{"investigation":{"slug":"save","entity_name":"Save","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Save (formerly Solend) is a Solana-based algorithmic lending and borrowing protocol that has operated since 2021. The protocol has been flagged by ZachXBT and carries a history of two significant incidents: a controversial governance vote in June 2022 that briefly granted the team emergency powers to seize a user's wallet, and a $1.26 million oracle manipulation exploit in November 2022. The protocol rebranded from Solend to Save in late 2024 and continues to operate with approximately $74 million in total value locked as of mid-2026.","sections":[{"content":"Save, formerly known as Solend, is a decentralized lending and borrowing protocol built on the Solana blockchain. It was launched in 2021 and quickly became one of the largest DeFi lending platforms on Solana by total value locked (TVL). The protocol allows users to deposit assets to earn interest and borrow against collateral. It is governed by the Save DAO, with SLND token holders (later rebranded to SAVE) holding voting rights over protocol decisions and treasury management. According to the protocol's own documentation, 60% of tokens were allocated to the community through liquidity mining and the DAO treasury, 25% to the core team, and 15% to investors. The team operates pseudonymously; the primary founder is known as 'Rooter.' In March 2024, the same team launched Suilend on the Sui blockchain, which separately grew to $1 billion TVL by January 2025. In late 2024, the Solend protocol was rebranded as Save Finance, and SLND tokens converted 1:1 to SAVE tokens beginning December 2024.","heading":"Overview and Background","sources":[{"url":"https://docs.save.finance/","name":"docs.save.finance","type":"other","credibility":3},{"url":"https://solanacompass.com/projects/save","name":"solanacompass.com","type":"other","credibility":3},{"url":"https://decrypt.co/221272/team-behind-top-lending-protocol-launches-suilend-on-sui","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"In June 2022, Solend became the subject of significant criticism within the DeFi community after passing governance proposal SLND1, which granted the Solend Labs team 'emergency powers' to assume control of a large user's wallet. The wallet in question — belonging to an anonymous user referred to as a 'whale' — had deposited approximately 5.7 million SOL, representing over 95% of the protocol's total SOL deposits, and had borrowed approximately $108 million in stablecoins (USDC and USDT), representing 88% of all outstanding USDC borrows. Solend calculated that if SOL fell to $22.30, the position would become subject to liquidation for up to $21 million. The protocol warned that a forced on-chain liquidation of this size could cause cascading damage to Solana's DeFi ecosystem and potentially leave the protocol with irrecoverable bad debt. Governance proposal SLND1 was published and voted on within the same day — the voting window was approximately seven hours. It passed with 97.5% of votes in favor, barely clearing the 1% quorum threshold with 1.13% participation. Notably, a single wallet accounted for the overwhelming majority of the 'yes' votes; without that wallet's participation, the proposal would not have reached quorum. Solend stated it had not directed the wallet to vote in a particular direction, only to participate. The proposal drew immediate and widespread condemnation from DeFi community members and legal commentators. Gabriel Shapiro, General Counsel of Delphi Labs, characterized the vote as 'contrary in every way to the DeFi ethos' and alleged it raised legal concerns about unauthorized access to user funds. Within 24 hours, a second proposal, SLND2, was passed with 99.8% approval (1,480,264 yes votes to 3,535 no votes), explicitly invalidating SLND1 and revoking the emergency powers. SLND2 also extended the minimum governance voting period to one day. The whale borrower subsequently moved $25 million in USDC debt to Mango Markets, and Binance intervened to facilitate an OTC liquidation of the remaining position, averting the crisis without triggering a chaotic on-chain liquidation.","heading":"Governance Controversy — June 2022 Whale Account Emergency