BlackHartBlackHart-1
The model behind the Liquid Security Index. It reads a protocol's code every time it changes, maps where value can move, and scores what could go wrong before anyone else finds it.
How it is built
Nine modules, each with one job. Together they turn a code change into a score in minutes.
Polyglot reader
Reads Solidity, Go, Rust and TypeScript into one map of the whole system.
ParsingValue-flow learning
Learns where value pools and how it moves between contracts.
Machine learningFormal path checker
Proves whether a dangerous path through the code can actually be reached.
Formal verificationAttack-path search
Explores the multi-step sequences an attacker could chain together.
SearchIntent critic
Separates behavior the team meant to build from gaps they did not.
ReasoningBlast radius
Estimates how much value a weakness could reach if it were used.
Risk modelingExecution replay
Replays candidates on simulated chains and throws out false alarms.
SimulationPattern library
Matches against known vulnerability classes and past findings, and merges duplicates.
Pattern matchingLive orchestrator
Runs a sweep on every change and streams the result into the index.
Real time
Twelve dimensions
A score combines twelve dimensions, each with a published weight. Liquidity and cross-chain messaging only count where they apply. Each card says whether a deterministic program or a decision model measures it.
- D1
Access control 18%
Admin keys, roles, permissions and the checks that guard them.
Deterministic - D2
Economic soundness 13%
How the economic design holds up under flash loans, MEV, liquidation cascades and bad incentives.
Deterministic - D3
Oracle integrity 13%
How prices reach the protocol, and how hard they are to manipulate or let go stale.
Deterministic - D4
Compositional risk 5%
External dependencies and the surface where contracts and integrations interact.
Deterministic - D5
Governance 10%
Admin key concentration, timelocks and how upgrades happen.
Decision model for docs - D6
Maturity 12%
Time in production, value secured over time, audits, bounties and incident history.
Deterministic - D7
Adversarial resilience 10%
How the code holds up under independent adversarial research.
Decision model to parse audit reports - D8
Supply chain 4%
Compiler versions, libraries, build reproducibility and proxy patterns.
Deterministic - D9
Liquidity and market structure Conditional
Liquidation cascades, holder concentration and exit queues, where positions trade.
Deterministic - D10
Cross-chain messaging Conditional
Bridge trust model, sequencer risk, fraud proofs and replay risk.
Mostly deterministic - D11
Operational security 10%
Incident response, deployment hygiene, key management and monitoring.
Deterministic - D12
Cascade exposure 5%
Failures upstream that could spread into the protocol, and the damage if it fails.
Deterministic
Prediction markets
A market has no code to read, so it gets six dimensions of its own. Every market is rescored daily, and again whenever its trading changes sharply.
Informed trading 35%
Whether someone with inside knowledge could profit first.
Market integrity 20%
Whether the volume is real: wash trading, concentration, coordinated rings.
Oracle resolution 15%
How the outcome gets decided, and how easily it can be disputed.
Event catalyst 10%
How much the market hangs on one scheduled moment.
Design clarity 10%
Whether everyone agrees what Yes means.
Platform counterparty 10%
Risk from the platform itself, taken from its protocol score.
Backtested against real hacks
15 exploits tracked since April 2026. 3 hit protocols we had scored before the exploit. Here is what the score saw first.
- Polymarket$700K lostBRI724At the hack
Our pre-hack assessment of Polymarket flagged operational security as the weakest layer of its defenses. The exact failure mode, a single hot wallet without multisig protection, was already visible in our breakdown.
- Fluid$225K lostBRI794At the hack
Our pre-hack assessment of Fluid flagged operational security as its single weakest area, the lowest-scoring layer in the breakdown. The exact failure mode, privileged operational keys that could be turned into a payout without a second independent custodian or a waiting period, was already what our score was warning about. The exploit confirmed that warning rather than contradicting it.
- Aztec Connect$2.2M lostBRI627At the hack
We assessed Aztec Connect on June 3, eleven days before the exploit, and rated its risk on the cautious side. Our two weakest scores were its reliance on the zero-knowledge proving system underneath it, and its end-of-life, unmaintained status. That is exactly where this hack landed: a soundness failure in the proving system, on frozen contracts that could no longer be patched. The assessment named the weak spots that were exploited.
Scored after the exploit
These protocols were scored after the exploit, so they are not part of the backtest.
Every Score Move is labeled
A score moves for one of two reasons. A release means the protocol's code changed. A model update means our method changed. Every move on every page says which, so you always know whether the protocol moved or we did.
Model history
- Method 2.1
- First seen May 4, 2026
- Formula 1.1
- First seen May 4, 2026
- Formula 1.0
- First seen May 15, 2026
- Weights 1.1
- First seen May 4, 2026
- Weights 1.0
- First seen May 15, 2026