DEX · BAL · $0.6B TVL. Balancer is the only protocol in this screen carrying an active notching cap. The November 2025 exploit of its V2 vault — a rounding-error flaw in the stable-pool math that drained well over $100M across chains — is exactly the fatal-flaw condition Methodology v1.0 was written to handle: a weakness that cannot be averaged away by good scores elsewhere.
Solvency screens at BB (55.0), with a notching cap of 59 declared over it. The cap does not bind here — the weighted inputs already land below the ceiling — which is itself the finding: Balancer's fundamentals are weak enough on their own that the fatal-flaw ceiling never has to do any work. A 55% drawdown, the deepest in the universe, and a 4/10 risk score reflect that the exploit reached core vault accounting rather than a peripheral integration, while the ~1x sustainability ratio leaves no cushion to absorb it.
Legitimacy screens at A, and the divergence from Solvency is the interesting part. Balancer's audit history was genuinely deep, the team disclosed and coordinated the response publicly, white-hat recovery efforts were real, and governance functioned through the crisis. The framework treats disclosure quality and solvency damage as separate questions — a protocol can handle a disaster honorably and still be uncreditworthy while the hole is open.
Growth screens at B: TVL halved, share down to ~5%, momentum 3/10. The exploit accelerated an erosion already underway as the boosted-pool and veBAL flywheel lost ground to newer AMM designs.
Composite B, set by Growth. The declared cap stays on the file until restitution is verified and the V3 accounting surface is re-audited — but the more sobering point is that Solvency is already below the ceiling without it. Recovery here is not a matter of lifting a cap; it is a matter of rebuilding fundamentals.
"A chain is as strong as its weakest link." The conservative composite takes the weakest dimension and inherits any notching cap, so a single structural weakness cannot be diluted by strength elsewhere.
