Spark Finance Onchain

Identification — sparklend-oc

• Protocol: SparkLend (Spark/Sky ecosystem), a permissionless DeFi lending market; the suffix -oc is not an official protocol name and I found no separate Optimism deployment matching it. SparkLend launched on Ethereum on May 9, 2023 and later expanded to Gnosis in September/October 2023.
• Website / docs: spark.finance; developer documentation is hosted at docs.spark.finance.
• Category: Lending / money market.
• Chains: Ethereum mainnet; Gnosis Chain deployment was deprecated in September 2026. No verified Optimism deployment found.
• Native token: No SparkLend-only token identified. SPK is the broader Spark ecosystem token, not a lending-market asset. Main contracts
• Ethereum: Pool 0xC13e21B648A5Ee794902342038FF3aDAB66BE987; PoolAddressesProvider 0x02C3eA4e34C0cBd694D2adFa2c690EECbC1793eE; PoolConfigurator 0x542dba469bde58faee189ffb60c6b49ce60e0738; ACL Manager 0xda135cd78a086025bcdc87b038a1c462032b510c. Addresses are cross-checked by ChainSecurity, Etherscan, and an independent monitoring registry; Ethereum Pool source is explorer-verified.
• Gnosis: Pool 0x2Dae5307c5E3FD1CF5A72Cb6F698f915860607e0; PoolAddressesProvider 0xA98DaCB3fC964A6A0d2ce3B77294241585EAbA6d; PoolConfigurator 0x9b232a63516eef3d9Cf0437E08DFd9D0E7906B0c; ACL/DSPauseProxy 0x5C3255d55E93F6b23966A3f3B29A7eB4455C5D43. Full two-source explorer+Dune cross-check: Not verifiable as of October 13, 2026; Dune was unavailable. Fork lineage and modifications SparkLend is an Aave V3 fork. Material changes include Maker/Sky governance through DSPauseProxy, D3M liquidity integration, single-transaction reserve initialization, different RewardsController deployment, restricted role assignments, rate limits, and Spark-specific flash-loan behavior. ChainSecurity performed deployment verification, but this is not equivalent to a complete audit of every later modification. Comparable forks have suffered serious incidents: Agave, an Aave fork, was exploited on Gnosis; Hundred Finance also suffered fork-related exploits. These demonstrate modification/integration risk, not evidence of intentional malicious code in SparkLend.

SparkLend OC appears to be a real, live lending product rather than a pure landing page: the documentation portal describes SparkLend as a permissionless money market, says it is supported on Ethereum, and the public app is referenced as the place for live market parameters and user flows such as supplying, borrowing, repaying, and withdrawing. The available web evidence also points to an operational front end with tutorial/docs support and an official application domain mentioned in the bug-bounty scope. Product maturity looks moderate-to-strong: the docs portal is organized, current, and explicitly links product pages, guides, and live-market references, which is consistent with a functioning DeFi app rather than a template site.

I did not find clear evidence in the retrieved sources of broken links, fake TVL metrics, or obvious template/clone signs, but that absence is not proof; those items are Not verifiable as of 2026-10-13. Live deposits/withdrawals are described in the product materials and user-facing pages, but independent confirmation of actual transaction execution was not available in the retrieved sources, so the operational status is Not verifiable as of 2026-10-13. An open API is at least implied by the bug-bounty listing, which includes an api-v2.spark.fi asset in scope, but the retrieved sources do not document a public API specification or developer endpoints in enough detail to confirm an open API definitively.

SparkLend (Spark) has an active bug bounty program managed by Immunefi. It is live since 01 November 2023, with rewards paid in DAI on Ethereum and denominated in USD. The maximum bounty is $5,000,000.

For smart-contract critical issues, the payout is 10% of funds directly affected up to the max; high-severity smart-contract issues have a max of $100,000. A proof of concept is required for critical and high smart-contract reports. Publicly visible program pages indicate the program is active and triaged by Immunefi.

No specific public case results were identified in the gathered sources, so reported results are not verifiable as of 2026-10-13.

