Methodology

Source Weights

Consensus Algorithm

The consensus engine clusters all available source prices for an asset and picks the most reliable result:

1. Collect all source prices with non-failed circuit breakers
2. Collapse repeated quotes from one source to their median, then count each registered provider family as one independent voice by retaining its strongest representative
3. Find the largest fully pairwise cluster of sources that agree within 50 bps (fixed pegs) or 500 bps (NAV tokens)
4. Break equal-size clusters by total weight, then stronger trust tier, then tighter spread, then peg proximity when available
5. If the winning cluster has 2+ members, publish its median price and separately keep the best cluster member for provenance
6. Choose that internal selected source by weight, then trust tier, then peg proximity, then source key
7. If no cluster of 2+ forms, fixed pegs stay on fixed-peg rules and fall back to the best trusted single source
8. Pool challenge: if all agreeing sources are challenge-eligible (CG, DL-list, DEX average, or promoted protocol DEX sources without a hard-source corroborator), check each large priced DEX pool (≥$100K TVL) from the published challenger snapshot built from the full retained pool set. If any protocol-level median diverges beyond the peg-type-aware threshold (500 bps for USD pegs, min(2 × depeg threshold, 500) for non-USD pegs), downgrade to low, and replace the price when at least two independent protocol-level medians corroborate that divergence unless severe-downside preservation applies. A high-TVL multi-protocol replacement can also use the peg depeg threshold when the published price is inside that threshold and at least two $5M+ protocol medians are depeg-sized in the same direction and mutually coherent inside the pool-challenge bps band. A one-protocol replacement remains allowed only when the protocol median has at least $5M TVL, the DEX median crosses the peg depeg threshold, and a hard primary candidate agrees within the normal consensus threshold

Authoritative Price Overrides

For wrapper-style assets whose executable value is set by direct protocol redemption, or by an instantly redeemable tracked base asset, rather than by secondary-market liquidity, the pipeline switches to an authoritative redemption-based mark:

• cUSD (Cap): getBurnAmount() — cUSD → USDC redemption rate
• iUSD (infiniFi): receiptToAsset() — iUSD → USDC redemption rate
• USDai: inherits tracked PYUSD pricing because base USDAI is treated as an instantly redeemable PYUSD wrapper
• iUSD (Initia) / USDCx: inherit tracked AUSD or USDC pricing when the parent rail is fresh and replay-safe
• USDK / XO / USDnr: inherit tracked wM pricing because Pharos treats them as instantly redeemable M0 extension units rather than free-floating market-priced assets
• Scoped par references: source-reviewed USD and FX redeemables can use fresh/static FX references when active supply is observable
• ERC-4626 NAV wrappers: audited vaults such as Spark Savings, Gauntlet, Steakhouse, Yearn, Avant, Noon, Yuzu, and Aave Umbrella use convertToAssets() multiplied by a fresh trusted tracked parent price
• sGHO / Idle tranches: protocol-specific previewRedeem() or virtualPrice() reads price assets whose executable value is not represented by thin secondary markets
• crvUSD (Curve): PriceAggregator.price() enters primary consensus as a live market voice, not a protocol override

These overrides set priceSource = "protocol-redeem" and priceConfidence = "high" when the quote validates against peg bounds, and they are applied after the GeckoTerminal probe so later market checks cannot overwrite them. Recovery scheduling treats a current price as usable only when it is positive and carries publishable source and observation-time provenance, and each live candidate has a bounded slice of the shared budget so one stalled wrapper cannot skip the remaining active gaps. Parent trust is judged on the composite's replay-safe core, so an agreeing non-replay-safe corroborator that joins a parent's consensus label can neither strip trust from a high-confidence parent nor upgrade one the gate would otherwise reject. Vault NAV routes persist their last-good on-chain rate, and a failed live read can publish that cached rate times the fresh trusted parent price as an explicit low-confidence protocol-redeem-cached-rate source — bounded to 24 hours, never replacing a live price, and never depeg-authoritative. Audited wrapper exceptions can use a fresh high-confidence same-run parent consensus for live pricing while keeping historical replay on replay-safe sources.

Enrichment Pipeline (6-pass fallback)

Assets still missing prices after primary consensus go through a staged enrichment pipeline:

1. Pass 1: Canonical tracked contract identity → DefiLlama coins API, but only prices that pass peg-aware validation can resolve the asset
2. Pass 1b: Tracked alternate deployment fallback only (no synthetic same-address cross-chain probing; same validation gate as pass 1)
3. Pass 2: CoinMarketCap category plus exact-slug quotes; truncated category pages ignore returned rows until the exact targeted lane validates active status, contracts, volume, freshness, and peg bounds
4. Pass 3: Jupiter Price API for tracked Solana mints (authenticated when configured, block-freshness checked, peg-aware, and able to add bounded soft evidence to agreeing low-depth Solana prices)
5. Pass 4: DexScreener exact token-address pools only; the older unique-symbol search fallback is retired, and each run makes at most one same-chain batch of 30 exact addresses with rotating chain and within-chain coverage
6. Pass 5: Allowlisted low-volume CoinGecko recovery for selected DefiLlama-listed assets, published only with fallback confidence

Confidence Levels

Price Validation

Every price is validated before entering the replay cache. Validation is context-aware with four modes:

• Authoritative primary: can admit deep downside for fixed pegs, but publication still requires corroboration unless the mark is protocol redemption or a pool-challenge replacement
• Fallback enrichment: rejects isolated bad prints below a lower bound
• DEX observation: requires consistent $50K post-confidence TVL floor
• Historical backfill: validates against per-timestamp peg references

USD and fiat-FX pegs share the same upside tolerance ratio when a usable reference exists, while commodity tokens (gold, silver) keep the broader 2x reference band and scale references by commodityOunces for gram- and 1/1000-ounce assets. NAV tokens use broad positive-price checks. Replay-safe cache storage is limited to strong, replayable prices and now expires after 6 hours.

Scoring Formula

The final value is clamped to [0, 100] and rounded to one decimal.

