Area scoresFour areas. The lowest sets the stars.
Depositor Protection85Multisig 3/5 and a 48-hour timelock; one signer can pause markets without a timelock.
Market Stress75Strong oracle; a depeg of the main collateral leaves bad debt of 1.2% of TVL.
Exit & Liquidity60Sets the ratingA withdrawal of 30% of TVL enters a 40-hour queue.
Safety Assist95Two recent audits, a 500,000 USD bounty, no incidents.
Overall 81 is weighted 40/25/15/20. The rating is 3 stars because Exit & Liquidity scored 60, and three stars needs 60 in every area.
Scenario resultsFive crashes, one fork.
Frontal Drain✓HELD14 attack vectors tested, no loss
SetupRun the common attack classes against the contracts: reentrancy, rounding and precision, access control, flash loans, and donation attacks.
Measured14 attack vectors tested, no loss
Fork and scriptBase · block 22,000,000. Script published after the 14-day fix window.
Pole Test!DEGRADEDOne signer can pause markets instantly; cannot move funds
SetupAssume one privileged key (admin, owner, or one signer) is leaked or misused.
MeasuredOne signer can pause markets instantly; cannot move funds
Fork and scriptBase · block 22,000,000. Script published after the 14-day fix window.
Side Impact✓HELDA 30-minute TWAP held against ±30% manipulation
SetupMove the oracle price by 30% in either direction for one block, or through a flash loan on the source pool.
MeasuredA 30-minute TWAP held against ±30% manipulation
Fork and scriptBase · block 22,000,000. Script published after the 14-day fix window.
Rollover!DEGRADEDBad debt of 1.2% of TVL at a depeg to 0.80
SetupThe main collateral or stablecoin depegs to 0.80 for six hours.
MeasuredBad debt of 1.2% of TVL at a depeg to 0.80
Fork and scriptBase · block 22,000,000. Script published after the 14-day fix window.
Rear Impact!DEGRADEDA 40-hour queue, slippage of 1.8%
Setup30% of TVL is withdrawn within 24 hours by many addresses.
MeasuredA 40-hour queue, slippage of 1.8%
Fork and scriptBase · block 22,000,000. Script published after the 14-day fix window.
Key findingsWhat the lab found.
- No user funds were lost across 14 tested attack vectors.
- One signer can pause markets instantly. That signer cannot move funds.
- A 30-minute TWAP held the oracle against a ±30% manipulation.
- A depeg of the main collateral to 0.80 left bad debt of 1.2% of TVL.
- Under a run, withdrawals entered a 40-hour queue with slippage of 1.8%.
RubricHow the points are set.
Depositor Protection · 100 points
| Sub-criterion | Points | Full | Half | Zero |
|---|---|---|---|---|
| Frontal Drain scenario | 30 | Held | Degraded | Failed |
| Pole Test scenario | 20 | Held | Degraded | Failed |
| Admin control (multisig) | 15 | Multisig of 3/5 or more with independent signers | Multisig 2/3 | Single key (EOA) |
| Upgrade timelock | 15 | 48 hours or more | 24 to 48 hours | Under 24 hours, or none |
| Upgrade scope | 10 | Immutable, or upgrades cannot touch funds | Upgradeable with limits | Fully upgradeable |
| Fund isolation | 10 | Funds isolated per pool or vault | Partly isolated | One contract holds all funds |
Per-item scores are published with the full test data.
Market Stress · 100 points
| Sub-criterion | Points | Full | Half | Zero |
|---|---|---|---|---|
| Side Impact scenario | 30 | Held | Degraded | Failed |
| Rollover scenario | 30 | Held | Degraded | Failed |
| Oracle design | 20 | Multi-source, TWAP and stale-data checks | One trusted source with stale-data checks | Spot price from one pool |
| Risk parameters | 20 | Supply and borrow caps, conservative LTV and documented MEV protection | Some in place | No limits |
Per-item scores are published with the full test data.
Exit & Liquidity · 100 points
| Sub-criterion | Points | Full | Half | Zero |
|---|---|---|---|---|
| Rear Impact scenario | 40 | Held | Degraded | Failed |
| Normal withdrawal time | 20 | Instant or one block | Up to 7 days | Over 7 days |
| Exit cost under stress | 20 | Slippage under 1% | 1 to 5% | Over 5% |
| Queue and lock transparency | 20 | Queue rules on-chain and documented | Documented only | Unclear |
Per-item scores are published with the full test data.
Safety Assist · 100 points
| Sub-criterion | Points | Full | Half | Zero |
|---|---|---|---|---|
| Audit | 25 | Two or more firms, under 12 months old, all critical and high findings fixed | One firm, or older than 12 months | No audit |
| Bug bounty | 15 | Maximum payout of 250,000 USD or 1% of TVL, or more | Exists, below that threshold | None |
| Pause or circuit breaker | 15 | In place, held by a multisig, tested | In place, held by a single key | None |
| Monitoring and incident response | 15 | Real-time monitoring and a public incident procedure | One of the two | None |
| Incident history, 24 months | 20 | No loss of funds | Losses fully repaid to users | Losses not repaid |
| Transparency | 10 | Verified code, full docs, known team | Partly | Unverified code |
Per-item scores are published with the full test data.
Visual recordImpact plates.
Impact plates, protocol diagrams and before/after frames for this report appear here once the visual record is produced.
Member ReportsShown beside the rating, never inside it.
Member Reports · not part of the rating
0reports filed
Members who have used the protocol on-chain can file one report per test cycle.
Safety rating · set by the lab
3 of 5
Computed from the Test Protocol and signed. It does not change with member votes.
Test historyEvery cycle, dated.
| Report | Tested | Version | Stars | Status |
|---|---|---|---|---|
| CR-0001 | 02.11.26 | v2.1.0 (commit a1b2c3d) | Valid |
Test Director
Signed · 2 Nov 2026v2.1.0 (commit a1b2c3d)
Fork Base · block 22,000,000
Fork Base · block 22,000,000
Full rubric breakdown, scenario details and raw data may be limited to Bulwark Members for the first 72 hours after a report is published. Stars, area scores and scenario results are public from day one.