TL;DR
Tydro reports its own market id on chain as "Aave V3 Ink Whitelabel Market". It is a licensed Aave deployment on Ink, the Kraken-incubated OP-stack L2, live since October 2025. This month's lookups went into the admin surface and the oracle, and both came back with more detail than we have ever had. The 48-hour timelock is real, and this run went past reading the setting to reading the receipts: the last four executed payloads sat in the queue for 48.0, 48.0, 48.1 and 51.1 hours against a recorded delay of exactly 172,800 seconds. That is the single best thing about this protocol. Three things came back worse than the draft of this report had them. The rsETH bad debt Aave modeled for this deployment was larger than the secondary coverage we relied on last time said. The oracle has no fallback configured and prices two BTC wrappers off the raw BTC feed. And the deposit base has thinned to where one pooled vault holds 53% of the largest market. No money has been lost here, and I can measure that rather than assert it. Whether you can leave on your own schedule is still the open question.
Checklist
Audits and contracts. The code is upstream Aave, pool revision 11 read directly from the Pool proxy, which is the most reviewed lending codebase in DeFi. Our July report and this month's draft both called it v3.3. That is wrong. The live implementation exposes approvePositionManager, renouncePositionManagerRole, isApprovedPositionManager, multicall and UMBRELLA, which are the Aave v3.4 position-manager API and do not exist in v3.3. It is v3.4 or newer; the exact release tag is unconfirmed. Tydro's own deployment audit is a separate question and it stays unanswered for a second consecutive month. The FAQ says contracts "have been audited and formally verified by third parties". The docs risks page says they "undergo audits and security reviews". Neither names a firm or links a report, the docs path for security and audits returns a 404, and DeFiLlama lists zero audits. No bug bounty surfaced either. One more thing you can check yourself: the published address list at docs.tydro.com names an L2PoolInstance that reads revision 9, while the Pool proxy actually points at a different implementation reading revision 11. The documentation is one upgrade behind the chain.
Admin control. Traced end to end and then tested against history, and it is the most useful section in this report. POOL_ADMIN and DEFAULT_ADMIN on the ACLManager are held by exactly one address, an Aave Executor contract. I confirmed that two ways, by hasRole calls and by replaying the ACLManager's entire role history, which is fifteen events and fits on one page. Three roles, FLASH_BORROWER, BRIDGE and ASSET_LISTING_ADMIN, have never been granted to anyone. The Executor is Ownable with no delay of its own, and its owner is a PermissionedPayloadsController whose execution delay for the only configured access level reads 172,800 seconds. Forty-eight hours on every listing, parameter, oracle and implementation change. The loop closes twice over: that controller's owner is the Executor itself, so setExecutionDelay cannot be called except through the controller's own queue, and the controller's proxy admin is also owned by the Executor, so upgrading the timelock away costs 48 hours of public notice too. Then the part that matters most, because a configured delay and an enforced delay are different claims: payloads 25 through 28 each carry a recorded delay of 172,800 seconds and each was executed 48.0 to 51.1 hours after it was queued, all four created by the same Safe. What keeps this yellow is the layer above. The payloads manager and the guardian are the same 4-of-9 Safe, so whoever proposes a change is also whoever can cancel one. A separate 4-of-10 Safe holds EMERGENCY_ADMIN and can pause instantly with no delay, which is deliberate and is exactly how the six-day May freeze happened. Those two Safes share eight signers, and across both there are eleven distinct addresses, none of them publicly identified and none of them listed anywhere in Tydro's docs. Four people out of eleven can stop the market today and change it in two days. Four automated agents, a RiskSteward plus rates, supply-cap and borrow-cap agents, all verified contracts, hold RISK_ADMIN and move parameters with no delay at all.
Oracle. This was marked for refresh last month and this run resolved most of it, which improved the picture in one direction and worsened it in another. Every one of the thirteen assets resolves through the AaveOracle to a Chainlink EACAggregatorProxy, either directly or through one of Aave's standard capped adapters, and the contract names confirm that on chain rather than taking the docs' word for it. Prices are fresh and the liquid staking assets carry normal exchange rates against ETH, so nothing reads stale or mispriced. That is the post-incident configuration, after the previous provider, Chaos Labs, was compromised on May 4, 2026. Three gaps. First, getFallbackOracle() returns the zero address, so there is no fallback configured at all; if a feed goes stale or reverts, the oracle reverts with it. Second, kBTC and SolvBTC are both priced straight off the raw BTC/USD feed with no exchange-rate or cap adapter, unlike weETH, wrsETH and ezETH which all get capped rate adapters. That is about $19.2M of BTC-wrapper collateral at 70% to 72% LTV whose depeg from BTC would be invisible to the oracle. Third, USDe is priced off the same capped USDT adapter as USD₮0, and GHO is priced by a GhoOracle returning a hardcoded 1.00 dollar. GHO is not usable as collateral here, so that one is largely benign. Separately, RedStone announced on August 6, 2026 that it is becoming an "official failsafe price data layer" for Tydro. As of this run it is not visible anywhere in the AaveOracle wiring, and the fallback slot is empty. Announced is not deployed.
