What is a DeFi risk rating?
A DeFi risk rating is a standardized measure of the probability that a lending market or vault will result in significant capital loss. It translates five distinct risk factors (collateral quality, smart contract exposure, oracle design, liquidity, and counterparty risk) into a single comparable score on a defined scale. The rating exists to answer a question that APY cannot: not how much you can earn, but how likely you are to lose principal.
The data DeFi shows and the data it doesn’t
When a depositor evaluates a DeFi lending vault, the first number they see is yield. APY is visible, real-time, and easy to compare. It is also the least informative number available for assessing capital safety.
APY measures what a vault pays when conditions are stable. It says nothing about what happens when collateral devalues faster than liquidations can clear, when an oracle reports stale prices during a volatile period, or when a smart contract upgrade introduces an undiscovered vulnerability.
These are the failure modes behind the largest capital losses in DeFi history. The Kelp DAO exploit in April 2025 drained $292 million from a protocol with a mature codebase and completed audits. The Terra collapse in May 2022 wiped billions from depositors who had no model for evaluating algorithmic collateral risk. In both cases, yield was visible. Risk was not.
A DeFi risk rating makes risk visible on the same terms as yield: one number, updated regularly, comparable across protocols.
What a DeFi risk rating measures
A rigorous DeFi risk assessment covers five factors. Each operates independently. A vault can score well on smart contract risk and poorly on liquidity.
Collateral quality captures the nature of the assets backing a lending market. DeFi vaults today hold tokenized T-bills, private credit, gold, stablecoins, and equity-linked products. Each has different liquidity profiles, valuation methods, and redemption mechanics. T-bills settle in one day. Private credit may lock for months. The rating reflects these differences.
Smart contract risk is the probability that the code governing a vault introduces losses through a bug, an exploit, or an upgrade. It is a probability distribution shaped by code complexity, audit coverage, upgrade mechanisms, and time in production. Not a binary pass or fail based on whether an audit was completed.
Oracle risk reflects how a vault prices its collateral. Fixed-price oracles maintain a constant valuation regardless of market conditions. Market-based oracles aggregate prices in real time across multiple sources. The choice of oracle design determines whether a vault’s collateral appears correctly valued during stress events.
Liquidity risk captures how much collateral can be sold, at what price, if a vault needs to liquidate positions quickly. An asset may appear liquid in calm conditions and become effectively illiquid during market stress when multiple vaults attempt to liquidate simultaneously.
Counterparty risk accounts for exposure to third-party entities (issuers, custodians, protocol teams) whose failure can cause losses regardless of the vault’s onchain parameters.
Why DeFi risk assessment requires its own methodology
Traditional credit rating methodology assumes issuers have audited financial statements, legal contracts are enforceable, and analysts can interview management teams. DeFi lending markets have none of these.
What DeFi does have is onchain data. Every transaction, every liquidation, every oracle update is recorded publicly and permanently. A DeFi risk assessment methodology uses this data as its primary input, building models from protocol behavior, collateral price history, and liquidation dynamics rather than from disclosed financials.
The computational approach is Monte Carlo simulation. Rather than assigning a single estimated outcome, the model runs thousands of scenarios across the historical distribution of collateral price movements, liquidity conditions, and correlated market shocks. The result is a probability distribution of outcomes.
This is how Credora rates DeFi lending markets. Each market runs through 100,000 simulations. The output is Probability of Significant Loss (PSL): the probability that a depositor loses more than 1% of principal over a one-year horizon. PSL is the number that drives the letter grade on the A+ to D scale. A full explanation of the methodology is available in How Credora rates a DeFi vault.
What the output looks like
A DeFi risk rating produces a letter grade on a defined scale: A+ through D. Each grade corresponds to a PSL range.
An A-rated vault has a low probability of significant loss. The collateral is liquid and marks to market accurately. The smart contract has been in production without incident. Oracle design matches the nature of the collateral.
A D-rated vault carries materially higher loss probability. This might reflect illiquid private credit collateral with model-based valuation, a fixed-price oracle that will not adjust in a stress event, or a smart contract with recent upgrades and limited audit history.
The letter grade makes comparison possible across protocols that would otherwise be incommensurable. A depositor comparing two Morpho vaults (one holding T-bills, one holding private credit) cannot compare them meaningfully using TVL or APY alone. The rating provides a common unit. A deeper look at what PSL ranges mean in practice is in What is PSL? How Credora measures DeFi risk.
Key takeaway
A DeFi risk rating translates collateral quality, smart contract exposure, oracle design, liquidity, and counterparty risk into a single, comparable score. It fills the gap between the data DeFi displays (yield) and the data allocators need (default probability). For institutional allocators managing DeFi portfolio risk across multiple protocols, the rating provides the common unit that TVL and APY cannot. Credora publishes independent ratings for DeFi lending markets, live on Morpho and Spark, updated daily.
Frequently asked questions
What factors does a DeFi risk rating cover?
A DeFi risk rating covers five factors: collateral quality, smart contract risk, oracle design, liquidity risk, and counterparty exposure. Each factor is modeled independently. The overall rating reflects their combined effect on the probability of significant capital loss.
How is DeFi risk assessment different from traditional credit rating methodology?
Traditional credit ratings rely on audited financials, legal enforceability, and issuer disclosure. DeFi risk assessment replaces these inputs with onchain data: transaction history, liquidation dynamics, oracle behavior, and collateral price distributions. The computational method (Monte Carlo simulation across thousands of scenarios) is also distinct from the scorecard-based approaches used in traditional credit analysis.
What does a Probability of Significant Loss (PSL) score mean in practice?
PSL is the annualized probability that a depositor loses more than 1% of principal in a given lending market. A PSL of 2% means that in 2 out of 100 simulated years, under historical market conditions, a depositor would have experienced a loss exceeding that threshold. Lower PSL corresponds to a higher letter grade on Credora’s A+ to D scale.
Ratings and data provided are for informational purposes only. Not investment advice or a solicitation to buy or sell assets. Always conduct your own due diligence. Credora does not guarantee the completeness or real-time accuracy of any information provided. A full disclaimer is included in each risk assessment report published at https://www.credora.network/reports/.