---
title: "Safety Scores Changelog"
canonical: "https://pharos.watch/methodology/scoring-changelog/archive/v6/"
description: "Safety Scores Changelog - Pharos methodology version history."
---
# Safety Scores Changelog
[All versions](https://pharos.watch/methodology/scoring-changelog/)
## v6.99 - Asymmetry USDaf live reserve freshness promotion
**Effective:** 2026-04-15
USDaf's Asymmetry reserve feed now preserves the protocol API timestamp and normalizes branch symbols before risk classification, allowing clean fresh snapshots to qualify for live collateral passthrough.
- The Asymmetry adapter now emits verified source freshness from the protocol API timestamp when available
- Branch-name normalization prevents casing-only symbols such as wBTC from degrading the feed as unknown exposure
- The global live collateral gate remains unchanged: only independent ok-status snapshots with scoring-eligible freshness can drive report-card collateral scoring
USDaf's Asymmetry reserve feed can now qualify for live collateral passthrough when the protocol API snapshot is fresh.
- The adapter now preserves Asymmetry's top-level API timestamp as verified reserve-source freshness.
- Branch symbols are normalized before risk lookup, so casing-only variants such as `wBTC` no longer degrade the feed.
- No scoring policy changed; the feed still needs fresh independent evidence and an `ok` sync state.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.98 - Timestamp-backed reserve feeds restored to collateral passthrough
**Effective:** 2026-04-15
Several live reserve adapters now consume source timestamps already exposed by their upstream dashboards or disclosure pages, allowing clean fresh snapshots to qualify for collateral-quality passthrough without weakening the global freshness gate.
- Circle, M0, Mento, and USD.AI reserve adapters now emit verified freshness when their upstream source exposes a usable disclosure or update timestamp
- Yuzu and Re Protocol reserve feeds now have explicit mappings for newly observed buckets/tokens, preventing clean fresh feeds from being degraded as unknown exposure
- OpenEden reserve sync now sends browser-style origin hints to reduce upstream transport failures while preserving the existing verified timestamp validation
- Feeds that still lack trustworthy source freshness remain detail-visible only; the report-card live collateral gate still requires independent evidence, ok sync status, and verified or not-applicable freshness
Timestamped reserve feeds can now re-enter collateral-quality passthrough when they satisfy the existing freshness and sync-health gates.
- Circle, M0, Mento, and USD.AI reserve adapters now preserve usable upstream disclosure or dashboard timestamps instead of leaving those snapshots marked `freshnessMode=unverified`.
- Re Protocol and Yuzu mappings now classify newly observed reserve buckets explicitly, so clean fresh snapshots are not degraded as unknown exposure.
- The global gate is unchanged: only fresh, independent, `ok` sync snapshots with verified or intrinsically current freshness can drive report-card collateral scoring.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.97 - Active-depeg caps use event peak and stale redemption inputs are suppressed
**Effective:** 2026-04-15
Safety Score active-depeg handling now uses the open event's peak severity for final caps, removes the legacy peg-dimension cap, suppresses stale redemption rows, and makes dependency/stress behavior more conservative.
- Peg Stability now passes through computePegScore() directly during active depegs instead of applying an extra legacy 65-point cap before the multiplier
- RawDimensionInputs.activeDepegBps now uses the open depeg event peak, aligning final Safety Score caps with the severe-redemption impairment source
- Report-card Liquidity / Exit suppresses stale redemption-backstop snapshots instead of reusing old redemption uplift indefinitely
- Partially unavailable upstream dependency scores are scored at the existing 70-point unavailable fallback for their declared weights rather than being treated as self-backed
- The contagion stress test now propagates downstream dependency recomputations transitively instead of stopping at direct dependents
Active-depeg and dependency edge cases now follow the documented Safety Score model more strictly.
- Peg Stability now passes through `computePegScore()` during active depegs instead of applying the old 65-point peg-dimension cap before the multiplier.
