Skip to main content
The Vaults.fyi Reputation Score is a proprietary metric that gives you a single, objective number to assess how battle-tested a vault is. It is not a comprehensive risk rating — it is a signal about protocol and vault history securing capital, holder adoption, underlying asset reliability, and applicable risk-flag penalties. In API responses, reputation data is returned as the score object. The composite Reputation Score is score.vaultScore; the active component scores and penalty details explain how the final value is calculated. The deprecated score.networkScore field remains available for backwards compatibility and diagnostics, but has zero weight in the composite score.

​
What the Reputation Score measures

The Reputation Score favors protocols that are “Lindy” — the longer a protocol has secured large amounts of capital without incident, the higher the vault tends to score. A low Reputation Score does not mean a vault is unsafe; it means the vault has not yet accumulated the track record that the metric rewards.
The Reputation Score complements — but does not replace — detailed risk reviews from auditors and risk managers like LlamaRisk, Chaos Labs, and Gauntlet. Use it for programmatic filtering; use risk reports for deeper due diligence.

​
Component scores

Vaults.fyi calculates the Reputation Score from four weighted component scores:
Measures the scale of trust a protocol has earned over its operational history. This component captures how much TVL the protocol has secured and for how long, using logarithmic scaling to prevent a handful of massive protocols from dominating. A protocol with $500M TVL sustained for two years contributes more positively than one that briefly touched the same TVL for a week.
Accounts for liquidity characteristics at the individual pool level, not just the protocol level. A large protocol can host pools with very different liquidity profiles — for example, Aave v3 USDT on mainnet (5BTVL)behavesdifferentlyfromAavev3pyUSDonmainnet(5B TVL) behaves differently from Aave v3 pyUSD on mainnet (12M TVL). This component uses the same TVL-over-time approach as protocol integrity, applied to the specific pool.
Measures holder distribution and diversity. More unique holders indicate broader trust and reduce concentration risk. Future improvements to this component will include filtering low-value addresses, distinguishing individual holders from protocol-owned positions, and analyzing the ability of large holders to exit and affect liquidity.
Evaluates the stability and creditworthiness of the vault’s deposit asset. For stablecoins and pegged assets (ETH/BTC derivatives), this component measures historical price stability relative to the peg, plus/minus 2% liquidity depth in onchain markets, and CEX and DEX trading volume. Assets with a consistent peg and deep liquidity contribute more positively.
The composite score uses the following formula, with a minimum result of zero:
Blockchain security is not a weighted component of the current Reputation Score.

​
Flag penalties

Active vault flags — security incidents, protocol risk warnings, and similar indicators — directly reduce the Reputation Score. Higher-severity flags carry larger deductions. Only the single largest active penalty applies; multiple flags do not stack. When a flag is resolved, the penalty does not necessarily disappear immediately. Vaults.fyi can mark a flag with resolution details and reduce the effective penalty to reflect how much of the issue has been addressed. This lets a vault recover trust incrementally rather than resetting overnight. The score.penaltyComponents field in detailed-vaults responses shows each active or decaying flag penalty, its severity, current penalty value, expiry, and optional resolution note. The score.totalScorePenalty field shows the total penalty currently applied to the composite Reputation Score. The same optional resolution note is also returned on flags[] entries.

​
Interpreting the Reputation Score

A higher Reputation Score reflects the combined contribution of protocol and vault history, holder adoption, and underlying asset reliability, after flag penalties. It does not assess the security of the blockchain the vault runs on. A high score does not guarantee safety — it means the vault has passed more of the tests that time imposes.
The Reputation Score does not incorporate smart contract audit results, governance risk, or nuanced risk assessments of protocol architecture. Do not use it as a substitute for security research.

​
Using the Reputation Score to filter vaults

You can filter the detailed-vaults API response to only return vaults above a minimum Reputation Score threshold using the minVaultScore query parameter:
This is useful when building integrations where you want to surface only established vaults to end users, without needing to maintain your own allowlist.
Set minVaultScore to match your product’s risk tolerance. Consumer wallets typically want higher thresholds (70+). Yield aggregators serving sophisticated users may set lower thresholds to capture emerging opportunities.
The Reputation Score is also visible in the Vaults.fyi app at app.vaults.fyi and returned by the detailed vaults endpoint as score.vaultScore.

​
Known limitations

The Reputation Score is objective and formula-driven, which means it has edges. A genuinely risky protocol with a long history can score well. A well-audited new protocol will score low until it builds a track record. Keep these limitations in mind when making risk decisions.
  • The Reputation Score does not account for governance risk, upgrade mechanisms, or admin key exposure.
  • Blockchain security does not contribute to the current score. Assess network risk separately.
  • Smart contract audit status is not currently a direct input to the Reputation Score.
  • Flag penalties reflect known incidents surfaced by vaults.fyi — they do not capture all possible risk vectors.
For a deeper explanation of the methodology and the thinking behind the Lindy-based approach, read the Vaults.fyi reputation score blog post.