{"protocols":[{"id":"etherfuse","name":"Etherfuse","chain":"stellar","category":"lending","logo":null,"deployedOn":{"host":"Blend","label":"Blend V2 pool"},"safetyScore":59,"computedAt":"2026-10-09T09:00:18.535Z","methodologyVersion":1,"factors":{"oracleSafety":{"value":94,"detail":"2 of 5 reserves tied at the worst score — 318s old (fresh<300s, dead>600s); all reserves have a deviation bound","weight":0.25,"components":[{"id":"priceFreshness","label":"Price freshness","value":94,"detail":"2 of 5 reserves tied at the worst score — 318s old (fresh<300s, dead>600s); anchored to the aggregator's own resolution and max_age (600s)"},{"id":"deviationBound","label":"Deviation bound","value":100,"detail":"all 5 reserves score the same — CAS3J7… bounded at 10% per 300s step; CCW67T… bounded at 5% per 300s step; CAL6ER… bounded at 5% per 300s step; CBLV4A… bounded at 5% per 300s step; CD6M4R… bounded at 5% per 300s step"},{"id":"priceAges","label":"Price age by feed (not scored)","value":null,"detail":"Other:XLM 318s, Other:USDC 318s, Stellar:CAL6ER… 18s, Stellar:CBLV4A… 18s, Stellar:CD6M4R… 18s — all 5 within the protocol's own 600s staleness limit. Reported, not graded: priceFreshness already scores the worst of these."},{"id":"deviationTightness","label":"Bound tightness (not scored)","value":null,"detail":"per-reserve max_dev: CAS3J7… 10%, CCW67T… 5%, CAL6ER… 5%, CBLV4A… 5%, CD6M4R… 5%. Measured against the previous upstream record, so this bounds movement per publish interval. Reported, not graded — see METHODOLOGY.md §2."}]},"adminKeySafety":{"value":10,"detail":"single-key admin (1 signer(s), high-threshold 0), 200 op(s) in 30d","weight":0.2},"liquiditySafety":{"value":59,"detail":"worst reserve (CAS3J7…) has 59% of supply as free liquidity","weight":0.15},"collateralSafety":{"value":82,"detail":"top reserve holds 46% of supplied value across 5 reserves (HHI 0.34)","weight":0.2},"utilizationSafety":{"value":42,"detail":"worst reserve (CAS3J7…) at 41% util vs 70% cap","weight":0.2}},"operationalState":{"asOf":"2026-10-09T09:00:18.000Z","level":"entryDisabled","detail":"pool status 4 (Admin Frozen) — borrowing and supplying are disabled; withdrawals and repayments still work.","origin":"admin","source":"PoolConfig.status = 4","blocked":["supply","borrow"]},"lastRunAt":"2026-10-09T09:00:16.067Z","lastRunStatus":"ok"},{"id":"blend","name":"Blend","chain":"stellar","category":"lending","logo":"/assets/protocols/blend.svg","deployedOn":null,"safetyScore":50,"computedAt":"2026-10-09T09:00:21.061Z","methodologyVersion":1,"factors":{"oracleSafety":{"value":97,"detail":"all 3 reserves score the same — 321s old (fresh<300s, dead>900s); all reserves have a deviation bound","weight":0.25,"components":[{"id":"priceFreshness","label":"Price freshness","value":97,"detail":"all 3 reserves score the same — 321s old (fresh<300s, dead>900s); anchored to the aggregator's own resolution and max_age (900s)"},{"id":"deviationBound","label":"Deviation bound","value":100,"detail":"all 3 reserves score the same — CAS3J7… bounded at 60% per 300s step; CCW67T… bounded at 20% per 300s step; CDTKPW… bounded at 20% per 300s step"},{"id":"priceAges","label":"Price age by feed (not scored)","value":null,"detail":"Other:XLM 321s, Other:USDC 321s, Other:EURC 321s — all 3 within the protocol's own 900s staleness limit. Reported, not graded: priceFreshness already scores the worst of these."},{"id":"deviationTightness","label":"Bound tightness (not scored)","value":null,"detail":"per-reserve max_dev: CAS3J7… 60%, CCW67T… 20%, CDTKPW… 20%. Measured against the previous upstream record, so this bounds movement per publish interval. Reported, not graded — see METHODOLOGY.md §2."}]},"adminKeySafety":{"value":40,"detail":"single-key admin (1 signer(s), high-threshold 0), 0 op(s) in 30d","weight":0.2},"liquiditySafety":{"value":21,"detail":"worst reserve (CCW67T…) has 21% of supply as free liquidity","weight":0.15},"collateralSafety":{"value":62,"detail":"top reserve holds 71% of supplied value across 3 reserves (HHI 0.59)","weight":0.2},"utilizationSafety":{"value":12,"detail":"worst reserve (CCW67T…) at 79% util vs 90% cap","weight":0.2}},"operationalState":{"asOf":"2026-10-09T09:00:21.000Z","level":"borrowingDisabled","detail":"pool status 3 (On-Ice) — borrowing is disabled; supplying, withdrawing and repaying still work. Blend's backstop can impose this restriction on its own — when the pool's backstop deposits fall below the required threshold, or when a large share of them is queued for withdrawal — and it can also be set deliberately. Which happened here is not readable from the status alone.","origin":"indeterminate","source":"PoolConfig.status = 3","blocked":["borrow"]},"lastRunAt":"2026-10-09T09:00:18.723Z","lastRunStatus":"ok"},{"id":"kinetic","name":"Kinetic","chain":"stellar","category":"lending","logo":"/assets/protocols/kinetic.png","deployedOn":null,"safetyScore":27,"computedAt":"2026-10-09T09:00:12.888Z","methodologyVersion":1,"factors":{"oracleSafety":{"value":0,"detail":"3 of 5 reserves tied at the worst score — CCW67T… 4122s old (fresh<30s, dead>3600s); CCCRWH… 4120s old (fresh<30s, dead>3600s); CBSJZE… 4122s old (fresh<30s, dead>3600s); circuit breaker armed on all reserves","weight":0.25,"components":[{"id":"priceFreshness","label":"Price freshness","value":0,"detail":"3 of 5 reserves tied at the worst score — CCW67T… 4122s old (fresh<30s, dead>3600s); CCCRWH… 4120s old (fresh<30s, dead>3600s); CBSJZE… 4122s old (fresh<30s, dead>3600s); anchored to K2's own cache TTL (30s) and staleness threshold (3600s)"},{"id":"deviationBound","label":"Deviation bound","value":100,"detail":"all 5 reserves score the same — breaker armed at 2000bps against a stored baseline"},{"id":"priceAges","label":"Price age by feed (not scored)","value":null,"detail":"USDC 4122s, USDT0 4122s, PYUSD 4120s, XLM 660s, SolvBTC_FUNDAMENTAL/USD 10s — 3 of 5 past the protocol's own 3600s staleness limit (USDC, PYUSD, USDT0). Reported, not graded: priceFreshness already scores the worst of these."},{"id":"deviationTightness","label":"Bound tightness (not scored)","value":null,"detail":"max_price_change_bps 2000 (20%), global. Measured against the last price the oracle served, so unlike Blend's per-publish-interval bound this has no fixed time spacing — the two are not comparable as numbers. Reported, not graded — see METHODOLOGY.md §2. Price sources: CCW67T… batchAdapter, CAS3J7… batchAdapter, CCCRWH… batchAdapter, CBIJBD… batchAdapter, CBSJZE… batchAdapter."