Fluid Lite

Orange · 68/100

Executive summary

Fluid Lite is an Ethereum-based automated yield-vault protocol offering leveraged staking (ETH Lite) and fixed-rate stablecoin strategies (USD Lite), scoring 68/100 (orange band) with high data confidence (90/100).

  • Security: Multiple audits by PeckShield, StateMind, MixBytes, and Cantina covering underlying Fluid components (Vault, DEX, Liquidity Layer); no audit directly covers the Fluid Lite wrapper/Strategy Handler itself, and bytecode match to deployed code is not verifiable as of October 27, 2026. Unresolved findings include acknowledged Medium supply-limit and admin-key trust issues. Active $500k Immunefi bug bounty.
  • Incidents: Three material events in 2026: March Resolv USR exploit caused ~$21M Fluid-wide bad debt (resolved, lenders made whole, no direct fLiteUSD exposure); April KelpDAO rsETH bridge failure triggered temporary Lite ETH withdrawal delays (no loss, resolved via redemption rails); May rewards-infrastructure key compromise drained ~$215k FLUID/GHO (core vaults unaffected, team pledged coverage but execution not verifiable).
  • Governance & custody: Non-custodial smart-contract vaults; Fluid DAO governance controls strategy approval and leverage ranges via on-chain voting (1% threshold, 4% quorum). Team multisig can pause withdrawals/rebalancing and reduce allocations but reportedly cannot withdraw vault assets. Timelock duration, current multisig signers, and independence are not verifiable as of October 27, 2026.
  • Top risks: Leveraged stETH depeg and cascading liquidation (high residual tail risk under correlated stress); smart-contract/oracle failure across layered dependencies; USDC issuer/depeg risk for USD vault; concentration and liquidity risk in external venues (exact allocations not verifiable); upgrade authority and governance-execution risk.
  • Strengths: Automated leveraged-yield execution with cross-protocol diversification (Aave, Morpho, Fluid lending); strong capital efficiency via shared liquidity layer; simple ERC-4626 interface; multi-chain flexibility (Ethereum, Arbitrum, Plasma documented for USD); established team (Instadapp founders, 2018+) with historical backing from Pantera, Coinbase Ventures.
  • Unverified: Bytecode audit coverage, current multisig composition/threshold, exact counterparty allocations, KYC/AML policy, organic vs. subsidized yield split, 20% collateral-depeg stress outcome, and whether any buybacks/burns have occurred.
  • Recommended exposure: Small tactical allocation only (<5% of DeFi portfolio) for sophisticated allocators comfortable with leveraged LST and multi-protocol dependency risk; require independent on-chain verification of current strategy allocations, collateral ratios, and liquidity depth before deployment; monitor stETH premium, Fluid lending utilization, and governance proposals; avoid during periods of elevated ETH volatility or LST stress.
  • Open questions: Verify deployed bytecode matches audited scope; confirm current multisig signers, threshold, and independence; obtain real-time on-chain breakdown of counterparty exposure and leverage ratios; validate redemption liquidity under stress; clarify whether May 2026 rewards loss was fully reimbursed; assess whether fixed USD rate is sustainably covered by strategy yield net of reserves.

Score

Component Weight Raw Points Reason
Security 20% 100 20.0 6 audit(s); fresh audit bonus; active bug bounty bonus
Audits 20% 50 10.0 no full audit on record; latest report 2025-12-10
Incidents 20% 100 20.0 1 open incident(s), $215,000 at risk = 0.5% of TVL (threshold 10%)
Governance 20% 90 18.0 DAO governance; no single party can withdraw funds
TVL 20% 1 0.2 TVL $41,593,926 = 1% of reference ($5,521,982,199)
Data confidence 90 7/7 critical categories; 16/33 verified facts; 33/33 fresh (180d)

Identification

protocol identification

two sources

Identification — Fluid Lite (Ethereum)

  • Name / website / docs: Fluid Lite, the automated-yield-vault product of Fluid/Instadapp; website fluid.io, documentation docs.fluid.io / lite.guides.instadapp.io. It is a yield aggregator / automated strategy-vault protocol, using leveraged staking, lending-market integrations and ERC-4626 vault shares.
  • Launch: Instadapp Lite was live by February 9, 2023, when the team stated it had launched “less than a year ago”; therefore the original launch was approximately 2022, but the exact date is Not verifiable as of October 27, 2026. Lite v2 was announced on February 9, 2023.
  • Chains: The supplied scope is Ethereum. Current Fluid Lite USD documentation identifies an Ethereum mainnet vault; broader historical/current product materials also reference Arbitrum and Plasma for Lite USD, but chain-level exposure is Not verifiable as of October 27, 2026 because Dune was unavailable.
  • Native token: Fluid’s ecosystem token is FLUID, formerly INST; Fluid Lite itself issues vault-share tokens rather than a separate protocol token. The documented USD vault share is fLiteUSD. Contract identification and verification
  • Ethereum Lite USD vault proxy: 0x273DA948ACa9261043fbdb2a857BC255ECC29012.
  • Implementation: 0xE16Ccc91a8134d428e7b6240177f9e2b227b9743.
  • Underlying USDC: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48. Docs and Etherscan/Routescan independently report the proxy and implementation; explorers expose proxy/source-code information. Dune cross-check: Not verifiable as of October 27, 2026. Fork lineage
  • No evidence identifies Fluid Lite as a fork of an unrelated protocol. It is an Instadapp-built product using Instadapp’s DeFi Smart Layer and external lending protocols. Lite v2 added multi-protocol support, improved withdrawals, ERC-4626 composability and upgradeability versus Lite v1.
  • Audits: Fluid’s broader Vault/Liquidity/Dex code has public audits, but a Lite-specific audit covering the vault above is Not verifiable as of October 27, 2026.
  • Malicious modifications in similar forks: Not verifiable as of October 27, 2026.

maturity

two sources

Fluid Lite appears to be a real product portal rather than a pure marketing landing page: the documentation describes concrete Ethereum mainnet vaults, contract addresses, and standard ERC-4626 deposit/withdraw flows, including read methods for previewing quotes before submitting a transaction. The getting-started guide explicitly states that users can deposit and later withdraw ETH/stETH or USDC through the app flow, which is a strong sign of live user functionality rather than a template shell. The maturity picture is mixed but credible.

The docs expose implementation details such as proxy addresses, asset/share mechanics, pause flags, and withdrawal fees, which is more operational than promotional documentation. The presence of address and concept pages also suggests a maintained support surface for actual vault interactions. That said, the source set does not let the quality of the live frontend be fully verified here, so broken links, fake metrics, or template reuse cannot be confirmed or ruled out beyond the fact that the documentation is specific and product-oriented.

The GitHub result for a similarly named repo is unrelated and should not be treated as evidence about this protocol. Open API: yes, at least at the smart-contract/interface level. The docs explicitly document ERC-4626 standard methods and read functions such as deposit, mint, withdraw, redeem, previewDeposit, previewMint, previewWithdraw, and previewRedeem, and they note that the vault is ERC-4626 compliant and works with compatible tooling.

If by “open API” you mean a public REST API or developer backend, that is not verifiable as of 2026-10-27.

Security

bug bounty

two sources

An active bug bounty program is publicly referenced for Fluid/Instadapp on Immunefi, with the program covering the Liquidity Layer, Lending Protocol, and Vault Protocol. Public sources consistently describe a critical smart-contract bug payout cap of $500,000, but I could not verify the exact launch date or a complete results ledger from the available sources. Reported results are therefore not verifiable as of 2026-10-27.

Active
Yes
Platform
Immunefi
Max payout
$500K

counterparty risks

two sources

Scope: Fluid Lite on Ethereum. Dune/on-chain verification was unavailable; therefore allocation percentages, current balances, and active-failure status are not independently confirmed. Not verifiable as of October 27, 2026. Dependencies & counterparty risk

  • Core dependency: Fluid’s architecture routes vault activity through its own Liquidity, Vault, Oracle, and—where applicable—DEX components. Smart-leg accounting depends on the Fluid DEX resolver and oracle outputs; a compromised or misconfigured oracle can return incorrect operate/liquidation prices.
  • External protocols/assets: Public secondary research describes the ETH Lite strategy as recursive liquid-staking exposure, including stETH supplied, ETH borrowed, and redeposited. This creates correlated LST depeg, liquidation, liquidity, and Fluid lending-market risks. The exact current asset mix is Not verifiable as of October 27, 2026.
  • Stablecoin exposure: Fluid Lite USD is documented as an ERC-4626 USDC vault on Ethereum, so USDC issuer/depeg, redemption, blacklist/freeze, and liquidity risks apply. Its strategy handler and exact downstream venues are not fully disclosed in the cited documentation.
  • Oracle/manipulation risk: Fluid documentation describes multiple oracle paths, including Chainlink and Uniswap-based pricing, but the resolver does not independently cross-check a compromised oracle. Thin liquidity, stale prices, or manipulated reference markets could trigger incorrect minting, withdrawals, or liquidations.
  • Bridges/custodians/CEX/MM/RWA: Ethereum-only deployment is reported by independent analytics; no bridge, custodian, CEX market-maker, or RWA issuer dependency was identified. This reduces bridge/custody risk but concentrates smart-contract and Ethereum execution risk.
  • Audit boundary: Fluid has audits for broader protocol components, but a public governance review states that no audit clearly covered the fLiteUSD v3 Strategy Handler. Do not treat broader Fluid audits as complete coverage of Fluid Lite. Failure scenarios: LST depeg or USDC depeg; oracle error/manipulation; lending-market insolvency or bad debt; recursive-loop liquidation cascade; strategy-handler or upgrade/admin compromise; withdrawal liquidity shortfall. Structured fields
  • dependency_failure_active: null
  • max_exposure_pct: null

crypto custody

two sources

Fluid Lite (formerly Instadapp Lite) is organized as a non‑custodial smart‑contract vault system on Ethereum: users deposit into on‑chain vault contracts and receive ERC‑20 vault share tokens that represent their claim; there is no centralized entity holding private keys to user funds. How custody works technically

  • Users deposit USDC or ETH into a Fluid Lite vault contract on Ethereum mainnet and receive shares, an ERC‑20 token representing a pro‑rata claim on the pool.
  • As the vault earns yield, the exchange rate (assets per share) increases rather than the share balance changing.
  • The vault contracts then deploy pooled assets to external DeFi protocols (e.g., Aave, Morpho, Fluid lending, etc.) using pre‑programmed strategies and a designated Rebalancer role that can move funds between protocols within governance‑set parameters.
  • Users retain economic claim via their share tokens and can exit via withdraw or redeem functions on the vault contract, which burn shares and return underlying assets. Custody model classification
  • Control of assets is mediated purely by Ethereum smart contracts; there is no indication of off‑chain, centralized custody accounts or omnibus wallets in Fluid Lite’s documentation.
  • This corresponds to a DeFi, smart‑contract–based, non‑custodial model, where risk is primarily smart‑contract and integrated‑protocol risk, not broker‑style custody risk.
  • Rebalancing and strategy execution are permissioned to the Rebalancer address, but this role operates on‑chain and within parameter limits; it does not resemble a traditional custodian with discretionary off‑chain control. Segregation of assets (vault vs. firm balance sheet)
  • Each vault holds user deposits in a dedicated on‑chain contract and issues a separate ERC‑20 share token; user claims are thus logically and technically separated from any treasury or operational wallets the Fluid team may control.
  • There is no statement in available public docs that user assets are treated as client assets under any specific regulatory segregation regime (e.g., broker‑dealer or qualified custodian rules), nor any insolvency opinion. Based on this, for the structured fields:
  • withdrawal_paused: null (no evidence of a current global pause state; pausing policies not clearly documented in retrieved sources).
  • segregated_assets: true (assets sit in distinct on‑chain vault contracts and are represented by ERC‑20 shares rather than co‑mingled on a centralized balance sheet).
Segregated assets
Yes

key management

two sources

## Fluid Lite — key-management organization (Ethereum) Fluid Lite uses a layered control model, rather than a single administrator: 1. DAO governance — The Fluid DAO/FLUID governance controls strategic configuration, including permitted underlying protocols, leverage ranges, and vault parameters. Governance can also assign or remove rebalancer permissions. 2. Rebalancer operators — Permissioned rebalancers execute operational actions such as leverage changes, refinancing, and position management within governance-defined limits.

They are explicitly described as unable to withdraw vault funds. For the newer Lite v3 architecture, responsibilities are separated into operator classes covering routine refinancing, capital movement, reconciliation, leverage, swaps, and strategy-parameter updates. 3. Team multisig / emergency authority — The documented Lite emergency multisig can reduce a protocol allocation ratio, pause withdrawals temporarily, and pause rebalancing.

It is stated not to own, withdraw, or transfer vault assets; its role is containment and emergency management, not treasury custody. The legacy Lite documentation identifies 0xa8c31E39e40E6765BEdBd83D92D6AA0B33f1CCC5. 4. Vault-level owners and upgrade controls — The current Lite v3 USD interface displays a vault owner plus a secondary “Team Multisig” owner, showing that implementation-specific administrative roles may exist in addition to the general Lite emergency role.

The interface identifies the secondary multisig as 0x4F6F97…C2D49e. > Contradiction / version risk: The older Lite risk documentation names 0xa8c3…CCC5, while the current v3 USD interface names 0x4F6F…D49e. These may represent different product versions or migrated controls; the sources do not reconcile them. Key-management risk assessment: authority is segmented, and the emergency role is reportedly non-custodial. However, the exact signer set, signing threshold, key-storage practices, rotation procedure, and timelock duration for the Ethereum Lite deployment are Not verifiable as of October 27, 2026.

On-chain verification was unavailable in this run.

smart-contract

two sources

Scope / addresses — Ethereum. “Fluid Lite” has multiple vaults. The currently documented Lite USD vault is 0x273DA948ACa9261043fbdb2a857BC255ECC29012, implementation 0xE16Ccc91a8134d428e7b6240177f9e2b227b9743, using USDC 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48. The legacy ETH Lite vault is 0xA0D3707c569ff8C87FA923d3823eC5D81c98Be78. Architecture. The USD vault is an ERC-1967-style delegate proxy; Etherscan identifies FluidLiteVaultProxy and the implementation address.

The proxy bytecode exposes an implementation slot and Upgraded event, confirming upgradeability, but the proxy ABI does not disclose the controlling admin. ``text User USDC/ETH │ deposit / mint / withdraw / redeem ▼ Fluid Lite vault proxy ─delegatecall─> implementation │ ├─ strategy/rebalancer permissions ├─ underlying lending/DEX protocols and oracles └─ withdrawal liquidity / accrued yield ▲ └─ governance + team emergency controls `` Admin and emergency risk. Fluid’s risk documentation states that DAO governance can change leverage parameters and approve/remove strategies; rebalancers may leverage/refinance but reportedly cannot withdraw vault funds. The team multisig can reduce protocol ratios, temporarily pause withdrawals, and pause rebalancing, but the documentation says it cannot move or withdraw vault assets. It identifies the team multisig as 0xa8c31E39e40E6765BEdBd83D92D6AA0B33f1CCC5.

The USD administration UI additionally displays an owner and secondary team multisig, but only truncated owner data is publicly rendered. Timelock / proxy-admin verification. Dune MCP was unavailable; therefore decoded admin events, current owner/admin values, signer threshold, queued transactions, and an on-chain timelock delay are Not verifiable as of October 27, 2026. Historical governance documentation describes approximately one-day voting delay, two-day voting period, and one-day execution queue for the older Lite system, but this is not proof of the current vault’s controls. Exit and worst case. Standard ERC-4626 exit functions exist for the USD vault, but withdrawals depend on available liquidity and underlying strategy unwinding. A compromised upgrade authority could replace logic to freeze withdrawals, alter accounting/fees/oracles, or redirect assets; a compromised emergency multisig could freeze withdrawals/rebalancing.

Whether any privileged key can directly drain funds is Not verifiable as of October 27, 2026. Audit status. No vault-specific audit was identified; Etherscan reports no audit submitted. Not verifiable as of October 27, 2026. Structured fields: admin_can_drain: null; audited_deployment: null; upgradeable: true; unresolved_critical: null; unresolved_high: null.

Upgradeable
Yes

audit

one source

Vault-component audit, not a direct Fluid Lite wrapper/Strategy Handler audit. Critical 0; High 0; Medium 2; Low 4. Bytecode match to deployed Fluid Lite code: Not verifiable as of October 27, 2026.

Auditor
MixBytes
Report date
2024-06-25
Scope
Fluid Vault protocol / VaultT1; report lists mainnet VaultT1 deployments.
Findings
Supply-limit risk, insufficient reentrancy protection, zero-collateral liquidation revert, unsupported token types, cross-vault liquidation risk and rate-calculation revert.
Fix status
3 fixed; 3 acknowledged. The supply-limit Medium finding remains acknowledged.
Report url
https://docs.fluid.instadapp.io/MixBytes_Fluid_Vault_Protocol_Audit.pdf
Report id
doc:1e5bcc067f26e5c5
Covers deployed code
No
Unresolved critical
0
Unresolved high
0

audit

one source

DEX-component audit, not a direct Fluid Lite wrapper/Strategy Handler audit. Critical 0; High 0; Medium 0; Low 3. Bytecode match to deployed Fluid Lite code: Not verifiable as of October 27, 2026.

Auditor
MixBytes
Report date
2024-12-04
Scope
Fluid DEX contracts and listed Ethereum pool deployments.
Findings
Three Low findings: missing custom error, misleading comment and revenueCut above 1% causing reverts.
Fix status
All 3 acknowledged; no fixes recorded in the report.
Report url
https://docs.fluid.instadapp.io/Mixbytes_Fluid_Dex_Audit.pdf
Report id
doc:3c45eb6d5eb34491
Covers deployed code
No
Unresolved critical
0
Unresolved high
0

audit

one source

Related Fluid component audit, not a direct Fluid Lite wrapper/Strategy Handler audit. Critical 0; High 4; Medium 4; Low 5. High findings were resolved; Medium findings were resolved except admin-key trust, mitigated. Bytecode match to deployed Fluid Lite code: Not verifiable as of October 27, 2026.

Auditor
PeckShield
Report date
2023-11-10
Scope
Pre-launch Fluid protocol: liquidity layer, lending, VaultT1, oracle and supporting contracts; reviewed commits 5b3bfd1 and 7a0cac2.
Findings
13 findings: C0/H4/M4/L5; oracle scaling, privileged functions, collateral/liquidation logic, reentrancy, admin-key trust and calculation issues.
Fix status
12 resolved; 1 mitigated (admin-key trust).
Report url
https://docs.fluid.io/Peckshield_Fluid_Audit.pdf
Report id
doc:4da3d9579ccae80c
Covers deployed code
No
Unresolved critical
0
Unresolved high
0

audit

one source

Liquidity-layer audit, not a direct Fluid Lite wrapper/Strategy Handler audit. Critical 0; High 0; Medium 0; Low 2. Bytecode match to deployed Fluid Lite code: Not verifiable as of October 27, 2026.

Auditor
MixBytes
Report date
2025-12-10
Scope
Changes in the Fluid Liquidity Layer between commits 23692b02dc20aa87aa59f2bcd8bb8ec4ad9234bf and f5a07116967103946791dffd1fbafa71e0a60828; ZIRCUIT and ZtakingPool out of scope.
Findings
Low risk of ETH loss from MAX_INPUT_AMOUNT_EXCESS and missed preTransferOut() hooks.
Fix status
1 fixed; 1 acknowledged.
Report url
https://docs.fluid.instadapp.io/MixBytes_Fluid_Liquidity_Audit.pdf
Report id
doc:79b02baccbffdf5d
Covers deployed code
No
Unresolved critical
0
Unresolved high
0

audit

one source

DEX-component audit, not a direct Fluid Lite wrapper/Strategy Handler audit. Critical 0; High 0; Medium 2; Low 7; Informational 4. Bytecode match to deployed Fluid Lite code: Not verifiable as of October 27, 2026.

Auditor
Cantina
Report date
2025-01-07
Scope
Instadapp Fluid DEX competition, conducted September 11–October 2, 2024.
Findings
Two Medium findings: incorrect TWAP oracle updates and a division-by-zero lock condition; 7 Low and 4 Informational findings were identified but not detailed in the public summary.
Fix status
Public report does not provide finding-by-finding remediation status.
Report url
https://docs.fluid.instadapp.io/cantina-audit-dex.pdf
Report id
doc:bf250a0e9ff763c1
Covers deployed code
No
Unresolved critical
0
Unresolved high
0

audit

one source

Liquidity-layer update audit, not a direct Fluid Lite wrapper/Strategy Handler audit. Critical 0; High 1; Medium 0; Informational 4. Bytecode match to deployed Fluid Lite code: Not verifiable as of October 27, 2026.

Auditor
StateMind
Report date
2025-10-14
Scope
Instadapp Liquidity Layer updates; final reviewed commit 151ced3ff5d6079e9bc598b71ccce25933a3580b.
Findings
High net-transfer overpayment; informational callback parsing, redundant conditions, revenue cap and native-transfer gas-limit issues.
Fix status
2 fixed; 3 acknowledged.
Report url
https://docs.fluid.instadapp.io/Statemind_Fluid_Liquidity_Updates_Audit.pdf
Report id
doc:f02c8cb970076d23
Covers deployed code
No
Unresolved critical
0
Unresolved high
0

audit

one source

Related broad Fluid audit, not a direct Fluid Lite wrapper/Strategy Handler audit. Critical 3; High 8; Medium 15; Informational 40. Bytecode match to deployed Fluid Lite code: Not verifiable as of October 27, 2026.

Auditor
StateMind
Report date
2023-12-29
Scope
Fluid liquidity layer, lending, VaultT1, iTokens, rewards, stETH queue, flashloans, proxies and oracles; final commit f5a07116967103946791dffd1fbafa71e0a60828.
Findings
66 findings, including pool-draining math/reward issues, debt-factor errors, oracle/DoS risks and liquidation/accounting issues.
Fix status
52 fixed; 14 acknowledged, including 1 High and 6 Medium.
Report url
https://docs.fluid.instadapp.io/Statemind_Fluid_Audit.pdf
Report id
doc:f2af8af78e4f9d5a
Covers deployed code
No
Unresolved critical
0
Unresolved high
1

Team & Reputation

founders

two sources

Identity. Fluid Lite is presented as a yield product within the Instadapp/Fluid ecosystem, not as an independently established protocol. Public materials identify Fluid as the successor to Instadapp, founded in 2018 by brothers Samyak Jain and Sowmay Jain. Samyak is publicly associated with the CEO/founder role; current role descriptions for Sowmay vary across sources, and the team’s present structure is not fully independently verifiable. Founders and prior record. The founders reportedly won an Ethereum hackathon in 2018, then built Instadapp after raising approximately $2.4 million from Pantera and Naval Ravikant.

Instadapp developed integrations and products around Aave, Compound, Uniswap, Maker and Curve before the Fluid rebrand. This is meaningful prior DeFi operating experience, but the cited historical claims are partly investor- or protocol-adjacent reporting rather than primary corporate records. The wider team includes Igor Lymar, identified in an audit-related source as CTO, and DeFi Made Here (DMH), described as a pseudonymous contributor who joined full-time in 2024.

DMH’s pseudonymous status reduces accountability and makes background verification weaker than for the named founders. Hacks and adverse history. The available results do not establish a confirmed exploit of Fluid Lite itself or a loss of protocol funds. One later transparency filing states that no prior exploits affecting tokenholders or protocol funds had been identified as of June 12, 2026. A separate investment write-up alleges that an early-2026 exploit of partner protocol Resolv pushed approximately $80 million of unbacked tokens into Fluid; this is a material counterparty/contagion risk claim, but it was not independently confirmed by the sources available here. Reality check. The founders and Instadapp have a credible, long-running DeFi build history, and Fluid has identifiable public-facing products and named personnel.

However, real office, legal operating entity, and onshore/offshore status are not independently verifiable as of October 27, 2026. A MiCA whitepaper lists Tortola, British Virgin Islands addresses for the founders, but that is a protocol document and does not prove an operating office. The evidence supports a genuine software project rather than an obvious web front, while corporate substance, jurisdictional accountability, and the full team remain only partially transparent.

general reputation

two sources

Reputation assessment: Fluid Lite appears to be the Ethereum-facing product associated with Fluid, developed by the Instadapp team. Publicly identified founders are Samyak Jain and Sowmay Jain; reported historical backers of Instadapp include Pantera Capital, Coinbase Ventures, and Standard Crypto. The team has an established DeFi operating history, but Fluid Lite-specific diligence is limited because on-chain verification is unavailable in this review. Auditors and security record: Public risk summaries report audits by PeckShield, StateMind, MixBytes, and Cantina, covering lending, vault, DEX, and liquidity-layer components.

However, audits do not eliminate smart-contract, oracle, governance, or liquidity risk. A separate report describes a May 2026 compromise of off-chain rewards infrastructure, with approximately 125,000 FLUID and 51,900 GHO reportedly drained; it states that core contracts and user funds were not affected. Another source characterizes the event as a frontend/key-leak incident, but the available search material is not sufficient to independently reconcile the differing descriptions. Sentiment and criticisms: Third-party assessments range from “mostly safe”/Grade B- to materially more cautious C-level ratings.

Recurring concerns include token concentration, documentation gaps, ticker/name collisions, reliance on multiple interconnected components, and the potential blast radius of a liquidity-layer failure. These are risk observations, not evidence of fraud. Fraud, rug, insolvency, legal and sanctions: I found no reliable evidence in the retrieved sources establishing a rug pull, fraud conviction, insolvency, regulatory enforcement action, or sanctions designation against Fluid, Instadapp, or the named founders. Not verifiable as of October 27, 2026 for a definitive legal, regulatory, or sanctions clearance. > Key unresolved concern: the reported 2026 off-chain compromise and conflicting incident descriptions warrant primary-source incident reports, affected-contract analysis, compensation details, and confirmation that Fluid Lite uses the same audited deployment set. Those points are Not verifiable as of October 27, 2026.

On-chain balances, exposure, deployment identity, and Ethereum-specific TVL share are Not verifiable as of October 27, 2026.

Economy

TVL: $41.6M

model

two sources

Fluid Lite — Economic Model (Ethereum scope; reviewed October 27, 2026) Products/assets in/out. Two tracked vaults: ETH Lite (iETHv2) accepts ETH and returns a vault share representing an automated ETH/LST strategy; USD Lite (fLiteUSD) accepts USDC and returns ERC-4626 shares redeemable for USDC. The USD vault currently reports $42.04m TVL, 6.00% fixed-rate floor, 7.14% credited APY, and $14.40m immediately available liquidity. Yield source and risk profile. ETH Lite uses liquid-staking assets—including stETH, wstETH and weETH—combined with recursive borrowing/redepositing through lending venues. This is leveraged, structurally directional long ETH/LST exposure, not market-neutral; liquidation, LST depeg, oracle, borrowing-cost and liquidity risks apply.

USD Lite sources yield from yield-bearing assets/strategies including sUSDe, syrupUSDC, syrupUSDT and sUSDai, with exposure to Ethena delta-hedged positions, Maple credit, and USDai infrastructure financing. This is not purely risk-free stablecoin carry and includes external protocol, credit, market and custody/strategy risk. Organic vs subsidized. No verified split between organic yield and incentives is available. The USD rate is governance-set with a 6% floor; reserves capture yield above the depositor rate, so sustainability depends on strategy yield exceeding the fixed obligation.

The ETH strategy may include reward/points components. organic_yield_pct: null. Leverage/lock-ups/withdrawals. ETH Lite is leveraged/looped; an aggregate vault leverage ratio is not verifiable as of October 27, 2026. USD Lite has no stated lock-up and advertises anytime withdrawals, but liquidity can be constrained while strategies unwind. Fees: ETH Lite charges 20% of performance plus 0.05% exit fee; USD Lite charges 0.05% withdrawal fee and no deposit fee. Protocol revenue. DefiLlama reports $141,681 fees/revenue over 30 days and $7.89m cumulative, all attributed to Ethereum. TVL/trend. DefiLlama: $210.1m total, 100% Ethereum, down 17.2% over 30 days; October 23, 2026 snapshot was $209.22m versus $251.64m on September 30. Dune TVL and product-level trend: Not verifiable as of October 27, 2026. > Contradiction: protocol marketing states a minimum 6% USD APR and historical 8–10%, while DefiLlama’s two-pool average supply APY is 5.3%; methodology and timing differ, so the marketing figure is not independently validated.

APY history/volatility sufficient to establish sustainability: Not verifiable as of October 27, 2026.

reserves

two sources

As of October 27, 2026, Fluid Lite is an Ethereum-only yield-vault product, not a separately disclosed reserve-backed stablecoin issuer. Reserve / treasury size and composition: On-chain balances and reserve composition are Not verifiable as of October 27, 2026 because Dune MCP was unavailable for this run. DeFiLlama reports $210.1M TVL on Ethereum, but this is an analytics estimate of vault assets, not verified treasury liquidity. Known Ethereum contracts:

  • Fluid Lite USD vault proxy: 0x273DA948ACa9261043fbdb2a857BC255ECC29012.
  • Underlying USDC: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48.
  • The implementation is 0xE16Ccc91a8134d428e7b6240177f9e2b227b9743.
  • The ETH Lite pool token is identified by DeFiLlama as 0xa0d3707c...98be78; the complete address and current balances were not independently verified here. Custody and control: Assets are held in smart-contract vaults and deployed through managed strategies. Governance controls strategy parameters; a team multisig has limited emergency powers, including pausing withdrawals/rebalancing, but the risk documentation states it cannot directly withdraw or move vault assets. The published team multisig is 0xa8c31E39e40E6765BEdBd83D92D6AA0B33f1CCC5. Reserve policy / liabilities: USD Lite applies a fixed-rate mechanism; excess yield may accumulate as vault reserves, while a 0.05% withdrawal fee is retained by the vault. ETH Lite charges a 20% performance fee and 0.05% exit fee, reportedly collected by the Instadapp treasury. Attestations: No independent proof-of-reserves or reserve attestation for Fluid Lite was located. Audits exist for relevant Fluid vault infrastructure, but they are security audits, not solvency attestations. Contradiction: DeFiLlama reports $210.1M TVL, while the protocol’s own USD-vault dashboard showed approximately $42.04M for that vault; scope/version differences are unresolved. The figures are not interchangeable. Dune query ID/execution ID: unavailable.

tokenomics

two sources

Scope: Fluid Lite is an Ethereum yield-vault product, not a separately tokenized protocol. Its vault receipt tokens (e.g., fLiteUSD, contract 0x273DA948ACa9261043fbdb2a857BC255ECC29012) represent deposits and are not governance tokens. The associated ecosystem token is FLUID (formerly INST), Ethereum contract 0x6f40d4A6237C257fff2dB00FA0510DeEECd303eb.

  • Supply/valuation: 100M total/max FLUID; approximately 83.697M circulating. Market cap was approximately $180.8M and FDV $216.0M at the latest CoinGecko snapshot.
  • Utility/governance: FLUID is intended to govern protocol parameters, listings, fees, treasury allocations and value-accrual decisions. Fluid Lite itself uses governance-set vault parameters and charges fees; Ethereum ETH Lite fees include a 20% performance fee plus 0.05% exit fee, while fLiteUSD charges 0.05% withdrawal fee.
  • Revenue share/buybacks/burns/staking: No verified holder dividend or staking-reward mechanism was found. A buyback program was proposed after $10M annualized revenue, with purchased tokens retained by the treasury and future burn/distribution decided by governance; this is not evidence that buybacks or burns have occurred. DeFiLlama currently lists fee switch, buybacks, dividends and burns as off/none.
  • Emissions/unlocks: Tokenomist/DeFiLlama report approximately 83.7% unlocked and no scheduled upcoming unlocks as of October 26, 2026. Historical allocations are reported as insiders 53.8%, farming/community incentives 43.4%, and airdrop 2.9%; these are analytics classifications, not raw-chain verification. Whether announced unlocks actually occurred on-chain: Not verifiable as of October 27, 2026.
  • Team/investor/treasury allocation and concentration: Public sources conflict in classification; Tokenomist reports community 55%, current team 23.79%, investors 12.09%, future team/ecosystem 7.85%, advisors 1.27%. Top-holder concentration and insider-wallet attribution: Not verifiable as of October 27, 2026.
  • Admin controls: Mint, blacklist, transfer-tax and fee-switch permissions—and their current controlling addresses—are Not verifiable as of October 27, 2026 without raw on-chain inspection.
  • Liquidity/listings: Reported Ethereum liquidity includes roughly $5.58M on Fluid DEX, $4.66M in a Uniswap V3 FLUID/WETH pool, and smaller Uniswap V3/V4 pools. The most active reported market is FLUID/USDT on Deepcoin.

Stress scenarios

stress scenario - bitcoin price falls below $10000

two sources

A Bitcoin move below $10,000 would be a severe macro and crypto-wide stress event, but for fluid-lite the direct impact depends on whether its strategy is materially exposed to BTC or to BTC-linked market plumbing. Based on the available sources, Fluid Lite is described as a recursive leveraged stETH strategy, not a BTC-native strategy, so the most likely transmission would be via broader deleveraging, liquidity stress, and collateral volatility rather than direct Bitcoin exposure. The clearest documented risk is cascading de-leveraging in a leveraged staking stack: Hindenrank says a 5%+ stETH depeg could trigger forced unwinds across Aave, Compound, and Morpho simultaneously, with losses amplified by leverage.

In a Bitcoin crash to $10,000, the relevant stress channel would be a broader market shock that could tighten liquidity, raise borrow costs, and worsen liquidation conditions across DeFi, including strategies like Fluid Lite that rely on rehypothecation and rebalancing. What can be said with confidence is limited:

  • Direct BTC exposure: Not verifiable as of 2026-10-27.
  • On-chain TVL/exposure split for Ethereum: Not verifiable as of 2026-10-27.
  • Whether BTC < $10k would trigger protocol insolvency: Not verifiable as of 2026-10-27. The strongest practical risk assessment is that a BTC collapse of that magnitude would likely increase redemption pressure, worsen market liquidity, and raise the probability of forced deleveraging in Fluid Lite’s leveraged positions, but the exact loss severity cannot be confirmed from the available sources. There is no evidence in the provided sources that Fluid Lite has a direct BTC peg or BTC-collateral mechanism that would make $10,000 a protocol-specific trigger rather than a system-wide stress amplifier.

stress scenario - largest collateral depegs 20%,

one source

Fluid Lite’s largest-collateral 20% depeg stress case is not verifiable as of 2026-10-27 from the available web sources alone. The strongest published risk note says a 5%+ stETH depeg could trigger cascading de-leveraging across Aave, Compound, and Morpho, but it does not quantify the portfolio loss under a 20% depeg scenario. The protocol docs describe the strategy as looping collateral to amplify ETH yield, which implies higher sensitivity to collateral price shocks, but they do not provide a formal 20% stress result.

What can be said from the sources is limited to the mechanism: the ETH vault uses recursive leverage, so a severe collateral depeg would likely force rapid deleveraging and liquidation across the borrowing stack. However, the actual loss magnitude, liquidation shortfall, or whether bad debt would occur at 20% cannot be confirmed without on-chain position data or a disclosed stress model, neither of which is available in the provided sources. Therefore, the 20% stress outcome is Not verifiable as of 2026-10-27.

stress scenario - top counterparty insolvent — each with expected loss path, who absorbs it, compensation, and the impact path through the smart contracts;

two sources

Scope / data gap. The official Ethereum integration page identifies Fluid Lite USD (fLiteUSD), an ERC-4626 USDC vault at 0x273D…9012; an independent memo instead describes a leveraged stETH/ETH Lite product. Top counterparty, allocation, and venue concentration: Not verifiable as of October 27, 2026. No Dune/on-chain verification was available in this run. Stress scenario — largest external venue becomes insolvent

  • Expected loss path: Assets or claims placed with that venue become frozen, impaired, or recover only partially. For a leveraged Lite strategy, the loss can be amplified: collateral may need to be sold to repay borrowing, with liquidation slippage and/or a depeg adding a second loss layer.
  • Who absorbs it: First, Lite depositors/shareholders through a lower net asset value and reduced redemption value. Available vault reserves and accumulated fee revenue may absorb part of the shortfall; the USD vault’s reserve is described as growing when yield exceeds the fixed depositor rate, while its withdrawal fee is retained by the vault. No contractual insurance or automatic Fluid-token backstop was identified.
  • Compensation: Not verifiable as of October 27, 2026. Any governance-funded rescue, treasury contribution, or negotiated recovery would be discretionary, not an identified smart-contract entitlement. The documented fee reserve is a buffer, not proof of full compensation.
  • Smart-contract impact path: fLiteUSD share accounting remains ERC-4626-based; impaired totalAssets lowers the effective share price and makes withdrawals economically haircut. If liquidity is unavailable, withdrawals can be constrained; governance/emergency controls may pause withdrawals or rebalancing temporarily. Rebalancing/automation attempts to unwind or refinance positions, but cannot create missing assets. Bottom line: the modeled loss is primarily borne pro rata by Lite users, after any available reserve/fee buffer and recoveries. Protocol-level socialization or compensation is Not verifiable as of October 27, 2026.

stress scenario - committed fraud by the DAO or owners

two sources

No committed-fraud finding is verifiable from the available sources. The only directly relevant governance/source material shows Fluid governance and treasury control are managed by the Fluid DAO, with protocol decisions conducted by token holders and the DAO controlling treasury, revenue, IP, and contributor-developed contracts. The other results are either unrelated to fraud, describe protocol risk or incident scenarios in general, or concern separate projects/contexts, not evidence that Fluid’s DAO or owners committed fraud.

For a stress scenario assessment, the appropriate conclusion is Not verifiable as of 2026-10-27. On the current evidence set, I cannot confirm any allegation of fraud by the Fluid DAO or its owners, and I also cannot rule it out without independent investigative sources such as court filings, regulator actions, audited incident reports, or credible media documenting a specific event.

stress scenario - primary yield source negative 30d,

two sources

For Fluid Lite on Ethereum, the available web data does not verify a negative 30-day primary yield source. The protocol’s reported APY remains positive in third-party trackers, with DefiLlama showing an average APY of 6.69% across 2 tracked pools and YieldScope showing 5.38% APY with a 4.81% 30d average for the Ethereum deployment. The best-supported stress-scenario interpretation is therefore: no evidence of a negative primary yield source in the last 30 days from the sources available here, and the protocol’s yield profile still appears positive on the surface.

However, the protocol page and adjacent materials do not expose a clearly verifiable breakdown of the underlying primary yield engine or whether a specific sub-source turned negative over the last 30 days. Given the lack of chain-level verification in this run, the correct risk note is: Not verifiable as of 2026-10-27. If you want, I can next map the likely primary yield components for Fluid Lite and identify which one would be most exposed in a stress case using only web-accessible sources.

Governance & Legal

governance

two sources

Governance assessment — Fluid Lite (Ethereum) Fluid Lite states that FLUID/Fluid DAO governance controls leverage ranges, approved strategies, vault parameters, and rebalancer permissions. The process is forum discussion followed by token-holder voting; Fluid’s broader governance documentation describes on-chain GovernorBravo-style governance with proposal threshold of 1% and quorum of 4%. However, the Lite-specific timelock duration is not consistently disclosed: older material says approximately two days, while newer third-party reporting identifies a one-day Fluid timelock. Timelock delay: Not verifiable as of October 27, 2026. Contradiction: the historical Lite risk page lists team multisig 0xa8c3…1CCC5; the current V3 USD frontend identifies 0x4F6F…C2D49e as secondary owner, while newer Fluid reporting describes that Avocado guardian as 6-of-12.

A separate assessment reported the older address as 4-of-8. Current signers, threshold, and independence are therefore Not verifiable as of October 27, 2026. The team/guardian can reduce strategy ratios, pause withdrawals or rebalancing, and perform emergency actions, but the published Lite documentation says it cannot withdraw or move vault assets.

Thus no verified admin role can drain user funds without governance; upgrade authority remains a material residual risk. The DAO appears substantively controlling for parameters and strategy approval, not merely symbolic, but the frontend, development, deployment, and emergency operations remain Instadapp-team controlled. Instadapp’s Terms identify InstaDApp Labs LLC; Delaware jurisdiction is reported by secondary company data.

Registration number and directors: Not verifiable as of October 27, 2026. Voting concentration and top FLUID holders via Dune: Not verifiable as of October 27, 2026.

Timelock
Yes
Admin can drain
No
Dao governance
Yes

legal & regulatory

one source

Scope / identification. Fluid Lite is identified in its documentation as an Instadapp product: a tokenized-vault interface implementing automated, leveraged DeFi strategies on Ethereum. The relevant contracting entity appears to be InstaDApp Labs LLC, not a separately identified Fluid Lite legal entity. Instadapp’s Terms describe a non-custodial software/interface model: users connect their own wallets, while Instadapp says it is not a broker, custodian, adviser, or fiduciary. Entity / jurisdiction. InstaDApp Labs LLC is associated with Delaware, United States, through Instadapp’s privacy notice and third-party corporate information; the Terms provide for California arbitration/court venue.

The Delaware registration itself was not independently confirmed from a retrieved filing. Legal structure therefore remains partly unverified. ToS, restrictions, and KYC/AML. Terms prohibit unlawful use and use by persons or jurisdictions subject to U.S. or other economic sanctions. They disclaim custody and responsibility for transactions, impose broad risk disclosures and liability limitations, and state that the software provider is not regulated by federal or state agencies.

No dedicated KYC/AML policy, customer-identification process, or money-transmitter/licensing analysis for Fluid Lite was located: Not verifiable as of October 27, 2026. Classification / actual risk. The contractual position is “software provider,” but this does not determine regulatory treatment. Fluid Lite automates leveraged staking, borrowing, looping, and cross-protocol transactions; depending on jurisdiction and implementation, regulators could analyze the interface, vaults, governance, fees, or tokenized interests under securities, collective-investment, derivatives, lending, money-transmission, consumer-protection, or AML regimes. This is a risk inference, not an established classification. Warnings, enforcement, litigation, sanctions. No protocol-specific regulator warning, enforcement action, court case, or sanctions designation was identified in the searches performed.

This absence is not confirmation of clean status: Not verifiable as of October 27, 2026. Compliance blocking of sanctioned wallets, if used, would not itself mean the protocol is sanctioned. Data protection. Instadapp’s privacy notice describes collection of personal/device data, U.S. hosting or transfers, possible international transfers using contractual safeguards, and disclosure for legal compliance. The notice appears materially old, so this is stale data and should not be treated as a current GDPR/CCPA assessment. Bottom line: the LLC/interface wrapper reduces direct custody exposure but does not eliminate smart-contract, governance, counterparty, consumer-protection, or regulatory recharacterization risk.

Fluid Lite’s DAO and multisig controls create operational control points that may matter for attribution and responsibility.

Entity
InstaDApp Labs LLC (apparent contracting/operator entity for Instadapp products; no separately identified Fluid Lite entity)
Jurisdiction
United States; Delaware association reported, with California arbitration/court venue in the Terms

legal registries

two sources

No exact GLEIF LEI record for 'InstaDApp Labs LLC', 'Fluid Lite'. OFAC SDN screening of 'InstaDApp Labs LLC', 'Fluid Lite': no match. SEC litigation and administrative release feeds: no mention.

Screened names
  • InstaDApp Labs LLC
  • Fluid Lite
Sanctioned
No

Stability

stability

one source

Fluid Lite on Ethereum does not appear to issue its own stablecoin; the stablecoin exposure is to USDC and other yield-bearing stablecoins used in the strategy, with fLiteUSD as the vault share token rather than a protocol stablecoin. No credible evidence found of any depeg event for the stablecoin used by Fluid Lite in the available sources, so depeg_count, last_depeg_date, and max_depeg_pct are not verifiable as of 2026-10-27. The protocol is therefore treated as stable with respect to the stablecoin used, but this is based on absence of verified depeg evidence rather than on-chain verification.

Own stablecoin
No
Stable
Yes
Stablecoin ids
  • USDC

Risks & Strengths

risks

one source

Fluid Lite combines leveraged staking, automated rebalancing, and allocations across multiple DeFi protocols, creating layered smart-contract, market, oracle, and operational dependencies. The principal risk is loss amplification during stETH or lending-market stress; independent on-chain exposure and contract-state verification were unavailable in this run: Not verifiable as of October 27, 2026.

RiskImpactSeverityProbabilityMitigation in placeResidual risk
Leveraged stETH depeg and liquidationRecursive borrowing amplifies losses. A stETH discount, lending-market impairment, or rapid ETH decline can force deleveraging, liquidation, and slippage losses.HighMediumVault leverage ranges, automated deleveraging/refinancing, and use of established lending venues are documented controls.High residual tail risk remains under fast, correlated market stress.
Smart-contract and oracle failureBugs or manipulated pricing can misvalue collateral, execute incorrect rebalances, lock withdrawals, or cause direct loss across vault and dependency contracts.HighMediumAudits are listed for several Fluid components; reentrancy controls and oracle-based risk management are referenced. Current Lite-specific coverage was not fully verified.Medium-High; audits reduce but do not eliminate undiscovered-vulnerability risk.
Multi-protocol dependency contagionFunds may be allocated among Lido and lending protocols such as Aave, Compound, Euler, or Morpho; failure of one dependency can impair proportional vault assets.HighMediumGovernance controls approved strategies and may remove protocols; users are warned that losses are passed through proportionally.High because diversification adds dependency and correlated-failure risk.
Automation, MEV, and execution riskBots execute refinancing and deleveraging on-chain; gas spikes, oracle latency, failed transactions, MEV, or market slippage can worsen losses during volatility.MediumMediumAutomation, rebalancing, and emergency pausing/reduced-ratio controls are documented; execution quality during extreme congestion is not independently verified.Medium; automation lowers monitoring burden but creates operational dependency.
Governance and privileged-operator riskDAO decisions can change leverage ranges and approved venues; rebalancers and team multisig retain bounded operational powers, while underlying-protocol governance can impose unexpected changes.MediumMediumDocumented parameter bounds, role separation, withdrawal/rebalancing pauses, and stated inability of the team multisig to withdraw funds.Medium; governance, key-management, and change-control risk remains.

strengths

two sources

Fluid Lite’s top strengths are: 1) Automated yield execution — it runs leveraged staking, looping, auto-compounding, and rebalancing in the background, so users do not need to manage complex DeFi positions manually. 2) Strong capital efficiency — the product is built on Fluid’s connected liquidity layer and is designed to share liquidity across strategies and markets, reducing idle capital and improving yield efficiency. 3) Cross-protocol diversification — it routes capital across established DeFi venues such as Aave, Fluid, Compound, and Morpho, which can broaden yield sources and reduce dependence on a single venue.

4) Simple user experience — Fluid Lite packages advanced DeFi into a single vault interface and ERC-4626-compatible structure, making it easier to use and integrate. 5) Multi-chain flexibility — the USD vault documentation says strategies are deployed across Ethereum, Arbitrum, and Plasma, allowing yield sourcing beyond a single chain while keeping the interface unified. These are the clearest strengths surfaced by the available sources; claims about on-chain size or usage are not verifiable here.

Methodology & Limitations

  • On-chain metrics: not verifiable — Dune phase 2 is not enabled.
  • 0 of 25 fact categories not yet collected.
  • Fact verifiability: 21 two independent sources, 12 one source.
  • Oldest fact verification date: 2026-10-27.