Methodology

Source Weights

Consensus Algorithm

The consensus engine clusters all available source prices for an asset and picks the most reliable result:

1. Collect all source prices with non-failed circuit breakers
2. Find the largest fully pairwise cluster of sources that agree within 50 bps (fixed pegs) or 500 bps (NAV tokens)
3. Break equal-size clusters by total weight, then stronger trust tier, then tighter spread, then peg proximity when available
4. If the winning cluster has 2+ members, publish its median price and separately keep the best cluster member for provenance
5. Choose that internal selected source by weight, then trust tier, then peg proximity, then source key
6. If no cluster of 2+ forms, fixed pegs stay on fixed-peg rules and fall back to the best trusted single source
7. Pool challenge: if all agreeing sources are challenge-eligible (CG, DL-list, DEX average, or promoted protocol DEX sources without a hard-source corroborator), check each large priced DEX pool (≥$100K TVL) from the published challenger snapshot built from the full retained pool set. If any protocol-level median diverges beyond the peg-type-aware threshold (500 bps for USD pegs, min(2 × depeg threshold, 500) for non-USD pegs), downgrade to low, and replace the price when at least two independent protocol-level medians corroborate that divergence unless severe-downside preservation applies. A high-TVL multi-protocol replacement can also use the peg depeg threshold when the published price is inside that threshold and at least two $5M+ protocol medians are depeg-sized in the same direction and mutually coherent inside the pool-challenge bps band. A one-protocol replacement remains allowed only when the protocol median has at least $5M TVL, the DEX median crosses the peg depeg threshold, and a hard primary candidate agrees within the normal consensus threshold

Authoritative Price Overrides

For wrapper-style assets whose executable value is set by direct protocol redemption, or by an instantly redeemable tracked base asset, rather than by secondary-market liquidity, the pipeline switches to an authoritative redemption-based mark:

• cUSD (Cap): getBurnAmount() — cUSD → USDC redemption rate
• iUSD (infiniFi): receiptToAsset() — iUSD → USDC redemption rate
• USDai: inherits tracked PYUSD pricing because base USDAI is treated as an instantly redeemable PYUSD wrapper
• iUSD (Initia) / USDCx: inherit tracked AUSD or USDC pricing when the parent rail is fresh and replay-safe
• USDK / XO / USDnr: inherit tracked wM pricing because Pharos treats them as instantly redeemable M0 extension units rather than free-floating market-priced assets
• Scoped par references: source-reviewed USD and FX redeemables can use fresh/static FX references when active supply is observable
• ERC-4626 NAV wrappers: audited vaults such as Spark Savings, Gauntlet, Steakhouse, Yearn, Avant, Noon, Yuzu, and Aave Umbrella use convertToAssets() multiplied by a fresh trusted tracked parent price
• sGHO / Idle tranches: protocol-specific previewRedeem() or virtualPrice() reads price assets whose executable value is not represented by thin secondary markets
• crvUSD (Curve): PriceAggregator.price() enters primary consensus as a live market voice, not a protocol override

These overrides set priceSource = "protocol-redeem" and priceConfidence = "high" when the quote validates against peg bounds, and they are applied after the GeckoTerminal probe so later market checks cannot overwrite them. Audited wrapper exceptions can use a fresh high-confidence same-run parent consensus for live pricing while keeping historical replay on replay-safe sources.

Enrichment Pipeline (6-pass fallback)

Assets still missing prices after primary consensus go through a staged enrichment pipeline:

1. Pass 1: Canonical tracked contract identity → DefiLlama coins API, but only prices that pass peg-aware validation can resolve the asset
2. Pass 1b: Tracked alternate deployment fallback only (no synthetic same-address cross-chain probing; same validation gate as pass 1)
3. Pass 2: CoinMarketCap batch listings (slug first; symbol fallback only when the tracked symbol is unique, rate-limited to 1 call/hour)
4. Pass 3: Jupiter Price API for tracked Solana mints (authenticated when configured, block-freshness checked, peg-aware, and able to add bounded soft evidence to agreeing low-depth Solana prices)
5. Pass 4: DexScreener exact token-address pools only; the older unique-symbol search fallback is retired, and the pass remains capped at 10 actual exact-address requests per run
6. Pass 5: Allowlisted low-volume CoinGecko recovery for selected DefiLlama-listed assets, published only with fallback confidence

Confidence Levels

Price Validation

Every price is validated before entering the replay cache. Validation is context-aware with four modes:

• Authoritative primary: can admit deep downside for fixed pegs, but publication still requires corroboration unless the mark is protocol redemption or a pool-challenge replacement
• Fallback enrichment: rejects isolated bad prints below a lower bound
• DEX observation: requires consistent $50K post-confidence TVL floor
• Historical backfill: validates against per-timestamp peg references

Commodity tokens (gold, silver) scale references by commodityOunces for gram- and 1/1000-ounce assets. NAV tokens use broad positive-price checks. Replay-safe cache storage is limited to strong, replayable prices and now expires after 6 hours.

Scoring Formula

The final value is clamped to [0, 100] and rounded to one decimal.

