Spark Finance

As of 2026-10-03: Identification — Name: SparkLend (Spark Protocol lending market). Website: https://spark.finance/; docs: https://docs.spark.finance/. Category: DeFi lending/borrowing money market.

Launch: May 2023. Active chain: Ethereum mainnet; the former Gnosis deployment was deprecated in September 2026. Token — No SparkLend-specific native token is required for lending operations. SPK is the broader Spark ecosystem token, not a Pool-level lending asset.

This distinction is important because the protocol’s reserve tokens are branded instruments such as spDAI/spWETH. Main Ethereum addresses — Pool proxy: 0xC13e21B648A5Ee794902342038FF3aDAB66BE987; PoolAddressesProvider: 0x02C3eA4e34C0cBd694D2adFa2c690EECbC1793eE; PoolAddressesProviderRegistry: 0x03cFa0C4622FF84E50E75062683F44c9587e6Cc1; ACLManager: 0xdA135Cd78A086025BcdC87B038a1C462032b510C; price oracle: 0x8105f69D9C41644c6A0803fDA7D03Aa70996cFD9; treasury proxy: 0xb137E7d16564c81ae2b0C8ee6B55De81dd46ECe5. Addresses are cross-checked against Spark’s registry/docs and Etherscan/ChainSecurity records. Explorer source verification is confirmed for the Pool, Provider, Registry and Oracle pages. Dune verification — Dune MCP was unavailable in this run; therefore the required Dune second-source/on-chain verification, current implementation slots, balances and latest block snapshot are: Not verifiable as of 2026-10-03. Fork lineage — Yes.

SparkLend is a fork of Aave V3. Changes include Maker/Sky governance and role configuration, Spark-specific treasury architecture, zero flash-loan fees, DAI-specific interest-rate strategy/D3M integration, sDAI oracle support, reserve/risk-parameter changes, and separate rewards deployment. Audit status — Upstream Aave V3 received multiple audits and Certora verification. ChainSecurity performed SparkLend deployment/bytecode/configuration validation, but explicitly states that this was not a full security assessment.

Spark-specific malicious-modification history in comparable forks: Not verifiable as of 2026-10-03.

SparkLend appears to be a real, live product rather than a simple landing page. The official documentation portal describes SparkLend as Spark’s permissionless money market on Ethereum, with dedicated guides for supplying, borrowing, repaying, withdrawing, and managing positions, and the docs portal itself frames Spark as having user tutorials plus developer documentation. The site also has product-specific pages such as the SparkLend guide and a borrow page, which is consistent with an operational app surface rather than a marketing-only brochure.

The UX maturity looks relatively high: the docs explicitly reference dashboard flows like “My portfolio,” “Deposit,” “Withdraw,” and “Borrow,” while the guides walk users through position management and support live market parameters and rate limits. Independent coverage and third-party listings also describe the app as supporting lending and borrowing flows, which aligns with a functioning interface. For API presence, there is evidence of a developer portal and an API namespace.

Immunefi’s program page lists Spark developer documentation and names api-v2.spark.fi among the in-scope websites, while the Spark developer docs repository describes a developer portal for Spark protocol documentation. That supports the conclusion that Spark has developer-facing documentation and likely an API surface, though the exact public/open API scope is not fully verifiable from the retrieved sources alone. No clear broken-link pattern, fake-metric signaling, or obvious template-site behavior was evident in the retrieved sources.

The main caveat is that some external pages are generic or promotional, so the strongest evidence comes from the official docs and developer materials.

SparkLend has an active bug bounty program managed by Immunefi. It has been live since 01 November 2023, with rewards denominated in USD and paid in DAI on Ethereum mainnet. The maximum bounty is $5,000,000.

Core parameters include: 10% of funds directly affected for critical smart-contract bugs, a $50,000 minimum reward for critical smart-contract disclosures, a $10,000 flat reward for temporary freezing impacts under 150 blocks, and PoC required for Critical and High smart-contract reports. Public sources reviewed did not enumerate disclosed payouts or results; specific results are not verifiable as of 2026-10-03.

Assessment date: October 5, 2026. Scope: Ethereum only. Dune MCP was unavailable; therefore balances, reserve composition, issuer concentration, and exposure percentages are Not verifiable as of October 5, 2026. Dependencies & counterparty risks

