Safety Scores Changelog: v7 archive

Safety Score scoring is unchanged, but degraded report-card inputs no longer create durable grade-history transitions and the compact score cache now exposes input-staleness metadata to dependent consumers.

• Daily grade-history writes are suppressed when stale DEX liquidity or redemption-backstop inputs built the report-card snapshot.
• The history cron records degraded conditions in cron metadata instead of persisting stale-input transitions.
• The compact report-card cache now carries degraded-input metadata for Chain Health and other lightweight consumers.

Contemporaneous release record.

Commit provenance not recorded

fxSAVE redemption scoring now uses live ERC-4626 capacity instead of a heuristic strategy-buffer estimate.

• Fresh clean snapshots read idle fxSP capacity from the current on-chain reserve-sync output.
• Clean live capacity can reach medium confidence and feed Liquidity / Exit.
• Missing or degraded live telemetry leaves the route unrated rather than applying the old 20% heuristic.

Contemporaneous release record.

Commit provenance not recorded

FreezeWatch re-audits the active assets that still resolved as No after the Dilutable retirement.

• M by M0, ISC, and USG now resolve as direct Yes.
• DLLR, FXD, CJPY, USDQ, and USDK now resolve as Possible.
• JUSD, SILK, NXUSD, LUAUSD, KRWO, and BNUSD now resolve as Upstream.

Contemporaneous release record.

Commit provenance not recorded

FreezeWatch now uses a four-status freeze model and leaves supply-control risk to Mint Authority.

• The retired Dilutable cohort was re-reviewed under freeze-only semantics.
• Most former Dilutable assets now resolve as Upstream; USDN resolves as Possible.
• KRWO, LUAUSD, and vCRED resolve as No; admin mint authority remains descriptive and unscored.

Contemporaneous release record.

Commit provenance not recorded

NAV and savings wrappers with a configured peg reference now use the referenced base stablecoin's peg state for Safety Score peg scoring, instead of reading their own yield-accruing share price as a USD peg.

• Appreciating wrapper prices above $1 no longer trigger active-depeg D/F caps by themselves.
• Tracked wrappers such as fxSAVE inherit peg risk from the configured base asset.
• Wrapper, dependency, collateral, and liquidity risks remain scored through their own dimensions.

Contemporaneous release record.

Commit provenance not recorded

Wrapper Decentralization now follows the tracked wrapped asset when the parent relationship is known, instead of assigning every wrapper the same flat low score.

• Parent-linked wrappers such as yBOLD, sBOLD, and sfrxUSD inherit the wrapped asset's already chain-adjusted Decentralization score.
• The inherited score uses the same wrapper-kind haircut as Dependency Risk: savings minus 3, strategy-vault/risk-absorption minus 5, and bond-maturity minus 8.
• Wrappers without a resolvable single tracked parent keep the conservative fallback score of 10.

Contemporaneous release record.

Commit provenance not recorded

Liquidity / Exit now consumes Redemption Backstop v4 current-capacity semantics instead of treating every configured redemption route as full-strength liquidity.

• Eventual-only routes remain visible as redemption coverage but do not create redemption-only Safety liquidity uplift without modeled current executable capacity.
• Redemption contribution is scaled by current capacity and confidence before it can improve the effective-exit score.
• The diversification bonus is reserved for plausibly independent issuer rails rather than correlated wrappers, same-protocol routes, or unknown-correlation exits.

Contemporaneous release record.

Commit provenance not recorded

Reserve-sync refinements promote additional clean independent snapshots without widening score-grade evidence policy to static or weak-probe sources.

• sGHO now reads the legacy savings contract's previewRedeem(totalSupply) path directly.
• Reservoir srUSD/wsrUSD snapshots now map AUSD and Steakhouse Prime USDC strategy rows from the live balance-sheet API instead of treating them as unknown exposure.
• USD.AI now stamps the latest scoped proof-row timestamp while preserving oldest/latest spread metadata, and mRe7YIELD allows a weekly Chainlink NAV cadence.

Contemporaneous release record.

Commit provenance not recorded

More RWA NAV tokens and tracked savings wrappers now use direct independent reserve feeds instead of curated validation or weak liveness probes.

• WTGXX, VBILL, ACRED, USTBL, EUTBL, and JTRSY now use timestamped Chainlink NAV feeds for score-grade reserve freshness.
• USDCV now uses the SG Forge CoinVertible reserve parser, aligning it with EURCV's independent attestation path.
• sUSDD and sUSN now use ERC-4626 totalAssets()/asset() wrapper reads so their live reserve slices inherit tracked USDD and USN parent links.