Components

Depeg Handling Rules

• Per-coin deduplication: active events are grouped by coin; each coin contributes once using the worst current deviation.
• Historical rebuild parity:completed-day backfills score any depeg overlapping the UTC day, canonicalize legacy depeg IDs into the current PSI universe, replay same-day deviation from `supply_history.price` when possible, never exceed the event's recorded `peak_deviation_bps`, and keep `peak_deviation_bps` as a start-day floor only when the event remained active through the UTC close and a daily snapshot misses the move. Replay days whose restored daily price is back inside the configured threshold drop out entirely, and restore jobs also repair replay-critical daily price coverage, including PSI-only shadow assets, before the PSI rebuild is rerun.
• Age-aware depreciation: fresh depegs get full weight for 30 days, then decay linearly to a 25% floor over 120 days.

Condition Bands

Base Dimensions (weighted average)

Redemption Backstop and Effective Exit

The standalone Liquidity Score remains a pure DEX market-depth metric. Safety Scores use an effective exit score for the Liquidity dimension, built on a best-path model: exit quality equals the best available exit path after redemption is adjusted for current executable capacity and route confidence.

modeledExitUsd = min(max(supplyUsd × 0.05, 100000), 25000000)

adjustedRedemption = redemption × capacityFactor × confidenceFactor

effectiveExit = round(min(100, max(dex, adjustedRedemption) + independentBonus))

capacityFactor is capped at 1.0 from current executable capacity divided by the modeled exit size. Confidence factors are 1.0 for high-confidence routes, 0.75 for medium-confidence routes, and 0.35 for low-confidence routes. The 10% secondary-path bonus is only applied when the redemption rail is independent from the DEX liquidity path, such as an issuer primary-market rail.

If only DEX liquidity exists, it is used directly. Eligible immediate, live, or queue-style redemption can stand alone when DEX liquidity is absent, with route family caps and component scoring as guardrails. Documented offchain issuer routes with eventual-only capacity do not replace missing DEX liquidity; they can only add the independent primary-market bonus when DEX liquidity already exists.

Redemption backstops are scored across access, settlement, execution certainty, capacity, output-asset quality, and cost. Low-confidence redemption routes stay visible on the site but do not uplift the Safety Score liquidity dimension. Documented offchain issuer exits with eventual-only capacity can add a primary-market bonus only when DEX liquidity already exists; they do not replace missing DEX liquidity. Severe active depegs also disable static or non-live-direct redemption uplift unless current live-open redemption evidence exists. Last-known DEX inputs still feed effective-exit scoring when the liquidity cron is stale, with staleness surfaced through liquidityStale / inputFreshness.dexLiquidity.stale. Materially stale or missing redemption snapshots are suppressed from Safety Score liquidity; normal 4-hourly redemption-sync lag remains inside the scoring freshness runway. Unknown route status remains low confidence for proxy-only or weaker evidence, but reviewed documented-bound routes can retain medium confidence when the rest of the evidence gates pass. Redemption metadata emitted by a live reserve adapter ages out with the reserve snapshot; if it is stale or degraded, the route stays visible but does not score as current capacity.

Current route coverage includes reviewed issuer rails, on-chain collateral redemptions, protocol NAV wrappers, and queued vault exits; newly reviewed wrappers and Nest-style vaults follow the same route-family caps and confidence gates as older configured routes.

Peg Stability Multiplier

After computing the base score, peg stability is applied as a power-curve multiplier: final = base × (pegScore / 100)^0.40. Coins with strong pegs (90+) are barely affected (~4% penalty), while coins with broken pegs are sharply penalized (e.g. pegScore 10 → 60% penalty). Pure NAV fund-share tokens with no configured peg reference keep pegScore = NR and receive multiplier 1.0, while configured NAV wrappers can inherit peg risk from a referenced base stablecoin. The peg dimension passes through the computed peg score directly; severe active depegs are hard-capped after the multiplier using the open event's peak deviation: ≥ 2500 bps (25%+) caps the overall score at F, ≥ 1000 bps (10%+) caps at D.

No-Liquidity-Data Penalty

A further 0.9× multiplier is applied when a coin has no exit-liquidity signal at all — neither DEX liquidity nor redemption-backstop coverage. Weights are redistributed across available dimensions; this 0.9× multiplier is then applied to the final score to correct for the missing liquidity data by applying a flat 10% penalty.

Resilience Scoring

Average of two equally-weighted sub-factors (50% each): Collateral Quality and Custody Model. Chain infrastructure is scored exclusively in the Decentralization dimension. Blacklist capability is reported descriptively but does not affect the Resilience score.

Tokenized RWA collateral is scored by the ultimate reserve or legal custody layer, not only by the smart-contract location of a wrapper token.

