Methodology

Current source admission and exceptions

Hive internal market (HBD/HIVE) evidence is HIVE/USD divided by the native midpoint. At least 500 HBD per side within 2%, narrow spread, recent non-self turnover, fresh non-regressing node heads and an independently timestamped CoinGecko HIVE/USD parent are required. The parent must be within five minutes; the effective local-fetch clock is the earlier leg, and neither publication nor retry refreshes either leg. This is one CoinGecko-dependent soft observation, not two independent votes or a conversion-price guarantee. It remains single-source without independent agreement and requires depeg confirmation, ordinary validation and pool challenge; a near-par direct CG quote can win the family over a native depeg. Failed gates remain unavailable. HBD supply is the protocol's own debt perimeter, current HBD supply minus the liquid DAO treasury, read from the same bracketed node proof; CoinGecko caps do not override it and a failed read withholds supply.

SOFID uses exact-identity CoinGecko/Kraken observed market consensus, not a nominal protocol-par override. Discounts and premiums keep their value and original clock; Kraken remains local-fetch and confirm_required. Missing quotes and carried nominal references stay unavailable, not $1. Issuer-conversion references for ONED/PYUSDx do not establish direct-wrapper identity or guaranteed liquid pegs, and fresh own-market discounts win.

CoinGecko Onchain is the sole enabled exact-address augmentation provider, key-gated and explicitly allowlisted. Only canonical deployments with missing prices or below-target source depth qualify, under identity, freshness, liquidity and request-budget gates. Unknown addressed tokens are not reinterpreted by symbol; reviewed deployment narrowing must still match current metadata. Eligible exact reviewed overrides reserve one bounded request before network round-robin; fairness rotates inside priority cohorts and persistent active gaps precede breadth refresh. Hourly corroboration and quarter-hour missing/address-priced refresh do not renew source clocks. DexScreener exact-pool fallback is separate from this address-provider adapter.

Promoted DEX lanes carry structured source-filter telemetry and confidence profiles; a lone protocol needs hard-source corroboration unless no non-DEX voice exists. Their presence withholds overlapping aggregate fallback even when their candidates fail corroboration. Direct-API quote legs prefer tracked live stablecoin prices, not unconditional $1 symbols.

Challenger snapshots retain qualifying protocol diversity before their TVL coverage cap. Challenger and DEX-bridge pools must pass pair-price coherence: the tracked leg's USD price agrees with the pool pair ratio × the counter-leg's USD price. A DEX row without a usable primary for deviation, outlier and display guards is withheld. Pool challenge uses per-protocol medians, not one rogue pool; high-TVL multi-protocol and narrowly hard-corroborated single-protocol exceptions retain their technical gates. NAV tokens are excluded from challenge. Replacement updates candidate prices; corroborated severe downside including depeg-authoritative evidence may lose confidence but retains its price and satisfies the temporal-jump guard. Blocked DEX slugs such as Bunni cannot contribute.

CoinGecko discovery tickers are price-only evidence, separate from curated Kinesis ticker/CEX primary lanes. Non-stale, non-anomalous USD-equivalent quotes need positive finite prices, at least $1,000 observed USD flow and non-future registry freshness within 24 hours. Exchange prices are volume-weighted; aggregate weights use observed flow × ticker confidence 0.55, never synthetic depth or TVL. Tickers request no depth and attribute zero TVL, including legacy rows; genuine pools retain TVL-based weights. Zero-source-TVL price publication still needs usable primary, peg, outlier and display guards and cannot clear primary, UI or depeg DEX trust floors. Price-observation counts may include tickers; liquidity pool counts cannot.

FX uses supported Chainlink intraday/commodity references, Frankfurter and the dated secondary mirror, with ExchangeRate-API as tertiary daily fallback. A failed live fetch can carry only in-cadence dated references; independent OXR, Chainlink and metals probes continue so a recovered intraday subset can return live. CZK/PLN use business-daily ECB via Frankfurter and AED the calendar-daily secondary feed, with currency-specific validation and supported CoinGecko native quotes. Validation bands and the dirham peg never substitute for an admitted provider/reference. Native-peg corroboration can fill or correct divergent weak/mixed USD marks and veto/resolve derived USD/FX depeg moves, but is not replay-safe primary consensus. Historical non-USD replay prefers direct CoinGecko native-fiat history against 1.0 before USD history.

JLTXX needs exact Token Class transaction NAV with its original dealing date and separate five-day business-day checks, finalized EIP-1898 native shares/observed decimals/canonical hash/time and a reviewed temporal/legal perimeter, even with positive CoinGecko market cap. Class assets are never circulating supply. Staged bootstrap only captures evidence; it cannot activate JLTXX or publish scores. Quarantine persists until approved runtime price/market-cap admission.

Reviewed USDU Uniswap V3 USDU/USDT recovery requires QuoterV2 sells of 1,000 and 100,000 USDU agreeing within 5%, actual inventory, code/implementation/pool identity and canonical-block checks. Both block and trusted USDT parent must be newer than five minutes. It never replaces a publishable price and has no replay-safe or standalone depeg authority. AUDm/CHFm/CADm/COPm/JPYm may use verified Mento pool/Broker sells × fresh USDm under identity, fee, capacity and trading-limit gates. BD uses reviewed Aero BD/USDC code, exact pool, transferable inventory and bounded impact; the older block/USDC clock governs five minutes. Legacy USDv uses Jupiter sells matched to live Meteora state, active-bin inventory and fresh Solana clocks. These routes retain fallback confidence and weak-source safeguards.

Source registry freshness kinds and maximum trusted ages govern admission. CoinGecko precision=full and upstream last_updated_at keep unrounded threshold inputs and reject stale rows. Bitstamp, Coinbase and Curve on-chain use upstream-observed provenance; crvUSD's dedicated Curve oracle circuit enforces five-minute block freshness. Replay cache also enforces each source's native age inside the composite six-hour cap. Hard single-source depeg authority requires source-native freshness, not a local collection timestamp.

Fallback enrichment retains budgets, circuits, exact identity, liquidity/depth, corroboration and peg-aware plausibility gates. Thin executable routes can qualify for fallback display but not standalone depeg mutation or replay continuity. Exact reviewed pools precede lower-fidelity duplicates. DexScreener complete single-token pool discovery and multi-address batch pricing use separate endpoints; symbol-only search is retired. Weak fallback/search-family address quotes must stay within 500 bps of a fixed peg unless stronger evidence corroborates them. DefiLlama contract and DexScreener discovery/liquidity paths retain dedicated circuits; provider diagnostics and GeckoTerminal probe statistics remain visible in /api/status. Guarded AZND no-quotes are coverage gaps, while thrown/timed-out work fails the circuit.

Live protocol recovery is limited to active registry assets, excluding frozen/quarantined budget consumers. Optional already-priced refresh failure does not poison the recovery circuit while the incumbent remains usable. Severe fixed-peg downside needs independent-family corroboration unless an explicit protocol redemption or pool-challenge mark applies; list-only aggregator pairs remain single-source. Corroborating candidates survive subsequent validation when the selected result is unchanged, and fresh replay-safe price_cache can preserve confirmed severe-depeg continuity. Unresolved routes remain fail-closed.

Short-lived DefiLlama contract and Jupiter quotes refresh quarter-hourly under separate 25-second pass budgets. Reviewed gaps remain hourly unless a publishable current quote is source-owned; stale labels do not qualify. Missing M and XO remain eligible. Named supplemental prices cannot re-enter as DefiLlama-list observations; reviewed USDFC low-volume quotes retain fallback confidence and original clocks within seven days.

DefiLlama chain current at zero, missing or at most half a vetted baseline triggers reviewed on-chain/chart repair or unavailable chain supply. Material gaps quarantine the asset, carrying last vetted values for at most seven days. After that, supply becomes unavailable, unless the deficit is at most 5% of the vetted total: then the observed remainder publishes as labeled partial coverage, with the chain still null and quarantined. Time alone cannot turn the drop into a redemption. Disappearing chain rows cannot release quarantine. Reviewed release requires observed list current and a review between that incident's first detection and the run clock; omitted chains and later incidents cannot inherit old reviews. A reviewed issuer-native on-chain read (EVM or Solana) that confirms the collapse can release a chain, including one the list omits, at the native amount. Releases do not add supply or override DefiLlama aggregates.

CoinGecko-detail caps can receive a chain split from complete reviewed on-chain shares within a calibrated entry band and wider retain band. Only previous entered/retained admission grants retain hysteresis; a fresh read after carried evidence must pass entry again. CoinGecko keeps the total, source, observation clock and historical aggregate buckets. The same admitted supply price values the on-chain ratio; NAV/yield-bearing assets never assume par. Canonical/escrow accounting prevents double counting and leaves unresolved custody unattributed. Unreadable legs and deadline-skipped reads may carry admitted shares within the existing restore ceiling, preserving original observation evidence. Whole-row restores also label valid partition evidence carried. Ratio rejection and missing valuation cannot carry. Per-asset chainPartition identifies entered, retained or carried shares. Candidate reads rotate under a bounded stage. Preferred supply fails closed; USTB and gtUSDCp reject fresh or carried partitions.

Unavailable supply and completeness survive fallbacks and history: old chain current stays null, observed zero stays zero (including at supplemental merges), and historical buckets require complete peg/supplemental evidence within the 14-day as-of budget. Joined circulation/escrow accounting uses canonical blocks, historical valuations match supply timestamps, and 7D/30D comparisons never silently lengthen their windows. USDC-denominated redemptions use observed USDC/USD, Solayer uses canonical SPL accrual, and FX/cache carries preserve cadence and original age; partial FX stays incomplete. Coverage and replay describe admitted rows, not rejected candidates.

Challenger eligibility and weights use the actual quote source's bounded TVL, never unrelated retained inventory. Composite prices inherit their parent's original clock; sync writes and DEX publication cannot refresh family quotes or aggregate contributors. Future or impossible FX days and out-of-policy epochs stay unavailable until genuinely replaced. USDT-denominated Curve ratios use admitted USDT/USD, with DOLA retaining composite depth two.

Zephyr scanner quotes with known invalid, stale or excessively future clocks cannot become undated prices or fund dependent ZYS NAV valuation. Genuinely absent clocks retain the existing undated policy. Independent ZSD official circulation and preferred market quotes keep their own provenance; rejected scanner prices do not erase them.