Scope / identity. sparklend-oc could not be matched unambiguously to a canonical SparkLend deployment. Current Spark documentation describes SparkLend as primarily Ethereum-based and says the Gnosis deployment was deprecated in September 2026, while separate materials describe Spark expansion to Optimism. Therefore, chain-specific balances and dependency percentages are Not verifiable as of October 13, 2026. External dependencies and counterparty risks

• Oracle risk: SparkLend uses an Aave-compatible routing layer with redundant aggregator contracts combining Chainlink, Chronicle, and RedStone. Failure, stale data, correlated feed errors, or a peg-ratio/oracle fault could cause under-collateralized borrowing or wrongful liquidations. The redundancy reduces—but does not eliminate—common-mode risk.
• Stablecoin / issuer risk: USDS is issued by Sky, not Spark. Any USDS depeg, governance failure, PSM liquidity impairment, or Sky solvency/backing event would transmit directly to SparkLend markets using USDS. USDC/USDT additionally retain issuer, freeze, redemption, and banking-system risks.
• Bridges / cross-chain risk: Cross-chain flows are rate-limited, but any Optimism or other bridge/interoperability layer introduces message-verification, mint/burn, liquidity, and chain-finality risks. A bridge failure could strand liquidity or create unbacked representations.
• LST/restaking exposure: Spark documentation identifies collateral such as wstETH, rETH, weETH and related assets as requiring peg-ratio monitoring. These add issuer, validator/slashing, withdrawal-queue, liquidity, and basis risks. Exact reserve weights are Not verifiable as of October 13, 2026.
• Governance / upgrade risk: Core contracts are upgradeable through the PoolAddressesProvider, creating administrative-key and governance-execution risk.
• Custodian, CEX/MM, and RWA/SPV exposure: No protocol-specific exposure percentages could be verified without on-chain analysis; therefore these are Not verifiable as of October 13, 2026. Failure scenarios: oracle corruption → bad liquidations/bad debt; USDS depeg → collateral and debt mismatch; bridge outage/exploit → trapped or unbacked assets; LST depeg/slashing → cascading liquidations; Sky or governance failure → liquidity support and solvency impairment. Contradiction callout: Spark materials list Optimism among supported app networks, but the current SparkLend product page states Ethereum is the current supported deployment and Gnosis was deprecated. This inconsistency prevents reliable identification of the -oc instance.

Not verifiable as of 2026-10-13. The available search results do not identify a protocol-specific custody arrangement for Sparklend OC, and they mostly describe general crypto custody models or unrelated custodians rather than this protocol’s actual operational setup. Based on the evidence provided, custody organization cannot be confirmed, and there is no verifiable indication of whether assets are segregated or whether withdrawals are paused.

Key-management organization — SparkLend-OC The slug-specific deployment and its current signer addresses/thresholds are Not verifiable as of October 13, 2026 because on-chain verification was unavailable in this run and public sources do not clearly identify a distinct “sparklend-oc” instance. At the SparkLend architecture level, privileged control is organized as follows:

• Primary governance authority: On Ethereum, the PoolAddressesProvider is owned by Sky Governance. This owner controls core address registration, proxy administration, and upgrade authority.
• Cross-chain administration: For deployments on other networks, ownership is assigned to a cross-chain governance bridge or a community multisig, rather than to an individual operational key.
• Governance relays/executors: Spark’s governance-relay infrastructure uses domain-specific Executors as administrators of bridged instances. Executors queue proposals originating from host-domain governance and execute them on the destination chain.
• Role separation: The lending pool uses an ACLManager; privileged functions are restricted to roles such as POOL_ADMIN_ROLE, while ordinary lending functions remain permissionless. Pool upgrades are mediated through the PoolAddressesProvider.
• Operational automation: Automation services execute already-approved governance actions and monitoring/kill-switch tasks; the public documentation does not establish that these services independently hold ultimate upgrade authority. Risk assessment: The design appears to avoid a single hot administrator by separating governance, cross-chain execution, ACL roles, and operational automation. However, the exact custody model—MPC versus multisig, signer count, signing threshold, key-storage provider, rotation policy, and emergency-key scope—for sparklend-oc is Not verifiable as of October 13, 2026.

Scope/identity finding — high severity: sparklend-oc cannot be matched to a verified SparkLend deployment. The canonical Spark registry’s Optimism file lists governance/PSM/oracle infrastructure but no SparkLend PoolAddressesProvider, Pool, PoolConfigurator, ACL Manager, or Oracle deployment. Current Spark documentation says SparkLend is supported on Ethereum; the Gnosis deployment was deprecated in September 2026.

