Safety Scores Changelog: v8 archive

Balance-measured aggregate pool TVL is no longer treated as a reserve-based AMM simulation unless the retained evidence includes the exact mechanics needed to model executable capacity.

• Aggregate balance measurements remain useful DEX coverage and pool-quality evidence.
• Without an exact invariant, fee, output identity, and capacity curve, the Safety Score applies the existing generic-TVL-proxy ceiling of 60 rather than the AMM-simulation ceiling of 85.
• The standalone Liquidity Score is unchanged.
• Same-notional route scoring remains inactive until the P4b rollout gate passes.

Contemporaneous release record.

Commit provenance not recorded

Liquidity / Exit now carries the evidence quality behind each published DEX score instead of treating TVL proxies, fallback rows, and retained AMM reserves as measured executable depth.

• Reserve-based AMM simulation caps at 85, generic TVL proxies at 60, and synthetic/fallback evidence at 55.
• A row with provider-inaccessible deployments and no observed deployment caps at 45.
• Inputs without republished evidence fields and rows explicitly marked legacy remain neutral and wire-compatible.
• The fixed-input replay changed 18 scores and 9 grades with no NR transitions; the standalone public Liquidity Score is unchanged.

Contemporaneous release record.

Commit provenance not recorded

Dependency Risk now uses one scoring path for available and unavailable upstreams, and report-card publication no longer permits a dependency cycle to make results depend on traversal order.

• Fully unavailable weights use the same explicit blend, 70-point fallback, weak-upstream penalty, and wrapper/mechanism ceilings as partially unavailable weights.
• Live-created cycle members fall back to curated dependency sets; an invalid fallback graph rejects the snapshot before cache or grade-history publication.
• Dependency dimensions now include structured contribution, availability, normalization, penalty, and ceiling diagnostics, including after contagion stress recomputation.
• The fixed-input all-card replay found two score changes, one expected grade crossing, 38 corrected nonbinding ceiling labels with no score effect, and no NR changes.

Contemporaneous release record.

Commit provenance not recorded

Dependency derivation now rejects self-links and represents each tracked variant as one serial wrapper claim on its parent, so displaying a parent's reserve book does not count that backing a second time.

• Frax self-holdings remain visible in reserve composition but no longer create a FRAX-to-FRAX graph edge.
• Static metadata, adapter output, stored live snapshots, the canonical resolver, and graph emission all enforce the same self-link and target-validity invariants.
• Raw inputs now include dependency source, fallback reason, mapped live weight, and live snapshot provenance.
• The fixed-input all-card replay found two score changes and no grade or NR transitions.

Contemporaneous release record.

Commit provenance not recorded

Dependency Risk now falls back to curated reserve links or manual dependencies when a score-grade live reserve snapshot contains no mapped tracked-asset links at all.

• Partial live mappings stay authoritative: unmapped live reserve remainder still counts as self-backed or non-stablecoin exposure instead of reviving older curated percentages.
• The fallback applies only to the all-unmapped live case, where treating the whole snapshot as self-backed can erase known upstream stablecoin dependencies.
• Raw inputs keep dependencyFromLive true only for live-derived or explicitly live-unmapped dependency sets; curated/manual fallback dependencies report false.

Contemporaneous release record.

Commit provenance not recorded

Reviewed bridge-route profiles now feed Decentralization through a penalty-only blend after CDP oracle scoring and before Mint Authority: min(current, 0.80 x current + 0.20 x bridge route score).

• bridgeRouteRisk profiles record route tier, summary, provenance, confidence, protocol evidence, and sources.
• Missing bridge-route reviews remain neutral, and strong issuer-native or canonical routes never lift a score.
• L2BEAT Interop data powers an advisory review queue, but live report-card scoring consumes only curated Pharos metadata.

Contemporaneous release record.

Commit provenance not recorded

Oracle-risk reviews now carry provenance and optional branch rows. When a CDP profile has branch-level oracle tiers, the Decentralization blend uses the weakest branch/profile score so multi-collateral systems are scored against their weakest verified price-feed path.

• oracleRisk profiles can include reviewed date, reviewer, confidence, source links, and per-branch collateral/chains context.
• Report-card payloads now expose an oracle setup presentation object, including inherited parent exposure for wrappers and savings variants.
• A warning-only coverage check and calibration report support the full CDP oracle-profile backfill and later review of the 25% blend weight.

Contemporaneous release record.

Commit provenance not recorded

Crypto-backed CDP stablecoins can now carry a reviewed oracle-risk profile. When one is present, Decentralization applies a penalty-only oracle setup blend — min(current, 0.75 × current + 0.25 × oracle score) — because liquidations and redemptions depend on the collateral price-feed path.

• The blend applies only to explicit oracleRisk profiles on crypto-backed CDP assets; missing reviews and non-CDP assets are unchanged.
• The oracle step runs after governance and chain infrastructure, before the existing Mint Authority blend. Immutable-code CDPs are not exempt because oracle feeds remain an external dependency.
• Initial reviewed profiles cover USDS as a medianized delayed oracle system and BOLD as redundant feeds with failover. Other CDPs stay unchanged until reviewed oracle metadata is curated.

Contemporaneous release record.

Commit provenance not recorded

The Mint Authority Score becomes a Safety Score input: the Decentralization dimension now applies a penalty-only blend — min(current, 0.65 × current + 0.35 × MAS) — so a weak privileged-mint path can drag the dimension down, while a strong one never lifts it.

• The blend runs after the governance baseline, wrapper inheritance, and the chain-infrastructure penalty; a "Mint authority" detail row appears on the report card when the drag binds.
• Coins without a rated Mint Authority Score are unchanged — a missing or unresolved review never penalizes.
• No separate confidence gate: the Mint Authority confidence caps (verified 100 / probable 90 / manual-review 85) already encode evidence quality inside the score.
• 111 of 368 scoreable active coins move down, none up; the biggest drops are mint-incident and unbounded-mint protocols, while issuers whose governance scores already reflect their mint topology are unchanged.

Contemporaneous release record.

Commit provenance not recorded