The Quantix Risk Index
Formula
index = round₁( Σ valuei × weighti )
- Code Security0.30
- Operational Security0.20
- Governance Risk0.15
- Economic Security0.15
- Infrastructure Resilience0.10
- Transparency0.10
- Total1.00
Components
Six components, fixed weights
| Component | Weight | Definition | Evidence that raises it | Evidence that lowers it |
|---|---|---|---|---|
| Code Security | 30% | Quality and assurance of on-chain code: review coverage, open findings by severity, test and verification depth. | Independent review of the deployed commit, invariant and fuzz testing, formal verification of core properties, verified fixes. | Open critical or high findings, unreviewed code paths in production, missing tests around privileged and accounting logic. |
| Operational Security | 20% | Key management, privileged-role hygiene, deployment process, monitoring and incident readiness. | Hardware or threshold key custody, separated roles, rehearsed incident response, monitoring of privileged actions. | Single-key administration, shared deployer and admin keys, no alerting on upgrades or parameter changes. |
| Governance Risk | 15% | Concentration of control, timelocks, upgrade authority, and the ability of users to react to changes. | Timelocks longer than the user exit window, distributed signers, scoped emergency powers, published procedures. | Instant upgrades, small or concentrated multisigs, owner-only parameter control, emergency paths that can move funds. |
| Economic Security | 15% | Resistance to price manipulation, liquidity and solvency stress, and incentive misalignment. | Manipulation-resistant pricing, caps scaled to liquidity, stress-tested liquidations, bounded incentive exposure. | Single price sources, thin liquidity behind valuations, unbounded fees or minting, correlated collateral. |
| Infrastructure Resilience | 10% | Dependence on single operators, RPC and oracle providers, bridges, sequencers and off-chain services. | Redundant sequencers, oracles, relayers and RPC providers; documented failover; no single operator on the critical path. | One operator or provider whose outage halts the system or whose data is trusted without verification. |
| Transparency | 10% | Public documentation, verified source, disclosed audits and responses, and clear upgrade communication. | Verified source for every deployment, published assessments and responses, documented upgrade and incident communication. | Unverified contracts, undisclosed admin roles, silent upgrades, unpublished review results. |
Grades and tiers
From score to grade
| Grade | Score | Meaning | Protocols |
|---|---|---|---|
| AAA | 90–100 | Exceptional posture; residual risk is minimal and well managed. | 1 |
| AA | 85–89.9 | Strong posture with minor, documented weaknesses. | 3 |
| A | 80–84.9 | Sound posture; some improvements recommended. | 8 |
| BBB | 75–79.9 | Adequate posture with notable weaknesses in one or more areas. | 7 |
| BB | 70–74.9 | Moderate risk; several areas need remediation. | 5 |
| B | 65–69.9 | Elevated risk; material weaknesses identified. | 3 |
| CCC | 60–64.9 | High risk; significant unresolved weaknesses. | 1 |
| CC | 55–59.9 | Very high risk; multiple critical weaknesses. | 1 |
| C | 50–54.9 | Severe risk; fundamental controls missing. | 1 |
| D | 0–49.9 | Critical risk; the system should not be relied upon in its current state. | 0 |
Risk tiers
- Low risk85–1004 protocols
- Moderate risk75–84.915 protocols
- Elevated risk65–74.98 protocols
- High risk55–64.92 protocols
- Severe risk0–54.91 protocol
Protocol counts are the current distribution across the 30 protocols in Quantix Intelligence coverage.
Worked example
Scoring Thessaly Governance
Step 1
Multiply each component by its weight
- Code Security80 × 0.30 = 24.00
- Operational Security76 × 0.20 = 15.20
- Governance Risk72 × 0.15 = 10.80
- Economic Security76 × 0.15 = 11.40
- Infrastructure Resilience78 × 0.10 = 7.80
- Transparency84 × 0.10 = 8.40
Step 2
Sum, round, grade
- Weighted sum
- 77.60
- Rounded to one decimal
- 77.6
- Grade band
- BBB
- Risk tier
- Moderate
Step 3
Test an improvement
Recommendations are evaluated by moving one component to a target and recomputing. For Thessaly Governance, “Longer voting delay and higher quorum” raises Governance Risk from 72 to 80:
77.6 → 78.8 (+1.2)
Adjustments
Open findings and score history
Open-finding penalty
Code Security starts from a base reflecting review depth and testing. Each finding that is open or only partially resolved subtracts a fixed penalty until its fix is verified; the result is clamped to 0–100.
- critical−18
- high−8
- medium−3
- low−1
Example: a base of 90 with one open high and two open medium findings gives 90 − 8 − 2 × 3 = 76.
Monthly history
Each protocol keeps a snapshot of all six components for every month from November 2025 (or its launch) to October 2026. Dated events — research assessments, verified remediations, upgrades, governance changes and analysed incidents — carry the component changes they cause, so every historical score is recomputed by the model rather than stored.
A score moves only when evidence changes. Market conditions, token prices and popularity are not inputs.
Calculator
Calculate a Risk Index
Grade BBB · Moderate risk
Adequate posture with notable weaknesses in one or more areas.
| Component | Value × weight | Points |
|---|---|---|
| Code Security | 80 × 0.30 | 24.0 |
| Operational Security | 76 × 0.20 | 15.2 |
| Governance Risk | 72 × 0.15 | 10.8 |
| Economic Security | 76 × 0.15 | 11.4 |
| Infrastructure Resilience | 78 × 0.10 | 7.8 |
| Transparency | 84 × 0.10 | 8.4 |
| Quantix Risk Index | 77.6 |
Largest gaps: Code Security (−6.0 points) and Operational Security (−4.8 points). Raising these moves the score most.
Limitations
What the index does not tell you
- A score summarises evidence at a point in time. It is not a guarantee that a system is free of vulnerabilities.
- Components are judged from reviewed code, configuration and process. Anything outside a review’s scope is not covered.
- Weights are fixed across categories so scores are comparable; a bridge and a wallet SDK fail in different ways.
- Rank is relative to the protocols in Quantix Intelligence coverage. Two protocols with close scores can have very different weaknesses — read the breakdown.
Put evidence behind your score.
A research assessment produces the findings, verified fixes and component evidence the Risk Index is built from.