Powers","sources":[{"url":"https://www.coindesk.com/tech/2022/06/19/solana-defi-platform-votes-to-control-whale-account-in-bid-to-avoid-liquidation-chaos","name":"coindesk.com","type":"other","credibility":3},{"url":"https://fortune.com/2022/06/20/solana-defi-platform-solend-votes-to-reverse-emergency-powers-to-take-over-whale-account/","name":"fortune.com","type":"other","credibility":3},{"url":"https://decrypt.co/103330/solana-lending-dao-overturns-vote-to-take-over-at-risk-whale-wallet","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/153011/new-solend-vote-invalidates-governance-decision-to-take-over-whale-account","name":"theblock.co","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/solend-invalidates-solana-whale-wallet-takeover-plan-with-second-governance-vote","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://decrypt.co/103489/solend-whale-108m-loan-nearly-crashed-solana","name":"decrypt.co","type":"other","credibility":3},{"url":"https://fortune.com/2022/06/28/binance-solana-defi-whale-account-liquidation/","name":"fortune.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 2, 2022, Solend suffered an oracle manipulation exploit that resulted in approximately $1.26 million in bad debt across three of its isolated lending pools: Stable, Coin98, and Kamino. The attacker exploited Solend's reliance on a single price oracle — the Switchboard oracle sourcing price data from the Saber liquidity pool — for the Hubble Protocol stablecoin USDH. The attacker had attempted a similar attack on October 28, 2022, pumping the USDH price on Saber using 200,000 USDC; however, arbitrage activity in the same block reversed the price manipulation before oracles could register it. On November 2, the attacker refined the technique by spamming the Saber pool to prevent arbitrage from occurring in the same slot, successfully inflating USDH's price from approximately $1 to as high as $15. Using the artificially inflated collateral value, the attacker borrowed and withdrew $1.26 million worth of assets across the three pools. Solend disabled the affected pools and notified exchanges of the exploiter's address. The protocol subsequently passed DAO proposals SLND5 and SLND6 to diversify oracle sources and improve oracle robustness. In August 2023, Solend announced that all affected users had been made whole. Approximately $900,000 of the original $1.26 million was recovered from the attacker; the protocol covered the remaining shortfall, accounting for subsequent price fluctuations. The protocol stated no individual user bore a net financial loss from the incident.","heading":"Oracle Manipulation Exploit — November 2022","sources":[{"url":"https://www.coindesk.com/business/2022/11/02/defi-protocol-solend-struck-by-126m-oracle-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/182055/solend-exploited-attack","name":"theblock.co","type":"other","credibility":3},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-solend/","name":"ackee.xyz","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/solends-isolated-pools-exploitation-nov-2-2022-detailed-analysis/","name":"immunebytes.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=oracle-attack-on-solend-costs-the-project-1-26-million","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain investigator ZachXBT has flagged Save (formerly Solend) as a notable entity in the context of crypto risk. The specific nature or content of ZachXBT's flag has not been independently verified through a primary source at the time of this investigation. ZachXBT is a pseudonymous on-chain investigator known for publicly documenting scams, exploits, and risky entities in the crypto space. The current trust score of 30/100 assigned prior to this investigation reflects this flag. Users should consult ZachXBT's public communications directly for the specifics of any allegations.","heading":"ZachXBT Flag","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"},{"content":"The June 2022 governance episode raised durable questions about the degree of centralization in Save's (then Solend's) governance model. Several structural weaknesses were identified by community members and analysts: first, the 1% quorum threshold allowed a single large token holder to meet quorum and pass a proposal; second, a 24-hour (later shortened to less on SLND1) voting window did not provide sufficient time for community deliberation; third, the initial proposal was drafted and executed by Solend Labs itself rather than being community-initiated. The episode was cited widely as an example of DeFi governance failure. Solend subsequently raised the minimum voting period