Notes / Findings
Source: data/finding_2026-09-18-competitive-positioning-cross-chain-overlap.md in the repository, rendered here without changes. Source file
Scope: find new territory that the competition does not cover for the oracle, after two earlier, broader competitive scans this week already covered SolGov, Hypernative/Blockaid, Gauntlet/Chaos Labs/LlamaRisk, DeFiSafety, ERC-8241, RWA platforms, L2Beat's Stage rubric, Aave's internal governance levels, restake.watch, and DORA/MiCA. This pass deliberately asked four NARROW, falsifiable questions instead of repeating that general sweep, run as four independent research passes. Pure research -- no scorer file or contract is modified by this finding itself (the one concrete code change it led to, extending cross_ecosystem_overlap.py to Tempo and Arbitrum, is a separate, disclosed action documented in README.md's "Cross-ECOSYSTEM signer overlap" section, not silently bundled into this doc).
Checked SolGov, L2Beat, Gauntlet, Hypernative, Blockaid, DeFiSafety, and Credora/RedStone: all publish via dashboard, API, or a closed loop with one specific protocol's own contracts -- none expose a generic, callable on-chain score. Two real counter-examples exist for ADJACENT metrics, not authority risk: Shentu's Security Oracle (getSecurityScore(address, string) -> uint8, deployed on BSC at 0xE7F15597B7594E1516952001f57d022bA799b479, GitHub) scores code-audit confidence, appears dormant since 2021-2023. Chaos Labs' Edge Risk Oracle pushes live market-risk parameter updates directly into Aave's own Risk Stewards contract (Chaos Labs), but it's a closed loop between Chaos Labs and Aave specifically, not a generic third-party-integrable primitive, and it scores market risk, not admin-key/governance risk.
Conclusion: the architectural pattern (on-chain, contract-callable risk score) is proven for adjacent metrics, so the idea itself isn't unclaimed -- but none was found shipping it for authority/governance risk as a generalized primitive third parties can integrate against. ExampleConsumer.sol demonstrates exactly that, in a real gap.
Checked DAO grant/treasury committees, DeFi insurance protocols, RWA compliance/custody providers, and institutional risk desks. No documented RFP or paid engagement found for admin-key/multisig/timelock assessment specifically gating a DAO listing or grant (Aave pays Gauntlet/Chaos Labs ~$1.6-2.57M/yr, but for market/liquidation risk, not authority risk -- Messari, Aave governance). RWA issuers (Ondo) pay for general smart-contract security audits (Cantina, Zellic, FYEO, Cyfrin, Spearbit -- Ondo audits), not a distinct authority-risk product. Institutional desks (Fireblocks, CertiK SkyInsights) sell bundled "security risk" products where authority-risk isn't separately priced.
The one clear, documented, recurring paid market found: Sherlock prices DeFi coverage premiums (protocols pay USDC per coverage period) using research that explicitly includes "upgradability risks" and "emergency mechanisms" as pricing inputs (Sherlock docs). This is live money moving today, not a hypothetical DAO mandate -- the closest real precedent for who would pay for this oracle's data as an ongoing feed rather than a one-time report.
The most consequential question, given KelpDAO's 2026-04-18 $292M exploit (a 1-of-1 LayerZero DVN verifier -- see the dashboard's own incident panel). Checked L2Beat's Stage framework, DeFiSafety, post-KelpDAO LayerZero-DVN risk tooling specifically, and academic literature.
No project found does systematic, at-scale, cross-chain signer-identity overlap detection wired into a live score. L2Beat's Stage framework scores governance decentralization per-project; the Superchain Security Council's shared multisig across OP-stack chains is self-disclosed, not discovered by an automated cross-check (L2Beat Stages). Most tellingly: the tooling that emerged specifically IN RESPONSE to KelpDAO -- a Dune/Defiant analysis finding 47% of ~2,665 LayerZero OApps run 1-of-1 DVN configs, and Blockaid's DVN-configuration auditor (Dune/Defiant, Blockaid gist) -- only checks requiredDVNCount + optionalDVNThreshold <= 1 WITHIN a single OApp. It has no logic comparing DVN operator identities ACROSS different OApps or bridges. The exact failure class KelpDAO exposed (concentrated verification authority) produced tooling that measures threshold risk, never committee-overlap risk.
This project's own sister research, multisig-overlap (GitHub), already does same-chain and cross-L2 signer-identity overlap at real scale (75 mainnet + 79 Superchain Safes, 6+ confirmed cross-protocol/cross-chain cases). Nothing comparable in scale or systematicity turned up in the sources checked for this scan, for even the same-chain version of this check. Honest caveat: private tooling at firms like Chainalysis, TRM Labs, or Forta Enterprise could do this without public indexing -- not ruled out, just not found.
Ranked candidates, most to least compelling:
Honesty check on this list: Robinhood Chain itself (the chain, not the xStocks-style issuer layer) already has L2Beat bridge/rollup-risk coverage (TVS ~$1.08B) -- not claimable as white space, a fact this research confirmed rather than assumed.
cross_ecosystem_overlap.py to Tempo and Arbitrum, and re-running it live) is documented separately in README.md, not bundled into this research finding.Not an audit, not investment advice. All notes ยท Back to the dashboard.