Components

Depeg Handling Rules

• Core-universe boundary: tracked variants and stable-value investment products do not contribute market cap, trend, depeg penalties, or DEWS stress breadth; their detail and research surfaces remain available.
• Per-coin deduplication: active events are grouped by coin; each coin contributes once using the worst current deviation.
• Historical rebuild parity:completed-day backfills score any depeg overlapping the UTC day, canonicalize legacy depeg IDs into the current PSI universe, replay same-day deviation from `supply_history.price` when possible, never exceed the event's recorded `peak_deviation_bps`, and keep `peak_deviation_bps` as a start-day floor only when the event remained active through the UTC close and a daily snapshot misses the move. Replay days whose restored daily price is back inside the configured threshold drop out entirely, and restore jobs also repair replay-critical daily price coverage, including PSI-only shadow assets, before the PSI rebuild is rerun.
• Age-aware depreciation: fresh depegs get full weight for 30 days, then decay linearly to a 25% floor by asset age 120 days.

Condition Bands

Base Dimensions (weighted average)

Redemption Backstop and Effective Exit

The standalone Liquidity Score remains a pure DEX market-depth metric. Safety Scores use an effective exit score for the Liquidity dimension, built on a best-path model: exit quality equals the best available exit path after redemption is adjusted for current executable capacity and route confidence.

Before that blend, the DEX input is bounded by its retained evidence: reserve-based AMM simulation caps at 85, generic TVL proxy evidence at 60, synthetic or fallback evidence at 55, and provider-inaccessible-only deployment coverage at 45. Older snapshots without these evidence fields and rows explicitly marked legacy remain neutral. The public standalone Liquidity Score is not rewritten by this Safety Score policy.

modeledExitUsd = min(max(supplyUsd × 0.05, 100000), 25000000)

adjustedRedemption = redemption × capacityFactor × confidenceFactor

effectiveExit = round(min(100, max(dex, adjustedRedemption) + independentBonus))

capacityFactor is capped at 1.0 from current executable capacity divided by the modeled exit size. Confidence factors are 1.0 for high-confidence routes, 0.75 for medium-confidence routes, and 0.35 for low-confidence routes. The 10% secondary-path bonus is only applied when the redemption rail is independent from the DEX liquidity path, such as an issuer primary-market rail.

Live reserve metadata counts as executable capacity only when it isolates assets immediately available to the holder route. Mixed reserve or accounting buckets remain backing context and cannot override a reviewed fallback; for example, USDe retains its 0.5% hot-buffer fallback because Ethena's aggregate Liquid Cash category does not isolate route-executable assets.

Queue-style live telemetry may count only when the adapter proves both a current route buffer and the queued liability from the same evidence set. For DUSD, the Makina path scores only idle Ethereum USDC left after subtracting the USDC value of DUSD already locked in the AsyncRedeemer; its whitelist is represented as issuer-discretionary access rather than a route-status impairment.

If only DEX liquidity exists, it is used directly. Eligible immediate, live, or queue-style redemption can stand alone when DEX liquidity is absent, with route family caps and component scoring as guardrails. Documented offchain issuer routes with eventual-only capacity do not replace missing DEX liquidity; they can only add the independent primary-market bonus when DEX liquidity already exists.

Redemption backstops are scored across access, settlement, execution certainty, capacity, output-asset quality, and cost. Low-confidence redemption routes stay visible on the site but do not uplift the Safety Score liquidity dimension. Documented offchain issuer exits with eventual-only capacity can add a primary-market bonus only when DEX liquidity already exists; they do not replace missing DEX liquidity. Severe active depegs also disable static or non-live-direct redemption uplift unless current live-open redemption evidence exists. Last-known DEX inputs still feed effective-exit scoring when the liquidity cron is stale, with staleness surfaced through liquidityStale / inputFreshness.dexLiquidity.stale. Materially stale or missing redemption snapshots are suppressed from Safety Score liquidity; normal 4-hourly redemption-sync lag remains inside the scoring freshness runway. Unknown route status remains low confidence for proxy-only or weaker evidence, but reviewed documented-bound routes can retain medium confidence when the rest of the evidence gates pass. Same-run live adapter telemetry can also carry token-specific route status and capacity for Liquity-style systems, wrappers, PSMs, Yearn V3 strategy-queue exits, and instant-redemption vaults. Redemption metadata emitted by a live reserve adapter ages out with the reserve snapshot; if it is stale or degraded, the route stays visible but does not score as current capacity.

Current route coverage includes reviewed issuer rails, on-chain collateral redemptions, protocol NAV wrappers, and queued vault exits; newly reviewed wrappers and Nest-style vaults follow the same route-family caps and confidence gates as older configured routes.

Peg Stability Multiplier

After computing the base score, peg stability is applied as a power-curve multiplier: final = base × (pegScore / 100)^0.40. Coins with strong pegs (90+) are barely affected (~4% penalty), while coins with broken pegs are sharply penalized (e.g. pegScore 10 → 60% penalty). Pure NAV fund-share tokens with no configured peg reference keep pegScore = NR and receive multiplier 1.0, while configured NAV wrappers can inherit peg risk from a referenced base stablecoin. The peg dimension passes through the computed peg score directly; severe active depegs are hard-capped after the multiplier using the open event's peak deviation: ≥ 2500 bps (25%+) caps the overall score at F, ≥ 1000 bps (10%+) caps at D.

No-Liquidity-Data Penalty

A further 0.9× multiplier is applied when a coin has no exit-liquidity signal at all — neither DEX liquidity nor redemption-backstop coverage. Weights are redistributed across available dimensions; this 0.9× multiplier is then applied to the final score to correct for the missing liquidity data by applying a flat 10% penalty.

Resilience Scoring

Average of two equally-weighted sub-factors (50% each): Collateral Quality and Custody Model. Chain infrastructure is scored exclusively in the Decentralization dimension. Blacklist capability is reported descriptively but does not affect the Resilience score.

Tokenized RWA collateral is scored by the ultimate reserve or legal custody layer, not only by the smart-contract location of a wrapper token.

Collateral quality is derived from reserve compositions when available. The default source is curated metadata. A live reserve snapshot replaces it only when the current report-card snapshot can prove the feed is fresh, authoritative, independent, and clean. In coverage tables this is the difference between a reserve view being configured and a score-grade live reserve actually being used. For report-card scoring, the live snapshot must carry scoring-eligible freshness evidence: either a verified timestamp path or an explicit on-chain latest-state not-applicable freshness mode. Direct one-bucket on-chain reserve proofs such as Liquity v1 can qualify when the adapter is classified as independent, but weak probe families do not qualify just because they are on-chain. Detail-only static-validated and weak-live-probe feeds remain visible on reserve surfaces, but they never override curated collateral scoring. Each reserve slice is classified into one of five risk tiers and the score is their weighted average. Direct ETH and canonical WETH slices share the same Very Low tier, while ETH liquid staking tokens remain Low. Delta-neutral wording is evaluated by structure: transparent spot or wrapped exposure can stay Medium, but externally managed market-neutral, basis, perp, LP, private-deal, or custody-dependent strategy books are High unless stronger granular evidence shows the slice is only a liquid stablecoin or cash-equivalent buffer. For coins without usable reserve compositions, a coarser enum-based fallback is used. Explicit overrides exist for coins where defaults are incorrect (e.g., protocols on Solana, coins with CEX custody).

