Deployer address prior on-chain history
A dev identity & insider risk factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor categorizes the deployer address's prior on-chain activity into one of three states: no prior history (fresh address), normal development history (prior legitimate protocol deployments, token interactions, no rug-linked transactions), or linked to a prior rug (address appears in a curator rug database or Chainalysis/OFAC label). Assessment is programmatic using on-chain transaction history analysis combined with curator rug-address lists. Category 7 context: a fresh deployer address with no prior history provides no baseline for assessing intent; a deployer with a documented rug history is an immediate red flag.
**Why it matters** The Eminence Finance case is the canonical example of deployer reputation being used as a false trust signal: $15M flooded into unannounced, unaudited contracts within hours simply because the deployer address was associated with Yearn Finance's known deployer. When deployer reputation is the primary trust signal, it creates exploitable asymmetry — users assume safety while the deployer faces no accountability. A fresh address with no history provides neither positive nor negative signal but eliminates the false-trust-signal risk. A rug-linked address is unambiguously disqualifying.
**Green / Yellow / Red** Green is scored when the deployer has a clean, multi-year on-chain history showing legitimate development activity — prior audited protocol deployments, no rug-database matches, no mixer interactions. Yellow applies when the deployer address is relatively new (less than six months) but shows normal development patterns with no rug links. Red is scored when the deployer address matches a curator rug database entry, is linked to a prior exit-scam protocol, or has a mixer-to-fresh-wallet funding chain (overlaps with RD-F-124).
**Common gray cases** Gray is assigned when the deployer is a multi-sig factory or CREATE2 factory deployment where no single originating EOA is identifiable as the responsible party.
**Notable historical examples** - **Eminence Finance** ($15M, 2020): Yearn deployer address used as false trust signal; $15M deposited into unaudited contracts within hours of silent deployment.
Measurement what to look for #
Classify the deployer address history as: none (fresh address) / normal-dev-history (prior protocol deploys, non-flagged activity) / linked-to-prior-rug (deployer used in prior known rug).