Fluid Liquidity

Protocol identification — Fluid Liquidity (Fluid, by Instadapp)

• Website: fluid.io. Docs: docs.fluid.io / docs.fluid.instadapp.io. Category: DeFi liquidity infrastructure: shared liquidity layer supporting lending/fTokens, vaults, flash loans and DEX products.
• Launch: Publicly introduced October 10, 2023; the liquidity-layer deployment and later products followed separately.
• Chain: Ethereum is confirmed for this review. Fluid is multi-chain overall, but other chains are outside the requested scope.
• Native token: FLUID, formerly INST following rebranding; Ethereum token contract 0x6f40d4a6237c257fff2db00fa0510deeecd303eb. Etherscan reports verified proxy source code. Main Ethereum contracts
• Fluid Liquidity proxy: 0x52Aa899454998Be5b000Ad077a46Bbe360F4e497. Cross-check: official contract-address documentation/repository and Etherscan’s “Fluid: Liquidity” label; Etherscan shows source-code verification and a proxy implementation.
• Fluid DEX Lite: 0xBbcb91440523216e2b87052A99F69c604A7b6e00, listed in the official integration documentation. Explorer verification status: Not verifiable as of October 10, 2026 from the sources reviewed.
• Required Dune cross-check: Not verifiable as of October 10, 2026 (Dune MCP unavailable in this run). Therefore, addresses are not “Dune-verified.” Fork lineage Fluid does not appear to be a direct fork of Aave, Compound, Maker, Uniswap or Curve. Instadapp describes it as a new architecture incorporating ideas from those protocols; its public repository is a distinct codebase and uses Instadapp’s Infinite Proxy. Audits exist for the Liquidity layer and related Vault/Lending components, including StateMind and MixBytes reports. This supports audited releases, not necessarily every subsequent deployment or upgrade. No confirmed malicious modification history for Fluid was identified. A systematic history of malicious modifications in comparable Fluid forks: Not verifiable as of October 10, 2026.

Fluid Liquidity appears to have a real, functional product rather than a mere landing page: the official app is linked separately from the website, and the docs expose read APIs plus contract and integration documentation. The product also has an Ethereum mainnet contract page with deposit/withdrawal activity visible in the explorer, which supports that the system is live rather than dormant. ## Maturity assessment

• Real portal/app: The official links list a dedicated app at fluid.instadapp.io and separate docs, suggesting an operating product stack rather than a marketing-only site.
• Live user-facing functionality: Documentation describes withdrawal limits, expansion behavior, and stateful user positions, which implies active deposit/withdraw workflows and nontrivial product logic.
• Developer/docs maturity: There are autogenerated contract docs, contract-address pages, and explicit read endpoints such as /v2/lending/1/users/{userAddress}/positions and /1/liquidity/tokens, which is a strong sign of a maintained integration surface.
• Open API: Yes. Public docs expose HTTP endpoints on api.fluid.instadapp.io for positions, vaults, and liquidity tokens, indicating an open read API for integrations.
• Template/fake-metric signs: Not verifiable as of 2026-10-10. The available sources do not show obvious template or fake-metric markers, but the website itself should not be treated as proof.
• Broken links: Not verifiable as of 2026-10-10. ## Bottom line Overall, Fluid Liquidity looks like a mature, live DeFi protocol with an actual app, public docs, explorer-visible contract activity, and an open read API. The strongest caveat is that the remaining UX quality checks, like broken links and superficial template signals, are not verifiable from the gathered sources as of 2026-10-10.

Fluid’s bug bounty is active on Immunefi. It appears to have two relevant programs tied to the protocol: a standalone Immunefi bug bounty for Instadapp/Fluid and a time-bound invite-only audit competition. The main Immunefi bug bounty lists Fluid targets added on 24 May 2024, with scope covering the Fluid Liquidity Layer, Fluid Lending protocol, Fluid Vault protocol, and Fluid contracts excluding the periphery folder.

The program’s published maximum bounty is $500,000, with critical rewards capped at 10% of directly affected funds up to that ceiling; high-severity rewards are capped at $100,000, with PoC required for all severities. A separate Immunefi invite-only audit competition for Fluid Protocol ran from 14 November 2024 to 12 December 2024, with an $80,000 reward pool paid in USDC on Ethereum, triaged by Immunefi, KYC required, and prizes distributed among valid findings. That competition is finished and should not be treated as the ongoing bounty program.

Publicly disclosed results are limited: the competition page shows the program finished, but no clear public tally of accepted reports or payouts is visible in the retrieved sources. Not verifiable as of 2026-10-10.

