Safety Scores Changelog

Active-depeg and dependency edge cases now follow the documented Safety Score model more strictly.

• Peg Stability now passes through computePegScore() during active depegs instead of applying the old 65-point peg-dimension cap before the multiplier.
• activeDepegBpsnow comes from the open depeg event's peak severity, so final Safety Score caps use the same severe-event source as redemption-route impairment.
• Stale redemption-backstop snapshots no longer uplift Liquidity / Exit; the dimension falls back to fresh DEX evidence or NR until the redemption snapshot refreshes.
• Missing upstream dependency scores are applied at the existing 70-point unavailable fallback for their declared weights, and the contagion stress test now propagates transitively through downstream dependency chains.

Severe active depegs now force redemption uplift to prove current exercisability instead of relying on static route documentation.

• Liquidity / Exit now ignores redemption backstops that are unresolved, low-confidence, or marked impaired by route-availability evidence.
• Active depegs at or above 2500 bps disable static, documented-bound, live-proxy, issuer/API, queue, and estimated redemption uplift.
• Live-direct, dynamic, permissionless routes with atomic or immediate settlement can still contribute during severe depegs because they carry current direct redemption evidence.

Direct inherited freeze risk now counts two reserve-side collateral classes that were previously under-attributed: custodied BTC wrappers and issuer-seizable tokenized collateral.

• Shared isBlacklistable() now treats centralized-custody BTC wrappers such as WBTC and cbBTC as direct inherited freeze exposure rather than only weak possible clues.
• Issuer-seizable tokenized collateral such as PAXG, XAUT, and reviewed tokenized share symbols such as BOSS now counts toward the same direct inherited threshold.
• Coins whose reserve mix crosses the majority threshold because of these assets now resolve to inherited instead of possible.

NAV wrappers that explicitly wrap a stablecoin now inherit peg risk from the referenced base asset instead of getting an automatic neutral peg multiplier.

• Configured NAV wrappers can now reuse a referenced base stablecoin's pegScore in Safety Score report-card scoring.
• Pure fund-share NAV tokens with no configured peg reference still keep pegScore = NR and the neutral multiplier treatment.
• This specifically closes the loophole where a wrapped stablecoin NAV structure could avoid the stronger v6.93 peg penalty even when the underlying base stablecoin had clear peg risk.

Peg stability now has more weight in the final grade, and severe live depegs can hard-cap the score regardless of otherwise strong base dimensions.

• PEG_MULTIPLIER_EXPONENT increased from 0.20 to 0.40.
• Active depegs at or above 1000 bps now cap the overall score at D, and active depegs at or above 2500 bps cap it at F.
• activeDepegBps is now exposed in report-card raw inputs so the frontend and stressed-grade recomputation paths apply the same cap logic.

LUSD now uses direct Liquity v1 system-collateral reads instead of the generic proof-style liveness probe, so clean snapshots qualify as independent live reserve evidence.

• The dedicated liquity-v1 adapter reads getEntireSystemColl() and getEntireSystemDebt() from the official Ethereum TroveManager.
• LUSD reserve snapshots remain a single-bucket 100% ETH view, but the adapter is now registered as independent instead of weak-live-probe.
• This promotes LUSD's clean authoritative reserve snapshots into collateral-quality live passthrough without relaxing the generic gate for other single-asset probes.

Blacklistability attribution now treats reserve-side freeze clues as first-class signals instead of only trusting explicit slice flags and resolved upstream coin IDs.

• Shared isBlacklistable() now resolves to possible when curated or live reserve labels imply blacklistable stablecoins, wrappers, or CEX/custody rails below the majority threshold.
• Majority direct reserve exposure still resolves to inherited; the new heuristics are there to prevent reserve-side exposure from incorrectly falling through to no.
• Live reserve enrichment and curated reserve evaluation now share the same direct clue detection for named stablecoin baskets and explicit custody/CEX descriptors.
• This does not relax the collateral passthrough gate: static-validated, weak-live-probe, and freshnessMode=unverified reserve feeds remain detail-visible only.

Blacklistability attribution now separates mutable-contract risk from collateral-inherited freeze risk.

