Fluid Lending

Identification — as of October 3, 2026

• Name/category: Fluid Protocol; *Fluid Lending* is its lending/fToken module, built around a shared Liquidity Layer with lending, vaults and DEX functionality.
• Website: https://www.fluid.io/ (official Fluid support identifies fluid.io as the project site). Docs/code: Fluid technical docs and the public Instadapp/fluid-contracts-public repository.
• Launch: Protocol introduced publicly on October 10, 2023; the production launch proposal for Lending/Vaults/Liquidity was submitted February 7, 2024. An exact first-mainnet-live timestamp is Not verifiable as of October 3, 2026.
• Chains: Ethereum, Arbitrum, Base, Polygon and Plasma are listed in deployment references. Explorer evidence confirms the shared Liquidity Proxy on Ethereum, Arbitrum, Polygon and Plasma; Base requires a separate direct explorer confirmation.
• Token: FLUID, formerly INST; the rebrand occurred in December 2024. It functions as the governance/value-alignment token. Principal addresses
• FluidLiquidityProxy: 0x52Aa899454998Be5b000Ad077a46Bbe360F4e497 — reported for all five chains; explorer labels include FluidLiquidityProxy / Fluid: Liquidity Layer.
• LendingFactory (Ethereum reference): 0x54B91A0D94cb471F37f949c60F7Fa7935b551D03; verified source/ABI is visible on PlasmaScan and the address appears in deployment records.
• Required two-source cross-check including Dune: Not verifiable as of October 3, 2026. Dune MCP was unavailable; no Dune query/execution IDs exist for this run. Base-specific factory verification is likewise Not verifiable as of October 3, 2026. > Contradiction: Earlier notes treated Plasma as unverified. Current deployment references and PlasmaScan now show Fluid contracts there; the older finding is superseded. Fork lineage Fluid is not evidenced as a direct fork of Aave, Compound, Maker or Uniswap. Its documentation says it was architecturally inspired by those protocols but uses an original modular Liquidity Layer, fTokens and Vaults. Audits covered Fluid’s own codebase, including MixBytes and StateMind reviews. Whether every deployed-chain modification was separately audited is Not verifiable as of October 3, 2026. A documented malicious-modification history in comparable Fluid forks is Not verifiable as of October 3, 2026.

Fluid Lending looks like a real live product, not just a landing page: the technical docs expose concrete lending actions such as withdraw/redeem flows, ERC-20 and native-token support, ERC-4626-style fTokens, and a documented API surface for market data and user positions. The site also publishes product/blog pages describing active lending markets and a broader Fluid ecosystem, which is consistent with an operational app rather than a template-only marketing site. Open API: yes.

The docs explicitly document endpoints under https://api.fluid.instadapp.io for lending tokens, liquidity tokens, yield/rate data, and merkle rewards, which indicates a public read API for integrators. What is not verifiable as of 2026-10-03: whether the current user-facing portal on all supported chains has fully working live deposits and withdrawals, whether there are broken links or template artifacts on the live UI, and whether any displayed metrics are stale or fabricated. Those checks would require live portal inspection and/or on-chain verification, which is unavailable in this run.

Active Immunefi bug bounty under the Instadapp program, with Fluid Lending explicitly in scope. The listing states rewards are paid in USDC, USDT, or DAI on Ethereum, denominated in USD. Critical smart-contract issues pay 10% of directly affected funds up to $500,000 with a $25,000 minimum; high smart-contract issues are capped at $100,000 with a $5,000 minimum.

A proof of concept is required for all severities, and the bounty covers deployed smart-contract vulnerabilities in scope. Public records found do not show a disclosed incident-result ledger or a clearly reported bounty payout history specific to Fluid Lending; Not verifiable as of 2026-10-03.

Assessment: medium-high. As of October 6, 2026, no active external dependency failure was identified; however, exact dependency concentrations remain Not verifiable as of October 6, 2026 because Dune/on-chain verification is unavailable. Chain and bridge structure. Fluid states that each deployment is a separate per-chain liquidity pool, with no native cross-chain pool, bridge, or messaging layer. This limits direct cross-chain contagion but leaves users exposed to any third-party bridge they use to move collateral.

The latest accessible DeFiLlama snapshot is stale (>7 days): $629.95m TVL, allocated Ethereum 66.3%, Arbitrum 17.1%, Plasma 13.1%, Base 2.8%, and Polygon 0.5%. This confirms material Ethereum concentration, but current percentages are Not verifiable as of October 6, 2026. Oracle/manipulation risk. Fluid documentation describes a combined Uniswap TWAP and Chainlink oracle design with multiple TWAP checkpoints and deviation checks. The 2023 PeckShield audit identified a high-severity Chainlink price-scaling issue, marked resolved, but explicitly excluded the external oracle itself from audit scope.

A stale, manipulated, unavailable, or misconfigured oracle could cause under-collateralized borrowing, delayed liquidations, or bad-debt socialization. External asset dependencies. Stablecoin depeg, LST/LRT impairment, or issuer insolvency could transmit directly through collateral and debt markets. Fluid documentation references leveraged stETH positions, but current collateral, stablecoin, LST/restaking, and per-issuer exposures are Not verifiable as of October 6, 2026. RWA issuer/SPV, custodian, CEX, and market-maker exposure is likewise Not verifiable as of October 6, 2026.

