DeFi

S&P Global Assigns Sky Protocol 'B-' Rating; Outlook Stable

Norbert Gehrke

02 Sep 2025 — 8 min read

At the beginning of August, S&P Global Ratings assigned its 'B-' issuer credit rating to Sky Protocol. The outlook is stable. Subsequently, S&P Global Ratings hosted webinar titled "Understanding Our Credit Approach to Sky," which detailed the methodology and rationale for assigning an inaugural credit rating to the decentralized lending protocol.

S&P's Broader Engagement in the Digital Asset Space

Before delving into the specifics of the Sky rating, context on S&P's broader activities within the digital asset ecosystem was provided. The Sky rating is not to be seen as an isolated event but part of a wider, ongoing effort to develop analytical frameworks for this emerging asset class.

Key initiatives highlighted include:

Stablecoin Stability Assessments: For the past 18 months, S&P has been publishing public assessments that rank major stablecoins against each other based on the risk of them losing their peg. These assessments focus on a relative comparison of stability rather than absolute creditworthiness.
Digital Bond Ratings: The agency has also been rating digital bonds—traditional debt instruments issued on blockchain technology by established issuers. This includes bonds on both private and public blockchains.
Tokenized Fund Ratings: More recently, S&P began rating tokenized funds. This surfaced a "full circle" moment where one of the tokenized funds S&P had previously rated appeared as an asset within the Sky Protocol's balance sheet, demonstrating the growing interconnectedness of the DeFi ecosystem.

These efforts underscore S&P's commitment to applying rigorous, structured analysis to various facets of the digital asset market, with the Sky credit rating being the latest and arguably most complex undertaking.

Understanding Sky: A Decentralized Protocol, Not a Company

Sky is not a legal entity in the traditional sense. It has no headquarters, no board of directors, and no corporate registration in a specific jurisdiction.

Instead, Sky is a decentralized autonomous organization (DAO) whose operations are governed by a set of smart contracts deployed on the Ethereum blockchain. Its primary function is to operate as a decentralized lending protocol that issues a stablecoin called USDS (which evolved from the well-known DAI stablecoin). USDS is the third-largest stablecoin by market capitalization, after Tether (USDT) and USD Coin (USDC).

The creation of USDS occurs through two main mechanisms:

Collateralized Lending: A user deposits crypto assets, predominantly Ether (ETH), into a smart contract vault and borrows USDS against this collateral. The protocol has specific collateralization requirements and limits to ensure that the value of the collateral significantly exceeds the value of the loan, creating a buffer against price volatility.
Peg Stability Module (PSM): Users can also create USDS by depositing other, more centralized stablecoins like USDC into the PSM, which then mints an equivalent amount of USDS on a one-to-one basis. This module is a key tool for maintaining the stablecoin's peg to the US dollar.

Once created, the borrowed USDS enters circulation. Borrowers can use it to acquire other assets or pay for services. Holders of USDS can also deposit it back into the protocol's savings contract (sUSDS) to earn a yield, which is generated from the stability fees (interest) paid by borrowers.

While the protocol itself is a decentralized network of code, it does interact with the traditional legal world by establishing legal entities in jurisdictions like the Cayman Islands. These entities are used for specific purposes, such as holding the "real-world assets" (RWAs) that are increasingly becoming part of the protocol's collateral base.

Defining the Ratable Promise: What is a DeFi "Default"?

A core challenge in applying a traditional credit rating framework to a DeFi protocol was defining what constitutes a "default." An S&P credit rating is an assessment of an entity's overall capacity and willingness to meet its financial obligations in full and on time. On S&P's global scale, a 'D' rating signifies a default. The question for Sky, therefore, was to identify its financial obligations and the conditions under which it would fail to meet them.

S&P defined Sky Protocol's primary financial obligations as its liabilities to the holders of its stablecoin, USDS, and its savings product, sUSDS. The "event of default," in this context, would be the imposition of a haircut on these holders.

This scenario would be triggered as a last-resort measure if the protocol were to experience severe losses—for instance, from a sharp drop in collateral value that liquidations failed to cover—that exhausted its available capital buffers. The protocol's governing document, known as the "Atlas," explicitly outlines this haircut mechanism as the final step in resolving a state of insolvency. Therefore, the 'B-' rating is fundamentally an assessment of the likelihood that the protocol will need to resort to this haircut mechanism to remain solvent.

While the context is novel, many of the underlying analytical concepts are comparable to those used for traditional lenders. The assessment still revolves around core principles like:

Capital Sufficiency: Does the protocol have enough capital to absorb potential losses?
Risk Management: How does it manage credit, market, and operational risks?
Liquidity Management: Can it meet its on-demand obligations?

However, applying these principles is complicated by unique challenges, including the pervasive legal and regulatory uncertainty surrounding DAOs, Sky's novel and evolving governance structure, and the unprecedented nature of its capital and liquidity sources and risks.

Governance: Centralization in a Decentralized World

Sky's governance structure is a critical component of the rating analysis. In theory, the protocol is governed by the holders of its governance token. The more tokens one holds, the greater their voting power. The process is designed to be community-driven, with proposals debated transparently on a public forum before being put to a vote.

In practice, however, the governance is still highly centralized. The protocol's founder, Rune Christensen, continues to wield significant influence over most major decisions, despite directly holding only around 9% of the governance tokens. This outsized influence is a result of two factors: low voter turnout among the broader token holder community and the practice of many holders delegating their voting power.

This centralization creates a significant key person risk, where the protocol's strategic direction is heavily dependent on a single individual. S&P also noted concentration in other key roles, such as facilitators and protocol advisors, which are intended to become more decentralized over time.

Other governance risks identified include:

Hostile Proposals: Low voter turnout makes the protocol more vulnerable to hostile takeover attempts, where a malicious actor could accumulate enough voting power to pass a proposal that drains the protocol's assets. Some such attempts have been observed in the past.
Self-Referential Risk: The protocol allows users to borrow against its own governance token. This is inherently risky, as a drop in the token's price could trigger liquidations, which in turn could lead to a further price drop and potentially an unplanned change in control over the protocol's governance.

The entire governance model is a work in progress, part of a long-term strategic overhaul known as the "Endgame" project. This state of flux adds another layer of uncertainty to the analysis.

Regulatory Landscape and Future Impact

The discussion touched upon the evolving regulatory environment, addressing the potential impact of legislation like the proposed stablecoin bills in the US. These bills primarily target stablecoins that are directly redeemable for US dollars from the issuer. Since Sky's USDS does not fit this model, the direct impact is limited.

The immediate consequence is that Sky is not well-positioned to benefit from any growth in the adoption of fully regulated stablecoins within the US financial system. However, there is an indirect benefit: by providing greater clarity and safety around stablecoins like USDC (which Sky holds as collateral), the regulation could reduce the risk profile of Sky's own balance sheet.

The far more significant regulatory development, however, will be the creation of comprehensive legal frameworks for DeFi protocols and DAOs themselves. While this is not expected in the near term, regulators globally are beginning to grapple with these issues. The future impact of such regulation is a major unknown and could be either positive (by providing legal clarity and fostering adoption) or negative (by imposing restrictive compliance burdens).

Dissecting the Balance Sheet: Capital, Funding, and Liquidity

S&P Global provided a detailed breakdown of its quantitative analysis of Sky's balance sheet, focusing on capital, funding, and liquidity.

Capital Sufficiency:
The core of the capital analysis involved applying specific risk weights to Sky's various asset classes to calculate a Risk-Adjusted Capital (RAC) ratio. The key risk weights were:

Crypto-backed Loans (over 50% of assets): A 75% risk weight was applied. This reflects the risk that although liquidations are automated and typically efficient, a severe and rapid market crash could cause losses if liquidations are delayed or experience "slippage" (selling at a lower price than expected). The weight is calibrated based on worst-case historical price declines over a stressed liquidation period.
USDC (held in the PSM): A 15% risk weight was used. This is based on a "look-through" approach to USDC's underlying reserves (T-bills and bank cash) and aligns with the Basel framework's treatment for high-quality sovereign and bank exposures.
Ethena's USDe (a "synthetic dollar"): A 1,250% risk weight was applied, effectively requiring the protocol to hold capital equal to 100% of the exposure. This extremely high weight is due to the novel and complex mechanism USDe uses to maintain its value, which involves hedged crypto positions. S&P views this as a high-risk, unproven asset, aligning with the Basel framework's treatment for the riskiest category of crypto assets.

A critical weakness identified in Sky's capital position is that its main capital buffer (the Surplus Reserve) is a fixed amount (around 70 million USDS) and is not dynamically adjusted as the risk profile of its asset base changes.

Funding and Liquidity:
Sky's funding structure is a strength. Since its funding comes entirely from the stablecoins it issues, which are created in tandem with its loan assets, there is a natural match and no external refinancing risk.

The primary risk, therefore, is liquidity. Since all of its liabilities are redeemable on-demand, the key risk is a "bank run" scenario where a large number of USDS holders attempt to redeem their tokens for USDC at the same time, potentially depleting the protocol's USDC reserves.

Mitigants for this risk include:

Maintaining a substantial liquidity buffer of stablecoins, targeted at 20-30% of total assets.
The ability of governance to rapidly increase interest rates on savings and borrowing to incentivize liquidity to stay within the protocol.

However, a significant vulnerability is depositor concentration. This risk was highlighted by a recent event where the Ethena protocol deposited approximately $1.5 billion into Sky's savings module, creating a massive single point of potential withdrawal. While that specific concentration has since unwound, it illustrates the potential for future concentrations to pose a severe threat to liquidity.

Conclusion: Key Takeaways from the Rating

The webinar concluded with a Q&A session that reinforced several key themes. The path to a rating upgrade for Sky is challenging and would require significant maturation, including a more dynamic capital framework, genuine decentralization of its governance, and greater diversification among its user base.

Conversely, a downgrade could be triggered by events such as a severe liquidity crisis, credit losses that overwhelm its capital buffer, or adverse regulatory actions. The analysis confirms that while DeFi protocols operate with novel technology, their financial risks can be assessed through a modified version of traditional credit principles, focusing on capital adequacy, risk management, governance strength, and liquidity resilience. The 'B- stable' rating ultimately reflects the protocol's innovative but still-developing nature, acknowledging its inherent strengths in funding while flagging significant risks related to its volatile asset base, centralized governance, and unproven resilience in the face of extreme market stress.