Contemporaneous release record.

Commit provenance not recorded

crvUSD scoring now reads LLAMMA reserve balances directly from on-chain Curve ControllerFactory data instead of relying on a legacy market-state API.

• CrvUSD continues to use existing on-chain factory flows for Yield Basis while LLAMMA bands_y is consumed directly for collateral inventory checks.
• Soft-liquidity bands_x inventory remains in snapshot metadata rather than being reclassified as external collateral.
• Freshness output for this path is marked as "not-applicable", which allows clean crvUSD snapshots to stay eligible for score-grade live reserve inputs.

Contemporaneous release record.

Commit provenance not recorded

The follow-up admin-mint sweep expands the Dilutable tier and records source provenance for every Dilutable override.

• DAI, DOLA, FPI, PHT, USDD, USDe, USDN (SMARDEX), crvUSD, REUSD, USDU, and XAI now resolve as Dilutable.
• Each canBeBlacklisted: "dilutable" entry now carries a contract-source link via canBeBlacklistedSource.
• The homepage table and stablecoin detail hero link the Dilutable label directly to that source.

Contemporaneous release record.

Commit provenance not recorded

A re-audit of 22 stablecoins marked Freezable: No introduces a new Dilutable tier and reclassifies five coins to Yes after finding upgradeable proxies, admin freeze mixins, or chain-native seizure precedent.

• The new Dilutable tier sits between No and direct Yes: the token has no transfer freeze or blacklist, but the issuer can mint unbounded supply and effectively seize value through dilution.
• vCRED, LUAUSD, and srUSD now resolve as Dilutable because their token contracts expose Ownable mint or AccessControl minter-grant authority without supply caps.
• HBD, mRe7YIELD, FEUSD (Felix), USDQ (Quill), and USDK (Orki) move to direct Yes after confirming transparent upgradeable proxies, Midas Blacklistable/Pausable mixins, or Hive Hardfork 23 chain-level balance seizure precedent.
• BabelFish XUSD's explicit canBeBlacklisted: false override is removed so its bridged USDT/USDC reserve exposure now resolves to Upstream by default.

Contemporaneous release record.

Commit provenance not recorded

Liquidity / Exit now applies stricter live redemption telemetry gates before redemption capacity can improve Safety Scores.

• Unverified nested redemption freshness is excluded unless a route-specific lower-bound allowlist explicitly permits it.
• Daily redemption limits emitted by adapters cap usable scoring capacity while raw capacity stays visible.
• Proxy and queue capacity kinds cannot qualify as severe-depeg live-direct evidence.

Contemporaneous release record.

Commit provenance not recorded

USD3 / Web 3 Dollar is reclassified from DeFi to CeFi-dependent because its Reserve Protocol DTF basket is concentrated in centralized stablecoin-derived collateral.

• usd3-reserve-protocol now uses governance centralized-dependent.
• The correction reflects Savings USDS, Aave USDC, wrapped Compound USDCv3, and Steakhouse USDC strategy exposure in the curated and live reserve configuration.
• Scoring weights, thresholds, reserve risks, and live reserve adapter behavior are unchanged.

Contemporaneous release record.

Commit provenance not recorded

Six disputed Freezable: No classifications were rechecked against native protocol controls and verified contract surfaces.

• HomeCoin now resolves as Possible because the holder-facing HOME token is a transparent upgradeable proxy with an active proxy-admin upgrade surface.
• HBD, vCRED, Freedom Dollar, LUAUSD, and NXUSD remain No after review found no freeze, blacklist, pause, denylist, arbitrary burn, or upgrade control on the holder-facing asset surface.
• Owner mint authority and user or allowance burn functions stay classified as supply controls, not freeze controls, unless paired with transfer gates, arbitrary burns, blacklist controls, or mutable holder-control surfaces.

Contemporaneous release record.

Commit provenance not recorded

The resolved Freezable: No cohort was reviewed against token-level freeze, denylist, blacklist, pause, and arbitrary role-burn controls.

• JupUSD, eSui Dollar, MAI, JUSD, Alpha Partner USDA, Ring USDR, DOC, USDRIF, and Nest inALPHA now resolve as direct Freezable: Yes where audited token or vault contracts expose holder-facing controls.
• sBOLD and Enosys CDP now resolve as Possible because their audited contracts expose pause or mutable branch-control surfaces rather than a confirmed current address-level blacklist.
• The remaining resolved No cohort stays unchanged where no direct holder-facing freeze, blacklist, pause, denylist, or arbitrary burn surface was confirmed.

Contemporaneous release record.

