Worked Example: Maple v2
The pattern shown here generalizes to every per-protocol grade on the dashboard. This page walks through one protocol end to end, using Maple v2 as the worked example. Three contracts are scored, each carries its own grade, and the three combine into a single per-protocol grade.
Snapshot taken: May 2026. Numbers shown are illustrative for teaching the read; the canonical numbers live on the Dimensions page and the live grades on the dashboard are the authoritative source. The grades below commit to two decimals; the tier band is the safer comparison unit when reading across protocols.
Maple v2 at a glance
Maple v2 is an institutional permissioned lending venue. Qualified depositors fund pools curated by pool delegates. Pool delegates underwrite loans to vetted institutional borrowers. The depositor surface is whitelisted; the loan side is off-chain underwritten with on-chain enforcement.
At the time of writing, three contracts on Maple v2 carry the smart contract risk grade for this protocol:
- MapleGlobals, the protocol's configuration contract: it holds protocol-wide configuration, including which addresses are permitted to act as pool delegates and lenders.
- GovernorTimelock, the time-delayed control surface: it gates privileged parameter changes behind a delay window, so admin actions cannot land instantly.
- PoolManagerFactory, the on-chain pool deployer: it produces a pool manager for each new pool, routing deposits and enforcing pool policy.
Two of these three contracts (MapleGlobals and GovernorTimelock) carry a protocol-wide blast radius despite a small code surface. That fact shapes the centrality weighting shown in the roll-up section.
The three contracts we score
The dimension rows in each panel below capture the two evidence families from the dimensions page: posture (what the deployed code and audit posture say today) and adversarial-behavior tests (whether the contract holds up under structured stress). The capping conditions row reports whether any of the three published caps has fired. See Dimensions for the full rubric.
MapleGlobals
The protocol's configuration contract is called MapleGlobals. It holds the curated list of pool delegates, the list of permitted lenders, the global parameter values, and the address of the timelock controller. Any contract that needs to ask "is this caller permitted" reads MapleGlobals.
The contract is upgradeable, with upgrade authority sitting behind GovernorTimelock. Audit coverage is strong (multiple firms, recent dates). The privileged role surface is moderate: a small set of addresses can rotate the pool delegate list and adjust global parameters, gated by the timelock delay. Historically, MapleGlobals has been the most central contract for any decision about who is allowed to act inside the protocol.
| Dimension | Per-contract grade (illustrative) | What drove it |
|---|---|---|
| Posture (machine-extractable) | 0.86 | Verified source, multiple recent audits, upgradeable but gated by the timelock, single-digit privileged roles |
| Adversarial-behavior tests | 0.82 | Pass with falsifier on authority recovery; concern on accounting drift under delegate rotation |
| Capping conditions | none firing | No unrestricted privileged action, no oracle precondition, source fully reviewable |
| Per-contract grade | 0.84 | Strong overall; lands in the Low Risk band |
GovernorTimelock
The time-delayed control surface is called GovernorTimelock. Sensitive parameter changes queue here and execute after a published delay. The contract's role is narrow: enforce the delay, execute on schedule, refuse to bypass.
The contract is non-upgradeable. The privileged role is tightly scoped to scheduled execution. Audit coverage is consistent. The delay window itself is the main behavioral guarantee for depositors: anything that affects the pool surface gets seen before it lands. In practice, the timelock is what limits the realistic blast radius of any single privileged action on MapleGlobals.
| Dimension | Per-contract grade (illustrative) | What drove it |
|---|---|---|
| Posture (machine-extractable) | 0.88 | Non-upgradeable, verified source, narrow role surface |
| Adversarial-behavior tests | 0.78 | Pass on delay enforcement; concern on emergency-action posture (no cancel path) |
| Capping conditions | none firing | Standard timelock pattern, fully reviewable |
| Per-contract grade | 0.82 | Low Risk; small downward pull from the emergency-action concern |
PoolManagerFactory
The on-chain pool deployer is called PoolManagerFactory. It produces a pool manager contract per pool, with a known shape and known initial parameters. After deployment, the per-pool managers operate independently; the factory does not retain ongoing authority over them.
The contract is non-upgradeable. The privileged role is narrow: deploy on request from authorized addresses (pool delegates registered in MapleGlobals). Audit coverage is strong. Historically, factories with this no-retained-authority shape have the smallest blast radius among Maple's scored contracts, which is why the centrality weight on this row is light.
| Dimension | Per-contract grade (illustrative) | What drove it |
|---|---|---|
| Posture (machine-extractable) | 0.84 | Non-upgradeable, verified source, narrow deployment role |
| Adversarial-behavior tests | 0.86 | Pass with falsifier on deployment-time invariant; standard factory pattern |
| Capping conditions | none firing | No path to alter deployed pool managers, no fund-handling surface |
| Per-contract grade | 0.85 | Reference Grade; the factory does not retain authority after deployment, which limits its risk surface |
From three grades to a protocol grade
The per-protocol grade for Maple v2 is the weighted geometric mean across the three per-contract grades, weighted by how central each contract is to the protocol.
| Contract | Per-contract grade | How central to the protocol | Why this weight |
|---|---|---|---|
| MapleGlobals | 0.84 | 1.00 | Protocol-wide configuration controls every pool; the most central contract |
| GovernorTimelock | 0.82 | 1.00 | Gates every privileged change protocol-wide; protocol-wide blast radius |
| PoolManagerFactory | 0.85 | 0.30 | Peripheral to the protocol; produces pool managers but does not retain authority over them after deployment |
The arithmetic step, with intermediates shown to four decimals:
ln(0.84) × 1.00 = -0.1744
ln(0.82) × 1.00 = -0.1985
ln(0.85) × 0.30 = -0.0488
-------
sum = -0.4217 (sum over contracts)
÷ 2.30 (sum of weights)
= -0.1834
exp(-0.1834) = 0.832
Maple v2 per-protocol grade: 0.83 (Low Risk band).
| Aggregation method | Maple v2 grade |
|---|---|
| Weighted geometric mean | 0.83 |
| Unweighted arithmetic mean | 0.84 |
The weighted geometric mean produces a slightly lower number than the unweighted average. PoolManagerFactory carries the highest individual grade (0.85) but only one-third the weight of the protocol-wide contracts, so its lift on the protocol grade is muted; the geometric mean is also structurally more conservative than the arithmetic mean when the inputs spread.
