Loading…
Case study · DeFi
A top-50 DeFi lending protocol survived a near-miss exploit and asked us to re-architect the protocol for institutional-grade resilience. We rebuilt collateral management, risk parameters, and governance — coordinated three external audits, formally verified critical invariants, and shipped a phased relaunch under explicit TVL caps that expanded as the protocol earned trust under load.
The challenge
The protocol had survived a near-miss exploit by minutes — a researcher had disclosed a critical vulnerability through responsible disclosure rather than exploiting it. The original implementation had elements of the architectural anti-patterns the post-mortem corpus has documented: oracle assumptions that broke under stress, risk parameters set during a calm market, and a governance design that centralized through omission.
Our approach
We started with a complete threat model. Stress scenarios documented (March 2020, May 2021 LUNA, June 2022 Celsius / 3AC, March 2023 USDC depeg) were modeled against the proposed architecture. Risk parameters were calibrated against worst observed conditions, with explicit safety margins.
Replaced single-source price feeds with multi-source oracle aggregation: Chainlink primary, Pyth secondary, on-chain TWAP fallback for manipulation resistance, time-windowed freshness checks, and explicit fallback behavior when feeds disagree by more than threshold.
Coordinated three external audits with three different reputable firms (sequential, not concurrent, so each could review the prior remediation). Formal verification of critical invariants (collateralization invariants, liquidation correctness, governance time-locks) using Certora.
The solution
Production protocol: re-architected collateral management with explicit per-asset risk envelopes, multi-source oracle aggregation, governance with 5-of-9 multisig + 48-hour time-locks on parameter changes, and operational tooling for treasury management and incident response.
Results
The protocol relaunched in May 2025. By the time the TVL cap fully lifted in November 2025, the protocol had operated 12+ months without a security incident, scaled to $340M TVL, and survived two market stress events that exposed weaker protocols. Three external audit firms have signed off on the post-launch state. The formal verification properties continue to hold.
Stack
Talk to us
A senior engineer plus the relevant department lead joins the first call. No discovery gauntlet, no junior reps.