DeFi Protocol Evaluation Framework - SuperEarn Docs

While the categories below illustrate core evaluation angles, the assessment is not limited to these items. Additional dimensions may be considered based on the protocol’s structure, documentation, and risk profile.

Area 1: Technical Security

Evaluates how robust the code is and how well the protocol is designed to withstand external attacks.

Evaluation Item	Checklist / Points to Verify	Importance
Audit	Which firm conducted the audit? (e.g. top-tier firms preferred) How many audits have been conducted? (minimum of 2 recommended) What were the findings, and were all Critical/High issues resolved? Is the audit report publicly available?	Highest
Bug Bounty Program	Is there an ongoing bug bounty program on platforms like Immunefi or HackerOne? Is the bounty size appropriate (high rewards relative to TVL indicate strong security confidence)?	High
Track Record	How long has the protocol been live on mainnet without major issues? Is there any history of hacks or fund losses and, if so, how were they handled?	High
Admin Key Structure	Do admin keys exist that can alter core protocol settings? If yes, are they managed via multisig, and who are the signers?	High
Dependencies	Which oracle is used (e.g., Chainlink, Pyth – reliable providers)? What are the price-oracle mechanisms? If the protocol is built on another protocol, is the base layer considered secure?	Medium
Dependency Graph Depth	Does the protocol rely on material 2nd- or 3rd-order dependencies such as underlying protocols, vaults, bridges, collateral assets, or rehypothecation layers? Are critical upstream dependencies sufficiently transparent, audited, and monitorable? Could a lower-layer failure materially affect strategy NAV, liquidity, or redemption availability?	High
Oracle Risk Profile	Are oracle sources, update cadence, deviation thresholds, and fallback mechanisms clearly documented? Could oracle lag or manually attested pricing create a false-solvency window during market stress? For NAV-style or delayed price feeds, are conservative valuation and stale-price controls in place?	High
Code Disclosure & Documentation	Is the code fully open-sourced on GitHub? Is developer documentation complete and well maintained?	Medium
Cross-chain Security (bridged tokens only)	Which bridging stack is used, and is the verifier set a threshold configuration (avoid 1-of-1)? Are there rate limits at both the transport layer (per-hour cap) and the mint layer (per-block cap), with a tested kill-switch?	Highest

Area 2: Economic Security

Evaluates whether the protocol’s yield sources, tokenomics, and risk mechanisms are sustainable and resilient even under extreme market conditions.

Evaluation Item	Checklist / Points to Verify	Importance
Liquidity	For lending protocols (especially for curators), is the collateral high-quality and reliable? For lending protocols: Is utilization rate appropriate? (if utilization is consistently above 85–90%, withdrawals may be delayed or blocked, so real-time monitoring is required) For DEX/AMM: Is pool TVL sufficient to handle expected deposits and withdrawals? For RWA or private credit: Are there explicit lock-up periods or redemption cycles (for example, 30-day lockup, weekly redemption)? Are there utilization, redemption-queue, or liquidity-ceiling conditions that could delay or block withdrawals under stress? Do major incentives have a known expiry date, and should the strategy be re-evaluated before expiry? Has the protocol handled large withdrawal events smoothly in the past?	Highest
Yield Source Consistency	Where does the yield come from: organic fees, borrower interest, market making, RWA income, or token emissions? How much of the headline APY is organic versus incentive-driven? If rewards are in a native or emission token, is the yield likely to remain sustainable after incentives end?	High
TVL and Volatility	Is TVL sufficiently large (for example, TVL greater than 50 million USD for more than 3 months can be considered solid, and greater than 100 million USD can be considered strong)? Is TVL relatively stable, without sharp fluctuations that indicate dependency on short-term institutional or mercenary yield-farming capital?	High
Liquidation / Deleveraging Mechanisms	For lending or perp DEXs: Do liquidation mechanisms function reliably in volatile markets? Is available liquidation venue liquidity sufficient relative to plausible liquidation volume under stress? Could correlated leverage, shared collateral, gas spikes, MEV competition, or weak keeper incentives cause liquidation delays, bad debt, or cascading losses? For yield-bearing stablecoins: Are there structural risks of depeg or death spiral?	High
Insurance / Safety Fund	Is there an insurance or safety fund to compensate users in case of unexpected losses? Are its size and trigger conditions clearly defined?	Medium

Area 3: Operational & Governance Trust

Evaluates how trustworthy and transparent the operating team or DAO is.

Evaluation Item	Checklist / Points to Verify	Importance
Team Structure & Reputation	Is the team anonymous or public (public teams generally earn higher trust)? For curators: Does the operations team have proven ability to select and manage sub-strategies and risks? Do team members have prior experience running successful projects?	High
Off-chain Operational Risk	Does the protocol rely on off-chain custody or trading? Which custody provider is used (Copper, Fireblocks, Ceffu, etc.)? Is proof of reserves available in real time or via regular reports? Is off-chain transparency ensured (for example through dashboards or attestations)?	High
Curator / Operator Concentration	Does the strategy repeatedly rely on the same curator, risk manager, collateral set, or operational venue across multiple exposures? Could aggregator-of-aggregators structures hide concentration that is not visible from the top-level vault or strategy name?	High
Governance Timelock vs Response Window	Are governance timelocks or execution delays short enough relative to plausible incident response windows? If not, are pause, withdrawal, or risk-reduction controls available through narrower emergency roles?	High
Governance Transparency	How are key decisions made (e.g., transparent forums and on-chain voting)? Is the community (Discord, Telegram, etc.) active, and does the team engage well with users?	Medium
VCs and Partners	Which VCs have invested? Are there partnerships with reputable protocols or infrastructure providers?	Low

Final Evaluation & Application

Each checklist item can be scored quantitatively. Additionally, for “Highest Importance” items, a Pass/Fail criterion can be applied: if even one such item fails, the protocol is automatically disqualified.