> For the complete documentation index, see [llms.txt](https://docs.infraredtrading.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.infraredtrading.com/learn/protocols/fluid/security.md). # Security Fluid's security posture — the audit history (PeckShield, StateMind, MixBytes, Cantina), bug-bounty status, both 2026 incidents, and the trust boundaries of the shared Liquidity Layer. Fluid's trust model is dominated by one architectural fact: **all product funds sit in a single upgradeable Liquidity Layer** per chain. That concentrates both the audit surface and the blast radius — analyzed below after the audit and incident record. ## Audits Per the [official audits page](https://docs.fluid.instadapp.io/audits-and-security.html) (fetched 2026-07-10) and [MixBytes' public audit repository](https://github.com/mixbytes/audits_public/tree/master/Instadapp/Fluid): | Auditor | Scope | Date / status | | ---------- | ----------------------------------------- | ----------------------------------------------------------------- | | PeckShield | pre-launch comprehensive audit | complete (pre-2024 launch) | | StateMind | general protocol; Liquidity Layer updates | complete (report PDF hosted on the docs site) | | MixBytes | Vault protocol | June 2024 (report PDF on the docs site + mixbytes/audits\_public) | | MixBytes | DEX protocol | complete | | Cantina | DEX protocol | complete | | MixBytes | Liquidity Layer | 2025-12-10 (mixbytes/audits\_public) | | MixBytes | Money Market Oracle | 2026-03-17 (mixbytes/audits\_public) | MixBytes' June 2024 Vault conclusion: "The protocol demonstrates a high degree of security", with the caveat that gas optimization (packed variables, BigMath) sacrificed clarity. A notable recommendation from that report — a supply limit matching market liquidity to avoid unprofitable liquidations — is consistent with an asymmetry visible in the deployed system: deposits are uncapped, and withdrawals are the throttled direction (see [Mechanics](/learn/protocols/fluid/mechanics.md)). The lending/fToken layer specifically was covered by StateMind's general audit and inherits the Liquidity Layer audit surface, since fToken funds and limits live there. ## Bug bounty No bug-bounty program could be verified for Instadapp Fluid as of 2026-07-10; the official audits page lists none. (An Immunefi listing for a similarly named "Fluid Protocol" concerns an unrelated project on the Fuel Network.) ## Incident history (as of 2026-07-10) **Fluid's core smart contracts (Liquidity Layer, Lending, Vaults, DEX) have no exploit to date.** Two 2026 incidents qualify the record — neither was a core-contract flaw, but both are relevant to integration risk: 1. **Off-chain Merkle-rewards key compromise (May 27-31, 2026).** Compromised operational keys for the off-chain rewards-distribution infrastructure drained FLUID plus \~51,900 GHO. Reported figures vary: an aggregator estimate put the total at \~$215K counting 112,883 FLUID (CoinMarketCap), while [The Crypto Times](https://www.cryptotimes.io/2026/05/31/fluid-protocol-loses-125k-fluid-51-9k-gho-in-key-compromise-attack/) reported \~125,000 FLUID and gave no USD total. The team confirmed core lending markets, vaults, and DEX were untouched. News coverage noted a disclosure gap (exploit May 27, acknowledged \~May 31), during which one large lender withdrew \~$77M USDC. Two lessons: the *reward/distributor periphery* has a different (weaker) trust profile than the audited core, and the episode is a live example of large fToken withdrawals interacting with the withdrawal limits described in [Mechanics](/learn/protocols/fluid/mechanics.md). 2. **Resolv exploit fallout (March 2026, indirect).** The Resolv protocol exploit (\~$80M unbacked mint) left Fluid markets with bad-debt exposure (reported ~~$21M); coverage credits Fluid/Instadapp with repaying the bad debt. Figures across sources conflict (~~$21M exposure vs reports of \~$70M repaid) and remain unreconciled as of 2026-07-10. Lesson: **shared-custody blast radius** — bad debt in one Liquidity-Layer market socializes toward suppliers of that token (fToken holders) until neutralized. Historical note: no incidents were located for the lending (fToken) contracts themselves since the January 2024 launch. ## Trust boundaries (integration-relevant ranking) 1. **Liquidity Layer admin = 1-day Timelock under the FLUID governor** (governance chain verified on-chain 2026-07-10; see [Deployments](/learn/protocols/fluid/deployments.md)). The layer is an upgradeable InfiniteProxy holding all funds — the single trust root for every Fluid product. Upgrade risk is timelock-gated (86,400 s). 2. **Auths (governance-appointed set, not enumerable on-chain)** can halt the entire layer (`changeStatus(2)`), instantly rewrite withdrawal limits, and retune rate curves — with no timelock on auth actions themselves. For quoting and execution this means limits read at block N are guaranteed only at block N. 3. **Guardians** can pause any pausable protocol's supply/borrow per token (`pauseUser`) — deposits AND withdrawals revert. Designed as an incident-response brake, paired with the automated expandable-limit ceilings that throttle exploit-speed withdrawals protocol-wide. 4. **fToken periphery roles are narrow:** factory auths can swap a token's rewards-rate model and rebalancer; neither touches user principal. fTokens are non-upgradeable and hold no funds. 5. **Economic risk:** fToken suppliers carry borrower credit risk of the shared pool — vault liquidation quality and the oracle quality of *other* products drawing the same token, not just lending-market risk. The Resolv event is the realized example. ## Monitoring hooks * `LogPauseUser`/`LogUnpauseUser`, `LogChangeStatus`, `LogUpdateUserWithdrawalLimit`, and `LogUpdateUserSupplyConfigs` events at the Liquidity Layer are the freeze/limit change feed. * `LendingFactory.LogTokenCreated` for new fTokens. * `rewardsActive` flips (fToken `LogUpdateRewards`/`LogUpdateRates`) change the share-price slope. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.infraredtrading.com/learn/protocols/fluid/security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.