Therefore, the oc chain/slug mapping is not established. Not verifiable as of October 13, 2026. Addresses / verification: Pool, provider, proxy admin, ACL Manager, configurator, oracle, reserve tokens, and implementation addresses: Not verifiable as of October 13, 2026. No deployment-specific explorer verification, audit-to-address match, or decoded admin-event trail can be safely attributed to this slug. Expected SparkLend architecture, if this refers to a genuine deployment: Governance / cross-chain relay → PoolAddressesProvider (owner; proxy factory/admin) → Pool proxy → Pool implementation ├→ PoolConfigurator → reserve/aToken/debt-token configuration ├→ ACL Manager → POOL_ADMIN / RISK_ADMIN / EMERGENCY_ADMIN / BRIDGE roles └→ AaveOracle / sentinel SparkLend’s Pool uses an InitializableImmutableAdminUpgradeabilityProxy; the PoolAddressesProvider is the proxy admin and can update implementations. User supply, withdrawal, borrowing, repayment and liquidation are permissionless, while configuration and emergency functions are role-gated. Risk assessment for this slug: proxy upgrade authority, pause/freeze, withdrawal restriction, fee/rate/oracle/strategy changes, role renunciation, timelock delay, and whether users can exit without administration: Not verifiable as of October 13, 2026. Dune was unavailable, so proxy-admin type and on-chain timelock delay were not confirmed. Worst case for a genuine deployment is a compromised provider owner/governance path replacing Pool or configurator logic, manipulating risk/oracles, freezing markets, or causing loss of funds; a direct admin drain is not established.

Do not treat this slug as investable until chain and addresses are supplied. Structured fields:

• admin_can_drain: null
• audited_deployment: null
• upgradeable: null
• unresolved_critical: null
• unresolved_high: null

MakerDAO SparkLend Freezer

MakerDAO Kill Switch

SparkLend Cap Automator Security Audit

MakerDAO Core Updates to SparkLend

SparkLend is not a purely anonymous project: public sources identify Phoenix Labs as the core development company and name Sam MacPherson, Nadia Alvarez, Lucas Manuel, and Kris Kaczor as key team members. Sam MacPherson is publicly described as a former smart-contract engineer at MakerDAO, technical lead at Maple, and blockchain developer at EY; Nadia Alvarez is described as a former Head of Growth at MakerDAO and a business-development manager for Latin America, with a prior account-management role at Red Hat. Lucas Manuel is publicly identified as co-founder/head of smart contracts, but several sources note that his background is less fully disclosed than Sam’s and Nadia’s. Reality check: this looks like a real operating team, not just a front-end with hidden operators.

The project has an active GitHub footprint for SparkLend contracts, public governance/forum activity, and media interviews quoting named executives, which is consistent with an ongoing development organization rather than an anonymous shell. However, a precise office location or legal onshore/offshore structure is not verifiable from the provided sources, and I would treat those items as Not verifiable as of 2026-10-13. Prior outcomes / credibility: the team’s strongest credibility signal is their earlier MakerDAO/Sky overlap and the fact that Spark/Lend has been integrated into the broader Sky ecosystem and covered by mainstream crypto media. That said, the sources here do not establish independent third-party verification of the founders’ full employment histories, nor do they provide a reliable record of prior failed ventures or hacks tied to the founders themselves.

No founder-specific hack history is verifiable from these results. Bottom line: SparkLend appears to be run by a public, identifiable team with real technical output and governance participation, but its corporate domicile, office footprint, and exact legal structure remain Not verifiable as of 2026-10-13 from the available evidence.

SparkLend’s reputation is generally positive, with the protocol presented as a conservative, permissionless money market and described by Spark as having narrow collateral, multi-oracle pricing, strict rate limits, and first-loss capital. Independent directory coverage also says SparkLend has had no recorded security incidents to date and has been independently audited, though one profile notes only a limited audit set on file. The protocol is widely associated with the MakerDAO/Sky ecosystem, which supports credibility and institutional familiarity, and Spark’s own materials describe Spark as incubated by MakerDAO.

