This note details how Clearstar conducts Improvements and Engagement with protocols whose yield opportunities have not achieved a passing risk tier or have received grades that require remediation. It is a part of the Capital Allocation Framework.
Improvements and engagement are not rejection; they are a structured feedback loop. When the APB Risk Rating identifies issues, whether through an F-grade disqualification, a Tier 5 outcome, or D-grade conditions that the protocol could address, Clearstar engages directly with the protocol team to communicate the findings, suggest improvements, and gather additional information that may not have been available during the initial due diligence.
This stage exists because many issues identified during due diligence are fixable. Common examples include missing timelocks on admin functions, unverified contract ownership, misconfigured role-based access control, and undocumented MPC wallet setups behind externally owned accounts. In practice, protocol teams are often receptive to these suggestions, as the improvements strengthen their security posture regardless of whether they proceed with Clearstar.
<aside> <img src="/icons/warning_red.svg" alt="/icons/warning_red.svg" width="40px" />
Not all opportunities enter this stage Only opportunities where Clearstar believes the issues are addressable and the protocol team is reachable are routed here. If the findings indicate a fundamental design flaw, an irreconcilable trust assumption, or the protocol team is unresponsive, the opportunity is declined outright.
</aside>
flowchart TD
A[APB Risk Rating outcome] --> B{Outcome type?}
B -->|F-grade disqualification| C[Identify affected DD tracks and areas]
B -->|Tier 5 rejection| C
B -->|D-grade conditions on passing tier| D[Document conditions and improvable areas]
C --> E{Issues addressable?}
E -->|No| F[Opportunity declined]
E -->|Yes| G[Initiate engagement with protocol team]
D --> G
G --> H[Communicate findings and suggestions]
H --> I[Protocol team responds]
I --> J{New information or changes made?}
J -->|Yes| K[Rerun affected DD tracks]
J -->|No / Unresponsive| F
K --> L[Recalculate APB Risk Rating]
L --> M{Improved tier?}
M -->|Pass| N[Proceed to Whitelisting]
M -->|Still failing| O{Further improvements possible?}
O -->|Yes| G
O -->|No| F
style A fill:#4A90D9,stroke:#2E6BA6,color:#fff
style B fill:#E8A838,stroke:#B8862D,color:#fff
style F fill:#D9534F,stroke:#A94442,color:#fff
style G fill:#E8A838,stroke:#B8862D,color:#fff
style K fill:#4A90D9,stroke:#2E6BA6,color:#fff
style L fill:#4A90D9,stroke:#2E6BA6,color:#fff
style N fill:#5BB85B,stroke:#3D8B3D,color:#fff
An opportunity enters Improvements and Engagement when one or more of the following conditions are met:
| Trigger | Source | Description |
|---|---|---|
| F-grade disqualification | APB Risk Rating Step 1 | Any single F grade in any assessment area across any DD track |
| Tier 5 rejection | APB Risk Rating Step 4 | Composite score above 3.75, even without an F grade |
| D-grade with improvement potential | APB Risk Rating Step 5 | A passing tier (1 through 4) with D-graded areas that the analyst believes the protocol could address |
| Analyst-initiated engagement | Any DD track | An analyst identifies an issue during Specific DD that could be resolved through direct engagement, even before the APB Risk Rating is produced |
<aside> <img src="/icons/info-alternate_blue.svg" alt="/icons/info-alternate_blue.svg" width="40px" />
D-grade engagement is optional For opportunities that have already achieved a passing tier, engagement on D-graded areas is at the senior analyst's discretion. The opportunity can already proceed to the Whitelisting stage with D-grade conditions attached; engagement is pursued only where the analyst believes the protocol is likely to address the issue and the improvement would materially reduce risk.
</aside>
The issues identified during due diligence that most frequently lead to engagement fall into a small number of recurring categories. The table below lists the most common patterns, the typical DD area where they surface, and the engagement approach.
| Finding | Typical DD Area | Typical Grade | Engagement Approach |
|---|---|---|---|
| Contract owned by a single EOA | Governance and Access Control (General Due Diligence) | F | Request details on whether the EOA is part of an MPC wallet setup (e.g. Fireblocks, ForDeFi). If so, request an audit of the MPC configuration. |
| No timelock on admin functions | Governance and Access Control (General Due Diligence) | D or F | Suggest adding a timelock (typically 24 to 48 hours) on high-impact parameter changes. |
| Misconfigured or undocumented RBAC | Governance and Access Control (General Due Diligence) | D or F | Request documentation of the role hierarchy. If roles are correctly configured but VALIS could not parse a non-standard pattern, request on-chain verification data. |
| Unverified proxy implementation | Smart Contract Security (General Due Diligence) | D | Request details on the upgrade mechanism, including who controls upgrades and whether a timelock is in place. |
| Missing or outdated audit | Smart Contract Security (General Due Diligence) | D or F | Recommend the protocol commission an audit from a reputable firm. Provide a list of findings that the audit should cover. |
| Stale oracle configuration | Oracle Security (General Due Diligence) | C or D | Suggest tightening freshness checks and adding fallback mechanisms. |
| Bridge with unverified security model | Bridge Security and Cross-Chain Risk (Blockchain Due Diligence) | D or F | Request documentation of the bridge's trust assumptions, multisig configuration, and incident history. |
| Concentrated token supply | Ownership and Supply Distribution (Asset Due Diligence) | D | Request disclosure of vesting schedules, lock-up agreements, and any planned distributions. |
<aside> <img src="/icons/list_purple.svg" alt="/icons/list_purple.svg" width="40px" />
Example: EOA ownership resolved by MPC wallet disclosure During General Due Diligence, VALIS identifies that a core vault contract is owned by a single externally owned account (EOA). This receives an F grade in Governance and Access Control, triggering automatic disqualification at the APB Risk Rating F-grade gate.
The analyst contacts the protocol team, who explains that the EOA is a signer address within a ForDeFi MPC wallet with a 3-of-5 approval threshold. The protocol provides:
The analyst reviews the MPC setup, confirms the approval threshold, and verifies recent transaction signatures against the policy. VALIS is rerun with the updated context, and the Governance and Access Control grade is upgraded from F to B. The opportunity re-enters the APB Risk Rating process and passes the F-grade gate.
</aside>