Collateral quality is derived from reserve compositions when available. The default source is curated metadata. A live reserve snapshot replaces it only when the current report-card snapshot can prove the feed is fresh, authoritative, independent, and clean. In coverage tables this is the difference between a reserve view being configured and a score-grade live reserve actually being used. For report-card scoring, the live snapshot must carry scoring-eligible freshness evidence: either a verified timestamp path or an explicit on-chain latest-state not-applicable freshness mode. Direct one-bucket on-chain reserve proofs such as Liquity v1 can qualify when the adapter is classified as independent, but weak probe families do not qualify just because they are on-chain. Detail-only static-validated and weak-live-probe feeds remain visible on reserve surfaces, but they never override curated collateral scoring. Each reserve slice is classified into one of five risk tiers and the score is their weighted average. Direct ETH and canonical WETH slices share the same Very Low tier, while ETH liquid staking tokens remain Low. Delta-neutral wording is evaluated by structure: transparent spot or wrapped exposure can stay Medium, but externally managed market-neutral, basis, perp, LP, private-deal, or custody-dependent strategy books are High unless stronger granular evidence shows the slice is only a liquid stablecoin or cash-equivalent buffer. For coins without usable reserve compositions, a coarser enum-based fallback is used. Explicit overrides exist for coins where defaults are incorrect (e.g., protocols on Solana, coins with CEX custody).

Decentralization Scoring

Base score from governance quality tier, then a chain-risk penalty for protocols on less decentralized chains — governance decentralization is undermined when the underlying chain has centralisation concerns:

• Immutable code— 100 (no admin keys, no upgrade path — e.g. LUSD, BOLD). Exempt from chain-risk penalty
• DAO governance— 85 (e.g. DAI)
• Multisig— 55 (e.g. GHO, FRAX)
• Regulated entity— 40 (named regulator, license, and independent audit — e.g. USDC, USDT)
• Single entity— 20 (unregulated or unverified issuer)
• Wrapper— inherits tracked parent Decentralization with a wrapper-kind haircut; unresolved wrappers fall back to 10

Resolvable wrappers use the wrapped asset's already chain-adjusted Decentralization score: savings wrappers subtract 3, strategy-vault and risk-absorption wrappers subtract 5, and bond-maturity wrappers subtract 8. For example, yBOLD and sBOLD inherit from BOLD, while sfrxUSD inherits from frxUSD.

Chain-risk penalty (DAO and multisig governance — exempt for immutable-code, wrapper, regulated-entity, single-entity):

• Combined score ≥80 — no penalty
• Combined score ≥60 — −10
• Combined score ≥40 — −25
• Combined score ≥20 — −40
• Combined score <20 — −60

Example: hyUSD (DAO governance, Solana, combined score 45) = 85 − 25 = 60. USDB (multisig, Blast L2, combined score 66) = 55 − 10 = 45.

Dependency Risk Scoring

Dependency scoring runs after upstream report cards are available and uses a topological order across the active dependency graph, so transitive stablecoin exposure is scored from upstreams before downstream coins are finalized.

• Self-backed coins— score by governance baseline: decentralized 90, centralized-dependent 75, centralized 95
• With mapped dependencies— blended score: each upstream's grade is weighted by its collateral fraction, and the self-backed portion (non-stablecoin collateral) scores vary by governance type (decentralized 90, centralized-dependent 75, centralized 95). A −10 penalty applies if any upstream dependency scores below 75
• Unavailable upstream scores— falls back to 70 when all dependency scores are unavailable; partially unavailable upstream weights are scored at 70 instead of being treated as self-backed

Dependency type ceilings— each dependency is classified as wrapper, mechanism, or collateral(default). Legacy wrappers (e.g., syrupUSDC → USDC) are capped at upstream − 3. Tracked parent-linked variants keep the same wrapper edge but use family-specific ceilings: savings −3, strategy-vault −5, risk-absorption −5, bond-maturity −8. Mechanism dependencies (e.g., DAI → USDC via PSM) are essential to the peg — score is capped at the upstream's score. Collateral dependencies use the blended formula with no ceiling.

Self-backed scores vary by governance type: centralized-dependent coins score 75 (systemic coupling risk), decentralized coins 90, and centralized coins 95. Centralized-dependent coins score lower because their peg mechanisms depend on upstream stablecoin infrastructure even for non-stablecoin collateral.

Grade Thresholds

Key Design Decisions

• NR (Not Rated)is used when fewer than 2 base dimensions have data — no misleading partial grades
• Weight is redistributed proportionally among rated base dimensions when some are NR
• Peg stability acts as a multiplier, not a base dimension — maintaining a peg is table stakes, not a differentiator
• Cemetery (defunct) coins receive a permanent F
• Decentralization score is structural, not a value judgment
• Blacklist capability is reported descriptively only and does not affect the Resilience score. Explicit mutable-contract overrides still surface as “possible”. Reserve-side stablecoins, custodied wrappers, issuer-seizable tokenized collateral, custody/CEX rails, and tracked parent-asset exposures now resolve to “inherited” blacklist risk instead of sharing the “possible” bucket.