Criticisms and unresolved concerns are mostly about *risk concentration* rather than outright scandal. Coverage notes that SparkLend is a stablecoin-focused lending market with governance-set rates, which can be viewed as a design strength but also implies dependence on governance and stablecoin market conditions. A June 2026 risk update cited by Spark shows low but nonzero exposure ratings across key vaults, indicating ongoing monitoring rather than a clean bill of health.

I did not find credible reporting of fraud, a rug pull, insolvency, sanctions, or legal/regulatory enforcement against SparkLend in the provided results. The only notable negative signal is that third-party coverage and commentary frame the broader DeFi lending sector as exposed to stablecoin and systemic-risk issues; one article also notes Spark reduced rsETH exposure before the April 2026 Kelp exploit, which is consistent with proactive risk management rather than a loss event. Overall sentiment is favorable, but the main unresolved concern is whether Spark’s conservative design and institutional positioning can continue to hold up under stressed stablecoin or collateral-market conditions.

Scope / identification: The slug sparklend-oc is not independently mapped to a distinct SparkLend deployment. Analysis therefore covers SparkLend generally; chain-specific attribution beyond DeFiLlama is Not verifiable as of October 13, 2026. Dune was unavailable, so no on-chain verification, query ID, or execution ID exists. Economic model: SparkLend is an Aave V3-style, permissionless overcollateralized money market: users supply assets, receive interest-bearing sp tokens, and borrowers draw variable-rate debt against eligible collateral.

Yield is primarily borrower interest, less reserve/protocol allocations—not a staking, restaking, or external strategy return. Spark documentation states supplied collateral remains in reserves and is not redeployed into external strategies. Risk profile: The lending engine is broadly market-neutral at the protocol level: it earns spread from lending activity rather than directional trading. Users can create directional or leveraged exposure by borrowing against ETH, liquid-staking collateral, BTC assets, or stablecoins.

Recursive looping is technically possible where collateral and debt assets are mutually supported; exact live leverage is Not verifiable as of October 13, 2026. No restaking mechanism was identified. Withdrawals / constraints: Withdrawals are permissionless but limited by available liquidity, supply caps, configured rate limits, and—where the supplied asset backs debt—health-factor requirements. There is no protocol-level maturity lock-up identified.

Users pay network gas; borrowers bear interest, while liquidations and flash loans can generate additional fees. Supply/borrow caps and governance-controlled collateral parameters are material gates. Revenue / collateral: DeFiLlama defines fees as borrower interest, flash-loan fees, liquidation fees and penalties, and revenue as the amount routed to Spark treasury. Its retrieved snapshot reports approximately $5.06m 30-day fees and $426k 30-day protocol revenue; these are stale aggregator figures, not on-chain-verified. TVL / APY: DeFiLlama’s retrieved snapshots show roughly $4.7–$5.25bn TVL, overwhelmingly Ethereum, with a small Gnosis balance; the conflicting snapshots are a data-quality contradiction.

Current product-level and chain-level TVL, trend, APY history, volatility, and sustainability are Not verifiable as of October 13, 2026 without Dune or a fresh API extract. One retrieved aggregator snapshot showed average supply APY around 1.25%.

## Scope and verification The slug sparklend-oc cannot be unambiguously mapped to a specific SparkLend chain deployment from public sources. Dune MCP was unavailable for this run; therefore, no on-chain balances, reserve composition, liabilities, or latest block snapshot were independently verified. Not verifiable as of October 13, 2026. ## Treasury and reserves

• Spark’s Q1 2026 financial report disclosed a consolidated Spark treasury of $46.1 million at March 31, 2026. This is stale relative to the required seven-day freshness window and is not a chain-specific or independently reconciled balance.
• Reported treasury address: 0x3300f198988e4C9C63F75dF86De36421f06af8c4. The report does not establish that this address contains all SparkLend reserves or that it is the treasury for sparklend-oc.
• SparkLend reserve-factor income is represented by accruedToTreasuryScaled; governance can call mintToTreasury, which mints the accrued income to the treasury as interest-bearing aTokens. This is protocol revenue, not necessarily immediately liquid reserves.
• Composition, custody, and current balances: Not verifiable as of October 13, 2026. No reliable public reserve attestation was identified. ## Control and reserve policy The Pool is upgradeable through the PoolAddressesProvider. The provider is the registry for Pool, configurator, oracle, ACL, and data-provider addresses; ownership is described as Sky governance on Ethereum and cross-chain governance bridges or community multisigs on other networks. Exact controller(s) for sparklend-oc remain unverified. > Contradiction / data gap: The reported $46.1M consolidated treasury figure cannot be reconciled to current on-chain balances, chain allocation, or liabilities without Dune or equivalent direct RPC verification. Treat it as an unverified, stale management report rather than liquid reserves. Structured fields:
• liquid_reserves_usd: null
• liabilities_usd: null

