The Onyx scoring methodology.

Onyx exists because Web3 inherited a credibility problem from Web2 and made it worse. Most projects publishing a "verified" badge sold it; most directories rank by ad spend, listing fee, or token sponsorship1. Users — and increasingly regulators — have no neutral, evidence-based answer to the only question that matters: is this project the kind of thing a serious person should rely on?

We answer that question using a transparent framework, applied identically to every project, by a small team accountable to a public conflict-of-interest policy. We score 2,418 projects on the same 100-point scale and we publish every removal, downgrade, and dissent in full.

What we are not: a press shop, a paid listing service, a research consultancy, or a clearinghouse for investment advice. Nothing in this document constitutes a recommendation to buy, sell, hold, stake, lend against, or otherwise trade any asset.

The single most important property of our ratings is that they cannot be purchased. Five binding commitments make this concrete:

1. Score independence. The score is determined by the methodology. No commercial relationship — listing fee, marketing package, sponsorship, employment agreement, or token holding — alters a score in either direction. The lead reviewer signs every score change on-chain2.
2. Tier pricing decoupled. Projects pay for listing features (additional badges, promotional placement in non-ranking surfaces, application processing). They do not pay for tiers. A Free Provisional project is scored on the same rubric as an Enterprise project.
3. No token holdings. Editorial staff disclose, and where required divest, holdings in any project under active review.
4. Public dissent. When a reviewer dissents from a score, the dissent is published on the project's page with the reviewer's name.
5. Public removals. Every removal, downgrade, and watchlist action is published with date, reason, and evidence sources, regardless of the project's commercial relationship with Onyx.

The framework allocates 100 points across five categories. Each category has between three and five sub-criteria. The point allocations have been stable since v2.0 (Q3 2024); the sub-criteria are revised quarterly. The current allocation is:

Note: A project may also accrue at most +3 bonus points in any category where its performance materially exceeds expectations, capped at the category maximum. Bonus rationale is always published in the rating notes.

Worth 25 of 100 points. This category answers: is there an accountable entity operating in a jurisdiction we can reach if something goes wrong? It is the largest single category because, in 2026, no other property of a Web3 project predicts long-term user safety as reliably.

Evidence sources

• Corporate registries (Companies House, Delaware SOS, BVI Registry, etc.)
• FATF jurisdictional risk index
• OFAC SDN list cross-reference
• KYC documentation provided by the project under NDA
• Independent press reports and court filings

How anonymous teams are scored

A pseudonymous or anonymous team is not automatically disqualifying — many of the most important projects in Web3 history shipped under pseudonyms3. They are, however, capped at 14 points in this category. The scoring acknowledges that anonymity is sometimes principled (privacy, jurisdictional safety) and sometimes evasive (evasion of liability). We do not attempt to distinguish; we apply the same cap to both.

Worth 25 of 100 points. Smart-contract risk is the single most consequential failure mode of a Web3 product. We score audit depth and recency, auditor independence and diversity, the existence and budget of an active bug-bounty program, key-management practices, and any incident history.

What does not count

An "audit" performed by an entity with a financial interest in the protocol — equity, advisory, or token allocation — is excluded from auditor-diversity scoring. Self-audits, "internal review" attestations, and any audit not published in full are not counted toward audit recency.

Worth 20 of 100 points. Time-tested protocols accrue points here. Uptime, version cadence, governance throughput, founder tenure, and the quality of operational responses during stress events. A protocol that has run cleanly for three years in production is, all else equal, less risky than one launched eight weeks ago.

Worth 15 of 100 points. Treasury disclosure (wallet addresses, balances, custody arrangements), token-vesting schedules with on-chain proofs, audited financials where the project operates a registered entity, and the level of detail in revenue reporting.

Worth 15 of 100 points. The only category where user-generated evidence is the primary input. We accept reviews only from wallets with verified on-chain interaction history with the project under review4. Average review score, fund-loss disclosures, support quality (measured via direct test interactions), and dispute resolution history.

The total score determines tier placement. Tiers correspond to credibility levels, not investment recommendations. Below 40, projects are rejected and not listed.

Ratings expire. Every project is re-rated on a cadence determined by tier, with additional triggers for material events. A score that has not been refreshed within its cadence is flagged stale and excluded from rankings.

Any rated project may appeal a score. Appeals must cite the specific sub-criterion in dispute, provide new evidence, and be filed within 30 days of the score's publication.

1. Filing. Appeals are filed through the project's account on Onyx. A wallet signature from a treasury or multi-sig signer is required.
2. Triage. The lead reviewer assigns the appeal to a second reviewer who did not score the original rating.
3. Review window. 14 business days. The second reviewer's findings are published with rationale, regardless of outcome.
4. Board escalation. A project may escalate to the full Editorial Board within 7 days of the second-reviewer decision. Board decisions are final, signed, and published.

In 24 months of operation, appeals have moved scores by an average of +1.2 points. We publish that average to be transparent about the fact that appeals are real but not transformative.

Every editorial staff member files a quarterly disclosure of all token holdings, advisory positions, equity in Web3 entities, and personal relationships with founders or executives of any rated project. Disclosures are public.

• Tokens of any rated project under active review must be divested before review begins, or the staff member is recused.
• Advisory relationships, paid or unpaid, with any rated project disqualify the staff member from reviewing that project — permanently, not for a cooling-off period.
• Personal relationships (family, romantic, financial) with anyone serving as a founder, executive, board member, or counsel of a rated project trigger automatic recusal.
• The lead reviewer may not own > $10k of any single token, regardless of whether the project is rated.

A project may be rejected before listing, downgraded after listing, watchlisted, or removed for cause. The four states are distinct and visually distinct on the platform.

Rejection (pre-listing)

Score below 40, identified fraud risk, sanctioned-entity association, or refusal to engage with the application process. Rejection is not public unless the project chooses to disclose.

Downgrade

Material change in the evidence: a new exploit, founder departure, regulatory action, audit-finding non-resolution past 90 days. Downgrades are always published with reasons.

Watchlist

An open question that has not yet resolved into a downgrade or removal. The project remains rated, but the watchlist badge appears on every surface.

Removal

Reserved for projects whose continued rating would itself be misleading. Examples: team identity falsification, sustained unresponsive treasury after exploit, sanctioned-entity confirmation, or evidence of deliberate fraud5.

The editorial board is named, signs every score on-chain, and is accountable to this methodology and the conflict-of-interest policy. Backgrounds across former regulators, on-chain analysts, and security researchers.

Every change to this document is published as a signed diff. The diff is binding from the effective date forward; ratings issued under earlier methodology versions are explicitly tagged with their version6.