Published in full, versioned, and applied mechanically. The grade measures whether a token can betray you in ways it hasn't disclosed — not whether it is a good investment. Changes ship with a public changelog entry; every published score is stamped with the version that produced it.
| Dimension | Weight | Question it answers |
|---|---|---|
| Supply Integrity | 20 | Can the number of tokens change outside disclosed rules? Mint paths, latent proxy-mint, transfer hooks. |
| Admin Surface & Upgradeability | 20* | Who can do what to the contract, and what gates them — owner, roles, proxies, pause/blacklist/fee switches. (*15 when Governance Reality applies.) |
| Disclosure Integrity | 15 | The docs-vs-chain gap: every checkable claim the project makes, verified against live chain state. |
| Insider Float & Vesting | 15 | How much can insiders sell today, and is the lock code or a promise? |
| Liquidity Permanence | 15 | Can the pool be pulled? LP burned/locked share, locker identity (allowlisted only), expiry. |
| Operational Track Record | 10 | Trust as a time series: age, unannounced admin actions, commitments kept. |
| Holder Concentration | 5 | Top-10 share excluding labeled non-circulating addresses. |
| Governance Reality | 5† | If governance is claimed — is it real or theater? (†Only when claimed; otherwise the weight returns to Admin Surface.) |
Supply and admin weigh most because they are the two vectors that can take 100% of holder value in one transaction. Concentration weighs least because address labeling is the noisiest data — its extremes are handled by hard caps instead. Missing data always surfaces as reduced coverage (●/◐/○), never as a fabricated score.
Assay extracts the machine-checkable claims a project makes in its own material — each recorded with a verbatim quote and source URL — and verifies each against chain state on every scan: VERIFIED, FALSE, UNVERIFIABLE, STALE, or FORWARD-LOOKING. Present-tense claims (“liquidity is locked”) are checked now; forward-looking promises become tracked commitments with deadlines and turn FALSE only if the deadline passes unmet. Undisclosed on-chain powers count as omissions; honest self-disclosure of warts scores up. Off-chain claims (team, partnerships, “backed by”) are marked UNVERIFIABLE — never verified, never contradicted.
Scale: A+, A, A−, B+, B, B−, C, D, F, plus N/R (unratable) and a Provisional badge under 12 months. Numeric bands: A ≥ 85 (A+ ≥ 95), B 70–84, C 55–69, D 40–54, F < 40. The overall grade is min(weighted average, hard caps) — a pure average would let beautiful documentation buy back a mint backdoor; pure weakest-link would give projects no gradient to climb.
| Trigger | Overall cap |
|---|---|
| Unverified source code | C |
| Mint/issuance whose classified controller is an EOA | F |
| Mint path present, controller unclassifiable (insufficient data) | C |
| Upgradeable with EOA admin, no timelock | D |
| Materially false safety claim (verified FALSE) | D |
| >50% of primary liquidity withdrawable by one key | D |
| Historical commitment violation | D (→ C after 24 clean months) |
| Insider liquid float > 30% | C |
| Top-10 unlabeled holders > 50% | C |
| Less than half of material claims verifiable | B |
| No machine-checkable disclosures at all (claim-light) | B+ |
| Age < 24 months | A |
| Age < 12 months | A− + Provisional |
| Age < 6 months | B+ + Provisional |
A B+ from a disclosed custodial stablecoin and a B+ from a young fixed-supply token are different kinds of B+. Every grade carries a badge saying which kind of trust you are extending: Code-Enforced (no admin exists), Governance-Gated (powers behind binding on-chain governance and timelocks), Custodial (powers behind an issuer or multisig; “disclosed” when the docs enumerate them honestly), Bridged (canonical) (issuance restricted on-chain to an allowlisted canonical bridge), or Discretionary (someone can act unilaterally).