Decentralization Scoring

Base score from governance quality tier, then a chain-risk penalty for protocols on less decentralized chains — governance decentralization is undermined when the underlying chain has centralisation concerns — followed by a branch-aware CDP-only oracle setup blend (v8.11), reviewed bridge-route blend (v8.12), and the penalty-only Mint Authority blend (v8.0):

• Immutable code— 100 (no admin keys, no upgrade path — e.g. LUSD, BOLD). Exempt from chain-risk penalty
• DAO governance— 85 (e.g. DAI)
• Multisig— 55 (e.g. GHO, FRAX)
• Regulated entity— 40 (named regulator, license, and independent audit — e.g. USDC, USDT)
• Single entity— 20 (unregulated or unverified issuer)
• Wrapper— inherits tracked parent Decentralization with a wrapper-kind haircut; unresolved wrappers fall back to 10

Resolvable wrappers use the wrapped asset's chain-adjusted, pre-blend Decentralization score: savings wrappers subtract 3, strategy-vault and risk-absorption wrappers subtract 5, and bond-maturity wrappers subtract 8. For example, yBOLD and sBOLD inherit from BOLD, while sfrxUSD inherits from frxUSD.

CDP oracle setup blend (v8.11):

Crypto-backed CDP stablecoins can carry reviewed oracleRisk metadata. When present, the score applies min(score, round(score × 0.75 + oracle × 0.25))after governance and chain infrastructure. Robust setups never lift a score; weak, single-source, laggy, or opaque feeds can drag it down. Missing oracle reviews and non-CDP assets are unchanged. The current tier scores are oracleless/internal 100, redundant failover 95, medianized delay 85, standard external 75, single-source/laggy 45, and opaque/unknown 20.

Since v8.11, reviews can include provenance plus branch rows for collateral markets or chains. If branch rows are present, the weakest branch/profile tier supplies the oracle score. Wrappers and savings variants display inherited parent oracle exposure without adding a separate wrapper-side oracle penalty.

Bridge route blend (v8.12):

Reviewed bridgeRouteRisk metadata can capture issuer-native, canonical, external bridge, lockbox, liquidity, or intent routes. When present, the score applies min(score, round(score × 0.80 + bridge × 0.20)) after oracle scoring and before Mint Authority. Strong issuer-native or canonical routes never lift a score; missing reviews stay neutral; weak external lock/mint, liquidity/intent, or opaque routes can drag it down.

Current tier scores are single-chain/native 100, issuer burn/mint 90, canonical bridge 85, issuer lock/mint 80, external validated network 65, liquidity/intent route 55, external lock/mint 40, and opaque/unknown 20. L2BEAT Interop is used as static review evidence, not as a live scoring dependency.

Mint Authority blend (v8.0):

A rated Mint Authority Score applies as the final stage: min(score, round(score × 0.65 + MAS × 0.35)). The blend only drags the dimension down — a weak privileged-mint path undermines a decentralization claim, while a strong one never lifts it. Coins without a rated Mint Authority Score are unchanged, wrappers take the drag once on their inherited pre-blend score (capped at the parent's blended score), and a Mint authority detail row appears when the drag binds.

Chain-risk penalty (DAO and multisig governance — exempt for immutable-code, wrapper, regulated-entity, single-entity):

• Combined score ≥80 — no penalty
• Combined score ≥60 — −10
• Combined score ≥40 — −25
• Combined score ≥20 — −40
• Combined score <20 — −60

Example: hyUSD (DAO governance, Solana, combined score 45) = 85 − 25 = 60. USDB (multisig, Blast L2, combined score 66) = 55 − 10 = 45.

Dependency Risk Scoring

Dependency scoring runs after upstream report cards are available and uses a topological order across the active dependency graph, so transitive stablecoin exposure is scored from upstreams before downstream coins are finalized.

• Self-backed coins— score by governance baseline: decentralized 90, centralized-dependent 75, centralized 95
• With mapped dependencies— blended score: each upstream's grade is weighted by its collateral fraction, and the self-backed portion (non-stablecoin collateral) scores vary by governance type (decentralized 90, centralized-dependent 75, centralized 95). A −10 penalty applies if any upstream dependency scores below 75
• Unavailable upstream scores— every unavailable weight is scored at 70 inside the same blend, including when every upstream is unavailable. It still triggers the weak dependency penalty and remains subject to wrapper or mechanism ceilings
• Variants and self-holdings— a tracked variant has one serial wrapper dependency on its parent. Mirrored parent reserves do not add parallel weight, and a coin's own treasury-held token remains reserve evidence without becoming a self-dependency

The Worker diagnoses the complete effective graph before traversal. Static cycles require explicit review; live-created cycle members fall back to curated dependency sets, and a graph that remains cyclic is rejected before snapshot and grade-history publication. The dimension payload records raw and normalized contributions, availability, self-backed share, the weak penalty, and any binding ceiling.

Dependency type ceilings— each dependency is classified as wrapper, mechanism, or collateral(default). Legacy wrappers (e.g., syrupUSDC → USDC) are capped at upstream − 3. Tracked parent-linked variants keep the same wrapper edge but use family-specific ceilings: savings −3, strategy-vault −5, risk-absorption −5, bond-maturity −8. Mechanism dependencies (e.g., DAI → USDC via PSM) are essential to the peg — score is capped at the upstream's score. Collateral dependencies use the blended formula with no ceiling.

Self-backed scores vary by governance type: centralized-dependent coins score 75 (systemic coupling risk), decentralized coins 90, and centralized coins 95. Centralized-dependent coins score lower because their peg mechanisms depend on upstream stablecoin infrastructure even for non-stablecoin collateral.

Grade Thresholds

Key Design Decisions

• NR (Not Rated)is used when fewer than 2 base dimensions have data — no misleading partial grades
• Weight is redistributed proportionally among rated base dimensions when some are NR
• Peg stability acts as a multiplier, not a base dimension — maintaining a peg is table stakes, not a differentiator
• Cemetery (defunct) coins receive a permanent F
• Decentralization score is structural, not a value judgment
• Blacklist capability is reported descriptively only and does not affect the Resilience score. Explicit mutable-contract overrides still surface as “possible”. Reserve-side stablecoins, custodied wrappers, issuer-seizable tokenized collateral, custody/CEX rails, and tracked parent-asset exposures now resolve to “inherited” blacklist risk instead of sharing the “possible” bucket.