Liquidity and exit. The weakest surface. About 52.9% of the aUSDC supply sits with one address, and the top five hold roughly 96%, across only 1,553 holders. This run identified that address, which last month's draft could not: it is a Veda BoringVault named "Balanced Yield USDC", a pooled product with $20.75M of its own supply across 3,540 depositors, run through a roles-based authority contract. The second-largest aUSDC holder is its sibling, "Boosted Yield USDC". That is worth knowing because it changes the shape of the risk rather than the size of it. This is not one whale who might get bored. It is an allocator whose whole job is to move capital when rates move, which makes a fast, mechanical exit more likely, not less. Meanwhile the USDC market runs at 59.4% utilization, USD₮0 at 80.7% and WETH at 80.8%. Put those together and the largest depositor cannot leave without pinning the market at full utilization and making everyone behind them wait on borrower repayment. The demonstrated case is worse still: in May, every depositor was locked out for six days regardless of utilization. The trend does not help. TVL is down about 73% in 90 days and about 89% from the January peak, including an eleven-day stretch in June that took it from $183.1M to $62.8M.
Yield: real versus emission. Last month's draft said supply APYs "run from 0.04% to 2.60%", and that quietly flattered the picture. Six of the thirteen reserves pay exactly zero, including wrsETH at $13.2M, sUSDe at $6.9M, SolvBTC at $6.5M and syrupUSDT at $4.8M. About $33.2M of the roughly $106.3M supplied earns no interest at all. The seven reserves that do pay run 0.04% on kBTC to 2.60% on GHO and USD₮0. That is genuine borrow interest and it is thin. The draw is INK points ahead of a token generation event, and the timing deserves more skepticism than we gave it. The July to September 2026 window that keeps getting quoted traces to an informal estimate from an ecosystem advisor, not to Kraken or the Ink Foundation, whose own guidance is that the token comes "after sufficient ecosystem maturity". Some analysts read that as late 2026 or 2027. One thing worth knowing if you are reading our lending board's top line: GHO carries the joint-highest supply APY at 2.60%, but per the published weekly points split it draws only 3% of the points while USD₮0 takes about a third. The best headline rate is on the asset the incentive program cares least about.
Holder concentration. Tydro has no token, so this is depositor concentration. aUSDC has 1,553 holders with the largest at 52.9% and the top five at about 96%. aGHO has 404 holders with the largest at 43.8%, and that one is a plain wallet, not a contract. aUSDT0 is the healthiest of the three: 7,438 holders, largest 17.1%, top ten 52.9%. Percentages are computed against on-chain totalSupply, but treat them as approximate: aToken balances rebase continuously, and the explorer's holder snapshot runs slightly hot, enough that its top ten aUSDC entries alone sum to 100.3% of live supply.
Track record. Ten months live, no exploit, and the single strongest fact in this report: total realized deficit across all thirteen reserves is 0.027592 USD₮0 plus 0.046337 GHO, about seven cents. Aave records bad debt explicitly through per-reserve deficit accounting, so that is a measurement rather than an inference. No reserve is paused right now either. It needs context, and this run sharpened the context in a bad direction. When KelpDAO was exploited on April 18, 2026, Tydro's Ink deployment was one of seven Aave markets with material rsETH exposure, and Aave's own incident report of April 20 modeled the damage to this deployment at $1,722,722 in the uniform-socialization scenario and $13,925,510 if losses were isolated to L2s, against a WETH aToken supply of $77.37M, a shortfall of 2.23% or 18.00%. Last month's draft put that range at "about $0.9M to nearly $10M", which came from secondary coverage that misquoted the very report it cited; I read the report directly this time and both ends were wrong. The distance between that model and today's zero was closed by DeFi United, a relief effort that gathered tens of thousands of ETH in pledges from Aave, Lido, EtherFi, Ethena, Mantle, the Ink Foundation and others to restore rsETH backing. It was not closed by anything in Tydro's own design. The wrsETH reserve is still listed, frozen, borrowing disabled, LTV set to zero and liquidation threshold to 0.1%, still holding 6,494.50 wrsETH worth about $13.2M. Our July report described Tydro as "untouched" by that incident. It was not, and that correction stands.