}]},"adminKeySafety":{"value":60,"detail":"admin is a contract (CC4UQN…) — not introspectable via Horizon; neutral baseline","weight":0.2},"liquiditySafety":{"value":42,"detail":"worst reserve (CBIJBD…) has 42% of supply as free liquidity","weight":0.15,"components":[{"id":"excludedReserves","label":"Reserves excluded as too small","value":null,"detail":"2 reserve(s) below the minimum scorable size, so not graded for free liquidity: CCCRWH… $4.01 (0.21% of pool), would have scored 0; CBSJZE… $6.99 (0.36% of pool), would have scored 100"}]},"collateralSafety":{"value":13,"detail":"top reserve holds 94% of supplied value across 5 reserves (HHI 0.89)","weight":0.2},"utilizationSafety":{"value":28,"detail":"worst reserve (CBIJBD…) at 58% util vs 80% optimal-utilization kink","weight":0.2,"components":[{"id":"excludedReserves","label":"Reserves excluded as too small","value":null,"detail":"2 reserve(s) below the minimum scorable size, so not graded for utilization headroom: CCCRWH… $4.01 (0.21% of pool), would have scored 0; CBSJZE… $6.99 (0.36% of pool), would have scored 100"}]}},"operationalState":{"asOf":"2026-10-09T09:00:10.000Z","level":"active","detail":"the router is not paused","origin":"indeterminate","source":"router.is_paused() = false","blocked":[]},"lastRunAt":"2026-10-09T09:00:06.407Z","lastRunStatus":"ok"},{"id":"aquarius-xlm-usdc","name":"Aquarius XLM/USDC","chain":"stellar","category":"dex","logo":null,"deployedOn":null,"safetyScore":24,"computedAt":"2026-10-09T08:30:32.778Z","methodologyVersion":1,"factors":{"adminKeySafety":{"value":10,"detail":"role posture binds at 10 — pool: worst of 7 roles — PauseAdmin single-key GA6MA6… (1 signer(s), high-threshold 0), 44 op(s) in 30d; RewardsAdmin single-key GCXYKA… (1 signer(s), high-threshold 0), 200 op(s) in 30d; SystemFeeAdmin single-key GB57YD… (1 signer(s), high-threshold 0), 200 op(s) in 30d | router: worst of 7 roles — PauseAdmin single-key GA6MA6… (1 signer(s), high-threshold 0), 44 op(s) in 30d; RewardsAdmin single-key GCXYKA… (1 signer(s), high-threshold 0), 200 op(s) in 30d; SystemFeeAdmin single-key GB57YD… (1 signer(s), high-threshold 0), 200 op(s) in 30d","weight":0.55,"components":[{"id":"rolePosture","label":"Privileged role posture","value":10,"detail":"pool: worst of 7 roles — PauseAdmin single-key GA6MA6… (1 signer(s), high-threshold 0), 44 op(s) in 30d; RewardsAdmin single-key GCXYKA… (1 signer(s), high-threshold 0), 200 op(s) in 30d; SystemFeeAdmin single-key GB57YD… (1 signer(s), high-threshold 0), 200 op(s) in 30d | router: worst of 7 roles — PauseAdmin single-key GA6MA6… (1 signer(s), high-threshold 0), 44 op(s) in 30d; RewardsAdmin single-key GCXYKA… (1 signer(s), high-threshold 0), 200 op(s) in 30d; SystemFeeAdmin single-key GB57YD… (1 signer(s), high-threshold 0), 200 op(s) in 30d"},{"id":"upgradeWindow","label":"Upgrade reaction window","value":100,"detail":"pool UpgradeDeadline = 0 — no code change scheduled (FutureWASM d691135a… matches the running code) | router UpgradeDeadline = 0 — no code change scheduled (FutureWASM c99539b0… matches the running code)"},{"id":"timelockDuration","label":"Timelock duration","value":null,"detail":"ADMIN_ACTIONS_DELAY is a compile-time constant with no getter, confirmed absent from all four deployed wasms, so the LENGTH of the upgrade window is not readable from the contract. The deadline and the current time are, which is why the window is graded as a state and never as a fraction remaining."},{"id":"emergencyBypass","label":"Emergency Admin bypass","value":null,"detail":"Aquarius's own response to Certora H-01: \"In the case of system vulnerability fixes, delay may be bypassed by the Emergency Admin role.\" So the reaction window is conditional on one single-signer key choosing not to skip it. Disclosed rather than folded in, because \"a window exists\" and \"the window is unconditional\" are different claims and only the first is true."