- `activeDepegBps` now comes from the open depeg event's peak severity, so final Safety Score caps use the same severe-event source as redemption-route impairment.
- Stale redemption-backstop snapshots no longer uplift Liquidity / Exit; the dimension falls back to fresh DEX evidence or NR until the redemption snapshot refreshes.
- Missing upstream dependency scores are applied at the existing 70-point unavailable fallback for their declared weights, and the contagion stress test now propagates transitively through downstream dependency chains.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.96 - Severe active depegs disable weak redemption uplift
**Effective:** 2026-04-14
Liquidity / Exit no longer accepts static or non-live-direct redemption uplift during severe active depegs unless current live-open redemption evidence exists.
- Redemption backstop uplift now requires a resolved non-low-confidence route that is not impaired by route availability or severe active-depeg contradiction
- Active depegs at or above 2500 bps disable static, documented-bound, live-proxy, issuer/API, queue, and estimated redemption uplift until live-open evidence returns
- Live-direct, dynamic, permissionless, atomic or immediate redemption routes can still contribute to Liquidity / Exit during a severe depeg because they provide current direct exercisability evidence
Severe active depegs now force redemption uplift to prove current exercisability instead of relying on static route documentation.
- Liquidity / Exit now ignores redemption backstops that are unresolved, low-confidence, or marked impaired by route-availability evidence.
- Active depegs at or above `2500 bps` disable static, documented-bound, live-proxy, issuer/API, queue, and estimated redemption uplift.
- Live-direct, dynamic, permissionless routes with atomic or immediate settlement can still contribute during severe depegs because they carry current direct redemption evidence.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.95 - Direct inherited freeze risk now counts custodied BTC wrappers and issuer-seizable collateral
**Effective:** 2026-04-07
Blacklistability attribution now treats centralized-custody BTC wrappers, tokenized gold, and issuer-seizable tokenized collateral as direct reserve-side freeze exposure when they dominate a stablecoin's backing mix.
- Shared isBlacklistable() logic now counts centralized-custody BTC wrappers such as WBTC and cbBTC as direct reserve-side freeze exposure instead of only possible exposure
- Issuer-seizable tokenized collateral such as tokenized gold and reviewed tokenized share symbols now also counts as direct inherited freeze risk when present in reserve labels
- Coins with these reviewed collateral assets gained inherited-freeze treatment in this phase; v7.13 later superseded the reserve-weight gate with the current any-reserve Upstream policy
Direct inherited freeze risk now counts two reserve-side collateral classes that were previously under-attributed: custodied BTC wrappers and issuer-seizable tokenized collateral.
- Shared `isBlacklistable()` now treats centralized-custody BTC wrappers such as `WBTC` and `cbBTC` as **direct** inherited freeze exposure rather than only weak possible clues.
- Issuer-seizable tokenized collateral such as `PAXG`, `XAUT`, and reviewed tokenized share symbols such as `BOSS` joined the direct inherited-freeze signal set introduced in this phase.
- Coins with these reviewed collateral assets gained inherited-freeze treatment in this phase; v7.13 later superseded the reserve-weight gate with the current any-reserve `inherited` instead of `possible`.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.94 - NAV wrappers can inherit peg risk from a referenced base stablecoin
**Effective:** 2026-04-06
NAV tokens that are explicit wrappers over a stablecoin can now inherit peg stability from a configured base asset instead of receiving an automatic neutral peg multiplier.
- Configured NAV wrappers can now use a referenced base stablecoin's pegScore in report-card scoring when their own NAV share price is not the right peg-tracking surface
- Pure NAV fund-share tokens with no configured peg reference still remain pegScore = NR and keep the neutral multiplier treatment
- sUSDai now inherits USDAI peg risk, preventing the stronger v6.93 peg multiplier from becoming a free pass for wrapped stablecoin NAV structures
NAV wrappers that explicitly wrap a stablecoin now inherit peg risk from the referenced base asset instead of getting an automatic neutral peg multiplier.
