stETH risk assessment — how Credora built the first asset-level risk assessment at scale in DeFi
Summary
Credora has published an independent risk rating for Lido’s stETH: A+ with a Probability of Default (PD) of 0.10%. This is the first asset-level rating issued on a liquid staking token at this scale in DeFi. The assessment covers smart contract security, on-chain reserve transparency, price stability, market position, and governance architecture. Every input is public. This article walks through the methodology, the data, and the result.
The structural gap
DeFi has operated without standardized, asset-level risk ratings. Protocols display APY, TVL, and audit history. These are useful inputs. They are not risk assessments.
A risk assessment converts raw data into a single, comparable metric: the probability that a holder will experience a loss event. In traditional credit markets, that metric is the probability of default. It is the number a risk committee evaluates before approving an allocation. It is the number that allows comparison across issuers and asset classes on a common scale.
For DeFi assets, that number has not existed at institutional standard. Institutional allocators have used APY as a proxy for risk because there was no independent, standardized alternative. The stETH rating is designed to close a specific part of that gap.
Why stETH
stETH is a liquid staking token issued through the Lido protocol. Each stETH token represents a pro-rata share of ETH staked through Lido’s protocol, where it is staked via a mix of permissioned and permissionless third-party node operators participating in Ethereum’s Proof-of-Stake consensus. As a rebasing token, the stETH balance adjusts automatically to reflect accrued staking rewards and any slashing events.
For readers familiar with traditional fixed-income instruments: stETH is analogous to a claim on a pooled asset (staked ETH), managed by an intermediary (Lido’s smart contracts and governance), with yield derived from network validation rewards. The “credit risk” equivalent is the probability that a holder cannot redeem stETH for the underlying ETH at or near par value.
The scale is significant:
- $19.4 billion in TVL
- 62% of the Ethereum liquid staking market ($34.3B total)
- 48% of the global liquid staking category ($44.8B across all chains)
- Deeply integrated across major DeFi lending protocols
stETH is the largest liquid staking asset in crypto. If an independent risk rating framework is going to exist for DeFi assets, this is where it starts.
The Credora Asset Rating Framework
Credora’s asset rating framework assigns a Probability of Default (PD) and an implied credit rating (A+ to D) to digital assets. In Credora’s framework, a default is defined as either:
- Eligible holders cannot redeem for two consecutive weeks, or
- The fair value of reserves falls 1% or more below outstanding issuance for seven consecutive days
This definition is deliberately precise. It provides a binary, verifiable trigger that removes ambiguity from the assessment.
The rating process has two stages: an Anchor PD (the baseline) and risk modifiers (adjustments that refine the baseline into a Final PD).
Stage 1: Anchor PD
The Anchor PD captures the core risk associated with a token’s reserve assets, custody structure, and smart contract architecture. For stETH, two components produce the Anchor PD:
Smart contract risk PD: 0.15%
This component evaluates the likelihood and severity of a smart contract exploit based on:
Audit quality. Lido has undergone 90+ independent security reviews and audits, including formal verification of critical modules. The February 2025 Certora formal verification of the Dual Governance module moved this metric to the maximum tier. All identified critical and high-severity issues were fixed prior to deployment.
Audit quantity and coverage. The number of independent audits, combined with a $2M Immunefi bug bounty, scores at the maximum tier.
Contract maturity. Lido launched in December 2020. Over 60 months of uninterrupted operation without a material exploit places contract maturity at its maximum tier.
These inputs, combined with historical DeFi exploit data, produce a smart contract risk PD of 0.15%.
Reserve asset quality: 0.01%
ETH is the sole reserve asset. As a native blockchain token, ETH carries a symbolic PD of 0.01%, reflecting structurally negligible default risk. The reserve is not a wrapped derivative or a synthetic. It is ETH deposited directly in the Ethereum Beacon Chain.
Anchor PD: 0.16%
The sum of the two components: 0.15% + 0.01% = 0.16%.
Stage 2: Risk modifiers
The Anchor PD is refined using notch-based adjustments. These modifiers capture risks not reflected in the base assessment. Each modifier has a defined range, and the adjustment direction (positive, neutral, or negative) depends on the assessment of that specific dimension.
A key design principle: positive adjustments are smaller than negative ones. Risk improvements materialize gradually. Adverse conditions exert stronger influence on default outcomes. The framework is conservative by construction.
The Anchor PD is converted into a logarithmic rating-notch curve, adjusted by the combined modifiers, and converted back into a PD. This ensures that adjustments reflect relative changes in risk rather than absolute PD shifts.
Modifier 1: Recent incident history
Adjustment: 0.00 (neutral)
No related incidents in the past six months. A minor slashing event on 13-03-2026 was promptly resolved with no downside to protocols or users. No notch adjustment applied.
Modifier 2: Reserve transparency
Adjustment: +0.25 (positive, maximum)
Lido publishes on-chain data for total ETH deposited in the Beacon Chain, directly verifiable against the circulating stETH supply in real time. Any independent party can audit collateral without reliance on off-chain reporting.
For institutional readers: this is the equivalent of a fund with fully transparent, real-time, independently auditable custody. The reserve verification does not depend on quarterly statements or third-party attestations. It is continuous and on-chain.