Dependency Ceilings

When a stablecoin depends on another (wrapper, mechanism, or collateral relationship), its dependency risk score is capped relative to its upstream:

• Wrapper dependency: legacy wrappers and tracked savings variants cap at upstream score minus 3; strategy-vault/risk-absorption variants cap at minus 5; bond-maturity variants cap at minus 8
• Mechanism dependency: capped at upstream score
• Collateral dependency: blended into dependency risk dimension via weighted average

If any upstream dependency scores below 75, a 10-point penalty is applied. These ceilings prevent a wrapped token from outscoring its underlying asset.

Limitations

• Peg stability only reflects price data — can't detect coins “stable” because nobody trades them
• Decentralization is structural, not a value judgment
• Dependency inputs come from score-grade live reserve slices when available, then curated reserve links, then manual dependency metadata; unmapped collateral relationships may still be missed

Dedicated protocol-native sources (Fluid, Balancer, Raydium, Orca, Meteora, PancakeSwap V3, Aerodrome Slipstream, and Velodrome Slipstream) are treated as primary-grade inputs and enter scoring before staged or fallback discovery sources are merged.

Discovery coverage is less page-fragile now: CoinGecko Onchain and GeckoTerminal token crawls read multiple bounded pages, and fallback enrichment can activate for weak partial coverage instead of waiting for a strict zero-pool outcome. Secondary discovery rows with non-finite, negative, or impossible pool TVL are rejected before staging and skipped again at scoring merge time if stale bad data is already present.

Matching is chain-aware: `chain + address` resolves first, and symbol fallback is only allowed when it is unique on that chain for addressless tokens. If an upstream token already supplies an unknown address, it is dropped instead of being remapped by symbol. Pool dedupe uses exact ids plus conservative derived identity keys, so legitimate same-pair pools are not collapsed just because their token set matches. Balancer direct pools now key exact identity off the API's real pool `address`, not the 32-byte vault pool id. Provider-specific ids with underscores or suffixes are normalized into canonical protocol families before identity matching.

Direct-source precedence is also measurement-aware now. A protocol-native pool only replaces an overlapping DeFiLlama row when it has measured non-zero 24h volume, which means Slipstream pool-state rows can expand Base and Optimism coverage without displacing stronger overlapping DL rows when volume telemetry is absent. Exact pool ids from protocol-native sources still stay reserved for later staged-source dedupe even when the direct row itself is too small to score, so discovery feeds cannot re-add the same address with incompatible TVL semantics.

Discovery rows also need authoritative confirmation when they claim a protocol family that already has a clean protocol-native fetch on that chain. In practice, GT/CG/DS staging cannot invent new Balancer, Fluid, Raydium, Orca, Meteora, PancakeSwap, Aerodrome, or Velodrome pools after the native source succeeded; if that native fetch is degraded or unavailable, the scorer fails open and still allows staged recovery rows through.

For identity-poor DeFiLlama UUID rows, staged discovery can use the narrow optional-metadata wildcard only when both sides are unique on chain, protocol, token set, and pool-shape family. That lets one staged exact-pool-id row collapse against one primary row without collapsing parallel same-pair pools.

When protocol-native sources expose pool inventory, Balancer, Raydium, Orca, Meteora, PancakeSwap V3, and the Slipstream integrations now contribute measured balances and fee detail instead of neutral placeholders. Balancer weighted pools are normalized against target token weights before the balance ratio is computed. Fluid reads reserves and fee detail from the official DexReservesResolver on Ethereum, Arbitrum, Base, and Polygon, while Aerodrome and Velodrome Slipstream read pool state from the on-chain Sugar view contracts on Base and Optimism.

Repeated sightings of the same physical pool across direct API, staged, and fallback sources are collapsed before DEX price aggregation. A separate challenger snapshot preserves the full retained pool set for depeg checks, instead of relying on the visible top-pools subset. Balancer stablecoin pools also get a narrow stable-pair identity fallback when DeFiLlama omits the subtype in `balancer-v3`, preventing direct-API stable pools from being double-counted as faux weighted rows.

Orderbook fallback rows now validate observable ticker quality directly. CoinGecko deprecated `trust_score`, so Pharos filters those tickers by freshness flags, finite USD price/volume, exchange identity, and USD-equivalent quote assets instead of relying on a legacy badge. The scoring-cron orderbook fallback is reserved for absent, no-price, or tiny DEX coverage; weak but already-covered DEX assets stay on the on-chain repair path instead of receiving time-budget-dependent centralized synthetic books.

PancakeSwap V3 volume now uses a bounded trailing-hour window from the official subgraph's `poolHourDatas.volumeUSD` buckets instead of the latest `poolDayDatas` row, so intraday volume no longer decays toward zero between UTC day rollovers.

After bad pools are filtered and secondary-source TVL caps are applied, every exported aggregate and score input is rebuilt from the retained pool set. That keeps filtered or downscaled pools from lingering in the final score through stale pre-filter totals.

Curve balance, registry, token-price, and metapool TVL enrichment is applied only to Curve DeFiLlama rows. Non-Curve rows that share the same token symbols as a Curve pool keep their own mechanism type and TVL.

Coverage confidence is measurement-aware. Instead of a fixed score by source family, Pharos now weights how much retained TVL has measured balances and prices, how broad the protocol mix is, and how much of the row depends on synthetic or freshness-decayed fallback liquidity.

