Deprecated contracts still holding value
A operational history factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor flags whether any protocol-announced deprecated contracts (contracts for which the team has publicly stated sunsetting or migration) still hold more than $100,000 in user funds or protocol assets. It is sourced from on-chain balance checks against a curator-maintained list of deprecated contract addresses, updated on a slow cadence (semi-annual or event-driven). A positive flag means the operational wind-down was not completed -- users were not migrated, funds were not drained, and the deprecated surface remains a live attack target.
Why it matters
Deprecated contracts represent a reduced-vigilance attack surface. The team has signalled they are moving away from the contract; monitoring attention is reduced; the codebase is no longer receiving security patches. OKX DEX lost $2.7M when attackers compromised a deprecated proxy admin key that had not been revoked. Force Bridge was drained on June 1, 2025 -- the day after announcing its May 31 sunset -- through a combination of reduced team attention and failed access control attempts in the six hours prior. The 1inch Fusion v1 settlement contract was deprecated but not destroyed, and resolvers continued calling it months after the successor was live. In each case, the deprecation announcement created a perception that the surface was gone while the financial exposure remained.
Green / Yellow / Red
Green: all deprecated contracts hold zero or negligible (below $1,000) in assets; migrations fully complete. Yellow: deprecated contracts hold between $1,000 and $100,000 in assets, with migration actively in progress and a public timeline published. Red: deprecated contracts hold more than $100,000 in assets with no active migration in progress, or the team has confirmed deprecation without a published drain-and-migrate plan.
Common gray cases
Contracts that are technically inactive (no user-callable functions remaining) but hold dust amounts due to rounding errors or stuck transactions are distinguished from contracts still accessible to users or holding meaningful protocol-owned liquidity.
Notable historical examples
- OKX DEX ($2.7M, 2023): Deprecated proxy admin key compromised; user approvals on deprecated TokenApprove contract drained.
- 1inch Fusion v1 ($5M, 2025): Deprecated settlement contract not destroyed; resolvers still calling it post-deprecation.
- Force Bridge ($3.76M, 2025): Drained the day after the team announced its sunset, through reduced-vigilance access control failures.
- Hacken HAI ($170K, 2025): Bridge minter key on a decommissioned DigitalOcean server used to mint 900M tokens.
Measurement what to look for#
Determine whether contracts marked deprecated by a protocol announcement still hold >$100K in assets.