Proposed “custodied collateral” support is a future/unverified marketing claim, not evidence of current exposure. Incident and counterparty signal. On May 27, 2026, compromised reward-distributor keys caused approximately $225k of losses across Ethereum, Base, and Arbitrum; core lending markets and user deposits were reportedly unaffected. This was an operational-key/custody failure, not an oracle or lending-pool failure, but it demonstrates counterparty and privileged-operator risk. Fluid’s “zero user funds lost” statement should therefore be read narrowly: it conflicts with the independently reported reward-distributor loss, although the lending pool was not reported affected.

Primary scenarios: oracle failure/manipulation, stablecoin or LST depeg, bridge failure during user transfers, liquidation cascades, and privileged-key compromise.

Fluid Lending is organized as a non-custodial smart-contract protocol: users deposit from their own wallet, and withdrawals are executed through protocol contracts rather than by a custodian holding client keys. The current evidence does not support a protocol-wide withdrawal pause; however, past incident handling shows that withdrawals can be temporarily restricted for specific affected markets or vaults, so a blanket pause is not verifiable as of 2026-10-05. Protocol-wide segregated custody is also not verifiable as of 2026-10-05: the available evidence points to pooled on-chain liquidity with market-level accounting, not to a separately ring-fenced custody structure for all assets.

Assessment — Fluid Lending key management (as of October 3, 2026) Fluid Lending does not appear to document a separate user-key custody or operational key-management system. The relevant control model is smart-contract access control around the shared Liquidity Layer and Lending contracts.

• Governance/admin authority: Fluid governance is intended to control lending-market configuration, including rate curves, fees, token allowances, protocol integrations, limits, and rewards.
• Emergency authority: A team multisig was designated as the Liquidity Layer’s guardian. Lending and Vault were classified as Class 0 protocols, allowing the guardian to pause their access to liquidity during an incident. The same proposal also identified the team multisig as deployer, while ownership was transferred to the Instadapp DAO.
• Timelock: A governance timelock has been described in Fluid governance records, with approximately a one-day execution delay in the documented configuration. A third-party 2026 assessment also reports a 24-hour timelock, but this is analytics-platform evidence rather than primary on-chain verification.
• Oracle controls: Fluid’s 2026 architecture update adds per-key pricing configuration, source validation, deviation checks, and per-token pause controls. Here, “key” refers to an oracle/pricing key or configuration identifier—not a private signing key. Risk conclusion: The defensible model is DAO/governance-controlled configuration, a team-controlled emergency guardian, and a timelock for governance actions. This creates residual centralization risk because the emergency multisig can pause lending access, while governance can change critical market and oracle parameters. Not verifiable as of October 3, 2026: the current signer identities, multisig threshold, exact timelock contract, upgrade-admin arrangement, and whether these controls are identical across Ethereum, Arbitrum, Base, Plasma, and Polygon. Dune/on-chain verification was unavailable for this run, so no current per-chain key-holder claim is made.

Assessment date: October 10, 2026. Dune is unavailable in this run; therefore proxy-admin event decoding, role-state verification, renunciation checks, and measured on-chain timelock execution are Not verifiable as of October 10, 2026. Architecture / addresses. Fluid Lending uses fTokens through a central Fluid Liquidity Layer that holds user funds; the Liquidity Layer is an upgradeable Instadapp Infinite Proxy. LendingFactory deploys fTokens, while VaultFactory deploys collateralized borrowing markets. The documented Ethereum Liquidity proxy is 0x52Aa899454998Be5b000Ad077a46Bbe360F4e497; the Ethereum Timelock is 0x2386DC45AdDed673317eF068992F19421B481F4c; GovernorBravo is 0x0204Cd037B2ec03605CFdFe482D8e257C765fA1B; the guardian/team multisig is 0x4F6F977aCDD1177DCD81aB83074855EcB9C2D49e; and the fUSDC/fUSDT rebalancer is 0x264786EF916af64a1DB19F513F24a3681734ce92.

Yearn’s independent review identifies the same core ownership model and a 1-day/86,400-second Timelock delay. Privileged capabilities. The Timelock can upgrade the Liquidity implementation, change LendingFactory ownership, alter supply/borrow limits and rate models, configure rewards/rebalancing, and authorize new fTokens. The guardian can pause Class-0 protocols and cancel queued Timelock transactions, but reportedly cannot transfer Liquidity Layer funds. Rebalancer permissions are described as deposit-only and unable to withdraw. Exit / failure analysis. Users generally retain permissionless fToken redemption, subject to liquidity and protocol withdrawal-limit mechanics.

A compromised guardian can freeze affected markets; a compromised GovernorBravo/Timelock path could, after the delay, upgrade the central proxy to malicious logic, manipulate limits/oracles/rates, or freeze withdrawals. This is the principal catastrophic scenario. No evidence reviewed shows a direct single-key drain function; however, the upgrade authority is economically equivalent to full-custody risk if governance is captured.

Full per-chain role and proxy-admin mapping: Not verifiable as of October 10, 2026. Audit coverage. Public records show multiple Fluid audits, including PeckShield and StateMind full-protocol reviews and MixBytes/StateMind Liquidity reviews; the cited MixBytes Vault audit reported 0 critical and 0 high findings, with remaining medium/low findings addressed or acknowledged. Map: GovernorBravo → 1-day Timelock → Liquidity Infinite Proxy → Liquidity Layer → fTokens / Vaults; Guardian multisig → pause/cancel controls; Oracles → Vault risk and liquidation pricing. Risk conclusion: Upgrade/capture risk is material; direct admin-drain risk is not evidenced in reviewed sources, but a malicious upgrade could become a protocol-wide drain or freeze.

Fluid DEX protocol audit is listed on the official audits/security page.

New published report identified: Statemind, “Fluid PR validation,” listed in Statemind’s public audit registry on March 2, 2026. This is a validation report rather than a conventional full-scope audit.

New published report identified: Cantina, “Instadapp fluid Competition,” published January 7, 2025. The report covers a Cantina competition conducted September 11–October 2, 2024 for the Fluid DEX codebase. It identified 0 critical, 0 high, 2 medium, 7 low, and 4 informational issues.

The two medium findings concern incorrect TWAP-oracle updates and a division-by-zero condition that could lock the DEX. The report does not provide a deployed-bytecode match or complete remediation-status table.

Corrected previously recorded event: Statemind, “Instadapp Liquidity Layer Update,” published October 14, 2025. The report provides a complete severity and remediation breakdown: one high issue and four informational issues. The high issue was fixed; one informational issue was fixed and three were acknowledged.

New published report identified: MixBytes, “Fluid DEX Security Audit Report,” published December 4, 2024. The report covers Fluid DEX PoolT1 components and lists deployed Ethereum mainnet pool addresses. It found three low-severity issues, all acknowledged.

New published report identified: MixBytes, “Instadapp Fluid Money Market Oracle Security Audit Report,” listed in MixBytes’ public audit registry on March 17, 2026.

Multiple Fluid audits are listed by Fluid, including Vault protocol, Fluid DEX protocol, and Fluid Liquidity Layer audits.

MixBytes — Fluid Vault Protocol Security Audit.

Instadapp Fluid Audit Report; scope covered the protocol’s general architecture, cross-vault interactions, big number math, tick math, user operations, and the liquidation algorithm. The report’s findings section lists no Critical issues; the snippet explicitly shows 'Critical: Not found.'

MixBytes published a 2025 Fluid Liquidity Layer audit for changes between two commits; the PDF notes some components were out of scope and that the initial commit was not audited.

PeckShield — Fluid Audit Report #2023-245.

Pre-launch comprehensive audit listed on Fluid’s audits/security page.

Fluid lending/protocol security page and third-party summaries indicate a pre-launch comprehensive audit by PeckShield covering the lending/protocol surface before launch.

Statemind — Fluid Security Audit.

Separate Liquidity Layer updates audit is listed on the official page, indicating later maintenance coverage beyond the main StateMind report.

Fluid Lending / broader Fluid protocol audit report hosted in Fluid docs. The accessible snippet states the audit of the codebase found 66 issues total: 3 critical, 8 high, 15 medium, 40 informational.

Identity and founders. Fluid Lending is the current protocol developed by the Instadapp team, not a separate namesake project. Publicly identified founders are Samyak Jain and Sowmay Jain; publicly listed senior personnel include Thrilok Kumar (reported as CTO/CPO) and Ahmad Mardeni. Independent profiles describe Fluid as emerging from Instadapp, which launched in 2018 and was rebranded toward Fluid in 2024. Prior project and outcomes. The team’s main prior project is Instadapp, a DeFi middleware/management platform integrating Maker, Aave, Compound and other protocols.

Samyak Jain reportedly won an Ethereum hackathon, left university, and co-founded Instadapp; the project raised approximately $2.4 million from Pantera and Naval Ravikant in 2019. Reported historical scale reached approximately $12 billion TVL, but this is an analytics/third-party figure rather than an on-chain verification. Security and incident history. The available evidence does not support a clean “no incidents” characterization. In March 2026, a Resolv-related exploit reportedly pushed approximately $80 million of unbacked tokens into Fluid, creating substantial bad-debt and risk-management consequences.

A separate historical summary reports a May 2026 compromise of reward-distributor infrastructure that drained approximately 125,000 FLUID and 51,900 GHO; this appears to concern privileged operational infrastructure rather than a demonstrated core lending-contract exploit. A token-transparency filing stated no prior exploits affecting tokenholders or protocol funds as of June 12, 2026, which conflicts with the later incident reporting and is therefore stale or narrower in scope. > Contradiction / reality check: “No prior exploits” is not consistent with later 2026 reporting of the Resolv-linked loss and reward-distributor compromise. The conflicting claim should not be used as evidence of an incident-free record. Public vs. anonymous and credibility. The founders and several team members are publicly named, with professional profiles reported for the leadership team.