Components

Pool Quality Adjustments

• Balance health— continuous ratio (not binary threshold): pools with imbalanced reserves score lower
• Pair quality— co-token scored by Pharos governance classification (CeFi→1.0, DeFi→0.9, CeFi-Dep→0.8) plus static map for volatile assets (WETH→0.65, WBTC→0.6)
• Metapool dedup— uses TVL excluding base pool to prevent double-counting across Curve metapools
• Retained-pool recomputation— HHI, depth, volume, and balance/organic/durability inputs are all recomputed from the same retained pool set before the UI truncates to the top 10 displayed pools

Net Flow 24h

Net Flow answers the first question directly: is a coin minting or burning right now? It is the raw 24-hour mint volume minus burn volume.

• Minting— `netFlow24hUsd > 0`
• Burning— `netFlow24hUsd < 0`
• Flat— `netFlow24hUsd = 0` with activity
• No activity— no 24h mint/burn events in the window
• Invariant— minting vs burning always comes from raw net flow, never from the pressure score sign

Pressure Shift vs 30D

This is the existing Flow Intensity formula under clearer naming. It measures how far current 24-hour flow pressure deviates from the coin's own trailing 30 fully closed daily configured issuance-chain baseline.

denominator = max(baselineDailyAbs × 0.3, $1M)
z = (currentDailyNet − baselineDailyNet) / denominator
pressureShift = clamp(-100, 100, z × 50)

• Baseline period— trailing 30 fully closed UTC days of configured issuance-chain daily net flows and absolute volumes, excluding the current partial day
• Minimum data— requires 7 days of history; returns null (NR) otherwise
• Activity gate— windows with no 24h mint/burn activity or less than $50K absolute 24h flow are marked NR and excluded from gauge weighting
• Ingestion safety— sync state advances only to the shared safe coverage frontier when some event definitions or block timestamps are incomplete; established coverage is marked lagging by cadence-derived block progress, or unknown when the current chain head is unavailable
• Floor— denominator is floored at $1M to prevent noise in low-volume coins
• Interpretation— above +10 = improving vs baseline, between -10 and +10 = stable vs baseline, below -10 = worsening

Bank Run Gauge

Market-cap-weighted composite of all tracked coins' pressure-shift values, producing a single ecosystem-wide configured issuance-chain flow-pressure reading. Gauge weights use each coin's canonical tracked-chain circulating supply. The gauge score maps to one of seven condition bands:

Returns null only when all tracked coins are NR (for example, insufficient history or no 24h mint/burn activity). Coins with null pressure-shift values are skipped from the market-cap-weighted composite.

Flight-to-Quality Detection

Detects capital rotation from lower-scored to higher-scored tracked mint/burn stablecoins — a pattern typically seen during market stress when holders move funds out of weaker assets and into stronger safety-score cohorts.

• Safe classification— tracked mint/burn coins with report-card score ≥65; risky coins are tracked mint/burn coins with score <50. Classification is unavailable when the report-card cache is unavailable or stale
• Dual threshold— active when risky coins have >$100M net outflows AND safe coins have >$100M net inflows simultaneously over 24h
• Intensity scaling— min(100, |riskyOutflows| / $1B × 100), reflecting the magnitude of the rotation

APY Resolution and Source Arbitration

• Tier 1 — Direct on-chain reads: reads protocol state directly, either as an exchange-rate delta (e.g. sUSDe), a conservative reward-only estimator (e.g. LUSD B.Protocol Stability Pool, LQTY only), or scrvUSD's Yearn V3 profit-unlock current-rate reader
• Tier 2 — DeFiLlama pools: matches the coin to a DeFiLlama yield pool via static mapping, chain-scoped wrapper rules, and address-first fallback matching, while explicitly preserving wrapper pools that upstream marks as non-stablecoin when they are configured as relevant yield sources, allowing exact-pool curated overrides for assets such as XAUT, and TVL-weighting exact pool groups when one tracked asset maps to chain-isolated wrapper vaults. Wrapper-over-native venues such as BOLD/yBOLD stay classified as native yield rather than governance-set when the wrapper is just packaging the protocol's own Stability Pool return
• Tier 2.5 — Protocol-native venues: ingests curated protocol-owned APIs and protocol-specific on-chain venue readers when the canonical savings path is not representable as a reliable DeFiLlama pool; these rows stay in the curated tier rather than inheriting Tier 1 deterministic precedence reserved for native wrapper readers. Royco Dawn senior and junior tranches publish here as structured-tranche rows keyed by royco-dawn:<chainId>:<marketId>:<side>, while Midas mMEV publishes a NAV-appreciation row from the issuer-listed mMEV/USD oracle
• Tier 3 — Price-derived: for NAV tokens only, derives APY from 7-45 day price appreciation in `supply_history`
• Tier 4 — Rate-derived: for dividend-distributing and Treasury-tracking tokens, derives APY from the selected benchmark registry entry net of known fee spreads, using USD by default, product-specific EFFR where configured, 3-month compounded €STR for EUR pegs, 3-month compounded SARON for Swiss-franc pegs, and BIST TLREF for TRY pegs. Rate-derived rows can also carry an explicit benchmark override for PYS/excess-yield provenance without changing the APY derivation benchmark

Deterministic and curated paths can all contribute rows, then a confidence-weighted arbitration layer chooses the best row. Divergent discovered or fallback sources can be demoted or rejected when a canonical source disagrees materially. Protocol-native supplemental lending venues such as Aave V3 do not outrank stronger native wrapper yields purely because they query protocol state directly. Within a confidence tier, candidates compare source-risk-adjusted utility after source-risk penalty resolution before falling back to APY and TVL tie-breakers, and Resolv / USR-linked lending-opportunity venues are excluded from publication entirely. Published lending-opportunity rows also need observable venue TVL and must clear the higher of the absolute TVL floor or 0.1% of the tracked stablecoin's current supply. Linked tracked-variant rows can become parent alternatives when they represent native/wrapper yield, while third-party lending-opportunity rows stay on the asset that owns the venue, and explicit lending overrides only publish for active assets.

Yield-bearing coverage is now explicitly inventoried per asset. If no reliable runtime source exists, the asset is marked as an intentional gap rather than silently disappearing from audit coverage.

Royco Dawn tranche rows are opportunity rows, not stablecoin registry additions. Senior rows are capped at or below the underlying Safety Score; junior rows receive first-loss, utilization, coverage, market-status, drawdown, TVL, withdrawal, explicit access, and venue-posture penalties. These tranche scores are used by PYS for the opportunity row only.

Deterministic rows keep their own source identity (`onchain:<stablecoinId>`) rather than sharing a pool UUID with curated sources, so source-aware history and previous-rate lookups stay isolated when both paths coexist.

Trailing APY metrics are computed from source-specific history rather than a mixed coin-level series, so source switches no longer contaminate the displayed 7d/30d averages.

Read-time data-stale warnings are also cadence-aware: hourly families attach only after three missed sync-yield-data intervals (about 3 hours at the current publisher), while price-derived rows wait 36 hours because they are backed by daily supply_history snapshots rather than hourly source observations.

Pharos Yield Score (PYS)

benchmarkSpread = apy30d − benchmarkRate
effectiveYield = max(0, apy30d + benchmarkSpread × 0.25)
sourceRiskPenalty = deriveOrResolve(sourceRisk, neutral=1, max=2.5)
rowUtility = effectiveYield / sourceRiskPenalty
riskPenalty = max(0.5, (101 − safetyScore) / 20)
yieldEfficiency = rowUtility / (riskPenalty ^ 1.75)
sustainability = max(0.3, 1.0 − apyVarianceScore)
PYS = clamp(round(yieldEfficiency × sustainability × scalingFactor), 0, 100)

• Effective yieldkeeps raw APY as the anchor, then adds 25% of the row's benchmark spread so tighter local-currency cash hurdles can lift the score without turning PYS into a pure excess-yield ranker
• Source-risk penaltyuses nested source-risk evidence from measured reward share, source depth, freshness, source switching, bootstrap history, and sourced venue tier where available, then clamps it to 1–2.5 while treating missing evidence as neutral
• Yield efficiencyrewards higher APY relative to the opportunity and coin risk profile — source-risk-adjusted row utility is divided by the curved safety penalty so weaker safety grades need much more effective yield to compete
• Sustainability multiplier penalizes volatile yields (high variance over 30 days), favouring consistent returns
• Scaling factoris a global constant that normalises scores into a readable 0–100 range after the steeper safety curve is applied

NAV Token Handling

NAV-appreciating tokens (e.g. sDAI, wUSDM, BUIDL) use live report-card scores when the safety framework has enough data for them, including NAV-aware report-card coverage. The default safety baseline of 40 (NR) is only a missing-safety fallback, so a NAV token's PYS can still reflect a full safety assessment when report-card hydration succeeds.

See the mechanism explainers for tokenized Treasury (T-bill) designs and tokenized credit funds.

Limitations

• Trailing averages require sufficient history — newly tracked coins may show unstable scores until 7 days of data accumulate
• Some DeFiLlama and protocol-native surfaces still depend on upstream asset metadata completeness; the resolver now drops ambiguous candidates rather than guessing across duplicate symbols
• The LUSD B.Protocol Stability Pool row is conservative by design: it includes projected LQTY incentives only and excludes ETH liquidation gains
• Price-derived APY (Tier 3) can be noisy for low-liquidity NAV tokens

When a live event is later contradicted across the peg by a low-confidence primary price, the detector now retires the stale live row immediately and routes the replacement move through pending confirmation instead of leaving the wrong direction active.

Pending incidents are no longer write-once snapshots. While a candidate is waiting for confirmation, Pharos now preserves the original first-seen timestamp, refreshes the current last-seen state, tracks the worst same-direction move, and resets the pending row cleanly if the market flips to the opposite side of the peg.

