Fluid Lending Protocol

Reassessment Summary (July 2026)

Onchain refresh at block 25529610 (July 14, 2026); the sUSDai cross-chain bridge and vault-oracle layer were separately verified on July 22, 2026 (all figures onchain-confirmed — canonical mint path, DVN quorum, rate limiter, and USDai T1 vault debt). Governance, proxy implementations, and rate models are all unchanged since May 24. The material changes are the sustained TVL decline off the May peak (now stabilizing) and sUSDai concentration holding above the 30% trigger. sUSDai is issued by USD.AI (usd.ai), a synthetic-dollar protocol backed by AI hardware loans. This surfaces additional risk factors including Fluid holding roughly two-thirds of total sUSDai supply and extreme on-chain illiquidity.

Material change #1 — sUSDai concentration above the 30% trigger: Top supply asset sUSDai is 31.2% of cross-chain lending TVL ($199.2M). Per-chain it is 63.9% of Arbitrum and 75.3% of Plasma supply (down from May peaks of 75.3% / 80.4% as diverse TVL exited those chains faster than sUSDai did, though the cross-chain share keeps climbing). Same yield-bearing-stable-wrapper pattern as the wstUSR exposure that produced the Mar 2026 bad-debt event. Issuer and source chain: USD.AI on Arbitrum. Additional concentration risks: Fluid holds ~$199M of sUSDai — roughly two-thirds of its ~$300M supply — and sUSDai 24h on-chain volume is only ~$681K (~0.2% of market cap), making exit nearly impossible without severe slippage. The same-address LayerZero OAdapter burns/mints on both Ethereum and Arbitrum; critically, its authenticated receive path can mint the canonical Arbitrum ERC-4626 token, not only the Ethereum OToken representation. Funds Mgmt § A (Collateralization) moves 2.75 → 4.0 and § B (Provability) 1.0 → 2.5; Category 2 § C (Dependencies) moves 2.5 → 4.0; Liquidity moves 2.0 → 2.5; weighted subtotal 1.94 → 2.575. The -0.5 TVL modifier is removed (protocol had a material incident and lost decent amount of TVL): final score 2.6 (up from 1.4; moves from Minimal Risk to Medium Risk tier).

Material change #2 — TVL fell 26.8% off the May peak, now stabilizing: Lending TVL dropped from $872.5M (May 23) to $631.9M (Jul 6) and has since flattened at $639.0M (Jul 14, DeFiLlama). Overall Fluid TVL $771.2M (down from ~$1.00B in May). The May–June decline was broad-based across chains and asset types; the Jul 6→14 window shows mild stabilization (fUSDT, fGHO, and fWETH supplies grew back while fUSDC/fUSDtb slipped). Exchange rates remain monotonically increasing (verified onchain at block 25529610), confirming no principal loss to fToken holders on Ethereum. The decline may reflect the broader market drawdown in May–Jun 2026 and/or sUSDai rotation.

Everything else healthy at refresh:

• fTokens: Exchange rates still monotonically increasing across every checkpoint (Feb → Apr → May → Jul 6 → Jul 14, verified onchain); supplies mixed over the Jul 6→14 window (fUSDT +5.3%, fGHO +8.8%, fWETH +3.3%, fwstETH +0.5% recovered; fUSDC −6.7%, fUSDtb −10.1% slipped; fsUSDS flat). Net lending supply up slightly. Since May 24 the trend is still down (fUSDC 203.6M → 134.4M USDC, fwstETH 1,828 → 360 wstETH, fWETH 3,335 → 1,600 WETH).
• Governance: GovernorBravo proposalCount 131 → 135. Of all 135 proposals, 127 are Executed; the remaining 8 are terminal non-executed states (3 Canceled, 3 Defeated, 2 Expired) — verified onchain by iterating state() at block 25529610. All quorum/threshold/delay/period params unchanged.
• Admin/guardian: Timelock delay 1 day, all core contracts still Timelock-owned. Avocado 7-of-14 unchanged. No LogUpdateAuth, LogUpdateGuardian, LogPauseUser, or LogUnpauseUser events since May 24.
• Liquidity Layer impl: 0xcc33…66a2 since Mar 31 2026, unchanged. No proxy implementation upgrades since May.
• Rate model: USDC/USDT/GHO/ETH curves unchanged. No LogUpdateRateDataV2s events since the May 18 PST listing.
• Audits: No new audits published since the May 24 report.

Contract Addresses (Ethereum Mainnet)

All contracts verified on Etherscan. Compiled with Solidity 0.8.21.

fToken Contracts (Lending)

fToken	Address	Underlying	Underlying Address
fUSDC	0x9Fb7b4477576Fe5B32be4C1843aFB1e55F251B33	USDC	0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
fUSDT	0x5C20B550819128074FD538Edf79791733ccEdd18	USDT	0xdAC17F958D2ee523a2206206994597C13D831ec7
fWETH	0x90551c1795392094FE6D29B758EcCD233cFAa260	WETH	0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2
fwstETH	0x2411802D8BEA09be0aF8fD8D08314a63e706b29C	wstETH	0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0
fGHO	0x6A29A46E21C730DcA1d8b23d637c101cec605C5B	GHO	0x40D16FC0246aD3160Ccc09B8D0D3A2cD28aE6C2f
fsUSDS	0x2BBE31d63E6813E3AC858C04dae43FB2a72B0D11	sUSDS	0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD
fUSDtb	0x15e8c742614b5D8Db4083A41Df1A14F5D2bFB400	USDtb	0xC139190F447e929f090Edeb554D95AbB8b18aC1C

fToken On-Chain State (Ethereum Mainnet)

fToken	Total Assets (Jul 14 2026)	Total Assets (Jul 6 2026)
fUSDC	134.4M USDC	144.0M USDC
fUSDT	130.5M USDT	123.9M USDT
fGHO	15.45M GHO	14.2M GHO
fwstETH	359.8 wstETH	358.0 wstETH
fWETH	1,599.5 WETH	1,548.7 WETH
fUSDtb	2.22M USDtb	2.47M USDtb
fsUSDS	5,015 sUSDS	5,015 sUSDS

Every fToken exchange rate is monotonically increasing (ERC-4626) and has never decreased at any checkpoint — the key safety property confirming fToken holders have not lost principal value on Ethereum.

Over the Jul 6→Jul 14 window supply stabilized: fGHO (+8.8%), fUSDT (+5.3%), fWETH (+3.3%), and fwstETH (+0.5%) recovered, while fUSDC (−6.7%) and fUSDtb (−10.1%) slipped and fsUSDS was flat. Net lending supply rose slightly ($631.9M → $639.0M). The larger May 24 → Jul 14 contraction remains broad-based (fUSDC −34%, fwstETH −80%, fWETH −52%). No fToken exchange rate has decreased at any checkpoint — holders who remained earned yield through the drawdown.

Core Infrastructure

All core contracts are owned/administered by the Timelock (1-day delay, GovernorBravo admin).

