Prior known-ignored disclosure
A response & disclosure hygiene factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor records evidence in prior-incident post-mortems or public records that a disclosed vulnerability was known to the protocol team before the exploit but was not acted upon within a reasonable timeframe. Evidence sources include: post-mortem disclosures by audit firms, security researchers, or the team itself; governance forum posts naming specific vulnerabilities; Discord or Telegram records; and curator-maintained records of ignored disclosure events. Measurement is manual curator review of all available post-mortems and public records for the protocol. Category 13 context: prior ignored disclosure is the strongest available signal for systematic response-hygiene failure — it demonstrates that the team's disclosure process failed under real conditions.
**Why it matters** Prior ignored disclosure is documented across five in-sample hacks with total losses exceeding $233M. Mango Markets ($115M, 2022) had a Discord warning in March 2022 specifically referencing Venus Protocol and the oracle manipulation vector — the attack occurred six months later. Atomic Wallet ($100M, 2023) ignored a Least Authority security report describing the vulnerability class. Sonne Finance ($20M, 2024) had yAudit flag the Compound V2 donation risk in their own audit report — the governance execution gap was not addressed. Balancer ($2.1M, 2023) had a five-day public warning before the exploit. Sturdy Finance ($800K, 2023) had a Balancer forum post specifically naming Sturdy's pools as vulnerable four months before the exploit.
**Green / Yellow / Red** Green is scored when no evidence exists in any accessible post-mortem or public record of a prior security disclosure being ignored or unacted upon within the response window. Yellow applies when a prior disclosure was acted upon but with a delay exceeding the protocol's stated SLA, or when the response was partial (the disclosed finding was addressed but a related attack surface was not). Red is scored when post-mortem evidence confirms that a prior disclosed vulnerability was known to the team and no action was taken within 30 days, and the vulnerability was subsequently exploited.
**Common gray cases** Gray applies when the protocol is new enough that no post-mortem record exists, or when prior disclosures were made through private channels that the curator cannot access.
**Notable historical examples** - **Mango Markets** ($115M, 2022): Discord warning in March 2022 referencing the exact oracle manipulation vector; ignored for six months before exploit. - **Atomic Wallet** ($100M, 2023): Least Authority security report (2022) describing vulnerability class; not acted upon. - **Sonne Finance** ($20M, 2024): yAudit flagged Compound V2 donation risk; governance execution gap not addressed. - **Balancer V2** ($2.1M, 2023): Five-day public warning before exploit; at-risk TVL partially evacuated. - **Sturdy Finance** ($800K, 2023): Balancer forum named Sturdy's specific pools as vulnerable four months before exploit; no action taken.
Measurement what to look for #
Determine whether evidence exists in prior-incident post-mortems that a disclosed vulnerability was reported to the team and not actioned before exploit.