S&P Global has launched a Vault Risk Assessment framework to evaluate risk in crypto lending vaults, a market that has expanded significantly in recent years. The framework debuted on October 4, the same day a security incident on the Coinbase-backed Base network highlighted structural vulnerabilities in vault products.
Deposits in crypto vaults reached approximately $10 billion in September, according to S&P, up from $1.5 billion two years earlier. The new assessment framework aims to standardize how investors and institutions evaluate the likelihood of impairment in these products.
On the day of the framework's launch, blockchain security firm CertiK identified suspicious activity involving an unnamed vault on Base. A newly deployed proxy borrowed approximately 1,783 aBaswstETH, valued at roughly $6 million, from the vault before redeeming the tokens through Aave for around 1,783 wstETH. The incident did not exploit Aave itself but instead exposed risks created by the contracts, permissions, and managers positioned between deposits and underlying lending protocols.
Vaults pool investor assets and allocate them according to predefined strategies, either through automated smart contracts or human managers called curators. Investors receive tokens representing claims on pooled assets and returns. As vaults grow more prevalent, they increasingly function as onchain versions of managed investment products, replicating structures associated with money-market, private-credit, private-equity, and hedge funds.
S&P's framework evaluates six areas: portfolio credit quality, liquidity mismatch, curator risk, blockchain risk, protocol risk, and vault security and governance. The assessment goes beyond point-in-time blockchain transparency to examine how a vault could behave under changing conditions.
S&P uses a "(v)" suffix for vault assessments, with AAA(v) representing the lowest relative risk category. The agency describes these as forward-looking opinions about relative risk of impairment. They are not credit ratings, do not assess expected yields, and do not guarantee investor capital recovery. Assessments can change as eligible assets, risk profiles, smart-contract features, or liquidity conditions evolve.
S&P indicated it will publish individual vault assessments in future announcements. Those grades could provide institutional allocators with a common benchmark for comparing strategies in a market that has grown nearly sevenfold in two years, while potentially raising returns expectations for weaker-rated products.