Scope: Matched to Spark/SparkLend; Dune was unavailable, so on-chain claims requiring query/execution references are not independently verified. Native token: Spark (SPK), Ethereum contract 0xc20059e0317DE91738d13af027DfC4a50781b066 (also deployed on Base and BSC). SPK is Spark’s governance and staking token. It supports Snapshot governance, staking/security participation, and reward distribution; current documented staking rewards are Spark Points/Symbiotic Points, not protocol revenue. Supply/valuation snapshot: Genesis/max supply is 10.0B SPK.

CoinGecko reports approximately 3.351B circulating, $71.1M market cap, and $212M FDV as of October 13, 2026. These are aggregator figures, not Dune-verified. Allocations and emissions: 65% (6.5B) is Sky farming for users over 10 years: 1.625B in each of years 1–2; 812.5M in years 3–4; 406.25M in years 5–6; and 203.125M annually in years 7–10. Ecosystem receives 23% (2.3B): 17% available at TGE and 6% after one year.

Team receives 12% (1.2B), with a 12-month cliff followed by three-year vesting. No investor allocation is disclosed. Unlock execution: The SPK airdrop’s final claim date was December 17, 2025. Whether announced unlocks and vesting releases actually occurred on-chain: Not verifiable as of October 13, 2026. Value capture/controls: Sky governance has authorized SPK buyback funding transfers, but no documented direct revenue share to SPK holders or SPK burn program was found.

Sky retains the ability to mint additional SPK in extreme circumstances. Detailed blacklist, fee-switch, and current privileged-function control analysis: Not verifiable as of October 13, 2026. Concentration/liquidity: Spark’s data hub shows top balances of about 4.79B (47.9%), 954.5M (9.5%), and 728.5M (7.3%); the first two correspond to disclosed Sky/subDAO-controlled addresses, implying high administrative concentration. DEX liquidity depth: Not verifiable as of October 13, 2026. Major tracked CEX markets include Binance, Coinbase, Bybit, OKX, and KuCoin.

For Sparklend OC, a Bitcoin move below $10,000 would be an *extreme tail-risk* macro shock rather than a base-case scenario. The web results consistently frame such a move as requiring simultaneous stress factors such as a global liquidity crunch, forced deleveraging, persistent institutional outflows, and a broader crisis of confidence in crypto and risk assets. For a lending protocol like Sparklend OC, the main stress transmission channels would be: collateral value collapse, sharp increases in liquidation volume, and a possible rise in bad debt if liquidation engines cannot keep pace.

The available results do not provide protocol-specific collateral composition, liquidation parameters, or current on-chain exposure for Sparklend OC, so those impacts are not verifiable as of 2026-10-13. Key risk interpretation:

• Collateralized BTC exposure: If BTC is used as collateral, a drop below $10,000 would likely push many positions far below maintenance thresholds, triggering widespread liquidations.
• ETH / alt collateral cross-impact: A BTC crash of that magnitude would likely coincide with a broad crypto selloff, so non-BTC collateral could also weaken materially, amplifying undercollateralization risk.
• Market liquidity risk: Several sources describe the $10,000 scenario as needing a severe global liquidity shock or geopolitical crisis, which would also impair liquidation depth and increase slippage. What cannot be verified from the provided evidence:
• Sparklend OC’s exact BTC exposure — Not verifiable as of 2026-10-13.
• Collateral mix and concentration — Not verifiable as of 2026-10-13.
• Protocol solvency under this stress case — Not verifiable as of 2026-10-13.
• Liquidation thresholds / bad-debt sensitivity — Not verifiable as of 2026-10-13. So the stress conclusion is: a BTC sub-$10,000 event would likely be a severe solvency and liquidation stress test for Sparklend OC, but the protocol-specific loss magnitude cannot be determined from the available sources.