Contract	Address	Role / Key Facts
Liquidity Layer (proxy)	0x52Aa…F4e497	Holds all funds. Upgradeable Instadapp Infinite Proxy; admin = Timelock; current impl 0xcc331…266a2 (since Mar 31 2026).
LendingFactory	0x54B9…51D03	Deploys fTokens; owner = Timelock.
Timelock	0x2386…1F4c	1-day (86,400s) delay; admin = GovernorBravo.
GovernorBravo	0x0204…5fA1B	135 proposals, 127 executed (8 terminal non-executed: 3 Canceled, 3 Defeated, 2 Expired). Quorum 4M / threshold 1M FLUID; 1-day voting delay, 2-day voting period.
Avocado Guardian	0x4F6F…D49e	7-of-14 custom multisig; can pause Class-0 protocols and cancel timelock txns; cannot move funds.
FLUID token	0x6f40…03eb	Governance token; 100M total supply.
Rebalancer (FluidReserveContractProxy)	0x2647…ce92	Permissioned rebalance() on fUSDC/fUSDT; owner = Timelock; deposits underlying as rewards, cannot withdraw.
LiquidityResolver / RevenueResolver	0xca13…5C60 / 0x0A84…0F32	Read-only periphery.

The most powerful admin action is the Timelock upgrading the Liquidity Layer implementation (1-day delay); the current impl is treated as in-scope of the 2025 MixBytes/StateMind Liquidity Layer audits absent a separate post-upgrade review.

Audits and Due Diligence Disclosures

No new audits have been published since the Feb 2026 assessment. The audit landscape is unchanged: 8 distinct security audits across 4 audit firms covering all major protocol components, including the Lending Protocol (PeckShield + StateMind full-protocol audits) and the Liquidity Layer (MixBytes + StateMind dual audit in 2025). All audit reports are available on the audits and security page.

The Resolv USR contagion event was not the result of an unaudited Fluid contract bug; it was the result of a leverage-loop borrower position becoming undercollateralized when an external collateral asset (wstUSR) collapsed in price following the upstream Resolv exploit.

Firm	Date	Scope
PeckShield	Nov 2023	Full Protocol (incl. Lending)
StateMind	Oct–Dec 2023	Full Protocol (incl. Lending)
MixBytes	Mar–Jun 2024	Vault Protocol
Cantina	Sep–Oct 2024	DEX Protocol
MixBytes	Oct 2024	DEX Protocol
MixBytes	Sep–Dec 2025	Liquidity Layer
StateMind	Sep–Oct 2025	Liquidity Layer

No formal verification (Certora, Halmos, etc.) has been performed.

Bug Bounty

Active Immunefi program (under the "Instadapp" name) covering the Liquidity Layer, Lending Protocol, and Vault Protocol — up to $500,000 for critical smart-contract bugs.

Historical Track Record

• Production History: Fluid launched on Ethereum mainnet on February 20, 2024. As of July 14, 2026, the protocol has been in production for ~2.40 years (~876 days).
• Total Fluid TVL (DeFiLlama "fluid" — all products, all chains, supply-side only): ~$771.2M as of July 14 2026 (July 6 snapshot: ~$757.6M; May 23: ~$999.6M; Apr 27: $911.5M; Feb 2026: $1.45B; peak $2.68B on Oct 9, 2025).
• Lending-only TVL (DeFiLlama "fluid-lending" — all chains): ~$639.0M as of July 14 2026 (July 6 snapshot: $631.9M; May 23: $872.5M; Apr 27: $750.8M; Feb 2026: $1.28B; peak $2.37B on Oct 9, 2025). Per-chain (July 14): Ethereum $426.1M, Arbitrum $111.2M, Plasma $79.9M, Base $18.5M, Polygon $3.4M.
• Recent TVL trend (DeFiLlama, lending-only daily series): The May 23 peak of $872.5M was followed by a sustained decline through June to $631.9M on July 6, then stabilized at $639.0M by July 14. The May–June decline was broad-based across all chains and asset types; the most recent week is flat-to-slightly-up.

Major TVL Drawdowns (Historical)

Date	Drawdown	Driver
2024-03-20	-13.7%	Early-protocol churn
2024-08-06	-16.1%	Broader crypto market selloff
2025-04-11	-11.3%	Market stress
2026-03-23	-30.3%	Resolv USR exploit contagion
2026-04-19/20	-17.5%	Kelp DAO bridge exploit / rsETH market freeze

The two 2026 events are the largest single-day drawdowns in the protocol's history. Both were driven by external counterparty/collateral-asset events, not by a bug in Fluid's contracts.

Incidents (since Feb 2026)

1. Resolv USR Depeg / Bad Debt Event — March 22, 2026

Upstream cause: Resolv Labs' minting infrastructure was exploited via a compromised AWS KMS-hosted private key (the SERVICE_ROLE signer). The attacker minted ~80M unbacked USR for ~$200K of USDC collateral, extracted ~$25M, and the USR stablecoin depegged from $1.00 to as low as $0.0025 on Curve before partially recovering to ~$0.85.

Impact on Fluid:

• Concentration risk materialized: wstUSR was the largest single supply asset on Fluid (18.9% of all-chain lending TVL per the Feb 2026 assessment), and ~98% of wstUSR supply was reportedly deployed in Fluid leverage loops at up to 6x leverage.
• Bad debt: Estimated $10–17.5M of bad debt accrued in Fluid lending markets when wstUSR-collateralized borrower positions became insolvent (the wrapping ratio of wstUSR meant that positions were deeply underwater even if USR repegged).
• Outflows: ~$300M of net outflows in a single day (the largest in protocol history). Total Fluid TVL: $1.25B (Mar 22) → $873M (Mar 23) = -30.3% in 24 hours.
• Operational response (~30 minutes): Admin team paused new borrowings and froze new deposits on affected vaults, then began analyzing existing positions. Per Fluid's official statement, all other markets continued operating normally.
• Bad debt coverage: Per Fluid's official communication, 100% of bad debt was covered via a short-term loan coverage agreement funded by personal commitments from Lom Lomashuk (Cyber Fund), a contributor known as "weremeow," and the Fluid core team itself. Resolv Labs additionally executed USR redemptions for whitelisted (pre-incident) wallets covering >90% of the affected user group, and committed to a permanent burn of 46M USR (9M immediate + 36M frozen via blacklist) to reduce ongoing depeg pressure.
• Repayment status: Fluid reported that ~$70M of USR-related debt was fully repaid by March 25, 2026, three days after the incident. All lending markets remained operational.
• fToken impact: No direct loss to fToken holders on Ethereum — onchain exchange rates continued to increase monotonically through and after the event (verified). fToken holders are reported as "not affected" per the official statement.

Sources:

• Halborn — Explained: The Resolv Hack (March 2026)
• Sentora Research — The Resolv Hack: $25M From a Single Compromised Key
• WEEX News — Fluid: 100% of bad debts are covered by the short-term loan coverage agreement
• Phemex News — Fluid Begins $70M Repayments After Resolv Incident
• Resolv USR Exploit Analysis (independent)
• Protos — Resolv hack shows DeFi learned nothing from last contagion

Critical observation: The bad-debt coverage was discretionary and off-balance-sheet (loans from named individuals/entities). It is not a pre-funded, programmatic insurance fund or first-loss tranche. While the response was rapid and successful, the same coverage mechanism cannot be assumed to scale to a much larger event, and there is no documented contractual obligation forcing those parties to backstop losses again. This is the most material change to the risk profile since the previous assessment.

2. Kelp DAO rsETH Bridge Exploit — April 18, 2026

Upstream cause: Attacker drained 116,500 rsETH (~18% of circulating supply, ~$292M) from Kelp DAO's LayerZero-powered bridge by tricking the cross-chain messaging layer into accepting a forged instruction. This is the largest DeFi exploit of 2026 to date.

Impact on Fluid:

• Fluid froze its rsETH markets within hours, alongside Aave, SparkLend, and Upshift.
• This was a precautionary action — Fluid contracts were not exploited.
• Total Fluid TVL: $1.04B (Apr 18) → $861M (Apr 20) = -17.5% over 2 days.
• No bad debt event reported.

Sources:

• CoinDesk — 2026's biggest crypto exploit: Kelp DAO hit for $292M
• Aave Governance — rsETH Incident Report (April 20, 2026)

Multi-chain Lending Deployment

Per-chain supply is current (July 14 2026, DeFiLlama); utilization is carried forward from the May 6 LiquidityResolver refresh.

Chain	Supply	USD-Weighted Util	Highest Borrowed-Token Util
Ethereum	$426.1M	~52.5%	GHO 86.7%, ETH 84.9%, USDT 77.6%
Arbitrum	$111.2M	~45.2%	USDC 90.3%, USDT0 88.6%, GHO 86.3%
Plasma	$79.9M	~44.3%	USDT0 90.9%, USDe 58.5%
Base	$18.5M	~40.4%	USDC 86.5%, GHO 84.0%
Polygon	$3.4M	~31.7%	USDT0 92.1%, USDC 87.3%

Combined lending TVL fell from the $872.5M May 23 peak to $631.9M (July 6), then stabilized at $639.0M (July 14, −26.8% from peak). The May–June decline was broad-based across all chains.

Funds Management

How fTokens Work

fTokens are ERC4626-compliant vault tokens. When a user deposits an underlying asset (e.g., USDC), the fToken contract:

1. Calls LIQUIDITY.operate() to deposit the underlying into the Liquidity Layer
2. The Liquidity Layer triggers a callback; the fToken transfers the underlying via SafeTransfer or Permit2
3. Shares are minted to the user based on the current exchange rate

On withdrawal, the reverse occurs: shares are burned before the underlying is withdrawn from the Liquidity Layer (burn-first pattern for safety).

Exchange rate: Computed onchain as tokenExchangePrice / EXCHANGE_PRICES_PRECISION (1e12 precision). The rate is monotonically increasing — it can never decrease. Verified onchain on Apr 27, 2026: all fToken exchange rates have increased since Feb 2026.

It incorporates:

• Yield from the Liquidity Layer (borrower interest)
• Optional rewards from a LendingRewardsRateModel (currently inactive for all fTokens; yields are purely organic)

Safety mechanisms in fToken contracts:

• Custom reentrancy guard (deposit/withdraw/rebalance all protected)
• Callback validation: checks caller = Liquidity AND token = ASSET AND status = ENTERED
• Burn-before-withdraw pattern
• BigMath precision with SafeCast overflow protection
• Rewards rate capped at 50% APR maximum

Accessibility

• Supplying: Permissionless — anyone can deposit via fTokens. No whitelist required.
• Redemption: fToken withdrawals via withdraw() or redeem() (standard ERC4626). Subject to Liquidity Layer withdrawal limits. During the Mar 2026 event, withdrawals from affected (wstUSR-related) vaults were paused while solvent markets continued operating; standard fToken markets (fUSDC etc.) on Ethereum remained operational throughout.
• Fees: No explicit deposit/withdrawal fees. Interest rates are algorithmically determined by utilization via a kink-based model.

Yield Source and Counterparty Risk

fToken yield comes from borrower interest. Borrowers use the Vault Protocol to deposit collateral and borrow assets from the Liquidity Layer. This means fToken holders are exposed to:

• Vault Protocol solvency: If borrowers default and liquidations fail to recover full value, bad debt could affect lending reserves. The Mar 2026 event is a concrete example of this risk materializing — the wstUSR price collapse outpaced the liquidation engine's ability to safely close positions, producing $10–17.5M of bad debt.
• Liquidation effectiveness: The tick-based liquidation mechanism must function correctly to prevent bad debt accumulation. In the Mar 2026 case, the speed and magnitude of the wstUSR price collapse exceeded what the liquidation mechanism could handle without losses.
• Oracle correctness: Vault liquidations depend on Chainlink, UniswapV3 TWAP, and Redstone price feeds. Oracle failures could delay liquidations.
• Coverage mechanism: Bad debt is not covered by a programmatic, pre-funded insurance fund or first-loss tranche. The Mar 2026 incident was covered via discretionary short-term loans from named individuals and entities.

Collateral quality backing fToken yield (borrower collateral types):

• Blue-chip: ETH, WETH, wstETH, weETH, rsETH, WBTC, cbBTC
• Stablecoins: USDC, USDT, USDT0, sUSDe, GHO
• Yield-bearing / higher-risk (the concentration drivers): sUSDai / USDai (31.2% — USD.AI synthetic dollar, Arbitrum-native and bridged), reUSD (6.1% — Re Protocol, Elevated Risk), PST (4.2% — Huma PayFi RWA, bridged from Solana via CCIP), plus syrupUSDC, sUSDS, and previously wstUSR (substantially de-risked post-Mar 2026)

Collateralization

• Backing: All lending positions are over-collateralized onchain. Borrowers must maintain collateral ratios (80–95% LTV depending on the pair).
• Liquidations: Fully onchain tick-based mechanism. Liquidation penalty as low as 0.1% for correlated pairs (wstETH/ETH), higher for uncorrelated pairs.
• Withdrawal Gap: Extra gap on Liquidity Layer limits reserved for liquidations to ensure they can always execute.
• Limitation observed Mar 2026: the liquidation engine's effectiveness depends on the collateral asset behaving like a liquid market asset. When wstUSR's underlying USR depegged ~99.7% intraday, on-DEX liquidity for wstUSR was insufficient for safe liquidation, producing bad debt.

Provability

• Transparency: All reserves are fully onchain and verifiable via resolver contracts (FluidLiquidityResolver at 0xD7588F6c99605Ab274C211a0AFeC60947668A8Cb).
• Exchange Rate: fToken exchange rates are computed programmatically onchain (ERC4626 standard). No offchain oracle or admin input needed. Rate is monotonically increasing — verified.
• Interest Rates: Algorithmically determined based on utilization. USDC rate model (re-verified onchain May 6, 2026): kink at 85% utilization (5.40% rate), second kink at 93% (7.50%), max rate 40%. Proposal #128 has now executed, but it did not emit a USDC/USDT rate update and the live USDC/USDT curve remains unchanged.
• Revenue: Protocol revenue is calculated and verifiable via the RevenueResolver contract.