Dependency Ceilings

When a stablecoin depends on another (wrapper, mechanism, or collateral relationship), its dependency risk score is capped relative to its upstream:

• Wrapper dependency: legacy wrappers and tracked savings variants cap at upstream score minus 3; strategy-vault/risk-absorption variants cap at minus 5; bond-maturity variants cap at minus 8
• Mechanism dependency: capped at upstream score
• Collateral dependency: blended into dependency risk dimension via weighted average

If any upstream dependency scores below 75, a 10-point penalty is applied. These ceilings prevent a wrapped token from outscoring its underlying asset.

Limitations

• Peg stability only reflects price data — can't detect coins “stable” because nobody trades them
• Decentralization is structural, not a value judgment
• Dependency inputs come from score-grade live reserve slices when available, then curated reserve links, then manual dependency metadata; unmapped collateral relationships may still be missed

Caps

• Bounds: cap-limited controls receive the immutable-cap bonus only when every cap-limited mint-capable control explicitly records that its cap cannot be raised. Unknown or omitted cap-mutability evidence stays bounded, but does not score as immutable.
• Incident cap: unbounded or compromised authority with a recorded mint incident is capped by the age of the most recent incident — 10 when under 2 years old, 15 at 2-4 years, 20 at 4+ years. Decay is purely time-based and always stays below the no-incident unbounded cap.
• Unbounded cap: unbounded or compromised authority without a recorded incident is capped at 25.
• EOA cap: a non-issuer-context EOA that can mint or authorize minting without MPC/HSM attestation is capped at 40.
• Confidence cap: verified caps at 100, probable at 90, manual-review at 85, and unknown returns NR.

Wrapper inheritance

`wrapped-or-variant-inherited` rows inherit from `inheritedFrom`. If the parent is scoreable, the wrapper score is the lower of the parent score and a blend of 60% parent score plus 40% weakest wrapper-control score. Missing parents, cycles, unresolved parents, and depth-limit cases return NR.

Dedicated protocol-native sources (Fluid, Balancer, Raydium, Orca, Meteora, PancakeSwap V3, Aerodrome Slipstream, and Velodrome Slipstream) are treated as primary-grade inputs and enter scoring before staged or fallback discovery sources are merged.

Discovery coverage is less page-fragile now: CoinGecko Onchain and GeckoTerminal token crawls read multiple bounded pages, and fallback enrichment can activate for weak partial coverage instead of waiting for a strict zero-pool outcome. Secondary discovery rows with non-finite, negative, or impossible pool TVL are rejected before staging and skipped again at scoring merge time if stale bad data is already present.

Matching is chain-aware: `chain + address` resolves first, and symbol fallback is only allowed when it is unique on that chain for addressless tokens. If an upstream token already supplies an unknown address, it is dropped instead of being remapped by symbol. Pool dedupe uses exact ids plus conservative derived identity keys, so legitimate same-pair pools are not collapsed just because their token set matches. Balancer direct pools now key exact identity off the API's real pool `address`, not the 32-byte vault pool id. Provider-specific ids with underscores or suffixes are normalized into canonical protocol families before identity matching.

Direct-source precedence is also measurement-aware now. A protocol-native pool only replaces an overlapping DeFiLlama row when it has measured non-zero 24h volume, which means Slipstream pool-state rows can expand Base and Optimism coverage without displacing stronger overlapping DL rows when volume telemetry is absent. Exact pool ids from protocol-native sources still stay reserved for later staged-source dedupe even when the direct row itself is too small to score, so discovery feeds cannot re-add the same address with incompatible TVL semantics.

Discovery rows also need authoritative confirmation when they claim a protocol family that already has a clean protocol-native fetch on that chain. In practice, GT/CG/DS staging cannot invent new Balancer, Fluid, Raydium, Orca, Meteora, PancakeSwap, Aerodrome, or Velodrome pools after the native source succeeded; if that native fetch is degraded or unavailable, the scorer fails open and still allows staged recovery rows through.

For identity-poor DeFiLlama UUID rows, staged discovery can use the narrow optional-metadata wildcard only when both sides are unique on chain, protocol, token set, and pool-shape family. That lets one staged exact-pool-id row collapse against one primary row without collapsing parallel same-pair pools.

When protocol-native sources expose pool inventory, Balancer, Raydium, Orca, Meteora, PancakeSwap V3, and the Slipstream integrations now contribute measured balances and fee detail instead of neutral placeholders. Balancer weighted pools are normalized against target token weights before the balance ratio is computed. Fluid reads reserves and fee detail from the official DexReservesResolver on Ethereum, Arbitrum, Base, and Polygon, while Aerodrome and Velodrome Slipstream read pool state from the on-chain Sugar view contracts on Base and Optimism.

Canonical Ethereum Uniswap V2 and BSC PancakeSwap V2 pools can publish exact constant-product execution only after their factory runtime and exact `getPair` binding are verified. Token order, reserves, and decimals must resolve at the same pinned block; other V2 forks and any identity, factory, reserve, price, or read failure stay capability-gated instead of inheriting executable depth.

Classic Aerodrome execution is limited to volatile pools already present in the Base Aerodrome census. Exact models require same-block reviewed factory and implementation runtimes, an exact `getPool(token0, token1, false)` binding, `stable = false`, an unpaused factory, and the pool's dynamic fee. This does not admit generic Solidly forks or deployments on Avalanche, Linea, or Sonic.

Base Aerodrome Slipstream pools can also publish measured exact-execution profiles. Each profile pins the reviewed factory and QuoterV2 runtimes, proves the retained pool through the factory's exact token and tick-spacing binding, and revalidates identity, prices, freshness, capacity monotonicity, and the retained TVL ceiling before scoring. Mature fresh profiles remain route-only if a pool temporarily rotates out of the display shortlist; they never re-enter aggregate liquidity, price consensus, target publication, or V8 scoring. Optimism Uniswap V3 has been retired from the maintained source and measured-execution lanes. The reviewed wM/USDC Raydium direction still captures its pool state and exactly replays the direct quote, but its score eligibility is paused after the first post-activation scoring consumers exceeded the Worker memory limit. Generic Raydium, Orca Whirlpool, Meteora, and unlisted native routes also remain shadow-only.

