DeFi operational security: the risk dimension that ratings haven’t measured
Standard DeFi risk ratings leave one category unmeasured: DeFi operational security.
Market and smart contract risk both draw from established inputs: price feeds, audit reports, deployment records. A third dimension remains consistently underweighted. It covers who holds the admin keys, what they’re authorized to do, how fast the protocol can halt, and whether a backstop exists that doesn’t need a governance vote to activate. Some of these inputs are visible on-chain, others sit off-chain, which complicates systematic assessment.
Credora has published eight metrics to measure it.
Why audits don’t cover DeFi operational security
A smart contract audit reviews the protocol’s source code against known vulnerability classes and its intended logic.. It assesses the code. Whether those operating the protocol are equipped to respond when conditions turn adversarial is outside the audit’s scope.
The H1 2026 incident record is specific. Most funds lost were lost to operational failure: software-resident keys, circuit breakers that couldn’t reach the exploited surface, privilege scope that gave a single compromised role full protocol coverage, and recovery mechanisms that stalled on governance coordination. Immunefi’s 2025 Crypto Losses Report documented that access control failures account for the largest share of DeFi losses by value, consistently outpacing novel smart contract exploits as a category.
Eleven documented key custody failures account for approximately $1.44B in losses. Twenty-six circuit breaker failures account for approximately $3.5B.
Operational data does not exist in the standardized form that price feeds or audit reports do. Circuit breakers and mint authority permissions require protocol-specific analysis on-chain. Key custody architecture and incident playbooks require direct disclosure from protocols. Neither has been systematized across rated assets.
Eight metrics in the Asset Rating Framework
Credora has added eight Operational Security metrics to the Asset Rating Framework. Each covers a distinct failure mode, with a three-tier rubric derived from the documented incident record.
Mint Authority Permissions. Who or what is authorized to issue new tokens. The tier runs from single-signer unconstrained authority through bounded multisig to algorithmic logic gated by on-chain collateral. Nine documented compromised-key minting incidents account for approximately $1.43B in realized losses.
Key Custody Environment. Where the private keys controlling privileged roles are stored. Software-resident keys are extractable by malware. Hardware-protected keys eliminate software extraction but retain a single point of failure. MPC with verified operator diversity removes it by distributing encrypted key shares across independent operators and jurisdictions.
Circuit Breaker Sophistication. How quickly the protocol can halt fund flows during an attack. A fully automated, on-chain invariant-triggered pause fires within a block. A manual pause with poorly-scoped coverage can take minutes to hours.
Incident Playbook. Whether a defined, rehearsed process exists for detecting and responding to a compromise. Protocols that encounter their incident response process for the first time during an active exploit consistently produce worse outcomes.
Privilege Scope. The blast radius of a single compromised key. Whether operational and custodial powers are structurally separated determines how much damage one compromised key can produce.
Privilege Constraints. How easily privileged actions can execute and how much time exists to detect and respond. The primary inputs are quorum thresholds, timelock durations, and whether anyone actively monitors the proposal queue.
Redemption Risk. The reliability of user exits under stress. Whether any privileged actor can unilaterally pause withdrawals caps the top tier.
Loss Absorption Capacity. Whether an explicit, liquid backstop exists and how it activates. A backstop requiring a governance vote introduces exactly the coordination delay that stress events eliminate.
How DeFi operational security metrics adjust the rating
The eight metrics are modifiers in the existing Asset Rating Framework, not a parallel scoring system. The framework covers asset quality, custody risk, audit quality, and contract maturity through the Anchor Probability of Default (PD) methodology. The operational security cluster adjusts the final Probability of Significant Loss (PSL) based on each protocol’s operational profile.
Two protocols with identical on-chain architecture, audit coverage, and contract maturity can carry different PSL values when their operational security profiles differ. A protocol with MPC key custody, an autonomous circuit breaker, a documented incident runbook, and a governance-independent backstop will carry a lower PSL than one with software-resident keys, a manual pause, no documented runbook, and governance-vote-dependent loss absorption. That difference now sits in the same A+ to D rating scale applied across all rated assets.
Historical incident data per tier backs every adjustment. Tier definitions and reasoning are published in full.
What this means for allocators
Allocators working from on-chain risk scores alone are missing a layer. The operational infrastructure determines outcomes when primary risk models hit conditions they weren’t built for.
A rating covering market risk, smart contract risk, and DeFi operational security is more complete than one covering two of the three. An allocator whose due diligence includes audited code, market-stress-tested collateral, and a verified operational security profile has a stronger compliance record than one working from yield data and TVL alone.
Key Takeaway
DeFi operational security is the failure category that smart contract audits don’t reach: who controls privileged keys, how circuit breakers are scoped and whether they cover the right surface, and whether loss absorption can activate without a governance vote. The H1 2026 incident record confirms this is the primary failure mode in DeFi by value lost, not a peripheral one. Credora’s eight new Operational Security metrics integrate this dimension into the existing A+ to D rating scale by adjusting the PSL based on each protocol’s documented operational profile. Two protocols with identical on-chain architecture will carry different ratings when their operational security profiles differ. That difference is quantified per metric, backed by historical incident data, and reflected in the same scale applied across all rated assets.
Frequently Asked Questions
What is DeFi operational security and why does it matter for risk ratings? DeFi operational security covers the logic and infrastructure around smart contract code: who controls admin keys, what those keys are authorized to do, how the protocol halts anomalous activity, and whether a loss absorption mechanism can activate without a governance vote. It matters for risk ratings because the majority of major DeFi losses by value trace to operational failure, not to undiscovered vulnerabilities in audited code.
How do Credora’s operational security metrics affect a protocol’s PSL? The eight Operational Security metrics function as modifiers within Credora’s Asset Rating Framework. They adjust the Probability of Significant Loss (PSL) alongside the existing quantitative methodology. Two protocols with identical smart contract architecture will carry different PSL values when their operational security profiles differ. A protocol with hardware-protected keys and an automated circuit breaker will carry a lower PSL than one with software-resident keys and a manually-activated pause.
Where can I read the full Operational Security methodology? The full Asset Rating Framework, including all eight Operational Security metrics with tier definitions, tier reasoning, and historical evidence per tier, is published at: https://docs.redstone.finance/docs/redstone-credora/methodologies/assets/