This is a meaningful positive relative to an anonymous protocol, but it does not establish legal liability, financial solvency, or operational-key security. The team has credible prior DeFi-building experience through Instadapp, while the incidents indicate material third-party, treasury, or operational-risk exposure. Office, domicile, and business reality. A real physical office, confirmed onshore/offshore legal domicile, and independently verified operating entity were Not verifiable as of October 10, 2026. Fluid has public code repositories, a documented development history, and a functioning protocol, so it is not merely a web front; however, corporate substance and office location remain unverified.

Claims sourced only from Fluid’s own website are treated as unverified marketing claims.

Reputation assessment: elevated but not categorically unacceptable risk. Fluid has credible institutional backing and a substantial audit program, but its reputation is materially affected by a 2026 partner-protocol contagion event, disputed incident reporting, and unresolved concerns around oracle, parameter, and operational risks. On-chain verification was unavailable for this review; therefore exposure, treasury coverage, current solvency, and chain-specific TVL cannot be independently confirmed. Not verifiable as of October 10, 2026.

• Team and investors: Fluid was founded by David Maas and Meir Bank, reportedly former Citibank and AngelDAO personnel. It raised $3.9 million from Bloccelerate, Animoca Ventures, CMS Holdings, Maelstrom, and others. These are positive reputation signals, but investor participation does not validate solvency or smart-contract safety.
• Audits and security: Search results attribute audits to PeckShield, StateMind, MixBytes, Cantina, and Certora across lending, liquidity-layer, vault, and DEX components. Reported historical findings include a delegate-call issue that was addressed, a documented MAX_RATE mismatch, tick-allocation/DoS risk, and acceptance of stale oracle data; the available results do not establish that every issue was independently verified as resolved.
• Material incident: A March 2026 Resolv exploit reportedly created approximately $80 million of unbacked collateral exposure at Fluid; independent curation reports estimate roughly $10–17.5 million of bad debt and about $300 million of same-day net outflows. Fluid reportedly covered the shortfall through treasury resources and partner financing, but the exact loss, funding terms, and remaining treasury cannot be verified from the available independent evidence.
• Additional operational incident: Reports describe a 2026 compromise of off-chain Merkle reward infrastructure, with approximately 125,000–163,706 FLUID and 49,526–51,900 GHO stolen; the reports state that core contracts and user funds were unaffected. The differing token figures are unresolved.
• Sentiment and criticisms: Positive commentary emphasizes automated risk limits, rapid crisis response, and user reimbursement. Critical commentary focuses on wstUSR concentration, reliance on partner collateral, off-chain reward infrastructure, audit-artifact fragmentation, and uncertain U.S. regulatory status.
• Fraud, rug, insolvency, sanctions, and legal matters: No independently verified rug-pull, fraud judgment, sanctions designation, or insolvency finding was identified in the reviewed results. Legal and regulatory status, including U.S. treatment and any enforcement action, is Not verifiable as of October 10, 2026. Contradiction callout: Fluid/DAO communications reportedly describe a “zero-incident” record, while independent reports describe the Resolv-related bad-debt event and a Merkle-infrastructure compromise. The contradiction is unresolved; “zero-incident” should not be treated as equivalent to “no material security or credit event.”

Economic model. Fluid Lending is an overcollateralized pooled lending market: users supply supported assets, receive ERC-4626-compatible fTokens, and earn a variable exchange rate primarily from borrower interest. Liquidity is centralized in Fluid’s Liquidity Layer; Vault, DEX, stETH and restaking integrations are separate products and add potential oracle, liquidation, directional and external-protocol exposure, but are not inherent to passive Lending deposits. Yield and leverage. DefiLlama reports 23 tracked pools and average supply APY of 3.38%; the yield is economically organic borrower-interest yield, although reward-rate infrastructure exists and the organic/subsidized split is Not verifiable as of October 5, 2026. APY history, volatility and sustainability are Not verifiable as of October 5, 2026.

Active loans of $781.55m versus $717.94m TVL imply approximately 1.09x gross loans/TVL, but this is only a protocol-level leverage proxy—not verified user looping leverage. Withdrawals, limits and risk. Deposits are redeemable through fToken withdrawal mechanics, but liquidity-layer withdrawal limits can constrain immediate exits and dynamically decay after supply. There is no verified fixed lock-up. Borrowing is collateralized, with utilization-sensitive rates, liquidation risk, oracle dependence and asset-specific caps/limits.

Exact current fees, gates, per-market limits and collateral parameters are Not verifiable as of October 5, 2026. TVL and revenue. The freshest retrieved DefiLlama snapshot reports $717.94m TVL: Ethereum $504.01m (70.2%), Arbitrum $141.80m (19.8%), Plasma $42.99m (6.0%), Base $24.72m (3.4%), and Polygon $4.42m (0.6%). It reports $3.34m 30-day fees and $424,482 protocol revenue. TVL trend is inconsistent across retrieved DefiLlama snapshots ($717.94m versus $746.89m/$763.85m), so the discrepancy is a data-freshness finding.