Source weights

Consensus algorithm

The consensus engine clusters all available source prices for an asset and picks the most reliable result:

1. Collect all source prices with non-failed circuit breakers
2. Collapse repeated quotes from one source to their median, then count each registered provider family as one independent voice by retaining its strongest representative
3. Find the largest fully pairwise cluster of sources that agree within 50 bps (fixed pegs) or 500 bps (NAV tokens)
4. Break equal-size clusters by total weight, then stronger trust tier, then tighter spread, then peg proximity when available
5. If the winning cluster has 2+ members, publish its median price and separately keep the best cluster member for provenance
6. Choose that internal selected source by weight, then trust tier, then peg proximity, then source key
7. If no cluster of 2+ forms, fixed pegs stay on fixed-peg rules and fall back to the best trusted single source
8. Pool challenge: if all agreeing sources are challenge-eligible (CG, DL-list, DEX average, or promoted protocol DEX sources without a hard-source corroborator), check each large priced DEX pool (≥$100K TVL) from the published challenger snapshot built from the full retained pool set. If any protocol-level median diverges beyond the peg-type-aware threshold (500 bps for USD pegs, min(2 × depeg threshold, 500) for non-USD pegs), downgrade to low, and replace the price when at least two independent protocol-level medians corroborate that divergence unless severe-downside preservation applies. A high-TVL multi-protocol replacement can also use the peg depeg threshold when the published price is inside that threshold and at least two $5M+ protocol medians are depeg-sized in the same direction and mutually coherent inside the pool-challenge bps band. A one-protocol replacement remains allowed only when the protocol median has at least $5M TVL, the DEX median crosses the peg depeg threshold, and a hard primary candidate agrees within the normal consensus threshold

Authoritative price overrides

For wrapper-style assets whose executable value is set by direct protocol redemption, or by an instantly redeemable tracked base asset, rather than by secondary-market liquidity, the pipeline switches to an authoritative redemption-based mark:

• cUSD (Cap): getBurnAmount() — cUSD → USDC redemption rate
• iUSD (infiniFi): receiptToAsset() — iUSD → USDC redemption rate
• USDai: inherits tracked PYUSD pricing because base USDAI is treated as an instantly redeemable PYUSD wrapper
• iUSD (Initia) / USDCx: inherit tracked AUSD or USDC pricing when the parent rail is fresh and replay-safe
• M / USDK / XO / USDnr: inherit tracked wM pricing because Pharos treats them as base-unit or instantly redeemable M0 extension paths rather than free-floating market-priced assets; M requires wM itself to report fresh replay-safe single-source confidence
• ONED / PYUSDx: reviewed one-for-one issuer-conversion references use tracked USDC or PYUSD. Fresh admitted own market prices win, including discounts; own market history is retained rather than replaced with parent history. These routes do not establish direct-wrapper classifications or guaranteed liquid market pegs
• Nominal par references: source-reviewed USD and FX redeemables with observable supply carry par as a separate nominalPriceReference (source protocol-par). Non-USD par is converted through a fresh or static FX reference, recorded on the reference as fxReferenceType and fxObservedAt. Par is never an observed price: a market quote wins only when the depeg detector would act on it without confirmation (fresh, not cached or fallback, and backed by depeg-authoritative exchange, oracle or on-chain sources). CoinGecko and DefiLlama agreement alone, thin, stale, cached or fallback marks never displace par. Otherwise the published price is par with priceObservedAtMode = "nominal_reference", no observation time and no confidence, which cannot open depeg events, and replay preserves existing history instead of synthesizing par points. SoFiUSD has no nominal override and instead uses its contract-verified CoinGecko/Kraken market consensus; unavailable observed quotes remain missing, and the ordinary depeg-authority gates are unchanged
• ERC-4626 NAV wrappers: reviewed vaults such as Sky sUSDS, Ethena sUSDe, Spark Savings, Gauntlet, Steakhouse, Sentora, Falcon, Resupply, Frax, Keyrock, Wintermute, Galaxy, Clearstar, Hyperithm, Yearn, Avant, Noon, Yuzu, and Aave Umbrella use canonical-chain convertToAssets() reads multiplied by a fresh trusted tracked parent price, including EURCV for euro-denominated shares; without that parent price, the wrapper remains unpriced. Legacy Spark USDC is a separate 18-decimal-share deployment from 6-decimal-share Spark V2
• sGHO / Idle tranches: protocol-specific previewRedeem() or virtualPrice() reads price assets whose executable value is not represented by thin secondary markets
• AZND thin-pool recovery: the exact Curve AZND/USDC route must pass identity, freshness, balance-floor, and quote-impact guards; a guarded no-quote remains an explicit coverage gap, while a thrown provider failure counts against the route circuit
• crvUSD (Curve): PriceAggregator.price() enters primary consensus as a live market voice, not a protocol override

Sentora pathUSD's exact Tempo vault route can use a fresh replay-safe single-source pathUSD parent. The resulting NAV retains the parent's market source, single-source confidence and original observation time; it does not gain protocol-authoritative confidence. Stale, fallback, cached and non-replay-safe single-source parents remain unavailable.

Pre-intake NAV supply valuation uses the same reviewed vault allowlist and the configured Worker RPC map as live enrichment, including Robinhood's existing keyed Dwellir route. It adds no endpoint or nominal-par fallback; an unavailable route or untrusted parent leaves valuation unavailable.

DEX pool discovery uses DexScreener's complete single-token token-pairs/v1 endpoint; the bounded multi-address pricing fallback remains on the separate tokens/v1 endpoint.

Apart from nominal par references, these overrides set priceSource = "protocol-redeem" and priceConfidence = "high" when the quote validates against peg bounds, and they are applied after the GeckoTerminal probe so later market checks cannot overwrite them. Recovery scheduling treats a current price as usable only when it is positive and carries publishable source and observation-time provenance, and each live candidate has a bounded slice of the shared budget so one stalled wrapper cannot skip the remaining active gaps. Parent trust is judged on the composite's replay-safe core, so an agreeing non-replay-safe corroborator that joins a parent's consensus label can neither strip trust from a high-confidence parent nor upgrade one the gate would otherwise reject. Vault NAV routes persist their last-good on-chain rate, and a failed live read can publish that cached rate times the fresh trusted parent price as an explicit low-confidence protocol-redeem-cached-rate source — bounded to 24 hours, never replacing a live price, and never depeg-authoritative. Audited wrapper exceptions can use a fresh high-confidence same-run parent consensus for live pricing while keeping historical replay on replay-safe sources.

CoinGecko Supply Gap-Fill Limits

DefiLlama list totals remain the canonical supply for DefiLlama-backed assets. When exactly one reviewed deployment is missing from DefiLlama's chain breakdown, a fresh CoinGecko market cap may raise the aggregate only while CoinGecko/DefiLlama stays inside a bounded band: a new fill needs a ratio above 1.05 and at most 1.45, an existing fill is kept above 1.02 (hysteresis), and no fill ever exceeds 1.50 at current or at any compared 1d/7d/30d point. All admitted aggregate buckets come from one CoinGecko series, and the row exposes supplyGapFill provenance with the retained DefiLlama total. Since v6.47, each historical remainder is attributed to the missing chain only when every existing chain has an observed bucket and their sum matches the DefiLlama baseline within max($0.01, baseline × 1e-6). Otherwise that missing-chain bucket is null and withheldHistoricalBuckets names the unavailable window; observed chain values are never scaled and admitted aggregates are unchanged. Aggregate admission still fails closed for out-of-band, incomplete or ambiguous supplemental evidence.

Enrichment Pipeline (6-pass fallback)

Assets still missing prices after primary consensus go through a staged enrichment pipeline:

1. Pass 1: Canonical tracked contract identity → DefiLlama coins API, but only prices that pass peg-aware validation can resolve the asset
2. Pass 1b: Tracked alternate deployment fallback only (no synthetic same-address cross-chain probing; same validation gate as pass 1)
3. Pass 2: CoinMarketCap category plus exact-slug quotes; truncated category pages ignore returned rows until the exact targeted lane validates active status, contracts, volume, freshness, and peg bounds
4. Pass 3: Jupiter Price API for tracked Solana mints (authenticated when configured, block-freshness checked, peg-aware, and able to add bounded soft evidence to agreeing low-depth Solana prices)
5. Pass 4: DexScreener exact token-address pools only; the older unique-symbol search fallback is retired, and each run makes at most one same-chain batch of 30 exact addresses with rotating chain and within-chain coverage
6. Pass 5: Allowlisted low-volume CoinGecko recovery, including reviewed NXUSD, Hermetica USDh, Crown BRLV and USDFC observations, published only with fallback confidence and the original observation clock inside the seven-day freshness budget

Broad fallback collection runs hourly outside the primary publication invocation. Pricing v6.52 refreshes short-lived DefiLlama contract and Jupiter quotes every 15 minutes alongside the existing exact-address and exact-DEX refresh. Missing-price or source-owned rows qualify, but reviewed gaps stay hourly unless a publishable current quote is already source-owned; a stale source label is insufficient. The contract and Jupiter passes each have a separate 25-second budget. The same admission guards and original observation clocks apply; staged recovery retains fallback confidence and does not become a trusted parent price for another asset.

Pricing v6.52 also requires a chain-dropout release review to fall between that quarantine's first detection and the current run. An observed list current is still required; an omitted chain or a later incident cannot inherit an older review. Reviewed releases do not add supply or override the DefiLlama aggregate.

Pricing v6.55 stops one small quarantined chain from blanking a whole asset. Once the seven-day carry has expired, a quarantined deficit of at most 5% of the vetted whole-asset total publishes the observed remainder as partial coverage. Nothing is carried or added, the excluded chain stays unavailable and quarantined, and the stablecoin page labels its market cap “Partial supply” with the excluded chain names. A larger deficit keeps supply unavailable. Elapsed time still never accepts the collapse.

DefiLlama-list consensus inputs must retain a DefiLlama origin or an absent legacy source label. Named supplemental prices cannot be relabeled as a second DefiLlama observation; CoinGecko-fallback supply rows remain excluded from this input.

Confidence levels

Price validation

Every price is validated before entering the replay cache. Validation is context-aware with four modes:

• Authoritative primary: can admit deep downside for fixed pegs, but publication still requires corroboration unless the mark is protocol redemption or a pool-challenge replacement
• Fallback enrichment: rejects isolated bad prints below a lower bound
• DEX pool observation: requires the existing $50K TVL floor; independent ticker prices require at least $1,000 observed USD flow with zero TVL attribution and unchanged publication/trust guards
• Historical backfill: validates against per-timestamp peg references

USD and fiat-FX pegs share the same upside tolerance ratio when a usable reference exists, while commodity tokens (gold, silver) keep the broader 2x reference band and scale references by commodityOunces for gram- and 1/1000-ounce assets. NAV tokens use broad positive-price checks. Replay-safe cache storage is limited to strong, replayable prices and now expires after 6 hours.

Scoring formula

The final value is clamped to [0, 100] and rounded to one decimal.

Components

Depeg handling rules

• Core-universe boundary: tracked variants and stable-value investment products do not contribute market cap, trend, depeg penalties, or DEWS stress breadth; their detail and research surfaces remain available.
• Per-coin deduplication: active events are grouped by coin; each coin contributes once using the worst current deviation.
• Native quote domains: non-USD native events never divide a USD price by a native reference. Live and historical inputs use timestamped native start or recovery evidence retained in D1, strictly as-of and younger than six hours. Continuous native quotes are not retained; other windows disclose unavailable price evidence rather than inventing a deviation.
• Daily provenance: daily scores average all samples, including methodology transitions, with the version breakdown and component sample counts disclosed. All-null components are stored as null and display as unavailable chart gaps; observed zero stays zero. Partially observed components average their observed samples and disclose the count.
• Historical rebuild parity: completed-day backfills score any depeg overlapping the UTC day, canonicalize legacy depeg IDs into the current PSI universe, replay USD-domain deviation from `supply_history.price` when possible, never exceed the event's recorded `peak_deviation_bps`, and keep `peak_deviation_bps` as a start-day floor only when the event remained active through the UTC close and a daily snapshot misses the move. Unless that floor applies, a start day whose restored daily price is back inside the configured threshold drops out of the replay. Later days of an active event keep their daily-price deviation. Restore jobs also repair replay-critical daily price coverage, including PSI historical assets, before the PSI rebuild is rerun.
• Age-aware depreciation: fresh depegs get full weight for 30 days, then decay linearly to a 25% floor by asset age 120 days. Contributor costs use the full-precision scoring factor; rounding applies only to visible age, percentage and cost text.

