Olivia
Online
Bulwark Score
@BulwarkScore
The safety rating AI agents can read. Independent DeFi crash tests. @forbes but for protocols.
0x0f8110b99bc4c5c0b22aa7dcf17a06935f7b8f4a
Joined November 2026
4 Following
89 Followers
47 Posts
Β Pinned Tweet
π¨ BULWARK Independen Crash Test Vol. 2: our first live fork execution. (full proof links on the reply)
Compound V3, USDC market on Ethereum.
2 of 5 scenarios, run as real transactions on a fork of mainnet at block 26,404,380. Nothing touched mainnet.
REAR IMPACT: FAILED
What if 30% of suppliers withdraw at once?
- Supply: 357.6M USDC
- Cash in the market: 47.9M USDC
- Demand (30%): 107.3M USDC
- Actually withdrawn: 37.8M USDC, 35.23% of demand
- Utilisation: 89.01% β 99.53%
- After 24 simulated hours: 0 more USDC out. No exit queue.
Context matters: no funds were lost. At high utilisation, cash is limited by design. In a live market, rising rates pull in repayments and new supply. Our fork models no market response, so this is the worst case: how much gets out if nobody comes to help.
POLE TEST: DEGRADED
What if one privileged key is misused?
- No single key can move funds
- Upgrades go through a governance vote, then a 48-hour timelock, then the proxy admin
- The configurator answers to the same timelock. No shorter path
- The pause guardian can freeze withdrawals. Funds frozen, not lost. Withdrawals resume after unpause
Re-run it yourself:
RPC_URL=<your archive RPC> ./run.sh CR-1029
It prints every number above, then MATCH or MISMATCH. We tested it on several RPC providers: MATCH.
Thresholds for held, degraded and failed were signed by our Test Director before the run.
Not run yet: Frontal Drain, Side Impact, Rollover.
The CR-1029 rating stays as it is until the Test Director signs the re-test.
Proof on the reply below
Solana Privacy Rings: findings follow in a separate post.
In few hours we're answering it with a run, not a reply.
First live fork execution: Compound V3 on Ethereum, Rear Impact + Pole Test.
Public scripts, public CI logs, one command to re-run, and a full video of the test.
Target later today. We'll tag you when it's live.
we are crash testing this soon today
https://t.co/VPz65GGwRa
Check it yourself:
Test scripts
https://t.co/314ANjshz7
Phase 1 results
https://t.co/LeF2pM2L66
Build verification
https://t.co/dxHqCqXHFx
Public CI run, logs open without login
https://t.co/LDhdjcveUs
Program on explorer
https://t.co/1HmwyvUqE5
Status on the bench
https://t.co/cVryLmnLHc
Solana Privacy Rings by @Helius : our first independent onchain findings. explained simply.
Think of Privacy Rings as a vault with tinted windows. You can put money in, send it privately, and take it out, without everyone seeing how much.
We checked three things:
1. Is the vault the one they showed us?
Helius published the blueprint (open source code). We compared it, byte by byte, with the vault actually running on Solana.
β Identical. What's running is what they published.
2. Who can rebuild the vault?
Every program on Solana can have an "upgrade key".
β This one isn't a single person's key. It's controlled by [a multisig, N of M people must agree]. No one can change it alone.
3. What can the staff do?
There are a few roles that keep the vault running.
β They can pause deposits or withdrawals, or slow them down.
β None of them can take your money.
What we haven't tested yet: what happens under stress, like fake transactions or everyone leaving at once. That's next.
Not a rating. No stars. Anyone can re-run our checks with one command and get the same answer.
![BulwarkScore's tweet photo. Solana Privacy Rings by @Helius : our first independent onchain findings. explained simply.
Think of Privacy Rings as a vault with tinted windows. You can put money in, send it privately, and take it out, without everyone seeing how much.
We checked three things:
1. Is the vault the one they showed us?
Helius published the blueprint (open source code). We compared it, byte by byte, with the vault actually running on Solana.
β Identical. What's running is what they published.
2. Who can rebuild the vault?
Every program on Solana can have an "upgrade key".
β This one isn't a single person's key. It's controlled by [a multisig, N of M people must agree]. No one can change it alone.
3. What can the staff do?
There are a few roles that keep the vault running.
β They can pause deposits or withdrawals, or slow them down.
β None of them can take your money.
What we haven't tested yet: what happens under stress, like fake transactions or everyone leaving at once. That's next.
Not a rating. No stars. Anyone can re-run our checks with one command and get the same answer.](https://pbs.twimg.com/media/HXBmOGsaEAATVc2.jpg)
Third burn. Checkable.
