TL;DR
Symbiotic is the base layer, not the product. You deposit one collateral asset into a vault, a curator points that collateral at networks, and a network's middleware can slash it. Two things changed since the last review. The protocol pivoted on 1 July 2026 with Core V2, which routes idle vault capital into outside lending venues through adapters for Aave V3, Morpho and Euler, and the collateral book kept shrinking: $337.35M today against a $2.70B peak in December 2024, down 87.5%. The audit stack is one of the deepest in the sector, with 17 reports from 8 firms sitting in the public repo, and no exploit has ever hit a Symbiotic contract. What I could not make clean is admin control. Read on-chain today, a 2-of-3 Gnosis Safe whose three signers are plain externally owned accounts owns the factory that decides which code a vault may be upgraded onto, and it also owns the registry that can switch on protocol fees of up to 5% a year plus 20% of performance. There is no timelock anywhere in either path.
Checklist
Audits and contracts. Verified 17 audit PDFs in the symbioticfi/core repo from 8 firms: Statemind, ChainSecurity, Zellic, OtterSec, Certora, Cantina, Bailsec and OpenZeppelin, with Core V2 covered by three of them (Statemind-CoreV2, Bailsec-CoreV2, Bailsec-CoreV2Extension). A further two, from ChainSecurity and Statemind, sit in the collateral repo covering DefaultCollateral. I confirmed the files and their names; I did not open the PDFs to grade findings this run. There is also a live Immunefi bug bounty paying 10% of funds directly affected for a critical smart-contract bug, capped at $500,000, which against a $337M book is a modest cap rather than a meaningful backstop. One correction to the previous report, and a correction to my own first pass at it: the factories and registries are non-upgradeable plain contracts, and vaults are proxies, but not all of them are upgradeable. Reading MigratableEntity.sol, initialize only assigns an owner if the deployer passed a non-zero address, and migrate requires the caller to be that owner. A vault deployed with a zero owner, or whose owner later renounces, can never be migrated. Whether your vault is upgradeable is a per-vault fact you have to check, and the docs describe both modes deliberately.
Admin control. Read from Ethereum mainnet on 2026-08-12. One Safe at 0x5721Ce64Ee0D772ce613b62D411350091C544CD0 owns the VaultFactory, DelegatorFactory, SlasherFactory, the V2 UniversalDelegatorFactory, the WithdrawalQueueFactory and the ProtocolFeeRegistry. It is Safe v1.3.0, threshold 2, three owners, all three of which return empty code, so there is no nested multisig quietly raising the real bar. I also checked the inverse, which the previous report did not: getModulesPaginated returns an empty list, so no enabled module can bypass the two-signature threshold either. No timelock sits between that Safe and anything it owns. Reading MigratablesFactory.sol, the Safe controls whitelist and blacklist, while migrate requires the caller to be the individual vault's own owner. So no single key rewrites your vault, but two Safe signatures plus one vault owner do, instantly, with no user opt-out.
Two things the previous report missed. First, this is not the only admin surface. The V2 AdapterRegistry at 0x788823C9579A049D986eB76718bC758C0998594a, whose setWhitelistedStatus decides which adapter a given vault may route collateral through, and therefore which outside venue ends up holding your money, is owned by a different Safe at 0xf6bb2e64bd201a862f2fe5461fc7ef01e2040b6a: v1.4.1, threshold 3, five owners, all five EOAs, no modules. The surface that moves your collateral into Aave or Morpho is better protected than the surface that decides what code your vault runs. Second, the ProtocolFeeRegistry lets the 2-of-3 Safe set a protocol management fee and performance fee, globally or per vault, capped in code at 5% a year and 20% of performance. Both are currently zero and the receiver is unset, verified on-chain today, but they can be turned on in one transaction with no notice.
One question the previous report left open is now closed, and the answer is worse than an oversight: it is documented behaviour. Neither MigratablesFactory.create, MigratablesFactory.migrate nor Factory.create ever reads the blacklisted flag. Symbiotic's own NatSpec in IFactory.sol says of blacklist, "The given type will still be deployable." Since whitelist only adds to an append-only set and there is no removal function, there is no on-chain way to retire a bad implementation once it is whitelisted. The blacklist is a signal to integrators, not a kill switch.
