The Test Protocol.

Every rating on BULWARK comes from this document. Anyone can read it, and anyone can re-run the tests it describes.

v1.0Current version4Areas5Scenarios6 monthsRating validity

Principles

Same crash

Every protocol in a class faces the same five scenarios. Results are comparable because the tests are identical.

Weakest link

Stars follow the lowest area score, not the average.

Re-runnable

Each result lists its fork block, its loss figures, and, after disclosure, its test script.

Areas and weights

40%Depositor Protection

25%Market Stress

15%Exit & Liquidity

20%Safety Assist

Depositor Protection Exploit simulation, access control, admin key risk, contract upgrade risk	40%
Market Stress Oracle manipulation, depeg, liquidation cascades, a 50% price drop in one hour	25%
Exit & Liquidity A bank run: 30% of TVL withdrawn in 24 hours, speed and cost of exit	15%
Safety Assist Audits, bug bounty, timelock, pause and circuit breaker, monitoring, incident history	20%

Weights set the overall score from 0 to 100. Scenario results convert to points: Held is 100%, Degraded 50%, Failed 0% of that sub-criterion.

Rubric

Depositor Protection · 100 points

Sub-criterion	Points	Full	Half	Zero
Frontal Drain scenario	30	Held	Degraded	Failed
Pole Test scenario	20	Held	Degraded	Failed
Admin control (multisig)	15	Multisig of 3/5 or more with independent signers	Multisig 2/3	Single key (EOA)
Upgrade timelock	15	48 hours or more	24 to 48 hours	Under 24 hours, or none
Upgrade scope	10	Immutable, or upgrades cannot touch funds	Upgradeable with limits	Fully upgradeable
Fund isolation	10	Funds isolated per pool or vault	Partly isolated	One contract holds all funds

Market Stress · 100 points

Sub-criterion	Points	Full	Half	Zero
Side Impact scenario	30	Held	Degraded	Failed
Rollover scenario	30	Held	Degraded	Failed
Oracle design	20	Multi-source, TWAP and stale-data checks	One trusted source with stale-data checks	Spot price from one pool
Risk parameters	20	Supply and borrow caps, conservative LTV and documented MEV protection	Some in place	No limits

Exit & Liquidity · 100 points

Sub-criterion	Points	Full	Half	Zero
Rear Impact scenario	40	Held	Degraded	Failed
Normal withdrawal time	20	Instant or one block	Up to 7 days	Over 7 days
Exit cost under stress	20	Slippage under 1%	1 to 5%	Over 5%
Queue and lock transparency	20	Queue rules on-chain and documented	Documented only	Unclear

Safety Assist · 100 points

Sub-criterion	Points	Full	Half	Zero
Audit	25	Two or more firms, under 12 months old, all critical and high findings fixed	One firm, or older than 12 months	No audit
Bug bounty	15	Maximum payout of 250,000 USD or 1% of TVL, or more	Exists, below that threshold	None
Pause or circuit breaker	15	In place, held by a multisig, tested	In place, held by a single key	None
Monitoring and incident response	15	Real-time monitoring and a public incident procedure	One of the two	None
Incident history, 24 months	20	No loss of funds	Losses fully repaid to users	Losses not repaid
Transparency	10	Verified code, full docs, known team	Partly	Unverified code

Sub-criteria that don't apply to a class (LTV for a DEX, for example) are replaced with an equivalent, and the replacement is written into the Crash Report.

Star rule

All four areas must reach the minimum for a star level.

	80% in every area	Comprehensive protection, the benchmark for its class
	70% in every area	Strong protection
	60% in every area	Adequate protection with clear weaknesses
	40% in every area	Minimal protection
	20% in every area	Very little protection
0	< 20%	Did not pass

function computeStars(r) { const min = Math.min(...Object.values(r.areas)); let stars = min >= 80 ? 5 : min >= 70 ? 4 : min >= 60 ? 3 : min >= 40 ? 2 : min >= 20 ? 1 : 0; if (r.criticalFailure) stars = Math.min(stars, 1); return stars; // computed, never entered by hand }

Critical failure

If Frontal Drain or Pole Test drains funds in simulation, the rating is capped at one star, whatever the other scores. The report shows a critical failure banner above the area scores.

Validity and re-tests

A rating is valid for six months. After that its status turns Expired and the stars show in grey until the protocol is re-tested.

Contract upgradeAny upgrade to a tested contract.

New chainA deployment to a chain not covered by the report.

IncidentAn exploit, depeg or loss flagged by the Incident Desk.

Disclosure

Every scenario runs on a mainnet fork (Foundry, Anvil or Tenderly) at a block recorded in the report. No test transactions touch mainnet, and TVL is measured at the fork block.

When a test finds a critical issue, the protocol gets 14 days to fix it. Test scripts are published after that window.

Independence

The lab accepts no payment from any protocol it tests. Holding the token gives access to reports and data, and has no effect on any rating. The analyst who prepares a test cannot sign it.

The approach is inspired by European vehicle safety testing. BULWARK is not affiliated with any vehicle safety program.

Changelog

Version	Date	Change
v1.0	02.11.26	First version: four areas, five scenarios, weakest-link star rule.