Risk Ratings: The Missing Piece for DeFi & Onchain Finance Mass Adoption - Mike Massari

Transcript

Nice to see you, everybody. I am Mike as uh you know, I was introduced. Thank you so much for having me. I am strategic advisor of Reston, head of Atom and Credora. Today we're going to talk about a number of things. Mostly is going to be risk, but I want to give you a little bit of an overview of what we've been up to. In the previous talk, we were discussing the roles of Oracles briefly and why Oracles are important now. I do think that we should double click on that a little bit.

Reston is the modular blockchain Oracles. We now serve over 110 chains, over 1,300 assets. It's a big big player in the Oracle space across all the protocols that you can imagine, right? So the Camino, Canton, Spark, Morpho, so on and so forth. We are the official Oracle for Securitize and we've been looking into institutional adoption much more as the old industry has been looking into uh over the past let me say couple of years.

In summary, what we want to do is we want to be the best Oracle for institutions and DeFi protocols and especially helping institutions tokenize different products. When I started in the Oracle business, it was uh with Chainlink Labs uh in about 2022. I've been in crypto since early 2017. The role of the space and the role of an Oracle at the time was very, very different from what it is now.

At the time, it was just good enough to just provide reliable, secure price data on different chains and basically call it a day. But now, an oracle is required to do many more things, and we do believe that in order to support the DeFi ecosystem, as an oracle, we should provide many more services. We created sometime ago what we call the RedStone stack. And the RedStone stack is a series is a series of product and services that we have and in a specific case, a company that we acquired, Credora, to support all of these wave of TradFi going into DeFi and RWA being tokenized.

So, this goes from the usual oracle feeds that you all know and love on protocols like Euler, Camino, Morpho, and so on. But also, we now support ultra fast feeds with uh our new product that is specifically for uh hip tree and and hyper liquid markets. We do uh support NAV proof of reserve for, for example, RWA and for stablecoin vaults. We have uh risk intelligence through Credora, which is what we're going to talk about today.

But also, as of very lately, we launched a new product that is called RedStone settle, that is all about liquidation on RWA positions and instant redemption of RWA, but also liquidations with Atom and recapturing of leaked MEV out of protocols. So, as you can see, there's a lot of stuff, right, that an oracle needs to provide nowadays, and what we want to do is to be the best in class and provide all of this in a single go without people, especially these institutions, having to go procure five, six different vendors and going through five, six six different acquisition process and regulatory compliance with these people and also from a management perspective, this

is actually very difficult when there is an incident that there's a lot of people to put together when it comes to resolving the problem. We had a record of zero mispricing event, zero downtime across the history of production Aave and we're bringing this to all of these new products. Sometime ago, this was about September 2025 as you can see. Our friend Vitalik Buterin tweeted that low risk DeFi can be for Ethereum what search was for Google.

Right? And this tweet came in a very, very timely manner because not only institutions were looking more and more to tokenize on Ethereum and in institutions, risk is just as important if not more important than APY and then yield and returns. But also, in 2025, Aave acquired Credora network. This was exactly the same month we acquired Credora in September of 2025. And Credora was and is the leading risk rating protocol across the web three space.

Think about traditional finance and like if you invest in an ETF, you usually see a number or a letter rating that is attached to these ETF. Usually, these letters goes from AAA all the way to maybe CCC or sometimes DDD. And there's a lot of parameters that go into this risk assessment and in order to understand how likely an investor is to lose money on the position. Credora does the same thing but in a completely revolutionary way that is specifically designed for Web3.

So, in principle we assess Web3 assets, Web3 markets, and vaults, and eventually also protocols, and eventually in the future more. But, we do it in a very simple way. We have ratings from A+ to D on half a rating increment, meaning you have A+, A, A-, B+, and so on and so forth all down to D. And we measure a bunch of different metrics. There's like hundreds of factors that go into this, but they all come down to one single number, which we call the probability of significant loss,

which is effectively what the likelihood of bad debt exceeding 1% of the principal is over the span of a year. And this is measured in percentage as well. And based on this percentage you get a letter rating. This is a very easy, very consumable way to understand our risk assessment as There is attached to the Credora rating a big 20-something page PDF report that goes in detail into all of these factors, into all of these metrics that we do measure.

But, for all intents and purposes, retail investors like myself that are not as experienced with ratings, they can just see the letter. And more experienced institutional investors, they instead are used to this due diligence process, they can read the deal report. So, we try to cater in a transparent, impartial, and easy to interpret way to all the broad spectrum of DeFi users from the completely financially illiterate like myself all the way to people that do this for a living, uh, and they breathe and breathe trading every day.