DEX cross-validation uses explicit trust gates: detection and pending confirmation only trust fresh DEX rows with at least $1M of aggregate source TVL, while the public DEX Price Check UI requires a lighter but still non-trivial floor of $250K. Aggregate DEX rows also need deeper corroboration before they can mutate live event state: recoveries/suppression and pending confirmation now require at least two protocol-level DEX groups, and ambiguous-primary recoveries are vetoed when a large challenger pool still shows the old depeg direction. Pool challenger confirmation counts distinct protocol/source-family groups, with the documented $5M single-pool exception preserved. For already-open depegs, same-direction aggregate DEX disagreement is advisory rather than a synthetic recovery signal, so events stay continuous until the normal recovery path confirms the coin is back inside threshold.

Pending confirmation chooses off-chain confirmers by source family from the primary agreeSources set. CoinGecko-family primary evidence cannot be confirmed by CoinGecko again, DefiLlama-family evidence cannot be confirmed by DefiLlama again, and promoted rows store canonical keys such as coingecko-confirm, dex:curve, and pool:curve:gecko_terminal for auditability.

Thin non-USD fiat peg groups also fail closed when the live peg reference would have to rely on a 1–2 coin peer median or an empty peer set instead of cached FX. The same authority gate covers the displayed deviation: while the reference is too thin to verify, peg surfaces report the current deviation as reference unavailable instead of quoting a self-referential number. Once a live row is already open, a fresh non-cached multi-source primary cluster can retire it after recovery even if that source mix is still too soft to open brand-new events directly.

For supported fiat pairs with a clean native-market quote, depeg routing now also checks that direct native quote before trusting a derived USD-versus-FX move. That means BRZ-style BRL reference drift can no longer open, sustain, or confirm a live depeg when the fresh direct BRZ/BRL quote is already back near parity. Historical backfill now follows the same principle for supported non-USD fiat assets: when CoinGecko exposes a native fiat pair, replay prefers that native history and compares it directly to the native 1.0 peg before falling back to USD-plus-FX reconstruction. In that native-replay mode, Pharos now uses daily points plus a two-point confirmation window across 36 hours so thin hourly native prints do not manufacture long false historical depeg streaks.

Live depeg events still require at least $1M of current circulating supply. Historical replay applies the same floor from historical supply snapshots, or from current stablecoins-cache supply when historical supply is absent; if neither supply source exists, backfill preserves existing rows. Below that floor, the detail page may still show the current price deviation from peg, but it labels live event coverage as limited instead of implying the coin held peg.

DEWS (Depeg Early Warning System) computes forward-looking stress every 30 minutes from market, liquidity, confidence, blacklist, flow, and yield signals, with optional PSI-based amplification during systemic stress. Blacklist activity is attributed through the tracker config's canonical stablecoin ID, so same-symbol siblings do not inherit one issuer's freeze events. Its divergence input now reuses the live depeg DEX trust floor, so fresh-but-thin DEX rows stay visible for analytics but do not affect the score unless they pass the same `$1M` aggregate-TVL gate.

Historical DEWS daily snapshots do not retain the underlying DEX trust metadata needed to replay that gate exactly. When operators remediate the old thin-DEX window, the repair path refreshes current rows and prunes unrecomputable daily history back to the Mar 9, 2026 trust-floor boundary before new snapshots are published under the stricter rule.

PegScore

Composite 0–100 score measuring how faithfully a stablecoin holds its peg. The tracking window spans up to 4 years but is capped at the coin's actual age. PegScore now prefers a curated launch date when one is available, then the earliest supply snapshot, then the first durable Pharos valid-price observation for priced assets without supply-history coverage. Young coins are not diluted across history they didn't exist for, and priced assets no longer stay unrated solely because no supply snapshot has been written. Requires at least 7 days of tracking data; returns null otherwise. Scores based on 7–30 days are marked as “Early score” to signal limited history.

PegScore Formula

pegScore = 0.5 × pegPct + 0.5 × severityScore − activeDepegPenalty − spreadPenalty

PegScore Components

DEWS

DEWS is a per-coin, forward-looking stress score (0–100) for depeg stress. It is not a calibrated probability. It is computed every 30 minutes from 8 sub-signals. Only signals with available data participate; weights are redistributed proportionally across available signals.

Bootstrap tolerance is one-time only. Missing optional tables can be ignored before the first successful publication. After that, stale or missing core liquidity inputs are recorded as source failures. The cron still writes rows that meet signal coverage, then marks the run degraded instead of treating the missing input as startup noise.

The Yield Anomaly sub-signal combines legacy warning strings with populated Yield Intelligence source-risk, source-switch, and rank-attribution stress evidence. Neutral, missing, or malformed structured yield rows remain unavailable rather than adding zero-stress signal weight.

Score Formula

base = sum(W_i × S_i) / sum(W_i); psiAmp = PSI < 75 ? 1 + ((75 - PSI) / 75) × 0.3 : 1; contagionAmp = same-peg first-pass bump, clamped to 1.2; DEWS = round(clamp(0, 100, base × psiAmp × contagionAmp))

At least 2 available signal sources (total weight ≥ 0.30) are required; otherwise DEWS returns null.

