Skip to main content
Webacy rates the risk of ERC-4626 vaults so you can screen, list, and monitor DeFi vaults with confidence. Every vault is scored against a versioned risk framework that spans seven categories — from smart-contract quality to counterparty and hack/exploit history — and rolls up into a single composite grade you can act on. This page is the starting point. It orients you to what the vault risk surface gives you and where to go to integrate.

​
What you get

Composite letter grade

A single A+–F grade (plus a 0–100 score and star rating) summarizing overall vault risk.

Per-category contributors

See exactly which of the seven risk categories drove the grade, each with its own score and weight.

Criteria taxonomy

A dense pass / warn / fail breakdown across the framework’s individual criteria.

Coverage disclosure

Every response tells you how many criteria are live versus planned — no hidden gaps.
The seven categories are smart_contract, operational_governance, asset_collateral, market_liquidity, counterparty, hack_exploit_history, and chain_infrastructure. The V3 vault risk surface covers nine chains: eth, arb, base, opt, pol, bsc, avax, gnosis, sol. The composite grade uses the standard 11-band letter scale: A+ (lowest risk) through F (highest), with no E grade.
Want vault risk coverage on a chain that’s not listed? Contact the team — we’re actively expanding chain coverage.

​
What V3 returns

The V3 vault surface (/v3/vaults/{address}) returns a composite letter grade, per-category contributors, the full pass / warn / fail criteria taxonomy, and coverage disclosure. The framework is versioned and pinnable via framework_version and grading_scheme. The underlying risk envelope is preserved verbatim on every V3 response, so if you already consume the standard Webacy risk format you can adopt V3 incrementally — read the new fields when you’re ready, ignore them until then.
Score polarity: higher means worse. V3 numeric scores (composite.score, category scores, contributor scores) run 0–100 where 0 is the lowest risk and 100 is the highest — the same direction as the risk.score envelope. The letter grade keeps the conventional mapping (A+ is best, F is worst), so a low numeric score earns a high letter grade. If you build dashboards, make sure higher numbers sort and color as worse. See the polarity warning for the worked example.

​
Quickstart

Fetch the full V3 risk decomposition for a single vault. You need a Webacy API key (sign up here) and the vault’s contract address and chain.
Pin framework_version and grading_scheme from your very first call. Both default, but pinning guarantees reproducible scoring when a new framework or scheme version ships — see Pinning the framework.
The framework taxonomy itself is available from a public endpoint (no API key required): GET /v3/framework returns the full category and criteria list, so your client never drifts from the live framework.

​
Where to go next

Vault Risk V3 Overview

The V3 contract: versioning, polarity, upstream floor, and categories.

Vault Detail (V3)

Full request/response reference for GET /v3/vaults/{address}.

Framework Methodology

How composite scores are derived and why the framework is API-driven.

Framework Taxonomy

The public endpoint returning the canonical category and criteria list.

Screen and Monitor Vault Risk

Step-by-step integration guide for screening and continuous monitoring.

Vault Risk Intelligence

The data and signals available — verdicts, withdrawal risk, history, depeg.

Vault Incidents

A curated timeline of vault exploits, depegs, and governance failures.