- Configured NAV wrappers can now reuse a referenced base stablecoin's `pegScore` in Safety Score report-card scoring.
- Pure fund-share NAV tokens with no configured peg reference still keep `pegScore = NR` and the neutral multiplier treatment.
- This specifically closes the loophole where a wrapped stablecoin NAV structure could avoid the stronger v6.93 peg penalty even when the underlying base stablecoin had clear peg risk.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.93 - Steeper peg multiplier + active depeg grade cap
**Effective:** 2026-04-05
Peg multiplier exponent raised from 0.2 to 0.4 so peg stability impacts grades more meaningfully. Active depegs above 1000 bps now cap the overall score at D; above 2500 bps caps at F.
- PEG_MULTIPLIER_EXPONENT changed from 0.2 to 0.4: coins with pegScore 80+ see ~1-5% more reduction; coins with pegScore < 30 see 19-34% more reduction
- New graduated active depeg cap: >= 2500 bps (25%) caps overall at 39 (F), >= 1000 bps (10%) caps overall at 49 (D)
- Active depeg severity (activeDepegBps) added to RawDimensionInputs for reproducibility in stressed grades and frontend
Peg stability now has more weight in the final grade, and severe live depegs can hard-cap the score regardless of otherwise strong base dimensions.
- `PEG_MULTIPLIER_EXPONENT` increased from `0.20` to `0.40`.
- Active depegs at or above `1000 bps` now cap the overall score at D, and active depegs at or above `2500 bps` cap it at F.
- `activeDepegBps` is now exposed in report-card raw inputs so the frontend and stressed-grade recomputation paths apply the same cap logic.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.92 - Direct Liquity v1 reserve observation for LUSD
**Effective:** 2026-04-04
LUSD now uses direct on-chain Liquity v1 system-collateral telemetry instead of the generic proof-style liveness probe, so fresh clean snapshots qualify as independent live reserve evidence.
- LUSD live reserve sync now reads TroveManager getEntireSystemColl() and getEntireSystemDebt() directly from Ethereum
- The reserve detail badge for clean authoritative LUSD snapshots now resolves to live instead of proof because the adapter is classified as independent single-bucket evidence
- Weak single-asset probes remain excluded from collateral-quality passthrough; this is a targeted Liquity v1 adapter upgrade rather than a reclassification of the generic family
LUSD now uses direct Liquity v1 system-collateral reads instead of the generic proof-style liveness probe, so clean snapshots qualify as independent live reserve evidence.
- The dedicated `liquity-v1` adapter reads `getEntireSystemColl()` and `getEntireSystemDebt()` from the official Ethereum `TroveManager`.
- LUSD reserve snapshots remain a single-bucket 100% ETH view, but the adapter is now registered as `independent` instead of `weak-live-probe`.
- This promotes LUSD's clean authoritative reserve snapshots into collateral-quality live passthrough without relaxing the generic gate for other `single-asset` probes.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.91 - Reserve-side blacklist exposure heuristics
**Effective:** 2026-03-30
Blacklistability attribution began scanning curated and live reserve labels plus reserve-rail text for stablecoin, wrapper, and CEX custody clues; v7.13 later promoted any matched reserve path to Upstream.
- Shared isBlacklistable() logic started surfacing reserve-side blacklist and custodial-freeze clues instead of falling through to no
- Curated and live reserve names started sharing the same direct blacklist clue detection instead of relying only on coinId or explicit blacklistable flags; v7.13 later removed the reserve-weight gate
- Only coins with no explicit blacklist function, no reserve-side blacklist clues, and no CEX custody signal remain in the no bucket unless an explicit false override applies
Blacklistability attribution now treats reserve-side freeze clues as first-class signals instead of only trusting explicit slice flags and resolved upstream coin IDs.
- Shared `isBlacklistable()` now resolves to `possible` when curated or live reserve labels imply blacklistable stablecoins, wrappers, or CEX/custody rails below the majority threshold.
- Majority **direct** reserve exposure still resolves to `inherited`; the new heuristics are there to prevent reserve-side exposure from incorrectly falling through to `no`.
- Live reserve enrichment and curated reserve evaluation now share the same direct clue detection for named stablecoin baskets and explicit custody/CEX descriptors.
- This does not relax the collateral passthrough gate: `static-validated`, `weak-live-probe`, and `freshnessMode=unverified` reserve feeds remain detail-visible only.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.9 - Explicit inherited blacklistability
**Effective:** 2026-03-30
Blacklistability attribution now separates mutable-contract risk from inherited collateral freeze risk, and no longer treats centralized-dependent governance as enough evidence on its own.
- Shared isBlacklistable() logic no longer defaults centralized-dependent governance to possible
- Reserve-heavy downstream freeze exposure now resolves to inherited instead of possible-inherited
- Inherited detection became an explicit upstream-freeze category using curated reserve-slice blacklistable markers and upstream stablecoin coinId links; v7.13 later removed the reserve-weight gate
Blacklistability attribution now separates mutable-contract risk from collateral-inherited freeze risk.
- Shared blacklistability resolution no longer treats `centralized-dependent` governance as enough evidence for `possible` on its own.
- Reserve-heavy downstream freeze exposure now surfaces as `inherited`, which is distinct from mutable-contract risk.
- Inherited status became an explicit upstream-freeze category that can use curated reserve-slice `blacklistable` markers in addition to upstream stablecoin links; v7.13 later removed the reserve-weight gate.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.8 - On-chain reserve freshness alignment
**Effective:** 2026-03-25
Direct latest-state reserve adapters now explicitly mark on-chain freshness as not-applicable, allowing clean independent branch-balance snapshots to participate in collateral-quality passthrough again.
- evm-branch-balances snapshots now carry freshnessMode=not-applicable instead of remaining timestamp-less and implicitly ineligible
- Clean branch-balance reserve feeds can override curated collateral quality again when their latest reserve sync status is ok
- This is an implementation-alignment change to the existing v6.6 freshness policy, not a new scoring rule family
Safety Score structure is unchanged, but direct latest-state reserve adapters now stamp explicit on-chain freshness so eligible feeds are no longer excluded by missing timestamp metadata.
- `evm-branch-balances` snapshots now persist `freshnessMode=not-applicable`.
- Clean independent branch-balance snapshots can once again override curated collateral quality when their latest `reserve_sync_state.last_status` is `ok`.
- This aligns implementation with the existing v6.6 freshness gate rather than introducing a new collateral-scoring rule family.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.7 - CeFi-dependent blacklistability fallback
**Effective:** 2026-03-25
Blacklistability attribution now defaults centralized-dependent stablecoins to possible unless an explicit override or inherited-reserve classification is more specific.
- Shared isBlacklistable() logic now resolves centralized-dependent governance to possible instead of false
- Inherited reserve exposure still takes precedence, preserving possible-inherited for reserve-heavy dependency cases
- Explicit canBeBlacklisted overrides remain authoritative, including explicit false exceptions
Blacklistability attribution now treats **centralized-dependent** stablecoins as **possible** by default unless a more specific signal applies.
- Shared blacklistability resolution now falls back to `possible` for centralized-dependent governance instead of `false`.
- Reserve-heavy dependency cases still surface as `possible-inherited` when inherited exposure is the more specific explanation.
- Explicit overrides remain authoritative, including curated `false` exceptions.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.6 - Timestamp-backed live reserve scoring gate
**Effective:** 2026-03-24
Collateral-quality passthrough now excludes timestamp-less or explicitly unverified live reserve feeds unless the feed carries verified freshness or is intrinsically on-chain.
- Independent live reserve feeds now need scoring-eligible freshness evidence in addition to fresh authoritative ok-status snapshots
- Snapshots with freshnessMode=unverified no longer override curated collateral quality in report-card scoring
- Direct on-chain reserve adapters can still qualify when freshness is marked not-applicable
Safety Score structure is unchanged, but collateral-quality live reserve passthrough now requires stronger freshness evidence before a live feed can override curated collateral scoring.
