S&P adds crypto vault assessments after Base incident

S&P Global Ratings launched its Vault Risk Assessment framework on Oct. 4, after deposits in crypto lending vaults reached about $10 billion in September. The total rose from $1.5 billion two years earlier, according to S&P.

The launch came on the same day that blockchain security firm CertiK flagged suspicious activity involving an unnamed vault on Coinbase-backed Base. A newly deployed proxy borrowed about 1,783 aBaswstETH, worth roughly $6 million, from the vault. It then redeemed the tokens through Aave for about 1,783 wstETH.

The incident did not involve an exploit of Aave. It involved risks linked to the vault’s contracts and permissions, which can affect investors separately from the underlying lending protocol.

Crypto vaults pool investor assets and allocate them under preset strategies. Smart contracts can manage those strategies automatically, or human managers known as curators can oversee them. Investors receive tokens representing claims on the pooled assets and their returns.

S&P’s framework covers portfolio credit quality, liquidity mismatch, curator risk, blockchain risk, protocol risk, and vault security and governance. It assesses the likelihood that investors could suffer an impairment, including when market conditions or a vault’s structure change.

Investors can face losses when an underlying lending protocol operates normally. Possible sources include a curator’s allocation decisions, inadequate liquidity for withdrawals, changes to contract permissions and vulnerabilities in the vault’s code.

S&P’s assessments use a “(v)” suffix. AAA(v) represents the lowest relative risk category. The assessments are not credit ratings, do not measure expected yields and do not guarantee the return of investors’ capital. S&P describes them as forward-looking opinions on relative impairment risk.

The assessments can change when a vault’s eligible assets, risk profiles, smart-contract features or liquidity conditions change. S&P plans to publish assessments for individual vaults in future announcements.