Scope confirmed: Fluid/Instadapp Fluid Liquidity on Ethereum; not the unrelated Fuel or Robinhood-chain projects. Dependencies and counterparties. Ethereum deployment is primarily dependent on Ethereum, Fluid’s central Liquidity Layer, supported collateral issuers, and oracle infrastructure. Documented Ethereum collateral/markets include USDC, USDT, ETH, wstETH, weETH, sUSDe/USDe, and other LST/restaking or yield-bearing assets; therefore issuer, wrapper, redemption-liquidity, and slashing/depeg risks are material. The audit states that VaultT1 relies on an oracle for collateral/debt valuation.

Fluid has used Chainlink, Uniswap-derived pricing, and RedStone-related integrations; stale-feed, thin-liquidity, market-manipulation, and oracle-liveness failures could cause bad debt or wrongful liquidations. Stablecoin / issuer risk. Governance records show exposure expansion to USDe/sUSDe, GHO, rsETH, mETH, tBTC and related assets. A major external dependency failure occurred with Resolv’s USR: Fluid’s own recap states approximately $100m exposure and a roughly $9.7m shortfall covered by the DAO treasury. This is a protocol-sourced claim and should be treated as an unverified marketing/management claim absent raw on-chain verification.

Independent risk commentary also flags issuer/admin and oracle dependencies for newer collateral assets. Bridges / custody / CEX-MM. Core Ethereum positions do not require Fluid-operated cross-chain liquidity; Fluid states liquidity is siloed per chain. However, bridged collateral and cross-chain deployments inherit bridge-message, mint/burn, validator/DVN, and liquidity risks. No verified evidence was found of material custodian, CEX, or market-maker counterparty exposure in the Ethereum lending contracts. Not verifiable as of October 10, 2026. Incident status. Fluid’s May 27–31, 2026 rewards-distributor key compromise reportedly drained approximately $215k–$225k; core lending, vault, DEX, and user deposits were reportedly not affected.

This was an operational custody/control failure, not an oracle or bridge exploit. Current unresolved status: Not verifiable as of October 10, 2026. CONTRADICTION / DATA GAP: DeFiLlama reports approximately $706m Ethereum TVL, while the stated USR exposure is approximately $100m; the exposure percentage cannot be validated or reconciled without Dune. Not verifiable as of October 10, 2026. Failure scenarios: oracle staleness/manipulation; LST/restaking depeg or slashing; stablecoin issuer insolvency/mint-control failure; bridge compromise; liquidity-bank-run and liquidation cascades; privileged-key compromise. Dune unavailable; no on-chain claims are asserted.

Fluid is a DeFi protocol, so user interaction is via non-custodial smart contracts rather than a centralized custodian model. The strongest available evidence indicates that supplied assets are pooled in a core Liquidity contract, and governance/control is exercised through a team multisig plus narrow auth contracts; funds only leave the system via the multisig-gated Reserve contract. A secondary source also describes the founding team as custodians while DAO tokenholders retain full control, but that is not independently verified here.

For the specific custody question, there is no verifiable evidence in the provided results that customer assets are held in segregated, legally ring-fenced accounts on Ethereum, so that field is not verifiable as of 2026-10-10. There is likewise no evidence that withdrawals are paused; withdrawal_paused is not verifiable as of 2026-10-10.

## Key-management organization — Fluid Liquidity (Ethereum)

• Governance / timelock: FLUID-token governance uses a GovernorBravo-style process and a Timelock contract. Governance proposals are the intended route for ownership, authorization, parameter, and upgrade changes. The Timelock is reported to impose a 1-day delay on Liquidity Layer implementation upgrades, creating an observation and exit window.
• Guardian multisig: The Instadapp/Fluid Avocado multisig at 0x4F6F…D49e acts as the Liquidity Layer guardian. The latest independent assessment reports it as a 6-of-12 multisig (previously 7-of-14). Its emergency power is limited primarily to pausing Class-0 protocols and cancelling queued timelock transactions; it reportedly cannot directly withdraw Liquidity Layer funds.
• Operational authorizations: The Liquidity Layer maintains an auth allowlist. Authorized addresses can perform operational actions such as rate, limit, and configuration updates. Governance can add or remove these addresses. The team multisig has at times received temporary protocol-specific authorization during launches, which should be treated as an elevated but configurable privilege.
• Reserve/rebalancer separation: The reserve contract’s rebalancer role is described as restricted to depositing underlying assets as rewards; it cannot withdraw funds. The reserve owner is the Timelock, separating routine operations from ultimate governance control.
• Key custody transparency: Public sources identify the controlling multisig addresses and roles, but do not disclose the individual signer identities, hardware-wallet/MPC procedures, geographic separation, backup/recovery process, or signer-rotation policy. Not verifiable as of October 10, 2026. Risk assessment: The design is layered—governance/timelock for durable changes, a multisig guardian for emergency intervention, and narrower operational auths. The principal residual risks are Timelock compromise, collusion or signer compromise within the guardian multisig, and temporary expansion of team auth privileges. Dune-based raw on-chain confirmation was unavailable for this review; therefore, these findings are not labeled on-chain verified.

Scope: Ethereum; as of October 10, 2026. Dune MCP was unavailable, so proxy-admin event history, current role holders, timelock delay, and renunciation status are Not verifiable as of October 10, 2026. Addresses / architecture. Core Liquidity proxy: 0x52Aa899454998Be5b000Ad077a46Bbe360F4e497; Etherscan identifies it as a verified FluidLiquidityProxy, with implementation 0xCc331daf…5092266A2. The proxy exposes getAdmin, setAdmin, addImplementation, and removeImplementation, confirming an upgradeable Instadapp Infinite-proxy architecture. Public technical material identifies the governance/team multisig as 0x4F6F977aCDD1177DCD81aB83074855EcB9C2D49e, but its current status as this proxy’s admin is Not verifiable as of October 10, 2026. Map: Governance/admin → Infinite Proxy → Liquidity AdminModule + UserModule; Lending fTokens / Vaults / DEX → Liquidity; Vaults → Oracle.

Liquidity custody is centralized in the core contract, while end users interact through higher-level protocols. Privileged surface. Documented admin/auth capabilities include adding/removing auths and guardians, global pause/status changes, token listing/configuration, interest-rate updates, supply/borrow and withdrawal limits, revenue collection, and proxy implementation changes. Guardian pause behavior and exact emergency/fee/oracle/strategy role holders are Not verifiable as of October 10, 2026. User withdrawals exist through Lending/Vault interfaces, but pause and withdrawal-limit controls can restrict exits; there is no verified unconditional user escape hatch.

A compromised proxy admin or sufficiently authorized governance path could upgrade logic to seize, redirect, or freeze pooled assets; compromised auths could materially alter rates, limits, supported tokens, or revenue routing. Timelock / rug risk. Ethereum timelock delay and whether upgrades require a vote are Not verifiable as of October 10, 2026. Therefore upgrade, freeze, oracle-manipulation, and governance-key compromise risks remain material. Audit evidence exists, but deployment-to-audited-commit matching is not independently verified here.

MixBytes reported 0 critical and 0 high findings, with two low findings (one acknowledged).

MixBytes — publication date: December 4, 2024. Scope: Fluid DEX contracts and listed deployed pools. Findings: 0 critical, 0 high, 0 medium, 3 low. Fix status: all 3 low findings acknowledged. Covers deployed code: Not verifiable as of October 10, 2026; deployed addresses are listed, but bytecode matching is not explicitly reported.

PeckShield — publication date: November 10, 2023. Scope: Fluid Protocol Solidity contracts, including liquidity, lending, vault, oracle and related modules; reviewed commit 5b3bfd1 and fixes at 7a0cac2. Findings: 0 critical, 4 high, 4 medium, 5 low.

Fix status: 12 resolved; 1 medium (admin-key trust) mitigated. Covers deployed code: Not verifiable as of October 10, 2026; the report confirms source commits, not bytecode matching.

MixBytes — publication date: December 10, 2025. Scope: changes to the Fluid Liquidity Layer between commits 23692b0 and f5a0711; ZIRCUIT and ZtakingPool were out of scope. Findings: 0 critical, 0 high, 0 medium, 2 low.

Fix status: 1 fixed; 1 acknowledged. Covers deployed code: No; the report explicitly says the initial commit was not audited and does not provide a bytecode-match confirmation.

MixBytes — publication date: June 25, 2024. Scope: Fluid VaultT1, including admin/core modules, BigMath, liquidity calculations, tick math and listed mainnet vault deployments. Findings: 0 critical, 0 high, 2 medium, 4 low.

Fix status: 2 fixed; 4 acknowledged. Covers deployed code: Not verifiable as of October 10, 2026; deployments are listed, but an explicit bytecode-match result is not stated.

Cantina — publication date: January 7, 2025. Scope: Instadapp Fluid DEX competition; review of a specific code version. Findings: 0 critical, 0 high, 2 medium, 7 low and 4 informational (the report details only critical/high/medium issues).

Findings concern incorrect TWAP updates and a division-by-zero lock risk. Fix status: Not verifiable as of October 10, 2026; report does not provide remediation statuses. Covers deployed code: No bytecode match demonstrated; competition assessed the submitted commit.

## Founders and team Fluid Liquidity is the successor to the Instadapp ecosystem, rather than an unrelated protocol. Public sources identify Samyak Jain and Sowmay Jain as the founders of Instadapp and the principals behind Fluid. RootData additionally lists Thrilok Kumar as CTO.

A token-transparency filing identifies Samyak Jain as CEO/founder and “DMH” as COO, indicating that at least part of the operating team is pseudonymous. The founders’ prior project is material: the brothers began with a MakerDAO-related project that won an ETHIndia hackathon in 2018, then built Instadapp, which attracted investment from Pantera and Naval. This supports meaningful technical and fundraising credibility, but historical TVL figures cited in secondary sources are not independently verified here. ## Security and prior outcomes A 2026 transparency filing states that it found no prior exploits affecting tokenholders or protocol funds as of 12 June 2026.

However, a separate investor account says that an exploit of partner protocol Resolv caused approximately $80 million of unbacked tokens to enter Fluid in March 2026. These statements conflict: the filing’s narrower wording may exclude partner-protocol incidents, while the investor account describes a serious ecosystem/exposure event. The underlying loss allocation and Fluid’s net financial impact are Not verifiable as of October 10, 2026. ## Public status, office, and business reality The founders are publicly named, but the full team is not fully transparent; “DMH” is pseudonymous.

A MiCA-oriented document lists Craigmuir Chambers, Road Town, Tortola, British Virgin Islands for the founders, indicating an offshore corporate address rather than proof of an operating office. A secondary directory separately reports a registered office in Watford, England, but I could not independently confirm that it belongs to the relevant Fluid entity; treat it as Not verifiable as of October 10, 2026. Fluid has stronger evidence of a real operating business than a simple web front: it evolved from a funded, publicly documented DeFi company with named founders, technical leadership, and deployed products.

Nevertheless, office occupancy, employee count, jurisdictional operating entity, and complete team identities are Not verifiable as of October 10, 2026. On-chain verification is unavailable in this run, so no chain-level claims are made.

Fluid Liquidity’s reputation is mixed: it has an identifiable Instadapp founding team and multiple reported audits, but material concerns exist around LP losses, concentration, governance controls, and operational/security incidents. On-chain verification was unavailable in this run; therefore TVL, exposure, treasury coverage, token concentration, and incident amounts are Not verifiable as of October 10, 2026.

• Team and backing: Independent coverage identifies Fluid as founded by Instadapp co-founders Samyak Jain and Sowmay Jain. Reports also associate the project with Cyber Fund, Pantera Capital, and Coinbase Ventures, but the precise investment terms and current ownership are Not verifiable as of October 10, 2026.
• Audits and security posture: Reports identify audits or reviews involving PeckShield, StateMind, MixBytes, and Cantina. An audit finding reportedly included privileged-function exposure, oracle-scaling issues, and precision issues; audits reduce but do not eliminate smart-contract risk.
• Primary criticism—LP economics: Independent reporting in May 2025 said Fluid’s ETH-USDC pool had accumulated more than $8.5 million in losses, with critics arguing that the rebalancing design systematically disadvantaged LPs and allowed arbitrageurs to extract value. Other reporting put losses near $9 million and said users believed risks were insufficiently disclosed. These figures are off-chain reports and are not on-chain verified in this run.
• Operational and counterparty risk: A 2026 risk review reports that the Resolv incident created bad-debt exposure for Fluid and that a separate off-chain rewards-infrastructure key compromise drained FLUID and approximately 51,900 GHO. Reported exposure and repayment figures conflict materially, so the amounts and final loss allocation are Not verifiable as of October 10, 2026.
• Governance and concentration: An independent review flags a governance timelock of under 48 hours, possible concentration of about 23% of token supply in one wallet, documentation gaps, and centralization risk from historical withdrawal freezes. These claims require on-chain confirmation and are therefore Not verifiable as of October 10, 2026.
• Fraud, rug, insolvency, legal, regulatory, and sanctions: No independently substantiated fraud, rug-pull, insolvency, sanctions, or regulatory-enforcement finding was identified in the reviewed results. This is not evidence that none exists; a complete legal and sanctions check is Not verifiable as of October 10, 2026. Overall assessment: reputation is moderate-to-high risk, driven less by a documented rug allegation than by novel liquidity mechanics, reported LP losses, counterparty exposure, short governance controls, and operational-security concerns. Claims of “no security flaws” conflict with reports of losses and later incidents.

Economic model — Fluid Liquidity (Ethereum; reviewed October 10, 2026)

• Strategy / assets in–out: A shared Liquidity Layer supports fToken lending, collateralized vault borrowing, and DEX smart-collateral/smart-debt positions. Depositors receive interest-bearing fTokens; borrowers provide collateral and receive debt assets. Smart positions can make deposited collateral or debt productive DEX liquidity.
• Yield sources: Core lending yield is borrower interest. Additional yield may come from DEX swap fees, native staking APR embedded in assets such as wstETH, and separate native, Merkle, or third-party incentives. Trading APR is activity-dependent and can vary materially.
• Organic vs subsidized: Base lending yield is economically organic (borrower-paid). Incentive components are subsidized or externally funded. The organic percentage is not published as a single protocol-wide metric: organic_yield_pct = null.
• Risk profile: Basic lending is comparatively market-neutral in token units, but smart collateral/DEX positions bear AMM inventory, impermanent-loss, and price risk. Vault borrowers are directional to collateral prices and liquidation thresholds. No protocol-wide restaking strategy was identified; external exposure can exist through LSTs and third-party reward programs.
• Leverage / looping: Vaults support high-LTV collateralized borrowing, with Fluid documentation citing up to 95% LTV for some vaults; this implies potential user-level leverage, not a uniform protocol leverage ratio. leverage_ratio = null.
• Lock-ups / withdrawals: No fixed lock-up was identified for core fToken lending. Withdrawals, borrowing, and payback are handled through the Liquidity Layer, but per-market withdrawal and borrow limits can gate liquidity and are updated after user actions.
• Fees / revenue: Revenue includes borrower-interest spread, DEX fee share, and product-specific fees. DeFiLlama identifies Fluid Lite’s ETH vault as charging a 20% performance fee plus a 0.05% exit fee; fees vary by product.
• TVL / trend: DeFiLlama reports approximately $916.38m combined TVL, including $706.36m on Ethereum in the latest snapshot; this is aggregator data, not raw on-chain verification. Product-level TVL, historical APY volatility, APY sustainability, and Dune-vs-DeFiLlama reconciliation: Not verifiable as of October 10, 2026. Contradiction / comparability note: Fluid’s reported “$3.6B total market size” is not directly comparable to DeFiLlama TVL because it refers to broader market/activity scope rather than deposited TVL.

Scope / confidence — Ethereum; as of October 10, 2026. Dune MCP is unavailable in this run, so on-chain balances, token composition, and current custody are Not verifiable as of October 10, 2026. Treasury / reserve size: DeFiLlama’s analytics dashboard reports a tracked Fluid treasury of approximately $27.12M, comprising approximately $27.10M FLUID, $16,715 stablecoins, $427 in major assets, and roughly $1K other assets. This is an analytics-platform estimate, not an on-chain-verified balance. Addresses: The historical InstaDapp/DAO treasury address publicly identified in governance is 0x28849d2b63fa8d361e5fc15cb8abb13019884d09; whether it remains the sole/current Fluid treasury wallet is Not verifiable as of October 10, 2026. The FLUID token is 0x6f40d4a6237c257fff2db00fa0510deeecd303eb; the Ethereum Liquidity Layer is 0x52Aa899454998Be5b000Ad077a46Bbe360F4e497, but the latter is protocol liquidity infrastructure, not necessarily treasury custody. Custody / control: Governance transferred ownership of the reserve contract and broader protocol to governance; the team multisig retained deployer/guardian functions and restricted rebalancer-management access.

This indicates DAO-controlled governance with operational multisig privileges, not fully trustless treasury custody. Reserve policy: Fluid announced an on-chain FLUID reserve funded by buybacks. The interim policy directed 100% of Ethereum mainnet revenue to buybacks during the first month, with a later automated/dynamic policy planned. The announcement is internally inconsistent: published July 3, 2026, but describes buybacks beginning in October 2025. Attestations: No independent proof-of-reserves or treasury attestation was identified.

Code audits do not attest to treasury assets or liabilities. Not verifiable as of October 10, 2026. Contradiction: DeFiLlama previously displayed approximately $33.76M treasury value, versus its later ~$27.12M snapshot; the difference is unresolved and demonstrates snapshot/valuation volatility.

FLUID (formerly INST) — Ethereum contract: 0x6f40d4a6237c257fff2db00fa0510deeecd303eb; max/total supply 100M. CoinGecko reports 83.7M circulating, market cap $172.7M, and FDV $206.3M as of October 10, 2026. Utility/governance: FLUID is the DAO governance token; holders vote on treasury, protocol upgrades and risk parameters. No protocol-native staking-reward schedule is documented.

DefiLlama reports fee switch off, dividends none, burns none, and buybacks none (updated September 2, 2026). Buybacks/revenue share — contradiction: Fluid’s announcement says buybacks began in October and initially directed 100% of Ethereum revenue to purchases, but DefiLlama still records no buybacks. A burn mechanism or direct revenue distribution is not evidenced. Treat buybacks as an announced/partly implemented value-accrual policy, not a guaranteed holder yield. Allocation/vesting: Genesis allocation disclosed as: community 55%; current team 23.79%; investors 12.07%; future team/ecosystem 7.85%; advisers 1.27%.

The disclosed vesting period began July 2021 and was four years; Blockworks states insider tokens fully vested. DefiLlama’s current categorization is 53.8% insiders, 43.4% farming, 2.9% airdrop, with no non-circulating bucket. Unlock verification: Announced vesting is reported complete, but actual unlock execution and wallet-level reconciliation are Not verifiable as of October 10, 2026 because Dune/on-chain verification is unavailable. The 83.7M circulating figure also conflicts with an older Etherscan snapshot showing 78.7M; the latter is stale. Concentration/control: CertiK reports top-10 holders at roughly 60% and major-holder concentration of 73.28%, excluding exchanges/locked addresses; this is stale analytics, not raw on-chain verification.

Mint, blacklist, whitelist, transfer-pause, adjustable-tax and balance-modification functions were not detected by CertiK. The token is upgradeable/proxy-based, so implementation/admin control remains a key risk; exact current admin is Not verifiable as of October 10, 2026. Ethereum liquidity/listings: DefiLlama lists approximately $12.1M across major FLUID/ETH-WETH pools on Fluid DEX and Uniswap V3, plus smaller Uniswap V4 pools. Main CEX listings reported by CoinGecko: Deepcoin, OKX and Bybit.

For Fluid Liquidity on Ethereum, a Bitcoin move below $10,000 would be a severe *macro-and-crypto stress* event, but the protocol’s own risk framing says it is designed to maintain liquidity during market crashes and to avoid liquidity crunches because the same liquidity supports both DEX and lending activity. That means the key risk is less a direct BTC-price exposure and more a systemwide stress transmission through correlated crypto selling, higher leverage unwind pressure, and thinner market liquidity. On Fluid’s own description of market-crash behavior, a broad selloff can *increase* ETH liquidity in the protocol when traders sell ETH for USDC or BTC, because LPs receive ETH and pay out USDC.

However, the same source also says that for pairs where ETH is less volatile than the other asset, liquidity can flow out of Fluid and other-token liquidity can come in, so the protocol’s resilience depends on the exact market pair mix. In a BTC-below-$10k stress scenario, the most relevant protocol-level concerns are:

• Higher liquidation intensity across crypto markets, which can increase demand on lending/liquidation infrastructure.
• Withdrawal pressure / reduced buffers if utilization is already high, since higher utilization leaves less room for fast withdrawals in stress scenarios.
• LP losses from rebalancing in volatile pools, because Fluid governance notes that sharp volatility can trigger rebalancing and incur losses to LPs.
• Bad-debt or contagion risk if a correlated external incident hits a market that Fluid supports, as seen in the Resolv-related post-mortem discussion. The strongest directly relevant on-source evidence is that Fluid’s design aims to keep liquidity available during crashes, but it does not eliminate LP loss, rebalancing loss, or stress from ecosystem-wide deleveraging. The specific impact of BTC falling below $10,000 on Fluid’s Ethereum deployment is Not verifiable as of 2026-10-10 from the available sources because there is no on-chain or chain-level exposure data in the provided materials.

Fluid’s collateral-depeg loss depends on the specific vault pair and the liquidation buffer; with only the provided sources, the maximum loss from a 20% collateral depeg is not verifiable as of 2026-10-10. The protocol uses isolated vaults with their own LTV/oracle, and published examples show borrowing limits from 80% to 95% LTV depending on the pair, so a 20% price drop can range from fully absorbed by overcollateralization to causing bad debt if the starting LTV is high enough. For context, Fluid’s documentation says vaults are isolated pairs with their own risk parameters, and its governance/forum materials describe specific configurations such as ETH/USDC at 92% threshold and cbBTC at 88% collateral factor, while other pairs can go as high as 95% LTV.

That means a 20% depeg is not a single protocol-wide outcome; the impact must be assessed per market, and the on-chain result is highly sensitive to the exact collateral factor, liquidation penalty, oracle timing, and available liquidation liquidity. A useful stress interpretation is: if a vault’s effective liquidation threshold is above the post-depeg collateral value, the position should be liquidated before bad debt; if the depeg is large enough to outpace liquidations or if liquidity is thin, bad debt can remain. Fluid’s own governance discussion explicitly notes that extreme depegs can drain liquidity pools and “result in a bad debt for the Fluid,” but it does not provide a universal 20% shock loss number.

Scenario: largest Ethereum Vault borrower becomes insolvent Exposure identification. The largest borrower, its debt, collateral, and percentage of Ethereum-wide Fluid exposure are Not verifiable as of October 10, 2026 because Dune is unavailable in this run. Fluid’s Liquidity Layer is shared by Lending, Vaults, and other integrated protocols; the core layer tracks supply/borrow balances, while Vault contracts perform collateral valuation and liquidation. 1. Market shock / insolvency. An oracle-marked collateral shortfall makes the NFT position liquidatable.

The Vault’s liquidation function can sell collateral against repayment of debt; liquidation amounts are returned as debt paid and collateral received. Smart-collateral or smart-debt positions require DEX-share conversion, adding liquidity and execution risk. 2. Expected loss path.

• First loss: the borrower loses collateral equity and any residual liquidation value.
• Liquidator compensation: the liquidator receives collateral at an economically favorable liquidation rate/discount. This is the incentive to repay the Vault debt; the cost is borne by the liquidated position, not a separate guaranteed insurance payment.
• Residual shortfall: if collateral sale proceeds are below debt—because of price gaps, oracle lag, thin DEX liquidity, or failed execution—the Vault records absorbed collateral/debt. The code exposes absorbedSupply and absorbedBorrow, and supports liquidation with an absorb option. 3. Who absorbs it. The immediate absorber is the Vault’s liquidation/absorption accounting. The ultimate economic absorber is Fluid Liquidity’s suppliers and/or the affected liquidity pool if the shortfall cannot be recovered: supplier exchange prices and withdrawal liquidity can be impaired. A separate, pre-funded insurance fund or automatic treasury reimbursement is Not verifiable as of October 10, 2026. 4. Smart-contract impact path. Oracle threshold breach → Vault.liquidate(..., absorb) → collateral/debt state updated in Vault ticks/branches → debt repayment routed through the shared Liquidity contract → fToken supplier claims remain against that pool. Cross-vault concentration is material: audits note that multiple Vaults share one Liquidity contract, so one asset-liquidity failure can impair liquidation of other positions using the same token. Bottom line: the designed waterfall is collateral → liquidator discount → Vault absorption → shared-liquidity suppliers; no verified external guarantor is established.

For the committed fraud by the DAO or owners stress scenario, I found no verified evidence of fraud by Fluid’s DAO or owners in the provided sources. The strongest directly relevant incident record instead points to a security/control failure and treasury response: Fluid says the March 2026 Resolv incident came from unauthorized minting in Resolv’s signing infrastructure, not from Fluid’s own contracts, and that the resulting shortfall was covered from the DAO treasury with users made whole. There is also evidence of centralization and governance-risk vectors that could make owner/DAO misuse consequential, but these are not proof of fraud.

A third-party report says Fluid’s architecture allows a single admin transaction to redirect all vaults of a type via a shared beacon implementation, and that adding a malicious approved protocol could drain the Liquidity Layer. A governance/audit source also notes a critical rebalancing function became inaccessible after a bad deployment, showing operational fragility rather than fraud. The only source in the set that explicitly raises DAO/owner-concentration concerns is the Stengarl report, which says a large share of token supply appears concentrated in one wallet and suggests it may be the DAO treasury, but that wallet attribution is not independently verified in the provided material.

Because of that, a fraud-by-DAO/owners conclusion is Not verifiable as of 2026-10-10. Risk assessment: low evidence of historical DAO/owner fraud; moderate governance/custody concentration risk if insiders were ever compromised or acted maliciously; high impact if such a scenario occurred because shared upgrade/admin controls could affect the whole Ethereum deployment.

For Fluid Liquidity on Ethereum, the primary yield source is borrower interest, and in a stress case where that source is negative over 30 days, the protocol’s lending yield would be structurally under pressure because supplier APY is tied to borrower demand and utilization rather than a fixed subsidy. What that means in practice:

• A negative 30d primary yield implies the core lending market is no longer producing net positive income for suppliers over that window; on Fluid, that would most likely reflect weak borrow demand, sharp rate compression, or market dislocation rather than an emission-driven reward stream.
• In a stress regime, Ethereum liquidity can also become more fragile because higher utilization leaves less withdrawal buffer, and withdrawal queues may form if exits exceed available liquidity.
• Fluid’s design does have a second economic source in DEX swap fees through the shared Liquidity Layer, but that is an offset, not a guarantee; whether it is enough to keep the combined yield positive is Not verifiable as of 2026-10-10 from the provided sources.
• Independent commentary on Fluid’s lending product notes that borrower-interest yield is the primary source and that the system is exposed to liquidity-layer and borrower-side risks across the stack. A useful stress interpretation is therefore: negative 30d primary yield = weakening core lending engine, with the main risks being lower supplier returns, tighter withdrawal conditions, and greater reliance on non-lending fee flows to stabilize total APY.

Scope: Ethereum only. Fluid’s frontend and development are operated by the Instadapp team; the public contracts are maintained in Instadapp’s GitHub organization. The core Liquidity Layer holds user funds and is upgradeable.

Current control is split: FLUID GovernorBravo controls the Timelock and protocol ownership; the Instadapp/Avocado team multisig is a guardian and operational deployer. The guardian can pause Class-0 protocols and cancel queued timelock transactions, but is reported unable to directly withdraw Liquidity Layer funds. Governance appears real rather than purely symbolic: governance proposals have transferred ownership, set protocol parameters, and control the Timelock.

The documented process is forum discussion followed by formal voting; historical parameters were approximately one-day voting delay, two-day voting period, and one-day execution queue. Current independent curation reports a 1-day Timelock delay and GovernorBravo control. Centralization risk remains material: the team multisig retains emergency pause/cancellation powers and operational deployment permissions, while a successful governance vote can authorize a Timelock upgrade of the core Liquidity Layer.

Multisig signer identities and independence are not established by the reviewed sources. Voting concentration and top FLUID holders via Dune: Not verifiable as of October 10, 2026. No Dune query or execution ID is available in this run.

Company: Instadapp’s Terms identify the operator as InstaDApp Labs LLC. Jurisdiction, registration number, directors, and Fluid-specific Terms of Service: Not verifiable as of October 10, 2026.

Assessment (as of October 10, 2026). Fluid Liquidity is a non-custodial DeFi software/protocol deployed on Ethereum, comprising lending, borrowing, liquidity-layer and DEX smart contracts. The protocol’s legal classification is not formally established in the reviewed materials; FLUID is described as a governance/utility token, but that is not a definitive securities, commodities, or other regulatory classification. Entity and structure. The historical operating entity is InstaDApp Labs LLC, with Instadapp’s terms selecting San Francisco County/Northern District of California; exact formation-state evidence was not located. A Fluid Foundation, described as a Cayman Islands non-profit entity, was reportedly incorporated to hold protocol IP for the DAO; the governance proposal stated that formal IP transfer was targeted for mid-2026, so completion is not independently verified here. ToS, restrictions, KYC/AML. Instadapp’s published terms prohibit use where unlawful or sanctions-restricted and state that the software provider is not regulated by a federal or state agency.

They place legal-compliance responsibility on users and disclaim custody/fiduciary obligations. No Fluid-wide, user-facing KYC/AML onboarding requirement was found. The Foundation proposal references AML/KYC and banking compliance for off-chain counterparties, not mandatory identification for permissionless Ethereum interactions. Data protection. Instadapp publishes GDPR rights for EEA/Swiss users and California privacy disclosures.

However, wallet activity remains publicly visible on Ethereum, and the reviewed materials do not establish a comprehensive Fluid-specific privacy controller/processor framework. Warnings, enforcement, litigation, sanctions. No protocol-specific regulator enforcement, court case, or sanctions designation was identified in the reviewed SEC, DOJ, and OFAC search paths. Not verifiable as of October 10, 2026 that none exists outside those sources. Legal risk remains material: a legal wrapper does not eliminate possible liability for developers, directors, operators, front-end providers, governance participants, or counterparties, nor does “decentralized/non-custodial” wording determine regulatory treatment.

No exact GLEIF LEI record for 'InstaDApp Labs LLC', 'Fluid Foundation', 'Fluid Liquidity'. OFAC SDN screening of 'InstaDApp Labs LLC', 'Fluid Foundation', 'Fluid Liquidity': no match. SEC litigation and administrative release feeds: no mention.

Fluid Liquidity does not appear to issue its own stablecoin; the protocol is described as a liquidity/lending layer that supports assets such as USDC, USDT, GHO, and EURC, but no protocol-native stablecoin is identified in the gathered sources. The stablecoin used in its liquidity products is not verifiable from the available sources, and no reliable evidence of any depeg event for a Fluid-associated stablecoin was found. As a result, the stablecoin depeg history is not verifiable as of 2026-10-10.

The structured fields are therefore set to null where unknown.

Fluid Liquidity’s main risks are concentrated in oracle/issuer dependency, shared-liquidity contagion, smart-contract complexity, and privileged operational control. Public evidence shows these are material rather than theoretical: the Resolv incident produced approximately $21 million of Fluid bad debt, while audits identify oracle, reentrancy, TWAP, and cross-contract logic concerns.

Fluid’s top strengths are its unified liquidity layer, high capital efficiency, smart collateral/smart debt design, strong risk controls, and gas-efficient liquidations/accounting. The protocol is built so lending, borrowing, DEX, and vault activity share one liquidity base rather than fragmenting capital across separate pools.

• Unified liquidity architecture: Fluid centralizes liquidity in a single core layer that multiple products read from, which reduces fragmentation and lets liquidity flow across lending, trading, and vaults without withdrawals or migration.
• High capital efficiency: Fluid advertises up to 95% LTV on ETH and positions itself as a system where one deposit can support multiple functions at once, improving utilization versus siloed DeFi markets.
• Smart Collateral / Smart Debt: Users can keep collateral productive while borrowing, and the same asset can simultaneously support lending, borrowing, and AMM liquidity, which increases yield and utility per unit of capital.
• Risk management and automated limits: Fluid’s design includes automated ceilings, utilization-aware limits, and isolated risk controls intended to restrict unusually large or risky positions while preserving normal activity.
• Lower gas and liquidation overhead: Fluid emphasizes gas-efficient accounting, partial liquidations, and very low liquidation penalties—reported as low as 0.1%—which can reduce execution costs and liquidation friction. These strengths are mostly *architecture-driven* rather than dependent on incentives, so they point to structural efficiency and risk containment as the protocol’s main advantages.