For SparkLend, a 20% depeg of the largest collateral asset is a severe but recognizable lending-market stress: if the asset is used as borrowing collateral, the immediate effect is a sharp drop in collateral value, higher liquidation risk, and possible cascading forced sales if liquidation capacity is thin. Industry stress-testing guidance explicitly treats 10–20% instantaneous depegs as a relevant scenario for lending protocols and liquidation engines, because the key failure mode is liquidation cascades and DEX liquidity exhaustion rather than the depeg itself. What this means in practice depends on SparkLend’s specific collateral mix, liquidation thresholds, oracle design, and available liquidity for the depegged asset.

If the largest collateral is also the dominant source of borrowing power, a 20% move can push many accounts below maintenance health, especially if positions are highly looped or concentrated. If the asset is only a modest share of collateral, the protocol may absorb the shock with liquidations but without system-wide insolvency. I cannot quantify the exact bad debt, liquidation volume, or TVL at risk from the provided information alone. Not verifiable as of 2026-10-13 whether SparkLend has enough chain-specific liquidity, oracle protections, and liquidation throughput to contain a 20% depeg without material losses.

The main risk conclusion is: the protocol’s vulnerability is likely concentrated in liquidation performance and collateral concentration, not in the price shock itself. The larger and more looped the collateral exposure, the more likely a 20% depeg becomes a protocol-level stress event rather than a routine liquidation cycle.

Assumption: “top counterparty” means the largest SparkLend borrower on the selected deployment. On-chain borrower concentration, collateral, and debt amounts are Not verifiable as of October 13, 2026 because Dune MCP is unavailable. Expected loss path 1. The borrower becomes insolvent or its collateral value falls below debt value.

2. Oracle prices reduce the borrower’s health factor below 1. Anyone can call Pool.liquidationCall().

The liquidator repays debt and receives collateral plus the liquidation incentive. SparkLend permits up to 50% debt coverage when HF is between 0.95 and 1.0, and up to 100% at or below 0.95. 3.

If collateral sales/liquidations fully cover debt, the loss is absorbed by the borrower through collateral forfeiture and the liquidation penalty; suppliers suffer no principal loss, although liquidity may temporarily tighten. 4. If collateral is insufficient, the residual becomes protocol bad debt: the reserve’s debt-token claim exceeds recoverable underlying assets.

The loss is economically shared by suppliers of that reserve through a lower effective aToken redemption value and/or impaired withdrawals. Who absorbs it / compensation

• First absorber: the insolvent borrower’s collateral and liquidation penalty.
• Second: reserve-level accrued income and treasury-held reserve-factor proceeds may offset losses, but the contracts do not provide an automatic, guaranteed insurance payment. SparkLend’s Pool mints reserve-factor income to the treasury as aTokens.
• Residual: reserve suppliers and, indirectly, the wider Spark/Sky system if governance chooses a recapitalization. A Sky backstop is not a contractual guarantee to depositors; any compensation would require governance action and available capital. Not verifiable as of October 13, 2026 for this deployment. Smart-contract impact path Oracle → health factor → Pool.liquidationCall() → collateral transfer / debt burn → reserve accounting. If liquidations fail or collateral is inadequate, no contract automatically socializes losses across unrelated markets: the affected reserve bears the shortfall. Spark’s documentation states that isolated-market liquidations affect the affected position/market rather than other markets. Key risk conclusion: the critical exposure is reserve concentration and liquidation liquidity, not counterparty recourse. No depositor compensation is guaranteed once collateral and reserve income are exhausted.

For the stress scenario of committed fraud by the DAO or owners, the risk is credible but not evidenced as having occurred from the sources reviewed. SparkLend’s governance and risk controls are explicitly designed to reduce catastrophic misuse, but they do not eliminate the possibility that a malicious or captured DAO could change risk parameters, list harmful assets, or otherwise abuse upgrade and governance powers. The strongest concrete evidence is *governance/upgrade centralization risk*, not a confirmed fraud event.