Condition bands

Base Dimensions (weighted average)

Redemption backstop and effective exit

The standalone Liquidity Score remains a pure DEX market-depth metric. Safety Scores use an effective exit score for the Liquidity dimension, built on a best-path model: exit quality equals the best available exit path after redemption is adjusted for current executable capacity and route confidence.

Before that blend, the DEX input is bounded by its retained evidence: reserve-based AMM simulation caps at 85, generic TVL proxy evidence at 60, synthetic or fallback evidence at 55, and provider-inaccessible-only deployment coverage at 45. Older snapshots without these evidence fields and rows explicitly marked legacy remain neutral. The public standalone Liquidity Score is not rewritten by this Safety Score policy.

modeledExitUsd = min(max(supplyUsd × 0.05, 100000), 25000000)

adjustedRedemption = redemption × capacityFactor × confidenceFactor

effectiveExit = round(min(100, max(dex, adjustedRedemption) + independentBonus))

capacityFactor is capped at 1.0 from current executable capacity divided by the modeled exit size. Confidence factors are 1.0 for high-confidence routes, 0.75 for medium-confidence routes, and 0.35 for low-confidence routes. The 10% secondary-path bonus is only applied when the redemption rail is independent from the DEX liquidity path, such as an issuer primary-market rail.

Live reserve metadata counts as executable capacity only when it isolates assets immediately available to the holder route. Mixed reserve or accounting buckets remain backing context and cannot override a reviewed fallback; for example, USDe retains its 0.5% hot-buffer fallback because Ethena's aggregate Liquid Cash category does not isolate route-executable assets.

Queue-style live telemetry may count only when the adapter proves both a current route buffer and the queued liability from the same evidence set. For DUSD, the Makina path scores only idle Ethereum USDC left after subtracting the USDC value of DUSD already locked in the AsyncRedeemer; its whitelist is represented as issuer-discretionary access rather than a route-status impairment.

If only DEX liquidity exists, it is used directly. Eligible immediate, live, or queue-style redemption can stand alone when DEX liquidity is absent, with route family caps and component scoring as guardrails. Documented offchain issuer routes with eventual-only capacity do not replace missing DEX liquidity; they can only add the independent primary-market bonus when DEX liquidity already exists.

Redemption backstops are scored across access, settlement, execution certainty, capacity, output-asset quality, and cost. Low-confidence redemption routes stay visible on the site but do not uplift the Safety Score liquidity dimension. Documented offchain issuer exits with eventual-only capacity can add a primary-market bonus only when DEX liquidity already exists; they do not replace missing DEX liquidity. Severe active depegs also disable static or non-live-direct redemption uplift unless current live-open redemption evidence exists. Last-known DEX inputs still feed effective-exit scoring when the liquidity cron is stale, with staleness surfaced through liquidityStale / inputFreshness.dexLiquidity.stale. Materially stale or missing redemption snapshots are suppressed from Safety Score liquidity; normal 4-hourly redemption-sync lag remains inside the scoring freshness runway. Unknown route status remains low confidence for proxy-only or weaker evidence, but reviewed documented-bound routes can retain medium confidence when the rest of the evidence gates pass. Same-run live adapter telemetry can also carry token-specific route status and capacity for Liquity-style systems, wrappers, PSMs, Yearn V3 strategy-queue exits, and instant-redemption vaults. Redemption metadata emitted by a live reserve adapter ages out with the reserve snapshot; if it is stale or degraded, the route stays visible but does not score as current capacity. A disclosure the redemption run admitted as fresh is carried forward until that run's own budget (the next scheduled refresh plus one retry) expires, keeping its original observation time, so a source budget lapsing between runs does not drop the route.

Current route coverage includes reviewed issuer rails, on-chain collateral redemptions, protocol NAV wrappers, and queued vault exits; newly reviewed wrappers and Nest-style vaults follow the same route-family caps and confidence gates as older configured routes.

A DEX route whose measured observation ages past its freshness window is derated rather than discarded: it keeps its place in the exit capacity denominator at reduced credit, because an expired producer window is weaker evidence rather than absent evidence. A route with no retained observation at all still fails closed, as does a stale non-atomic redemption route. Dropping expired routes outright previously let an ordinary producer-schedule delay move a score with no market event behind it, and propagated that move to every asset backed by the affected one.

Peg stability multiplier

After computing the base score, peg stability is applied as a power-curve multiplier: final = base × (pegScore / 100)^0.40. Coins with strong pegs (90+) are barely affected (~4% penalty), while coins with broken pegs are sharply penalized (e.g. pegScore 10 → 60% penalty). Pure NAV fund-share tokens with no configured peg reference keep pegScore = NR and receive multiplier 1.0, while configured NAV wrappers can inherit peg risk from a referenced base stablecoin. The peg dimension passes through the computed peg score directly; severe active depegs are hard-capped after the multiplier using the open event's peak deviation: ≥ 2500 bps (25%+) caps the overall score at F, ≥ 1000 bps (10%+) caps at D.

Grade stability

A published letter grade changes only after two consecutive publications compute the same new band. Until then the card keeps its previous grade beside the raw score and discloses the computed band (gradeHold). Scores are never held or smoothed, and moves into or out of NR or a pipeline gap publish immediately. When a run's deployment-supply attribution misses an asset, the last admitted attribution is reused for one further 30-minute cycle, keeping its original observation time; after that the existing unavailable-supply treatment applies. Likewise, when the stablecoin supply sync has not re-observed an asset, its last observed circulating supply stays usable for one further hour beyond the 30-minute supply budget, keeping its original observation time; a fresh observation always replaces it.

No-Liquidity-Data Penalty

A further 0.9× multiplier is applied when a coin has no exit-liquidity signal at all — neither DEX liquidity nor redemption-backstop coverage. Weights are redistributed across available dimensions; this 0.9× multiplier is then applied to the final score to correct for the missing liquidity data by applying a flat 10% penalty.

Resilience scoring

Average of two equally-weighted sub-factors (50% each): Collateral Quality and Custody Model. Chain infrastructure is scored exclusively in the Decentralization dimension. Blacklist capability is reported descriptively but does not affect the Resilience score.

Tokenized RWA collateral is scored by the ultimate reserve or legal custody layer, not only by the smart-contract location of a wrapper token.

Collateral quality is derived from reserve compositions when available. The default source is curated metadata. A live reserve snapshot replaces it only when the current report-card snapshot can prove the feed is fresh, authoritative, independent, and clean. In coverage tables this is the difference between a reserve view being configured and a score-grade live reserve actually being used. For report-card scoring, the live snapshot must carry scoring-eligible freshness evidence: either a verified timestamp path or an explicit on-chain latest-state not-applicable freshness mode. Direct one-bucket on-chain reserve proofs such as Liquity v1 can qualify when the adapter is classified as independent, but weak probe families do not qualify just because they are on-chain. Detail-only static-validated and weak-live-probe feeds remain visible on reserve surfaces, but they never override curated collateral scoring. A score-grade adapter can identify a source-owned reserve category with a stable source key. Reviewed metadata joins only to a unique matching key and fails closed on key mismatches or duplicates; historical unkeyed rows use a unique normalized-name compatibility match. The live percentage remains the scoring weight and is never used to decide whether the category is the same reserve slice. Each reserve slice is classified into one of five risk tiers and the score is their weighted average. Direct ETH and canonical WETH slices share the same Very Low tier, while ETH liquid staking tokens remain Low. Delta-neutral wording is evaluated by structure: transparent spot or wrapped exposure can stay Medium, but externally managed market-neutral, basis, perp, LP, private-deal, or custody-dependent strategy books are High unless stronger granular evidence shows the slice is only a liquid stablecoin or cash-equivalent buffer. For coins without usable reserve compositions, a coarser enum-based fallback is used. Explicit overrides exist for coins where defaults are incorrect (e.g., protocols on Solana, coins with CEX custody).

V8.17 Decentralization Scoring (retired)

This historical V8.17 dimension started from the governance quality tier, then applied a chain-risk penalty for protocols on less decentralized chains — governance decentralization is undermined when the underlying chain has centralisation concerns — followed by a branch-aware CDP-only oracle setup blend (v8.11), reviewed bridge-route blend (v8.12), and the penalty-only Mint Authority blend (v8.0). It is not used by Safety Score V10; the retained metadata is displayed only as the descriptive Control posture classification:

• Immutable code — 100 (no admin keys, no upgrade path — e.g. LUSD, BOLD). Exempt from chain-risk penalty
• DAO governance — 85 (e.g. DAI)
• Multisig — 55 (e.g. GHO, FRAX)
• Regulated entity — 40 (named regulator, license, and independent audit — e.g. USDC, USDT)
• Single entity — 20 (unregulated or unverified issuer)
• Wrapper — inherits tracked parent Decentralization with a wrapper-kind haircut; unresolved wrappers fall back to 10

Resolvable wrappers use the wrapped asset's chain-adjusted, pre-blend Decentralization score: savings wrappers subtract 3, strategy-vault and risk-absorption wrappers subtract 5, and bond-maturity wrappers subtract 8. For example, yBOLD and sBOLD inherit from BOLD, while sfrxUSD inherits from frxUSD.

CDP oracle setup blend (v8.11):

Crypto-backed CDP stablecoins can carry reviewed oracleRisk metadata. When present, the score applies min(score, round(score × 0.75 + oracle × 0.25)) after governance and chain infrastructure. Robust setups never lift a score; weak, single-source, laggy, or opaque feeds can drag it down. Missing oracle reviews and non-CDP assets are unchanged. The current tier scores are oracleless/internal 100, redundant failover 95, medianized delay 85, standard external 75, single-source/laggy 45, and opaque/unknown 20.

Since v8.11, reviews can include provenance plus branch rows for collateral markets or chains. If branch rows are present, the weakest branch/profile tier supplies the oracle score. Wrappers and savings variants display inherited parent oracle exposure without adding a separate wrapper-side oracle penalty.

Bridge route blend (v8.12):

Reviewed bridgeRouteRisk metadata can capture issuer-native, canonical, external bridge, lockbox, liquidity, or intent routes. When present, the score applies min(score, round(score × 0.80 + bridge × 0.20)) after oracle scoring and before Mint Authority. Strong issuer-native or canonical routes never lift a score; missing reviews stay neutral; weak external lock/mint, liquidity/intent, or opaque routes can drag it down.

Current tier scores are single-chain/native 100, issuer burn/mint 90, canonical bridge 85, issuer lock/mint 80, external validated network 65, liquidity/intent route 55, external lock/mint 40, and opaque/unknown 20. L2BEAT Interop is used as static review evidence, not as a live scoring dependency.