SunSwap V2 routes on Tron remain shadow-only and score-ineligible while target and quote collection continue for revalidation. The producer proves the canonical factory and pair runtimes, exact pair binding and reserves, the reviewed 0.3% constant-product output, and a bounded latest-state block bracket. It prefers a direct SUN Smart Router path. When that service's three returned candidates are all clean V2 multi-hop paths, it may use the pinned on-chain V2 Router only after proving its runtime, factory binding, exact two-token path, and identical raw output. An invalid direct Smart Router candidate still fails closed. Missing, stale, failed, or identity-mismatched evidence remains capability-gated per target. The SunSwap census still does not enter aggregate liquidity, price consensus, direct-source precedence, visible pool selection, P4 capacity or completeness, or aggregate liquidity inputs.

Repeated sightings of the same physical pool across direct API, staged, and fallback sources are collapsed before DEX price aggregation. Exact direct price evidence can rejoin only when the same canonical pool survives final scoring and both records clear the price-observation floor; derived or mismatched identities remain excluded. A separate challenger snapshot preserves the full retained pool set for depeg checks, instead of relying on the visible top-pools subset. Balancer stablecoin pools also get a narrow stable-pair identity fallback when DeFiLlama omits the subtype in `balancer-v3`, preventing direct-API stable pools from being double-counted as faux weighted rows.

Orderbook fallback rows now validate observable ticker quality directly. CoinGecko deprecated `trust_score`, so Pharos filters those tickers by freshness flags, finite USD price/volume, exchange identity, and USD-equivalent quote assets instead of relying on a legacy badge. The scoring-cron orderbook fallback is reserved for absent, no-price, or tiny DEX coverage; weak but already-covered DEX assets stay on the on-chain repair path instead of receiving time-budget-dependent centralized synthetic books.

PancakeSwap V3 volume now uses a bounded trailing-hour window from the official subgraph's `poolHourDatas.volumeUSD` buckets instead of the latest `poolDayDatas` row, so intraday volume no longer decays toward zero between UTC day rollovers.

Large retained pools must clear the minimum 24h volume floor even when volume is marked unmeasured. After bad pools are filtered and secondary-source TVL caps are applied, every exported aggregate and score input is rebuilt from the retained pool set.

Curve balance, registry, token-price, and metapool TVL enrichment is applied only to Curve DeFiLlama rows. Non-Curve rows that share the same token symbols as a Curve pool keep their own mechanism type and TVL.

Address-grade plain Curve StableSwap-NG pools with rate-bearing inputs can publish a route model only after fresh same-block state verifies `get_balances`, amplification, stored rates, ordered coins, and static fee state. Rate scaling adjusts both balances and references; Curve deducts its captured static fee after the full-input invariant. Stale, unpinnable, identity-mismatched, or dynamic-fee state remains capability-gated. Metapools, CryptoSwap, legacy pools, and all other unreviewed Curve shapes are not widened.

Coverage confidence is measurement-aware. Instead of a fixed score by source family, Pharos now weights how much retained TVL has measured balances and prices, how broad the protocol mix is, and how much of the row depends on synthetic or freshness-decayed fallback liquidity.

Components

Pool Quality Adjustments

• Balance health— continuous ratio (not binary threshold): pools with imbalanced reserves score lower
• Pair quality— co-token scored by Pharos governance classification (CeFi→1.0, DeFi→0.9, CeFi-Dep→0.8) plus static map for volatile assets (WETH→0.65, WBTC→0.6); composite Curve LP aliases such as 3Crv inherit the best quality of their underlying stablecoin basket
• Metapool dedup— uses TVL excluding base pool to prevent double-counting across Curve metapools
• Retained-pool recomputation— HHI, depth, volume, and balance/organic/durability inputs are all recomputed from the same retained pool set before the UI truncates to the top 10 displayed pools

Net Flow 24h

Net Flow answers the first question directly: is a coin minting or burning right now? It is the raw 24-hour mint volume minus burn volume.

• Minting— `netFlow24hUsd > 0`
• Burning— `netFlow24hUsd < 0`
• Flat— `netFlow24hUsd = 0` with activity
• No activity— no 24h mint/burn events in the window
• Invariant— minting vs burning always comes from raw net flow, never from the pressure score sign

Pressure Shift vs 30D

This is the existing Flow Intensity formula under clearer naming. It measures how far current 24-hour flow pressure deviates from the coin's own trailing 30 fully closed daily configured issuance-chain baseline.

denominator = max(baselineDailyAbs × 0.3, $1M)
z = (currentDailyNet − baselineDailyNet) / denominator
pressureShift = clamp(-100, 100, z × 50)

• Baseline period— trailing 30 fully closed UTC days of configured issuance-chain daily net flows and absolute volumes, excluding the current partial day
• Minimum data— requires 7 days of history; returns null (NR) otherwise
• Activity gate— windows with no 24h mint/burn activity or less than $50K absolute 24h flow are marked NR and excluded from gauge weighting
• Ingestion safety— sync state advances only to the shared safe coverage frontier when some event definitions or block timestamps are incomplete; established coverage is marked lagging by cadence-derived block progress, or unknown when the current chain head is unavailable. For quiet assets, completed block-scan span proves window maturity even when the oldest event row has aged out of retention
• Floor— denominator is floored at $1M to prevent noise in low-volume coins
• Interpretation— above +10 = improving vs baseline, between -10 and +10 = stable vs baseline, below -10 = worsening

Bank Run Gauge

Market-cap-weighted composite of all tracked coins' pressure-shift values, producing a single ecosystem-wide configured issuance-chain flow-pressure reading. Gauge weights use each coin's canonical tracked-chain circulating supply. The gauge score maps to one of seven condition bands:

Returns null only when all tracked coins are NR (for example, insufficient history or no 24h mint/burn activity). Coins with null pressure-shift values are skipped from the market-cap-weighted composite.

Flight-to-Quality Detection

Detects capital rotation from lower-scored to higher-scored tracked mint/burn stablecoins — a pattern typically seen during market stress when holders move funds out of weaker assets and into stronger safety-score cohorts.