• Sky/Maker / DAI-USDS: SparkLend remains structurally dependent on Sky governance, DAI/USDS monetary policy, the DAI Savings Rate and related rate-source infrastructure. Governance compromise, faulty rate updates, a DAI/USDS depeg, or collateral shortfall could create bad debt or impair withdrawals. The codebase documents DAI-specific rate strategies and external rate sources.
• Stablecoin issuers: USDC/USDT and Sky-issued stablecoins introduce issuer, redemption, blacklist/freeze, banking and depeg risk. A concentrated stablecoin liquidity run could impair withdrawals or liquidations. Exact reserve and borrow concentrations are Not verifiable as of October 5, 2026.
• Oracle/manipulation risk: Current documentation describes a three-oracle design using RedStone, Chainlink and Chronicle, with fallback behavior when feeds fail. This reduces single-feed risk but does not eliminate correlated oracle outages, stale data, governance misconfiguration, or manipulation of thinly traded collateral. Pegged/exchange-rate assets additionally depend on their underlying token exchange rates. These controls are protocol-documented claims, not independently verified on-chain here.
• LST/LRT exposure: wstETH, rETH, weETH and other exchange-rate assets create dependency on Lido, Rocket Pool, Ether.fi and/or other underlying issuers, including smart-contract, validator, slashing, redemption and liquidity risk. Per-asset exposure is Not verifiable as of October 5, 2026.
• Bridges/custodians/CEX-MM/RWA SPVs: No direct Ethereum bridge, custodian, CEX/MM or RWA issuer/SPV exposure was independently verified for SparkLend in this review. Not verifiable as of October 5, 2026. Failure scenarios: stablecoin depeg or issuer insolvency; Sky governance/rate-source failure; oracle outage or correlated manipulation; LST/LRT exchange-rate failure; liquidation-liquidity shock; or smart-contract/upgrade failure. No currently active dependency failure was independently verified. Contradiction callout: Protocol materials describe conservative caps, oracle redundancy and minimal rehypothecation, but the associated live exposure percentages cannot be reconciled without on-chain data. The on-chain result is therefore unavailable, not assumed. Structured fields: dependency_failure_active: null; max_exposure_pct: null.

SparkLend’s custody is mixed. For the core permissionless lending market, custody is non-custodial: users connect their own wallets, and Spark describes SparkLend as a pool-based money market where supplied assets stay in the reserve pool and are not redeployed into external strategies. For the institutional BTC borrowing flow, custody is organized off-chain through Anchorage Digital, which holds BTC in qualified custody and acts as collateral agent while Spark supplies the loan liquidity and onchain execution.

Withdrawal pause status is not verifiable as of 2026-10-05. Asset segregation is not verifiable as of 2026-10-05; the available evidence indicates reserve-pool custody for SparkLend and qualified-custody handling for institutional BTC collateral, but no independently verified statement confirms a formal segregated-assets regime across the protocol.

Scope correction. The previously recorded evidence from spark.money/glossary/key-management concerns Spark’s Bitcoin/Lightning product, not Ethereum SparkLend. It is therefore not applicable to SparkLend’s key-management arrangement. SparkLend organization (Ethereum):

• Users: SparkLend is a permissionless lending market; users interact through their own Ethereum wallets rather than depositing keys with SparkLend. However, the specific wallet, signer, backup, or recovery practices used by users are not defined in the protocol documentation. Not verifiable as of October 3, 2026.
• Routine administration: Risk parameters and market configuration are controlled through the Sky governance system. The documented architecture includes a governance executor/proxy path and role-based permissions around SparkLend administration. Exact current key holders, signing devices, custody providers, and rotation procedures are not publicly established in the sources reviewed. Not verifiable as of October 3, 2026.
• Emergency controls: SparkLend has a separate Security Access/Freezer multisig intended for urgent pause or freeze actions, rather than ordinary parameter management. The published design limits its use to emergencies and provides a governance process for changing signers. > Contradiction / transparency gap: An older Sky Atlas entry documents the Freezer multisig as 2-of-5 and names five signers, while a more recent independent risk assessment states that the current threshold and signer identities are not publicly documented. Because the Atlas data is stale and no current on-chain verification was performed in this run, the current threshold and signer set are Not verifiable as of October 3, 2026. Risk assessment: Key control is organizationally segmented between governance-controlled administration and a narrowly scoped emergency multisig. The principal unresolved risk is not evidence of a single-key design, but insufficient current disclosure of signer identity, threshold, key storage, backup, rotation, and replacement procedures. Not verifiable as of October 3, 2026.

Scope: Ethereum mainnet; reviewed October 5, 2026. Dune MCP is unavailable, so current role membership, proxy-admin decoded events, latest block, and on-chain timelock delay are Not verifiable as of October 5, 2026. Canonical addresses: Pool 0xC13e21B648A5Ee794902342038FF3aDAB66BE987; PoolAddressesProvider 0x02C3eA4e34C0cBd694D2adFa2c690EECbC1793eE; PoolConfigurator 0x542DBa469bdE58FAeE189ffB60C6b49CE60E0738; ACLManager 0xdA135Cd78A086025BcdC87B038a1C462032b510C; AaveOracle 0x8105f69D9C41644c6A0803fDA7D03Aa70996cFD9; FreezerMom 0x237e3985dD7E373F2ec878EC1Ac48A228Cf2e7a3; documented ProxyAdmin 0x883A82BDd3d07ae6ACfD151020faD350df25087e. Architecture: PoolAddressesProvider (Ownable) → InitializableImmutableAdminUpgradeabilityProxy → Pool / PoolConfigurator / token implementations. The provider is the proxy factory/admin and onlyOwner can replace Pool and PoolConfigurator implementations. ``text Governance/owner ? │ PoolAddressesProvider ── upgrades ──> Pool proxy ──> reserves, aTokens, debt tokens │ └──> PoolConfigurator proxy ├──> ACLManager: POOL/RISK/EMERGENCY/ASSET-LISTING roles ├──> AaveOracle └──> FreezerMom ──> freeze/pause controls `` Privileged actions: Pool admins can list/drop reserves, update token implementations, activate/deactivate markets, and change protocol fees; risk/pool admins can alter collateral, borrowing, caps and reserve factors.

Emergency or pool admins can pause reserves; FreezerMom can freeze/pause markets. These controls do not directly withdraw user deposits, but a compromised upgrade authority could deploy malicious logic capable of draining or blocking funds. User exit: ordinary withdrawals are permissionless subject to liquidity and reserve state; an emergency pause/freeze can prevent or restrict exits. Exact live behavior and role holders: Not verifiable as of October 5, 2026. > Contradiction/data gap: prior records identify an emergency multisig, but its complete address, current membership, proxy-admin type, renounced roles, and timelock delay are Not verifiable as of October 5, 2026. Audit: ChainSecurity’s March 15, 2024 Core Updates audit reported 0 critical, high, medium, or low findings for the reviewed changes; this is not a guarantee for all deployed code. Fields: admin_can_drain: null; audited_deployment: true; upgradeable: true; unresolved_critical: 0; unresolved_high: 0

ChainSecurity — SparkLend deployment verification; publication date April 26, 2023; scope: Ethereum SparkLend deployment, bytecode/configuration validation; findings: Critical 0, High 0, Medium 0 disclosed; fix status: deployment validation passed; covers deployed code: Yes for the reviewed deployment, but current deployed-code match is Not verifiable as of 2026-09-04.

ChainSecurity — SparkLendConduit; publication date Not verifiable as of 2026-09-04; scope: SparkLendConduit contracts and ERC20 helper integration; findings: Critical 0, High 0, Medium 0 disclosed; low-risk frontrunning exposure in withdraw() was documented; fix status: acknowledged/mitigated operationally; covers deployed code: No current bytecode match verified.

ChainSecurity — SparkLend Freezer; publication date March 13, 2024; scope: freezer module, emergency spells, and interfaces; findings: Critical 0, High 0, Medium 0, Low 1; fix status: low issue acknowledged with no code change; covers deployed code: No current bytecode match verified.

ChainSecurity — Core Updates to SparkLend; publication date March 15, 2024; scope: January patch, disabled flashloan borrowing, and public getReservesCount(); findings: Critical 0, High 0, Medium 0; fix status: no issues found; covers deployed code: No current bytecode match verified.

ChainSecurity — SparkLend Kill Switch; publication date March 18, 2024; scope: IKillSwitchOracle.sol and KillSwitchOracle.sol; findings: Critical 0, High 0, Medium 1, Low 2; fix status: medium issue code-corrected, one low issue code-corrected, one low issue resolved by specification change; covers deployed code: No current bytecode match verified.

ChainSecurity — SparkLend Advanced; publication date June 4, 2024; scope: custom oracles, interest-rate strategies, fallback rate source, and related SparkLend Advanced contracts; findings: Critical 0, High 1, Medium 0, Low 0; fix status: high-severity weETH oracle manipulation risk accepted; covers deployed code: No current bytecode match verified.

The audit reported one high-severity issue: the weETH oracle could be manipulated upwards by burning eETH, which could potentially drain the protocol. Spark acknowledged the issue but deemed it not a practical risk under current weETH collateral parameters on SparkLend Mainnet and because borrowing is disabled. The report also states a stable-debt calculation issue was corrected, with totalDebt removed and totalVariableDebt used directly.

Cap Automator was audited separately. The report says the most critical subjects were functional correctness, manipulation resiliency, and integration into SparkLend. It identified an issue where setting caps to zero was not restricted, which could bypass cooldown and risk lifting the cap; after the intermediate report, all identified issues were addressed or acknowledged.

SparkLend Advanced Smart Contracts; Core Updates to SparkLend; SparkLend Freezer Smart Contracts; Cap Automator (listed in ChainSecurity audit index).

Newly identified published security review: Certora, SparkLend Rounding Mitigation, final report dated August 2026. The review concerns the SparkLend core rounding-mitigation release, comparing sparkdotfi/sparklend-v1-core release candidate commit 900c189f against deployed baseline v1.0.0 commit 8120e495. Current Ethereum deployed-code bytecode match is not independently verified.

New Cantina security review for SparkLend Advanced, covering the sparkdotfi/sparklend-advanced repository. The review period was February 4–7, 2026; a separate publication date is not shown. Current deployed-code bytecode match is not independently verified.

According to the SparkLend documentation and public audit repositories, the primary and explicitly cited audit for SparkLend is a review of the Spark Protocol (which includes SparkLend) performed by Nethermind in 2023. The audit appears to focus on the Spark Protocol’s core contracts, interest rate strategies, and integrations with MakerDAO infrastructure (e.g., D3M), but the exact scope and contract list are not fully enumerated in a single, easily verifiable public report. Given the lack of a clear, downloadable, versioned PDF with identified commit hashes and a bytecode-match statement mapping directly to the currently deployed Ethereum SparkLend contracts, it is not possible to confirm that this audit fully covers the exact deployed bytecode as of today.

Not verifiable as of 2026-09-03.

Spark documentation says SparkLend is based on Aave v3 and that Spark-specific core audits cover changes made on top of the base codebase, plus deployment changes.

Assessment (as of 2026-10-03): SparkLend is credibly a live DeFi lending protocol within the MakerDAO/Sky ecosystem, not merely a web front. However, its founder and corporate-team disclosures are less standardized than those of a conventional venture-backed company. The protocol is associated with Rune Christensen, founder of MakerDAO, and public third-party profiles identify Lucas Manuel as a senior technology leader; Sam MacPherson is publicly associated with Phoenix Labs and Spark-related development.

These identities and roles are supported by secondary material, but a complete, authoritative current team roster was not established.

• Founder / prior outcomes: Rune’s relevant prior project is MakerDAO/Sky, a major DeFi ecosystem. Phoenix Labs is also associated with Spark’s development. The available evidence does not establish a separate standalone Spark startup founder narrative or independently verify the full employment/ownership structure.
• Public vs. anonymous: Key ecosystem figures are publicly named, but Spark’s team disclosure is incomplete. Some contributors use public pseudonyms, so the protocol is not fully transparent on an individual-contributor basis.
• Security and prior hacks: Not verifiable as of 2026-10-03. The available search evidence did not establish a reliable, comprehensive incident history specific to SparkLend; do not treat absence of a located report as proof that no incident occurred.
• Office / jurisdiction: Not verifiable as of 2026-10-03. Search results contain multiple unrelated entities named “Spark Finance,” including New Zealand and UK companies. Those records cannot be attributed to SparkLend without matching contract, legal-entity, or official organizational evidence; they are therefore excluded.
• Real business vs. web front: The protocol’s integration with MakerDAO/Sky, identified technical contributors, and publicly documented lending product support a real operating protocol. This is a credibility assessment, not proof of a conventional incorporated operating company, staffed office, or onshore legal domicile.
• On-chain verification: Not verifiable as of 2026-10-03. Dune was unavailable for this run, so no founder wallets, treasury, deployment activity, or activity-based reality check could be independently confirmed. Bottom line: SparkLend passes the basic “real protocol” test through ecosystem lineage and identifiable contributors, but has meaningful disclosure gaps around legal entity, physical office, complete team, and incident history. The unrelated “Spark Finance” corporate records should not be used as evidence of SparkLend’s domicile or office.

SparkLend’s reputation remains generally positive for legitimacy and engineering, but its principal unresolved concern is concentration of control and dependency on Sky/Maker governance. Independent assessments describe a functioning protocol with no documented direct fund-loss exploit over its operating history, while identifying systemic exposure to Sky governance, shared Aave-derived code, oracle/depeg risk, and token-distribution concentration.

• Protocol and governance: SparkLend is operated within the Sky ecosystem rather than as an fully independent lending DAO. Sky governance influences risk parameters, debt ceilings, rates, and related liquidity allocation; a governance capture could therefore alter collateral, LTV, or rate settings. This is the clearest reputational criticism.
• Founders/investors: Public descriptions consistently associate Spark with MakerDAO/Sky and its governance structure. A distinct conventional venture-capital investor profile was Not verifiable as of October 3, 2026.
• Auditors and security: ChainSecurity assessments reportedly found a good security level for SparkLend Advanced and no critical/high findings in certain cap-automation and governance-relay reviews. Spark advertises an Immunefi bounty of up to $5 million, but that figure is a protocol claim rather than independent evidence of security. An audit summary also reports a critical weETH-oracle issue and a medium rsETH pricing issue requiring risk assessment; this remains relevant because oracle and liquid-staking-token depeg risk are material lending concerns.
• Incidents and criticisms: Spark was not the victim of the April KelpDAO bridge exploit; its rate limits and reduced rsETH exposure reportedly contained potential contagion. That is a positive control example, not proof that the protocol is risk-free. Criticism remains focused on upgrade authority, centralized operational permissions, cross-chain governance, and possible correlated risk from shared Aave-derived architecture.
• Fraud, rug, insolvency: No credible evidence of fraud, rug-pull behavior, or protocol insolvency was identified in the reviewed sources. Not verifiable as of October 3, 2026 for an exhaustive absence-of-allegations determination.
• Legal, regulatory, sanctions: No specific enforcement action or sanctions designation was identified in the reviewed material. Regulatory exposure around Sky/USDS and whether yield-bearing stablecoin products resemble securities or deposits is raised as an unresolved issue, not an established violation. > Unresolved risk: Token and control concentration are significant reputational weaknesses. Independent commentary reports that 65% of SPK supply is held through a Sky proxy and that upgrade or execution authority may be concentrated in privileged contracts; these figures require on-chain verification, which was unavailable, so they should not be treated as independently confirmed. Overall, SparkLend appears to be a legitimate, professionally audited DeFi lending protocol, but institutional risk is dominated less by evidence of fraud than by governance centralization, Sky/USDS dependency, privileged upgrade paths, oracle/depeg exposure, and regulatory uncertainty.

As of October 5, 2026. SparkLend is a permissionless, overcollateralized money market: suppliers deposit supported assets and receive variable supply yield; borrowers post collateral and pay interest. The primary yield source is borrower-paid interest and reserve spread, not trading PnL. Assets/exposure: collateral is deliberately narrow, including stablecoins and ETH-correlated assets such as wstETH/rETH. Spark states supplied collateral remains in reserves rather than being redeployed into external strategies.