Mint Authority blend (v8.0):

A rated Mint Authority Score applies as the final stage: min(score, round(score × 0.65 + MAS × 0.35)). The blend only drags the dimension down — a weak privileged-mint path undermines a decentralization claim, while a strong one never lifts it. Coins without a rated Mint Authority Score are unchanged, and wrappers take the drag once on their inherited pre-blend score (capped at the parent's blended score).

Chain-risk penalty (DAO and multisig governance — exempt for immutable-code, wrapper, regulated-entity, single-entity):

• Combined score ≥80 — no penalty
• Combined score ≥60 — −10
• Combined score ≥40 — −25
• Combined score ≥20 — −40
• Combined score <20 — −60

Example: hyUSD (DAO governance, Solana, combined score 45) = 85 − 25 = 60. USDB (multisig, Blast L2, combined score 66) = 55 − 10 = 45.

Dependency risk scoring

Dependency scoring runs after upstream report cards are available and uses a topological order across the active dependency graph, so transitive stablecoin exposure is scored from upstreams before downstream coins are finalized.

• Self-backed coins — score by governance baseline: decentralized 90, centralized-dependent 75, centralized 95
• With mapped dependencies — blended score: each upstream's grade is weighted by its collateral fraction, and the self-backed portion (non-stablecoin collateral) scores vary by governance type (decentralized 90, centralized-dependent 75, centralized 95). A −10 penalty applies if any upstream dependency scores below 75
• Unavailable upstream scores — every unavailable weight is scored at 70 inside the same blend, including when every upstream is unavailable. It still triggers the weak dependency penalty and remains subject to wrapper or mechanism ceilings
• Variants and self-holdings — a tracked variant has one serial wrapper dependency on its parent. Mirrored parent reserves do not add parallel weight, and a coin's own treasury-held token remains reserve evidence without becoming a self-dependency

The Worker diagnoses the complete effective graph before traversal. Static cycles require explicit review; live-created cycle members fall back to curated dependency sets, and a graph that remains cyclic is rejected before snapshot and grade-history publication. The dimension payload records raw and normalized contributions, availability, self-backed share, the weak penalty, and any binding ceiling.

Dependency type ceilings — each dependency is classified as wrapper, mechanism, or collateral (default). Legacy wrappers (e.g., syrupUSDC → USDC) are capped at upstream − 3. Tracked parent-linked variants keep the same wrapper edge but use family-specific ceilings: savings −3, strategy-vault −5, risk-absorption −5, bond-maturity −8. Mechanism dependencies (e.g., DAI → USDC via PSM) are essential to the peg — score is capped at the upstream's score. Collateral dependencies use the blended formula with no ceiling.

Self-backed scores vary by governance type: centralized-dependent coins score 75 (systemic coupling risk), decentralized coins 90, and centralized coins 95. Centralized-dependent coins score lower because their peg mechanisms depend on upstream stablecoin infrastructure even for non-stablecoin collateral.

Grade thresholds

Key design decisions

• NR (Not Rated) is used when fewer than 2 base dimensions have data — no misleading partial grades
• Weight is redistributed proportionally among rated base dimensions when some are NR
• Peg stability acts as a multiplier, not a base dimension — maintaining a peg is table stakes, not a differentiator
• Cemetery (defunct) coins receive a permanent F
• Decentralization score is structural, not a value judgment
• Blacklist capability is reported descriptively only and does not affect the Resilience score. Explicit mutable-contract controls surface as “Possible”. Parent and qualifying issuer/custodian reserve exposure instead use “Upstream” under the FreezeWatch decision procedure.

Dependency ceilings

When a stablecoin depends on another (wrapper, mechanism, or collateral relationship), its dependency risk score is capped relative to its upstream:

• Wrapper dependency: legacy wrappers and tracked savings variants cap at upstream score minus 3; strategy-vault/risk-absorption variants cap at minus 5; bond-maturity variants cap at minus 8
• Mechanism dependency: capped at upstream score
• Collateral dependency: blended into dependency risk dimension via weighted average

If any upstream dependency scores below 75, a 10-point penalty is applied. These ceilings prevent a wrapped token from outscoring its underlying asset.

Limitations

• Peg stability only reflects price data — can't detect coins “stable” because nobody trades them
• Decentralization is structural, not a value judgment
• Dependency inputs come from score-grade live reserve slices when available, then curated reserve links, then manual dependency metadata; unmapped collateral relationships may still be missed

Serial maximum and basket sum

Each root starts with a share of 100%. Basket relationships sum mapped weights multiplied by their upstream look-through shares. Serial relationships take the maximum upstream share, not a sum. When both channels apply, the lookup takes the larger of the serial maximum and the basket sum. Each dependent appears once across selected roots. A published shared backing book counts once in USD totals; direct and indirect totals can still include the same underlying value at several layers, so the headline states that overlap. These gross layer totals are not additive independent holdings.

Publication-bound supply

USD equals the mapped share multiplied by circulating USD at evaluation from the accepted publication. The result names its generation, methodology version, publication time, and supply clock, and labels held snapshots. It never silently substitutes current market cap. When evaluation supply was not published, USD remains unknown with the reason 'Supply at evaluation not published for this generation'. Unknown supply is not zero: the row remains visible and known-USD totals exclude its unavailable amount.

Coverage and limitations

Coverage is limited to published relationships and their measured or reviewed weights, which may differ from current composition. Unknown weights and cycles leave shares unresolved rather than guessed or clamped. Role dependencies are listed as 'Role dependencies (not drawn)'; 'Known, not in the scored graph' relationships are outside the lookup and totals. An absent coverage field means not published, not no gaps. Peg, liquidity, confidence, and other transmission channels are not modeled. No mapped downstream exposure found does not establish that other dependencies are absent.

Separate offline modeled scenarios

Separate offline modeled scenarios are available in Exposure mode. A daily Node workflow reuses the production Safety Score evaluator, including role dependencies, for up to 15 hubs ranked by mapped direct exposure USD from publication-bound supply and published dependencies, with shared backing books counted once. The three D1b shocks limit the root's downstream-consumed final score to 40, model a 1,000 bps one-day depeg with captured peg history and exit facts held fixed, or model mint-control compromise. Each selection shocks one root, not all selected roots together. Results name their source publication, artifact age, and two-day freshness budget. Earlier-generation results are explicitly labelled; stale or unavailable results withhold modeled numbers. NR remains NR. Modeled with the production Safety Score evaluator; not a forecast. These artifacts do not change canonical cards, journals, publication identity, or scoring policy. Structural exposure lookup remains separate and adds no scoring override.

Dedicated protocol-native sources (Fluid, Balancer, Raydium, Orca, Meteora, PancakeSwap V3, Aerodrome Slipstream, Velodrome Slipstream, and Aero Slipstream and basic pools) are treated as primary-grade inputs and enter scoring before staged or fallback discovery sources are merged.

Discovery coverage is less page-fragile now: CoinGecko Onchain and GeckoTerminal token crawls read multiple bounded pages, and fallback enrichment can activate for weak partial coverage instead of waiting for a strict zero-pool outcome. Secondary discovery rows with non-finite, negative, or impossible pool TVL are rejected before staging and skipped again at scoring merge time if stale bad data is already present. CoinGecko Onchain and GeckoTerminal pair rows must also pass the pair-price coherence gate: the tracked leg's USD price must agree with the pool's own pair ratio × the counter-leg's USD price, and a provider row that publishes leg USD prices with null or zero pair-ratio inputs is rejected before it stages any TVL or price evidence. Zero volume and zero transactions never reject a pool on their own, so quiet pools remain eligible.

Stellar classic-AMM discovery uses Horizon with exact, case-preserving CODE:ISSUER identities. Those rows receive price and TVL only when the counter-asset is another active tracked classic Stellar stablecoin with a usable peg reference and the implied tracked price passes the common plausibility gate. Horizon is a capped secondary source with a 200-row response bound and 0.55 fallback-price confidence; Soroban contract tokens, Stellar order books, and Soroban-native DEX liquidity remain outside this provider and fail closed rather than inheriting synthetic coverage.

Matching is chain-aware: `chain + address` resolves first, and symbol fallback is only allowed when it is unique on that chain for addressless tokens. If an upstream token already supplies an unknown address, it is dropped instead of being remapped by symbol. A token pair is a matching candidate, not a pool identity: opaque provider IDs remain distinct chain-scoped deployments until a physical match is proven. Identical exact repeats count once; conflicting exact observations are quarantined with a named reason. One physical pool attributed to several stablecoins counts once globally. Balancer uses its real pool address, not the vault pool ID; candidate fingerprints support guarded unique joins, never TVL aggregates.

Direct-source precedence is also measurement-aware. A protocol-native pool normally replaces an overlapping DeFiLlama row only when it carries a positive measured 24h volume reading; Aerodrome, Velodrome and Aero pools, whose on-chain pool-state rows publish no trailing volume, and pools whose tokens carry a reviewed price dependency are explicit exceptions that take precedence without volume. When several registry lanes observed the same pool, the reading that counts is the most trusted lane refreshed within 24 hours, else the most trusted inside the 72-hour admission window, else the freshest lane with a usable reading; a registry zero written before the v6.9 producer activation counts as unmeasured rather than a measured zero, except CoinGecko onchain zeros, which were explicit zero-trade readings. Exact pool ids from protocol-native sources still stay reserved for later staged-source dedupe even when the direct row itself is too small to score, so discovery feeds cannot re-add the same address with incompatible TVL semantics.

Discovery rows also need authoritative confirmation when they claim a protocol family that already has a clean protocol-native fetch on that chain. In practice, GT/CG/DS staging cannot invent new Balancer, Fluid, Raydium, Orca, Meteora, PancakeSwap, Aerodrome, or Velodrome pools after the native source succeeded; if that native fetch is degraded or unavailable, the scorer fails open and still allows staged recovery rows through.

For identity-poor DeFiLlama UUID rows, staged discovery can use the narrow optional-metadata wildcard only when both sides are unique on chain, protocol, token set, and pool-shape family. That lets one staged exact-pool-id row collapse against one primary row without collapsing parallel same-pair pools.

When protocol-native sources expose pool inventory, Balancer, Raydium, Orca, Meteora, PancakeSwap V3, and the Slipstream integrations now contribute measured balances and fee detail instead of neutral placeholders. Balancer weighted pools are normalized against target token weights before the balance ratio is computed. Fluid reads reserves and fee detail from the official DexReservesResolver on Ethereum, Arbitrum, Base, and Polygon, while Aerodrome and Velodrome Slipstream read pool state from the on-chain Sugar view contracts on Base and Optimism. Aero, which publishes no Sugar view, is enumerated straight from its factories on Base, Ethereum, OP Mainnet, Arbitrum, Robinhood Chain, and Arc; each pool must prove factory membership at one pinned block, and stable-curve pools are admitted only when both tokens are independently priced. Curve requires complete USD-valued balances and Fluid both reserve halves. Incomplete evidence remains unmeasured with neutral balance weighting; complete zero-sided balances remain measured zero. Provider numbers must be complete finite decimals, not numeric prefixes, and Orca balance normalization requires integer token decimals in 0..255. Independently admitted pool identity and TVL can survive missing balance evidence, but that absence cannot establish measured coverage.

