Skip to main content
The methodology behind CORE3’s crypto project risk assessment consists of the following risk areas: security, financial and operational sustainability, dependency, reputational, compliance and regulatory risks.

​
Security risks — smart contract audits, bug bounties, and monitoring

The Security Risks category evaluates a project’s resilience against direct technical exploitation and adversarial attacks, which remain one of the most dominant loss vectors in the crypto market. Smart contract vulnerabilities, protocol misconfigurations, and insufficient monitoring continue to be responsible for a significant share of catastrophic losses, often materializing suddenly and without warning.The combined assessment of token and product audits, active bug bounty programs, and continuous third-party monitoring allows CORE3 to distinguish between projects that treat security as a one-time compliance exercise and those that approach it as an ongoing operational discipline. Audits reduce known and classifiable risks, bug bounties incentivize adversarial testing under real-world conditions, and monitoring systems provide early detection of anomalous behavior post-deployment.
Together, these metrics mitigate the structural challenge of immutable code and composability risk by lowering both the probability and severity of security incidents. Within the Project PoL framework, this category primarily addresses tail-risk events that can lead to immediate and irreversible loss. This makes it a core component of any digital asset security assessment.

​
How Often Are Crypto Risk Metrics Updated?

The methodology consists of 98 metrics and sub-metrics that together form the final score.
Different metrics are updated at different intervals, ranging from weekly to quarterly (or upon updates of the scored protocol, like new security audit), depending on their importance in keeping the score as fresh as possible and on the typical timeframe in which meaningful changes are expected to occur.

Project PoL Scoring Logic

Learn how these risk domains combine into a single PoL score