Skip to content
PROTOCOL RESEARCH

Dolomite risk

Well-audited, largely immutable money market with a clean core track record, but a current WLFI-collateral concentration and a ~93%-utilization USD1 pool trap depositors, forcing caution.
CautionResearched Jul 1, 2026

Scorecard

strong: Audits & contractsSix audits (SECBIT 2021, Cyfrin 2023 core + 2025 modules, Zokyo 2023, Guardian 2024, plus OpenZeppelin/Bramah on the dYdX-origin core); 100% line/statement/branch coverage claimed; core largely immutable. Confirmed on docs.
watch: Admin control2-of-3 Gnosis Safe behind a 1-day (86,400s) delayed multisig, but four functions (incl. ownerSetInterestSetter and a GLP vault-implementation setter) bypass the timelock. Confirmed on docs.
watch: OracleChainlink primary on Arbitrum; Chronicle primary + Redstone + Kodiak TWAP on Berachain; Chainlink + Chronicle + Redstone + Uniswap-V3 TWAP on Ethereum. Heterogeneous, some thin TWAP feeds. Confirmed on docs.
weak: Liquidity & exitUSD1 pool ~93% utilization (~$12.5M idle) means depositors cannot all withdraw at once; WLFI dominates supplied collateral, risking cascading bad debt on a forced liquidation (Apr-May 2026).
watch: Yield (real vs emission)Real borrow/lend spread plus Berachain PoL, but headline USD1 rates reflect concentrated leverage on one counterparty, not broad organic demand; oDOLO/veDOLO emissions sit on top.
weak: Holder concentrationProtocol collateral base is WLFI-dominated (~55% of ~$836M supply, one governance token). DOLO token itself ~49% allocated to insiders/foundation (vested); circulating ~44%. Earlier '73%' claim unsupported and dropped.
watch: Track recordOne incident: Mar-2024, $1.8M drained from a discontinued 2019 contract via lingering approvals (live protocol not breached); ~90% returned by exploiter, remaining 10% covered from treasury. No governance-takeover incident.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$231.0M
30d↓4%
Audits2
Last hack$1.8M · Mar 2024

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

Dolomite is a capital-efficient money market on Arbitrum and Berachain. The core is inherited from dYdX's Solo Margin, audited six times, immutable in its risk-limit ceilings, and has never been breached at the protocol level. That part is solid. The problem is what is sitting inside the protocol right now. As of the April-May 2026 reporting window, World Liberty Financial's WLFI token dominates supplied collateral and the USD1 stablecoin pool runs near 93% utilization, which means ordinary depositors in that pool cannot all exit at once and a sharp WLFI drop could leave the protocol with bad debt. The engine is fine. The fuel it is currently running on is the risk.

Checklist

Audits and contracts. Six audits over the protocol's life, confirmed on the official docs: SECBIT Labs (2021-08-02, pre-Arbitrum launch), Cyfrin (2023-08-23 core, 2025-04-24 POLVaults v2.0 modules), Zokyo (2023-04-19, GLP and Isolation Mode), Guardian Audits (2024-01-11), plus OpenZeppelin (Zeppelin Solutions) and Bramah Systems on the original dYdX Solo Margin base. Docs claim 100% line, statement, and branch coverage, with public coverage reports. Risk-limit ceilings are hard-coded immutable and the core repository is designed not to change.

Admin control. Confirmed on docs: admin is a 2-of-3 Gnosis Safe (2 signers of 3) owned by a delayed multisig with a 1-day (86,400s) timelock, meant to grow as the protocol is battle-tested. Four functions bypass the delay for black-swan speed: ownerSetMarketIsClosing, ownerSetMarketMaxWei, ownerSetInterestSetter, and the GLP setUserVaultImplementation. A 2-of-3 threshold is on the low side, and the bypass on an interest setter and a vault-implementation setter is a real trust vector. Verify the live secondsTimeLocked on Arbiscan before sizing up, since the 1-day value is the launch figure.

Oracle. Confirmed on docs and heterogeneous by chain. Arbitrum leans on Chainlink wherever possible, with Pendle TWAP for PT/YT assets, Camelot TWAP for GRAIL/JONES/PREMIA, algorithmic-plus-Chainlink for GLP and GM tokens, and Chronicle/Redstone for a few wrapped assets. Berachain uses Chronicle as primary with Redstone for ETH/LBTC/USDe and Kodiak TWAP for governance tokens (including DOLO). Ethereum uses Chainlink plus Chronicle for rUSD/srUSD, Redstone for wrapped stablecoins, and Uniswap V3 TWAP for DOLO. Reasonable, but the non-Arbitrum feeds are more diverse and some ride TWAPs on less-liquid pairs.

Liquidity and exit. This is the sharp edge. Per CoinDesk (2026-04-09) and corroborating coverage (Odaily, bitcoin.com, PANews), WLFI is the single largest supplied asset at roughly $458.9M, about 55% of Dolomite's ~$835.7M total at that snapshot, and the USD1 stablecoin pool showed ~$180M supplied against ~$167.5M borrowed, a ~93% utilization ratio leaving only about $12.5M idle. At that utilization, USD1 depositors expecting at-will withdrawal cannot all get out, and reporting through May 2026 described retail depositors still unable to fully exit. If WLFI sells off, its thin market depth means a forced liquidation could crash the price before collateral unwinds, dumping bad debt back onto the same depositors.

