BlackHartPublic score as of Nov 7, 7 days behind. Live subscribers see every move the moment it lands.
Go live for $29
Wormhole
Score history
Model updateEvery Score Move
Live for subscribersOpen any move to see what changedMay 19up 2Model updateDimensions rescored
BlackHart's method or evidence changed and the score was recalculated. No new release drove this move.
May 15down 6Model updateDimensions rescored
BlackHart's method or evidence changed and the score was recalculated. No new release drove this move.
May 13down 56Model updateDimensions rescored
BlackHart's method or evidence changed and the score was recalculated. No new release drove this move.
May 6up 8Model updateDimensions rescored
BlackHart's method or evidence changed and the score was recalculated. No new release drove this move.
May 6up 27Model updateMethodology update
BlackHart's method or evidence changed and the score was recalculated. No new release drove this move.
Dimensions
12 dimensions, 11 apply to Wormhole. Open one to see how it is scored.Access controlscore 75weight 16%
Admin keys, roles, permissions and the checks that guard them.
Economic soundnessscore 80weight 12%
How the economic design holds up under flash loans, MEV, liquidation cascades and bad incentives.
Oracle integrityscore 85weight 12%
How prices reach the protocol, and how hard they are to manipulate or let go stale.
Maturityscore 68weight 11%
Time in production, value secured over time, audits, bounties and incident history.
- Live since
- Sep 1, 2021 (62 months)
- TVL
- $1B+
- Audits
- Trail of Bits, Jan 2024
- OtterSec, Sep 2023
- Neodyme, Feb 2022
- Bug bounty
- Immunefi, up to $1,000,000
Adversarial resiliencescore 52weight 10%
How the code holds up under independent adversarial research.
Compositional riskscore 70weight 9%
External dependencies and the surface where contracts and integrations interact.
Governancescore 72weight 9%
Admin key concentration, timelocks and how upgrades happen.
Cross-chain messagingscore 62weight 9%
Bridge trust model, sequencer risk, fraud proofs and replay risk.
Operational securityscore 66weight 9%
Incident response, deployment hygiene, key management and monitoring.
- GitHub scan
- wormhole-foundation/wormhole on May 20
- Branch protection
- No
- Required reviews
- 0
- Signing ratio
- 72%
- Commits in 90 days
- 50
- PR review ratio
- 97%
- Has CI
- Yes
- CI success rate
- 60%
- Security policy
- Yes
- Deployment hygiene
- 77 of 100
- Development practices
- 51 of 100
- Emergency history
- 75 of 100
- Incident response
- 65 of 100
- Key management
- 70 of 100
- Monitoring
- 70 of 100
Cascade exposurescore 96weight 5%
Failures upstream that could spread into the protocol, and the damage if it fails.
Supply chainscore 78weight 4%
Compiler versions, libraries, build reproducibility and proxy patterns.
- Dependabot
- No