An independent review describes SparkLend as using upgradeable proxies and a centralized UpgradeController governed by the Spark DAO, and it flags critical attack vectors where a malicious or faulty upgrade could lead to fund loss, market manipulation, or governance takeover. Another source notes that the Sky DAO controls SparkLend’s risk parameters, meaning a captured governance process could alter LTVs, list malicious assets, or change the SSR adversely. On the other hand, available sources do not show a confirmed case of the DAO or owners actually committing fraud against users.

The audit and security materials instead focus on technical manipulation and governance-abuse *possibilities* such as oracle manipulation, upgrade failure, or governance takeover risk. Based on the reviewed material, the appropriate classification is not a proven fraud incident, but a plausible governance-capture / malicious-admin stress case. So, for risk assessment purposes, the answer is: Yes, the protocol has meaningful exposure to insider/DAO fraud scenarios via governance and upgrade authority, but no public evidence in the reviewed sources confirms that such fraud has already occurred.

SparkLend’s primary yield source is lending interest from borrowers, and Spark’s own materials describe SparkLend as a stablecoin lending market whose revenue comes from interest accrued by borrowers, with Spark collecting a reserve factor on that interest. In a negative 30-day stress scenario for that primary source, the relevant reading is that lend-from-borrow demand weakens or borrower rates compress, so depositor yield would fall rather than be sustained by the core lending engine. For SparkLend specifically, that means the protocol is not primarily dependent on a fixed external subsidy; its yield is tied to lending activity, while Spark’s broader ecosystem also references a separate capital-allocation layer (the SLL) and yield-bearing stablecoin products.

DefiLlama also characterizes SparkLend as a stablecoin lending market with governance-defined rates and tracks an average APY of 1.14%, which is consistent with a yield profile that can compress materially when core lending economics deteriorate. In risk terms, the stress outcome is yield negative / yield compression over the last 30 days, not a protocol failure by itself. The main question is whether alternative revenue channels can offset the decline; based on the sources provided, that offset is not verifiable as of 2026-10-13 without on-chain data or a verified treasury/revenue breakdown.

Scope limitation: sparklend-oc could not be uniquely matched to a chain-specific SparkLend deployment from available sources. Dune was unavailable in this run; therefore voting concentration, top holders, current owners, signer sets, thresholds, and block-level authority checks are Not verifiable as of October 13, 2026. No Dune query or execution ID exists. Governance model: SparkLend’s Ethereum deployment is governed through Sky Governance: token-holder polling can authorize parameter changes, followed by an Executive Vote and execution after the GSM Pause Delay.

A recent governance record states the delay was 24 hours. The SparkLend Pool is upgradeable; its PoolAddressesProvider controls implementation pointers and configuration. Sky documentation states Ethereum ownership is held by Sky Governance, while other networks may use cross-chain governance bridges or community multisigs.

For the specific -oc deployment, the actual owner/bridge/multisig is Not verifiable as of October 13, 2026. DAO assessment: Ethereum SparkLend governance is substantive rather than purely symbolic for parameters and upgrades, but the selected chain-specific deployment cannot be confirmed. The frontend is legally distinct from the protocol; Skybase International’s terms state it does not control or operate the protocol. Entity jurisdiction, registration number, directors, and applicable ToS jurisdiction were Not verifiable as of October 13, 2026. Risk conclusion: Upgrade authority exists at the PoolAddressesProvider/associated access-control layer.

Whether that authority can directly move deposited assets, whether an emergency bypass exists, and whether a single admin or multisig can act without governance are Not verifiable as of October 13, 2026. No contradiction between claimed and on-chain figures can be assessed without Dune/explorer verification.

Legal/regulatory assessment (as of October 13, 2026)

