Vault Due Diligence
Step-by-step guide to assessing vault risk using the API.
This guide walks through a complete due diligence assessment of a DeFi vault using the Philidor API.
Step 1: Look Up the Vault
curl https://api.philidor.io/v1/vault/ethereum/0x8eB67A509616cd6A7c1B3c8C21D48FF57df3d458Check the top-level fields first:
total_score— composite risk score (0-10)risk_tier— Prime, Core, or Edgeis_audited— whether the protocol version is auditedstrategy_type— what the vault does (lending, yield_aggregation, etc.)
Step 2: Examine Risk Vectors
The risk_vectors field breaks the score into three independent dimensions:
| Vector | Weight | What to look for |
|---|---|---|
| Asset | 40% | Is the underlying asset Prime tier? Is the oracle Chainlink? |
| Platform | 40% | How long has the code been live? How many audits? |
| Governance | 20% | Is there a timelock? How long? |
Red flags:
- Any vector scoring below 3
- Asset vector limited by a non-Chainlink oracle
- Platform vector dragged down by incident decay
Step 3: Review Audit Status
Check the audit fields:
audit_status— "audited" or "unaudited"auditors— list of audit firmsaudit_date— when the audit was completedaudit_report_url— link to the full report
Unaudited = forced Edge. No exceptions, regardless of other scores.
Step 4: Check Oracle Freshness
curl https://api.philidor.io/v1/oracle-vector/freshnessVerify that the oracle feeds for the vault's assets are fresh and updating. Stale oracles are a leading indicator of potential issues.
Step 5: Review Events and History
curl https://api.philidor.io/v1/vault/ethereum/0x8eB67A509616cd6A7c1B3c8C21D48FF57df3d458/eventsLook for:
- Incidents — any security events or losses
- Allocation changes — frequent rebalancing may indicate instability
- Parameter changes — fee changes, cap adjustments
Step 6: Decision Framework
| Score | Typical Action |
|---|---|
| 8.0+ (Prime) | Suitable for core allocations. Monitor for tier changes. |
| 5.0-7.9 (Core) | Acceptable with active monitoring. Size positions accordingly. |
| < 5.0 (Edge) | Requires deep due diligence. Consider size limits. |
| Unaudited | Hard pass for institutional allocations. |
Using the MCP Server
With the MCP server, you can run the entire assessment with a single prompt:
"Run a due diligence report on the Gauntlet USDC vault at 0x8eB67A509616cd6A7c1B3c8C21D48FF57df3d458 on Ethereum"
This triggers the vault_due_diligence prompt which orchestrates multiple tool calls automatically.