CVE/GHSA advisory issued against protocol
A response & disclosure hygiene factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor records whether a CVE (Common Vulnerabilities and Exposures), GHSA (GitHub Security Advisory), or equivalent standardized public advisory has been issued against the monitored protocol or its core smart contracts. Detection is programmatic via the CVE database, GitHub Advisory Database, and OSV vulnerability feed, cross-referenced against the protocol's repository identifiers and known contract addresses. Category 13 context: a CVE or GHSA represents the highest-formality level of public vulnerability disclosure — it indicates that a vulnerability has been assessed as sufficiently significant to warrant standardized public notification, creating a documented public record and a timestamp against which the team's response can be measured.
**Why it matters** A CVE issued against a DeFi protocol creates a public, indexed record that any researcher, auditor, or monitor can retrieve and cross-reference. KyberSwap Elastic ($48M, 2023) had its tick-crossing precision failure ultimately documented in public advisories after the exploit. Compound's governance vulnerability family has multiple associated GHSAs. The existence of a CVE or GHSA against a protocol is not inherently a red flag — it may indicate responsible disclosure and patching — but the combination of an open (unresolved) advisory and a live protocol represents a specific elevated risk state. A resolved advisory provides the opposite signal: evidence that the protocol has engaged with formal vulnerability disclosure processes and maintained a public fix record.
**Green / Yellow / Red** Green is scored when no open CVE, GHSA, or equivalent public advisory exists for the protocol's core contracts, or when all historical advisories are marked as patched with on-chain proof of fix. Yellow applies when a historical advisory exists and is marked resolved, but the curator cannot verify on-chain that the fix was actually deployed. Red is scored when an open (unresolved) CVE or GHSA advisory exists against the protocol's core smart contracts that have not been marked as patched, indicating a known public vulnerability with no confirmed fix.
**Common gray cases** Gray applies when the protocol's contracts are not registered in any vulnerability tracking system and the absence of a CVE/GHSA reflects non-registration rather than absence of known vulnerabilities — the typical state for most DeFi protocols that have not engaged with formal CVE coordination.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether a CVE, GHSA, or equivalent public advisory has been issued against this protocol or its code.