Risk Framework
How Philidor scores DeFi vaults 0-10 using a three-vector model, with explainability, evidence controls, and model governance.
Philidor assigns each tracked vault a 0-10 relative resilience score computed under a single, canonical methodology.
What The Score Means
The score estimates relative resilience to loss scenarios under current evidence quality.
- Higher score means stronger observed controls and lower modeled failure pressure.
- Lower score means known risk pressure, data weakness, or both.
- The score is for comparison, not a guarantee.
What The Score Is Not
- Not a guarantee of safety
- Not a guarantee of returns
- Not investment advice
- Not legal or regulatory certification
Composite Formula
raw_total = 0.40 * asset_vector + 0.40 * platform_vector + 0.20 * control_vector
final_total = asset_quality_drag(raw_total)| Vector | Weight | Measures |
|---|---|---|
| Asset Composition | 40% | Category-specific asset failure risk, evidence quality, caps |
| Platform & Strategy | 40% | Code maturity, audits, strategy complexity, dependency pressure |
| Governance Controls | 20% | Timelocks, immutability, depositor reaction window |
The 40/40/20 split places equal emphasis on what a depositor holds and the protocol that holds it, with a smaller but meaningful weight on the depositor's reaction window if something goes wrong.
Scope And Identity
- Address + chain is the scoring identity key. Symbol is display-only.
- Risk outputs include explainability metadata (caps, flags, provenance).
- Asset, platform, and control vectors are all active in the composite.
Design Principles
- Evidence-aware by default: unresolved assets remain fail-safe, but known assets are scored primarily on observed dimensions rather than workflow status.
- Deterministic computation: same inputs produce same outputs.
- Governed change control: methodology changes, approvals, and score runs are tracked.
- Explainability-first: score consumers can inspect why a score is capped or constrained.
Tier Interpretation
| Range | Tier | Plain-language interpretation |
|---|---|---|
| 8.0-10.0 | Prime | Strong observed controls and evidence quality relative to tracked vaults |
| 5.0-7.9 | Core | Moderate risk profile with meaningful constraints or uncertainty |
| 0.0-4.9 | Edge | Elevated or unresolved risk profile; often capped by flags, staleness, or missing coverage |
See Tiers & Suitability for details on how tiers interact with institutional suitability labels.
Worked Examples
The following walk-throughs illustrate how the three vectors combine. Each is flagged illustrative because post-calibration vault numbers shift as evidence is refreshed; the structure of the calculation is what matters.
Aave v3 Ethereum WETH — Prime (illustrative, as of this release)
Single-sided WETH lending on Aave v3 Ethereum.
| Vector | Score | Basis |
|---|---|---|
| Asset | 8.5 | 70/30 Aave lending composite: WETH deposit scored 9.0, weighted pool reserves scored ~7.0 (30%) |
| Platform | 7.6 | Base 8.0 (mature code, deep audits, simple lending) × 0.95 worst-of factor (Chainlink is Prime-tier dependency) |
| Control | 8.0 | Governance timelock ≥ 48 hours |
| Composite | 8.04 | 0.4 × 8.5 + 0.4 × 7.6 + 0.2 × 8.0 → Prime |
Morpho Steakhouse Prime USDC — Prime (illustrative, as of this release)
Curated Morpho vault with multi-market USDC exposure.
| Vector | Score | Basis |
|---|---|---|
| Asset | 7.17 | Curated Morpho vault scored on weighted market exposures and curator quality |
| Platform | 8.86 | Morpho V2, mature deployment, minimal dependency drag |
| Control | 9.0 | 7-day governance timelock |
| Composite | 8.21 | 0.4 × 7.17 + 0.4 × 8.86 + 0.2 × 9.0 → Prime |
Aave v3 Ethereum weETH — Core (illustrative, as of this release)
Single-sided weETH (LRT) lending market on Aave v3.
| Vector | Score | Basis |
|---|---|---|
| Asset | 7.3 | LRT category appropriately constrains the asset vector; 70/30 composite with pool reserves |
| Platform | 7.6 | Same platform as Aave WETH example |
| Control | 8.0 | Timelock ≥ 48 hours |
| Composite | 7.56 | Sits in the Core band — the LRT asset category cap prevents this market from clearing Prime, which is the intended outcome |
Metronome msETH Vault — Edge (illustrative, as of this release)
Emerging synthetic ETH product with thin observational evidence.
| Vector | Score | Basis |
|---|---|---|
| Asset | 4.5 | Synthetic stablecoin/synthetic ETH category, limited operator history, evidence confidence below institutional threshold |
| Platform | 6.5 | Reasonable platform maturity but not deeply seasoned |
| Control | 7.0 | Moderate timelock |
| Composite | ~4.80 | Composite sits in Edge because the asset category genuinely reflects elevated risk, not because of a policy override |
Hard-Fail Example — Edge (illustrative, as of this release)
Any vault with an active hard-fail flag (sanctions exposure, active depeg, redemption paused, single-signer upgrade) is capped regardless of the three-vector composite.
- A vault with
active_depegis capped at 1.0 for a 7-day cooldown. - A vault with
sanctions_exposureis capped at 0.0.
Hard caps bind even when other vectors would otherwise land the vault in Core or Prime. See the Asset vector page for the complete hard-fail table.
Sections
- Asset Composition (40%)
- Platform & Strategy (40%)
- Governance Controls (20%)
- Tiers & Suitability
- Data Integrity & Governance
What Changed In This Release
Philidor now publishes a single canonical scoring methodology. The changes below refine the framework to better reflect how institutional depositors actually experience risk; they are calibration refinements, not structural redesigns.
- Prime threshold pinned at 8.0. Prime has always been documented as the top tier; this release aligns the implementation with the 8.0 cutoff across all surfaces. Vaults previously near the 7.5–7.9 range now surface as Core, matching how our analyst desk has long treated them.
- Smoothed the top of the Control timelock ladder. The mapping now reads: Immutable → 10, ≥ 7 days → 9, ≥ 3 days → 8.5, ≥ 48 hours → 8, ≥ 24 hours → 6, ≥ 6 hours → 4, no timelock → 1. The new 8.5 step at ≥ 3 days and 8.0 at ≥ 48 hours reduce a discontinuity in the mid-band and better reflect the reaction-window difference between those configurations. See Governance Controls.
- Aave lending markets now use a 70/30 deposit-weighted asset composite. For Aave v3 single-sided lending markets, the asset vector is a 70/30 weighted composite of the deposit asset and the other active reserves in the same pool (filtered to reserves with ≥ 1% of pool weight). The 70/30 split replaces a 50/50 construction and better reflects the dominance of the deposited asset in institutional depositor risk, with cross-collateral risk mediated by liquidation engines, isolation mode, and liquidation bonuses. See Asset Composition.
- Consolidated to a single scoring version. Prior methodology version flags have been retired; documentation, API responses, and analyst artifacts describe one framework.