Canonical Ethereum Uniswap V2 and BSC PancakeSwap V2 pools can publish exact constant-product execution only after their factory runtime and exact `getPair` binding are verified. Token order, reserves, and decimals must resolve at the same pinned block; other V2 forks and any identity, factory, reserve, price, or read failure stay capability-gated instead of inheriting executable depth.

Retired legacy Sonic stable/volatile and Base/Optimism volatile Solidly diagnostics no longer augment per-pool measured-balance flags. Base Aerodrome stable and Optimism Velodrome stable diagnostics require original state/reference clocks and independent same-block request/refined endpoint verification, but remain non-scoring for exact Exit. Unavailable or stale proof is not a measurement. These flags describe diagnostic/API evidence, not the balance-ratio aggregate used by Liquidity scoring and confidence. Ordinary venue discovery and TVL accounting remain; no fixed-clock neutrality is claimed.

Hook-free Ethereum Uniswap V4 pools can publish measured exact-execution profiles through the separately reviewed PoolManager, StateView, and Quoter path. Each score-facing profile binds the exact PoolId, ordered currencies, fee, tick spacing, zero hook, pinned runtimes, immutable PoolManager relationships, current pool state, and ABI-decoded quote. Hooked pools and other V4 chains remain unsupported, and stale or drifted evidence fails closed.

Base Aerodrome Slipstream pools can also publish measured exact-execution profiles. Each profile pins the reviewed factory and QuoterV2 runtimes, proves the retained pool through the factory's exact token and tick-spacing binding, and revalidates identity, prices, freshness, capacity monotonicity, and the retained TVL ceiling before scoring. Mature fresh profiles remain route-only if a pool temporarily rotates out of the display shortlist; they never re-enter aggregate liquidity, price consensus, or public target inventory. Any V10 Exit use is limited to the current score-eligible exact-route contract. Optimism Uniswap V3 has been retired from the maintained source and measured-execution lanes.

As of v6.0, the never-score-eligible Solana and Tron native measured-execution lanes (Raydium CLMM, Orca Whirlpool, SunSwap V2) and the Fluid measured overlay have been retired. Retained Raydium, Orca, and Fluid pools continue to contribute aggregate liquidity, price observations, and shaped exit-route evidence, but no native measured-execution profiles are collected or published for them, and the target-only SunSwap census is no longer fetched.

External protocol totals gate fallback admission, not published valuation. Fallback groups exceeding per-coin protocol headroom are quarantined before price admission, and rejection follows the physical pool across coin views; trusted raw TVL is never clipped to fit the external total. Curve factory models need independent tracked-market references. Bounded UniV3 outage identity carry does not carry current USD valuation: without an independent current reference, the measured target stays unresolved.

Repeated sightings of the same physical pool across direct API, staged, and fallback sources are collapsed before DEX price aggregation. Exact direct price evidence can rejoin only when the same canonical pool survives final scoring and both records clear the price-observation floor; derived or mismatched identities remain excluded. A separate challenger snapshot preserves the full retained pool set for depeg checks, instead of relying on the visible top-pools subset. Balancer stablecoin pools also get a narrow stable-pair identity fallback when DeFiLlama omits the subtype in `balancer-v3`, preventing direct-API stable pools from being double-counted as faux weighted rows.

CoinGecko discovery tickers are price-only since Liquidity v6.93. When earlier discovery found no pools or no usable price, Pharos checks non-stale/non-anomalous USD-equivalent quotes with positive finite prices, exchange identity and at least $1,000 reported USD flow. It requests no depth and admits only non-future registry observations within 24 hours. Pricing v6.44 weights exchange prices by observed flow × source confidence, with zero TVL attribution. Neither fresh nor legacy ticker rows enter pool scoring, caps, coverage or orderbook diagnostics, and exchange flow cannot satisfy the unchanged primary, display or depeg trust floors.

PancakeSwap V3 volume now uses a bounded trailing-hour window from the official subgraph's `poolHourDatas.volumeUSD` buckets instead of the latest `poolDayDatas` row, so intraday volume no longer decays toward zero between UTC day rollovers.

Large retained pools must clear the minimum 24h volume floor with an admitted reading; an unmeasured, missing, or stale reading does not clear it. After bad pools are filtered and secondary-source TVL caps are applied, every exported aggregate and score input is rebuilt from the retained pool set.

Since v6.9, DEX volume counts only admitted readings: a pool's provider 24h volume observed within the last 72 hours. The reading stays a 24h figure as of its own observation time, and every published volume record states the 72h window and the oldest and newest observation times. Older readings contribute nothing, even though the remembered discovery row keeps its decaying TVL. A source field that is absent or unparseable is stored as unmeasured, never as zero; an explicit provider zero (for CoinGecko onchain, only alongside zero reported trades) stays a measured zero. Registry zeros recorded before the v6.9 producer (before its 2026-09-28 07:29 UTC activation) could be coerced missing values, so they count as unmeasured while positive readings from that period stay usable; CoinGecko onchain zeros are the exception, because sampled ones were genuine zero-trade readings. A 24h or 7d total is published only when every retained pool is admitted; otherwise the total is unavailable and the record shows the observed volume of the admitted pools next to their share of retained TVL (volume coverage), including for the ecosystem-wide aggregate.

Since v6.93, one registry evaluation clock is captured after the registry read completes. A row later than that clock is rejected whole as future_observation, before identity, value, metadata, price or volume can contribute. Trust/freshness, TVL confidence, maturity, trade-index evidence, dead-pool predicates and coin/global volume summaries share this frozen basis. This fixes a one-generation dead-pool bypass for valid post-source-start refreshes. Stage payload v4 carries the clock through hourly publication and any half-hour publication of an unconsumed stage; normal half-hour reuse keeps the prior accepted generation. Source-fetch, source-slot and measured-quote clocks, the 24-hour price/TVL budget and 72-hour volume budget are unchanged.

Curve balance, registry, token-price, and metapool TVL enrichment is applied only to Curve DeFiLlama rows. Non-Curve rows that share the same token symbols as a Curve pool keep their own mechanism type and TVL.

Address-grade plain Curve StableSwap-NG pools with rate-bearing inputs can publish a route model only after fresh same-block state verifies `get_balances`, amplification, stored rates, ordered coins, and static fee state. Rate scaling adjusts both balances and references; Curve deducts its captured static fee after the full-input invariant. Stale, unpinnable, identity-mismatched, or dynamic-fee state remains capability-gated. Metapools, CryptoSwap, legacy pools, and all other unreviewed Curve shapes are not widened.

Explicitly reviewed Curve metapools can instead publish exact same-notional execution through pinned get_dy_underlying calls. LUSD/3Crv uses this path from v6.2: the producer verifies its legacy factory registration, implementation, 3pool base relationship, coin order, decimals, and runtime code before quoting LUSD to USDC. From v6.3, multiple Curve registry views of the same canonical pool address collapse to one physical fingerprint candidate, while distinct addresses with the same coin set remain ambiguous. Reported TVL is never treated as executable capacity, and any proof or quote failure leaves the route gated.

Coverage confidence is measurement-aware. Instead of a fixed score by source family, Pharos now weights how much retained TVL has measured balances and prices, how broad the protocol mix is, and how much of the row depends on synthetic or freshness-decayed fallback liquidity.

Components

Pool quality adjustments

• Balance health — continuous ratio (not binary threshold): pools with imbalanced reserves score lower
• Pair quality — co-token scored by Pharos governance classification (CeFi→1.0, DeFi→0.9, CeFi-Dep→0.8) plus static map for volatile assets (WETH→0.65, WBTC→0.6); composite Curve LP aliases such as 3Crv inherit the best quality of their underlying stablecoin basket
• Metapool dedup — uses TVL excluding base pool to prevent double-counting across Curve metapools
• Dead-pool floor — a pool with at least $1M of TVL is dropped from the score and from DEX-implied prices when its 24h reading shows zero trades (CoinGecko Onchain reported no buys and no sells, on a network where CoinGecko records trades) and its other token is not a tracked stablecoin. These are single-sided pools: a few dollars of the stablecoin seed a ~$1 price, and the provider values large amounts of an unlisted token at that price. Missing or unverified volume never triggers the floor, and a pool counts again as soon as CoinGecko reports a trade in it
• Retained-pool recomputation — HHI, depth, volume, and balance/organic/durability inputs are all recomputed from the same retained pool set before the UI truncates to the top 10 displayed pools
• Global population basis — headline TVL, protocol and chain breakdowns, and volume-coverage TVL denominators use the same retained pools deduplicated across coins. External protocol totals gate fallback admission, never rescale trusted raw TVL or observed volume. Over-headroom fallback groups are quarantined across physical-pool attributions, with excluded counts and raw TVL disclosed separately. Quality-adjusted and effective TVL are separate scoring models, not replacements for observed statistics; provider valuations are not guaranteed correct
• Measured evidence — complete finite provider values, valid token scales and complete matching-scope balance legs are required. Unknown balances stay unmeasured, while measured zero remains zero. Factory references must be independently current; carried pool identity cannot supply a current USD price. Each historical quote ages at assessment, and canonical block hashes and fresh non-future per-peg FX bind measured capacity
• Measurement epochs — v6.97 records the changed retained population without rewriting history. Paired source stages reject incompatible older admission policies; TVL trends do not interpret a policy step as a market withdrawal

Net Flow 24h

Net Flow answers whether a coin minted or burned over the last 24 closed UTC hours. It is the mint volume minus burn volume over that window, not the still-open current hour.

• Minting — `netFlow24hUsd > 0`
• Burning — `netFlow24hUsd < 0`
• Flat — `netFlow24hUsd = 0` with activity and complete USD valuation
• No activity — no observed 24h mint/burn events with complete current-fingerprint scan coverage
• Invariant — minting vs burning always comes from raw net flow, never from the pressure score sign
• Valuation completeness — events without a USD price are counted as unpriced, never as $0. Known mint and burn totals are then lower bounds, and a partial window publishes no exact net. With complete scan coverage, unpriced mints can only raise the net and unpriced burns can only lower it, so a window with only one side unpriced shows the known net as an explicit bound (≥ or ≤); direction also requires complete scan coverage and missing valuation that cannot flip it. Buckets aggregated before v6.22 read as coverage unknown and keep their old-method net, labelled, until they leave the 30-day baseline and 7/30/90-day windows.
• Event-time pricing — an event is valued only with a plausible price whose actual observation time is within ±24 hours of the event (inclusive): a daily supply snapshot price through its recorded observation time (never its day label; nominal par is never stored), or a replay-safe cached observation, whichever was observed closer to the event. A current price is never applied to an old event; without such evidence, including NAV observations more than 24 hours old over weekends, the event stays unpriced.

Pressure Shift vs 30D

This is the existing Flow Intensity formula under clearer naming. It measures how far current 24-hour flow pressure deviates from the coin's own trailing 30 fully closed daily configured issuance-chain baseline.

denominator = max(baselineDailyAbs × 0.3, $1M)
z = (currentDailyNet − baselineDailyNet) / denominator
pressureShift = clamp(-100, 100, z × 50)

• Baseline period — trailing 30 fully closed UTC days of configured issuance-chain daily net flows and absolute volumes, excluding the current partial day
• Minimum data — requires 7 days of history; returns null (NR) otherwise
• Activity gate — windows with no 24h mint/burn activity or less than $50K absolute 24h flow are marked NR and excluded from gauge weighting
• Coverage and valuation gates — pressure is NR, and the coin leaves gauge weighting, unless current-fingerprint scan proof covers the window, the 24h window is fully valued and the baseline has no known unpriced events. Legacy scan coverage remains unknown, not proof of quiet activity. Omitted coin counts and market-cap weight remain disclosed; observed gross subtotals cannot establish a signed net or pressure
• Literal minting pressure — stablecoin pages also show the raw 24h mint-versus-burn volume balance. Since v6.27 it is NR, with its reason, unless both sides are fully valued: a balance of lower-bound volumes is not a measurement
• Ingestion safety — sync state advances only to the shared safe coverage frontier when some event definitions or block timestamps are incomplete; established coverage is marked lagging by cadence-derived block progress, or unknown when the current chain head is unavailable. For quiet assets, completed block-scan span proves window maturity even when the oldest event row has aged out of retention. BUIDL tracks both registered Ethereum share-class contracts; coverage requires both scan cursors to catch up
• Floor — denominator is floored at $1M to prevent noise in low-volume coins
• Aggregate gauge interpretation — ≥ +10 = improving vs baseline, [-10, +10) = stable vs baseline, below -10 = worsening. Per-coin pressure-state labels are separate: exactly +10 is stable.

Bank Run Gauge

Market-cap-weighted composite of all tracked coins' pressure-shift values, producing a single ecosystem-wide admitted issuance-chain flow-pressure reading. Gauge weights use each coin's admitted tracked-chain circulating supply. The gauge score maps to one of seven condition bands:

The gauge is unavailable when no coin with a pressure-shift value has a positive market-cap weight, for example when all tracked coins are NR or their weights are unavailable or zero. Coins with null pressure-shift values are skipped from the composite.

Flight-to-Quality Detection

Detects capital rotation from lower-scored to higher-scored tracked mint/burn stablecoins — a pattern typically seen during market stress when holders move funds out of weaker assets and into stronger safety-score cohorts.

• Safety cohorts — safe is B- or above, neutral is C-/C/C+, and risky is below C-. Classification is unavailable for inactive assets or when the canonical V10 publication is missing, held, stale, invalid, or identity-incompatible
• Dual threshold — active when risky coins have >$100M net outflows AND safe coins have >$100M net inflows simultaneously over 24h
• Intensity scaling — min(100, |riskyOutflows| / $1B × 100), reflecting the magnitude of the rotation

APY Resolution and Source Arbitration

• Tier 1 — Direct on-chain reads: reads protocol state directly, either as an exchange-rate delta (e.g. sUSDe), a conservative reward-only estimator (e.g. LUSD B.Protocol Stability Pool, LQTY only), a multi-branch interest-only estimator (e.g. Base Dollar Liquity V2 Stability Pools), or scrvUSD's Yearn V3 profit-unlock current-rate reader. XGLD's reviewed exchange-rate provider measures XAUt per XGLD, separating gold-denominated NAV changes from gold's USD price. This is issuer-administered NAV, not reconciled strategy profit; it supplies no measured TVL and still needs a valid historical comparison anchor. Initial and re-anchor observations remain durable history anchors, including Ondo/Midas NAV readers, but enter no current yield row, ranking, alternative or rolling sample until a return is measured. They never publish synthetic zero APY; genuine zero and negative returns remain.
• Tier 2 — DeFiLlama pools: matches the coin to a DeFiLlama yield pool via static mapping, chain-scoped wrapper rules, and address-first fallback matching, while explicitly preserving wrapper pools that upstream marks as non-stablecoin when they are configured as relevant yield sources, allowing exact-pool curated overrides for assets such as XAUT and Frankencoin Savings for ZCHF, and TVL-weighting exact pool groups when one tracked asset maps to chain-isolated wrapper vaults. Supplied contradictory addresses fail closed, missing native pins cannot borrow a generic venue's APY, and ambiguous same-chain receipts require curated pool identity
• Tier 2.5 — Protocol-native venues: ingests curated protocol-owned APIs and protocol-specific on-chain venue readers when the canonical savings path is not representable as a reliable DeFiLlama pool; these rows stay in the curated tier rather than inheriting Tier 1 deterministic precedence reserved for native wrapper readers. Royco Dawn senior and junior tranches publish here as structured-tranche rows keyed by royco-dawn:<chainId>:<marketId>:<side>, while Midas mMEV publishes a NAV-appreciation row from the issuer-listed mMEV/USD oracle
• Tier 3 — Price-derived: derives APY from 7-45 day USD price appreciation only for explicitly catalogued NAV-appreciation or lending-vault mechanisms with an actual USD return reference and no intentional holder-return gap. FPI and ISC retain explicitly reviewed USD-based variable-NAV exceptions. XGLD has no USD-price fallback: gold's USD appreciation is not its XAUt return. USD drift also cannot measure distributed rewards or rebasing yield
• Tier 4 — Rate-derived: for dividend-distributing and Treasury-tracking tokens, derives APY from the selected benchmark registry entry net of known fee spreads, using USD by default, product-specific EFFR where configured, 3-month compounded €STR for EUR pegs, 3-month compounded SARON for Swiss-franc pegs, the CBR key rate for RUB pegs, and BIST TLREF for TRY pegs. Product-input freshness is checked independently of the PYS comparison hurdle: fresh EFFR cannot refresh a stale T-bill product input, and a hardcoded fallback cannot produce a product APY candidate. Non-USD products independently require the USD normalization reference. These dependencies are assessed consistently at publication and on API reads

Weighted pool groups use one complete TVL universe for total, base, and reward APY. A missing reward is zero only when that pool's base already covers its total; otherwise an unresolved component stays unavailable without discarding the measured total. Rewards from a small pool are never attributed to the entire group.

Deterministic and curated paths can all contribute rows, then a confidence-weighted arbitration layer chooses the best row. Divergent discovered or fallback sources can be demoted or rejected when an eligible canonical source disagrees materially; rejected evidence cannot veto a fresh source. Protocol-native lending venues do not outrank native wrapper yields merely by querying on-chain state. Evidence quality precedes confidence; fixed-yield alternatives are demoted before those comparisons. A non-rejected curated explicit pool takes precedence over auto-discovered candidates of the same asset and yield type, including an incumbent; discovery remains available as an alternative. Within a tied tier, risk-adjusted utility is compared when either source has an operator-provided penalty, otherwise APY and TVL break ties. Resolv / USR-linked lending-opportunity venues are excluded from publication entirely. Published lending-opportunity, fixed-yield, and structured-tranche rows must also pass a final resolve-stage measured venue-TVL gate after tracked, explicit, auto-discovered, supplemental, and linked-variant candidates are assembled. sourceTvlUsd must clear the higher of the chain floor or 0.1% of current tracked supply; null or non-finite TVL fails closed, and structured-tranche floors augment Royco's bespoke market/vault floors. The supply-relative floor applies to every peg currency, including GOLD/SILVER, because tracked supply is USD-denominated. Holder-versus-deposit typing is assigned before this gate. Curated receipt sources retain holder yield; auto-discovered pools remain lending opportunities because symbol and deployment matches do not establish receipt ownership. A parent-token projection is a deposit opportunity, not passive yield on plain holdings. An underlying-address match alone identifies the deposit asset, not ownership of a differently named receipt: native fallback also requires the tracked instrument's exact symbol, so Royco's senior tranche is not promoted into apyUSD holder yield. ZCHF's Frankencoin Savings row likewise requires a savings deposit; the curated Ethereum venue wins over auto-discovered Gnosis, which stays an alternative. Third-party opportunities stay with the asset that owns the venue, and explicit lending overrides publish only for active assets.

Yield-bearing coverage is now explicitly inventoried per asset. If no reliable runtime source exists, the asset is marked as an intentional gap rather than silently disappearing from audit coverage. HedgeCore sUSD is an intentional gap: its gross Venus quote is quarantined because on-chain rate interfaces revert and the documented 93% pass-through does not establish holder-return equivalence.

Royco Dawn tranche rows are opportunity rows, not stablecoin registry additions. Senior rows are capped at or below the underlying Safety Score; junior rows receive first-loss, utilization, coverage, market-status, drawdown, TVL, withdrawal, explicit access, and venue-posture penalties. These tranche scores are used by PYS for the opportunity row only.

Deterministic rows keep their own source identity (`onchain:<stablecoinId>`) rather than sharing a pool UUID with curated sources, so source-aware history and previous-rate lookups stay isolated when both paths coexist. Linked variants and protocol-specific on-chain rows also preserve their exact modern keys; only pre-source-key history and the named LUSD legacy alias normalize to a parent deterministic key.

Trailing APY metrics are computed from source-specific history rather than a mixed coin-level series, so source switches no longer contaminate the displayed 7d/30d averages.

Read-time data-stale warnings are also cadence-aware: core families attach only after three missed sync-yield-data intervals (about 6 hours at the current publisher), while price-derived rows wait 30 hours because they are backed by daily supply_history snapshots and rate-derived rows wait 36 hours for the daily benchmark producer. Each source class also emits a midpoint aging warning (27h price-derived, 30h rate-derived) once an observation misses its refresh slot but has not reached the stale bound. Ordinary exchange-rate anchors expire after 14 days; price-derived and Midas/Ondo NAV anchors remain valid through their configured 45-day comparison window.

Freshness eligibility is applied before confidence arbitration. A stale deterministic candidate cannot beat a fresh curated candidate, and every benchmark used by a published row is evaluated independently. Retained market benchmarks can remain score-bearing but degraded within their freshness bounds; expired source or benchmark evidence is NR. Missing critical venue, market-size, or tranche evidence also withholds PYS without hiding an otherwise eligible opportunity.

Calculation mode and evidence class are separate. Exchange-rate math can be deterministic while the product estimate remains a modeled proxy; fresh direct first-party, on-chain, and curated observations therefore outrank a modeled proxy on evidence quality. Rankings label evidence as rated, estimated, partial, or NR. Missing critical freshness or Safety evidence cannot produce an exact PYS.

Pharos Yield Score (PYS)

benchmarkSpread = apy30d − benchmarkRate
hurdleRebase = usdBenchmarkRate − benchmarkRate (0 for USD-currency rows or missing rates)
effectiveYield = max(0, apy30d + benchmarkSpread × 0.25 + hurdleRebase)
sourceRiskPenalty = deriveOrResolve(sourceRisk, neutral=1, max=2.5)
rowUtility = effectiveYield / sourceRiskPenalty
riskPenalty = max(0.5, (101 − safetyScore) / 20)
yieldEfficiency = rowUtility / (riskPenalty ^ 1.75)
sustainability = max(0.3, 1.0 − apyVarianceScore)
PYS = clamp(round(yieldEfficiency × sustainability × scalingFactor), 0, 100)

APY above the 300% scoring envelope or non-finite effective yield is unavailable, not a zero score. Every withheld score carries an NR reason; a valid score that rounds to zero remains a measured 0.

• Effective yield keeps raw APY as the anchor and adds 25% of the row's benchmark spread, then swaps the local hurdle for the USD risk-free rate (v8.43). A peg that only pays its own central-bank rate scores like a USD row holding the T-bill rate, and equal benchmark-relative excess scores equally in every currency. This is the covered-interest-parity reading of excess yield: it assumes a frictionless hedge and ignores FX basis. The rebase term is zero for USD-currency rows, including EFFR comparisons, or when either required rate is unavailable
• Source-risk penalty uses nested source-risk evidence from measured reward share, source depth, freshness, source switching, bootstrap history, and sourced venue tier where available. History maturity counts distinct UTC observation days rather than raw hourly samples, then clamps the combined penalty to 1–2.5 while treating missing evidence as neutral
• Yield efficiency rewards higher APY relative to the opportunity and coin risk profile — source-risk-adjusted row utility is divided by the curved safety penalty so weaker safety grades need much more effective yield to compete
• Consistency penalizes volatile trailing yields while favouring measured consistent returns. It is unavailable, and PYS is NR, until at least two trailing observations exist; a near-zero mean or non-finite variation also withholds the score. Measured zero variance keeps full credit
• Scaling factor is a global constant that normalises scores into a readable 0–100 range after the steeper safety curve is applied

NAV Token Handling

NAV-appreciating tokens (e.g. sDAI, wUSDM, BUIDL) use live report-card scores when the safety framework has enough data for them, including NAV-aware report-card coverage. The default safety baseline of 40 (NR) is a conservative missing-safety fallback with an explicit provenance reason; fresh rows retain an estimated PYS until report-card hydration supplies a full safety assessment.

See the mechanism explainers for tokenized Treasury (T-bill) designs and tokenized credit funds.

Limitations

• Trailing averages require sufficient history — newly tracked coins retain a limited-history penalty until 7 distinct UTC observation days accumulate
• History before v8.31 lacks the full benchmark, source-risk, and scaling input snapshot and is labeled legacy-partial; later points store versioned inputs for exact PYS recomputation
• Rows carrying `safety-unrated` or `opportunity-evidence-missing` remain estimated until the missing safety or market-risk evidence is reviewed; stale source and benchmark evidence remains PYS NR
• Some DeFiLlama and protocol-native surfaces still depend on upstream asset metadata completeness; the resolver now drops ambiguous candidates rather than guessing across duplicate symbols
• The LUSD B.Protocol Stability Pool row is conservative by design: it includes projected LQTY incentives only and excludes ETH liquidation gains
• The Base Dollar Liquity V2 Stability Pool row is conservative by design: it includes 75% of accrued borrower interest only, requires complete five-branch reads, and excludes upfront borrowing fees and liquidation collateral gains
• Price-derived APY (Tier 3) can be noisy for low-liquidity NAV tokens

When a live event is later contradicted across the peg by a low-confidence primary price, the detector now retires the stale live row immediately and routes the replacement move through pending confirmation instead of leaving the wrong direction active.

Pending incidents are no longer write-once snapshots. While a candidate is waiting for confirmation, Pharos now preserves the original first-seen timestamp, refreshes the current last-seen state, tracks the worst same-direction move, and resets the pending row cleanly if the market flips to the opposite side of the peg.

DEX cross-validation uses explicit trust gates: detection and pending confirmation only trust fresh DEX rows with at least $1M of aggregate source TVL, while the public DEX Price Check UI requires a lighter but still non-trivial floor of $250K. Aggregate DEX rows also need deeper corroboration before they can mutate live event state: recoveries/suppression and pending confirmation now require at least two protocol-level DEX groups, and ambiguous-primary recoveries are vetoed when a large challenger pool still shows the old depeg direction. Pool challenger confirmation counts distinct protocol/source-family groups, with the documented $5M single-pool exception preserved. For already-open depegs, same-direction aggregate DEX disagreement is advisory rather than a synthetic recovery signal, so events stay continuous until the normal recovery path confirms the coin is back inside threshold.

Every onset waits beyond the full trigger threshold for at least 15 minutes, even when multiple sources already agree. Pending confirmation chooses off-chain confirmers by source family from the primary agreeSources set. CoinGecko-family primary evidence cannot be confirmed by CoinGecko again, and Pharos does not treat DefiLlama's coingecko:{id} mirror as independent. A native CoinGecko quote may initiate a pending non-USD candidate, but it cannot confirm itself: promotion also requires a fresh canonical USD price from a non-CoinGecko family to agree after normalization through the authoritative FX reference. Promoted rows store canonical keys such as temporal:15m, primary:defillama, and dex:curve for auditability.

Extreme moves of 50% or more, small-cap assets, and fresh multi-source clusters all use the same minimum 15-minute onset window. Independent source agreement can satisfy the source rule after that window, but it never bypasses temporal confirmation.

Those 15-minute windows are continuous-observation windows, not endpoint-age checks. Onset and recovery both require consecutive qualifying observations no more than 1200 seconds apart, and a longer gap resets the window to the new observation rather than counting the blind interval toward confirmation. The tolerance is deliberately wider than the 900-second producer cadence: measured start-to-start gaps for the producing job run 868–932 seconds, so a tolerance equal to one interval would reset almost every observation and suppress confirmation entirely. It stays below two intervals, so a fully missed run still resets the episode. A depeg therefore cannot be promoted with a start time backdated across an interval nobody observed, and missing data leaves an event open rather than proving recovery.

Non-USD fiat pegs use the live fiat FX rate as their primary reference whenever it is available, even when three or more same-peg assets are tracked. A peer median is only a fallback and must contain at least three contributors; thinner peer groups or an empty peer set fail closed. The same authority gate covers the displayed deviation: while no trustworthy reference is available, peg surfaces report the current deviation as reference unavailable instead of quoting a self-referential number. Once a live row is already open, a fresh non-cached multi-source primary cluster can retire it after recovery even if that source mix is still too soft to open brand-new events directly.

For supported fiat pairs with a CoinGecko native-currency quote, depeg routing checks that quote before trusting a derived USD-versus-FX move. That means BRZ-style BRL reference drift can no longer open, sustain, or confirm a live depeg when the fresh BRZ/BRL quote is near parity; conversely, the native quote can initiate a pending candidate when the USD-versus-FX path masks the native discount. Historical backfill follows the same principle for supported non-USD fiat assets: when CoinGecko exposes a native fiat pair, replay prefers that native history and compares it directly to the native 1.0 peg before falling back to USD-plus-FX reconstruction. In that native-replay mode, Pharos uses daily points plus a two-point confirmation window across 36 hours so thin hourly native prints do not manufacture long false historical depeg streaks. Binary backfill replay also requires peak corroboration: a deeper sample replaces an open episode's peak only when another sample of that episode lands within 1,000 bps, so a lone wick between par readings cannot become the published peak.

Resolution uses hysteresis and persistence rather than the onset boundary. A live event enters recovery only at half the trigger threshold, then must remain there for 15 minutes before closing; a move back into the deadband or depeg range resets that recovery timer. This prevents near-boundary prices from repeatedly closing and reopening one incident.

How an incident closed is decided by its recorded closure reason, not by whether a recovery price happens to be stored. An explicit recovered-primary, recovered-dex, or recovered-native reason means recovered even where quote-domain policy stores no recovery price, so a genuinely recovered non-USD event is no longer misfiled as orphan-closed and excluded from duration training. Conversely, direction supersession, coverage loss, orphan cleanup, and unknown explicit closures cannot be read as recovered just because a stray recovery price is present, so they stay out of the recovered duration corpus and out of Resolver Reviewer outcomes. Legacy rows that predate recorded closure reasons keep the older price-based reading, so historical recovered labels are preserved rather than rewritten.

Live depeg events still require at least $1M of current circulating supply. Historical replay applies the same floor from historical supply snapshots, or from current stablecoins-cache supply when historical supply is absent; if neither supply source exists, backfill preserves existing rows. Current observed deviation and its authoritative reference do not depend on that event floor: sub-floor assets, and priced assets with unknown supply, still receive a measured deviation in peg and Safety Score facts. Below the floor, live event coverage remains explicitly limited. Only an observed sub-floor supply (an explicit zero included) closes an open event as coverage loss; unavailable supply preserves the lifecycle without extending trusted off-peg time.

Replay never re-persists an episode that has already been accounted for. A recomputed episode is skipped when a reviewed suppression window covers it — an operator verdict, backed by on-chain evidence, that the episode is a price-feed artifact rather than a market depeg — or when an existing live event for the same coin and direction overlaps it, since the live detector and the hourly replay read the same price series and would otherwise count one market episode twice. Skips keep the dry-run preview, the replay fingerprint, and the stored rows in agreement, and the replayed window's own delete still removes the stale backfill twin.

PegScore begins at a reviewed replay-coverage anchor when one is curated for the asset; otherwise it uses the documented age and first-observation fallbacks. Detail and tracker surfaces distinguish projected incidents from their constituent threshold crossings and publish a recent 90-day peg view whose denominator contains only observed coverage.

Since peg methodology 6.31, off-peg time stops at the last recorded trusted observation. Missing price/reference coverage or a missed producer run cannot extend a depeg interval; resumption starts a new interval rather than bridging the blind span. Unrecorded history inside legacy open events is unknown, not off peg or verified stability. Those spans are removed from the occupancy denominator and duration severity, including the recent 90-day view; occupancy is unavailable when no known time remains, and PegScore requires seven known days. Recorded historical peaks remain adverse evidence, but a stale open lifecycle alone cannot activate the current-depeg penalty.

PegScore excludes false-positive and disputed audit verdicts, but retains events with no audit data. Unknown non-null verdicts are not scoreable evidence. DDR uses the stricter policy: no-data verdicts are also ineligible there. Legacy unaudited null verdicts remain eligible in both systems.

DEWS (Depeg Early Warning System) computes forward-looking stress every 30 minutes from market, liquidity, confidence, blacklist, flow, and yield signals, with optional PSI-based amplification during systemic stress. Blacklist activity is attributed through the tracker config's canonical stablecoin ID, so same-symbol siblings do not inherit one issuer's freeze events. Both blacklist windows exclude suppressed mirror-zero tracker artifacts while retaining unsuppressed events. Hourly DEX prices remain eligible for 75 minutes, and its divergence input reuses the live depeg DEX trust floor, so fresh-but-thin rows stay visible for analytics but do not affect the score unless they pass the same `$1M` aggregate-TVL gate. The Mint/Burn Flow signal separates 30-day baseline coverage from source freshness: a fresh zero-volume 24-hour row is calm, while a mature baseline with no fresh 24-hour row is unavailable and recorded as stale. Divergence admits observed primary and trusted DEX legs independently; a stressed DEX-only observation remains market evidence when the primary is missing or nominal. Neither missing leg is a measured calm zero. The foundational stablecoins snapshot must fit its producer cadence plus runtime freshness budget; a stale, missing-clock, or invalid-clock snapshot holds the accepted generation without refreshing its timestamp. A late Yield Intelligence rankings generation is retained as last-good evidence for up to three yield producer intervals, with its generation and age recorded; beyond that it holds the generation. Malformed core persisted inputs quarantine the affected asset before scoring and contagion, while healthy peers publish an exact admitted generation. Its latest row is removed without rewriting sparse or daily history; optional unreadable pool detail only makes that component unavailable. Whole-source failures still withhold the generation, and an empty admitted cohort preserves the previous publication.

