DeFi Protocol Risk Scorecard
A DeFi risk rating estimates how likely you are to lose a deposit in a protocol, pool or token, and how badly. Most of what you will want to deposit into, game tokens above all, has no rating from anyone, so score it yourself. The scorecard below runs our DeFi risk rating guide's method: eight lines, each 0 (least worrying) to 3, a confidence on every line, and the knockouts that end it whatever the total says.
Score a protocol
Answer for one protocol, pool or token. Each line scores 0 (least worrying) to 3. Mark how sure you are; a line you could not check counts as unresolved, not as safe.
- Lines answered
- 0 of 8
- Unresolved (low confidence)
- 0
- If every unresolved line is the worst
- 24 of 24
Side by side
Kept in this browser only. A total compares protocols scored the same way on the same day; it does not predict a loss.
The method and its scores are the Alt Codex guide's own, not a rating agency's. General information, not financial advice.
Why the keys come before the audit
Most people score the code, and the code is no longer where most of the money leaves. crypto.news reports that CertiK and Forbes both put 2026's crypto hack losses at $1.3 billion in the first half of the year, and that compromised private keys overtook smart contract bugs as the leading way in. The two largest were not code bugs at all. Drift Protocol lost $285 million on April 1 after attackers spent months social engineering their way to an admin key, then drained it in 128 seconds. KelpDAO lost $290 million 17 days later through a single compromised verifier on its LayerZero bridge, and KelpDAO answered LayerZero's criticism with Dune data showing 47% of LayerZero apps, more than 1,200 of them, use the same single-verifier setup. That is why the first two lines are who can move the money and how long they have to wait, and why an audit can never score better than 1.
The eight lines and what scores what
| Line | 0 or 1 | 3 |
|---|---|---|
| Who can move the money | Nobody (0), or a multisig with named signers (1) | One key |
| Admin delay | A timelock you can see in the contract | No delay, or one the admin can skip. With an admin who can move funds, a knockout |
| Audit scope | An audit of the deployed version (1 at best: it says nothing about how keys are kept) | No audit (another version's audit is 2) |
| Dependencies | A native asset in one protocol (0); a point for depending on others | A point for every bridge on top: one bridge is 2, two is 3. Restaking doubles the line |
| Supply and unlocks | Nothing to unlock, or locks you checked on-chain | No schedule, or a retained freeze authority on Solana |
| Where the yield comes from | Fees the protocol earns, passed on | Token emissions only, or you cannot name the source |
| TVL and liquidity trend | Steady or rising over several quarters | Down three quarters or more, or too thin to exit (two quarters down is 2) |
| Track record | Products run for years, through bad quarters | A new launch, a first product or an anonymous team |
The guide gives the scores at the ends of most lines and its worked example fixes a few in the middle; the steps between them are ours, and the scorecard says so under the result. The weights do not come from any rating agency. A total is for comparing two protocols scored the same way on the same day. It does not predict a loss, and the scorecard never turns it into a letter grade for that reason.
Knockouts and confidence
Three findings end it before the total does. An admin who can move funds with no delay is the Drift case, possible on day one. An address you have not confirmed from two places you already trust leaves you scoring the real protocol while depositing into a copy. And a protocol that someone you met online pointed you to is the pattern FinCEN's September 2026 alert describes: scam centres using fake personas to move victims into fraudulent digital asset investments, about $12.7 billion of suspected activity in the reports it analysed.
Every line also takes a confidence. A line marked low, or "I could not find out", is unresolved, and the scorecard shows a second total that counts each one at 3. A protocol that scores well only because you could not find the bad parts has not scored well.
The guide's worked example
"Load the guide's example" fills in the hypothetical from the guide: a farm for a four-month-old game's token paired with a bridged stablecoin. A 3-of-5 multisig with named signers (1), no admin delay (3, a knockout), an audit of an earlier version (2), one bridge (2), team tokens on a 12-month cliff with an LP lock claimed but not verifiable (2, low confidence), emissions with no fee revenue (3), TVL down two quarters (2) and a studio's first product (3). It comes to 18 of 24 with one knockout, and the answer is do not deposit. If the team adds a delay and publishes a verifiable lock, score it again from the top.
If it passes: enter small, cap the approval, revoke
Deposit from a separate wallet that holds only what you can lose. When the approval prompt appears, set a spending cap equal to the deposit instead of the unlimited default. When you leave, revoke the approval: MetaMask's help centre draws the line between disconnecting a dapp, which stops it seeing your address and balances, and revoking an approval, which stops it moving your tokens. Revoking is an on-chain transaction, so it costs gas, and MetaMask suggests reviewing your approvals monthly. Setting up a wallet for play-to-earn games without getting drained walks through the separate wallet, and do you need a hardware wallet for crypto games covers what hardware does and does not protect.
For the mechanics behind the lines: yield farming explained for where farm yields come from, liquid staking explained and restaking protocols for the dependency line, and bridging to Arbitrum for what a bridge adds. For a game's economy rather than a DeFi pool, the play-to-earn red-flag checker asks the game-shaped questions.
General information, not financial advice. The scorecard runs in your browser and nothing you type leaves it; its comparison list stays in this browser.
Sources: Alt Codex, DeFi Risk Rating and How to Score a Protocol (the method and its sources); crypto.news, DeFi has lost $1.3 billion to hacks in 2026; MetaMask, How to revoke smart contract allowances; FinCEN, Nearly $13 Billion Linked to Suspected Digital Asset Scams (September 3, 2026).