Reading the dashboard panel
The dashboard surfaces this protocol grade as a single tier chip on the Maple v2 row, with three secondary surfaces a reader can expand to:
- The per-protocol grade with its tier band (here, 0.83 / Low Risk).
- The per-contract drill-down: a row per scored contract showing the contract name, the per-contract grade, the contract's tier chip, and how central the contract is to the protocol.
- The per-dimension breakdown inside each contract row: the two evidence-family grades plus any capping condition that fired, with the same vocabulary used on the Dimensions page.
The grade carries a freshness timestamp showing when it was last evaluated. If a watch is still pending classification, the affected contract carries a pending indicator until review resolves it.
Why this grade landed where it did
Maple v2 lands in the Low Risk band today because the protocol-wide contracts (MapleGlobals, GovernorTimelock) score above 0.80 individually, the helper contract scores cleanly, no capping condition fires, and the timelock-gated upgrade authority on MapleGlobals narrows the surface for any single privileged action.
Six observations connect the per-contract evidence to the per-protocol grade:
- The upgrade authority on MapleGlobals is gated by GovernorTimelock with a published delay, making instant changes to the protocol's configuration structurally impossible.
- The delegate set is curated and rotated through the timelock, so depositors have a visible window before any change to who can act on their pools.
- GovernorTimelock is non-upgradeable and narrow in scope, narrowing the surface for governance-side attacks that would not show up in code-level analysis.
- PoolManagerFactory does not retain authority over deployed pool managers, so a compromise of the factory cannot reach back into live pools.
- If a capping condition were to fire on a peripherally-weighted contract like PoolManagerFactory, the weighted geometric mean would dampen the impact relative to the same cap on MapleGlobals or GovernorTimelock; the protocol grade would still move visibly because no weight reaches zero.
- A re-evaluation that shifts a per-contract grade by one tenth may not cross a tier boundary at the per-protocol level. Not every re-evaluation produces a visibly different dashboard grade.
If a future re-evaluation surfaced an unrestricted privileged action on any of the three contracts (the cap that pins a contract grade at the very-high-risk ceiling), the cap would pin that contract's grade and the per-protocol grade would compress through the weighted geometric mean toward the Moderate Risk band. For example, if MapleGlobals were found to expose an unrestricted privileged action, its capped grade would propagate into the roll-up unchanged, dropping the Maple v2 protocol grade well below today's Low Risk reading.
When the grade would move
The Maple v2 per-protocol grade would move on any of the following events:
- A code change on any of the three contracts: a meaningful change to the deployed code at MapleGlobals, GovernorTimelock, or PoolManagerFactory triggers a re-evaluation of that contract. The re-evaluation may produce the same grade (like-for-like upgrade) or a different one; not every detected change moves the grade visibly.
- A change to the curated list of scored contracts: if the curated list grows (a fourth contract added) or shrinks (one retired), the per-protocol grade is recomputed even if no individual contract changed.
- A documented methodology revision: a published, dated change to the rubric, the score reductions, or the capping ceilings would re-evaluate the protocol's grade.
- A new audit or incident analog landing: if a new audit covers a previously sparse surface, or a new public incident analog ties back to one of these contracts, the score reductions step would re-evaluate.
The following events would NOT move the smart contract risk grade for Maple v2:
- A pool delegate adding or removing a borrower from their underwriting list.
- A pool funding rate or pool-level parameter change applied through the timelock.
- A market event affecting the value of the underlying loans.
- A governance vote that does not change the contract code itself.
Market activity is covered by Market Risk. Governance votes, pool-level parameter changes, and timelock-routed admin actions are outside the three risk dimensions Ozone currently grades. See Monitoring for the full list of triggers and non-triggers.
Applying this read to other protocols
The same three-step read works for every protocol on the dashboard:
- Morpho Blue carries a single immutable contract in scope. The per-protocol grade equals the per-contract grade by construction; there is no aggregation. The structural posture of the singleton sets the grade.
- Morpho Vault (MetaMorpho) carries two factory contracts: a legacy factory and a current canonical factory. Both count toward the protocol grade by default. Their structural similarity drives the aggregate.
- AAVE V3 carries four contracts of mixed roles: the Pool, an oracle adapter, an access control manager, and an addresses provider. Two of the four (the access control manager and the addresses provider) carry protocol-wide blast radius despite helper-shaped functions, so their centrality weights are overridden upward and they dominate the protocol grade alongside the Pool.
- Pendle V2 carries six contracts: a market factory in canonical and legacy variants, a yield-contract factory in canonical and legacy variants, the router, and an oracle adapter. The canonical-and-legacy pairings keep the older variants in scope while the canonical replacements operate alongside; the protocol grade reflects both.
In every case: read the per-contract panels, check for capping conditions, look at how central each contract is to the protocol, and let the weighted geometric mean tell you which contract dominates the per-protocol grade. A single weak contract pulls the geometric mean down more than its arithmetic share, and central contracts carry more of the pull than peripheral ones; the protocol grade reflects both effects simultaneously.