DeFiScan

DeFiScan, launched by the DeFi Collective, aims to assess the decentralization level of DeFi protocols in a verifiable manner. Its framework categorizes protocols into stages from Stage 0 (fully centralized) to Stage 2 (no training wheels), introducing key metrics such as security councils and exit windows. In December 2024, DeFiScan updated its methodology to refine scoring for centralization risks of dependencies and adjusted security council requirements (e.g., proportion of non-insider signers). In March 2025, it further revised the framework to expand the security council's role to overseeing governance exit windows, and released DeFiScan V2, built on L2BEAT's discovery and continuous monitoring technology, enabling automated review and real-time monitoring. These evolutions transform decentralization assessment from static ratings to a dynamic, verifiable system, providing users with more transparent risk references and prompting the industry to scrutinize "pseudo-decentralization."

DeFiScan, styled DEFISCAN, is an open-source DeFi protocol risk monitoring platform founded in 2024 and built by a team called the DeFi Collective, whose publicly identified member is tokenbrice.eth. The team describes over 30 years of combined experience across protocol engineering, smart contract security and financial regulation. It does not rank yields or aggregate TVL; it answers one question specifically: when you put money into a protocol, whose trust assumptions and which structures are you actually exposed to. It cites a finding that around 75 percent of ecosystem losses in 2025 came from access-control exploits, meaning compromised admin keys, governance attacks and privilege escalation, a category that unlike code bugs is structural and persists as long as privileged roles exist.

On methodology, DEFISCAN explicitly refuses to rely on documentation or team statements. Monitoring agents trace bytecode and verify state directly on-chain around the clock, so a trust posture cannot shift silently through a proxy upgrade or admin change. Each protocol is assessed across five dimensions in a Risk Radar: Admin Control, covering upgradeability, administrative privileges, protections and privilege ownership; Dependencies, covering underlying protocols, oracles and infrastructure; Governance, covering processes, execution delays and the funds governance can move; Code Verifiability, covering source availability and on-chain verifiability; and Access, covering availability through diverse independent frontends. Every data point links back to a specific contract address, transaction hash or governance action, and the entire scanning engine and rule set are open source.

Future strategy and roadmap: the positioning is to become the transparency layer for DeFi, serving funds and treasuries doing diligence before deploying capital, protocol teams wanting to demonstrate their security posture, researchers and auditors needing structured machine-readable governance and permissions data, and risk and compliance teams mapping trust assumptions to regulatory requirements. Disclosed ecosystem partners include the Ethereum Foundation and Liquity. The risk is that it remains early: RootData showed an information transparency score of only 47 percent, no disclosed funding and no token, so protocol coverage breadth and update cadence have yet to be tested. Whether verifiable risk becomes a paid demand also depends on institutions actually paying for third-party risk data, which is exactly where comparable security and data products have historically failed to scale.

TokenBrice — Co-founder; a core figure in the non-profit DeFi Collective and a long-standing DeFi researcher and advocate.

Nils Bundi — Board member and technical lead; DeFi protocol architect and developer with a background in financial engineering.

Florian — Board member; attorney at law focused on regulation and compliance.