[Ethereum] Badger DAO - Security Rating 3

Security Rating Database
#1

Security Rating Level: 3
Evaluation Date: Mar 31st, 2021

1. History & Team (Weight 20%; Score 72)

1.1 Project age (8%; 50)
Launched on mainnet from 2020 December, alive for 4 months
1.2 Past exploits (8%; 100)
Was never attacked
1.3 Team anonymity (2%; 100)
Team are public
1.4 Team experience in programming (2%; 20)
Unknown

2. Exposure (Weight 25%; Score 57.2)

2.1 Historical TVL (17.5%; 61)
Average market share in the past 2Q: 3.5%, 3.0%
Data collected from Badger DAO | Stats, Charts and Guide | DeFi Pulse
2.2 Industry segment (5%; 40)
Badger DAO is a yield aggregator
2.3 Infrastructure (2.5%; 65)
Oracle is needed for price feed (Chainlink), a decentralised single oracle

3. Audit (Weight 35%; Score 78)

Audit report available on: Zokyo on LinkedIn: Badger.Finance Smart Contract Audit Report and Building Defi for Bitcoin - Badger
3.1 Transparency and scope (14%; 100)
Full scope audit done, and report is public
3.2 Audit firm trust score (10.5%; 30)
Audited by Haechi and Zokyo, Tier 3 audit firm
3.3 Audit findings (10.5%; 80)
No critical issues were found in audit
3.4 Other credits (up to additive 5.25%; 5)
Core smart contracts audited by multiple firms

4. Code quality (Weight 15%; Score 40)

Repository on github: GitHub - Badger-Finance/badger-system
4.1 Documentation
No top level documentation exists but not in full details. Minimal comments
4.2 Test
Insufficient test suites

5. Developer community (Weight 5%; Score 88)

5.1 Bug bounty program (3.5%; 100)
Exists. Reward up to $500,000
5.2 Issues raised on Github (1.5%; 60)
3 issues raised on github repository

The N-SCOSS for Compound is 66.4, level 3

#2

Badger DAO is rated at security level at 3, as re-evaluated on 2021 December 20th.

Badger DAO lost score in pillar 1 since it was attacked once in 2021 December. However, this is compensated by its improved performance in Pillar 5. A more active developer activity indicated by increased rewards in bug bounty and more issues under discussion led to a score increase in pillar 5. Overall Badger DAO maintained its security level.

Below are the details of updated rating for Badger DAO based on data up to 2021 December 20th.

Security Rating Level: 3
Evaluation Date: Dec 20th, 2021

1. History & Team (Weight 20%; Score 64)

1.1 Project age (8%; 80)
Launched on mainnet from 2020 December, alive for 13 months
1.2 Past exploits (8%; 50)
In the past 12 months, BadgerDAO was attacked once in 2021 December
1.3 Team anonymity (2%; 100)
Team are public
1.4 Team experience in programming (2%; 20)
Unknown

2. Exposure (Weight 25%; Score 56.5)

2.1 Historical TVL (17.5%; 60)
Average market share in the past 4Q: 0.6%, 0.6%, 0.8%, 1.4%
Data collected from Badger-dao Protocol: TVL and stats - DefiLlama
2.2 Industry segment (5%; 40)
Badger DAO is a yield aggregator
2.3 Infrastructure (2.5%; 65)
Oracle is needed for price feed (Chainlink), a decentralised single oracle

3. Audit (Weight 35%; Score 78)

Audit report available on: Zokyo on LinkedIn: Badger.Finance Smart Contract Audit Report and Building Defi for Bitcoin - Badger
3.1 Transparency and scope (14%; 100)
Full scope audit done, and report is public
3.2 Audit firm trust score (10.5%; 30)
Audited by Haechi and Zokyo, Tier 3 audit firm
3.3 Audit findings (10.5%; 80)
No critical issues were found in audit
3.4 Other credits (up to additive 5.25%; 5)
Core smart contracts audited by multiple firms

4. Code quality (Weight 15%; Score 40)

Repository on github: GitHub - Badger-Finance/badger-system
4.1 Documentation
No top level documentation exists but not in full details. Minimal comments
4.2 Test
Insufficient test suites

5. Developer community (Weight 5%; Score 100)

5.1 Bug bounty program (3.5%; 100)
Exists. Reward up to $750,000
5.2 Issues raised on Github (1.5%; 100)
75 issues raised on github repository
(Note that the count of number of issues was different from last evaluation, changing from counting open issues only to open+closed issues. Such adjustment is to better reflect all historical discussion in github repository and hence a more precise measure of the developer activity)

The N-SCOSS for Compound is 65.225, level 3