Market-listing governance threshold
A economic risk factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor is a categorical assessment of the protocol's market-listing governance threshold: permissionless (any address can create markets), low-threshold (governance vote required but with low quorum or short timelock), high-threshold (governance vote with meaningful quorum and timelock), or no new listings (protocol does not add new markets). The classification is derived from source code inspection and governance configuration. This factor applies to lending protocols and permissionless vaults.
Why it matters
The ability of any address to list new markets or vaults without human review is a direct enabler of injection attacks. AlexLab II ($16.18M, 2025) was exploited when an attacker self-listed a malicious token through the protocol's permissionless vault mechanism. Cork Protocol ($12M, 2025) lost funds because its CorkHook contract accepted unvalidated external contracts as legitimate inputs. Penpie ($27M, 2024) and Pickle Finance ($19.7M, 2020) share the same root cause: permissionless registration paths that allowed fake markets or jars to be created without whitelist review. The severity of this factor is amplified when the protocol is also a Compound V2 fork (where permissionless market creation enables the empty-market inflation attack).
Green / Yellow / Red
Green: no new market listings permitted (fixed market set), or new listings require a high-threshold governance vote with at least forty-eight hours of timelock and multisig countersignature. Yellow: new listings require a governance vote but with a low quorum threshold or less than forty-eight hours of timelock, creating an exploitable activation window. Red: any address can create markets, vaults, or pools without governance approval or whitelist review.
Common gray cases
Protocols that allow permissionless creation of isolated markets with limited collateral sharing may present lower risk than fully-shared-liquidity permissionless designs; curator must assess the isolation boundary when scoring.
Notable historical examples
- Penpie ($27M, 2024): Permissionless market registration allowed attacker to create a fake market and exploit the protocol.
- Sonne Finance ($20M, 2024): Permissionless governance execution enabled front-running of market activation.
- Pickle Finance ($19.7M, 2020): Permissionless jar creation without whitelist review.
- AlexLab ($16.18M, 2025): Permissionless vault token self-listing used to inject malicious asset.
- Cork Protocol ($12M, 2025): Permissionless contract registration without validation of submitted contract code.
- Radiant Capital 1st ($4.5M, 2024): Governance-activated market with 6-second exploitation window.
- Onyx Protocol ($2.1M, 2023): Governance-added PEPE market with no seed deposit.
Measurement what to look for#
Classify the governance threshold required to list a new market as: permissionless / low-threshold (team multisig) / high-threshold (DAO vote) / no new listings.