to one day and took other steps to address governance concentration, though critics argued the team retained outsized influence over protocol operations. Additionally, the SLND2 vote itself showed a concentrated voting pattern: one wallet purchased an estimated $700,000 worth of governance tokens to accumulate sufficient votes, representing approximately 90% of total participation, which critics noted replaced one form of concentration with another.","heading":"Governance and Decentralization Concerns","sources":[{"url":"https://beincrypto.com/solend-passes-counter-proposal-slnd1-criticism-forfeits-emergency-powers-overtake-accounts/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/what-decentralization-solend-approves-whale-wallet-takeover-to-avoid-defi-implosion","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/153011/new-solend-vote-invalidates-governance-decision-to-take-over-whale-account","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Save (formerly Solend) has maintained an ongoing security audit program. The protocol has been audited by Kudelski Security, Neodyme, OSEC, and OtterSec, among others. The protocol maintains a bug bounty program offering up to $1 million for critical vulnerabilities. Despite these measures, the November 2022 oracle exploit demonstrated a material vulnerability in the protocol's price feed architecture, specifically relying on a single oracle source (Switchboard/Saber) for an illiquid asset. Post-exploit, the protocol diversified its oracle sources via DAO proposals SLND5 and SLND6. The Save documentation explicitly lists smart contract risk, oracle risk, and liquidation risk as known protocol risks.","heading":"Security Posture and Audits","sources":[{"url":"https://docs.save.finance/protocol/audit","name":"docs.save.finance","type":"other","credibility":3},{"url":"https://docs.save.finance/protocol/bug-bounty","name":"docs.save.finance","type":"other","credibility":3},{"url":"https://docs.save.finance/getting-started/risks","name":"docs.save.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"The SLND token, which governs the Save protocol, reached an all-time high of approximately $16.65 and as of mid-2026 trades approximately 99% below that peak. In December 2024, the protocol completed a token migration from SLND to SAVE at a 1:1 ratio. As of May 2026, Save carries approximately $74.45 million in total value locked across Solana (approximately $74.18 million) and Eclipse (approximately $273,000), per DeFi Llama data. This represents a significant decline from the protocol's peak TVL of over $400 million reported in August 2024. Weekly fee generation is approximately $11,500 as of mid-2026, compared to $4.42 million in gross protocol revenue for Q3 2024, reflecting a substantial reduction in protocol activity. The core team has allocated significant development resources to Suilend on the Sui blockchain, which has grown to become the leading DeFi protocol on Sui by TVL.","heading":"Token Performance and Current Protocol Status","sources":[{"url":"https://defillama.com/protocol/save","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/solend","name":"coingecko.com","type":"other","credibility":3},{"url":"https://save.finance/save","name":"save.finance","type":"other","credibility":3},{"url":"https://blog.sui.io/solend-lending-protocol-suilend-launch/","name":"blog.sui.io","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"Solend protocol launches on Solana as an algorithmic lending and borrowing platform.","source":"Save Finance documentation","source_url":"https://docs.save.finance/","date_original":"2021-01-01"},{"date":"2022-06-19","event":"Solend passes governance proposal SLND1, granting the team 'emergency powers' to take over a whale user's wallet holding 5.7 million SOL and $108 million in stablecoin borrows. Proposal passes 97.5% in favor with only 1.13% quorum participation, within a seven-hour window.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2022/06/19/solana-defi-platform-votes-to-control-whale-account-in-bid-to-avoid-liquidation-chaos"},{"date":"2022-06-20","event":"Community backlash prompts a second governance vote, SLND2, which passes with 99.8% approval and invalidates SLND1, revoking emergency powers. Minimum voting period extended to one day.","source":"Fortune","source_url":"https://fortune.com/2022/06/20/solana-defi-platform-solend-votes-to-reverse-emergency-powers-to-take-over-whale-account/"},{"date":"2022-06-21","event":"The whale borrower begins moving funds, transferring $25 million in USDC debt to Mango Markets, reducing systemic risk on Solend.