Upgrade frequency (per 90 days)
A post-deploy hygiene & change mgmt factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor counts the number of distinct contract upgrades executed for the protocol's core contracts in the trailing 90-day window. The count is derived from on-chain Upgraded events emitted by UUPS or transparent proxy contracts, or equivalent upgrade-execution events for other proxy patterns. High upgrade frequency is a proxy for ongoing development activity on production contracts — an elevated surface area for post-audit code changes.
Why it matters
Upgrade frequency is an operational hygiene indicator: protocols that upgrade frequently are making ongoing changes to live production code, each of which represents a potential introduction of unreviewed vulnerability. A protocol that upgrades its core lending contracts six times in 90 days has introduced six windows during which post-audit changes may be unreviewed (assessed separately under RD-F-139). High upgrade frequency also signals that the codebase is not in a stabilized state, which correlates with lower battle-test confidence. This factor is displayed as a count rather than a pass/fail to give context to the RD-F-139 assessment.
Green / Yellow / Red
Green is assigned when the upgrade count is 0 or 1 in the trailing 90 days, indicating a stable deployed codebase. Yellow covers 2–4 upgrades in 90 days with all changes documented via release notes or governance proposals. Red is assigned when 5 or more upgrades have been executed in the trailing 90 days, or when upgrades are occurring without publicly documented justification.
Common gray cases
This factor is grayed when the protocol uses immutable (non-upgradeable) contracts, where an upgrade count of zero is structural rather than behavioral.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Count the number of contract upgrades in the trailing 90 days via on-chain upgrade events.