Interest Rate Model

Decoded from FluidLiquidityResolver.getTokenRateData(token) for each token ((uint256 version, RateDataV1Params v1, RateDataV2Params v2)). Compared against the May 6 and Feb 2026 snapshots in prior reports. All curves unchanged since May 24.

Stablecoins and ETH — current curves:

| Token | Version | Kink 1 | Rate@K1 | Kink 2 | Rate@K2 | Max Rate | |-------|---------|--------|---------|--------|---------|----------|------------| | USDC | V2 | 85% | 5.40% | 93% | 7.50% | 40.00% | | USDT | V2 | 85% | 5.40% | 93% | 7.50% | 40.00% | | GHO | V2 | 85% | 6.50% | 93% | 9.50% | 40.00% | | ETH (native) | V2 | 88% | 2.50% | 93% | 4.00% | 10.00% |

Rate-update events on the Liquidity Layer since May 24, 2026: no new LogUpdateRateDataV2s events. The last rate event remains the May 18 listing of PST (0x22ae3d9a…). USDC/USDT/GHO/ETH curves unchanged since May 6.

Post-Feb USDC/USDT rate history (verified that no new events since the April 23 2026 update — rechecked at block 25529610):

Date	Tx	USDC/USDT Kink 1	Rate at Kink 1	Kink 2	Rate at Kink 2	Notes
Feb 13, 2026	0xe373...131bb	85%	5.00%	93%	8.00%	Liquidity Layer rate update event
Mar 10, 2026	0xa99e...96c06	85%	4.50%	93%	7.50%	Liquidity Layer rate update event
Apr 23, 2026	0x1927...49e	85%	5.40%	93%	7.50%	Liquidity Layer rate update event; still the current live USDC/USDT curve

Proposal #128 (executed May 5 2026) was expected by its text to move USDC/USDT kinks to 90%/95%; the execution receipt did not emit a USDC/USDT rate event and the live state did not change. This unresolved gap between proposal text and onchain effect remains a documented open observation; no follow-up proposal has corrected it.

Liquidity Risk

Lending-Specific Liquidity Concerns

fToken holders face liquidity risk from the shared Liquidity Layer architecture. This architecture and its trade-offs are unchanged since Feb 2026, but the Mar 2026 event provides a concrete stress test.

• Shared pool: fToken withdrawals compete with all other withdrawal demand on the Liquidity Layer.
• Withdrawal limits: The Liquidity Layer enforces per-token expandable withdrawal limits. maxWithdraw() returns the minimum of: (1) the withdrawal limit at Liquidity, (2) actual liquid balance.
• Stress test result (Mar 22–25, 2026): $300M+ net outflows in 24 hours. Standard fToken markets (fUSDC, fUSDT, etc.) on Ethereum continued processing withdrawals throughout. Affected vaults (wstUSR-collateralized) were paused. The kink-based rate model worked as designed — high utilization produced rate increases that incentivized borrowers to repay and stabilize utilization.
• Stress test result (Apr 18–20, 2026): Additional ~$180M outflows over 2 days following the Kelp/rsETH freeze. No further bad debt; precautionary freeze of rsETH markets only.

Exit Mechanisms

• Normal exit: Call withdraw() or redeem() on fToken. Subject to available liquidity and withdrawal limits.
• Secondary market: fTokens are ERC20 tokens and can be traded on secondary markets, though no significant DEX liquidity for fTokens was observed.
• Throttled exit: During high utilization, the expansion-rate mechanism throttles large withdrawals.

Lending TVL by Asset Type (Ethereum)

Source: DeFiLlama fluid-lending Ethereum tokensInUsd — total $426.1M of supply collateral routed through the Liquidity Layer (includes Vault-collateral deposits, not only fToken supply). Percentages are of that Ethereum supply total.

Asset Type	Supply TVL	%
ETH/LSTs (wstETH, weETH, WETH, osETH, rsETH, …)	~$191.8M	45.0%
Yield-bearing stablecoin wrappers (sUSDai, reUSD, sUSDe, …)	~$106.6M	25.0%
Stablecoins (USDT, USDC, USDe, GHO, …)	~$55.7M	13.1%
BTC tokens (WBTC, cbBTC, …)	~$36.7M	8.6%
Other (PST, PAXG, XAUT, …)	~$35.3M	8.3%

Yield-bearing stablecoin wrappers are ~25% of Ethereum supply, now the second-largest category behind ETH/LSTs and larger than plain stablecoins. sUSDai is present on Ethereum at $64.6M (15.2% of Eth supply), up from ~$52M on Jul 6 and near-zero in May — its expansion onto Ethereum adds to the cross-chain concentration concern. This is a bridged representation whose source chain is Arbitrum, not a native Ethereum ERC-4626 vault; the cross-chain burn/mint authority on both chains is documented below.

Top Supply Assets (Cross-Chain)

Source: DeFiLlama fluid-lending tokensInUsd — cross-chain, total $639.0M (Jul 14, 2026).

Rank	Token	Supply TVL	% of Total
1	sUSDai	$199.2M	31.2%
2	wstETH	$133.2M	20.8%
3	WETH	$42.1M	6.6%
4	reUSD	$38.8M	6.1%
5	USDT	$27.4M	4.3%
6	PST	$26.5M	4.2%
7	USDT0	$26.0M	4.1%
8	USDC	$25.8M	4.0%
9	WBTC	$24.9M	3.9%
10	cbBTC	$23.5M	3.7%
11	weETH	$18.1M	2.8%
12	osETH	$11.0M	1.7%
13	ETH	$10.3M	1.6%

Top-5 concentration: 69.0% (was 69.9% on Jul 6, 70.6% on May 23). Top single-asset concentration: 31.2% (was 30.6% on Jul 6, 28.3% on May 23, and 19.9% on Apr 27 before the May 24 memo flagged the 30% trigger). sUSDai + reUSD combined: 37.3% of cross-chain TVL in yield-bearing stablecoin wrappers (was 38.5% on Jul 6 — reUSD shrank while sUSDai grew).

Top Supply Assets (Ethereum)

Source: DeFiLlama fluid-lending Ethereum tokensInUsd — total $451.0M (Jul 23, 2026).

Rank	Token	Supply TVL	% of Total
1	wstETH	$128.1M	28.4%
2	sUSDai	$73.9M	16.4%
3	reUSD	$40.9M	9.1%
4	PST	$39.2M	8.7%
5	WETH	$38.2M	8.5%
6	USDT	$23.7M	5.2%
7	WBTC	$21.4M	4.7%
8	USDC	$20.7M	4.6%
9	cbBTC	$14.8M	3.3%
10	Other	$50.1M	11.1%

Top-5 concentration: 71.0%. Top single-asset concentration: 28.4% (wstETH). Higher-risk assets sUSDai + reUSD + PST combined: $154.0M (34.2%) of Ethereum supply.

Non-blue-chip collateral beyond the wrappers — PST (Ethereum rank 4, $39.2M, 8.7%). Unlike Fluid's blue-chip collateral (wstETH, WETH, WBTC, cbBTC), PST is Huma Finance's "PayFi Strategy Token" and carries three stacked risks that blue-chip assets do not (verified onchain Jul 22, 2026):

• Off-chain RWA credit backing: PST represents a claim on Huma's PayFi receivables (real-world payment-financing / invoice credit), not onchain collateral — its value is not independently verifiable onchain and depends on the performance of off-chain receivables.
• Chainlink CCIP bridge: on Ethereum PST is a BurnMintERC20 (0x22ae3d9a…d4c7) — mint authority is the CCIP BurnMintTokenPool (0xBE77…0D3d); a CCIP/DVN compromise could mint unbacked PST on Ethereum.
• Solana source-chain risk: the CCIP pool's only configured remote chain is Solana (getSupportedChains() returns solely the Solana selector 124615329519749607), so PST is effectively bridged from Solana and inherits Solana-side program/custody risk.

PST was listed May 18 2026 with a steep 50%/80% kink and 100% max rate — Fluid's own rate curve treats it as a higher-risk market than the stablecoin/ETH pairs.

Per-Chain Concentration (Worse Than Cross-Chain Average) — July 14, 2026

Chain	Total Supply	#1 Asset	#1 Share	#2 Asset	#2 Share
Plasma	$79.9M	sUSDai	75.3%	USDT0	20.6%
Arbitrum	$111.2M	sUSDai	63.9%	wstETH	10.0%
Base	$18.5M	cbBTC	27.6%	wstETH	22.4%
Polygon	$3.4M	wstETH	32.0%	WBTC	30.3%
Ethereum	$426.1M	wstETH	27.4%	sUSDai	15.2%

On Arbitrum and Plasma, sUSDai (issued by USD.AI, a synthetic-dollar protocol backed by AI hardware loans) remains overwhelmingly dominant (63.9% / 75.3% of those chains' lending TVL) despite the per-chain percentages declining from May peaks (75.3% / 80.4%) because diverse TVL exited those chains faster than sUSDai did. A USD.AI-level upstream event would still functionally take down lending on those two chains. sUSDai has also expanded onto Ethereum to $64.6M (15.2% of Eth supply), up from ~$52M on Jul 6 and near-zero in May.

Issuer risk profile (USD.AI): USD.AI (usd.ai) describes itself as "a yield-bearing synthetic dollar backed by loans against AI hardware, compute, and DePIN assets" targeting 15–25% APR, with peg maintenance relying on arbitrage rather than over-collateralization or RWA backing. sUSDai market cap is ~$300M with 24h on-chain volume of only ~$681K (~0.2% of market cap — extreme illiquidity). Fluid holds ~$199M of sUSDai — roughly two-thirds of its total supply, making Fluid the dominant liquidity venue for the asset and making any sUSDai exit effectively impossible without cascading price impact. On-chain price history: ATL $0.796 (−20% from par), recently ~$1.10, confirming sUSDai is not a stable-value instrument.

sUSDai cross-chain architecture and LayerZero mint authority (verified Jul 22, 2026): The canonical sUSDai contract is the Arbitrum StakedUSDai, an ERC-4626 vault whose asset() is Arbitrum USDai 0x0A1a…82EF. The same address on Ethereum, 0x0b2b…955ef9, is instead an upgradeable OToken with no asset() / convertToAssets() path. The same-address OAdapter 0xffB200…7f24 burns on send and mints on receive on both chains. On Ethereum it is the sole current BRIDGE_ADMIN_ROLE holder. The authenticated LayerZero path can therefore mint canonical Arbitrum sUSDai, not only the remote Ethereum representation. The canonical mint-side Ethereum→Arbitrum receive route requires all three DVNs (LayerZero Labs, Nethermind, and Canary) and 15 confirmations. Both adapters are owned by the same-address 3-of-3 Safe on their respective chain, see Bridges page. Ethereum proxy upgrades are separately controlled by ProxyAdmin 0x0b3296…d9F, owned by a 48-hour TimelockController. The configured 10M sUSDai/hour Arbitrum→Ethereum limiter applies to outbound debit and does not cap _credit on a forged inbound message. Fluid's Ethereum Liquidity Layer held ~67.5M of ~70.2M mainnet sUSDai supply when rechecked Jul 22 (~96%); at the Jul 14 report snapshot it accounted for the stated $64.6M. A verifier-path or adapter-owner compromise could dilute canonical supply and impair Fluid's broader cross-chain exposure independently of Fluid's own vault oracles. The 3-of-3 DVN route and 3-of-3 owner Safe are meaningful mitigants, but they do not remove the canonical-supply bridge dependency.

External corroboration: per CoinDesk RWA Yield Infrastructure Trade (Mar 2026), Fluid handles ~100% of on-chain sUSDai trading volume and 68% of reUSD trading volume, so a redemption-side stress event in sUSDai would also concentrate on Fluid's liquidity venues.

Concentration Risk Reassessment (July 14, 2026)

The May 24 reassessment said: "the concentration risk has shifted assets but has not been reduced in pattern or magnitude." The situation has further intensified: sUSDai has held above the 30% trigger explicitly set in the May 24 reassessment and now stands at 31.2% of cross-chain lending TVL.

Key facts:

• sUSDai cross-chain share is 12.3 pp higher than the wstUSR share that triggered the Mar 2026 incident.
• On Arbitrum and Plasma, sUSDai is a single point of failure for the chain's lending business (63.9% / 75.3% of chain TVL). While these percentages declined from May peaks, it's because diverse TVL left faster, not because sUSDai was reduced.
• Of the top 4 supply assets globally, two (sUSDai #1, reUSD #4) are yield-bearing stablecoin wrappers — the same structural amplification pattern as wstUSR/USR. Combined they are 37.3% of all-chain TVL.
• Fluid is also the dominant on-chain trading venue for sUSDai (~100%), so the redemption/liquidity surface for sUSDai under stress is itself heavily Fluid-concentrated.
• Note: absolute sUSDai fell from the May peak of $246.7M to $193.3M on Jul 6 as overall TVL contracted, then edged back up to $199.2M by Jul 14. The rising 31.2% share reflects sUSDai being stickier than other assets plus modest renewed inflows in early July.

The structural reasoning holds: yield-bearing-stable wrappers carry contagion risk because their wrap ratio amplifies losses when the underlying depegs. The change since May is that the 30% trigger fired and the share keeps climbing, and sUSDai now appears on Ethereum ($64.6M) as well as Arbitrum/Plasma.

Historical Liquidity Performance

• August 2024: -16.1% TVL drop, recovered without operational issues
• March 2026: -30.3% drop, partial market freezes (wstUSR vaults), bad debt event covered, full recovery within days. Standard fToken markets remained functional.
• April 2026: -17.5% drop, precautionary rsETH freeze, no operational impact to other markets.
• May–Jul 2026: -26.8% TVL decline ($872.5M → $639.0M by Jul 14, having bottomed near $632M in early July). Broad-based across all chains and asset types. No incident, no freezes, no bad debt. fToken exchange rates continued increasing monotonically throughout. This is the first sustained TVL decline without an associated incident — consistent with market rotation rather than protocol stress.

Centralization & Control Risks

Governance

• Governance Model: Onchain GovernorBravo governance. FLUID token holders vote on proposals that execute through a timelock. Discussion on governance forum, onchain voting via GovernorBravo, and offchain signaling via Snapshot.
• Timelock: 0x2386DC45AdDed673317eF068992F19421B481F4c — 1-day (86,400s) delay. Admin = GovernorBravo.
• Owner/Admin: All core contracts (Liquidity Layer proxy admin, LendingFactory, RebalancerProxy) confirmed owned by the Timelock.
• GovernorBravo Parameters:
  • Quorum: 4,000,000 FLUID (4% of total supply) ✓
  • Proposal threshold: 1,000,000 FLUID (1% of total supply) ✓
  • Voting delay: 7,200 blocks (~1 day) ✓
  • Voting period: 14,400 blocks (~2 days) ✓
  • Proposals created: 135; proposals executed: 127 (other 8 are terminal non-executed: 3 Canceled, 3 Defeated, 2 Expired)

Lending-Specific Admin Controls

Role	Who	What They Can Do to Lending
Timelock (governance)	0x2386DC45...	Upgrade Liquidity Layer implementation, change LendingFactory owner, change supply/borrow configs, change rate models
LendingFactory Auths	Set by Timelock	Update fToken rewards config, change rebalancer address, rescue stuck tokens, set fToken creation code
LendingFactory Deployers	Set by Timelock	Create new fToken contracts
Rebalancer (fUSDC, fUSDT)	0x264786EF…ce92 — FluidReserveContractProxy, owner()=Timelock	Deposit underlying without minting shares (adds as rewards). Cannot withdraw. (Corrected from Apr 2026 report, which named the inactive FluidLendingRewardsRateModel 0x724d…b9b6 in this slot.)
Guardian (Avocado multisig)	0x4F6F977a...	Pause Class 0 protocols only. Cannot move or withdraw funds. Cancel timelock transactions. Used to freeze rsETH markets in Apr 2026 (precautionary).

Key finding: No admin role can directly access or move user funds deposited via fTokens. The most powerful action is the Timelock upgrading the Liquidity Layer implementation (1-day delay). The Guardian's pause capability was exercised appropriately in both Mar and Apr 2026 events without abuse. No LogPauseUser or LogUnpauseUser events since May 24, 2026 — all previously-frozen vaults have been reopened and no new market freezes have occurred.

Programmability

• System Operations: Largely programmatic. Interest rates and exchange rates are all computed onchain algorithmically.
• Oracle System (dependency via Vault Protocol): Chainlink primary, with UniswapV3 TWAP, Redstone, and custom center-price oracles as fallbacks. Modular per vault.
• Rate Model: Interest rates determined algorithmically via kink-based utilization model. Parameters set by governance.
• Keepers/Automation: No keepers needed for lending. Liquidations (in Vaults) are incentivized and performed by external liquidators.

External Dependencies

• Liquidity Layer: Critical dependency — holds all fToken deposits. Upgradeable proxy controlled by Timelock.
• Vault Protocol: Generates fToken yield. Vault borrowers, liquidations, and oracles all affect lending counterparty risk.
• Chainlink: Indirect dependency via Vault Protocol oracle system. Multiple fallback oracle paths reduce risk.
• Permit2: Supported for deposits (Uniswap's 0x000000000022D473030F116dDEE9F6B43aC78BA3).
• External collateral asset issuers: As demonstrated by the Resolv (USR/wstUSR) and Kelp (rsETH) events, the protocol's risk surface includes the operational security of every accepted collateral asset issuer. A compromise of an issuer's keys or bridge can produce contagion damage even without any bug in Fluid.

Operational Risk

• Team: Instadapp Labs. Founded by Sowmay Jain and Samyak Jain — both are publicly known, India-based founders active since 2019. Key GitHub contributors include thrilok209, KABBOUCHI, and SamarendraGouda.
• Funding: Well-funded by top-tier VCs: Pantera Capital, Coinbase Ventures, Standard Crypto, additional undisclosed investors.
• Legal Structure: Instadapp Labs.
• Documentation: Comprehensive technical documentation at docs.fluid.instadapp.io. Full source code on GitHub.
• Communication: Active governance forum, Discord, Twitter @0xfluid.
• Incident Response: Mar 2026 response demonstrated the team can act within ~30 minutes (pause/freeze affected markets) and arrange off-balance-sheet capital coverage of ~$70M within ~3 days. Strong response, but reliance on personal commitments rather than a programmatic mechanism is a structural concern.

Monitoring

Contracts to Monitor

Contract	Address	What to Monitor
fUSDC	0x9Fb7b4477576Fe5B32be4C1843aFB1e55F251B33	Largest fToken (~$134M Jul 14 2026). Exchange rate, deposits/withdrawals
fUSDT	0x5C20B550819128074FD538Edf79791733ccEdd18	Second largest (~$131M Jul 14 2026). Exchange rate, deposits/withdrawals
Liquidity Layer	0x52Aa899454998Be5b000Ad077a46Bbe360F4e497	Holds all fToken deposits. Admin changes, implementation upgrades
Liquidity Layer impl (current)	0xcc331daf69752bece3dc98dbc63eacd5092266a2	Implementation contract behind the proxy. Monitor for changes via EIP-1967 implementation slot.
Timelock	0x2386DC45AdDed673317eF068992F19421B481F4c	Owner of all core contracts — queued/executed transactions
GovernorBravo	0x0204Cd037B2ec03605CFdFe482D8e257C765fA1B	Governance proposals, voting, execution
Avocado Multisig	0x4F6F977aCDD1177DCD81aB83074855EcB9C2D49e	Guardian pause/cancel actions

Key Events to Watch

Contract	Event	Significance
Timelock	QueueTransaction / ExecuteTransaction	Governance actions queued/executed — 1 day warning
LendingFactory	New fToken creation	New lending market created
Liquidity Layer	LogUpdateAuth	Auth permissions changed — affects who can modify lending configs
Liquidity Layer	LogUpdateGuardian	Guardian address changed
Liquidity Layer	LogPauseUser / LogUnpauseUser	Protocol paused/unpaused — directly affects fToken operations. Now an actively exercised path (Mar/Apr 2026).
Liquidity Layer	LogUpdateUserSupplyConfigs	Supply limits changed — affects max fToken deposits
Liquidity Layer	LogUpdateUserBorrowConfigs	Borrow limits changed — affects utilization and withdrawal availability
Liquidity Layer	LogUpdateRateDataV1 / LogUpdateRateDataV2	Interest rate parameters changed — affects fToken yield
EIP-1967 Admin (proxy)	Storage slot read	Implementation changes on Liquidity Layer / fToken contracts

New Monitoring Recommendation: Collateral Asset Issuers

Given the Mar/Apr 2026 contagion events, monitoring of the off-protocol collateral asset issuers (Resolv, Kelp, Ethena, Maple, etc.) is now a first-order concern. A compromise at any major upstream issuer can produce sub-day bad-debt events at Fluid even without any Fluid contract change.

Top-priority issuer to monitor (July 2026 update): USD.AI (sUSDai). sUSDai is now 31.2% of cross-chain Fluid lending TVL (above the 30% reassessment trigger set in May 2026) and 64–75% of Arbitrum/Plasma supply. sUSDai is issued by USD.AI (usd.ai). USD.AI is a synthetic-dollar protocol backed by AI hardware loans with peg maintenance via arbitrage, targeting 15–25% APR. Key risk factors: Fluid holds ~$199M of sUSDai — roughly two-thirds of its ~$300M supply; 24h on-chain volume is only ~$681K (~0.2% of market cap); price has historically ranged $0.796–$1.19. Any incident touching USD.AI governance, the underlying loan-collateral pool, USDai redemption mechanics, or USDai peg stability is the single highest-impact external event for Fluid lenders at this snapshot. Second-priority: Sky/Maker (sUSDS, fsUSDS). sUSDS is Sky's savings token — a separate, much smaller exposure (~$5K fToken supply). Sky is well-established but a Sky governance incident would still affect Fluid via USDS/USDC and USDS/USDT liquidity even though sUSDS supply on Fluid is minimal.

Third-priority: Re Protocol (reUSD). reUSD is $38.8M (6.1% of cross-chain TVL, ~26.7% of total reUSD supply). Standalone risk assessment at reports/report/re-reusd.md scores 3.51/5.0 (Elevated Risk). Key risk factors for Fluid lenders: ~50% offchain backing via §114 reinsurance trusts; share price written daily by admin-controlled Chainlink Functions (setSharePrice on SharePriceCalculator); ~86% of onchain reserves held at plain EOAs with no onchain timelock or role gating; only ~50.2% reUSD-only onchain coverage (near the 50% floor); no bug bounty; 42% branch test coverage. Any incident touching Re's custodial EOAs, the NAVConsumer oracle, the §114 trust counterparties, or Re's 3-of-5 governance Safe would affect the $38.8M reUSD position on Fluid.

Fourth-priority: Huma / PST (bridged from Solana). PST (Huma "PayFi Strategy Token") is $26.5M (4.2% of cross-chain TVL) and is not blue-chip: it is backed by off-chain PayFi receivables rather than onchain collateral, and on Ethereum is a Chainlink CCIP BurnMintERC20 (0x22ae3d9a…d4c7) bridged solely from Solana (pool 0xBE77…0D3d supports only the Solana chain selector). Monitor the CCIP token-pool mint activity and rate limits, Huma's receivables performance and redemption liquidity, and any Solana-side program incident — any of which could impair or unbacked-mint the Ethereum PST that Fluid vaults hold as collateral.

Reassessment Triggers

• Time-based: Reassess in 2 months (September 2026) — shorter than the standard 6 months because sUSDai has crossed the 30% trigger and the TVL trajectory bears watching.
• Concentration-based (FIRED — Jul 6 2026): Reassess immediately if sUSDai exceeds 30% of cross-chain lending TVL → TRIGGER FIRED at 30.6% (Jul 6), now 31.2% (Jul 14). Reassess immediately if sUSDai exceeds 40% of cross-chain lending TVL.
• Coverage-mechanism formalization: Reassess if Fluid implements a programmatic insurance/coverage layer (would lower funds-management subcategory). Conversely, reassess if the protocol experiences a second bad-debt event without comparable third-party coverage.
• TVL-based: Reassess if lending TVL changes by more than 50% from current ~$639M baseline (July 14 2026) — i.e., drops below ~$320M or exceeds ~$959M.
• sUSDai source-chain / bridge controls (highest priority): Reassess immediately on any mint-role or admin-role change on Arbitrum or Ethereum sUSDai, either OAdapter owner change, peer or DVN-route configuration change, rate-limit change, proxy implementation upgrade, cross-chain supply mismatch, or unexpected canonical Arbitrum mint.
• USDai T1 depeg / utilization: The Arbitrum and Base USDai T1 vaults use a hardcoded 1:1 peg leg that does not reflect a depeg. Monitor USDai market price and these vaults' debt, not the aggregate sUSDai supply balance. Reassess immediately if USDai deviates below ~$0.97, if aggregate hard-peg T1 debt becomes material, or if their oracle configuration changes. A depeg past ~1 − CF (≈6% at 94% CF) on maxed positions can produce uncovered bad debt.
• Incident-based: Reassess after any further exploit, governance change, significant parameter modification, or contagion event from a major collateral issuer (especially USD.AI for sUSDai, Re for reUSD, Sky/Maker for sUSDS).
• Governance: Reassess if GovernorBravo parameters change (quorum, timelock delay, voting period) or if Avocado guardian configuration changes.
• Dependency: Reassess if Liquidity Layer implementation is upgraded (current impl: 0xcc331daf69752bece3dc98dbc63eacd5092266a2) or if a new protocol is added to the shared liquidity pool.

Open Observations

• Proposal #128 (executed May 5 2026) didn't change USDC/USDT kinks despite the proposal text saying it would; only an ETH rateAtUtilizationMax event was emitted. All subsequent proposals (#129–#135) have since executed. The onchain USDC/USDT curves remain at 85%/93% kink with 5.40%/7.50% rates as verified at block 25529610.

Appendix: Contract Architecture

┌─────────────────────────────────────────────────────────────────────────┐
│                          GOVERNANCE LAYER                                │
│                                                                          │
│   FLUID Token Holders   (100M max supply, 4M quorum, 1M propose)         │
│              │                                                           │
│              │ propose / vote                                            │
│              ▼                                                           │
│   ┌────────────────────────────┐      ┌──────────────────────────────┐  │
│   │  GovernorBravo             │      │  Avocado Multisig (Guardian) │  │
│   │  0x0204Cd03...             │      │  0x4F6F977a...               │  │
│   │  proposalCount: 135        │      │  Custom contract (not Safe)  │  │
│   │  127 Executed              │      │  7-of-14 custom guardian     │  │
│   │  voting: 1d delay, 2d vote │      │  - Pause Class-0 protocols   │  │
│   │                            │      │  - Cancel timelock txns      │  │
│   └────────────┬───────────────┘      └────────────┬─────────────────┘  │
│                │ queue                             │ cancel              │
│                ▼                                   ▼                     │
│   ┌──────────────────────────────────────────────────────────────────┐  │
│   │  Timelock — 1-day delay (admin = GovernorBravo)                  │  │
│   │  0x2386DC45AdDed673317eF068992F19421B481F4c                      │  │
│   │  Owns: Liquidity Layer admin slot, LendingFactory, VaultFactory, │  │
│   │        DexFactory                                                │  │
│   └──────────────────────────────────────────────────────────────────┘  │
└──────────────────────────────────┬──────────────────────────────────────┘
                                   │ owns / upgrades
                                   ▼
┌─────────────────────────────────────────────────────────────────────────┐
│                        CORE INFRASTRUCTURE                               │
│                                                                          │
│   ┌──────────────────────────────────────────────────────────────────┐  │
│   │  Liquidity Layer  (Instadapp Infinite Proxy)                     │  │
│   │  Proxy: 0x52Aa899454998Be5b000Ad077a46Bbe360F4e497                │  │
│   │  EIP-1967 dummy impl (current): 0xcc331daf… (since Mar 31 2026)  │  │
│   │      previous: 0xa57d7cEF…  (upgrade tx 0xf484b2a2…)             │  │
│   │  Module-dispatch logic in module slots, NOT EIP-1967 impl slot   │  │
│   │                                                                  │  │
│   │  Holds ALL deposits across lending / vaults / DEX / stETH        │  │
│   └────┬─────────────────────────────────────────────────────────────┘  │
│        │                                                                 │
│   ┌────▼────────────────┐  ┌─────────────────┐  ┌───────────────────┐   │
│   │  LendingFactory     │  │  Resolvers      │  │  Sibling Factories│   │
│   │  0x54B91A0D...      │  │  FluidLiquidity │  │  VaultFactory     │   │
│   │  Deploys fTokens    │  │  Revenue        │  │  DexFactory       │   │
│   └────┬────────────────┘  └─────────────────┘  └────────┬──────────┘   │
└────────┼───────────────────────────────────────────────────┼────────────┘
         │ deploys                                           │ deploys
         ▼                                                   ▼
┌──────────────────────────────────┐    ┌────────────────────────────────┐
│   LENDING PROTOCOL (fTokens)     │    │   SIBLING PROTOCOLS            │
│   ERC4626, monotonic exch. rate  │    │   (share Liquidity Layer)      │
│                                  │    │                                │
│   fUSDC   0x9Fb7…  ~$134M        │    │  Vault Protocol                │
│   fUSDT   0x5C20…  ~$131M        │    │   - borrowers + collateral     │
│   fGHO    0x6A29…  ~$15M         │◀───│   - tick-based liquidations    │
│   fwstETH 0x2411…  ~360 wstETH   │ yield   - generates fToken yield    │
│   fWETH   0x9055…  ~1,600 WETH   │    │                                │
│   fUSDtb  0x15e8…  ~$2.2M        │    │  DEX Protocol                  │
│   fsUSDS  0x2BBE…  ~$5K          │    │  stETH Protocol                │
│                                  │    │                                │
│   All-chain lending TVL: ~$639M  │    │                                │
└──────┬──────────────────▲────────┘    └─────────┬──────────────────────┘
       │ deposit            ▲ withdraw            │ borrow / repay
       ▼                    │                     ▼
   Lenders               (no value loss        Borrowers
                          Mar/Apr 2026)        (post collateral)
                                                  │
                                                  ▼
┌─────────────────────────────────────────────────────────────────────────┐
│                       EXTERNAL DEPENDENCIES                              │
│                                                                          │
│  ORACLES  (Vault Protocol consumes these for liquidations)               │
│    Chainlink (primary)  •  UniswapV3 TWAP  •  Redstone  •  custom        │
│                                                                          │
│  COLLATERAL-ASSET ISSUERS  ← first-order contagion vector                │
│    Top-10 cross-chain supply (Jul 14 2026, total $639.0M):               │
│      sUSDai   31.2%  (USD.AI — Staked USDai)            ★★★ ABOVE 30%     │
│      wstETH   20.8%  (Lido)                             trigger          │
│      reUSD     6.1%  (Re Protocol — score 3.51 Elevated Risk) ★              │
│      WETH      6.6%   USDT  4.3%   PST   4.2%   USDT0 4.1%               │
│      USDC      4.0%   WBTC  3.9%   cbBTC 3.7%   weETH 2.8%               │
│    ★ = yield-bearing stablecoin wrapper (same structural pattern as      │
│        wstUSR/USR that produced the Mar 22 2026 bad-debt event)          │
│    ★★★ = sUSDai above 30% trigger set in May 24 report. Issuer is       │
│        USD.AI (usd.ai). Fluid holds ~2/3 of total supply.  │
│        Per-chain: Plasma 75.3%, Arbitrum 63.9%, Ethereum 15.2%.         │
│                                                                          │
│                                                                          │
│    Materialized contagion (since Feb 2026 assessment):                   │
│      Mar 22 2026 — Resolv USR depeg → wstUSR collateral collapse →       │
│                    $10–17.5M bad debt (covered off-balance-sheet)        │
│      Apr 18 2026 — Kelp DAO bridge exploit → rsETH precautionary freeze  │
│                    (no Fluid contract loss)                              │
│                                                                          │
│  PERMIT2 (Uniswap):  0x000000000022D473030F116dDEE9F6B43aC78BA3          │
└─────────────────────────────────────────────────────────────────────────┘

Risk pathways (key):

• Lender → fToken → Liquidity Layer: fully programmatic ERC4626 with burn-before-withdraw; exchange rate monotonically increasing (verified through all 2026 events including the May–Jul TVL drawdown).
• Borrower default → bad debt → fToken yield: realized in Mar 2026 ($10–17.5M). No programmatic backstop; covered via discretionary loans (cyberfund/Lomashuk, weremeow, Fluid core team).
• Collateral-issuer / bridge compromise → wrap-ratio amplified loss → bad debt: the structural pattern that produced Mar 2026. sUSDai is 31.2% cross-chain and 64–75% on Arbitrum/Plasma — larger than the wstUSR exposure that triggered the prior incident. Issuer and source chain: USD.AI on Arbitrum, a novel synthetic-dollar protocol backed by AI hardware loans. Fluid holds ~two-thirds of all sUSDai supply with near-zero exit liquidity (~0.2% daily volume). sUSDai has traded as low as $0.796. The LayerZero OAdapter has mint/burn authority on both the Ethereum OToken and canonical Arbitrum sUSDai, adding a canonical-supply failure path; the Arbitrum receive route is 3-of-3 with 15 confirmations, but its outbound rate limiter does not cap inbound credit. reUSD (6.1%, $38.8M) has a standalone risk score of 3.51/5.0 (Elevated Risk) per reports/report/re-reusd.md: ~50% offchain backing, admin-written share prices, EOA reserve custody, no bug bounty. Combined sUSDai + reUSD = ~37% of TVL in high-risk yield-bearing wrappers.
• Governance → Timelock (1d) → Liquidity Layer impl: upgrade path. The Mar 31 2026 upgrade bundled dummy-impl swap + module-dispatcher selectors in one tx (0xf484b2a2…). No subsequent upgrades.
• Avocado Guardian → Pause Class-0: cannot move funds; used appropriately in both Mar and Apr 2026 events. No pause/unpause events since May 24 2026.