Commit provenance not recorded

Score-grade live reserve slices with tracked coinId links now drive Dependency Risk, raw dependency inputs, topological ordering, and the public dependency graph together.

• Report-card Dependency Risk now uses the same fresh independent live reserve slices already eligible for collateral-quality scoring when those slices carry tracked stablecoin links.
• Unmapped live reserve share remains implicit self-backed or non-stablecoin exposure, so live snapshots no longer fall back to stale curated dependency percentages for that remainder.
• The public dependency graph now publishes the effective dependency edges used by the snapshot, while tracked variant parent wrapper edges remain synthetic and de-duplicated.

Contemporaneous release record.

Commit provenance not recorded

Blacklist labeling now reserves possible for curated direct token or vault controls.

• Reserve-side stablecoins, wrapped or custodied collateral, custody/CEX rails, and tracked parent-asset exposures now resolve to inherited / Upstream instead of sharing the possible bucket.
• Explicit canBeBlacklisted: "possible" overrides remain only on assets whose holder-facing token or vault still exposes a pause, freeze, or blacklist surface.
• The change is descriptive only for Resilience and does not alter tracked-variant dependency ceilings or the parent-overall cap framework added in recent v7.x releases.

Contemporaneous release record.

Commit provenance not recorded

K3 sBOLD now joins the tracked parent-linked variant framework as a risk-absorption child of BOLD.

• sbold-k3-capital now declares canonical variantOf / variantKind metadata as a risk-absorption child of bold-liquity.
• The classification is based on Liquity Stability Pool loss-absorption dominating the wrapper's extra risk surface, rather than a generic strategy-vault interpretation.
• sBOLD now joins the tracked risk-absorption cohort beside stUSDS and stkGHO.v1, using the existing parent minus 5 dependency ceiling and parent-overall cap.

Contemporaneous release record.

Commit provenance not recorded

The tracked parent-linked wrapper framework now covers the four highest-confidence strategy-vault children.

• sUSDai, msY, sAID, and stcUSD now declare canonical variantOf / variantKind metadata as tracked strategy-vault children.
• Dependency Risk now applies a tracked strategy-vault wrapper ceiling of parent minus 5 points, while the existing parent-overall cap still prevents the child from outscoring the parent card.
• The homepage variant owner on / now includes aStrategy filter state alongside the existing Savings, Risk-Abs, and Bond families.
• This phase keeps the current parent-linked pegReferenceId path for these four products, so severe parent depegs still constrain the child until independent NAV/peg handling ships later.

Contemporaneous release record.

Commit provenance not recorded

The parent-linked wrapper framework now covers bond-maturity variants, starting with bUSD0 as a bond leg over USD0.

• bUSD0 now declares canonical variantOf / variantKind metadata as a bond-maturity child of USD0.
• Dependency Risk now applies a stricter bond wrapper ceiling of parent minus 8 points while the existing parent-overall cap still prevents the child from outscoring the parent card.
• The homepage variant owner on / now includes aBond filter state, and detail-page variant cards link back into that owner instead of introducing a dedicated variant route family.

Contemporaneous release record.

Commit provenance not recorded

Tracked savings and staked wrappers now carry an explicit parent relationship in Safety Scores instead of relying on reserve-shape quirks to infer the upstream stablecoin.

• Nine tracked wrapped or staked stablecoins now declare canonical variantOf / variantKind metadata and contribute a synthetic wrapper edge from parent to child in dependency scoring, topological ordering, and the dependency graph.
• Dependency Risk now caps tracked savings wrappers at parent minus 3 points and tracked risk-absorption wrappers at parent minus 5 points, while legacy non-variant wrapper dependencies keep the original parent-minus-3 behavior.
• Tracked variants cannot outscore their parent overall card; live cards and stressed recomputation now expose overallCapped, uncappedOverallScore, rawInputs.variantParentId, and rawInputs.variantKind so parent-cap drag is distinct from peg drag in the UI and stress tooling.

Contemporaneous release record.

Commit provenance not recorded

Reserve-risk tiering now distinguishes transparent spot or wrapped market exposure from actively managed strategy books.

• Delta-neutral wording no longer implies a medium reserve-risk tier by itself.
• Transparent spot or wrapped market exposure can remain medium when custody and counterparty risk are already captured by the custody model.
• Externally managed market-neutral, basis, perp, LP, private-deal, or custody-dependent strategy reserves are high unless stronger granular evidence shows the slice is only an idle stablecoin or cash-equivalent buffer.
• avUSD's 0xPartners-managed strategy and loss-absorption reserve slices move from medium to high.

Contemporaneous release record.