Dune-vs-DeFiLlama TVL, product-level TVL, and on-chain trend are Not verifiable as of October 5, 2026 because Dune MCP is unavailable. Organic-yield percentage: Not verifiable as of October 5, 2026.

Status as of October 5, 2026: Dune MCP was unavailable; therefore cross-chain balances, reserve composition, liabilities, and chain-level exposure are Not verifiable as of October 5, 2026. No independently verified proof-of-reserves statement or reserve attestation was located. Size / composition. Do not treat TVL as treasury reserves. DeFiLlama currently reports approximately $717.94M Fluid Lending TVL and $781.55M active loans, but these are analytics-platform figures, not reserve or liability attestations.

It also reports six operating chains, while the supplied scope lists five; the exact chain allocation is Not verifiable as of October 5, 2026. Addresses / custody / control. Yearn Curation identifies the shared Liquidity Layer at abbreviated address 0x52Aa…F4e497 on Ethereum as the central fund store for lending, vault, DEX, and stETH products. It is upgradeable, with administration controlled by a Timelock; the Timelock is governed by GovernorBravo with a one-day delay. The Avocado Guardian can pause certain protocols or cancel Timelock transactions but cannot move funds.

Full cross-chain treasury-address mapping is Not verifiable as of October 5, 2026. Reserve policy / known treasury action. Following the Resolv incident, Fluid reported approximately $21M of bad debt: about $8.2M allocated to the governance treasury and $1.5M to the team, with buybacks paused and emissions reduced to preserve and rebuild treasury resources. Yearn reports no programmatic, pre-funded insurance fund or contractual first-loss coverage. These are governance/protocol disclosures, not independently verified balances. Attestations. No third-party reserve attestation or independently verified proof-of-reserves report was found.

Proposed future support for off-chain custodied collateral does not establish current custody arrangements. Contradiction / limitation: Protocol-reported solvency and treasury allocations cannot be reconciled to current wallet balances without raw on-chain verification; the on-chain result is therefore Not verifiable as of October 5, 2026.

FLUID tokenomics — as of October 4, 2026.

• Native token: FLUID, rebranded 1:1 from INST; capped at 100,000,000 tokens. Ethereum: 0x6f40d4A6237C257fff2dB00FA0510DeEECd303eb; Polygon: 0xf50D05A1402d0adAfA880D36050736f9f6ee7dee; CoinGecko currently lists 0x61E030A56D33e8260FdD81f03B162A79Fe3449Cd for Base, Arbitrum and Plasma. This conflicts with the previously recorded Arbitrum address 0xaE7d...17A5B; without Dune, the correct Arbitrum deployment is Not verifiable as of October 4, 2026.
• Supply/valuation: 83.697M circulating; 100M total/max. Current CoinGecko snapshot: approximately $144.8M market cap and $173.0M FDV; these are time-sensitive aggregator figures, not on-chain verified.
• Utility/governance: FLUID governs protocol integrations, liquidity-layer parameters, fees, vault configuration and rewards. Governance contracts historically include Governor and Timelock; effective current control and voting concentration are Not verifiable as of October 4, 2026.
• Value accrual: The DAO announced a reserve-funded buyback program; bought tokens are intended for treasury/governance-directed use, not automatically burned. Direct revenue share, dividends, active staking rewards and completed buyback volume are Not verifiable as of October 4, 2026. DeFiLlama labels buybacks, burns and dividends “none,” creating a data contradiction with Fluid’s buyback announcement.
• Emissions/unlocks: No post-launch inflationary minting is disclosed; supply enters circulation through vesting/community distribution. Initial allocation: community 55%; current team 23.79%; investors 12.07%; future team/ecosystem 7.85%; advisors 1.27%. DeFiLlama reports 83.70% unlocked and a 5M FLUID DAO-incentive cliff on August 7, 2026. Whether that announced unlock actually occurred on-chain is Not verifiable as of October 4, 2026.
• Concentration/admin risk: Top-holder concentration, insider wallets, mint/blacklist/fee-switch functions and controlling multisigs are Not verifiable as of October 4, 2026 because on-chain verification is unavailable.
• Liquidity/listings: DEX liquidity depth is Not verifiable as of October 4, 2026. CoinGecko lists major observed CEX markets including Bybit, Deepcoin, Gate, OKX and Coinbase, primarily FLUID/USDT or FLUID/USD; reported ±2% depth is generally only tens of thousands of dollars per venue, indicating limited executable depth for institutional size.

Stress conclusion: A Bitcoin fall below $10,000 would create material liquidation and bad-debt risk for Fluid Lending, but the loss cannot be quantified from the available evidence. On-chain verification was unavailable; therefore collateral balances, BTC-wrapper exposure, debt concentration, liquidation volumes, bad debt, and chain-level exposure are Not verifiable as of October 10, 2026.

• Fluid’s lending markets use automatic, on-chain liquidation when collateral falls through its liquidation threshold; one independent review reports maximum borrowing near 85% LTV and liquidation near 90% LTV for a Bitcoin-related market, leaving limited protection for highly leveraged borrowers.
• A rapid BTC crash could cause simultaneous liquidations, collateral-sale slippage, oracle/timing stress, and liquidity shortages. An audit finding states that large collateral sales may depress execution prices enough to make liquidation unprofitable and create bad debt; the cited report also recommended supply limits.
• Fluid’s shared Liquidity Layer means losses or withdrawal pressure may affect suppliers beyond the specific Bitcoin market. An independent architecture review identifies correlated risk between Fluid products and possible withdrawal queues during high utilization.
• One secondary analysis estimates Bitcoin wrappers at 14% of collateral, but this figure was not independently verified and should be treated as unverified analysis, not an exposure measurement.
• Independent reporting is contradictory on historical losses and audit coverage: one source reports $10–17.5 million of realized bad debt in March 2026, while another alleges approximately $19.3–21 million related to the Resolv incident and disputes parts of Fluid’s published audit roster. These claims require primary on-chain and auditor confirmation. Stress assessment: High severity for BTC-backed borrowers; potentially high for suppliers if liquidations exhaust available liquidity or transmit losses through the shared pool. The impact on each supported chain—Ethereum, Arbitrum, Base, Plasma, and Polygon—and the percentage of total exposure per chain are Not verifiable as of October 10, 2026.

Assessment: High / material stress risk. A 20% depeg of Fluid Lending’s largest collateral would likely trigger widespread liquidations, with bad-debt risk amplified if that asset is concentrated in leverage loops. Current evidence identifies wstUSR as 18.9% of all-chain lending TVL in an earlier assessment, with approximately 98% of its supply reportedly used in Fluid leverage loops; the same source reports that this concentration subsequently resulted in a bad-debt event. Fluid permits very high collateralization efficiency—up to 95% LTV for some markets—and liquidation penalties can be as low as 0.1%.

Its liquidation design generally liquidates only the amount needed to restore a position to the required threshold, rather than immediately liquidating the entire position. This can reduce market impact in ordinary conditions, but under a rapid 20% depeg it may leave a large volume of positions near or beyond liquidation thresholds while liquidators compete to absorb collateral. The protocol also uses a shared liquidity layer across lending and trading.

Independent risk analysis identifies contagion between these products, oracle/AMM-state risks for smart collateral, and reduced liquidity buffers caused by high utilization. Consequently, stress could transmit through both liquidation execution and withdrawal demand. Bad debt becomes more likely where collateral liquidity is thin, oracle pricing lags or is manipulated, liquidation capacity is insufficient, or the depeg asset is correlated with other collateral and debt markets. What is not verifiable:

• The current largest collateral asset and its exact share of exposure across Ethereum, Arbitrum, Base, Plasma, and Polygon: Not verifiable as of October 3, 2026.
• Chain-by-chain TVL/exposure percentages and the current size of any potential bad debt: Not verifiable as of October 3, 2026.
• Whether Plasma is currently an active Fluid Lending deployment: Not verifiable as of October 3, 2026. Available evidence confirms Ethereum, Arbitrum, Base, and Polygon, while another secondary source lists Plasma but is not sufficient to establish current deployment status. Bottom line: the principal vulnerability is not merely the 20% price shock; it is the combination of high LTVs, potentially concentrated collateral, leverage-loop exposure, low liquidation penalties, and shared liquidity. The available evidence supports a high-severity scenario assessment, but does not support a current quantified loss estimate.

Fluid Lending — stress: top counterparty becomes insolvent Exposure identification. The requested counterparty concentration, borrower/asset exposure, and percentage by Arbitrum, Base, Ethereum, Plasma, and Polygon are Not verifiable as of October 4, 2026: Dune is unavailable in this run, and no reliable current chain-by-chain exposure dataset was identified. Expected loss path 1. Counterparty insolvency or collateral depeg makes the position undercollateralized under Fluid’s oracle. 2.

A liquidator repays debt and receives collateral. Fluid supports partial liquidation and liquidation of accumulated bad debt; liquidation proceeds are routed through the Vault and central Liquidity layer. 3.

If collateral proceeds fully repay debt, the counterparty bears the economic loss through collateral seizure and liquidation penalties; lenders should not incur principal loss. 4. If proceeds are insufficient, the residual becomes protocol bad debt.

The smart-contract impact is a deficit between Liquidity-layer assets and recorded borrower liabilities; this can reduce available withdrawals, constrain new borrowing, and impair lender redemption economics. A precise loss-socialization formula or automatic insurance waterfall is Not verifiable as of October 4, 2026. Who absorbs it / compensation

