Vault Methodology

Webacy’s vault methodology assesses the probability of financial loss arising from a vault’s exposures, liquidity, market conditions, infrastructure, concentration, and governance. Vaults connect deposited assets to strategies, markets, and protocols. Their risk depends on both the assets they hold and how those assets are deployed, managed, valued, and withdrawn. Our framework evaluates these relationships together to identify conditions that could lead to loss.

​

Assessment framework

The rating framework comprises six risk types. Each contains risk categories assessed through underlying rating factors: specific evidence, conditions, and indicators relevant to that category.

​

Credit risk

Credit risk assesses the potential for losses when borrowers, counterparties, or underlying exposures fail to meet their obligations.

• Credit and counterparties: The quality of credit exposures and the reliability of counterparties on which the vault depends.
• Claim and loss allocation: The nature of depositors’ claims and how losses are distributed across participants if an underlying exposure fails.

​

Liquidity risk

Liquidity risk assesses whether depositors can withdraw or exit their exposure without material loss.

• Redemption and exit: The availability and reliability of withdrawal routes, including the constraints that may affect access to deposited assets under normal and stressed conditions.

​

Market risk

Market risk assesses how changes in market conditions and asset valuations could affect the vault.

• Valuation and oracles: The reliability of asset valuations and price information used to value positions and support the vault’s mechanisms.

​

Concentration risk

Concentration risk assesses whether a limited set of exposures or dependencies could amplify losses or restrict access to funds.

• Concentration: The extent to which the vault depends on particular assets, markets, counterparties, or strategies.
• Redemption and exit: How concentrated exposures or dependencies could limit withdrawal capacity or make exits more difficult during stress.

​

Operational risk

Operational risk assesses whether the vault’s technical infrastructure and supporting systems can function securely and reliably.

• Code and chain: Risks arising from the vault’s smart contracts and the blockchain infrastructure on which they operate.
• Bridges and representations: Risks introduced by cross-chain mechanisms and wrapped or bridged assets used by the vault.
• Events and incidents: Operational failures and security incidents, including their implications for the vault’s continued operation.

​

Governance risk

Governance risk assesses how control, decision-making, and strategy oversight affect depositors’ exposure to loss.

• Admin controls and governance: The allocation of authority and the powers available to change the vault’s configuration, operation, or exposures.
• Events and incidents: Governance-related events and their implications for accountability and depositor protection.
• Curator and mandate: The role and responsibilities of the curator, the scope of the vault’s strategy, and the controls governing how that mandate is implemented.

​

How the assessment evolves

Webacy combines on-chain and off-chain evidence. On-chain risk is assessed in real time. Off-chain risk is assessed as close to real time as available information allows, depending on the availability and verification of documentation, disclosures, and other evidence. Underlying rating factors inform category assessments, which contribute to the six risk types and the overall rating. The assessment considers how risks interact. For example, concentrated allocations may increase both exposure to loss and the difficulty of exiting during a disruption. Categories that appear under more than one risk type are assessed from each relevant perspective. Redemption and exit, for example, addresses both general withdrawal availability and the constraints created by concentration. Supporting records are informational. They provide context and evidence for the assessment and are separate from the six risk types that contribute to the rating.