{"investigation":{"slug":"dtrinity-dlend","entity_name":"dTRINITY dLEND","trust_score":40,"severity_base":null,"score_modifier":2,"confidence":0.72,"status":"draft","content_type":"investigation","summary":"dTRINITY is a DeFi stablecoin lending protocol developed by Trinity Foundation Ltd., a Singapore-incorporated non-profit, with dLEND serving as its Aave v3-forked lending engine. The protocol launched on Fraxtal in December 2024 and subsequently deployed on Sonic, Katana, and Ethereum. It has suffered two separate security incidents since launch — a $56,000 authorization-check exploit in September 2025 and a $257,000 deposit inflation (liquidity index manipulation) attack in March 2026 — though the team committed to covering 100% of losses from internal funds in both cases and no user funds were reported uncompensated.","sections":[{"content":"dTRINITY describes itself as the world's first subsidized stablecoin protocol. Its core components are dUSD, a decentralized stablecoin backed 1:1 by an on-chain reserve of USD-denominated stablecoins and yield-bearing stablecoins (USDC, FRAX, DAI, sFRAX, sDAI); dLEND, a lending market forked from Aave v3 in which dUSD is the primary borrowable asset; and DEX integrations for liquidity routing. Reserve yield is redirected to fund borrower interest rebates, which the protocol claims can produce near-zero or negative effective borrowing rates. The protocol is developed by Trinity Foundation Ltd., a Singaporean non-profit public company limited by guarantee. Core contributors include co-founders of Stably, a stablecoin infrastructure company active since 2018. Strategic advisors include co-founders of Frax, Convex, Sky (formerly MakerDAO), Coin98, and Promontory Partners. No external venture capital funding has been publicly disclosed.","heading":"Protocol Overview","sources":[{"url":"https://decrypt.co/297381/dtrinity-launches-subsidized-stablecoin-lending-protocol-on-fraxtal-l2","name":"dTRINITY Launches Subsidized Stablecoin Lending Protocol on Fraxtal L2 - Decrypt","type":"news_article","credibility":2},{"url":"https://chainwire.org/2024/12/18/dtrinity-launches-subsidized-stablecoin-lending-protocol-on-fraxtal-l2/","name":"dTRINITY Launch Announcement - Chainwire","type":"news_article","credibility":2},{"url":"https://docs.dtrinity.org/protocol-components/dlend","name":"dLEND Documentation - dTRINITY Docs","type":"official","credibility":2}],"severity":"low"},{"content":"On or around September 27, 2025, an attacker exploited a missing authorization check in the swapLiquidity() function of the IOdosLiquiditySwapAdapter contract deployed on Sonic and Fraxtal. The attacker used victims' addresses that had previously approved the adapter contract, enabling withdrawal of collateral deposits (aTokens) without authorization. Malicious swap routes directed the collateral to attacker-controlled addresses while returning minimal amounts to pass validation checks. The protocol acknowledged the incident publicly via its X/Twitter account on September 27-28, 2025. According to available reporting, approximately $56,000 was stolen, and the team stated that the affected funds belonged solely to dTRINITY team members who had approved the adapter during testing — no external user funds were reported lost. This incident has been classified as a suffered exploit resulting from a smart contract authorization flaw, not from any alleged fraud or insider misconduct by the team.","heading":"Security Incident 1: Sonic/Fraxtal Authorization Exploit (September 2025)","sources":[{"url":"https://blockthreat.com/blockthreat-week-39-2025/","name":"BlockThreat Week 39, 2025 - Peter Kacherginsky","type":"research","credibility":2},{"url":"https://olympixai.medium.com/balancer-0x48cf-dtrinity-121m-lost-to-rounding-bugs-upgrade-backdoors-and-missing-auth-c5d02358b735","name":"Balancer, 0x48cf, dTrinity: $121M Lost to Rounding Bugs, Upgrade Backdoors, and Missing Auth - Olympix","type":"research","credibility":2}],"severity":"medium"},{"content":"On March 17, 2026 — six days after the cbBTC market was listed on dLEND's Ethereum deployment — an attacker exploited an empty-market vulnerability inherent to Aave v3 forks. The attack proceeded in two phases. In the setup transaction, the attacker reduced the cbBTC reserve to near-zero liquidity by withdrawing deposits, then executed repeated flash loans whose premium repayments caused the reserve's liquidityIndex to inflate from approximately 1.0 RAY to approximately 6.22 million RAY — a roughly 6.2 million-fold increase — which is a monotonically increasing value and could not be reversed. In the exploit transaction (on-chain hash 0xbec4c8ae), the attacker took a zero-fee Morpho flash loan of approximately 11,366 cbBTC, deposited at the distorted index to create phantom collateral, borrowed 257,328.63 dUSD against it, and extracted an additional 7.86 cbBTC through 127 deposit/withdrawal cycles before repaying the flash loan. Starting costs were approximately 772 USDC and around $12,500 in setup fees; net attacker profit was approximately $257,000 in dUSD. The root cause was the absence of a minimum total-liquidity guard in the _handleFlashLoanRepayment function, combined with the protocol's deployment of a new, sparsely populated reserve without additional protective measures. Fraxtal and Katana deployments were unaffected due to chain-isolated reserves. The team paused the Ethereum deployment, publicly committed on March 18, 2026 to covering 100% of the approximately $257,000 bad debt from internal funds, and stated repayment would begin within 24 hours. This incident is attributed as an exploit suffered by the protocol — an external attacker exploiting a known Aave v3 fork vulnerability — not as fraud or misconduct by dTRINITY personnel.","heading":"Security Incident 2: Ethereum dLEND Deposit Inflation / Liquidity Index Manipulation (March 2026)","sources":[{"url":"https://blog.verichains.io/p/deep-dive-into-the-dtribity-cbbtc","name":"Deep Dive into the dTRINITY cbBTC Exploit - Verichains Blog","type":"research","credibility":2},{"url":"https://www.darknavy.org/web3/exploits/dtrinity-dlend-index-manipulation/","name":"dTRINITY dLEND Index Manipulation - DARKNAVY","type":"research","credibility":2},{"url":"https://olympixai.medium.com/how-a-six-day-old-market-cost-dtrinity-257k-anatomy-of-the-dlend-liquidity-index-attack-7913ffee8182","name":"How a Six-Day-Old Market Cost dTRINITY $257K - Olympix","type":"research","credibility":2},{"url":"https://www.kucoin.com/news/flash/dtrinity-dlend-on-ethereum-hit-by-deposit-inflation-attack-causing-257-000-bad-debt","name":"dTRINITY: dLEND on Ethereum Hit by Deposit Inflation Attack - KuCoin","type":"news_article","credibility":2},{"url":"https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-16-mar-22-2026","name":"Weekly Web3 Security Incident Roundup Mar 16 - BlockSec","type":"research","credibility":2},{"url":"https://cryip.co/dtrinitys-dlend-protocol-exploit-drains-around-257k-on-ethereum/","name":"dTRINITY Exploit Breakdown - Cryip","type":"news_article","credibility":3}],"severity":"high"},{"content":"Prior to and after launch, dTRINITY underwent five external smart contract audits. Verichains conducted an audit in June 2024 covering lending markets, oracle systems, rewards infrastructure, flash loans, access controls, and protocol logic. Halborn audited the stablecoin and AMO infrastructure in October 2024. Cyberscope also audited the protocol in October 2024 with a similar scope. Hats Finance ran a public audit competition in August 2025 with rewards up to $80,000 in USDC. Hashlock completed a full protocol audit in October 2025. The protocol's documentation states that all audit findings have been addressed. Notably, despite five external audits, the September 2025 authorization-check vulnerability and the March 2026 empty-market index manipulation exploit were not prevented, suggesting that audit coverage did not fully address live deployment risks — particularly the known Aave v3 empty-market vulnerability. The Hats Finance competition occurred before the March 2026 exploit and after the September 2025 exploit; it is not currently known whether either vulnerability class was flagged during the competition.","heading":"Security Audits","sources":[{"url":"https://docs.dtrinity.org/developer-guide/audits-and-security","name":"Audits