2,030,050 $BULW sent to 0xβ¦dEaD from the dev wallet, in two transactions:
https://t.co/eTGo5H5nQZ
https://t.co/7rxgKU2Knm
Burned so far:
- Burn 1: 22,596,634 BULW (100% of the dev launch buy)
- Burns 2 + 3: 2,030,050 BULW
- Total: 24,626,685 BULW, 2.46% of supply, gone for good
Don't take our word for it. Check the dEaD balance.
The token grants access, never stars.
Not a Crash Report. No score, no stars. Just facts anyone can check with one command.
What we tested
Program ring1GaLCuJnkUMVkX2JeZLTTX17wKsV4fZmPVzXANW on Solana mainnet, the permissionless Default Ring, against helius-labs/privacy-rings at commit 20b6c9b.
1. Is the code onchain the code on GitHub?
Yes. We downloaded the official v1.0.0 release binary, checked its SHA-256 against Helius's published SHA256SUMS, then compared it byte by byte with the program running on mainnet.
634,120 bytes. Identical.
2. Who can upgrade the program?
The upgrade authority is a program-derived address, not a regular wallet. No single private key exists for it. It's controlled by [PROGRAM, e.g. a Squads multisig] with a [N]-of-[M] threshold.
3. What can the other roles do?
- Protocol authority: can change config and pause deposits and withdrawals on a tree. Cannot move user funds.
- Forester: maintains the nullifier tree. Can slow the withdraw path. Cannot move user funds.
- Fee authority: changes fees only.
- Tree and ring creation: no path to user balances.
What we didn't test yet
Phases 2 to 4 (private transfers, prover and indexer outages, forged proofs, mass exits) need a full local prover and indexer setup. They come next. No claims are made about them today.
One command, same result:
bash https://t.co/VCyQRLQH3n β MATCH
An audit reads the code. We checked what's actually running.
@BruceWayne2608 now, we did
For newbie: Explained simply.
Think of Compound V3 as a big shared piggy bank.
It holds $357M on paper, but only $48M is actually inside. The rest is lent out.
Test 1: what if 30% of people want their money back at the same time?
β Only about a third got out. The rest has to wait until borrowers pay back.
β No money was lost. It just wasn't there to take right away.
Test 2: who holds the keys?
β Nobody can take the money alone. Changes need a vote plus a 48-hour wait.
β One guard can lock the door for a while. Money stays safe, just stuck until it reopens.
Run on a real copy of Ethereum. Anyone can re-run it and get the same numbers.
Full results: https://t.co/vKMDNMVoGa
π¨ BULWARK Independen Crash Test Vol. 2: our first live fork execution. (full proof links on the reply)
Compound V3, USDC market on Ethereum.
2 of 5 scenarios, run as real transactions on a fork of mainnet at block 26,404,380. Nothing touched mainnet.
REAR IMPACT: FAILED
What if 30% of suppliers withdraw at once?
- Supply: 357.6M USDC
- Cash in the market: 47.9M USDC
- Demand (30%): 107.3M USDC
- Actually withdrawn: 37.8M USDC, 35.23% of demand
- Utilisation: 89.01% β 99.53%
- After 24 simulated hours: 0 more USDC out. No exit queue.
Context matters: no funds were lost. At high utilisation, cash is limited by design. In a live market, rising rates pull in repayments and new supply. Our fork models no market response, so this is the worst case: how much gets out if nobody comes to help.
POLE TEST: DEGRADED
What if one privileged key is misused?
- No single key can move funds
- Upgrades go through a governance vote, then a 48-hour timelock, then the proxy admin
- The configurator answers to the same timelock. No shorter path
- The pause guardian can freeze withdrawals. Funds frozen, not lost. Withdrawals resume after unpause
Re-run it yourself:
RPC_URL=<your archive RPC> ./run.sh CR-1029
It prints every number above, then MATCH or MISMATCH. We tested it on several RPC providers: MATCH.
Thresholds for held, degraded and failed were signed by our Test Director before the run.
Not run yet: Frontal Drain, Side Impact, Rollover.
The CR-1029 rating stays as it is until the Test Director signs the re-test.
Proof on the reply below
Solana Privacy Rings: findings follow in a separate post.
@0xMufty @WalkDog1984 do you ever knowing about creator fees from @ponsdotfamily ? why should i have bags when the creator fees is enough for our intern and to run the protocol?
Solana Privacy Rings: findings follow in a separate post.
π¨ BULWARK Independen Crash Test Vol. 2: our first live fork execution. (full proof links on the reply)
Compound V3, USDC market on Ethereum.