Worst case
Nothing in the admin path can move funds in under 48 hours except a pause, and I have now watched that 48 hours actually elapse four times, so the delay is a fact rather than a setting. The pause is the realistic bad day: a 4-of-10 Safe freezes the pool, you watch your position for a week, and May says that is precedent rather than hypothesis. The slower path is uglier. Because the proposer and the canceller are the same Safe, compromising four keys out of nine gives an attacker both the power to queue a malicious payload and the power to block its cancellation, so you would get 48 hours of warning and no on-chain party with standing to stop it. A quieter path runs through the oracle: with no fallback configured and two BTC wrappers priced off the raw BTC feed, either a stalled feed or a wrapper depeg produces the wrong answer or no answer, and $19.2M of collateral sits behind that. The likeliest ordinary loss involves no keys and no oracle at all: the Veda vault reallocates, utilization pins, and your exit waits on borrower repayment in a market that has already shed three quarters of its size this quarter. There is no insurance fund and no Aave DAO safety module standing behind this deployment.
Bottom line
Caution, same verdict as July, for materially different reasons in both directions. The admin surface is better than we described it and is now verified rather than assumed: a genuine 48-hour timelock over everything, enforced on real payloads, with the path to shortening the timelock also delayed by it. What holds it down is the other end. An audit claimed twice and named zero times, over documentation that is a version behind the chain. An oracle with an empty fallback slot and two BTC wrappers on a raw BTC feed. A depositor base where one vault is half the biggest market and the pool has lost 73% of its size in a quarter. A record that includes a six-day freeze and a shortfall someone else helped pay for. Small, monitored position, sized so that a week of being locked out is an inconvenience rather than a problem. Do not count the points as yield until the token exists, and do not count on the token existing this quarter.
Data appendix
- TVL: $56.07M (DeFiLlama, slug
tydro). 90d ago $205.42M on 2026-05-14, about -72.7%. ATH $506.13M on 2026-01-15, about -88.9%. 90d high $210.97M (2026-05-15), 90d low $51.47M (2026-08-05). Borrowed $44.95M. The June cliff ran 2026-06-02 to 2026-06-13, $183.1M down to $62.8M, about -65.7%. - Model: "Aave V3 Ink Whitelabel Market" (
getMarketId, read on chain). Pool proxy 0x2816cf15F6d2A220E789aA011D5EE4eB6c47FEbA, implementationL2PoolInstance0x6a056dA055C616cd89dBcd0dC4b3f4E0F6162eb6,POOL_REVISION11, exposingapprovePositionManager/renouncePositionManagerRole/isApprovedPositionManager/multicall/UMBRELLA, so v3.4 or newer, not the v3.3 we said in July. Exact release tag: refresh. Live since Oct 2025 (DeFiLlamalistedAt2025-10-16). Thirteen reserves on chain: WETH, kBTC, USD₮0, USDG, GHO, USDC, weETH, wrsETH, ezETH, sUSDe, USDe, SolvBTC, syrupUSDT. None currently paused. - Audits: No firm named and no report linked anywhere found. tydro.com/faq claims third-party audits and formal verification; docs.tydro.com/resources/risks claims audits and security reviews; docs.tydro.com/resources/security-and-audits returns 404 (checked this run); DeFiLlama lists 0. Underlying Aave audits are public. Deployment-specific reports: refresh. Note also that docs.tydro.com/resources/addresses publishes
