Using StableRate · 5 min read
How the StableRate Safety Score works
The exact formula behind the 0–100 Safety Score on every yield and staking option: nine factors from free public data, their weights, how missing data is handled, and what the score can’t see.
Education, not financial advice. Rates change; DeFi carries smart-contract and depeg risk. Do your own research.
What the score is
Every option in our tables gets a Safety Score from 0 to 100. It adds up red flags we can measure from free public data (mostly DefiLlama): how big and how old the protocol is, its audits and hack history, how much the rate swings, whether the rate leans on reward tokens, and how well a stablecoin has held its $1 peg.
- Safer: 80 or more. Few red flags in the data we have.
- Moderate: 60–79. Some red flags. Read the breakdown.
- Risky: under 60. Several red flags, or too little data to say.
A high score is not a guarantee and not financial advice. Large, old, audited protocols have still been hacked. Use the score to decide what to read more about, not what to buy. Open any row (tap Details on a phone, or the score on a computer) to see each factor with a plain-English reason.
The nine factors and their weights
Each factor gets a sub-score from 0 to 100. The Safety Score is the weighted average: score = Σ(weight × sub-score) ÷ Σ(weights that apply). Nothing is hidden: this is the full list.
| Factor | Weight | How it’s scored |
|---|---|---|
| Protocol size (TVL) | 12% | Total deposits across the whole protocol, on a log scale: $10M scores 0, $10B scores 100 ($100M ≈ 33, $1B ≈ 67). Source: DefiLlama protocols. |
| Pool size (TVL) | 10% | Deposits in this one pool (or, for native staking, the value staked on the network): $1M scores 0, $1B scores 100, log scale ($10M ≈ 33, $100M ≈ 67). Source: DefiLlama pools. |
| Protocol age | 10% | Years since the protocol was listed on DefiLlama: full marks at 4 years, straight line below that. Protocols listed before DefiLlama started recording dates (Oct 2021) get full marks. |
| Audits | 12% | Audits listed on DefiLlama: 2 or more = 100, 1 = 60, none = 0. An audit lowers bug risk; it doesn’t remove it. |
| Hack history | 12% | From DefiLlama’s hacks database: no recorded hack = 100. A hack of this protocol in the last 2 years = 0, 2–5 years ago = 50, older = 75. A hack of a sibling product from the same team (for example another version) counts half. If 90%+ of the funds were returned, add 25. |
| APY volatility | 14% | Two halves. Day-to-day swings: DefiLlama’s sigma for the pool divided by its average APY: 0.5% or less scores 100, 8% or more scores 0. Today vs normal: how far today’s APY is from its 30-day average: 0% off scores 100, 50% or more off scores 0. Rates that jump around are harder to plan on and often signal incentives or thin markets. |
| Reward-token reliance | 10% | Share of today’s APY paid in separate reward tokens rather than the pool’s own interest: 0% = 100, 100% = 0. Reward tokens can drop in price or stop at any time. |
| Stablecoin peg health | 12% | Stablecoin options only. Worst daily price over the past year versus $1: under 0.5% off = 100, under 2% = 70, under 5% = 30, worse = 0; and 0 if it’s more than 1% off right now. If it’s more than 3% off right now, the whole score is capped at 50 (Risky), however good everything else looks. A one-day spike that neither neighbouring day confirms is ignored as a price-feed glitch. Source: DefiLlama stablecoin prices. |
| Impermanent-loss risk | 8% | Impermanent-loss risk as flagged by DefiLlama: none = 100, flagged = 0. Our tables already show only single-asset pools, so this is almost always 100. |
| Total | 100% |
Example: a stablecoin pool that scores 100 on everything except volatility (50) and peg health (70) gets (100 − 14 − 12 + 14×0.5 + 12×0.7) ÷ 100 = 89.
Missing data is not treated as safe
If we don’t have a number for a factor (a protocol with no TVL figure, a pool with no APY history yet), that factor counts as 30 out of 100, about as weak as a real red flag. We also show a confidence level: High when we know at least 85% of the weighted inputs, Medium from 60%, Low below that. The meter says “some data missing” or “low data” when confidence isn’t high.
Factors that don’t apply
- Peg health only applies to stablecoin options.
- Native staking (delegating ATOM, SOL, ADA and so on directly on the chain) has no separate protocol, so protocol size, age, audits, hack history and reward tokens don’t apply. We don’t track native APY history yet, so volatility counts as unknown and these rows carry low confidence.
Factors that don’t apply are left out and the average is taken over the rest.
Volatile and Steady badges
Next to the 30-day chart you’ll see Volatile when any of these is true: DefiLlama’s sigma is more than 4% of the average APY, today’s APY is more than 25% away from its 30-day average, or the 30-day range (highest minus lowest day) is more than half the average. Otherwise it says Steady. The small numbers under the chart are the lowest and highest daily APY over the last 30 days.
Where the data comes from and how often
- Rates, pool size, sigma, 30-day average, reward split and IL flag: DefiLlama /pools, refreshed every 6 hours.
- Protocol TVL, listing date and audits: DefiLlama /protocols, refreshed daily.
- Hack history: DefiLlama /hacks, daily.
- Peg history: DefiLlama stablecoin prices (a year of daily prices), daily; today’s price every 6 hours.
DefiLlama also publishes an APY outlook for each pool. We show it in the breakdown for information but don’t score it.
What the score can’t see
Public data misses a lot. The score knows nothing about who controls admin keys, how a protocol is governed, oracle design, the real source of a yield, legal or custody risk at an exchange, or the quality of an audit. A brand-new exploit won’t show until it’s in the hacks database. Read how to pick safer yields and the risks page before you deposit.