and Security - dTRINITY Documentation","type":"official","credibility":2},{"url":"https://hatsfinance.medium.com/dtrinity-audit-competition-rewards-up-to-80-000-in-usdc-cd415f3597b1","name":"dTRINITY Audit Competition - Hats Finance","type":"other","credibility":2},{"url":"https://www.cyberscope.io/audits/dtrinity","name":"dTRINITY Smart Contract Audit - Cyberscope","type":"research","credibility":2}],"severity":"medium"},{"content":"As of reporting, dTRINITY dLEND carries approximately $830,000 in total value locked, while dUSD has approximately $1.38 million TVL — figures indicating a small-scale protocol. The dUSD stablecoin has traded at approximately $1.0024 on Curve (Fraxtal), maintaining its peg within normal tolerances. No depeg event for dUSD has been reported. The protocol is live across Fraxtal (since December 2024), Katana (since October 2025), and Ethereum (since January 2026, though the Ethereum dLEND deployment was paused after the March 2026 exploit). The Fraxtal and Katana deployments remained operational following both security incidents due to chain-isolated architecture.","heading":"Protocol TVL and Peg Status","sources":[{"url":"https://defillama.com/protocol/dtrinity-dlend","name":"dTRINITY dLEND TVL Stats and Charts - DefiLlama","type":"on_chain","credibility":2},{"url":"https://defillama.com/protocol/dtrinity-dusd","name":"dTRINITY dUSD TVL Stats and Charts - DefiLlama","type":"on_chain","credibility":2},{"url":"https://www.geckoterminal.com/fraxtal/pools/0x9ca648d2f51098941688db9a0beb1dadc2d1b357","name":"dUSD/FRAX Pool on Curve (Fraxtal) - GeckoTerminal","type":"on_chain","credibility":2}],"severity":"low"},{"content":"No regulatory action by the SEC, CFTC, DOJ, or any other authority has been identified against dTRINITY, Trinity Foundation Ltd., or its principals as of the investigation date. No allegations of fraud, rug pull, or insider misconduct have been identified in any sourced reporting. The team's response to both exploit incidents — public acknowledgment and commitment to full loss coverage from internal funds — has been cited in published coverage without contradiction. The protocol is governed by Trinity Foundation Ltd., a Singapore non-profit entity, though no further details about governance structure, multisig composition, or upgrade controls have been independently verified in available public sources.","heading":"Regulatory and Fraud Risk","sources":[{"url":"https://www.dtrinity.org/","name":"dTRINITY Official Website","type":"official","credibility":2}],"severity":"low"}],"timeline":[{"date":"2024-06","event":"Verichains completes first external audit of dTRINITY lending markets and protocol logic.","source":"dTRINITY Documentation - Audits and Security","source_url":"https://docs.dtrinity.org/developer-guide/audits-and-security"},{"date":"2024-10","event":"Halborn and Cyberscope each complete external smart contract audits of dTRINITY stablecoin and AMO infrastructure.","source":"dTRINITY Documentation - Audits and Security","source_url":"https://docs.dtrinity.org/developer-guide/audits-and-security"},{"date":"2024-12-18","event":"dTRINITY launches on Fraxtal L2 mainnet, debuting dUSD stablecoin and dLEND lending market.","source":"dTRINITY Launches on Fraxtal L2 - Chainwire","source_url":"https://chainwire.org/2024/12/18/dtrinity-launches-subsidized-stablecoin-lending-protocol-on-fraxtal-l2/"},{"date":"2025-08","event":"Hats Finance runs public audit competition for dTRINITY with up to $80,000 USDC in rewards.","source":"dTRINITY Audit Competition - Hats Finance Medium","source_url":"https://hatsfinance.medium.com/dtrinity-audit-competition-rewards-up-to-80-000-in-usdc-cd415f3597b1"},{"date":"2025-09-27","event":"Attacker exploits missing authorization check in swapLiquidity() function on Sonic and Fraxtal deployments, stealing approximately $56,000. Team states all affected funds belonged to dTRINITY team members, not external users.","source":"BlockThreat Week 39, 2025","source_url":"https://blockthreat.com/blockthreat-week-39-2025/"},{"date":"2025-10","event":"Hashlock completes full protocol audit of dTRINITY.","source":"dTRINITY