Control and Governance (20%)
Control and governance scoring based on immutability, AMM no-pause behavior, timelocks, and depositor exit windows.
Control and Governance measures the depositor reaction window when protocol parameters change adversely.
This vector is weighted at 20% because governance risk is partially depositor-mitigable. Timelocks create response time, unlike core asset or platform risk, which is not directly controllable by the depositor.
Scoring Ladder
| Configuration | Score |
|---|---|
| Immutable contracts | 10 |
| AMM with no pause control | 9 |
| Timelock ≥ 7 days | 9 |
| Timelock ≥ 3 days | 8.5 |
| Timelock ≥ 48 hours | 8 |
| Timelock ≥ 24 hours | 6 |
| Timelock ≥ 6 hours | 4 |
| Timelock > 0 and < 6 hours | 2 |
| No timelock / EOA admin | 1 |
| Unknown (data unavailable) | 5 |
The ladder is smoothed at the top end. The step from "≥ 48 hours" to "≥ 3 days" moves 0.5 points, and the step from "≥ 3 days" to "≥ 7 days" adds another 0.5 points. This reflects the diminishing marginal value of each additional day of timelock in the 2-7 day range.
Unknown timelock configuration scores 5, a neutral mid-band value that neither rewards nor punishes missing data; a separate evidence-freshness path flags the missing information for follow-up.
How To Interpret
The score reflects the depositor's ability to react to adverse parameter changes:
- Immutable (10): No parameters can change. The code is the final word.
- Long timelock (8.5-9): Changes are announced days in advance. Depositors can monitor and exit comfortably.
- Moderate timelock (6-8): Some reaction time, but requires active monitoring.
- Short timelock (4): Minimal reaction window; monitoring must be near real-time.
- No timelock (1): Admin can change parameters instantly. Depositors have no warning.
Composite Interaction
- Governance is an active 20% component of the composite.
- Governance strength does not bypass asset-level hard caps, review caps, or fail-safe constraints. A vault with strong governance but a hard-failed asset is still capped by the asset hard-fail.
- If fail-safe mode is
fail_closed, risk output is withheld regardless of governance score.
Non-EVM control evidence: Solana
On Solana the control surface is not a contract admin but the program upgrade authority and per-market emergency powers, so the vector scores captured on-chain control evidence rather than EVM timelock semantics (ratified in ADR 0002, live since PHI-258):
- Evidence is read directly from finalized chain state: each program's upgrade authority (including whether it is burned), any resolvable multisig behind it, and market-level admin/emergency-council state.
- The score is worst-program-first across every program a vault actually depends on — a direct K-Lend reserve row scores only the klend program, while a kVault row carries both programs, because its capital rides K-Lend.
- The scoring ladder runs from burned upgrade authority (highest) down through verified multisig tiers to a raw single keypair (lowest), with caps for keypair-held authorities and a clamp when a live emergency power can halt withdrawals.
- Unknown and absent are different: unresolved control evidence is scored as unknown, never silently treated as safe.
Timelock seconds — the EVM input — is explicitly null on Solana rows;
it is not the control model there and a fabricated zero would be wrong
in both directions.
Current Limitations
This vector does not yet fully differentiate:
- signer-quality nuances (e.g. a high-quality multisig vs. a weak multisig)
- DAO quorum and liveness guarantees
- governance token concentration dynamics
- emergency-controls quality beyond basic pausability signals
These nuances are captured qualitatively in analyst notes and are candidates for future quantitative coverage.
Thresholds Reference
Key governance-related thresholds used elsewhere in the system:
| Threshold | Value |
|---|---|
| Safe timelock | ≥ 7 days (604,800 seconds) |
| Moderate timelock | ≥ 2 days (172,800 seconds) |