• Shared blacklistability resolution no longer treats centralized-dependent governance as enough evidence for possible on its own.
• Reserve-heavy downstream freeze exposure now surfaces as inherited, which is distinct from mutable-contract risk.
• Inherited status now requires majority reserve exposure and can use curated reserve-slice blacklistable markers in addition to upstream stablecoin links.

Safety Score structure is unchanged, but direct latest-state reserve adapters now stamp explicit on-chain freshness so eligible feeds are no longer excluded by missing timestamp metadata.

• evm-branch-balances snapshots now persist freshnessMode=not-applicable.
• Clean independent branch-balance snapshots can once again override curated collateral quality when their latest reserve_sync_state.last_status is ok.
• This aligns implementation with the existing v6.6 freshness gate rather than introducing a new collateral-scoring rule family.

Blacklistability attribution now treats centralized-dependent stablecoins as possible by default unless a more specific signal applies.

• Shared blacklistability resolution now falls back to possible for centralized-dependent governance instead of false.
• Reserve-heavy dependency cases still surface as possible-inherited when inherited exposure is the more specific explanation.
• Explicit overrides remain authoritative, including curated false exceptions.

Safety Score structure is unchanged, but collateral-quality live reserve passthrough now requires stronger freshness evidence before a live feed can override curated collateral scoring.

• Independent live reserve feeds still need a fresh authoritative snapshot whose latest reserve_sync_state.last_status is ok.
• In addition, collateral passthrough now requires scoring-eligible freshness evidence: either a verified timestamp path or a freshnessMode of verified or not-applicable.
• Feeds marked unverified remain available on reserve detail/status surfaces, but they no longer override curated collateral quality in report-card scoring.

Safety Score structure is unchanged, but the collateral-quality live reserve passthrough is now stricter about evidence quality and warning-bearing feeds.

• Live collateral passthrough now requires a fresh authoritative snapshot whose latest reserve_sync_state.last_status is ok.
• The live reserve adapter registry now separates reserve shape (sourceModel) from evidence strength (evidenceClass).
• single-asset and tether style feeds are now treated as weak-live-probe evidence, so they remain visible on reserve detail/status surfaces but no longer override curated collateral scoring.
• Source-age and material unknown-exposure warnings now degrade reserve sync health and automatically keep those snapshots out of collateral passthrough.

Safety Score structure is unchanged, but Liquity-style formula routes can now use current on-chain redemption fees when live reserve telemetry is available.

• LUSD and BOLD now reuse live reserve sync metadata for current redemption fee bps instead of always sitting in the generic reviewed-formula bucket.
• These routes remain labeled as formula fee models and eventual-only capacity routes, so Pharos does not present them as having an immediate redeemable buffer.
• If live fee telemetry is unavailable, the liquidity dimension falls back to the prior reviewed-formula treatment.

Safety Score structure is unchanged, but a narrow class of immutable on-chain redemption routes now counts as stronger exit evidence than heuristic capacity models.

• LUSD and BOLD now use documented-bound eventual redemption capacity instead of generic heuristic supply-full modeling.
• These routes still present as eventual-only, so Pharos does not treat full current supply as an immediate redeemable buffer.
• Liquity-style min 50 bps + baseRate fees remain reviewed formula inputs rather than fixed-fee assumptions.

Safety Score structure is unchanged, but the collateral-quality live reserve passthrough is now stricter about which hourly reserve feeds qualify.

• Live collateral passthrough now requires a fresh authoritative snapshot: the reserve row must be non-empty and matched to the coin's latest successful sync state.
• Only dynamic-mix and single-bucket feeds count as independent live collateral inputs. validated-static feeds stay visible on reserve detail/status surfaces but no longer override curated collateral scoring.
• Single-bucket live feeds now participate in collateral drift and fallback tracking; the old implicit >= 2 slices gate is no longer the scoring contract.

Safety Score structure is unchanged, but the Liquidity dimension is now stricter about what redemption evidence can improve it.

• Low-confidence redemption routes remain visible in detail surfaces, but they no longer uplift the Safety Score liquidity dimension.
• When the reused DEX liquidity snapshot is stale, it is no longer blended into effectiveExitScore.
• Redemption detail output now distinguishes immediate redeemable capacity from eventual issuer/protocol redeemability.