Documentation - Audits and Security","source_url":"https://docs.dtrinity.org/developer-guide/audits-and-security"},{"date":"2026-01","event":"dTRINITY dLEND launches on Ethereum mainnet.","source":"dTRINITY dLEND Documentation","source_url":"https://docs.dtrinity.org/protocol-components/dlend"},{"date":"2026-03-11","event":"cbBTC market listed on dLEND Ethereum deployment.","source":"How a Six-Day-Old Market Cost dTRINITY $257K - Olympix","source_url":"https://olympixai.medium.com/how-a-six-day-old-market-cost-dtrinity-257k-anatomy-of-the-dlend-liquidity-index-attack-7913ffee8182"},{"date":"2026-03-17","event":"Attacker manipulates cbBTC liquidity index through repeated flash loan premium accrual in near-empty reserve, borrows 257,328.63 dUSD against inflated phantom collateral. Approximately $257,000 in bad debt created. Ethereum dLEND deployment paused. Fraxtal and Katana unaffected.","source":"dTRINITY dLEND Index Manipulation - DARKNAVY","source_url":"https://www.darknavy.org/web3/exploits/dtrinity-dlend-index-manipulation/"},{"date":"2026-03-18","event":"dTRINITY publicly commits to covering 100% of the approximately $257,000 bad debt from internal funds; states repayment to begin within 24 hours.","source":"dTRINITY: dLEND on Ethereum Hit by Deposit Inflation Attack - KuCoin","source_url":"https://www.kucoin.com/news/flash/dtrinity-dlend-on-ethereum-hit-by-deposit-inflation-attack-causing-257-000-bad-debt"}],"sources_used":[{"url":"https://decrypt.co/297381/dtrinity-launches-subsidized-stablecoin-lending-protocol-on-fraxtal-l2","name":"dTRINITY Launches Subsidized Stablecoin Lending Protocol on Fraxtal L2 - Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260213035826/https://decrypt.co/297381/dtrinity-launches-subsidized-stablecoin-lending-protocol-on-fraxtal-l2","credibility":2,"archive_timestamp":"2026-02-13T03:58:26+00:00"},{"url":"https://chainwire.org/2024/12/18/dtrinity-launches-subsidized-stablecoin-lending-protocol-on-fraxtal-l2/","name":"dTRINITY Launch Announcement - Chainwire","type":"news_article","archive_url":"http://web.archive.org/web/20260422232530/https://chainwire.org/2024/12/18/dtrinity-launches-subsidized-stablecoin-lending-protocol-on-fraxtal-l2/","credibility":2,"archive_timestamp":"2026-04-22T23:25:30+00:00"},{"url":"https://docs.dtrinity.org/protocol-components/dlend","name":"dLEND Documentation - dTRINITY Docs","type":"official","archive_url":"http://web.archive.org/web/20260518160136/https://docs.dtrinity.org/protocol-components/dlend","credibility":2,"archive_timestamp":"2026-05-18T16:01:36+00:00"},{"url":"https://docs.dtrinity.org/developer-guide/audits-and-security","name":"Audits and Security - dTRINITY Documentation","type":"official","archive_url":"http://web.archive.org/web/20260118150034/https://docs.dtrinity.org/developer-guide/audits-and-security","credibility":2,"archive_timestamp":"2026-01-18T15:00:34+00:00"},{"url":"https://blog.verichains.io/p/deep-dive-into-the-dtribity-cbbtc","name":"Deep Dive into the dTRINITY cbBTC Exploit - Verichains Blog","type":"research","archive_url":"http://web.archive.org/web/20260419202115/https://blog.verichains.io/p/deep-dive-into-the-dtribity-cbbtc","credibility":2,"archive_timestamp":"2026-04-19T20:21:15+00:00"},{"url":"https://www.darknavy.org/web3/exploits/dtrinity-dlend-index-manipulation/","name":"dTRINITY dLEND Index Manipulation - DARKNAVY","type":"research","archive_url":"http://web.archive.org/web/20260512180834/https://www.darknavy.org/web3/exploits/dtrinity-dlend-index-manipulation/","credibility":2,"archive_timestamp":"2026-05-12T18:08:34+00:00"},{"url":"https://olympixai.medium.com/how-a-six-day-old-market-cost-dtrinity-257k-anatomy-of-the-dlend-liquidity-index-attack-7913ffee8182","name":"How a Six-Day-Old Market Cost dTRINITY $257K - Olympix Medium","type":"research","archive_url":"http://web.archive.org/web/20260503063429/https://olympixai.medium.com/how-a-six-day-old-market-cost-dtrinity-257k-anatomy-of-the-dlend-liquidity-index-attack-7913ffee8182","credibility":2,"archive_timestamp":"2026-05-03T06:34:29+00:00"},{"url":"https://www.kucoin.com/news/flash/dtrinity-dlend-on-ethereum-hit-by-deposit-inflation-attack-causing-257-000-bad-debt","name":"dTRINITY: dLEND on Ethereum Hit by Deposit Inflation Attack - KuCoin","type":"news_article","archive_url":"https://web.archive.org/web/20260819194922/https://www.kucoin.com/news/flash/dtrinity-dlend-on-ethereum-hit-by-deposit-inflation-attack-causing-257-000-bad-debt","credibility":2,"archive_timestamp":"2026-08-19T19:49:22+00:00"},{"url":"https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-16-mar-22-2026","name":"Weekly Web3 Security Incident Roundup Mar 16 - BlockSec","type":"research","archive_url":"http://web.archive.org/web/20260416013307/https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-16-mar-22-2026","credibility":2,"archive_timestamp":"2026-04-16T01:33:07+00:00"},{"url":"https://phemex.com/news/article/defi-lending-protocol-dtrinity-suffers-260000-exploit-67152","name":"DeFi Protocol dTRINITY Hit by $260,000 Exploit - Phemex","type":"news_article","archive_url":"https://web.archive.org/web/20260819172850/https://phemex.com/news/article/defi-lending-protocol-dtrinity-suffers-260000-exploit-67152","credibility":2,"archive_timestamp":"2026-08-19T17:28:50+00:00"},{"url":"https://cryip.co/dtrinitys-dlend-protocol-exploit-drains-around-257k-on-ethereum/","name":"dTRINITY Exploit Breakdown - Cryip","type":"news_article","archive_url":"http://web.archive.org/web/20260418134941/https://cryip.co/dtrinitys-dlend-protocol-exploit-drains-around-257k-on-ethereum/","credibility":3,"archive_timestamp":"2026-04-18T13:49:41+00:00"},{"url":"https://olympixai.medium.com/balancer-0x48cf-dtrinity-121m-lost-to-rounding-bugs-upgrade-backdoors-and-missing-auth-c5d02358b735","name":"Balancer, 0x48cf, dTrinity: $121M Lost - Olympix Medium","type":"research","archive_url":"http://web.archive.org/web/20251203204919/https://olympixai.medium.com/balancer-0x48cf-dtrinity-121m-lost-to-rounding-bugs-upgrade-backdoors-and-missing-auth-c5d02358b735","credibility":2,"archive_timestamp":"2025-12-03T20:49:19+00:00"},{"url":"https://blockthreat.com/blockthreat-week-39-2025/","name":"BlockThreat Week 39, 2025","type":"research","archive_url":"http://web.archive.org/web/20260228022303/https://blockthreat.com/blockthreat-week-39-2025/","credibility":2,"archive_timestamp":"2026-02-28T02:23:03+00:00"},{"url":"https://hatsfinance.medium.com/dtrinity-audit-competition-rewards-up-to-80-000-in-usdc-cd415f3597b1","name":"dTRINITY Audit Competition - Hats Finance Medium","type":"other","archive_url":"http://web.archive.org/web/20260725204151/https://hatsfinance.medium.com/dtrinity-audit-competition-rewards-up-to-80-000-in-usdc-cd415f3597b1","credibility":2,"archive_timestamp":"2026-07-25T20:41:51+00:00"},{"url":"https://www.cyberscope.io/audits/dtrinity","name":"dTRINITY Smart Contract Audit - Cyberscope","type":"research","archive_url":"http://web.archive.org/web/20260317160007/https://www.cyberscope.io/audits/dtrinity","credibility":2,"archive_timestamp":"2026-03-17T16:00:07+00:00"},{"url":"https://defillama.com/protocol/dtrinity-dlend","name":"dTRINITY dLEND TVL - DefiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20250916080257/https://defillama.com/protocol/dtrinity-dlend","credibility":2,"archive_timestamp":"2025-09-16T08:02:57+00:00"},{"url":"https://defillama.com/protocol/dtrinity-dusd","name":"dTRINITY dUSD TVL - DefiLlama","type":"on_chain","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.geckoterminal.com/fraxtal/pools/0x9ca648d2f51098941688db9a0beb1dadc2d1b357","name":"dUSD/FRAX Pool on Curve (Fraxtal) - GeckoTerminal","type":"on_chain","archive_url":"http://web.archive.org/web/20251009232659/https://www.geckoterminal.com/fraxtal/pools/0x9ca648d2f51098941688db9a0beb1dadc2d1b357","credibility":2,"archive_timestamp":"2025-10-09T23:26:59+00:00"},{"url":"https://www.rootdata.com/Projects/detail/dTRINITY?k=MTMyMjA%3D","name":"dTRINITY Project Introduction - RootData","type":"other","archive_url":"https://web.archive.org/web/20260819195111/https://www.rootdata.com/Projects/detail/dTRINITY?k=MTMyMjA%3D","credibility":3,"archive_timestamp":"2026-08-19T19:51:11+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:18.068823+00:00","updated_at":"2026-08-25T07:44:56.088+00:00"}}