• First line: liquidators and the collateral position absorb value loss through forced sale; liquidators are compensated with collateral and liquidation pricing.
• Residual shortfall: the documented precedent is discretionary recovery, not a clearly documented automatic insurance fund. In the 2026 Resolv incident, approximately $19.3 million of residual bad debt was allocated to Resolv (~$9.7m), the Fluid governance treasury (~$8.2m), and the team (~$1.5m), reimbursable from future protocol revenue. Resolv also burned remaining USR at contract level and enabled redemption for healthy-position users.
• Therefore, compensation is case-specific and governance/issuer-dependent; no guaranteed depositor reimbursement schedule is verifiable. Impact path through contracts Oracle reprices collateral/debt → Vault marks position liquidatable → external liquidator calls liquidation → collateral is transferred against debt repayment → Vault/Liquidity accounting is rebalanced → any unrecovered deficit remains with the lending system and may be reflected in reduced liquidity or treasury-funded remediation. The Vault documentation confirms positions borrow from the shared Liquidity layer and that liquidation can target all bad debt. > Contradiction / risk finding: Fluid’s post-mortem states “no impact to user deposits” and full solvency, but also records ~$21m of incident bad debt and treasury/team funding. This indicates depositor protection was achieved through ex-post capital support, not proof that the contracts independently absorb unlimited counterparty insolvency.

Assessment — committed fraud by the DAO or owners: No verifiable evidence was found, as of October 3, 2026, that Fluid Lending’s DAO, owners, or controlling personnel have been accused, charged, or adjudicated for intentional fraud. Not verifiable as of 2026-10-03. On-chain verification was unavailable for this run, so no blockchain-based conclusion is made. The relevant documented event is a security incident, not established DAO/owner fraud. Fluid reported that an attacker compromised its off-chain rewards-distribution infrastructure and used operational secrets to submit and approve a fraudulent Merkle root.

The reported drain was approximately 163,706 FLUID and 49,526 GHO, plus a small amount of cbBTC; Fluid stated that core protocol contracts and user funds were unaffected. Independent coverage similarly characterizes the event as a key or infrastructure compromise and says the lending markets, vaults, DEX, and user deposits were not affected. The incident may indicate operational-control and segregation-of-duties weaknesses, because one attacker reportedly obtained control over both reward-distribution approval functions.

That is a material governance and operational-risk finding, but it does not by itself establish that the DAO or owners committed fraud. Claims attributing fault specifically to the Fluid finance team are third-party reporting and should not be treated as a judicial or regulatory fraud finding. No independent source located in this check established a fraud conviction, regulatory fraud action, civil adjudication, or substantiated allegation against the Fluid DAO or owners.

The search also did not independently verify reported treasury or loss-reimbursement figures; Not verifiable as of 2026-10-03.

Finding — primary yield source negative over 30 days: Not established. The latest available independent yield data shows positive Fluid Lending rates: the October 10 snapshot reports 6.21% current APY and a 4.60% 30-day mean for an Ethereum USDC pool; this is a positive lending yield, not a negative 30-day result. A separate October 6 report lists positive USDC rates of 4.83% on Ethereum and 4.38% on Arbitrum. The October 1 report likewise records positive rates across USDC, USDT, and ETH markets. Stress assessment: The available evidence does not support the scenario that Fluid Lending’s primary yield source was negative during the last 30 days.

However, the evidence is pool-specific and does not provide a complete, chain-by-chain 30-day yield series for all specified deployments (Arbitrum, Base, Ethereum, Plasma, and Polygon). On-chain verification is unavailable in this run; therefore, the protocol-wide conclusion and exact cross-chain exposure are Not verifiable as of October 10, 2026. The apparent primary yield source is lending interest paid by borrowers, with rates varying by asset and utilization.

This characterization is supported by independent descriptions of Fluid’s rates as utilization-driven market rates, but it is not an on-chain verification. No evidence found in the reviewed results indicates a negative lending rate or a negative 30-day average. The DeFiLlama result reports a positive 30-day fee figure and positive average APY, but its displayed result is not sufficiently current or complete to serve as the sole protocol-wide stress conclusion.

Assessment (as of October 13, 2026): Governance is operational but remains only partially decentralized. The 2024 ownership-transfer proposal assigned core Ethereum Fluid ownership to Instadapp DAO governance, while retaining the Instadapp team multisig 0x4F6F977aCDD1177DCD81aB83074855EcB9C2D49e as fToken/vault deployer, reward/rebalancer operator, and Liquidity Layer Guardian. The Guardian may pause Class-0 protocols but is documented as unable to withdraw user liquidity. Proposal process: Forum discussion → Snapshot/DAO vote → timelocked execution.

The documented Ethereum timelock configuration is approximately 24 hours voting delay, 48 hours voting period, and 24 hours execution queue. DAO reality: dao_governance=false. The Foundation proposal states that, as of February 2026, only Ethereum was under direct governance; transfer of all EVM-chain deployments was still a proposed workstream, with legal/IP transfer targeted for mid-2026. I found no independent evidence confirming completion for Arbitrum, Base, Polygon, or Plasma. Control surface: The team retains meaningful operational control over frontend/development execution, deployment of new markets, reward operations, and emergency pausing.

The proposed Fluid Foundation is a Cayman Islands non-profit intended to hold the brand, frontend, and smart-contract IP for the DAO; its directors/custodians are described as team-controlled, but names and corporate registration number were not disclosed in the reviewed sources. Voting concentration / holders: Not verifiable as of October 13, 2026. Dune was unavailable in this run; no substitute source was accepted for top-holder concentration. Multisig: Threshold, signer count, signer identities, and signer independence: Not verifiable as of October 13, 2026. The documented team multisig address is not sufficient to establish these properties. Company / ToS: Instadapp’s Terms identify the counterparty as InstaDApp Labs LLC.