• Legal structure/entity: SparkLend is presented as a permissionless DeFi money market, not as a separately incorporated bank or lending company. The documented legal wrappers are primarily for the interface/IP: Mars Foundation, a Cayman Islands exempted foundation company, deployed the Spark front end; Mars SPC Limited, a Cayman Islands exempted segregated-portfolio company, holds Spark front-end IP for MKR/Sky governance.
• Additional entity: The SPK token documentation identifies SPK Company Ltd. as a British Virgin Islands company, with Spark Foundation as parent and Cayman Islands business address. This appears relevant to the token ecosystem, not proof that SparkLend’s smart contracts are owned or operated by that company.
• Terms/restrictions: The front end issues terms of business and a privacy policy. Wallet access may be blocked where TRM Labs associates an address with legally prohibited conduct. This is address screening—not evidence that the protocol itself performs customer onboarding or full KYC.
• KYC/AML/sanctions: No protocol-wide KYC/AML framework, licensed VASP status, or customer-identification process was verified. Not verifiable as of October 13, 2026. The interface’s TRM-based wallet screening creates sanctions/AML compliance controls at the access layer, but does not make the protocol or its entities sanctioned.
• Classification: SparkLend is described as a decentralized lending protocol. No banking, securities-lending, consumer-credit, or other definitive regulatory classification was located. The SPK MiCA document’s “utility token classification: false” concerns SPK, not SparkLend’s lending activity.
• Warnings/enforcement/court cases: No protocol-specific regulator enforcement, sanctions designation, or court case was located in the reviewed SEC/CFTC/OFAC and governance materials. This is not a legal clearance; jurisdictional exposure remains significant because identifiable Cayman/BVI entities support the interface, IP, and token ecosystem.
• Data protection: The interface states that wallet addresses are shared with TRM, while IP addresses are not shared with TRM. The scope, controller identity, retention period, and cross-border transfer basis were not independently verified. Legal structure vs. actual risk: The wrapper entities may narrow contractual/IP exposure, but users transact directly with upgradeable smart contracts and governance-controlled infrastructure. Recourse, insolvency treatment, and liability allocation remain materially uncertain.

No exact GLEIF LEI record for 'No separate SparkLend legal entity identified', 'relevant wrappers are Mars Foundation', 'Mars SPC Limited', 'with SPK Company Ltd', 'Spark Finance Onchain'. OFAC SDN screening of 'No separate SparkLend legal entity identified', 'relevant wrappers are Mars Foundation', 'Mars SPC Limited', 'with SPK Company Ltd', 'Spark Finance Onchain': no match. SEC litigation and administrative release feeds: no mention.

SparkLend does not appear to issue its own stablecoin; it is a stablecoin lending market that primarily uses USDS, and some materials also mention USDC and other stablecoins as borrowable assets. The web evidence available here does not verifiably document any depeg history for the stablecoin used by SparkLend, so the depeg count, last depeg date, and max depeg percentage are not verifiable as of 2026-10-13. Therefore, stablecoin depeg history cannot be confirmed from the gathered sources, and the safest classification is that this is not verifiable from available evidence rather than assumed to be stable or unstable.

SparkLend’s principal risks are oracle failure, privileged governance or upgrade actions, Optimism/L2 infrastructure dependence, liquidity stress, and smart-contract defects. Controls materially reduce—but do not eliminate—loss severity; deployment-specific exposure, current parameters, and TVL are Not verifiable as of October 13, 2026 because on-chain verification was unavailable.

SparkLend’s main strengths are deep stablecoin liquidity, governance-defined rates, conservative risk controls, strong oracle resilience, and capital efficiency at scale. The protocol is positioned as a stablecoin lending market with consistent liquidity supplied through Spark’s Liquidity Layer, which lets it bootstrap markets and maintain depth without relying only on organic deposits.

• Deep liquidity and scale: SparkLend is described as a high-liquidity lending market backed by Sky/Spark liquidity infrastructure, and external profiles report very large TVL relative to peers.
• Stable, governance-defined rates: Unlike utilization-driven lending markets, SparkLend uses governance-defined rates, which can make borrowing costs more predictable for users and treasury/risk planning.
• Conservative risk framework: The docs emphasize a narrow collateral set, supply and borrow caps, rate limits, debt ceilings, and first-loss capital, all of which reduce tail risk and concentration risk.
• Multi-oracle pricing resilience: SparkLend uses a three-oracle median across RedStone, Chainlink, and Chronicle, so a single oracle failure is less likely to distort prices or trigger bad liquidations.
• Capital efficiency and composability: E-Mode, overcollateralized borrowing, and integration with Spark’s liquidity allocator are designed to improve borrowing power while keeping the system permissionless and non-custodial. If you want, I can also turn this into a risk-adjusted strengths vs. weaknesses view for institutional due diligence.