Sub-Signals & Weights

• Supply Velocity (0.25) — rapid redemptions (bank run), measured from 1-day and 7-day supply contraction rates
• Pool Balance Drift (0.20) — one-sided selling pressure in DEX pools, blending balance stress, pool stress, and worst-pool imbalance
• Liquidity Erosion (0.15) — LPs fleeing, measured from 7-day changes in liquidity score and TVL
• Price Confidence (0.15) — N-source consensus failures across CoinGecko, DefiLlama list, GeckoTerminal, Pyth, Binance, Coinbase, RedStone, Curve on-chain, and DEX prices; maps confidence levels (high/single-source/low/fallback) to stress values
• Cross-Source Divergence (0.15) — fragmented pricing between multi-source consensus price, DEX price, and peg reference
• Blacklist Activity (0.10) — issuer emergency freeze surges for canonical stablecoin IDs with direct blacklist-tracker coverage
• Mint/Burn Flow (0.10) — redemption surge vs minting from on-chain Transfer event data; mature 30-day coverage stays available even when the latest 24-hour window is quiet, contributing zero flow stress instead of disappearing
• Yield Anomaly (0.05) — warning-signal and structured source-risk accumulation from yield spikes, divergence, TVL outflows, negative trends, reward-heavy regimes, thin/stale sources, source switches, and source-risk rank drivers

Threat Bands

• CALM (0–15) — no stress signals detected
• WATCH (16–35) — mild stress on 1-2 indicators
• ALERT (36–55) — multiple indicators elevated
• WARNING (56–75) — strong stress signals, depeg plausible
• DANGER (76–100) — severe stress across available weighted signals

Edge Cases

• NAV tokens are excluded entirely (price appreciates, not pegged)
• Non-USD pegs: cross-source divergence is dampened by 0.7 (noisier FX pricing)
• Small coins (<$50M): supply velocity is dampened via a logarithmic size factor
• Missing DEX data stays unavailable; zero-current rows retire; aggregate freshness uses the newest current row while the body exposes oldest-row lag

Supply history is daily and mint/burn coverage is partial (about 141 of 400 coins), so coins with neither usable source degrade to Insufficient Signal on supply-dependent kill signals rather than guessing. The depeg-event provenance side-table is unpopulated in production, so audit-verdict gating is not used; corpus quality comes from incident grouping, quarantine of flappy coins, and a minimum-severity floor. Terminal truth derives from cemetery/frozen status and the live deep-and-sustained-open pattern, never from the presence of a recovery price on a backfilled row.

Acceptance gates: Stage 1 must score Recovery Unlikely on clearly-attributable deaths (UST, IRON, USR) and must not on major recoveries (USDC during SVB, DAI on Black Thursday, LUSD/BOLD wobbles); Stage 2 median/IQR bands must contain realized resolution times at the documented coverage rate, with leave-one-coin stability and a stable canonical lineage hash. Abandoned slow-deaths that never present a sharp depeg are out of scope. The full methodology, limitations, and backtest plan live in docs/depeg-resolver.md.

DDRR does not replay today’s resolver over historical rows. It compares the frozen first-published DDR outcome with the later event outcome, keeps append-only errata visible, preserves immutable trigger/readiness metadata, and separates policy-universe coverage from scoreable recovery/duration accuracy. If a health deferral is followed by recovery or reliable terminal evidence before a healthy lock, the row remains a pre-lock coverage outcome rather than a retroactive forecast.

Systemic Risk Scoreboard

On page load, the scoreboard pre-computes the five most damaging single-coin failure scenarios. For each targetable coin (one that has dependents), it simulates a downgrade to D, counts the number of affected coins, and sums their market cap as “supply at risk.” Results are sorted by supply at risk descending.

Stress Test

The interactive stress test overrides a target coin's overall score, then recomputes the Dependency Risk dimension for every coin that lists that target as an upstream dependency. This models the direct dependency channel only.

In reality, a major stablecoin failure would also impact peg stability, liquidity, and market confidence simultaneously — the stress test captures only the mechanical dependency impact.

Limitations

• Collateral weights are researched estimates that may not reflect real-time ratios
• The stress test models only the dependency risk channel, not second-order market effects

The blacklist tracker stores event-time rows separately from a persistent freeze-ledger snapshot. Each cron run processes new events since the last indexed block; new blacklist rows refresh last-known snapshots, while later unblacklist events do not delete historical ledger rows.

Backlog sync handles gaps from missed cron runs or RPC failures by replaying events from the last confirmed cursor. Tron events use a separate ingestion path due to the TRC-20 event format differences, and missing Tron account/token-balance data remains provider-missing rather than being converted to zero.

The public-facing freeze totals combine per-chain counts into a single figure. Destroy/seize events can overwrite the stored amount when they provide better seized-value evidence, and the public summary reads the persistent ledger rather than treating unfreeze rows as historical deletion. The legacy active fields remain available for the local net-active state machine, but public freeze exposure should use the tracked ledger fields.