Prior known-ignored disclosure
A response & disclosure hygiene factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor records evidence in prior-incident post-mortems or public records that a disclosed vulnerability was known to the protocol team before the exploit but was not acted upon within a reasonable timeframe. Evidence sources include: post-mortem disclosures by audit firms, security researchers, or the team itself; governance forum posts naming specific vulnerabilities; Discord or Telegram records; and curator-maintained records of ignored disclosure events. Measurement is manual curator review of all available post-mortems and public records for the protocol. Category 13 context: prior ignored disclosure is the strongest available signal for systematic response-hygiene failure — it demonstrates that the team's disclosure process failed under real conditions.
Why it matters
Prior ignored disclosure is documented across five in-sample hacks with total losses exceeding $233M. Mango Markets ($115M, 2022) had a Discord warning in March 2022 specifically referencing Venus Protocol and the oracle manipulation vector — the attack occurred six months later. Atomic Wallet ($100M, 2023) ignored a Least Authority security report describing the vulnerability class. Sonne Finance ($20M, 2024) had yAudit flag the Compound V2 donation risk in their own audit report — the governance execution gap was not addressed. Balancer ($2.1M, 2023) had a five-day public warning before the exploit. Sturdy Finance ($800K, 2023) had a Balancer forum post specifically naming Sturdy's pools as vulnerable four months before the exploit.
Green / Yellow / Red
Green is scored when no evidence exists in any accessible post-mortem or public record of a prior security disclosure being ignored or unacted upon within the response window. Yellow applies when a prior disclosure was acted upon but with a delay exceeding the protocol's stated SLA, or when the response was partial (the disclosed finding was addressed but a related attack surface was not). Red is scored when post-mortem evidence confirms that a prior disclosed vulnerability was known to the team and no action was taken within 30 days, and the vulnerability was subsequently exploited.
Common gray cases
Gray applies when the protocol is new enough that no post-mortem record exists, or when prior disclosures were made through private channels that the curator cannot access.
Notable historical examples
- Mango Markets ($115M, 2022): Discord warning in March 2022 referencing the exact oracle manipulation vector; ignored for six months before exploit.
- Atomic Wallet ($100M, 2023): Least Authority security report (2022) describing vulnerability class; not acted upon.
- Sonne Finance ($20M, 2024): yAudit flagged Compound V2 donation risk; governance execution gap not addressed.
- Balancer V2 ($2.1M, 2023): Five-day public warning before exploit; at-risk TVL partially evacuated.
- Sturdy Finance ($800K, 2023): Balancer forum named Sturdy's specific pools as vulnerable four months before exploit; no action taken.
Measurement what to look for#
Determine whether evidence exists in prior-incident post-mortems that a disclosed vulnerability was reported to the team and not actioned before exploit.