Yield: real vs emission. The base yield is real: a borrow-lend spread plus Berachain Proof-of-Liquidity rewards, with virtual liquidity letting collateral keep earning while used as margin. But the headline USD1 numbers reflect concentrated leverage on one counterparty, not broad organic demand. Treat those APRs as regime-dependent, not durable. Emissions add oDOLO/veDOLO incentives on top, which are inflation, not organic yield.

Holder concentration. Two layers, both concentrated. Per Dolomite's own distribution docs, DOLO has a 1B fixed supply with roughly 49% allocated to insiders and the foundation (core team 20.2% on a 3-year vest and 1-year cliff, investors 15.1%, foundation 10.6%, service providers 3%, advisors 0.2%) and 50%+ to community (liquidity mining, airdrop, partner and Boyco rewards, protocol-owned liquidity). Circulating supply is about 441.6M of 1B (~44%). The earlier draft figure of "~73% held by major stakeholders" is not supported by the official allocation and is dropped. More important for depositors is collateral concentration: the supplied base is currently dominated by a single governance token (WLFI). Note DOLO governance does not control the protocol admin surface; that stays with the Gnosis Safe plus timelock.

Worst case

WLFI drops fast. Dolomite's liquidation engine triggers on the large WLFI collateral, but the token's shallow market depth means the forced sale crashes the price further, collateral fails to cover the debt, and the protocol books bad debt. That shortfall lands on USD1 and stablecoin depositors, who are already unable to fully withdraw at ~93% utilization. This is isolated to the affected pools by Dolomite's isolation-mode design, so unrelated markets should survive, but anyone lending into the WLFI or USD1 markets is directly exposed. There is no insurance fund noted; position sizing and pool selection are your only mitigation.

Bottom line

Caution. The smart-contract layer is one of the better-audited money markets around and the core has never been exploited. The March 2024 loss hit a discontinued 2019 SoloMargin contract via stale user approvals, not the live protocol; the exploiter returned about 90% and Dolomite's treasury made users whole for the remaining 10%. There is no governance-takeover or protocol-level incident on record. But a red on Liquidity and exit, driven by the WLFI collateral concentration and the trapped USD1 pool, is a fund-loss surface that outranks the clean audit story. Safe to use in vanilla blue-chip markets with conservative sizing; avoid the WLFI and USD1 pools until that concentration unwinds.

Data appendix

  • TVL: ~$201M (DeFiLlama "dolomite", 2026-07-01, verified). 90d / ATH: refresh.
  • Chains: Arbitrum, Berachain (also Ethereum, Mantle, Botanix, X Layer, Polygon zkEVM per docs).
  • Audits: SECBIT Labs (2021-08-02, pre-launch), Cyfrin (2023-08-23 core; 2025-04-24 POLVaults v2.0), Zokyo (2023-04-19 GLP/Isolation), Guardian Audits (2024-01-11), OpenZeppelin + Bramah Systems (dYdX Solo Margin origin). 100% line/statement/branch coverage claimed. Source: docs.dolomite.io/audits-and-security. Bug bounty: refresh.
  • Admin/governance: 2-of-3 Gnosis Safe behind a delayed multisig; timelock 1 day (86,400s) at launch, meant to grow. Four functions bypass the timelock (ownerSetMarketIsClosing, ownerSetMarketMaxWei, ownerSetInterestSetter, GLP setUserVaultImplementation). Risk-limit ceilings immutable. Source: docs.dolomite.io/admin-privileges. Live secondsTimeLocked value: refresh (verify on Arbiscan).
  • Oracle: Arbitrum: Chainlink primary + Pendle/Camelot TWAP + algorithmic (GLP/GM) + Chronicle/Redstone (select assets). Berachain: Chronicle primary + Redstone + Kodiak TWAP (governance tokens incl. DOLO). Ethereum: Chainlink + Chronicle (rUSD/srUSD) + Redstone + Uniswap V3 TWAP (DOLO). Source: docs.dolomite.io/risk-management.
  • Collateral concentration (Apr 2026): WLFI ~$458.9M supplied (~55% of ~$835.7M total); USD1 pool ~$180M supplied / ~$167.5M borrowed (~93% utilization, ~$12.5M idle). Sources: CoinDesk 2026-04-09; Odaily; PANews. Current on-chain snapshot: refresh.
  • Token distribution: DOLO 1B fixed supply. Insiders/foundation ~49% (team 20.2% 3yr vest / 1yr cliff, investors 15.1%, foundation 10.6%, service providers 3%, advisors 0.2%); community 50%+ (liquidity mining, airdrop, partner/Boyco, POL). Circulating ~441.6M (~44%). Source: docs.dolomite.io/dolo/distribution. On-chain top-holder breakdown: refresh (agent run).
  • Incident record: 2024-03-20, ~$1.8M drained from a discontinued 2019 SoloMargin contract via lingering user approvals; current protocol not breached; ~90% returned by the exploiter, remaining ~10% covered from Dolomite treasury so affected users were made whole. No governance-takeover or protocol-level incident on record. Sources: Cointelegraph, Cryptobriefing, revoke.cash/exploits/dolomite, Binance Square, Dolomite Medium post-mortem. Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols