Skip to content
Education only · not financial, tax or legal adviceCanadian facts checked 2026-10-31 · a MITEY site
Menu
Tool · Due diligence

Protocol risk scorecard

Rate a protocol on eight risk dimensions and get a printable, reasoned score.

Runs in your browser · nothing is sent
Mitey the yeti pointing ahead while holding a clipboard, with a magnifying glass over code
Mitey says: Score what you can verify. Unknown counts as risk, not as fine.
Upgrade and admin control (weight 3)

Who can change or pause the contracts? Timelock? Multisig with known signers?

Audits and bug bounty (weight 3)

Independent audits of the deployed version? Findings fixed? Active bug bounty?

Oracle design (weight 3)

Robust price feeds, resistant to thin-liquidity manipulation and staleness?

Track record (weight 2)

Time live without major incidents, and how past incidents were handled.

Liquidity and exit (weight 2)

Can you exit at a fair price in stress? Withdrawal limits or queues?

Collateral and dependencies (weight 2)

What assets, bridges and other protocols does it depend on?

Governance (weight 1)

Concentrated voting power? Can a few holders push through changes?

Disclosure and documentation (weight 1)

Clear docs, risk disclosures and a way to contact the team?

Protocol · 0/8 rated
–/100

How this tool works

Eight dimensions that commonly decide whether a protocol fails safely or badly. Rate each from 0 (worrying or unknown) to 3 (strong and verifiable). Admin-key control, audits and oracle design carry more weight.

Write a note for each rating so the scorecard records your evidence. Print it or save it as a PDF from your browser. We do not score or rank protocols ourselves.

Limits

  • Your ratings, your evidence; the tool only weights them.
  • A high score is not a safety guarantee: audited code can still fail.
  • Nothing you enter leaves your browser.

Questions people ask

Does an audit make a DeFi protocol safe?

No. An audit reviews code at a point in time for the issues the auditors looked for. Later upgrades, integrations, economic attacks and key compromises can all cause losses in audited protocols.

What are admin keys?

Admin keys let a team or multisig change, pause or upgrade a protocol's contracts. They can protect users in an emergency but also concentrate risk: whoever controls them can change the rules.

Why does oracle design matter?

Lending and derivatives protocols rely on price feeds. A feed that can be manipulated, or goes stale, can trigger wrongful liquidations or let attackers borrow against inflated collateral.

Sources and dates

  • Introduction to smart contracts — ethereum.orgreference
    No date shown on page · checked 2026-10-31. What a smart contract is and how it executes.
  • Oracles — ethereum.orgreference
    No date shown on page · checked 2026-10-31. How off-chain data reaches smart contracts, and oracle risks.
  • Decentralized autonomous organizations (DAOs) — ethereum.orgreference
    No date shown on page · checked 2026-10-31. How DAOs and on-chain governance work.

Education only. Nothing on this page is financial, investment, tax or legal advice, or a recommendation to buy, sell, stake, lend or borrow any crypto-asset. Crypto-assets can lose some or all of their value and are not covered by CDIC. Canadian rules change: check the dated sources above and talk to a qualified professional about your situation. Full disclaimer.