Security

How the DefiLords lending and borrowing protocol on Base is built, what protects your funds, and — stated plainly — what has not been independently reviewed. Read this before depositing.

Lending & borrowing: Base (baseMainnet)
AI vaults: Arbitrum — separate deployment

Audit status

No third-party security audit has been completed on any DefiLords contract. No contract listed on this page has been reviewed by an external audit firm, and no audit report exists for any of them. Any description of DefiLords as “audited” is incorrect.

We state this directly rather than in softer language because the alternative — “security-reviewed”, “audit-ready”, “built to audit standards” — would imply an independent verification that has not happened. Internal review and testing are not a substitute for an external audit, and we do not present them as one.

The practical consequence: the contracts holding your funds have not been examined by anyone outside the team. Undiscovered vulnerabilities are more likely in unaudited code, and a vulnerability in any contract below could result in partial or total loss of deposited funds.

This page will be updated when that changes. If an audit is completed, this section will name the firm, link the full report, and state which contracts and which commit it covered — including anything the audit did not cover.

What this page covers

DefiLords runs two separate on-chain products on two different networks. This page documents the lending and borrowing protocol on Base — the contracts listed below.

The AI vaults run on Arbitrum, under a separate deployment with its own contracts, at aivaults.defilords.finance. Those contracts are not listed here, and nothing on this page should be read as describing them.

The audit status stated above applies to both products: no third-party audit has been completed on any DefiLords contract, on either network.

Deployed contracts (Base)

These are the contracts that make up the protocol on baseMainnet. Every address is public and can be inspected on a block explorer.

Multi-Collateral Borrow Pool
0x05DFf3739B0CC22967eD727e9707D825ef93451f

Holds collateral and issues loans against multiple asset types.

Same-Asset Borrow Pool
0x58B1aA92eef4222cA959e12F6D88F2b9043a67F4

Holds collateral and issues loans denominated in the same asset.

Lending Vault
0xd3c1e7961A929Ae109147fCb9541051Bc75003Fc

Custodies supplied liquidity and accrues interest to lenders.

Price Oracle
0xd0314A976E768Fa8A35389b46F081365660b570A

Supplies the asset prices used for collateral valuation and liquidation.

The following are part of the protocol design but are not currently deployed on this network. They hold no funds and are not live:

  • Strategy VaultRoutes deposited capital into yield strategies.
  • AcademyTracks course progress and credentials. Holds no user funds.

Custody

DefiLords is non-custodial. Supplied assets are held by the contracts listed above, not by the DefiLords team, and withdrawal is executed by the contract rather than granted by us. We cannot move your funds to ourselves.

Non-custodial does not mean risk-free. It means the risk sits in the contract code and its administrative controls rather than in our honesty — which is precisely why the audit status above matters.

Pause and emergency controls

The vault and borrow pools implement a pause mechanism. When paused, deposits and borrows are rejected and the interface reports that the contract is paused for maintenance.

Unconfirmed — do not publish
Not yet confirmed: who can trigger a pause (single key, multisig, or timelock), and whether pausing also blocks withdrawals or only deposits and borrows. A pause that can halt withdrawals is a materially different risk to one that cannot, and readers are entitled to know which this is. Confirm before publishing.

Administrative control

Unconfirmed — do not publish
Not yet confirmed, and required before this page is published:
  • Are the contracts upgradeable, or immutable once deployed?
  • Who holds the admin or owner keys — an individual, a multisig (and of what threshold), or a timelock?
  • Is there a timelock delay on privileged actions, and how long?
  • What can a privileged key do that a user cannot — change the oracle, change rates, withdraw reserves, upgrade logic?
These answers determine the honest ceiling on how much a depositor is trusting the team rather than the code. Vague wording here is worse than saying nothing.

Price oracle

Collateral valuation and liquidation thresholds depend on the price oracle listed above. If the oracle reports an incorrect price, positions can be liquidated that should not be, or loans can be issued against collateral worth less than reported.

Unconfirmed — do not publish
Not yet confirmed: the oracle’s data source (Chainlink, a TWAP, or a team-operated feed), its update frequency, and whether any staleness or deviation check rejects bad prices. A team-operated feed is a materially different trust assumption to Chainlink and must be named as such.

Reporting a vulnerability

If you believe you have found a vulnerability, please report it privately rather than disclosing it publicly, so it can be fixed before it is exploited.

Unconfirmed — do not publish
Needs a real disclosure channel before publishing: a security contact address (ideally security@defilords.finance), expected response time, and whether a bug bounty exists. A security page with no way to report a bug invites public disclosure instead.
Security | Defi Lords