The Terms specify California law/venue and JAMS arbitration, but do not provide a registration number or directors. Contradiction: The Foundation proposal presents token holders as having ultimate authority, while simultaneously stating that only Ethereum was then directly governed and that multichain ownership transfers remained to be completed. The latter is the stronger operational-risk finding until execution evidence is produced.

As of October 3, 2026, the strongest entity evidence is Instadapp’s own Terms of Service, which identify the contracting party as InstaDApp Labs LLC. Fluid governance materials describe Fluid as developed by the Instadapp team and governed by INST tokenholders, with revenues directed to the INST DAO Treasury. Entity/jurisdiction: Entity is reasonably identified as InstaDApp Labs LLC. A specific incorporation or operating jurisdiction is not established by the official Fluid materials reviewed; third-party references claim Delaware, but this was not independently verified. Not verifiable as of 2026-10-03 for jurisdiction. Terms/restrictions: The available Instadapp Terms require legal capacity, compliance with applicable law, and prohibit use by persons in jurisdictions or groups subject to economic sanctions.

They include mandatory individual arbitration, class-action and jury-trial waivers, broad disclaimers, and a liability cap generally tied to amounts paid or $100. The Terms were last identified as updated January 8, 2020, creating documentation-staleness risk. KYC/AML: No protocol-level KYC, AML, customer-identification, or licensing framework was located in the reviewed official materials. Not verifiable as of 2026-10-03. Wallet screening or sanctions blocking, if used by interfaces or infrastructure providers, would not establish that the protocol/entity itself is sanctioned. Classification: No formal regulator classification of Fluid Lending, INST, or the lending activity was located. The protocol presents itself as decentralized DeFi infrastructure; that does not eliminate potential lending, securities, derivatives, money-transmission, consumer-protection, AML, or sanctions exposure depending on the relevant jurisdiction and activity. Enforcement/court/sanctions: No public regulator enforcement action, court case, or sanctions designation specifically naming Fluid Lending or InstaDApp Labs LLC was located in the searches performed through October 3, 2026.

This is not a legal clearance. Not verifiable as of 2026-10-03 for absence of undisclosed or non-indexed matters. Data protection: Instadapp maintains a privacy policy describing collection, use, retention, and disclosure of personal information, but the policy is also dated 2020 and is not clearly Fluid-specific. Legal structure vs. actual risk: The LLC/ToS structure may provide a contractual interface and liability protections for the operator, but it does not necessarily allocate smart-contract, oracle, governance, upgrade-admin, insolvency, or DAO-related risks for users. Fluid’s own audit disclaimer states that audits do not assess regulatory status or business-model suitability.

No exact GLEIF LEI record for 'InstaDApp Labs LLC', 'Fluid Lending'. OFAC SDN screening of 'InstaDApp Labs LLC', 'Fluid Lending': no match. SEC litigation and administrative release feeds: no mention.

Fluid Lending does not appear to issue its own stablecoin; the supported assets identified in the available evidence are external stablecoins such as USDC, USDT, GHO, and USR. A verifiable depeg-related incident did occur in March 2026 when Fluid suspended its USR marketplace after the Resolv USR collapse; the available evidence supports one documented incident, with the last known date on 2026-03-22 and a reported intraday low around 78% below peg (to about $0.2176). No protocol-level evidence in the gathered sources establishes additional separate depeg events or a full protocol-wide depeg rate for Fluid’s supported stablecoin set, so the count is limited to the single documented USR incident and the maximum depeg percentage is based on that incident.

The previously recorded five risks remain relevant after rechecking the audit, bounty, and protocol-coverage evidence; no finding can be retired. On-chain exposure, reserves, utilization, parameter parity, and chain-level concentration are Not verifiable as of October 5, 2026 because Dune MCP is unavailable; therefore no current TVL or exposure percentages are asserted.

Fluid Lending’s top five strengths are: 1) capital efficiency via Smart Collateral and Smart Debt, which let the same capital earn lending and trading-related yield; 2) high LTV / efficient borrowing, with sources citing up to 95% LTV on ETH and other supported collateral; 3) liquidation efficiency and risk controls, including partial liquidations, low liquidation penalties, and automated health/risk management; 4) product composability / unified liquidity layer, which combines lending and DEX liquidity for more productive assets; and 5) security posture and control framework, supported by multiple independent audits and formal verification claims. The most defensible independent evidence consistently points to Fluid’s hybrid lending-DEX design as the core strength: Eco describes Smart Collateral + Smart Debt as producing capital efficiency that beats pure lending or pure DEX models, OAK Research highlights the same mechanism and high effective liquidity, and Yearn’s curation report notes that the protocol’s design and stress response materially supported resilience during the March 2026 incident. The main caveat is that some claims on the official site about peak LTV, liquidation penalties, and “most capital efficient” positioning are best treated as unverified marketing claims unless cross-checked independently.