Four structural changes landed together in the safety methodology: a wider custody model, a new chain tier for Solana and BNB Chain, a simpler 2-factor Resilience score, and a steeper 5-band chain penalty.

• Custody model expanded from 3 to 6 tiers: onchain, institutional-top, institutional-regulated, institutional-unregulated, institutional-sanctioned, and cex.
• Added mature-alt-l1 for Solana and BNB Chain with score 45.
• Resilience became (collateral + custody) / 2; blacklist capability is now descriptive only.
• Chain-risk penalty moved to 5 bands, and wrapper governance became exempt from that penalty.

Three DeFi-classified coins were corrected after live reserve review showed majority centralized custody exposure.

• meUSD, ALUSD, and BtcUSD were reclassified from decentralized to centralized-dependent.
• ALUSD's earlier v4.1 correction was explicitly reversed after reserve review showed majority direct USDC/USDT exposure.
• meUSD and BtcUSD were corrected after live reserves confirmed custodial BTC-variant backing.

Collateral quality scoring now consumes live reserve snapshots when available, using hourly data from reserve_composition instead of curated metadata.

• Coins with liveReservesConfiguse fresh (<48h) live snapshots for collateral quality instead of curated metadata.
• Delta alert fires when live-derived score diverges from curated by >15 points.
• Dependency inference remains on curated data (live slices lack coinId links).

Direct ETH and canonical WETH reserve slices now share the same very-low risk tier.

• Updated the shared direct-asset reserve map used by live reserve adapters so `WETH` no longer falls into the generic wrapped-asset bucket.
• Aligned curated reserve metadata and live config overrides for coins that expose plain `WETH` or `ETH` slices.
• Left mixed strategy buckets unchanged. Delta-neutral ETH exposures, bridged ETH buckets, and mixed BTC/ETH slices still use their existing manually-modeled risk tiers.

The Safety Score liquidity dimension now evaluates exit liquidity, not just raw DEX depth.

• Added a new redemption backstop datasetfor redeemable assets, covering onchain collateral redemptions, stable basket redemptions, queue-based liquid-buffer systems, and issuer redemption rails.
• The report-card Liquidity dimension now uses an effective exit score: DEX liquidity remains the floor, while redemption quality can improve the dimension without redefining the standalone DEX liquidity score.
• Added route-family caps so queue-based and offchain issuer systems cannot look unrealistically liquid even when redemption exists.

Three fixes to the peg score formula that prevent young coins with chronic depegs from scoring artificially high:

• Tracking window capped at coin age — uses the coin's earliest supply snapshot instead of always defaulting to a 4-year window. A 30-day-old coin is now scored over 30 days, not 1,461.
• Severity magnitude floor — every depeg event carries a minimum penalty of (peakBps / 2000) × recencyWeight, regardless of duration. Hundreds of brief high-magnitude depegs now accumulate real cost.
• Active depeg penalty steepened — floor raised from 2 to 5, divisor changed from 200 to 50. A 500 bps ongoing depeg now costs 10 points (was 2.5).

When the Liquidity dimension is NR (no DEX data), the overall score now receives a 10% penalty instead of silently redistributing the weight to other dimensions.

As DEX pipeline coverage matures, absence of liquidity data is increasingly suspect and should not inflate grades.

Chain infrastructure was scored in bothResilience (as a 25% sub-factor) and Decentralization (as a penalty) — double-counting chain risk.

• Chain infra now scored exclusively in Decentralization
• Resilience becomes a 3-factor model (each &frac13;): Collateral Quality, Custody Model, Blacklist Capability

New highest GovernanceQuality tier: immutable-code → 100. For protocols with no admin keys, no upgrade path, no DAO attack surface (e.g. LUSD, BOLD). Exempt from chain infrastructure penalty.

• Blacklist scoring softened: blacklistable 0→33, possible 50→66, not-blacklistable 100 (unchanged). Non-zero floor for blacklistable tokens.
• regulated-entity tier added (score 40). Auto-promoted from single-entity when: jurisdiction regulator + license set, and proof of reserves via independent audit. Exempt from chain infra penalty.
• Grade thresholds lowered 5 points (C-range overcrowding after blacklist/decentralization changes).