Commit provenance not recorded

Liquidity / Exit and the redemption-backstop snapshot now reuse the last-known DEX liquidity score when its freshness runway has elapsed, instead of suppressing it and cascading documented offchain-issuer routes (USDC, USDP, USDT, GUSD, …) to NR on routine sync-dex-liquidity cron lag.

• Reverses v6.1's rule that stripped stale DEX liquidity out of effectiveExitScore; staleness is surfaced via liquidityStale and inputFreshness.dexLiquidity.stale so consumers can warn on age without losing the dimension.
• /api/redemption-backstops.effectiveExitScore stays aligned with the stale-DEX freshness policy during stale windows instead of diverging to null, but it remains the raw best-path exit blend and can still differ numerically from report-card liquidity after Safety Score eligibility gates apply. The redemption-backstop cron still marks its run degraded and sets metadata.liquidityStale = true for operational visibility.
• Absent DEX snapshots (loader rejects or empty table) still produce liquidityScore = null and trigger the documented offchain-issuer primary-market-floor exclusion; the rule now distinguishes "present but old" from "truly missing."

Contemporaneous release record.

Commit provenance not recorded

The GHO reserve adapter now decomposes residual issuance across active facilitators and routes unmapped labels through the standard material-unknown-exposure validator instead of a GHO-specific warning.

• Aave V3 direct-minter facilitators contribute medium-risk residual slices; FlashMinter and unmapped facilitators contribute high-risk slices.
• Unmapped residual share accumulates into unknown-exposure telemetry so material unknown exposure can degrade the GHO sync consistently with other reserve adapters.
• Direct GhoReserve / GhoDirectFacilitator / RemoteGSM reads remain a follow-up pending verified Aave deployment addresses.

Contemporaneous release record.

Commit provenance not recorded

Documented issuer redemption now earns a small primary-market exit bonus only when DEX liquidity is already present.

• Offchain issuer routes with documented-bound eventual redeemability can contribute the diversification bonus.
• The route cannot replace missing DEX liquidity; no-DEX assets still need immediate-bounded redemption evidence to score.
• Low-confidence, stale, impaired, route-limited, and severe-depeg-ineligible routes still fail closed.

Contemporaneous release record.

Commit provenance not recorded

Redemption backstops now stay eligible through normal 4-hourly sync lag instead of dropping out of Liquidity / Exit as soon as the previous snapshot crosses one sync interval old.

• Report-card redemption freshness now uses a two-run runway for the 4-hourly redemption sync.
• Medium- and high-confidence immediate-bounded redemption routes continue to improve Liquidity / Exit between normal syncs.
• Missing, materially stale, low-confidence, impaired, eventual-only, and severe-depeg-ineligible routes still fail closed.

Contemporaneous release record.

Commit provenance not recorded

USTB can now use Superstate's current liquidity telemetry while keeping NAV/AUM separate from immediate exit capacity.

• Current Circle USD and USDC RedemptionIdle balances bound USTB redemption capacity.
• The on-chain NAV oracle remains reserve evidence, not immediate liquidity.
• Malformed or unavailable liquidity telemetry fails closed instead of falling back to NAV/AUM.

Contemporaneous release record.

Commit provenance not recorded

frxUSD now uses fresh Frax balance-sheet redemption capacity with route-status and capacity-ratio fail-closed guards.

• frxUSD no longer relies on a static full-supply eventual redemption model.
• Live route-status telemetry can suppress redemption uplift when a route is paused, degraded, or cohort-limited.
• Nested capacity amounts no longer reuse flat reserve-composition ratios as supply-relative capacity ratios.

Contemporaneous release record.

Commit provenance not recorded

Liquidity / Exit now distinguishes standalone redemption-route quality from Safety Score-eligible exit capacity.

• Eventual-only redemption routes remain visible but no longer uplift Liquidity / Exit by themselves.
• Queue-like routes can contribute when resolved and current, with their contribution capped before blending.
• Immediate-bounded, live-direct, and validated-live routes continue to improve the dimension when fresh and unimpaired.

Contemporaneous release record.

Commit provenance not recorded

More proof-style reserve feeds now use timestamped independent evidence instead of weak liveness checks.

• USYC and TBILL now use Chainlink-style NAV oracle reads with verified source timestamps.
• FRAX now reads Frax's v2 balance-sheet API and maps known balance-sheet assets explicitly.
• USD1 now reads its Chainlink bundle oracle for live reserve size, timestamp, and supply comparison.
• The global gate remains strict: proof sources without payload-native freshness stay detail-visible only.

Contemporaneous release record.

Commit provenance not recorded