- Independent live reserve feeds still need a **fresh authoritative snapshot** whose latest `reserve_sync_state.last_status` is `ok`.
- In addition, collateral passthrough now requires scoring-eligible freshness evidence: either a verified timestamp path or a `freshnessMode` of `verified` or `not-applicable`.
- Feeds marked `unverified` remain available on reserve detail/status surfaces, but they no longer override curated collateral quality in report-card scoring.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.5 - Clean independent live reserve passthrough
**Effective:** 2026-03-22
Collateral-quality passthrough now requires clean independent live reserve evidence, excluding weak probes and warning-bearing snapshots from Safety Score scoring.
- Live collateral passthrough now requires a fresh authoritative snapshot whose latest reserve sync status is ok
- The live reserve adapter registry now separates reserve shape (sourceModel) from evidence strength (evidenceClass)
- single-asset and tether style feeds now remain detail/status-visible only; they no longer override curated collateral scoring
- Source-age and material unknown-exposure warnings now automatically keep affected snapshots out of collateral passthrough
Safety Score structure is unchanged, but the collateral-quality live reserve passthrough is now stricter about evidence quality and warning-bearing feeds.
- Live collateral passthrough now requires a **fresh authoritative snapshot** whose latest `reserve_sync_state.last_status` is `ok`.
- The live reserve adapter registry now separates reserve shape (`sourceModel`) from evidence strength (`evidenceClass`).
- `single-asset` and `tether` style feeds are now treated as `weak-live-probe` evidence, so they remain visible on reserve detail/status surfaces but no longer override curated collateral scoring.
- Source-age and material unknown-exposure warnings now degrade reserve sync health and automatically keep those snapshots out of collateral passthrough.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.4 - Live Liquity redemption fee telemetry
**Effective:** 2026-03-22
The liquidity dimension keeps the same structure, but Liquity-style formula routes can now use current on-chain redemption fees when live reserve telemetry is available.
- LUSD and BOLD now reuse live reserve sync metadata for current redemption fee bps instead of always sitting in the generic formula-fee bucket
- These routes remain labeled as formula-based and eventual-only; Pharos still does not present them as having an immediate redeemable buffer
- If live fee telemetry is unavailable, Safety Score liquidity falls back to the prior reviewed-formula treatment
Safety Score structure is unchanged, but Liquity-style formula routes can now use current on-chain redemption fees when live reserve telemetry is available.
- **LUSD** and **BOLD** now reuse live reserve sync metadata for current redemption fee bps instead of always sitting in the generic reviewed-formula bucket.
- These routes remain labeled as `formula` fee models and `eventual-only` capacity routes, so Pharos does not present them as having an immediate redeemable buffer.
- If live fee telemetry is unavailable, the liquidity dimension falls back to the prior reviewed-formula treatment.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.3 - Documented-bound Liquity redemption confidence
**Effective:** 2026-03-22
Fully on-chain Liquity redemption routes with documented full-system redeemability now qualify as stronger exit-liquidity evidence without being presented as immediate buffer capacity.
- LUSD and BOLD now use documented-bound eventual redemption capacity instead of heuristic supply-full modeling
- These routes remain eventual-only on detail surfaces, but they can now uplift the Safety Score liquidity dimension
- Liquity-style base-rate fee formulas remain reviewed formula inputs rather than fixed-fee assumptions
Safety Score structure is unchanged, but a narrow class of immutable on-chain redemption routes now counts as stronger exit evidence than heuristic capacity models.
- **LUSD** and **BOLD** now use `documented-bound` eventual redemption capacity instead of generic heuristic `supply-full` modeling.
- These routes still present as `eventual-only`, so Pharos does not treat full current supply as an immediate redeemable buffer.
