Post-mortem published within 30 days
A operational history factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor records whether the protocol published a public post-mortem within thirty days of its most recent exploit. The Boolean is set to true only when a post-mortem is publicly accessible (blog post, governance forum thread, or equivalent) and contains at minimum a timeline of the incident, identification of the root cause, and a description of the remediation steps taken or planned. Partial disclosures (e.g., brief tweets with no technical detail) do not satisfy the criterion.
Why it matters
A timely, detailed post-mortem serves three depositor-protection functions. First, it demonstrates that the team understood what failed -- a prerequisite for fixing it. Second, it creates an accountability record that allows the community to verify whether the stated fix was actually deployed. Third, it informs the broader ecosystem about a new vulnerability class, reducing the probability of the same vector being exploited on sister protocols. Twelve of the thirteen audited protocols in the dataset that were subsequently exploited had some form of post-mortem, but quality varied dramatically: Merlin DEX's CertiK audit marked a critical finding as resolved based on a verbal promise with no post-mortem verification; Elephant Money's Solidity Finance audit identified the exact vulnerability but the finding was not communicated to the team.
Green / Yellow / Red
Green: post-mortem published within thirty days containing timeline, root cause, and remediation plan with on-chain verification of fix. Yellow: post-mortem published but after thirty days, or published on time but lacking root-cause technical depth or remediation verification. Red: no post-mortem published, or a statement issued that attributes the incident to external factors without acknowledging the internal vulnerability.
Common gray cases
Protocols that deliver private post-mortems to institutional depositors but do not publish publicly are scored red on this factor, since depositor-protection requires public disclosure.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Determine whether a public post-mortem was published within 30 days of the most recent incident.