100 months and a $7.5 million forfeiture. A prison sentence does not refund depositors, though, so the time to act is before you deposit.
Comments
No comments yet. Be the first to comment!
Leave a Comment