2 of 5 scenarios, run as real transactions on a fork of mainnet at block 26,404,380. Nothing touched mainnet.
REAR IMPACT: FAILED
What if 30% of suppliers withdraw at once?
- Supply: 357.6M USDC
- Cash in the market: 47.9M USDC
- Demand (30%): 107.3M USDC
- Actually withdrawn: 37.8M USDC, 35.23% of demand
- Utilisation: 89.01% β 99.53%
- After 24 simulated hours: 0 more USDC out. No exit queue.
Context matters: no funds were lost. At high utilisation, cash is limited by design. In a live market, rising rates pull in repayments and new supply. Our fork models no market response, so this is the worst case: how much gets out if nobody comes to help.
POLE TEST: DEGRADED
What if one privileged key is misused?
- No single key can move funds
- Upgrades go through a governance vote, then a 48-hour timelock, then the proxy admin
- The configurator answers to the same timelock. No shorter path
- The pause guardian can freeze withdrawals. Funds frozen, not lost. Withdrawals resume after unpause
Re-run it yourself:
RPC_URL=<your archive RPC> ./run.sh CR-1029
It prints every number above, then MATCH or MISMATCH. We tested it on several RPC providers: MATCH.
Thresholds for held, degraded and failed were signed by our Test Director before the run.
Not run yet: Frontal Drain, Side Impact, Rollover.
The CR-1029 rating stays as it is until the Test Director signs the re-test.
Proof on the reply below
Solana Privacy Rings: findings follow in a separate post.
In few hours we're answering it with a run, not a reply.
First live fork execution: Compound V3 on Ethereum, Rear Impact + Pole Test.
Public scripts, public CI logs, one command to re-run, and a full video of the test.
Target later today. We'll tag you when it's live.
Check everything:
Full evidence
https://t.co/vKMDNMVWvI
Fork block on Etherscan
https://t.co/pEDdbHlkpS
Test scripts
https://t.co/314ANjshz7
Result file
https://t.co/Gth0d0KatX
Execution commit
https://t.co/ylj7t7i96N
Public CI run, logs open without login
https://t.co/awfZLDSgRJ
BULWARK Independent Crash Test Β· Vol. 2 is done.
On the bench:
- Compound V3, USDC market on Ethereum
- Solana Privacy Rings by Helius
Findings drop in the next post: what we ran, what held, what didn't, and how to re-run it yourself.
Same rules as always:
- No fees from the protocols we test
- Public scripts, public logs
- No stars until the Test Director signs
Stay tuned.
Paralel with compound v3 testing, this what we currently test in Solana Privacy Rings.
@Helius put encrypted balances on Solana: deposit into a private balance, transfer privately, withdraw back to public. Great for users. But when balances are hidden, "is the money still there?" can't be answered by looking. It has to be tested.
Scope: the permissionless Default Ring. Custom Rings get scoped separately once they're public.
Phase 1 Β· Who holds the keys
- Who can upgrade the Rings program: nobody, a multisig, or one wallet?
- Every privileged role in the Default Ring, and what it can do to user funds
- Does the program running onchain match the open-source code? Verifiable build check
Phase 2 Β· Does it work as claimed
- Deposit, private transfer and withdraw for SOL, SPL and Token-2022
- What stays visible onchain for each transfer, compared with the docs
Phase 3 Β· Side Impact + Frontal Drain
- Prover or indexer goes down: can users still exit?
- Indexer returns bad data: does the program refuse it?
- Forged proofs, double-spends, replayed withdrawals: every one must be rejected
Phase 4 Β· Rear Impact, Rollover, solvency
- 30% of deposits exit at once: what gets out, how fast, where it jams
- All rings share one state tree: can trouble in one ring reach the others?
- Do hidden balances still add up to the assets actually locked?
- Trusted setup: who took part, and what happens if the circuits change
How you'll check our work:
- Public scripts and CI logs for every phase
- A video walkthrough of each run, no cuts
- Phase 1 needs nothing but a Solana RPC. Anyone can re-run it
Rules:
- No score and no stars until the full report is signed by our Test Director
- Any security finding goes privately to Helius first, with a 14-day fix window. Nothing gets hinted at here before that
An audit reads the code. A crash test runs it under stress.
Phase 1 just strated, Dear @Helius team any words for the the testing and rating ?
New test class: Privacy (PRV).
Class five is open. First in the queue: Solana Privacy Rings.
Why privacy needs a crash test:
- Encrypted balances hide amounts from everyone
- That includes the people who should check the money is still there
- When you can't look, you have to test
How Rings will be tested:
- Same five scenarios as every other protocol
- Run on a mainnet fork
- Weakest area sets the stars
- Human-signed Crash Report
- No stars until the report is signed
Status: Queued.