• Safe classification— tracked mint/burn coins with report-card score ≥65; risky coins are tracked mint/burn coins with score <50. Classification is unavailable when the report-card cache is unavailable or stale
• Dual threshold— active when risky coins have >$100M net outflows AND safe coins have >$100M net inflows simultaneously over 24h
• Intensity scaling— min(100, |riskyOutflows| / $1B × 100), reflecting the magnitude of the rotation

APY Resolution and Source Arbitration

• Tier 1 — Direct on-chain reads: reads protocol state directly, either as an exchange-rate delta (e.g. sUSDe), a conservative reward-only estimator (e.g. LUSD B.Protocol Stability Pool, LQTY only), or scrvUSD's Yearn V3 profit-unlock current-rate reader
• Tier 2 — DeFiLlama pools: matches the coin to a DeFiLlama yield pool via static mapping, chain-scoped wrapper rules, and address-first fallback matching, while explicitly preserving wrapper pools that upstream marks as non-stablecoin when they are configured as relevant yield sources, allowing exact-pool curated overrides for assets such as XAUT, and TVL-weighting exact pool groups when one tracked asset maps to chain-isolated wrapper vaults. Wrapper-over-native venues such as BOLD/yBOLD stay classified as native yield rather than governance-set when the wrapper is just packaging the protocol's own Stability Pool return
• Tier 2.5 — Protocol-native venues: ingests curated protocol-owned APIs and protocol-specific on-chain venue readers when the canonical savings path is not representable as a reliable DeFiLlama pool; these rows stay in the curated tier rather than inheriting Tier 1 deterministic precedence reserved for native wrapper readers. Royco Dawn senior and junior tranches publish here as structured-tranche rows keyed by royco-dawn:<chainId>:<marketId>:<side>, while Midas mMEV publishes a NAV-appreciation row from the issuer-listed mMEV/USD oracle
• Tier 3 — Price-derived: for NAV tokens only, derives APY from 7-45 day price appreciation in `supply_history`
• Tier 4 — Rate-derived: for dividend-distributing and Treasury-tracking tokens, derives APY from the selected benchmark registry entry net of known fee spreads, using USD by default, product-specific EFFR where configured, 3-month compounded €STR for EUR pegs, 3-month compounded SARON for Swiss-franc pegs, the CBR key rate for RUB pegs, and BIST TLREF for TRY pegs. Rate-derived rows can also carry an explicit benchmark override for PYS/excess-yield provenance without changing the APY derivation benchmark

Deterministic and curated paths can all contribute rows, then a confidence-weighted arbitration layer chooses the best row. Divergent discovered or fallback sources can be demoted or rejected when a canonical source disagrees materially. Protocol-native supplemental lending venues such as Aave V3 do not outrank stronger native wrapper yields purely because they query protocol state directly. Within a confidence tier, candidates compare source-risk-adjusted utility after source-risk penalty resolution before falling back to APY and TVL tie-breakers, and Resolv / USR-linked lending-opportunity venues are excluded from publication entirely. Published lending-opportunity rows also need observable venue TVL and must clear the higher of the absolute TVL floor or 0.1% of the tracked stablecoin's current supply. Linked tracked-variant rows can become parent alternatives when they represent native/wrapper yield, while third-party lending-opportunity rows stay on the asset that owns the venue, and explicit lending overrides only publish for active assets.

Yield-bearing coverage is now explicitly inventoried per asset. If no reliable runtime source exists, the asset is marked as an intentional gap rather than silently disappearing from audit coverage.

Royco Dawn tranche rows are opportunity rows, not stablecoin registry additions. Senior rows are capped at or below the underlying Safety Score; junior rows receive first-loss, utilization, coverage, market-status, drawdown, TVL, withdrawal, explicit access, and venue-posture penalties. These tranche scores are used by PYS for the opportunity row only.

Deterministic rows keep their own source identity (`onchain:<stablecoinId>`) rather than sharing a pool UUID with curated sources, so source-aware history and previous-rate lookups stay isolated when both paths coexist. Linked variants and protocol-specific on-chain rows also preserve their exact modern keys; only pre-source-key history and the named LUSD legacy alias normalize to a parent deterministic key.

Trailing APY metrics are computed from source-specific history rather than a mixed coin-level series, so source switches no longer contaminate the displayed 7d/30d averages.

Read-time data-stale warnings are also cadence-aware: hourly families attach only after three missed sync-yield-data intervals (about 3 hours at the current publisher), while price-derived rows wait 36 hours because they are backed by daily supply_history snapshots and rate-derived rows wait 48 hours for the daily benchmark producer. Ordinary exchange-rate anchors expire after 14 days; price-derived and Midas/Ondo NAV anchors remain valid through their configured 45-day comparison window.

Freshness eligibility is applied before confidence arbitration. A stale deterministic candidate cannot beat a fresh curated candidate, and every benchmark used by a published row is evaluated independently. Fallback benchmarks remain score-bearing but degraded while they are within the 48-hour scoring TTL; expired source or benchmark evidence is retained for audit with an NR PYS and explicit provenance.

Calculation mode and evidence class are separate. Exchange-rate math can be deterministic while the product estimate remains a modeled proxy; fresh direct first-party, on-chain, and curated observations therefore outrank a modeled proxy on evidence quality. Rankings label evidence as rated, estimated, partial, or NR. Missing critical freshness or Safety evidence cannot produce an exact PYS.

Pharos Yield Score (PYS)

benchmarkSpread = apy30d − benchmarkRate
effectiveYield = max(0, apy30d + benchmarkSpread × 0.25)
sourceRiskPenalty = deriveOrResolve(sourceRisk, neutral=1, max=2.5)
rowUtility = effectiveYield / sourceRiskPenalty
riskPenalty = max(0.5, (101 − safetyScore) / 20)
yieldEfficiency = rowUtility / (riskPenalty ^ 1.75)
sustainability = max(0.3, 1.0 − apyVarianceScore)
PYS = clamp(round(yieldEfficiency × sustainability × scalingFactor), 0, 100)

• Effective yieldkeeps raw APY as the anchor, then adds 25% of the row's benchmark spread so tighter local-currency cash hurdles can lift the score without turning PYS into a pure excess-yield ranker
• Source-risk penaltyuses nested source-risk evidence from measured reward share, source depth, freshness, source switching, bootstrap history, and sourced venue tier where available. History maturity counts distinct UTC observation days rather than raw hourly samples, then clamps the combined penalty to 1–2.5 while treating missing evidence as neutral
• Yield efficiencyrewards higher APY relative to the opportunity and coin risk profile — source-risk-adjusted row utility is divided by the curved safety penalty so weaker safety grades need much more effective yield to compete
• Sustainability multiplier penalizes volatile yields (high variance over 30 days), favouring consistent returns
• Scaling factoris a global constant that normalises scores into a readable 0–100 range after the steeper safety curve is applied

NAV Token Handling

NAV-appreciating tokens (e.g. sDAI, wUSDM, BUIDL) use live report-card scores when the safety framework has enough data for them, including NAV-aware report-card coverage. The default safety baseline of 40 (NR) is a conservative missing-safety fallback with an explicit provenance reason; fresh rows retain an estimated PYS until report-card hydration supplies a full safety assessment.

See the mechanism explainers for tokenized Treasury (T-bill) designs and tokenized credit funds.

Limitations

• Trailing averages require sufficient history — newly tracked coins retain a limited-history penalty until 7 distinct UTC observation days accumulate
• History before v8.31 lacks the full benchmark, source-risk, and scaling input snapshot and is labeled legacy-partial; later points store versioned inputs for exact PYS recomputation
• Rows carrying `safety-unrated` or `opportunity-evidence-missing` remain estimated until the missing safety or market-risk evidence is reviewed; stale source and benchmark evidence remains PYS NR
• Some DeFiLlama and protocol-native surfaces still depend on upstream asset metadata completeness; the resolver now drops ambiguous candidates rather than guessing across duplicate symbols
• The LUSD B.Protocol Stability Pool row is conservative by design: it includes projected LQTY incentives only and excludes ETH liquidation gains
• Price-derived APY (Tier 3) can be noisy for low-liquidity NAV tokens

When a live event is later contradicted across the peg by a low-confidence primary price, the detector now retires the stale live row immediately and routes the replacement move through pending confirmation instead of leaving the wrong direction active.

Pending incidents are no longer write-once snapshots. While a candidate is waiting for confirmation, Pharos now preserves the original first-seen timestamp, refreshes the current last-seen state, tracks the worst same-direction move, and resets the pending row cleanly if the market flips to the opposite side of the peg.

DEX cross-validation uses explicit trust gates: detection and pending confirmation only trust fresh DEX rows with at least $1M of aggregate source TVL, while the public DEX Price Check UI requires a lighter but still non-trivial floor of $250K. Aggregate DEX rows also need deeper corroboration before they can mutate live event state: recoveries/suppression and pending confirmation now require at least two protocol-level DEX groups, and ambiguous-primary recoveries are vetoed when a large challenger pool still shows the old depeg direction. Pool challenger confirmation counts distinct protocol/source-family groups, with the documented $5M single-pool exception preserved. For already-open depegs, same-direction aggregate DEX disagreement is advisory rather than a synthetic recovery signal, so events stay continuous until the normal recovery path confirms the coin is back inside threshold.

Every onset waits beyond the full trigger threshold for at least 15 minutes, even when multiple sources already agree. Pending confirmation chooses off-chain confirmers by source family from the primary agreeSources set. CoinGecko-family primary evidence cannot be confirmed by CoinGecko again, and Pharos does not treat DefiLlama's coingecko:{id} mirror as independent. Promoted rows store canonical keys such as temporal:15m, coingecko-confirm, and dex:curve for auditability.

Extreme moves of 50% or more, small-cap assets, and fresh multi-source clusters all use the same minimum 15-minute onset window. Independent source agreement can satisfy the source rule after that window, but it never bypasses temporal confirmation.

Non-USD fiat pegs use the live fiat FX rate as their primary reference whenever it is available, even when three or more same-peg assets are tracked. A peer median is only a fallback and must contain at least three contributors; thinner peer groups or an empty peer set fail closed. The same authority gate covers the displayed deviation: while no trustworthy reference is available, peg surfaces report the current deviation as reference unavailable instead of quoting a self-referential number. Once a live row is already open, a fresh non-cached multi-source primary cluster can retire it after recovery even if that source mix is still too soft to open brand-new events directly.

For supported fiat pairs with a CoinGecko native-currency quote, depeg routing checks that quote before trusting a derived USD-versus-FX move. That means BRZ-style BRL reference drift can no longer open, sustain, or confirm a live depeg when the fresh BRZ/BRL quote is near parity; conversely, the native quote can initiate a pending candidate when the USD-versus-FX path masks the native discount. Historical backfill follows the same principle for supported non-USD fiat assets: when CoinGecko exposes a native fiat pair, replay prefers that native history and compares it directly to the native 1.0 peg before falling back to USD-plus-FX reconstruction. In that native-replay mode, Pharos uses daily points plus a two-point confirmation window across 36 hours so thin hourly native prints do not manufacture long false historical depeg streaks.

Resolution uses hysteresis and persistence rather than the onset boundary. A live event enters recovery only at half the trigger threshold, then must remain there for 15 minutes before closing; a move back into the deadband or depeg range resets that recovery timer. This prevents near-boundary prices from repeatedly closing and reopening one incident.

Live depeg events still require at least $1M of current circulating supply. Historical replay applies the same floor from historical supply snapshots, or from current stablecoins-cache supply when historical supply is absent; if neither supply source exists, backfill preserves existing rows. Below that floor, the detail page may still show the current price deviation from peg, but it labels live event coverage as limited instead of implying the coin held peg.

PegScore begins at a reviewed replay-coverage anchor when one is curated for the asset; otherwise it uses the documented age and first-observation fallbacks. Detail and tracker surfaces distinguish projected incidents from their constituent threshold crossings and publish a recent 90-day peg view whose denominator contains only observed coverage.

DEWS (Depeg Early Warning System) computes forward-looking stress every 30 minutes from market, liquidity, confidence, blacklist, flow, and yield signals, with optional PSI-based amplification during systemic stress. Blacklist activity is attributed through the tracker config's canonical stablecoin ID, so same-symbol siblings do not inherit one issuer's freeze events. Its divergence input now reuses the live depeg DEX trust floor, so fresh-but-thin DEX rows stay visible for analytics but do not affect the score unless they pass the same `$1M` aggregate-TVL gate. The Mint/Burn Flow signal separates 30-day baseline coverage from source freshness: a fresh zero-volume 24-hour row is calm, while a mature baseline with no fresh 24-hour row is unavailable and recorded as stale.

Historical DEWS daily snapshots do not retain the underlying DEX trust metadata needed to replay that gate exactly. When operators remediate the old thin-DEX window, the repair path refreshes current rows and prunes unrecomputable daily history back to the Mar 9, 2026 trust-floor boundary before new snapshots are published under the stricter rule.

PegScore

Composite 0–100 score measuring how faithfully a stablecoin holds its peg. The tracking window spans up to 4 years and first honors a reviewed replay-coverage anchor when one is curated for the asset. Without that verified anchor, PegScore prefers a curated launch date, then the earliest supply snapshot, then the first durable Pharos valid-price observation for priced assets without supply-history coverage. Young coins are not diluted across history they didn't exist for, and unobserved pre-coverage days are not silently treated as stable. Requires at least 7 days of tracking data; returns null otherwise. Scores based on 7–30 days are marked as “Early score” to signal limited history. The API additionally publishes a coverage-aware 90-day view with observed days, incidents, constituent threshold crossings, and peg percentage.

PegScore Formula

pegScore = 0.5 × pegPct + 0.5 × severityScore − activeDepegPenalty − spreadPenalty

PegScore Components

DEWS

DEWS is a per-coin, forward-looking stress score (0–100) for depeg stress. It is not a calibrated probability. It is computed every 30 minutes from 8 sub-signals. Only signals with available data participate; weights are redistributed proportionally across available signals.

Bootstrap tolerance is one-time only. Missing optional tables can be ignored before the first successful publication. After that, stale or missing core liquidity inputs are recorded as source failures. The cron still writes rows that meet signal coverage, then marks the run degraded instead of treating the missing input as startup noise.

Mint/Burn Flow requires both a mature 30-day baseline and a fresh 24-hour hourly row. Fresh zero-volume rows remain available as calm flow evidence, while stale baseline-only input is recorded as a source-freshness failure and its signal weight is redistributed.

The Yield Anomaly sub-signal combines legacy warning strings with populated Yield Intelligence source-risk, source-switch, and rank-attribution stress evidence. Neutral, missing, or malformed structured yield rows remain unavailable rather than adding zero-stress signal weight.

Score Formula

base = sum(W_i × S_i) / sum(W_i); psiAmp = PSI < 75 ? 1 + ((75 - PSI) / 75) × 0.3 : 1; contagionAmp = same-peg first-pass bump, clamped to 1.2; DEWS = round(clamp(0, 100, base × psiAmp × contagionAmp))

At least 2 available signal sources (total weight ≥ 0.30) are required; otherwise DEWS returns null.

Sub-Signals & Weights

• Supply Velocity (0.25) — rapid redemptions (bank run), measured from 1-day and 7-day supply contraction rates
• Pool Balance Drift (0.20) — one-sided selling pressure in DEX pools, blending balance stress, pool stress, and worst-pool imbalance
• Liquidity Erosion (0.15) — LPs fleeing, measured from 7-day changes in liquidity score and TVL
• Price Confidence (0.15) — N-source consensus failures across CoinGecko, DefiLlama list, GeckoTerminal, Pyth, Binance, Coinbase, RedStone, Curve on-chain, and DEX prices; maps confidence levels (high/single-source/low/fallback) to stress values
• Cross-Source Divergence (0.15) — fragmented pricing between multi-source consensus price, DEX price, and peg reference
• Blacklist Activity (0.10) — issuer emergency freeze surges for canonical stablecoin IDs with direct blacklist-tracker coverage
• Mint/Burn Flow (0.10) — redemption surge vs minting from on-chain Transfer event data; requires at least 7 baseline days and a fresh 24-hour mint/burn row, with fresh zero-volume rows contributing zero flow stress
• Yield Anomaly (0.05) — warning-signal and structured source-risk accumulation from yield spikes, divergence, TVL outflows, negative trends, reward-heavy regimes, thin/stale sources, source switches, and source-risk rank drivers

Threat Bands

• CALM (0–15) — no stress signals detected
• WATCH (16–35) — mild stress on 1-2 indicators
• ALERT (36–55) — multiple indicators elevated
• WARNING (56–75) — strong stress signals, depeg plausible
• DANGER (76–100) — severe stress across available weighted signals

Edge Cases

• NAV tokens are excluded entirely (price appreciates, not pegged)
• Non-USD pegs: cross-source divergence is dampened by 0.7 (noisier FX pricing)
• Small coins (<$50M): supply velocity is dampened via a logarithmic size factor
• Missing or stale DEX and mint/burn freshness stays unavailable; zero-current rows retire; aggregate freshness uses the newest current row while the body exposes oldest-row lag

Supply history is daily and mint/burn coverage is partial (about 141 of 400 coins), so coins with neither usable source degrade to Insufficient Signal on supply-dependent kill signals rather than guessing. The depeg-event provenance side-table is unpopulated in production, so audit-verdict gating is not used; corpus quality comes from incident grouping, quarantine of flappy coins, and a minimum-severity floor. Terminal truth derives from cemetery/frozen status and the live deep-and-sustained-open pattern, never from the presence of a recovery price on a backfilled row.

Acceptance gates: Stage 1 must score Recovery Unlikely on clearly-attributable deaths (UST, IRON, USR) and must not on major recoveries (USDC during SVB, DAI on Black Thursday, LUSD/BOLD wobbles); Stage 2 median and typical ranges must contain realized resolution times at the documented coverage rate, with leave-one-coin stability and a stable canonical lineage hash. Abandoned slow-deaths that never present a sharp depeg are out of scope. The full methodology, limitations, and backtest plan live in docs/depeg-resolver.md.

DDRR does not replay today’s resolver over historical rows. It compares the frozen first-published DDR outcome with the later event outcome, keeps append-only errata visible, preserves immutable trigger/readiness metadata, and separates policy-universe coverage from scoreable recovery/duration accuracy. If a health deferral is followed by recovery or reliable terminal evidence before a healthy lock, the row remains a pre-lock coverage outcome rather than a retroactive forecast. Rollout-active incidents that already existed before DDRv2 use the public-contract effective timestamp as the fairness boundary for the same pre-lock coverage test.

The blacklist tracker stores event-time rows separately from a persistent freeze-ledger snapshot. Each cron run processes new events since the last indexed block; new blacklist rows refresh last-known snapshots, while later unblacklist events do not delete historical ledger rows.

Backlog sync handles gaps from missed cron runs or RPC failures by replaying events from the last confirmed cursor. Tron events use a separate ingestion path due to the TRC-20 event format differences, and missing Tron account/token-balance data remains provider-missing rather than being converted to zero.

The public-facing freeze totals combine per-chain counts into a single figure. Destroy/seize events can overwrite the stored amount when they provide better seized-value evidence, and the public summary reads the persistent ledger rather than treating unfreeze rows as historical deletion. The legacy active fields remain available for the local net-active state machine, but public freeze exposure should use the tracked ledger fields.