- Liquity-style `min 50 bps + baseRate` fees remain reviewed formula inputs rather than fixed-fee assumptions.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.2 - Independent live reserve contract tightening
**Effective:** 2026-03-22
Collateral-quality passthrough now only uses fresh authoritative independent live reserve feeds, preventing validated-static probes from overriding curated scoring and allowing single-bucket live feeds to count.
- Live collateral passthrough now requires a fresh authoritative snapshot matched to reserve_sync_state, not just a fresh reserve_composition row
- Only dynamic-mix and single-bucket live feeds can override curated collateral quality; validated-static feeds stay reserve-detail/status only
- Single-bucket live feeds now contribute to collateral drift and curated-fallback tracking instead of being excluded by an implicit >=2-slice gate
Safety Score structure is unchanged, but the collateral-quality live reserve passthrough is now stricter about which hourly reserve feeds qualify.
- Live collateral passthrough now requires a** fresh authoritative snapshot**: the reserve row must be non-empty and matched to the coin's latest successful sync state.
- Only `dynamic-mix` and `single-bucket` feeds count as independent live collateral inputs. `validated-static` feeds stay visible on reserve detail/status surfaces but no longer override curated collateral scoring.
- Single-bucket live feeds now participate in collateral drift and fallback tracking; the old implicit `>= 2 slices` gate is no longer the scoring contract.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.1 - Redemption confidence gating and capacity semantics
**Effective:** 2026-03-22
Liquidity scoring now distinguishes strong redemption evidence from heuristic routes and stops presenting eventual issuer redemption as immediate buffer capacity.
- Low-confidence redemption backstops no longer uplift the Safety Score liquidity dimension
- Stale DEX liquidity no longer produces blended effective-exit inputs in report-card scoring
- Redemption detail output now separates eventual redeemability from immediate redeemable capacity
Safety Score structure is unchanged, but the Liquidity dimension is now stricter about what redemption evidence can improve it.
- Low-confidence redemption routes remain visible in detail surfaces, but they no longer uplift the Safety Score liquidity dimension.
- When the reused DEX liquidity snapshot is stale, it is no longer blended into `effectiveExitScore`.
- Redemption detail output now distinguishes immediate redeemable capacity from eventual issuer/protocol redeemability.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded
## v6.0 - Custody model tiers, mature-alt-l1, 2-factor Resilience
**Effective:** 2026-03-21
Four structural changes: 6-tier custody model replaces 3-tier, new mature-alt-l1 chain tier for Solana/BNB, Resilience becomes 2-factor (blacklist descriptive only), 5-band chain penalty with wrapper exemption.
- Custody model split: onchain/institutional-top/institutional-regulated/institutional-unregulated/institutional-sanctioned/cex (was onchain/institutional/cex)
- USDC, BUIDL, EURC, frxUSD, DAI, USDS classified as institutional-top (80); sanctioned custodians score 5
- Mature-alt-l1 tier (score 45) for Solana and BNB Chain; JupUSD, USX, hyUSD, lisUSD, CASH reclassified
- Resilience is now (collateral + custody) / 2; blacklist reported but no longer affects score
- 5-band chain penalty: ≥80→0, ≥60→-10, ≥40→-25, ≥20→-40, <20→-60; wrappers exempted
- Deployment multipliers: canonical-bridge 0.85→0.90, native-multichain 0.40→0.75
Four structural changes landed together in the safety methodology: a wider custody model, a new chain tier for Solana and BNB Chain, a simpler 2-factor Resilience score, and a steeper 5-band chain penalty.
- Custody model expanded from 3 to 6 tiers: onchain, institutional-top, institutional-regulated, institutional-unregulated, institutional-sanctioned, and cex.
- Added **mature-alt-l1** for Solana and BNB Chain with score 45.
- Resilience became `(collateral + custody) / 2`; blacklist capability is now descriptive only.
- Chain-risk penalty moved to 5 bands, and wrapper governance became exempt from that penalty.
Origin: Contemporaneous release record
Commits: Commit provenance not recorded