The way that the rating work is interesting. Are you guys familiar with the concept of a vault in a lending protocol right? Fantastic. A vault, the way that I always like to explain it, is just a strategy and it's a collection of different markets and a collection of different assets that effectively produces a certain level of return. We rated 90% of Morpho by TVL on Morpho vault. We rated 100% of Spark saving vaults.

But in order to rate these vaults, you need to be able to rate the market and the asset that compose the vault. So, the Credora rating, I would encourage you to see it as a little bit of a Russian doll type of thing. So, each asset in the vault and in the market is rated. Each market is rated and then there comes into one single vault rating that you can see. This is particularly good because you can catch a lot of these outlier ratings when it comes to the vault strategy itself, even if they are like the positions within the vault are somewhat masked or or skewed in different ways.

So, for example, if you have a very specific only risky asset within a vault, but it's in a small percentage, the vault can still be deemed more secure if you just do this algorithmically and just rate it the vault without looking at the asset, but what we do is actually we weigh the asset based on a a number of factors, not only how much is utilized, and the risk to provide a risk of the vault itself. So, it's a much more dynamic, it's a much more curated rating. And the other very very important thing that makes it completely different from the traditional finance rating is that it's

dynamic and always updated. At Rayson, as you guys probably all know, we are an infrastructure company. What we do best is create infra on blockchain. And Credora is no different. Credora is an infrastructure protocol. We set up infrastructure to monitor these hundreds of parameters. And whenever there is a meaningful change in one of these or more these, they can generate a change in the rating. We actually know it immediately and the rating gets updated within 24 hours as opposed to the 3 to 6 months that it takes in traditional finance to update the rating.

As I was saying, this maps out. This is a very small image. Let's see if we can zoom it in. We cannot. So, hopefully you can see it, but the way that we do the rating maps out pretty much one-to-one to tradfi rating or one-to-many, I should say. You have, you know, the A+ rating which has got a probability of significant loss, minimum and maximum, and maps to certain tradfi rating. So, even people that are quite familiar with how the tradfi rating system work, they will be able to understand it even if we simplified it a bit so that it's more legible for DeFi people and people that are not used

to see rating reports. This really helps when it comes to um the more, you know, institutional side of the rating consumers. And as I was mentioning, we are live and we launched this in November after the acquisition. We relaunched Credora. And from then, we had a number of success story. This slide actually is not even updated because we just rated listed Alchemix as um the last protocol that we did integrate with. So, that adds quite a bit to these numbers, but for all intents and purposes, you can see we rated over $10 billion in TVL. We have 100% of Spark coverage.

We have 90% of Morpho coverage. Uh there is over 250 Morpho markets that are rated by Credora. Because what we do believe and what Morpho believes as well is that the future of DeFi is not just yield and APY, which is the thing that we looked at for the past I don't know, maybe 10 years, but it's also risk. And a lot a lot of APY without an a risk assessment is meaningless.

Rating actually move markets, right? A lot of the questions that I get when I speak with people is okay, you do the rating, fantastic. This is a great nice-to-have, but does it actually make a difference? It's not a nice-to-have because of this. You have in rated markets a proven track record of increased investment. In the 5 days after we publish our Spark rating, Spark got over $200 million deposited in USDTs and USDS and USDCS across their saving vaults.

And this was an immediate spike. You can see it on the graph. You can probably figure out when we published the rating. And this graph, again, not updated. We are actually coming out with another communication with Spark with updated numbers on the case study of this on next week, but this number I guarantee you is much, much higher than than 200 millions and it's been over the past month. So, it's a very provable trust signal. Same behavior we saw it on Morpho, same behavior we're seeing it on Lista even if the rating has been published just a week ago.

Especially now, you obviously all familiar with all the risk and the hacks that have been happening in in DeFi in Italy. Ratings assume a very, very important position when it comes to understanding the risk profile that you're exposed to as an investor. And ratings in a certain way is just the start. Because in order to consume and utilize the power of the rating, we do believe that you absolutely need as a user a place to compare and see all the ratings against

each other. I rate something in isolation is usually not very helpful when you rate multiple things together, then obviously that specific number, that specific assessment becomes much more powerful. So, we launched the Credora dashboard. And the Credora dashboard is live at app.credora.network. You can see it there. There is all of the risk ratings that we did there, all in one place, which is a great thing on its own, right? This is already good cuz you can compare it, you can put one rating against each other and see like why a rating is higher or lower than another.

But also, and this I think is the king of feature of of this particular application, you can simulate a portfolio or even connect your wallet. You can just also give the wallet address, right? We don't need it necessarily a wallet connection. And figure out what is the average calculated risk profile of your portfolio investment. So, based on the ratings that we have of the asset and the vaults that we did, which as we said are hundreds, chances are that in your portfolio there's going to be those assets, there's going to be those vaults if you invest in DeFi, and you are able to simulate a position on the fly.

Even theoretically, you can say I can just want to put X amount of USDTs in this particular Morpho vault, and then X amount of this other asset in this Spark vault or whatever. And finally, out of our launch features, we have alerts. So, remember when I was saying the ratings are dynamic, right? They change. And we do believe that if a rating change, as a user, you should have the knowledge of what's happening. And if you have a specific investment in a specific vault that whose rating changes, you should be notified.

So, we do have that system of alerting users so that you can see, oh, something is happening, maybe I want to rebalance my portfolio, or maybe I want to, you know, take another look at this particular vault or this particular asset where I invested money in. There's more to come. These are just our launch features. This is very much of a I will not even call it a beta version. This is probably an alpha version of what this is going to be when it grows up, but we wanted to get something out quickly in order to try and be as helpful and as transparent as possible towards the DeFi ecosystem and towards the space.

What is next is a number of utilization, a number of algorithmic utilization of our rating as well as some very nice features that we are going to be adding. For example, in the Oracle, you can provide a real-time rating update directly on the price feed of a certain asset. This is something that we as Resonance uniquely positioned to do and and it's something that we're considering doing in the future.

We are covering already private credit. So, some of these rating you will see actually quite a few. They are still private. They're not publicly exposed rating because maybe the assets are private or maybe some of the liquidity of the asset is private and is confidential and is behind KYB or KYC, so the rating is as well. Uh you are able as an investor, for example, in the asset to access the rating report, but it's not publicly online available on the internet. But also we're working with insurance protocols like Catalysis, for example, that are utilizing the PSL as a trigger or as an underlying data to calculate premiums on insurance of certain Morpho

vaults. So, Catalysis just launched mainnet a couple of weeks ago and they're insuring vaults on Morpho. They're utilizing exclusively Credora data underlying. It's the only rating data that they're using. Obviously, they have their own pieces of data and their own algorithm, but they premium of each of the insurance position comes also from Credora rating. As well, we are seeing, for example, agentic applications that are allocating capital in different positions in different vaults based on the rating.

Uh we are seeing risk-oriented protocol designs that are using the rating as an underlying factor to even onboard certain assets or onboard certain vaults or create vaults in a specific way. Lotus comes to mind. Like our friends at Lotus, they created a lending protocol that is risk security first. So, they create vaults based on what the rating of the specific assets are. Uh and we're seeing, you know, programmatically risk-adjusted yield, live risk notifications, so on so forth. So, all of this is coming to DeFi and we're powering some of this already. Uh some of this are features that we're looking into releasing.

But, the main idea and the message I want to leave you with is we are moving as an industry. We started the one of you that have been around for a while know, we started from a very I would say somewhat speculative position of thinking a lot about API, thinking a lot about return in DeFi. And now we're in a position where we're growing up and we cannot just think about the API, we cannot just think about return. We need to be thinking about risk as well.

And as Credora, we want to be at the forefront and we are at the forefront of providing this information in a transparent in a risk-minimized, completely independent way across the system. I am going to leave you with our contact. If you want to build with us, just go scan the QR code. It goes to our website. There you can find not only all the ways to be in touch with us, all the Twitters and the Telegram groups and so on so forth, but more importantly, in the documentation section, the Credora methodology is public.

The calculations on the methodology, they are not for security reason, but the factors and what we are figuring out, what we're looking at, how we do the simulations, you find all there. There's a fantastic section that's called AutoRate Morpho and it talks about all the process that we use to rate the Morpho vaults. Very interesting bedtime read if you want. There's also PDF reports of examples of the ratings that we did. So, if you want to look at what a PDF is and what the rating report actually looks like, you can find it there as well. If you have any questions, I'm here to answer them. Otherwise, thank you so much for your time. It was lovely.

>> Thank you. Anyone has a question? Okay, yeah. >> Um yeah, thanks. I have a couple of questions about your methodology. Um so, I was wondering uh I would I would maybe read the details, but if you could quickly explain where this number is coming from because I think the the PSL because I think we see that a lot of um losses in DeFi come from hacks that are kind of unpredictable and you it's I'm not sure how you could quantify this. So, if somebody is looping USD, then maybe that's something you can track and you can erase the um evaluation, but for things like uh recent hack or I don't know, maybe did you have a

PSL for RS ETH? >> Yeah, excellent question. Uh This boils down to me to what are the factors that you look into, right? When you do the rating. I can how you weigh them against each other. That's basically what this question means. Uh the factors are many. So, we have two big set of factors. They're on-chain factors and and off-chain factors. The on-chain factors are the one that you can advance from a smart contract, right? So, where's the liquidity, which collateral, how much, and so on and so forth. The off-chain factors are much more interesting. Sometimes it's proof of reserve. Uh sometimes there factors around custody and who owns that custody? Or what is the operational security of a certain protocol? What is

the governance of a protocol? What is the regulatory profile of a protocol? So on and so forth. So all of these are taken into consideration. If you go to one of our Spark reports, uh you will see uh I don't have internet connection, so unfortunately I cannot show you live, but yeah, so you will see on Spark itself, on aptos.spark.fi, that we give an individual rating out of five to each one of these individual categories.

Within the category itself, there's indicators. And the way that we effectively stack rank these indicators against each other is by running thousands and thousands of simulations at different points by changing different factors, so that we simulate scenarios and we calculate risk based on the scenario. Some of this risk calculation is algorithmic and automated, but we always have a quant that is there to verify, like a person ultimately that looks at the results and verifies the rating and then publishes the rating. So we use automation and AI when it comes to running the simulation and and trying to

to loop around numbers and and create scenarios, but there's always like our quant analyst that ultimately look at the rating and do this process manually. >> And these scenarios, do they include these types of hacks as well? >> Yes, so we do again, we cannot disclose a whole lot about what it is, but yes, we do include operational security. Uh and as you saw all the recent hacks basically in crypto over the past couple of months, they were all operational security problems. Uh there was not programmatic hacks on, you know, the actual protocols. It was all about obsec. So, we already included operational security before, but in light of this, we updated

our methodology to to, you know, weight it in a bit more heavy way. >> Thank you. Um also, a couple of questions. Um I'll tell them right uh now and you you decide how to answer them. But, um would you like does your methodology will have spotted, for example, what happened to Gelb da layer zero? Like, does it does it consider a breach? Um breach risk in the methodologies that they use? And the second question is, and I think you addressed it a little bit at the end, how how do you think about the uh friction or trade-offs between having a transparent methodology versus uh that being gamed and like, you know, security reasons?

>> Yeah, excellent questions, both of them. The first question is is fairly easy to understand. You as a risk rating agency provide a risk factor. The prediction of an adverse event doesn't exist. And if if people could predict adverse events, by definition, the adverse event would not happen. So, you can predict how likely something is to break or or how risky something is, which is what we do. You can assess more than predict. I think that's a better word. But, you cannot predict on this day there will be there will be this hack, and it will be coming from this particular thing.

Um but at the same time, for example, for the Resolve hack that there was, which was probably the first hack that kicked off all of this like seasons of hack in uh in crypto that we had recently, Credora, before the acquisition even, they rated Resolve at a B- which minus, in financial terms, is a bad rating. Like, you don't want to be a B- minus. And this was back in I think mid-2025. I think it was June or July 2025. So, this was even before we acquired it. So, there is indicators and there are things, as I said, that take into consideration the operational security of a specific asset or specific protocol.

Um and this makes me nicely to your second question, which was around how much, you know, is good to disclose versus how you expose yourself to gamification. Our strategy is what you see in the documentation. So, we do disclose the methodology because we want to be transparent and we think it's important to be transparent. Uh Being a third-party rating agency or rating organ it removes the the trust me, bro, my product is best and is super safe narrative, right? If people rated themselves, this is what people effectively ask you to do.

We don't want to do that and not only we're independent, but we're also public. The way that the calculations happen and the weights of every single individual factor, that is not public, for example. So, you know what the things are, but if you have a little bit of, you know, common sense, you would know. Like everyone in this room knows, you know, this about the custody and the collateral asset and the operational security and the compliance and the regulatory profile and so on, right? The governance of the protocols and so on.

So, those things are quite public and we're very happy to explain how we look into those. The specific calculations, they are private so that we reduce the risk of people gamifying the uh the system. That said, it's not too bad if someone gamifies the system. So, as in if you look at a rating and it's a rating that you're not happy with and you change something in your protocol or in your asset or in your vault to get a better rating, that's a good thing.

So, we want that. We don't want people to do it in a non-organic way or in a in a fake way, but if a rating helps improve the safety of a specific vault, that's a great thing. It's a win-win for everybody. >> Yeah. Thank you very much. We run out of time. So, we >> Thank you.