How the DefiLords lending and borrowing protocol on Base is built, what protects your funds, and — stated plainly — what has not been independently reviewed. Read this before depositing.
We state this directly rather than in softer language because the alternative — “security-reviewed”, “audit-ready”, “built to audit standards” — would imply an independent verification that has not happened. Internal review and testing are not a substitute for an external audit, and we do not present them as one.
The practical consequence: the contracts holding your funds have not been examined by anyone outside the team. Undiscovered vulnerabilities are more likely in unaudited code, and a vulnerability in any contract below could result in partial or total loss of deposited funds.
This page will be updated when that changes. If an audit is completed, this section will name the firm, link the full report, and state which contracts and which commit it covered — including anything the audit did not cover.
DefiLords runs two separate on-chain products on two different networks. This page documents the lending and borrowing protocol on Base — the contracts listed below.
The AI vaults run on Arbitrum, under a separate deployment with its own contracts, at aivaults.defilords.finance. Those contracts are not listed here, and nothing on this page should be read as describing them.
These are the contracts that make up the protocol on baseMainnet. Every address is public and can be inspected on a block explorer.
Holds collateral and issues loans against multiple asset types.
Holds collateral and issues loans denominated in the same asset.
Custodies supplied liquidity and accrues interest to lenders.
Supplies the asset prices used for collateral valuation and liquidation.
The following are part of the protocol design but are not currently deployed on this network. They hold no funds and are not live:
DefiLords is non-custodial. Supplied assets are held by the contracts listed above, not by the DefiLords team, and withdrawal is executed by the contract rather than granted by us. We cannot move your funds to ourselves.
Non-custodial does not mean risk-free. It means the risk sits in the contract code and its administrative controls rather than in our honesty — which is precisely why the audit status above matters.
The vault and borrow pools implement a pause mechanism. When paused, deposits and borrows are rejected and the interface reports that the contract is paused for maintenance.
Collateral valuation and liquidation thresholds depend on the price oracle listed above. If the oracle reports an incorrect price, positions can be liquidated that should not be, or loans can be issued against collateral worth less than reported.
If you believe you have found a vulnerability, please report it privately rather than disclosing it publicly, so it can be fixed before it is exploited.