Systemic amplification requires a valid PSI sample within two producer intervals. A stale or invalid retained sample holds accepted DEWS publication instead of silently amplifying a fresh generation. Historical detection diagnostics exclude unevaluable events and disclose partial coverage; missing signal measurements and explicitly inapplicable signals remain distinct.

Historical DEWS daily snapshots do not retain the underlying DEX trust metadata needed to replay that gate exactly. When operators remediate the old thin-DEX window, the repair path refreshes current rows and prunes unrecomputable daily history back to the Mar 9, 2026 trust-floor boundary before new snapshots are published under the stricter rule.

PegScore

Composite 0–100 score measuring how faithfully a stablecoin holds its peg. The tracking window spans up to 4 years and first honors a reviewed replay-coverage anchor when one is curated for the asset. Without that verified anchor, PegScore prefers a curated launch date, then the earliest supply snapshot, then the first durable Pharos valid-price observation for priced assets without supply-history coverage. Young coins are not diluted across history they didn't exist for, and unobserved pre-coverage days are not silently treated as stable. Requires at least 7 days of tracking data; returns null otherwise. Scores based on 7–30 days are marked as “Early score” to signal limited history. The API additionally publishes a coverage-aware 90-day view with observed days, incidents, constituent threshold crossings, and peg percentage.

PegScore Formula

pegScore = 0.5 × pegPct + 0.5 × severityScore − activeDepegPenalty − spreadPenalty

PegScore Components

DEWS

DEWS is a per-coin, forward-looking stress score (0–100) for depeg stress. It is not a calibrated probability. It is computed every 30 minutes from 8 sub-signals. Only signals with available data participate; weights are redistributed proportionally across available signals.

Supply Velocity blends its readable 0.6/0.4 legs and Liquidity Erosion its readable 0.5/0.5 legs, dividing by the sum of available leg weights rather than counting missing deltas as calm. Coverage is 1 for full evidence, 0.6 or 0.4 for one supply leg, 0.5 for one liquidity leg, and 0 with a tagged unavailable result when neither is readable. Historical missing coverage remains unknown. Curves, dampening, signal-family weights and detector thresholds are unchanged.

Current DEX corroboration and recovery use original observations: family quotes must fit 35 minutes and aggregate contributors 75 minutes. Republishing an aggregate cannot renew undated, future or expired quotes. Conservative pool warnings remain negative-only evidence, not fresh recovery proof.

Bootstrap tolerance is one-time only. Missing optional tables can be ignored before the first successful publication. After that, stale or missing core liquidity inputs are recorded as source failures. The cron still writes rows that meet signal coverage, then marks the run degraded instead of treating the missing input as startup noise.

Mint/Burn Flow requires complete 24-hour and 30-day coverage at the published common closed-hour watermark, including explicitly admitted legacy pre-cutover windows with their weaker assurance. Both windows and dirty-hour checks share that end; freshness uses the actual window end, not its publication time. Existing freshness and valuation gates remain. An admitted fully valued zero-volume window is calm; absent or stale evidence is unavailable, with its signal weight redistributed. Restored inputs can move scores and bands in either direction; formulas and weights are unchanged.

Pool Balance Drift blends 40% balance stress, 35% average pool stress, and 25% worst single-pool imbalance among pools of at least $100K. When the top-pool detail is missing or unreadable, or no eligible pool carries a balance measurement, the worst-pool component is unavailable and the blend is renormalized over the two readable components with its coverage published, rather than counting the missing pool as perfectly balanced. A readable list with no eligible pool is an observed zero. Smoothing averages only with a previous reading built from the same components; one asset's unreadable detail never holds the whole run.

Liquidity Erosion selects the nearest positive-TVL daily observation with coverage confidence at least 0.5, within an inclusive 36 hours of the seven-day target, preserving the historical score and its date. The TVL anchor additionally requires the same liquidity-measurement epoch as the stored current observation; same-epoch minor releases remain comparable. Historical reconstruction uses its selected historical current anchor, not today's runtime version. Cross-epoch or missing-version-projection TVL evidence stays unavailable without discarding the independently eligible score. Without either historical anchor the signal is unavailable, not calm; weak public history remains visible. Corrected input availability can change new scores or bands, but retained scores are not rewritten and no replay result is claimed.

The Yield Anomaly sub-signal combines legacy warning strings with populated Yield Intelligence source-risk, source-switch, and rank-attribution stress evidence. Neutral, missing, or malformed structured yield rows remain unavailable rather than adding zero-stress signal weight.

Score formula

base = sum(W_i × S_i) / sum(W_i); psiAmp = PSI < 75 ? 1 + ((75 - PSI) / 75) × 0.3 : 1; contagionAmp = same-peg first-pass bump, clamped to 1.2; preliminaryScore = round(clamp(0, 100, base × psiAmp × contagionAmp))

At least 2 available signal sources (total weight ≥ 0.30) are required; otherwise DEWS returns null.

Final DEWS is capped at WATCH (35) unless there is qualifying market-price or DEX-liquidity stress evidence: an available Cross-Source Divergence, Pool Balance Drift, or Liquidity Erosion sub-signal at least 10. An available Blacklist Activity sub-signal at least 55 also bypasses the cap as severe issuer-control evidence. Mere source availability does not qualify. With either bypass the preliminary score is final; without either, finalScore = min(preliminaryScore, 35). The final score sets the band.

Sub-Signals & Weights

• Supply Velocity (0.25) — rapid redemptions (bank run), measured from 1-day and 7-day supply contraction rates
• Pool Balance Drift (0.20) — one-sided selling pressure in DEX pools, blending balance stress, pool stress, and worst-pool imbalance
• Liquidity Erosion (0.15) — LPs fleeing, measured from 7-day score and TVL changes against a positive-TVL history row with confidence at least 0.5 within 36 hours of the target; missing anchors are unavailable
• Price Confidence (0.15) — N-source consensus failures across CoinGecko, DefiLlama list, GeckoTerminal, Binance, Coinbase, Curve on-chain, and DEX prices; maps confidence levels (high/single-source/low/fallback) to stress values
• Cross-Source Divergence (0.15) — fragmented pricing between multi-source consensus price, DEX price, and peg reference
• Blacklist Activity (0.10) — issuer emergency freeze surges for canonical stablecoin IDs with direct blacklist-tracker coverage
• Mint/Burn Flow (0.10) — redemption surge vs minting from on-chain Transfer event data; requires at least 7 baseline days and a fresh 24-hour mint/burn row, with fresh zero-volume rows contributing zero flow stress
• Yield Anomaly (0.05) — warning-signal and structured source-risk accumulation from yield spikes, divergence, TVL outflows, negative trends, reward-heavy regimes, thin/stale sources, source switches, and source-risk rank drivers

Threat Bands

• CALM (0–15) — no stress signals detected
• WATCH (16–35) — mild stress on 1-2 indicators
• ALERT (36–55) — multiple indicators elevated
• WARNING (56–75) — strong stress signals, depeg plausible
• DANGER (76–100) — severe stress across available weighted signals

Edge cases

• NAV tokens are excluded entirely (price appreciates, not pegged)
• Non-USD pegs: cross-source divergence is dampened by 0.7 (noisier FX pricing)
• Nominal par is not an observed price: without observed primary or DEX evidence, divergence stays unavailable rather than calm
• Small coins (<$50M): supply velocity is dampened via a logarithmic size factor
• Missing or stale DEX and mint/burn freshness stays unavailable; zero-current rows retire; aggregate freshness uses the newest current row while the body exposes oldest-row lag

Supply history is daily and mint/burn coverage is partial (about 141 of 400 coins), so coins with neither usable source degrade to Insufficient Signal on supply-dependent kill signals rather than guessing. Legacy null audit verdicts remain eligible; false-positive, disputed, no-data, and unknown non-null verdicts are excluded. Corpus quality also depends on incident grouping, quarantine of flappy coins, and a minimum-severity floor. Terminal truth derives from cemetery/frozen status and the live deep-and-sustained-open pattern, never from the presence of a recovery price on a backfilled row.

Acceptance gates: Stage 1 must score Terminal evidence on clearly-attributable deaths (UST, IRON, USR) and must not on major recoveries (USDC during SVB, DAI on Black Thursday, LUSD/BOLD wobbles); Stage 2 median and typical ranges must contain realized resolution times at the documented coverage rate, with leave-one-coin stability and a stable canonical lineage hash. Abandoned slow-deaths that never present a sharp depeg are out of scope. The full methodology, limitations, and backtest plan live in docs/depeg-resolver.md.

v5 replay evidence is small and advisory. Re-mapping 74 forecast-scored sealed outcomes under the v5 rules gave 71 correct calls against 61 under v4 and 70 for a constant “will recover” baseline, with false terminal calls falling from 11 to 1. A time-ordered duration replay (46 to 121 incidents per landmark) lowered Brier error against v4 in every landmark and horizon cell and beat a pooled base rate per horizon, but odds remain overconfident at long horizons (30-day odds averaged 0.90 against 0.79 observed at the 1-hour landmark) and typical-range coverage stays below its nominal 70%. Terminal-call skill cannot yet be measured: only three forward-looking terminal outcomes exist.

DDRR does not replay today’s resolver over historical rows. It compares the frozen first-published DDR outcome with the later event outcome, keeps append-only errata visible, preserves immutable trigger/readiness metadata, and separates policy-universe coverage from scoreable recovery/duration accuracy. If a health deferral is followed by recovery or reliable terminal evidence before a healthy lock, the row remains a pre-lock coverage outcome rather than a retroactive forecast. Rollout-active incidents that already existed before DDRv2 use the public-contract effective timestamp as the fairness boundary for the same pre-lock coverage test.

The blacklist tracker stores event-time rows separately from a persistent freeze-ledger snapshot. Each cron run processes new events since the last indexed block; new blacklist rows refresh last-known snapshots, while later unblacklist events do not delete historical ledger rows.

Backlog sync handles gaps from missed cron runs or RPC failures by replaying events from the last confirmed cursor. Tron events use a separate ingestion path due to the TRC-20 event format differences, and missing Tron account/token-balance data remains provider-missing rather than being converted to zero.

State transitions use timestamp, block number, numeric EVM block-global log index, and batch-array position, never transaction-hash order. Tron events from different transactions in the same block use confirmed within-block transaction positions when observed from chain data; transaction-local indices alone cannot prove that order. Missing or contradictory positions keep state explicitly ambiguous and excluded from confirmed active counts. A bounded maintenance pass resolves both historical and new conflicts without rewinding scan cursors. Malformed required direction, address, array, or identity evidence holds the scan frontier for two observations; the third distinct scan durably quarantines the raw evidence and reason before continuing. Valid empty address arrays do not hold the frontier.

The public-facing freeze totals combine per-chain counts into a single figure. Destroy/seize events can overwrite the stored amount when they provide better seized-value evidence, and the public summary reads the persistent ledger rather than treating unfreeze rows as historical deletion. The legacy active fields remain available for the local net-active state machine, but public freeze exposure should use the tracked ledger fields.