Auditor re-engaged after last exploit
A operational history factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor is a Boolean recording whether a reputable auditor performed a re-audit or formal incident review after the most recent exploit. Re-engagement must be from a firm of comparable or higher tier than the original auditor and must cover at minimum the affected contracts and any related functions. An informal code review by the team's own developers does not satisfy this criterion.
**Why it matters** Re-audit after an exploit is the strongest available signal that a protocol is treating the root cause as systemic rather than treating the specific attack vector as isolated. In the dataset, protocols that re-engaged auditors after incidents showed materially lower rates of same-root-cause recurrence. Conversely, protocols that did not re-engage auditors -- or that re-engaged auditors for only a narrow slice of the affected code -- were disproportionately represented in the same-root-cause repeat-exploit cluster. Euler Finance ($197M, 2023) and Sherlock's $4.5M insurance claim acknowledging the missed donateToReserves function highlight that re-audit does not guarantee correctness, but its absence is a reliable negative signal.
**Green / Yellow / Red** Green: re-audit completed by a reputable firm after the most recent exploit, covering all affected contracts, with findings published or attested on-chain. Yellow: re-audit completed but with a scope narrower than the affected surface, or by a lower-tier firm than the original audit. Red: no re-audit after most recent exploit; or re-audit conducted but findings not published.
**Common gray cases** Bug-bounty payouts from whitehats following an incident are not equivalent to a formal re-audit unless the bounty submission prompted a full scope review. Curator must verify that the re-audit scope covered the actual exploit path, not merely the patched function.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether a reputable auditor performed a re-audit or incident review after the most recent exploit.