E-Mode permits correlated-asset looping; flash loans are transaction-level leverage, not persistent exposure. Restaking, directional trading, and external strategy exposure were Not verifiable as of October 5, 2026 beyond the stated reserve-retention policy. Organic vs subsidized / neutrality: lending income is economically organic, but the percentage attributable to incentives, liquidity-layer support, or other subsidies is Not verifiable as of October 5, 2026. DeFiLlama reports zero incentives in its displayed income statement, but this is aggregator data rather than raw on-chain verification.

The strategy is market-neutral at the protocol level, while borrowers may create directional or leveraged positions. Mechanics and controls: withdrawals and repayments are supported subject to available liquidity, reserve/cap parameters, and transaction fees. Interest is variable and supply-demand driven, while some stablecoin rates can be governance-defined. Liquidation begins below health factor 1; close factor is up to 50% above 0.95 and up to 100% at or below 0.95.

Supply/borrow caps, isolation mode, E-Mode, rate limits, and liquidation penalties are key gates. TVL/revenue/APY (DeFiLlama snapshot, not Dune): approximately $5.71B TVL, $2.91B active loans, and +33.2% 30-day TVL growth; Ethereum is reported as 100% of TVL. Average supply APY is 1.55% across 15 pools; one sampled Ethereum pool, spUSDT, shows 3.40% supply APY and 3.97% borrow APY. 30-day fees are $6.27M and protocol revenue $535,489.

APY history, volatility, sustainability, and TVL by product are Not verifiable as of October 5, 2026. Contradiction: Spark documentation says Gnosis was fully deprecated in September 2026 and Ethereum is the current supported network, while DeFiLlama still lists two chains but assigns 100% of TVL to Ethereum. The documentation is the newer protocol-status evidence; the discrepancy is a data-classification issue. On-chain verification is Not verifiable as of October 5, 2026.

Assessment — as of October 5, 2026 (Ethereum) Size / composition. Current protocol-reported treasury is $43.72M, updated daily on Spark’s financial dashboard; this is an off-chain/protocol figure and is an unverified marketing claim, not a Dune-confirmed reserve balance. The Q2 2026 financial report recorded $48.5M at June 30, 2026, excluding SPK according to Spark’s subsequent explanation, and reported $1.31M of Q2 SPK buybacks. The same report disclosed $6.36M of accrued, unredeemed depositor-yield liability for Spark Savings Vaults. Contradiction callout. Previously recorded DefiLlama treasury data of approximately $60.18M conflicts with the Q2 reported $48.5M and the current dashboard’s $43.72M.

The discrepancy is unresolved; no independent raw-chain valuation was available in this run. DefiLlama’s current page reports SparkLend TVL and revenue, not a directly auditable treasury balance. Addresses / custody / control. The reported Spark treasury address is 0x3300f198988e4C9C63F75dF86De36421f06af8c4. A separate legacy/contract-labelled Spark: Treasury address is 0xb137E7d16564c81ae2b0C8ee6B55De81dd46ECe5; do not assume both are included in the reported total.

Governance execution is mediated through Sky/Spark proxy infrastructure; July 2026 governance explicitly transferred USDS from the Surplus Buffer to the Spark subproxy. On-chain / Dune. Dune MCP was unavailable. Ethereum token balances, composition, custody concentration, latest-block USD valuation, and query 6656460 execution cannot be independently checked: Not verifiable as of October 5, 2026. Reserve policy / attestations. Spark describes treasury capital as operational capital and junior risk capital supporting SKY credit access; the Q2 report says assets were held on-chain and balances were “verified on-chain,” but this is self-reported. No independent reserve attestation was located: Not verifiable as of October 5, 2026.

The ChainSecurity document is a deployment-verification report, not a reserve attestation.

Updated finding — the prior “no native token” conclusion is obsolete. As of October 3, 2026, Spark has native token Spark (SPK) on Ethereum at 0xc20059e0317de91738d13af027dfc4a50781b066. SparkLend is one Spark product; SPK governs the broader Spark ecosystem, including SparkLend parameters.

• Supply/valuation: Genesis total supply is 10.0bn SPK; current circulating supply is reported as ~3.4bn, with market cap ~$85.1m and FDV ~$248.6m (CoinGecko snapshot; values are time-sensitive).
• Utility/governance: SPK is used for governance voting/delegation and staking. Staking currently earns Spark Points and supports security for bridges/future products; staked SPK retains voting power. There is a minimum two-week unstaking delay.
• Revenue/value accrual: DeFiLlama classifies the fee switch as on and value accrual as buybacks, with no dividends or burns. This is an analytics-platform interpretation, not independently verified here; Spark’s official docs do not establish a guaranteed revenue share or fixed staking yield.
• Emissions/unlocks: Sky farming distributes 6.5bn SPK over 10 years: 1.625bn in each of years 1–2, 812.5m in years 3–4, 406.25m in years 5–6, and 203.125m annually in years 7–10. Allocation: 65% users/Sky farming, 23% ecosystem, 12% team. Team tokens have a 12-month cliff, then three-year vesting; ecosystem tokens include 17% available at TGE and 6% one year later.
• Allocations: No separate investor allocation is disclosed in the official schedule; treasury/airdrop wallets sit within the 23% ecosystem bucket.
• Admin risks: The verified ERC-20 ABI exposes privileged mint, burn, rely, deny, and file functions. No blacklist function is visible in that ABI. Sky states it can mint additional SPK under extreme circumstances. Actual current ward/admin control and whether announced unlocks occurred on-chain: Not verifiable as of October 3, 2026 (Dune unavailable).
• Concentration/markets: Top-holder concentration and insider-wallet attribution: Not verifiable as of October 3, 2026. Reported Ethereum DEX liquidity is approximately $365k USDC–SPK and $271k ETH–SPK on Uniswap V4; major CEX listings include Binance, OKX, Coinbase, Bybit, KuCoin and Gate.

A Bitcoin price collapse below $10,000 would create material liquidation and bad-debt risk for SparkLend positions using WBTC or other BTC-linked collateral. However, the protocol’s current aggregate BTC exposure, reserve-level debt, and resulting loss estimate are Not verifiable as of October 10, 2026 because on-chain verification is unavailable in this run. Relevant controls and transmission channels

• Spark’s documentation states that BTC E-mode was removed in June 2026 and that remaining positions were force-liquidated on June 8, 2026. This reduces concentrated BTC-correlated borrowing, but does not establish that all BTC exposure was eliminated.
• WBTC was reportedly re-enabled as collateral on March 31, 2026, with a stated maximum LTV of 77%; this is a protocol-associated claim and should be treated as an unverified marketing claim absent raw-chain verification.
• Spark describes supply and borrow caps as controls intended to limit single-asset exposure and insolvency risk. Their live utilization, remaining capacity, and governance history are Not verifiable as of October 10, 2026.
• Spark’s liquidation mechanism makes accounts with a health factor below 1 liquidatable; between health factors 1 and 0.95, up to 50% of debt may be covered, and at or below 0.95, up to 100% may be covered.
• A rapid BTC crash could therefore trigger simultaneous WBTC liquidations, liquidation-bonus losses, oracle/market-liquidity stress, and possible bad debt if collateral cannot be sold near oracle value. The magnitude is Not verifiable as of October 10, 2026. > Contradiction / data-quality finding: Public sources report materially different Spark/SparkLend TVL figures, including approximately $3.4 billion and approximately $4.96 billion. These figures come from different snapshots and/or methodologies; the authoritative current number is Not verifiable as of October 10, 2026. Stress conclusion: The principal risk is not Spark’s direct Bitcoin holdings but collateral-driven contagion: falling WBTC prices reduce borrower health factors, force liquidations, and may impair lender recoveries if liquidation liquidity or oracle integrity fails. Quantitative BTC exposure, chain share, and loss severity are Not verifiable as of October 10, 2026.

Assessment — 20% depeg of the largest collateral (Ethereum): the loss amount and collateral concentration are Not verifiable as of 2026-10-03. Dune/on-chain verification is unavailable in this run, and the available analytics result does not provide a current, asset-level collateral breakdown suitable for quantifying bad debt. DeFiLlama reports SparkLend TVL of approximately $3.416 billion on Ethereum, but this is an analytics-platform figure, not raw on-chain exposure, and its displayed update is older than the seven-day freshness requirement.

The stress would reduce the affected collateral’s market value by 20%. Positions using that asset would experience a corresponding deterioration in collateral coverage, subject to the asset’s liquidation threshold, existing borrower leverage, and whether other collateral is included in the account. A position becomes liquidatable when its Health Factor falls below 1.

SparkLend’s liquidation mechanics create a nonlinear liquidation risk: when Health Factor is below 1 but above 0.95, a liquidation can cover up to 50% of outstanding debt; at or below 0.95, up to 100% can be covered. Liquidators seize collateral based on oracle prices and the applicable liquidation bonus, so a rapid depeg can produce liquidation demand and potential bad debt if collateral cannot be sold near oracle-implied value. Spark’s documentation states that pricing uses a three-oracle median of RedStone, Chainlink, and Chronicle.

For assets with exchange-rate or hardcoded pricing, a peg-ratio oracle can trigger a killswitch that halts new borrowing when deviations exceed asset-specific thresholds. This may limit new distressed borrowing, but it does not eliminate losses from existing undercollateralized positions or market-liquidity shortfalls. Conclusion: the scenario is materially adverse for borrowers concentrated in the depegged asset, but protocol-wide loss severity, affected debt, liquidation volume, and chain exposure percentage are Not verifiable as of 2026-10-03 without current raw on-chain data. The prior finding remains unchanged.

As-of October 10, 2026 — Ethereum only. Counterparty identification. The largest SparkLend borrower/counterparty cannot be reliably identified from the available sources: Not verifiable as of October 10, 2026. Dune/on-chain verification is unavailable, and Spark’s public dashboard reports aggregate borrowers, not a ranked borrower-level exposure. Current aggregate figures are therefore not evidence of top-counterparty concentration. Stress scenario: largest borrower becomes insolvent

• Expected loss path: borrower collateral falls below debt value or becomes illiquid; the position’s health factor falls below 1 and liquidators repay debt in exchange for discounted collateral. Expected loss is the residual debt after collateral liquidation, liquidation bonus, execution slippage, oracle lag, and any unliquidated/uncollateralized debt.
• Who absorbs it: liquidators absorb execution/market risk initially and are compensated with the liquidation bonus. Suppliers bear the economic shortfall if liquidated collateral plus repayments do not cover debt. SparkLend’s public materials describe “first-loss capital” and risk controls, but a current, quantified external insurance or guaranteed supplier-compensation pool is Not verifiable as of October 10, 2026.
• Smart-contract impact path: Pool.liquidationCall() checks health factor, burns the borrower’s debt tokens for the amount repaid, transfers/burns collateral aTokens, sends any liquidation protocol fee to the reserve treasury, and transfers the repaid debt asset into the reserve’s aToken contract.
• Residual bad debt: the precise deployed SparkLend bad-debt implementation is Not verifiable as of October 10, 2026 without deployment-level inspection. In Aave V3.3-derived logic, if liquidation leaves zero collateral and debt outstanding, remaining debt tokens are burned and a reserve deficit is recorded; otherwise residual debt can continue accruing and reduce effective supplier backing. Impact: suppliers face reduced withdrawal backing/aToken value, higher utilization and rates, potential withdrawal constraints, and governance intervention (freezing markets, lowering caps, or funding a deficit). Spark has a documented freezer capable of pausing or freezing all or individual markets.

Assessment — committed fraud by the DAO or owners: No credible evidence was identified that SparkLend’s DAO, owners, or core operators committed fraud, misappropriated user funds, or operated a rug-pull scheme. This remains Not verifiable as of 2026-10-03, because direct on-chain verification was unavailable for this run and absence of reported evidence is not proof that fraud did not occur. SparkLend is described as part of the MakerDAO/Sky ecosystem and as an Aave v3 fork.

Its published bug-bounty scope treats direct theft of user funds, permanent freezing of funds, and insolvency as critical-impact risks; that is evidence of covered threat scenarios, not evidence that those events occurred. The April 2026 KelpDAO bridge exploit is relevant but does not establish fraud by SparkLend. Independent reporting says the attacker created approximately 116,500 unbacked rsETH, worth about $292–294 million, and that SparkLend froze its rsETH market.

Other reporting states SparkLend had reduced rsETH exposure before the exploit and avoided material losses. These facts indicate third-party contagion risk and emergency risk controls, not committed fraud by SparkLend’s DAO or owners. Stress conclusion: Treat DAO/owner fraud as an unresolved tail risk rather than an evidenced incident. The more substantiated risks are governance centralization, administrator or emergency-control dependence, oracle/asset exposure, and potential contagion from third-party protocols.

No on-chain claim, TVL comparison, treasury balance, or loss estimate is asserted here because it was not independently verified in this run.

Stress assessment — SparkLend, Ethereum: primary yield source negative for 30 days Result: Moderate-to-high income and liquidity stress; negative yield alone does not establish user principal loss. SparkLend’s documented liquidation mechanism is collateral-based: liquidation is triggered when a position’s health factor falls below 1, not merely because an underlying yield source is negative. The likely transmission channel is the broader Sky/Spark yield stack. Documented sources include crypto-loan fees, U.S.

Treasury-bill investments, and liquidity provision through SparkLend. If the primary source produces a negative return for 30 days, gross income could fall below the rate distributed to savers or below funding and operational costs. The resulting risks are lower or suspended distributions, reserve depletion, governance intervention, and withdrawal/liquidity pressure.

These consequences are risk inferences from the documented revenue structure, not an observed current event. SparkLend also relies on stablecoin liquidity supplied from Sky and operates with governance-defined or market-based borrowing rates, depending on the asset. A prolonged negative source could therefore require rate changes, reduced allocations, or rebalancing into other sources.

It would not, by itself, make overcollateralized SparkLend loans undercollateralized; principal impairment would require a separate failure such as collateral devaluation, oracle failure, bad debt, market illiquidity, or a shortfall in the relevant reserve mechanism. Stress indicators to monitor

• Net yield of the affected source versus the applicable saver/distribution rate.
• Sky/Spark reserve coverage and any governance proposals changing rates or allocations.
• Stablecoin withdrawals, utilization, borrow-rate changes, and liquidity depth.
• Health-factor deterioration, liquidations, oracle incidents, and bad-debt growth.
• Concentration of Ethereum exposure in the affected source; a current on-chain percentage is Not verifiable as of October 3, 2026 because on-chain verification was unavailable. Limitations: Current 30-day realized yield, reserve balances, exposure by source, and any live negative-yield event are Not verifiable as of October 3, 2026. The cited revenue-source description is partly from Spark’s own research and therefore should be treated as an unverified marketing claim unless independently reconciled to financial or on-chain data.

Assessment as of October 13, 2026: SparkLend is governed through Sky governance, not an autonomous Spark DAO. The control path is Sky forum/Atlas authorization → Snapshot or governance poll → SKY executive vote → Spark proxy spell. The latest October 8, 2026 executive proposal confirms that Spark proxy spells can change Spark administration, claim SparkLend reserves, and route assets to the Spark ALM Proxy or Spark Operations Multisig.

It also proposes transferring Spark Beacon administration to the Sky Governance Relay. DAO status: materially centralized/hybrid; the DAO is not the ultimate autonomous controller. Governance is substantive at the Sky level, but Spark-specific voting is authorization/input rather than independent Spark token-holder control.

Proposal process is therefore real but parent-governance controlled. Frontend/development authority is not independently documented as DAO-controlled; contract administration is controlled through Sky proxy/relay mechanisms. Timelock: Sky GSM Pause Delay is 48 hours in the latest located executive proposal.

Emergency/custom-spell voting exists, and the Spark freezer architecture provides emergency risk controls; these are bypass/override capabilities for normal governance execution, not evidence of unrestricted fund withdrawal. Funds: Sky-approved Spark proxy spells can claim accrued SparkLend reserves and route them to designated ALM and operations addresses, but the reviewed evidence shows this occurring through governance-approved executive spells, not an unapproved unilateral admin drain. Top holders, voting concentration, multisig signer set, threshold, and independence are Not verifiable as of October 13, 2026 because Dune/on-chain verification was unavailable in this run.

Company entity, jurisdiction, registration number, directors, and applicable Spark terms are Not verifiable as of October 13, 2026. Contradiction / change from prior review: the October 8, 2026 proposal strengthens Sky control by moving Spark Beacon administration from Spark Executor to Sky Governance Relay.

As of October 3, 2026, SparkLend is described as a permissionless, non-custodial Ethereum lending protocol within the Sky ecosystem, not as a separately regulated bank, lender, broker, or money-services business. Its legal classification is therefore not formally verifiable from the reviewed materials. Entity/jurisdiction. The strongest current legal-entity evidence is Spark Foundation, an active Cayman Islands foundation company (registration CR-418210), which is identified by Spark’s MiCA materials as the parent/director of SPK Company Ltd., a British Virgin Islands company limited by shares formed to issue/distribute SPK. The MiCA materials concern the SPK token and do not expressly establish Spark Foundation as the contracting operator or liability-bearing entity for SparkLend. ToS, restrictions, KYC/AML, data protection. A protocol-specific SparkLend Terms of Service, governing-law clause, and comprehensive privacy notice were Not verifiable as of 2026-10-03.

The interface does apply wallet screening: Spark states that addresses may be checked by TRM Labs for legally prohibited conduct; the wallet address is shared, while IP addresses and metadata are stated not to be shared with TRM. This is front-end compliance blocking, not evidence that the underlying contracts are KYC/AML-gated. The SPK token white paper separately requires eligibility self-certification and permits exclusion of restricted jurisdictions/wallets; that restriction should not be conflated with SparkLend lending access. Warnings/enforcement/courts/sanctions. No protocol- or identified-entity-specific regulator enforcement, sanctions designation, or court case was identified in the reviewed public sources; the SEC’s “Sparkster” matter is a different, unrelated project and must not be attributed to SparkLend. Not verifiable as of 2026-10-03 whether any non-public investigation exists. Legal structure vs. actual risk. Cayman/BVI entities improve formal organization for token issuance and ecosystem administration, but do not clearly create a direct claim against a SparkLend operator for smart-contract losses.

Governance control, upgradeability, front-end screening, and potential protocol dependence on Sky create practical control and regulatory risks despite the “non-custodial/permissionless” description. This is an analytical inference, not a court determination. On-chain verification was unavailable in this run.

Legal entity per GLEIF: SPARK FINANCE LIMITED (LEI 549300OIKHJE8JP2OH97; jurisdiction NZ; registration ACTIVE). OFAC SDN screening of 'Spark Foundation', 'Spark ecosystem', 'Spark Finance': no match. SEC litigation and administrative release feeds: no mention.

SparkLend does not appear to issue its own stablecoin; it uses Sky/Maker’s USDS as the core stable asset, so own_stablecoin is false. A depeg for SparkLend’s used stablecoin is not verifiable from the available sources, so depeg_count, last_depeg_date, max_depeg_pct, and stable remain not verifiable as of 2026-10-05.

SparkLend’s principal Ethereum risks remain oracle/depeg transmission, privileged governance and upgrade control, smart-contract defects, liquidity stress, and liquidation losses during volatile markets. Recent materials document expanded kill-switch, rate-limit, slippage, audit, and bounty controls, but current Ethereum utilization, collateral concentration, reserve liquidity, and bad-debt exposure are Not verifiable as of October 5, 2026 because Dune verification was unavailable. Chain-specific exposure is therefore not quantified.

SparkLend’s top strengths are: deep stablecoin liquidity from Sky, strong capital efficiency for large borrowing positions, conservative risk controls, layered oracle/rate protections, and tight integration with the broader Spark/Sky ecosystem.

• Deep liquidity and scale: SparkLend is supplied directly from Sky’s stablecoin reserves, and current docs describe the lending market as backed by the Spark Liquidity Layer for deep, consistent liquidity.
• Capital efficiency: The protocol is positioned to support large borrowing positions and efficient stablecoin markets, with coordinated liquidity management across venues.
• Conservative risk design: Spark’s security framework emphasizes a narrow collateral set, constrained exposure, strict rate limits, and protocol-level loss absorption.
• Oracle and rate robustness: The security framework highlights multi-source oracle pricing and strict interest-rate controls as part of its risk model.
• Ecosystem integration: SparkLend is tightly linked to Sky and the broader Spark stack, including the Liquidity Layer and Spark Savings, which helps sustain utilization and allocation efficiency. No on-chain verification was available in this run, so any TVL, utilization, or exposure figures are Not verifiable as of 2026-10-03.