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2022/06/21/solend-says-whale-at-center-of-solana-defi-controversy-starts-moving-funds"},{"date":"2022-06-28","event":"Binance intervenes to facilitate an OTC liquidation of the remaining whale position, resolving the liquidation crisis without triggering a chaotic on-chain sell-off.","source":"Fortune","source_url":"https://fortune.com/2022/06/28/binance-solana-defi-whale-account-liquidation/"},{"date":"2022-10-28","event":"First attempted USDH oracle manipulation attack on Solend; arbitrage activity reverses the price manipulation in the same block, preventing a successful exploit.","source":"Ackee Blockchain","source_url":"https://ackee.xyz/blog/2022-solana-hacks-explained-solend/"},{"date":"2022-11-02","event":"Solend suffers a $1.26 million oracle manipulation exploit targeting the USDH stablecoin price feed. The Stable, Coin98, and Kamino isolated pools are drained. Affected pools are disabled.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2022/11/02/defi-protocol-solend-struck-by-126m-oracle-exploit"},{"date":"2023-08-16","event":"Solend announces that all users affected by the November 2022 oracle exploit have been fully compensated. Approximately $900,000 was recovered from the attacker; the protocol covered the remainder.","source":"Ackee Blockchain / Solend announcement","source_url":"https://ackee.xyz/blog/2022-solana-hacks-explained-solend/"},{"date":"2024-03","event":"The Solend team (pseudonymous founder Rooter) launches Suilend on the Sui blockchain, which becomes Sui's leading DeFi lending protocol.","source":"Sui Blog","source_url":"https://blog.sui.io/solend-lending-protocol-suilend-launch/","date_original":"2024-03-01"},{"date":"2024-08","event":"Solend (now operating as Save Finance) reaches over $400 million in TVL, marking its peak under the rebranded identity.","source":"Analytics Insight","source_url":"https://www.analyticsinsight.net/cryptocurrency-analytics-insight/solend-announces-new-solana-defi-protocol-with-rebrand-to-savefinance","date_original":"2024-08-01"},{"date":"2024-12-12","event":"Save Finance completes the token migration from SLND to SAVE at a 1:1 ratio, formalizing the rebrand.","source":"Save Finance","source_url":"https://save.finance/save"}],"sources_used":[{"url":"https://docs.save.finance/","name":"docs.save.finance","type":"other","archive_url":"http://web.archive.org/web/20260606225807/https://docs.save.finance/","credibility":3,"archive_timestamp":"2026-06-06T22:58:07+00:00"},{"url":"https://solanacompass.com/projects/save","name":"solanacompass.com","type":"other","archive_url":"http://web.archive.org/web/20260413111037/https://solanacompass.com/projects/save","credibility":3,"archive_timestamp":"2026-04-13T11:10:37+00:00"},{"url":"https://decrypt.co/221272/team-behind-top-lending-protocol-launches-suilend-on-sui","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260118204926/https://decrypt.co/221272/team-behind-top-lending-protocol-launches-suilend-on-sui","credibility":3,"archive_timestamp":"2026-01-18T20:49:26+00:00"},{"url":"https://www.coindesk.com/tech/2022/06/19/solana-defi-platform-votes-to-control-whale-account-in-bid-to-avoid-liquidation-chaos","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251117212640/https://www.coindesk.com/tech/2022/06/19/solana-defi-platform-votes-to-control-whale-account-in-bid-to-avoid-liquidation-chaos","credibility":3,"archive_timestamp":"2025-11-17T21:26:40+00:00"},{"url":"https://fortune.com/2022/06/20/solana-defi-platform-solend-votes-to-reverse-emergency-powers-to-take-over-whale-account/","name":"fortune.com","type":"other","archive_url":"https://web.archive.org/web/20260829133625/https://fortune.com/2022/06/20/solana-defi-platform-solend-votes-to-reverse-emergency-powers-to-take-over-whale-account/","credibility":3,"archive_timestamp":"2026-08-29T13:36:25+00:00"},{"url":"https://decrypt.co/103330/solana-lending-dao-overturns-vote-to-take-over-at-risk-whale-wallet","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260414024440/https://decrypt.co/103330/solana-lending-dao-overturns-vote-to-take-over-at-risk-whale-wallet","credibility":3,"archive_timestamp":"2026-04-14T02:44:40+00:00"},{"url":"https://www.theblock.co/post/153011/new-solend-vote-invalidates-governance-decision