The good half of the picture is real. The NetworkRegistry and OperatorRegistry expose no owner at all and are permissionless, vault creation is permissionless, and ownership of the factories was moved off the deploying EOA onto the Safe.
Oracle. Symbiotic's share accounting is not driven by a price feed, and slash amounts are set by the network rather than read from an oracle, so the classic manipulation vector is absent at the core. Core V2 widens this: collateral routed through the Aave V3, Morpho or Euler adapters inherits those venues' oracles, and the Liquid Lane tokenized-asset products carry their own. Per-vault feeds not enumerated this run.
Liquidity and exit. Withdrawal is request then claim. The docs are explicit that requests "become claimable after the end of the next vault epoch" and that until that boundary "the requested amount remains eligible for slashing", so starting to leave does not stop the loss. Epoch length is a per-vault parameter fixed at deployment, which puts the structural delay at one to two full epochs. Seven days is the commonly cited setting but it is not a protocol constant. Core V2 adds a recall dependency, because collateral parked in an outside lending market has to be pulled back before it can serve an obligation or an exit.
Yield: real vs emission. Real. You keep the underlying asset's yield, networks pay rewards directly to stakers, and V2 adds lending yield. There is no token and no emissions program propping up the number, and DeFiLlama carries no market cap or CoinGecko id for Symbiotic. Points have run since June 2024 with no committed token and no guaranteed airdrop, so treat them as a lottery ticket rather than income. Note also that protocol fees are currently zero by setting, not by design, and can be raised to 5% plus 20% of performance without warning.
Holder concentration. No governance token exists, so the meaningful measure is the collateral book, and it is lopsided. uniBTC is 48.4% of it, and BTC wrappers together (uniBTC, LBTC, solvBTC, plus dust in wBTC, tBTC and iBTC) are 59.9%. uniBTC is Bedrock's wrapper, which was itself exploited for roughly $2M in September 2024 through a mint path that accepted ETH as though it were BTC. Vaults are siloed by collateral, so a wstETH depositor is not exposed to uniBTC, and that siloing is why this is not scored red. Anyone sitting in the dominant asset should understand that they are the book.
Track record. Mainnet since 28 January 2025, roughly 18 and a half months, and the protocol has held user deposits since June 2024, roughly 26 months. I found no exploit of Symbiotic's own contracts, no reported slashing loss, and DeFiLlama's hacks list for the protocol is empty. The previous report called this a clean record, and that was too generous. Around 22:00 UTC on 4 October 2024 the official @symbioticfi X account was hijacked and used to post links to a site impersonating symbiotic.fi, which told visitors they had earned thousands of points and prompted a signature that drained their wallets. Symbiotic disclosed it within the hour and engaged SEAL, but reporting has the account still compromised as late as 7 October. No contract was touched and the code was never at fault, and it is exactly the kind of incident that costs retail users money. Against the rest of the record: the book is down 30.6% over 90 days, 76.4% year over year and 87.5% from the December 2024 peak, wstETH alone is down 91.3% year over year, and the product itself was repositioned six weeks ago.
Worst case
Three separate paths. The governance one: two of the three signer EOAs are compromised, a malicious vault implementation gets whitelisted, and a vault owner who is compromised or complicit migrates a live vault onto it. No timelock means no warning window and no chance to withdraw first, the epoch delay means you could not have left quickly anyway, and blacklisting the bad version afterwards does not stop anyone deploying or migrating onto it. The economic one, which needs no compromise at all: the same two signatures set a 5% annual management fee and a 20% performance fee on V2 vaults, effective on the next block. The designed one: a network your vault serves submits a slashing request through its middleware, an InstantSlasher executes it with no dispute window, and your principal is cut. A resolver can veto only if the vault wired one in with a non-zero vetoDuration and acts inside it, and once a slash executes the docs describe no appeal and no reversal. Where the money goes then depends on the vault's Burner: the docs say burning is optional and redistribution to a counterparty is a valid outcome. Layer on Core V2, which is six weeks old and now has your collateral sitting in Aave, Morpho or Euler between obligations. There is no protocol insurance fund; the Slashing Insurance Vaults primitive Symbiotic published in July 2025 is third-party underwriting capital, not a protocol-owned backstop, and it does not cover you by default. Vault choice and position size are the whole mitigation.