L2PoolInstance0x2aB3580a805fB10CbAd567212C70e26C1B6769eC, which readsPOOL_REVISION9, while the Pool proxy points elsewhere at revision 11. - Admin/governance: ACLManager 0x86E2938daE289763D4e09a7e42c5cCcA62Cf9809. Full role history is 15 events. Current holders: POOL_ADMIN and DEFAULT_ADMIN, Executor 0x1dF462e2712496373A347f8ad10802a5E95f053D only (also the owner of PoolAddressesProvider 0x4172E6aAEC070ACB31aaCE343A58c93E4C70f44D); EMERGENCY_ADMIN, Safe 0x00C2B13eF4F70Bf1827179Fe6d8facF7cFf6AcD2 only, 4-of-10, no delay, pause only (moved there from the 4-of-9 Safe on 2025-08-11); RISK_ADMIN, four verified contracts with no delay, RiskSteward 0xC1d38a1c (granted 2026-06-05, replacing an earlier RiskSteward revoked the same block), AaveRatesAgent 0x050E8Fc9, AaveBorrowCapAgent 0x32fF33C9, AaveSupplyCapAgent 0xA2430ab7 (all 2026-03-04); FLASH_BORROWER, BRIDGE and ASSET_LISTING_ADMIN never granted to anyone. Executor's owner is PermissionedPayloadsController 0x1dE9CB9420Dd1f2cCeFFf9393E126b800D413b7A (impl 0xCCCcf90C363Eaf09dD89DD5330C1287Ff6a945Ee), access level 1 delay 172,800s (48h), grace 7d, expiration 35d, 29 payloads to date,
MIN_EXECUTION_DELAY0 andMAX_EXECUTION_DELAY604,800s. ItspayloadsManagerandguardianare the same 4-of-9 Safe 0x2e8090716C5a25332cf963d454250B88bf04E6dC. Delay enforcement measured, not assumed: payloads 28, 27, 26 and 25 each record delay 172,800s and executed 48.08h, 48.09h, 48.02h and 51.08h after queuing, all created by that Safe. The controller's ownowner()is the Executor, and its proxy admin 0x8a2de8be84a4c1650c6d225c31db28277adf1fc8 is also owned by the Executor, so the delay cannot be shortened or upgraded away without 48h notice. Both Safes are v1.4.1, threshold 4, sharing 8 signers for 11 distinct addresses. Signer identities: refresh. No Executor, Safe or timelock appears in Tydro's published address list. Not governed by Aave DAO. - Oracle: AaveOracle 0x4758213271BFdC72224A7a8742dC865fC97756e1 (labelled TydroOracle in the docs), verified on Ink, base currency unit 1e8,
getFallbackOracle()= 0x0, no fallback set. Sources traced for all 13 assets, all rooting to ChainlinkEACAggregatorProxycontracts: WETH direct ETH/USD 0xcc2cbec9; USDC direct USDC/USD 0x89991637; kBTC and SolvBTC both direct BTC/USD 0xcd4d9b45 with no exchange-rate or cap adapter; USD₮0 and USDe bothPriceCapAdapterStable0x00f5c1a7 over USDT/USD with a $1.04 cap; USDGPriceCapAdapterStable0x32b1f1a1 over USDG/USD, same cap; weETH, wrsETH, ezETH, sUSDe, syrupUSDT allCLRatePriceCapAdapterover a Chainlink base feed plus a Chainlink exchange-rate feed, snapshot delays 7d or 14d; GHO aGhoOracle0x20fd5f3f returning a hardcoded 1.00. Chaos Labs was primary through 2026-05-11, Chainlink from 2026-05-12 (DeFiLlama oracle registry, with an on-chain migration tx as proof). RedStone announced 2026-08-06 as an official failsafe layer; not present in this wiring as of this run. Per-feed heartbeats and deviation thresholds: refresh. - Bad debt: Total realized deficit across all 13 reserves is 0.027592 USD₮0 plus 0.046337 GHO, about $0.07. Read via
getReserveDeficiton every reserve. wrsETH is frozen, borrowing disabled, LTV 0, liquidation threshold 0.1%, 6,494.4953 wrsETH still supplied, about $13.2M at the oracle's $2,026.95. - rsETH incident (Aave governance report, April 20, 2026, read directly this run): Ink (Tydro whitelabel) was one of seven Aave markets with material rsETH exposure out of eleven that listed it. Scenario 1, uniform socialization at a 15.12% haircut: bad debt $1,722,722 / 744.49 WETH, aToken supply $77,368,235 / 33,435.23 WETH, shortfall 2.23%. Scenario 2, losses isolated to L2s at a 73.54% haircut: bad debt $13,925,510 / 6,018.01 WETH, shortfall 18.00%. The report does not enumerate Ink-specific attacker positions; the attacker's 89,567 rsETH deposits went to Ethereum Core (53,400) and Arbitrum (36,167). The "$21M rsETH collateral against $19.36M wETH debt in two leveraged wallets" figure is from secondary coverage only. Resolution came via DeFi United, launched 2026-04-24 to cover an estimated 118,000 ETH shortfall, with roughly 69,500 ETH pledged including 25,000 from the Aave DAO and over 10,000 from LayerZero; the Ink Foundation publicly confirmed contributing alongside Aave and Tydro.