}]},"assetControlSafety":{"value":40,"detail":"worst of 2 gradable reserve(s): USDC CCW67T…: issuer GA5ZSE… has auth_revocable — can freeze the pool's balance","weight":0.45,"components":[{"id":"reserve:CAS3J7GYLGXMF6TDJBBYYSE3HQ6BBSMLNUQ34T6TZMYMW2EVH34XOWMA","label":"XLM","value":100,"detail":"XLM CAS3J7…: native XLM — a SAC with no issuer account to act from"},{"id":"reserve:CCW67TSZV3SSS2HXMBQ5JFGCKJNXKZM7UQUWUZPUTHXSTZLEO7SJMI75","label":"USDC","value":40,"detail":"USDC CCW67T…: issuer GA5ZSE… has auth_revocable — can freeze the pool's balance"}]}},"operationalState":{"asOf":"2026-10-09T08:30:32.000Z","level":"active","detail":"the AMM router CBQDHN… is not in emergency mode","origin":"indeterminate","source":"router.get_emergency_mode() = false","blocked":[]},"lastRunAt":"2026-10-09T09:00:21.260Z","lastRunStatus":"failed"},{"id":"yieldblox","name":"YieldBlox","chain":"stellar","category":"lending","logo":"/assets/protocols/yieldblox.png","deployedOn":{"host":"Blend","label":"Blend V2 pool"},"safetyScore":23,"computedAt":"2026-10-09T09:00:15.878Z","methodologyVersion":1,"factors":{"oracleSafety":{"value":0,"detail":"2 of 5 reserves tied at the worst score — max_dev 0 — deviation check disabled","weight":0.25,"components":[{"id":"priceFreshness","label":"Price freshness","value":98,"detail":"all 5 reserves score the same — 315s old (fresh<300s, dead>900s); anchored to the aggregator's own resolution and max_age (900s)"},{"id":"deviationBound","label":"Deviation bound","value":0,"detail":"2 of 5 reserves tied at the worst score — max_dev 0 — deviation check disabled"},{"id":"priceAges","label":"Price age by feed (not scored)","value":null,"detail":"Stellar:CAS3J7… 315s, Stellar:CDTKPW… 315s, Stellar:CAUIKL… 315s, Stellar:CBLV4A… 315s, Stellar:CAL6ER… 315s — all 5 within the protocol's own 900s staleness limit. Reported, not graded: priceFreshness already scores the worst of these."},{"id":"deviationTightness","label":"Bound tightness (not scored)","value":null,"detail":"per-reserve max_dev: CAS3J7… 0%, CDTKPW… 10%, CAUIKL… 0%, CBLV4A… 10%, CAL6ER… 10%. 3 base asset(s) excluded — priced 1:1, not oracle-derived. Measured against the previous upstream record, so this bounds movement per publish interval. Reported, not graded — see METHODOLOGY.md §2."}]},"adminKeySafety":{"value":60,"detail":"admin is a contract (CANSYF…) — not introspectable via Horizon; neutral baseline","weight":0.2},"liquiditySafety":{"value":10,"detail":"worst reserve (CCCRWH…) has 10% of supply as free liquidity","weight":0.15},"collateralSafety":{"value":47,"detail":"top reserve holds 73% of supplied value across 8 reserves (HHI 0.59)","weight":0.2},"utilizationSafety":{"value":0,"detail":"worst reserve (CCCRWH…) at 90% util vs 90% cap","weight":0.2}},"operationalState":{"asOf":"2026-10-09T09:00:15.000Z","level":"borrowingDisabled","detail":"pool status 3 (On-Ice) — borrowing is disabled; supplying, withdrawing and repaying still work. Blend's backstop can impose this restriction on its own — when the pool's backstop deposits fall below the required threshold, or when a large share of them is queued for withdrawal — and it can also be set deliberately. Which happened here is not readable from the status alone.","origin":"indeterminate","source":"PoolConfig.status = 3","blocked":["borrow"]},"lastRunAt":"2026-10-09T09:00:13.176Z","lastRunStatus":"ok"}]}