Contributions
defirisk.co is an open-source risk transparency dashboard for defi protocols. You can improve the project, request coverage, or correct and challenge an assessment, all in public.
Overview #
There are two kinds of contribution, with different audiences. If you are adeveloper or researcher, you can improve the code, docs, and rubric, or ask us to cover a new protocol. If you represent a protocol (or you have spotted an error in one), you can correct a fact or challenge a grade. Both kinds resolve in public.
| You want to… | How |
|---|---|
| Improve code, docs, or the rubric | Open a pull request; see Code & docs. |
| Get a protocol covered | File a coverage request; see Request coverage. |
| Fix a wrong data point | File a Factual Correction. |
| Challenge how a grade was reached | File a Grade Dispute orRubric Proposal. |
Improve the dashboard #
Code & docs #
The site, scoring pipeline, schema, and rubric definitions are all open source. Pull requests are welcome to:
- The site (
site/), especially WCAG 2.2 AA accessibility fixes and performance improvements. - The scoring scripts (
compose.py,dump.py,rubric.py) and database migrations (db/migrations/). - Documentation, examples, and translations.
One topic per PR, with tests for new code paths and a short description of what changed and why. Full expectations, code style, and licensing are inCONTRIBUTING.md.
Pull requests cannot write to per-protocol factor scores or letter grades, and cannot edit the generated data/api/ tree, which is regenerated from the database on every deploy. To change what a protocol page says, use the correction and dispute channels below.
Request coverage #
Want a protocol added to the dashboard? File a coverage request with the protocol name, chain, approximate TVL, known audits, and any conflict-of-interest disclosure. The baseline scope bar is live for more than 12 months, TVL over $50M, on an EVM or otherwise supported chain. Requests are logged and prioritised against the published criteria.
Correct or challenge an assessment #
Everything we publish about a protocol is open to challenge, and every challenge is resolved in public. There are three channels, and which one you use depends on what you are claiming is wrong: the evidence, the judgment, or therubric itself. Picking the right one is the only thing you have to get right; if you file in the wrong place we re-route it and say so on the thread.
| Channel | You're claiming… | Outcome |
|---|---|---|
| Factual Correction | a data point is wrong, and you can cite a source. | Factor re-evidenced; the letter is recomputed. |
| Grade Dispute | the facts are right, but the rubric was applied incorrectly. | Re-adjudication; the factor flips, stays, or is rewritten. |
| Rubric Proposal | the rule itself is miscalibrated. | Public debate; a versioned change to the rubric. |
A letter grade is a deterministic function of the underlying factor scores. We never patch a grade directly. We correct or re-adjudicate the factor, and the letter recomputes from there. That is why a successful challenge always targets a specific factor, never the letter.
Factual Correction #
Use this when a specific data point is factually wrong and you can prove it: an audit link, a multisig threshold, a timelock delay, an oracle configuration, a TVL figure. A correction needs a verifiable source: a URL, a contract address, an audit PDF page, or an on-chain transaction. With that, we update the factor's evidence and the letter recomputes at the next pipeline run.
Grade Dispute #
Use this when the facts are not in question but you believe the rubric was applied incorrectly: a predicate was misread, a critical flag was miscounted, or a factor was scored against the wrong threshold. A Grade Dispute is resolved through theappeals process in the methodology: the maintainer re-adjudicates the disputed factor against the same predicates as the original assessment, and the decision is published with full reasoning. The factor either flips, stays, or is rewritten, and the letter recomputes.
Rubric Proposal #
Use this when the disagreement is with the rubric itself, not with any single assessment: a category is mis-specified, a critical factor is too broad, or a threshold is poorly calibrated. Rubric proposals are filed as public issues, reviewed by the maintainer, and either accepted into a future rubric version, deferred to a later revision, or declined with a public note. Because the rubric is versioned, an accepted proposal changes future grades transparently; see the rubric changelog.
What we never accept #
We correct factual data points that carry a verifiable source. We do not accept direct edits to factor scores or letter grades, not even a well-meaning pull request that "fixes a single field." The data layer is populated only by the pipeline and curator review, because the blast radius of a missed bad edit (a protocol team submitting favourable data about itself) is larger than the throughput a shortcut would buy. Every data change flows through one of the three channels above.
Timelines #
Every submission is acknowledged and triaged within five business days. From there:
- A straightforward Factual Correction with a clean source is applied at the next pipeline run after the evidence is verified.
- A Grade Dispute reaches a published decision within 14 daysof being filed, with full reasoning recorded on the thread.
- A Rubric Proposal has no fixed clock. It is debated in public and resolved when a rubric version is cut.
For already-published protocols, the grade stays live throughout a dispute. We do not gate publication on the dispute calendar or redact pages while a challenge is open. If a challenge succeeds, the historical record shows both the before and after grade with the date of change.
Audit trail #
Every correction and dispute is a public issue on thesource repository. The decision and the reasoning behind it are recorded on that thread, which becomes the permanent, citable record for the protocol. There is no private channel for changing a grade. If a number moved, the issue that moved it is public. Each protocol page links to its own corrections and disputes so the trail is one click from the assessment it concerns.
Security #
Found falsified data, a page that misrepresents a deployment, or anything security-relevant? Those can be reported publicly through a Factual Correction, or privately if the reporter has reason to keep it confidential. SeeSECURITY.md for the private channel and what is in scope.