- GHO exposure: GHO on Ink is 0xfc421ad3c883bf9e7c4f42de845c4e4405799e73, an
UpgradeableGhoTokenbehind aTransparentUpgradeableProxy, chain supply 3,500,747.31 GHO. Tydro holds 1,950,883.01, about 55.7% of every GHO on Ink. Reserve config: not usable as collateral (LTV 0, LT 0), borrowing enabled, supply APY 2.60%, borrow APY 4.20%, 1,341,722.57 borrowed for 68.8% utilization, matching our lending board's 2.60% top-APY reading. Upgrade authority resolved this run: proxy admin 0x06ba20fb, owned by Executor 0x47aadaae, owned by PayloadsController 0x44d73d7c with guardian 0x1bbcc6f0. That is Aave's own cross-chain governance stack, a separate trust assumption from the rest of this market. - Utilization (on chain): WETH 80.8%, USD₮0 80.7%, GHO 68.8%, USDG 65.3%, USDC 59.4%, USDe 44.1%, kBTC 9.7%. The other six reserves have no borrowing at all.
- Supply / borrow APY (on chain): USD₮0 2.60 / 3.58, GHO 2.60 / 4.20, USDG 1.85 / 3.15, USDC 1.41 / 2.64, WETH 1.23 / 1.79, USDe 0.73 / 2.21, kBTC 0.04 / 0.86. weETH, wrsETH, ezETH, sUSDe, SolvBTC and syrupUSDT all pay 0.00, about $33.2M of supply.
- Holder concentration: aUSDC (aInkWlUSDC) 1,553 holders, top1 52.85%, top5 95.65%; top1 is Veda
BoringVault"Balanced Yield USDC" 0xcaae49fb, itself $20.75M across 3,540 holders under aRolesAuthority, and top2 is its sibling "Boosted Yield USDC" 0xDbD87325. aGHO 404 holders, top1 43.82% (an EOA), top5 80.14%. aUSDT0 7,438 holders, top1 17.10%, top10 52.87%. Computed against on-chaintotalSupply; the explorer snapshot runs about 0.3% hot, its aUSDC top ten summing to 100.33%. - Incentives: INK TGE still not executed. The July to September 2026 window traces to an informal ecosystem-advisor estimate, not to Kraken or the Ink Foundation, whose guidance is "after sufficient ecosystem maturity"; some analysts read that as late 2026 or 2027. Season 2 points are live and running until TGE. Current weekly split, 218,000 points: USD₮0 33%, WETH 24%, kBTC 23%, USDC 11%, USDG 6%, GHO 3%. Conversion terms: refresh.
- Recent-news scan: No Tydro security event found between 2026-07-02 and this run. One thing did happen that last month's scan would have missed: RedStone's 2026-08-06 announcement of a failsafe pricing layer, discussed above. The two events on record remain the April 18 KelpDAO rsETH exploit and the May 4 Chaos Labs oracle-provider compromise, where markets were paused May 4 and resumed around 00:00 UTC on May 10 after a 48-hour timelock expired at 23:52 UTC on May 9, six days, with a four-hour no-liquidation grace period and no bad prices reaching the pool. Carrying forward from July: tydro-v2.com still serves a Tydro-branded page, still is not linked from tydro.com, and hosts its own wallet-connect while borrowing the real docs, X and legal-page links for credibility. It also claims the protocol has "no withdrawal gate", which the six-day May pause refutes. Treat as possible phishing and do not connect a wallet there. Note that RedStone's official blog refers to a "Tydro v2" market, so the name may be legitimate; that is not evidence the domain is.
- Board reconciliation: Our /lending board reads $87.3M supplied across 11 markets with $44.0M borrowed. On chain I count 13 reserves, about $106.3M supplied and about $45.2M borrowed, netting about $61.1M against DeFiLlama's $56.07M. The borrowed figures agree within rounding; the supply and market-count gaps are unexplained. The $5.0M DeFiLlama gap is close to the size of the syrupUSDT reserve ($4.75M), which would be consistent with a pricing omission, but I did not confirm that. refresh.
Maintained monthly. Methodology: DeFi Research Instruction v2.