Modifier 3: stETH-ETH price relationship
Adjustment: +0.25 (positive, maximum)
stETH is designed to track ETH on a 1:1 basis through a market-driven mechanism. Over the trailing 365 days:
- Annualized volatility vs. ETH: 1.98%
- Price deviations exceeding 1%: zero
- Most recent significant deviation: approximately 0.3% in July 2025, driven by a surge in the validator withdrawal queue
- Price history depth: exceeds 365 days
The ETH relationship stability is strong. The deviation threshold (1%) has not been breached in the assessment period.
Modifier 4: Market capitalization
Adjustment: +0.25 (positive, maximum)
$21.3 billion in market capitalization. 62% of the liquid staking category’s total TVL of $34.3 billion. This indicates dominant relative positioning, strong market trust, and broad protocol adoption.
Scale matters for risk assessment because it reflects demonstrated operational resilience under real market conditions, not theoretical stress tests.
Modifier 5: Governance
Adjustment: 0.00 (neutral)
Lido DAO governs via Aragon with a 72-hour voting process, 5% quorum, and over 50% approval threshold. Multi-sig roles, contract addresses, and emergency procedures are clearly defined.
The June 2025 launch of Dual Governance grants stETH holders veto power over DAO decisions, materially improving governance accountability. Across five emergency-response metrics (documented incident playbook, narrow privilege scope, governance constraints, exit liquidity under stress, loss absorption capacity), stETH scores positively on all.
The neutral adjustment reflects a balance: governance infrastructure is well-designed, but on-chain participation remains low. Votes often clear the 5% quorum by a narrow margin, and decision-making is concentrated among large LDO holders. The Curated Module accounts for approximately 90% of staked ETH, while the Community Staking Module is capped at 6% pending expansion.
The result
The Final PD of 0.10% places stETH among the higher-quality derivative assets rated by Credora within DeFi. On the Credora rating scale (A+ to D), this corresponds to A+, which is consistent with the framework’s intent to unify risk assessment across tokens and traditional credit scales.
Considerations
The rating reflects the assessment as of 13-03-2026. Two factors flagged as considerations:
Governance concentration. Despite the Dual Governance improvement, validator operations remain concentrated. The Curated Module handles approximately 92% of staked ETH. On-chain governance participation is low. These are structural features of the current protocol design, and they constrain the governance modifier from scoring a positive adjustment.
Legal and regulatory uncertainty. Lido faces legal proceedings related to the regulatory treatment of its LDO governance token. In Samuels v. Lido DAO, a California lawsuit alleges that LDO was sold as an unregistered security. Lido was also referenced in a 2024 SEC complaint against Consensys concerning MetaMask staking services, though Lido was not named as a defendant and Consensys later announced an agreement in principle to dismiss the case. These proceedings do not directly affect stETH redemption mechanics but represent an ongoing risk factor.
What this rating enables
A standardized PD on an asset at this scale enables three things that were previously not possible in DeFi:
Cross-asset comparison. stETH risk can now be compared against other rated assets on the same scale, using the same methodology. The comparison is apples-to-apples, not APY-to-APY.
Portfolio-level risk management. A PD can be integrated into portfolio models, used to set position limits, and included in risk reporting. This is the operational requirement that institutional allocators need before deploying capital.
Independent verification. Every input to this rating is public. The methodology is documented. Any reader can trace the path from raw data to final PD. That transparency is itself a risk signal: assets that seek independent assessment are making a different statement than assets that avoid it.
What comes next
This is Credora’s first public asset-level rating. Vault and market ratings are already live on Morpho and Spark. Asset ratings are the next layer of DeFi risk infrastructure.
The stETH A+ is a single data point. The value of a rating system is not one number. It is the comparability that emerges when the framework covers enough assets to make absence visible.
The full rating methodology is documented at [credora.network/docs]. The complete stETH Risk Assessment Report is available here.
About Credora: Credora provides independent, data-driven risk ratings for on-chain finance. By standardizing risk measurement across assets, lending markets, and vault strategies, Credora enables transparent, resilient capital allocation. Through quantitative modeling, stress testing, liquidity analysis, and governance assessment, Credora converts complex protocol mechanics into comparable risk signals, supporting the sustainable growth and institutional adoption of on-chain markets.
Follow Credora on X: https://x.com/credoranetwork
Follow Credora on LinkedIn: https://www.linkedin.com/company/credoranetwork
About Lido
Lido is an open-source, liquid-staking middleware that provides a way to participate in the blockchain network validation process and reap rewards for this activity. With a mission to democratize staking, Lido middleware lets users connect with node operators and stake their digital assets without the need to individually maintain hardware. Lido users can interact with various third-party DeFi applications that have independently integrated and support the liquid staking tokens. For further information, please visit https://lido.fi
Follow Lido on X: https://x.com/LidoFinance
Follow Lido on LinkedIn: https://www.linkedin.com/company/lidofi/
Ratings and data provided are for informational purposes only. They do not constitute investment advice or a solicitation to buy/sell assets. Always conduct your own due diligence. Full disclaimer: credora.network/terms-of-service