Bottom line
Caution, the same call as last time but on much better evidence, and on one worse fact. The audit depth is real, the contract-level incident record is genuinely clean, and the yield is not emissions. What holds it back is that the upgrade path over depositor funds runs through two signatures on three EOAs with no delay, that the same two signatures can switch on a 5% fee, that a whitelisted implementation cannot be retired on-chain by design, that slashing is a designed loss with no recourse once executed, and that the collateral book has shrunk to roughly an eighth of its peak while concentrating into a single BTC wrapper. Nothing here is fraudulent or broken. It is thin governance under a shrinking book, which is a position-sizing problem rather than an avoid.
One boundary is worth stating plainly, because Mellow is reviewed in the same batch. Symbiotic holds the collateral, enforces delegation limits, and executes slashing requests. Mellow sits above it as a curator, choosing which Symbiotic networks and operators to back, running leverage, and batching withdrawals. The previous report attributed the April 2026 EarnETH freeze to a Mellow-layer failure, and that is not what happened. EarnETH is a Lido vault managed by Veda and Mellow; on 18 April 2026 an attacker used a forged cross-chain message to release roughly 116,500 rsETH, about $292M and around 18% of supply, from Kelp, and EarnETH's roughly $21.6M leveraged rsETH position on Aave, about 9% of the vault, was impaired as a result. Deposits and withdrawals were suspended and Lido applied a $3M first-loss backstop. The root cause was an external protocol exploit, amplified by curator leverage, and Symbiotic's contracts were not involved either way. The exposure is still one-directional. Deposit through a curator and you own both layers of risk, the curator's judgement and Symbiotic's slashing and upgrade surface. Deposit directly into a Symbiotic vault and you do not inherit the curator's.
Data appendix
- TVL: $337.35M. DeFiLlama's daily series reads $338.45M on 2026-08-11 and $337.87M at the 2026-08-12 daily close, with an intraday re-pull at 10:15 UTC on 2026-08-12 reading $340.54M. The spread is hours of drift, not a discrepancy; the checks below use the verified $337.35M. 90d: $486.11M on 2026-05-14, down 30.6%. 1y: $1,428.93M on 2025-08-12, down 76.4%. ATH: $2,700.50M on 2024-12-07, down 87.5%. The recent trough was $289.43M on 2026-07-01, so the book is up 16.6% off that low and up 5.0% over 30 days. Ethereum only; DeFiLlama now categorises the protocol as Collateral Management. The decline is a multi-quarter grind, not one event: the largest single-day drop in the last 200 days is 14.2%, on 5 to 6 February 2026, which is consistent with outflows and price rather than a hole.
- Collateral composition (DeFiLlama token breakdown, 2026-08-12 snapshot summing to $340.54M, 40 assets): uniBTC $164.77M (48.4%), wstETH $69.69M (20.5%), LBTC $27.67M (8.1%), rETH $18.26M (5.4%), weETH $16.62M (4.9%), solvBTC $11.12M (3.3%), SPK $8.95M (2.6%). BTC wrappers combined are 59.9%. A year ago wstETH was $802.34M and 56.1% of the book, so ETH collateral is down 91.3% and the book has rotated into BTC wrappers. Correcting the previous report: mETH is not gone, it is down from $185.09M to about $0.33M, a 99.8% decline, which is functionally the same story told accurately.
- On-chain scale (2026-08-12): VaultFactory reports 357 vaults created all-time and 3 whitelisted vault implementations. DelegatorFactory carries 4 delegator types, SlasherFactory 2 (matching the instant and veto slashers in the docs), UniversalDelegatorFactory 1 and WithdrawalQueueFactory 1. NetworkRegistry lists 82 registered networks and OperatorRegistry 301 registered operators. Registration is cumulative and permissionless, so these are not activity counts; Symbiotic's own copy claims 80+ vaults, 74,000+ stakers and 111 operators active, with Chainlink, Nexus Mutual and Cap Labs in production.