@0xMufty @WalkDog1984 hey guys, new to crypto here, didnt have some bucks for blue tick. please find the suspected wallet "links" to dev wallet.
okay let me help you,
this is dev wallet address 0xe5c0cd13758943a98e4b5ba1b6f52030d64f8c10
goodluck,
gm, 2nd day of launch here.
In few hours we're answering it with a run, not a reply.
First live fork execution: Compound V3 on Ethereum, Rear Impact + Pole Test.
Public scripts, public CI logs, one command to re-run, and a full video of the test.
Target later today. We'll tag you when it's live.
Just went through your GitLab. The architecture looks solid, and I really like what you're building.
One question: is the crash-testing engine already executing real attack simulations on blockchain forks, or are the scores currently generated from manually submitted test results?
Would love to see a live, reproducible test. That would be a huge milestone for Bulwark.
@0xMufty @WalkDog1984 dont tell lies bro, give your proof if that wallet linked to Dev wallet.
Just come accross that 2 wallet, we can confirms that is not us, maybe someone who really bullish on this project.
@IMDK312 @WalkDog1984 @zm2nxv @rektprince369 @degenApe22 lot of milestones passed by hours, glad to announnce next
What's coming next at BULWARK.
First, what we are, in one line:
Moody's rates bonds. Crash labs rate cars. BULWARK rates DeFi.
We copy the real chain, crash a protocol five different ways, and tell you what broke. In stars.
Next two weeks:
- Contracts page: every BULWARK address in one place, one click to check
- Public test scripts: re-run one of our crash tests yourself
- Solana Privacy Rings goes on the bench
- Robinhood Chain joins the lab: Morpho Blue and Uniswap first
- Score cards: every What's coming next at BULWARK.
First, what we are, in one line:
Moody's rates bonds. Crash labs rate cars. BULWARK rates DeFi.
We copy the real chain, crash a protocol five different ways, and tell you what broke. In stars.
Next two weeks:
- Contracts page: every BULWARK address in one place, one click to check
- Public test scripts: re-run one of our crash tests yourself
- Solana Privacy Rings goes on the bench
- Robinhood Chain joins the lab: Morpho Blue and Uniswap first
- Score cards: every test gets one shareable card
No fees from the protocols we test.
The token grants access, never stars. gets one shareable card
No fees from the protocols we test.
The token grants access, never stars.
gm, today,
Next from the lab: ask BULWARK, right in your timeline.
Soon you'll mention one account with a protocol name or contract address, and get its crash-test rating back in seconds.
Why it matters:
- Most people decide where to put money in the replies, not on a ratings site
- A rating only helps if it shows up before the deposit, not after the exploit
- Every request for an untested protocol tells us what to test next
What's different:
- Other bots read what a project says. We answer with what happened when we crashed it
- No instant AI verdicts. Every answer comes from a signed Crash Report
- No "safe", no "scam". Just stars, scores and the weakest area
- Not tested yet? We say so, and your request joins the queue
Coming soon.
Last Seen Users on Sotwe
Ψ²ΩΨ¬ Ψ§ΩΩΩ
Ψ± Ω
ΨͺΨΨ±Ψ±
Seen from Pakistan
Ψ§ΩΩΨ§Ψ³Ψ±β οΈ:O
Seen from France
Sinema Ai
Seen from Indonesia
Pannabellaa
Ψ³Ψ§ΩΨ¨ ΩΩΨ£Ψ¬ΩΨ¨Ω
Seen from Germany
ΨΉΨ¨Ψ§Ψ³ Ψ§Ψ¨Ω ΨΉΨ¨Ψ―
Amazonium
Seen from Mexico
Kel
Seen from Turkey
θͺεη¨δΊεε
«η¦γ€γ©γΉγδΏεε’
Seen from Japan
ΰΈΰΈΰΈΰΉΰΈ’ΰΉΰΈΰΈͺΰΈ²ΰΈ§ΰΉΰΈ«ΰΈΰΉ ΰΉΰΈ‘ΰΉΰΈ‘ΰΉΰΈ²ΰΈ’ΰΈΰΈ²ΰΈ’ΰΈΈ 25-55ΰΈ£ΰΈ²ΰΈΰΈΰΈΈΰΈ£ΰΈ΅ΰΉΰΈΰΈ§ΰΈΰΈ£ΰΈΰΈΰΈΰΈ£ΰΈ±ΰΈ§
Seen from Thailand
Most Popular Users
Elon Musk
@elonmusk
240.9M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers