TL;DR
Save is the July 2024 rebrand of Solend, a Solana lending protocol. Two things define its risk. First, the program is upgradeable, so admin keys are the real surface, and the public audit trail is stale: the only named audits are Kudelski on the base spl-token-lending code plus a Soteria scanner run, with no dates on the page. The post-rebrand code (sUSD, saveSOL, permissionless pools) has no dedicated audit I could confirm this run. Second, the history is not clean. In June 2022 governance voted to seize a whale's account (SLND1), then reversed it a day later after backlash (SLND2); in November 2022 an oracle-manipulation attack left $1.26M in bad debt on isolated pools; and back in August 2021 an authentication-check flaw in UpdateReserveConfig let an attacker rewrite reserve config. TVL is now small at about $68M, well off its peak. This is a caution, not an avoid: the 2022 loss was absorbed by the treasury and later restored, no exploit is active today, but every money-loss surface here carries a documented flaw.
Checklist
Audits and contracts. Named audits are Kudelski on the upstream spl-token-lending base plus a Soteria scanner; the audit page carries no dates and predates the rebrand. No confirmed audit of the rebranded Save stack (native stablecoin sUSD, LST saveSOL, permissionless pools). Treat contract assurance as partial and dated on an upgradeable program. Admin control. Standard Solana upgradeable program, so a compromised or malicious upgrade authority is the top smart-contract risk. The public risk docs do not state the signer count, threshold, or timelock duration; multisig-plus-timelock is a reasonable assumption but is not verified on-chain this run. Note the August 2021 incident was itself an admin-surface flaw (an auth check in UpdateReserveConfig), which is why config authority is not a footnote here. Oracle. Current Save docs state liquidations use Pyth as the main feed with Switchboard as backup, so Switchboard is still in the live path, not merely historical. The November 2022 exploit came through a Switchboard feed reading a manipulated Saber USDH price on isolated pools. Permissionless and long-tail pools keep that manipulation class alive; the main pool (SOL, USDC, USDT, LSTs) is the safer surface. Yield: real vs emission. Lending APY is real borrower-paid interest. I did not verify the current real-vs-emission split or any SLND incentive layer this run. Holder concentration. Governance runs on SLND. During the June 2022 crisis one wallet reportedly spent about $700k to control roughly 90% of the SLND1 vote, which the vote passing on barely over 1% quorum makes plausible; it shows how thin quorum can be. Current token distribution is unverified. Track record. Not spotless, three documented marks. August 2021: an insecure auth check in UpdateReserveConfig let an attacker create a fake market and lower liquidation thresholds; detected and patched within about 1.5 hours. June 2022: an emergency governance vote (SLND1) granted the team power to take over a large borrower's account to avoid a cascading liquidation, reversed a day later by SLND2 after community backlash. November 2022: a $1.26M oracle-manipulation exploit hit the Stable, Coin98 and Kamino isolated pools; Solend froze the pools, absorbed the bad debt into its treasury, and later announced the funds were restored, so no user wallets were directly drained.
Worst case
A malicious or compromised upgrade authority pushes bad program code, or a fresh long-tail/permissionless pool gets its oracle manipulated the way USDH was in 2022. In the first case, deposits across markets are at risk because the program is upgradeable and the admin config is unverified. In the second case, damage is contained to the affected isolated pool, and the 2022 precedent is that the treasury covered it and funds were restored rather than users eating the loss. The governance episode adds a softer worst case: the DAO has once voted to reach into an individual account, so position sizing and staying in the vanilla main pool are your mitigations.
Bottom line
Caution. Save works, and the 2022 loss was absorbed by the treasury and later restored without hitting user wallets, but the fund-loss surfaces each carry a real, documented flaw: stale and incomplete audit coverage on an upgradeable program, a live oracle-manipulation class on long-tail pools (with Switchboard still in the current price path as backup), an admin-config flaw that was actually exploited once in 2021, and a governance layer that has once voted to seize an account. None is an active drain today, which keeps it off avoid, but the combination is why it is not solid. Size small, stick to the main pool, and re-check the admin multisig and a fresh audit before scaling in.
Data appendix
- TVL: ~$68M (DeFiLlama, "solend" slug, 2026-07-01, verified input). 90d / ATH trend: down materially from peak; exact figures refresh.
- Audits: Kudelski (base spl-token-lending) and a Soteria scanner run; the audit doc carries no dates and predates the rebrand. Post-rebrand Save code audit: refresh (none confirmed).
- Admin / governance: Upgradeable Solana program; SLND-token DAO. Public risk docs do not state signer set / threshold / timelock; exact config refresh (not verified on-chain this run).
- Oracle: Per current Save docs, Pyth is the main feed and Switchboard the backup for liquidations, so both are live. Switchboard reading a manipulated Saber USDH price was the Nov 2022 exploit vector on isolated pools.
- Holder concentration: SLND governance token; June 2022 SLND1 vote reportedly saw one wallet buy ~$700k of voting power (~90% share), consistent with the ~1% quorum it passed on. Current distribution refresh.
- Recent-news scan (2026-07-01): Aug 2021 UpdateReserveConfig auth-check exploit (confirmed, patched in ~1.5h); June 2022 SLND1/SLND2 governance overreach (confirmed, reversed); Nov 2, 2022 $1.26M oracle exploit (confirmed, treasury absorbed, funds later restored, no user wallets hit); no major post-rebrand (2024-2026) Save exploit found this run. Maintained monthly. Methodology: DeFi Research Instruction v2.