--- title: "DeFi Protocol Risk Scorecard" description: "DeFi protocol risk scorecard: document evidence about contracts, governance, assets, oracles, liquidity, incidents, economics, operations, and exit risk." canonical: https://www.getswoopr.com/tools/defi-protocol-risk-scorecard/ source: "Swoopr Investment: https://www.getswoopr.com" --- ## Direct Answer > The DeFi Protocol Risk Scorecard documents evidence and unknowns across nine risk dimensions before you use a protocol: deployment identity, contract security, privileged control, asset quality, oracle integrity, liquidity depth, economic sustainability, operational resilience, and user position policy. It deliberately assigns no aggregate "safe" label, because a single number can mask a critical unknown, and instead reports section-level evidence quality and triggers a hard stop whenever a critical question is answered Unknown or with weak evidence. A hard stop does not claim a protocol is fraudulent; it means evidence is insufficient for the deployment you reviewed, so the unknown stays visible as an exposure constraint. # DeFi Protocol Risk Scorecard Document evidence and unknowns across nine DeFi risk dimensions before using a protocol. Critical unknowns remain visible as exposure constraints, not hidden in an aggregate score. ![A smartphone displays a calculator app beside bitcoins and a laptop with a financial chart.](https://www.getswoopr.com/images/hero/tools-defi-protocol-risk-scorecard.webp) *Photo by [Alesia Kozik](https://www.pexels.com/@alesiakozik/) via [Pexels](https://www.pexels.com/photo/a-person-holding-a-smartphone-with-a-calculator-app-on-the-screen-6772022/)* **Educational tool only.** Results are scenarios based on user-entered assumptions, not investment advice, price forecasts, or safety ratings. DeFi positions can result in partial or total loss of principal. ## Protocol Risk Scorecard Complete each section based on your own research. **Unknown** answers stay unknown, they are never assigned neutral points. A critical unknown prevents any reassuring overall label. 0 of 9 sections answered 1 Exact Deployment Not started ▼ Record the exact scope of this review. These details appear in the summary and any export. Protocol & product name Network / chain Contract address(es) Deployment version / date Official documentation URL Repository URL Date reviewed Are contract addresses verified on a block explorer? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, contract verification unknown Unverified contracts cannot be independently reviewed. Treat this as a blocking exposure constraint. Confidence: Select High, primary source, exact deployment Medium, indirect or incomplete Low, secondary summary or assumption Are official sources cross-checked against the deployment? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Are legacy or deprecated contracts excluded from scope? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low 2 Contract & Integration Evidence Not started ▼ Independent audits exist and cover the exact deployment? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, audit evidence unknown or absent Without a scoped audit covering this exact deployment, the contract attack surface cannot be assessed. Confidence: Select High Medium Low Bug bounty program active and in scope for this deployment? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low On-chain monitoring and incident alerts documented? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Integrated protocols (composability dependencies) are identified? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low 3 Privileged Control & Governance Not started ▼ Upgrade authority (proxy admin / owner) is known and documented? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, upgrade authority unknown An unknown upgrade key means the protocol can be modified without warning. Treat as a blocking exposure constraint. Confidence: Select High Medium Low Pause, freeze, or emergency powers are documented with constraints? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Governance participation is active and concentration is documented? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Timelock delay is sufficient for users to exit before changes apply? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, timelock unknown or absent Without a timelock, protocol changes can take effect immediately with no exit window for users. Confidence: Select High Medium Low 4 Assets & Collateral Not started ▼ Underlying asset issuer and reserve model are documented? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, collateral or stablecoin design cannot be evaluated If you cannot identify the reserve model and redemption path, the floor value of the position cannot be assessed. Confidence: Select High Medium Low Wrapper and bridge risks for any non-native assets are documented? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Collateral factors, caps, and concentration are documented? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low 5 Oracles & Data Not started ▼ Oracle provider, source markets, and manipulation resistance are documented? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, oracle source unknown Oracle manipulation is a documented class of DeFi exploit. An unknown oracle source is a critical unresolved risk. Confidence: Select High Medium Low Fallback oracle behavior on stale data or network outage is documented? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low 6 Liquidity & Exit Not started ▼ Exit route is fully described and can be completed without a front-end? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, exit route cannot be described If you cannot describe a complete exit path (including a direct contract call if the front-end is unavailable). This is a blocking exposure constraint. Confidence: Select High Medium Low TVL, available liquidity, and utilization are documented? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Stressed price impact for position size is calculated? Contextual Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low 7 Economics & Incentives Not started ▼ Yield source is identified, who pays and why? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, yield source cannot be identified If you cannot identify who pays the yield and why, the sustainability of returns and risk to principal cannot be assessed. Confidence: Select High Medium Low Token emissions schedule and unlock events are documented? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Bad-debt handling and loss socialization mechanism are documented? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low 8 Operations & Incident Response Not started ▼ Front-end and RPC dependencies are identified and fallbacks exist? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Postmortems for past incidents are published and accessible? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Emergency communication channels are known and monitored? Contextual Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low 9 User Position Policy Not started ▼ Document your personal exposure rules before entering. These are constraints you set, not protocol parameters. Maximum exposure and shared dependency limits are defined? Critical Strong evidence Some evidence Weak evidence Unknown N/A Hard stop, user cannot tolerate complete loss If no maximum exposure or loss tolerance has been defined, this scorecard cannot establish readiness to enter a position. Confidence: Select High Medium Low Gas reserve, emergency conditions, and action thresholds are defined? Material Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low Review cadence and re-review triggers are defined? Contextual Strong evidence Some evidence Weak evidence Unknown N/A Confidence: Select High Medium Low 30%, incident report, governance vote, audit release…" aria-label="Notes for review cadence"> Generate Summary Clear All ### Review Summary | Section | Strong | Some | Weak | Unknown | N/A | Status | | --- | --- | --- | --- | --- | --- | --- | Disclaimer: This scorecard is for educational purposes only. It does not certify safety, predict outcomes, or constitute investment advice. Results reflect only the evidence you have documented. Reviewed: . Print / Export ## About This Scorecard This tool applies a structured evidence-documentation framework across nine risk dimensions common to DeFi protocols: deployment identity, contract security, privileged control, asset quality, oracle integrity, liquidity depth, economic sustainability, operational resilience, and user position policy. ![Person analyzing financial data on laptop, tablet, and notebook.](https://www.getswoopr.com/images/accent/tools-defi-protocol-risk-scorecard-accent-1.webp) *Photo by [AlphaTradeZone](https://www.pexels.com/@alphatradezone/) via [Pexels](https://www.pexels.com/photo/person-writing-on-a-notebook-5831658/)* **No aggregate "safe" label is assigned.** A single numerical score can mask a critical unknown. Instead, the tool surfaces section-level evidence quality and flags hard stops, conditions where evidence is insufficient for the reviewed deployment regardless of other scores. ### Rating labels | Label | Meaning | | --- | --- | | **Evidence substantially documented** | No hard stops triggered; every section has at least one answered question; no question anywhere was answered Weak or Unknown. | | **Evidence partially documented** | No critical hard stops, but one or more sections have material unknowns or low confidence evidence. | | **Material unknowns** | No critical hard stops triggered, but more than two Unknown answers or more than three Weak-evidence answers across non-critical questions. Position requires further research before entry. | | **Critical unknowns** | One or more hard-stop conditions triggered. Evidence is insufficient. These unknowns must be resolved or treated as permanent exposure constraints. | | **Review incomplete** | Fewer than three sections have any answers. Summary not generated. | ### Hard-stop conditions A hard stop is triggered when a critical question receives an Unknown or Weak evidence answer. Hard stops do not claim a protocol is fraudulent, they mean evidence is insufficient for the reviewed scope. Hard stops that remain unresolved prevent a reassuring overall label. - Contract addresses cannot be verified on a block explorer - Audit scope does not cover the exact deployment - Upgrade or custody key identity is unknown - Timelock is absent or its delay is unknown - Exit route cannot be fully described - Oracle source cannot be identified - Yield source (who pays and why) cannot be identified - Collateral or stablecoin design cannot be evaluated - User's loss tolerance or maximum exposure is undefined ## Supporting Lessons - [How to Evaluate a DeFi Protocol](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/how-to-evaluate-a-defi-protocol/) - [The DeFi Risk Stack](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/defi-risk-stack/) - [DeFi Position Management](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/defi-position-management/) - [DeFi Transaction Lifecycle](https://www.getswoopr.com/learn/defi-and-yield-farming/foundations/defi-transaction-lifecycle/) - [DeFi & Yield Farming Hub](https://www.getswoopr.com/learn/defi-and-yield-farming/) - [Crypto Bridges Explained](https://www.getswoopr.com/learn/crypto-fundamentals/crypto-bridges-explained/) - [Stablecoin Depeg Risk](https://www.getswoopr.com/learn/crypto-fundamentals/stablecoin-depeg-risk/) - [Counterparty Risk in Crypto](https://www.getswoopr.com/learn/crypto-fundamentals/counterparty-risk-in-crypto/) ## References - [Ethereum.org: DeFi Overview](https://ethereum.org/defi/): background on smart-contract, oracle, and protocol risk categories this scorecard's due-diligence sections evaluate. - [CFTC: Digital Assets Primer](https://www.cftc.gov/digitalassets/index.htm): background on digital-asset market structure and counterparty risk, as described in the CFTC primer of December 2020. This scorecard is a manual due-diligence checklist based on your own research, not a verified safety rating or investment recommendation. It does not use live data and does not audit smart contracts. ## Related Reading - [Free Stock & Crypto Trading Tools](https://www.getswoopr.com/tools/) the section this guide belongs to - [APY / Effective Yield Calculator](https://www.getswoopr.com/tools/apy-effective-yield-calculator/) a companion guide in this cluster - [Balance Transfer Calculator: The Fee Against the Interest It Buys Out](https://www.getswoopr.com/tools/balance-transfer-calculator/) a companion guide in this cluster - [CD Ladder Builder](https://www.getswoopr.com/tools/cd-ladder-builder/) a companion guide in this cluster - [Company Metric Comparison Dashboard](https://www.getswoopr.com/tools/company-fundamentals-comparison/) a companion guide in this cluster - [Compound Growth & Contribution Calculator](https://www.getswoopr.com/tools/compound-growth-calculator/) a companion guide in this cluster - [Credit Card Payoff Calculator: What the Minimum Payment Actually Costs](https://www.getswoopr.com/tools/credit-card-payoff-calculator/) a companion guide in this cluster - [Credit Utilization Calculator: Per Card, Overall, and What a Paydown Changes](https://www.getswoopr.com/tools/credit-utilization-calculator/) a companion guide in this cluster - [Crypto Position Size Calculator](https://www.getswoopr.com/tools/crypto-position-size-calculator/) a companion guide in this cluster - [DCA vs. Lump Sum Simulator](https://www.getswoopr.com/tools/dca-vs-lump-sum-simulator/) a companion guide in this cluster