Angle Protocol
DAMASCUSStablecoin · Multi-chain · $200M+ TVL · 15 contracts
Public risk assessment — scores are produced with the same methodology as monitored protocols
Security Profile
78
72
65
75
68
75
50
82
70
100
78
72
65
75
68
75
50
82
70
100
Audit History
Bug Bounty Program
Assessment
Well-audited EUR stablecoin with simple architecture but smaller team, limited adversarial exposure, and oracle complexity. Below DAMASCUS due to Guardian centralization risks, opaque oracle config, and lack of active bounty program. Above FORGED due to clean audit history, standard patterns, and no exploit history.
Dimension Breakdown
How scores work →- Two-tier access: onlyGovernor (full power) + onlyGuardian (ops/fees)
- Minter role pattern on AgToken restricts supply inflation
- ProxyAdmin owned by Governor timelock -- upgrade path gated
- Guardian can set fees and pause without timelock -- ops flexibility vs risk tradeoff
- No granular per-collateral admin roles (single Guardian controls all)
- 1:1 swap model with fee curves avoids complex liquidation logic
- Savings vault uses linear rate accrual (no compounding rounding risk)
- Rate capped by maxRate governor param prevents runaway yield
- No flash mint capability limits inflation attack surface
- Fee curve manipulation by Guardian could theoretically extract MEV
- Redemption curve during depeg events introduces slippage risk
- Oracle config per collateral -- flexible but complex
- Supports Chainlink, Redstone, Pyth, custom feeds
- updateOracle is permissionless -- anyone can trigger refresh
- Oracle config is opaque bytes blob -- harder to audit on-chain
- EUR/USD pair less liquid than USD pairs on Chainlink
- No explicit staleness check exposed in Transmuter interface
- Protocol live since Nov 2021 (42 months), Transmuter since Jun 2023
- No critical exploits on current Transmuter architecture
- V1 (StableMaster) deprecated -- clean migration to V2
- Multiple audits: Chainsecurity, Code4rena, Sigma Prime
- Z-factor: 0.70 (Transmuter), 0.83 (AgToken)
- TVL peaked higher (~$500M) but stabilized at ~$30M -- smaller attack surface
- OZ Governor with veANGLE voting -- standard pattern
- Timelock on execution path for governance proposals
- Guardian multisig has significant direct power (fees, pause, rates)
- Guardian can effectively DoS protocol by pausing all collaterals
- veANGLE concentration risk not publicly measured
- Moderate governance activity -- fewer proposals than top-tier protocols
- No active bug bounty program on major platforms currently
- Code4rena contest found issues in V2 design phase
- Transmuter architecture is simpler than V1 -- reduced attack surface
- EUR-focused protocol receives less adversarial attention than USD stablecoins
- No formal verification of core invariants
- No validated adversarial findings — score set to neutral baseline
- Angle Labs operates with professional team
- Guardian multisig for operational actions
- Active on-chain governance participation
- Smaller team than top-tier protocols
- Less public incident response history to evaluate
- Simple architecture: Token + Transmuter + Savings (3 core contracts)
- ERC-4626 standard for savings enables clean integration
- Minimal external DeFi dependencies in core
- Collateral tokens are external dependency surface
- Cross-chain deployments (Arbitrum, Optimism, etc.) add composition risk
- Member of 2 dependency cluster(s)
- No cross-protocol cascade exposure detected
- Score: 100/100 (higher = more isolated from systemic risk)
- Source: cross_protocol_composition.json dependency analysis
- OpenZeppelin contracts (Governor, Proxy, ERC20, ERC4626)
- Solidity 0.8.x with built-in overflow protection
- Verified source on Etherscan
- Standard dependency management
Risk Drivers
Primary risk factors driving this score, ordered by severity.
Adversarial Risk Signals
Observable security posture indicators. These signals reflect publicly verifiable information and responsible disclosure outcomes. No specific vulnerability details are exposed.
Score History & Verification
Score provenance tracking begins with the next reassessment.
On-Chain Data
- Protocol Slug
- "angle"
- Oracle
- BRORegistry (Base)
- Evidence
- IPFS (pinned)
- Staleness Threshold
- 24 hours
registry.getScore("angle")Reduce exploitable risk
BlackHart Monitoring provides continuous adversarial analysis, vulnerability detection, remediation support, and verified reassessment when your risk posture improves.