- Audits: 17 PDFs in github.com/symbioticfi/core/audits from 8 firms: Statemind (Core&Rewards, CoreV2, 3F), ChainSecurity (Core), Zellic (Core), OtterSec (Core&Rewards), Certora (Core), Cantina (Core), Bailsec (CoreV2, CoreV2Extension, 3F, Euler&Pareto, LiquidLane&Reactor, LiquidLane:Centrifuge, LiquidLane:Figure&OpenEden, LiquidLane:mGLOBAL) and OpenZeppelin (LiquidLane). Separately github.com/symbioticfi/collateral/audits holds ChainSecurity and Statemind reports on DefaultCollateral. File existence and names verified; report contents and finding severities not read this run. The Certora formal-verification scope is carried from the prior report and was not re-verified: refresh. Bug bounty live on Immunefi: 10% of funds directly affected for a critical smart-contract bug, hard cap $500,000; other criticals a flat $5,000; high severity capped at $100,000.
- Admin and governance (on-chain, 2026-08-12). Safe A, 0x5721Ce64Ee0D772ce613b62D411350091C544CD0, Safe v1.3.0, threshold 2, nonce 20, no enabled modules, owns VaultFactory 0xAEb6bdd95c502390db8f52c8909F703E9Af6a346, DelegatorFactory 0x985Ed57AF9D475f1d83c1c1c8826A0E5A34E8C7B, SlasherFactory 0x685c2eD7D59814d2a597409058Ee7a92F21e48Fd, UniversalDelegatorFactory 0xB5eFf01403C0dD3aDa1010919791d6EB82F6a84C, WithdrawalQueueFactory 0x6f80fd397120164e44d23B9334910C8dE41Ce4ce and ProtocolFeeRegistry 0x9983edCD02f57b8b94bD8dE9D18E614dFB964d6D. Its three owners, 0x7e0EA90788E25C2F749447DcEbcd674C01962ae1, 0xCe17dfC7ECFcE8bE1174d1BB008556417452F37c and 0x62f881757ef7560805a070b4ef902e62d66C4c78, all return empty code, so all three are EOAs, with nonces of 3, 1 and 21 (consistent with dedicated cold signing keys). Safe B, 0xf6bb2e64bd201a862f2fe5461fc7ef01e2040b6a, Safe v1.4.1, threshold 3, five owners, all EOAs, no modules, owns AdapterRegistry 0x788823C9579A049D986eB76718bC758C0998594a. No timelock contract sits in either path. NetworkRegistry 0xC773b1011461e7314CF05f97d95aa8e92C1Fd8aA, OperatorRegistry 0xAd817a6Bc954F678451A71363f04150FDD81Af9F and NetworkMiddlewareService 0xD7dC9B366c027743D90761F71858BCa83C6899Ad expose no owner and are permissionless. Signer identities and whether they are institutionally separated: refresh.
- What those owners can do. MigratablesFactory: whitelist and blacklist are onlyOwner; migrate reverts unless the caller equals the individual vault's owner. AdapterRegistry: setWhitelistedStatus(vault, adapter, status) is onlyOwner and gates which adapter a vault may use. ProtocolFeeRegistry: setGlobalFee, setGlobalReceiver and setVaultFee are onlyOwner, bounded by MAX_MANAGEMENT_FEE of 5% a year and MAX_PERFORMANCE_FEE of 20%; globalManagementFee, globalPerformanceFee and globalReceiver all read zero today. Blacklisting is advisory: neither factory's create or migrate path reads the blacklisted flag, and the IFactory NatSpec states outright that a blacklisted type "will still be deployable". Since whitelist only appends and nothing removes, there is no on-chain retirement path for a whitelisted implementation.
- Who can slash: the network's middleware submits the slashing request with subnetwork, operator, amount and capture timestamp. The Slasher validates it against captured limits but does not itself detect misbehavior. The instant Slasher validates and executes in one step with no on-chain dispute window. The VetoSlasher gives any configured resolver a vetoDuration window to block it, and resolverSetEpochsDelay controls how many vault epochs pass before a newly set resolver becomes active. Constraints exist at two levels, operator-network limits and network-resolver limits, both set by role holders, and only operators that explicitly opted into a network can be slashed. Where slashed value goes is set by the vault's Burner: the docs state that burning is optional and that redistribution is a valid outcome if it matches the vault's policy. The docs describe no appeal, reversal or depositor recourse once a slash executes.
- Slashing live? Yes. Slashing shipped feature-complete at the 28 January 2025 mainnet launch, which is what Symbiotic claimed as its first-mover point (The Block, 28 January 2025). No slashing loss at Symbiotic was found in this run's scan. Secondary reporting says mev-commit runs live slashing with no incidents across roughly 11 months and 7,813 validators; that specific figure is refresh. A widely circulated LlamaRisk assessment stating slashing is not live is dated 15 August 2024, five months before mainnet, and should not be read as current.
- Exit path: request then claim, claimable after the end of the next vault epoch, with the queued amount slashable until that boundary. Epoch length is set per vault at deployment, so the structural delay is one to two epochs. Seven days is commonly cited but is not protocol-enforced; the epoch for any specific vault is refresh.
- Oracle: not core-critical for share accounting, and slash amounts are network-defined. The V2 adapters shipped in the repo are AaveV3Adapter, MorphoVaultV2Adapter, EulerAdapter, ERC4626Adapter, LiquidLaneAdapter, ThreeFAdapter, AppAdapter and RestakingAppAdapter, and routed collateral inherits the venue's oracle. Per-vault feeds: refresh.
- Holder concentration: no governance token exists; DeFiLlama carries no CoinGecko id, no CMC id and no market cap. Collateral concentration is given above. Per-vault and per-curator TVL split: refresh.
- Incident record: no exploit of a Symbiotic contract found, and DeFiLlama's hacks list for the protocol is empty. One non-contract incident on the record: the official @symbioticfi X account was compromised around 4 October 2024 at 22:00 UTC and used to push a wallet-drainer phishing site impersonating symbiotic.fi with a fake points redemption; Symbiotic engaged SEAL within about 15 minutes of becoming aware, and reporting has the account still in attacker hands as late as 7 October. Separately, uniBTC, today 48.4% of the collateral book, is Bedrock's wrapper, exploited for roughly $2M in September 2024 through a mint path that accepted ETH at parity against BTC; security firms later tied the attacker's access to an insider at an infrastructure partner and affected parties were reimbursed. Neither incident involved Symbiotic's code.
- Recent news scan (since 2026-07-04): Core V2 launched 1 July 2026, repositioning Symbiotic from restaking to collateral markets, with idle vault capital routed into blue-chip lending protocols and recalled when obligations arise, claiming roughly 70% greater capital efficiency than standalone pools. Named participants: Nexus Mutual for insurance capacity, Cap for institutional credit, and Liquid Lane with Midas as first issuer and Fasanara Capital as initial curator. The prior report's mention of KPK as vault curator was not corroborated this run: refresh. On 7 August 2026 CoinDesk and The Defiant reported that ether.fi removed restaking exposure from weETH entirely and moved it into a separate opt-in weETHs "Super Symbiotic" track built on Symbiotic, with weETHs TVL around $17.7M, which lines up with the $16.62M of weETH in Symbiotic's book. No Symbiotic exploit, slashing loss, curator freeze or withdrawal pause was found in this run's scan. Funding: $29M Series A led by Pantera with Coinbase Ventures (April 2025) and a $5.8M seed co-led by Paradigm and cyber.Fund (June 2024), both confirmed in DeFiLlama's raise records. The share of the $337.35M currently running on V2 rails versus V1, and how much is deployed into outside lending markets right now: refresh.
Maintained monthly. Methodology: DeFi Research Instruction v2.