The standard profile above treats disclosed, purpose-consistent centralization as if it were a hidden rug risk — the right default for a project token, the wrong lens for a fiat stablecoin or a canonical bridge wrapper. A category profile re-weights the dimensions and re-labels a few of them so a token is graded for what it actually is. Profiles are assigned only by hand, in the public reviewed registry; auto-discovered tokens always score the standard profile, and every report, index row and history line is stamped with the profile used.
A profile never grants a free pass. It only re-weights and re-labels; every anchor it raises and every cap it relaxes additionally requires positive, per-scan evidence — an approved issuer disclosure that verifies against the chain, or an on-chain canonical-bridge classification. Without that evidence a profile falls back to “insufficient data” (a C ceiling), never to a good grade. And the structural caps a profile relaxes stay printed on the report, marked waived with the evidence that waives them — the underlying fact is never deleted, only kept out of the grade ceiling.
| Profile | What changes | What still fails it |
|---|---|---|
| Fiat stablecoin Custodial wrapped |
Issuance and administration re-anchor to “disclosed custodial control” only while an approved admin-disclosure claim verifies, every scan, that every on-chain power is enumerated in the issuer's own material. Insider float and holder concentration are N/A (no insiders exist for issuance-based supply). Liquidity permanence is replaced by Redeemability, which is out of automated scope in v0.2 — it lowers coverage, never guesses. A permanent cap holds these at B+: a custodial issuer never reaches A. | A materially false claim still caps at D. No verified disclosure → capped at C (insufficient data). An undisclosed on-chain power flips the disclosure claim FALSE, which collapses the anchors and caps at D — automatically, on the next scan. |
| Bridged (canonical) | When minting is verified on-chain to be restricted to an allowlisted canonical bridge, issuance and admin anchor high and the report carries a derivative-trust note (the grade covers the wrapper contract, not the parent-chain asset or the bridge operator). Liquidity permanence is N/A — a canonical wrapper makes no LP-lock promise. | If the bridge check does not pass, the token falls back to the standard treatment. Non-canonical bridges cannot receive this profile. |
| Native representation | A bridged form of another chain's native coin publishes its on-chain facts with no letter grade (state NS — Not Scored): Assay's automated methodology grades token contracts, not an L1's consensus or its bridge operators. | — |
Two kinds of “no score” are kept distinct: N/A means the concept does not apply (there are no insiders in issuance-based supply), and it costs no coverage; out of automated scope means the concept applies but cannot be machine-checked yet (redeemability), and it lowers coverage rather than being guessed.
v0.2.1 — The rug-ready cap now fires only when a single key can withdraw more than half of a token's total tracked liquidity — the “primary liquidity” the rule already names — instead of whenever any pool with non-zero liquidity is one-key-withdrawable. A dominant pool that is itself EOA-held is still scored zero on liquidity, so this only stops a small EOA-controlled side pool from imposing a fatal grade on an otherwise-sound token. The cap now reports the withdrawable share and names the largest offending pool. Standard-profile grades are otherwise unchanged.
v0.2.0 — Category profiles (see above). Fiat stablecoins and custodian-wrapped assets are scored for what they claim to be: issuer-controlled issuance and administration anchor upward only while the issuer's own disclosures verify against the chain on every scan, redeemability replaces liquidity permanence (out of automated scope, shown as reduced coverage), and custodial issuers are permanently capped at B+. Canonical-bridge tokens are graded on their wrapper with the bridge verified on-chain; bridged forms of L1 native coins publish facts without a letter (NS). Profiles are assigned only in the public reviewed registry, and any cap a profile waives stays visible on the report. Also fixed in this version: a dominant pool whose lock status cannot be analyzed now reads as insufficient data (lower coverage) instead of “mostly unlocked”. Standard-profile scores are unchanged from v0.1.
v0.1.0 — Initial public methodology: eight dimensions, hybrid aggregation with the cap table above, claims verdicts (six deterministic verifier types), Trust Model badges, coverage indicator, COI carve-out.