-to-take-over-whale-account","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/solend-invalidates-solana-whale-wallet-takeover-plan-with-second-governance-vote","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260829234343/https://cointelegraph.com/news/solend-invalidates-solana-whale-wallet-takeover-plan-with-second-governance-vote","credibility":3,"archive_timestamp":"2026-08-29T23:43:43+00:00"},{"url":"https://decrypt.co/103489/solend-whale-108m-loan-nearly-crashed-solana","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260518130717/https://decrypt.co/103489/solend-whale-108m-loan-nearly-crashed-solana","credibility":3,"archive_timestamp":"2026-05-18T13:07:17+00:00"},{"url":"https://fortune.com/2022/06/28/binance-solana-defi-whale-account-liquidation/","name":"fortune.com","type":"other","archive_url":"https://web.archive.org/web/20260829133711/https://fortune.com/2022/06/28/binance-solana-defi-whale-account-liquidation/","credibility":3,"archive_timestamp":"2026-08-29T13:37:11+00:00"},{"url":"https://www.coindesk.com/business/2022/11/02/defi-protocol-solend-struck-by-126m-oracle-exploit","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260606143843/https://www.coindesk.com/business/2022/11/02/defi-protocol-solend-struck-by-126m-oracle-exploit","credibility":3,"archive_timestamp":"2026-06-06T14:38:43+00:00"},{"url":"https://www.theblock.co/post/182055/solend-exploited-attack","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-solend/","name":"ackee.xyz","type":"other","archive_url":"https://web.archive.org/web/20260829181713/https://ackee.xyz/blog/2022-solana-hacks-explained-solend/","credibility":3,"archive_timestamp":"2026-08-29T18:17:13+00:00"},{"url":"https://immunebytes.com/blog/solends-isolated-pools-exploitation-nov-2-2022-detailed-analysis/","name":"immunebytes.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.web3isgoinggreat.com/?id=oracle-attack-on-solend-costs-the-project-1-26-million","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260305141729/https://www.web3isgoinggreat.com/?id=oracle-attack-on-solend-costs-the-project-1-26-million","credibility":3,"archive_timestamp":"2026-03-05T14:17:29+00:00"},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"},{"url":"https://beincrypto.com/solend-passes-counter-proposal-slnd1-criticism-forfeits-emergency-powers-overtake-accounts/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/what-decentralization-solend-approves-whale-wallet-takeover-to-avoid-defi-implosion","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260829234626/https://cointelegraph.com/news/what-decentralization-solend-approves-whale-wallet-takeover-to-avoid-defi-implosion","credibility":3,"archive_timestamp":"2026-08-29T23:46:26+00:00"},{"url":"https://docs.save.finance/protocol/audit","name":"docs.save.finance","type":"other","archive_url":"http://web.archive.org/web/20260519183204/https://docs.save.finance/protocol/audit","credibility":3,"archive_timestamp":"2026-05-19T18:32:04+00:00"},{"url":"https://docs.save.finance/protocol/bug-bounty","name":"docs.save.finance","type":"other","archive_url":"http://web.archive.org/web/20260412051049/https://docs.save.finance/protocol/bug-bounty","credibility":3,"archive_timestamp":"2026-04-12T05:10:49+00:00"},{"url":"https://docs.save.finance/getting-started/risks","name":"docs.save.finance","type":"other","archive_url":"http://web.archive.org/web/20260519182827/https://docs.save.finance/getting-started/risks","credibility":3,"archive_timestamp":"2026-05-19T18:28:27+00:00"},{"url":"https://defillama.com/protocol/save","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250917110802/https://defillama.com/protocol/save","credibility":3,"archive_timestamp":"2025-09-17T11:08:02+00:00"},{"url":"https://www.coingecko.com/en/coins/solend","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://save.finance/save","name":"save.finance","type":"other","archive_url":"http://web.archive.org/web/20251209012909/https://save.finance/save","credibility":3,"archive_timestamp":"2025-12-09T01:29:09+00:00"},{"url":"https://blog.sui.io/solend-lending-protocol-suilend-launch/","name":"blog.sui.io","type":"other","archive_url":"http://web.archive.org/web/20260313072216/https://blog.sui.io/solend-lending-protocol-suilend-launch/","credibility":3,"archive_timestamp":"2026-03-13T07:22:16+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:46.833922+00:00","updated_at":"2026-08-30T05:14:12.254147+00:00"}}