{"investigation":{"slug":"silo-finance","entity_name":"Silo Finance","trust_score":47,"severity_base":null,"score_modifier":-5,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Silo Finance V1 is a non-custodial isolated lending protocol launched on Ethereum mainnet in August 2022, enabling permissionless markets for long-tail crypto assets by confining risk to individual lending pools (Silos). The protocol experienced two security incidents in 2023: a critical interest rate manipulation vulnerability discovered by a white-hat researcher (no user funds lost) and a white-hat drain of approximately $45,000 in SILO incentive tokens due to a separate contract flaw. The deployed production version of V1 diverges from the audited codebase, a risk the team has publicly acknowledged but not fully remediated through re-audit.","sections":[{"content":"Silo Finance V1 is a non-custodial DeFi lending protocol built on an isolated market architecture. Each Silo contains a single base asset paired with a bridge asset such as ETH or a stablecoin, so that bad debt or exploits in one market cannot cascade across the full protocol. This design was motivated by vulnerabilities in shared-pool lending platforms such as Compound and Aave, where a single compromised collateral asset can drain funds from unrelated depositors. Silo V1 launched in beta on Ethereum mainnet in August 2022 with nine pools capped at 500 ETH each. The protocol expanded to Arbitrum in February 2023 and subsequently to OP Mainnet, Base, and other chains. As of May 2026 the V1 deployment holds approximately $1.55 million in total value locked, distributed primarily on Arbitrum ($1.28 million) and Ethereum ($165,000), placing it among the smaller active lending protocols. Silo Finance also introduced a protocol-native stablecoin, XAI, as a cross-silo bridge asset; XAI was deprecated in early 2024 after adoption proved limited and pool imbalances destabilized its peg.","heading":"Protocol Overview","sources":[{"url":"https://medium.com/silo-protocol/silo-is-live-in-beta-mainnet-94b6b0164258","name":"medium.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/silo-v1","name":"defillama.com","type":"other","credibility":3},{"url":"https://gov.silo.finance/t/a-plan-to-deprecate-xai-stablecoin/443","name":"gov.silo.finance","type":"other","credibility":3},{"url":"https://nansen.ai/post/what-is-silo-finance-defis-risk-isolated-lending-markets","name":"nansen.ai","type":"other","credibility":3}],"severity":"medium"},{"content":"On April 27, 2023, a white-hat security researcher identified under the handle @kankodu submitted a critical vulnerability report to Silo Finance via the Immunefi bug bounty platform. The flaw resided in the V1 InterestRateModel contract (IRMv1). Because the utilization ratio was calculated as total borrowed amount divided by total deposits, an attacker could donate ERC-20 tokens directly to a Silo contract — bypassing deposit accounting — and push the utilization ratio above 100%. At critical utilization, the interest rate would spiral to astronomical levels, inflating collateral valuations and allowing an attacker to borrow far more than should have been permitted. A proof-of-concept demonstrated that an attacker spending roughly 1 ETH could borrow approximately 450,000 XAI from a pool, with an estimated $3 million in Ethereum mainnet funds at aggregate risk. Arbitrum markets were immune because all pools had pre-existing deposits at the time of discovery. The Silo team developed and deployed a replacement contract (IRMv2) by May 1, 2023, capping utilization at 100% and limiting maximum compounded interest to 10,000% per year. Certora conducted formal verification of the fix between May 10 and May 24, 2023, confirming no remaining exploit vectors. No user funds were lost. The white-hat researcher received a 100,000 USDC bounty. The vulnerability disclosure was published on June 6, 2023.","heading":"Security Incident: Interest Rate Manipulation Vulnerability (April–May 2023)","sources":[{"url":"https://medium.com/silo-protocol/vulnerability-disclosure-2023-06-06-c1dfd4c4dbb8","name":"medium.com","type":"other","credibility":3},{"url":"https://medium.com/immunefi/silo-finance-logic-error-bugfix-review-35de29bd934a","name":"medium.com","type":"other","credibility":3},{"url":"https://medium.com/certora/silo-finance-post-mortem-3b690fffeb08","name":"medium.com","type":"other","credibility":3},{"url":"https://www.certora.com/blog/silo-finance-post-mortem","name":"certora.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 21, 2023, at approximately 00:30 UTC, members of the RAMSES protocol discovered a vulnerability in Silo Finance's separate incentives contract that would have allowed any actor to drain all SILO tokens held in that contract — approximately $45,000 at the time. RAMSES developed a proof-of-concept and submitted a bug report through Immunefi's program. The report was promptly closed by Immunefi as out-of-scope; subsequent attempts to reopen the ticket failed. Facing a live, drainable vulnerability and an unresponsive disclosure channel, RAMSES performed an unsanctioned white-hat operation, draining the funds themselves and transferring them to the RAMSES Treasury for safekeeping. RAMSES then contacted the Silo team directly. Funds were returned in full, and both teams later attributed the communication breakdown to Immunefi's ticket-triage process. This incident highlighted a gap in Immunefi's scope definition for Silo V1 and raised questions about the robustness of the protocol's disclosure pipeline, though it did not result in permanent user loss.","heading":"Security Incident: Incentives Contract White-Hat Drain (July 2023)","sources":[{"url":"https://hackmd.io/@yesthatdog/silo-whitehat","name":"hackmd.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Silo V1.1.1 received full audits from ABDK and Quantstamp. Certora additionally performed formal verification of the base protocol between May 7 and July 15, 2022, as well as separate formal verification of the Chainlink price provider. ChainSecurity audited the Curve and Convex integrations. During the Certora formal verification pass, five issues were uncovered — two rated high severity and three medium — that had not been identified by ABDK or Quantstamp. After these fixes were applied and the new contract version was deployed, the team elected not to commission a fresh complete audit, stating they believed the differences between the audited version (v1.1.1) and the deployed version were not material. However, the Silo team has publicly acknowledged that the deployed V1 contracts differ from the audited codebase, and the developer documentation states: 'the core team cannot guarantee the security of any shipped deployments including the currently deployed version.' This gap between audited and deployed code is an unresolved risk factor for V1 users. Trail of Bits was retained for an audit of Silo V2 rather than commissioning a re-audit of V1.","heading":"Audit Coverage and Deployed-vs-Audited Code Gap","sources":[{"url":"https://devdocs.silo.finance/security/audits-and-formal-verification","name":"devdocs.silo.finance","type":"other","credibility":3},{"url":"https://cryptopanic.com/news/16005261/RT-SiloFinance-4-Silo-v111-is-audited-by-ABDK-amp-Quantstamp-The-deployed-version-differs-from-the-audited-one-Read-about-the-audi","name":"cryptopanic.com","type":"other","credibility":3},{"url":"https://www.certora.com/reports/silo-report","name":"certora.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The SILO governance token launched on December 1, 2021, with a total planned supply of 1 billion tokens over four years. Token allocation at launch was: community treasury 45% (linear vesting over three years), founding contributors 21.75% (three-year linear vest with six-month cliff), future contributors and advisors 10% (four-year linear vest with one-year cliff), early contributors 6.75% (four-year vest with six-month cliff), early investors and advisors 6.30% (two-year vest with six-month lock), and early community airdrop 0.2%. The protocol commits 50% of revenue to buying back SILO tokens from the open market for redistribution to xSILO stakers. SILO reached an all-time high of approximately $1.05 in April 2022 before declining roughly 94% through the end of 2022, in line with broader DeFi market conditions. The governance structure relies on a 48-hour timelock on executed proposals. There is no emergency admin veto function, a design intended to maximize decentralization; however, the absence of emergency pause mechanisms for core contracts has been noted as a risk. The SiloDAO operates on-chain governance on Ethereum.","heading":"Governance, Tokenomics, and Token Performance","sources":[{"url":"https://silopedia.silo.finance/silodao/usdsilo","name":"silopedia.silo.finance","type":"other","credibility":3},{"url":"https://iq.wiki/wiki/silo-finance","name":"iq.wiki","type":"other","credibility":3},{"url":"https://resources.silo.finance/governance/the-silo-dao","name":"resources.silo.finance","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/silo-finance","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Silo V1 documentation identifies multiple risk categories applicable to users. Smart contract risk is present in all deployed markets, with the team explicitly noting that audited and deployed versions diverge and that security of deployed contracts cannot be guaranteed. Oracle risk exists through reliance on Chainlink price feeds; while Chainlink is a high-quality provider, price lag, incorrect pricing, or feed downtime can result in premature liquidations or undetected insolvency. Collateral risk is inherent in V1's permissionless design: any ERC-20 token can be listed as a base asset, meaning individual Silos may contain tokens with hidden mechanics such as rebasing or transfer taxes, thin liquidity, or elevated volatility. Liquidation risk is present in that liquidations are permissionless but not guaranteed; rapid price declines may outpace liquidator response, generating bad debt isolated to the affected Silo. The protocol does not allow bad debt to cross silo boundaries, which is its primary structural differentiation from shared-pool competitors. The XAI stablecoin — previously used as a cross-silo bridge asset — was deprecated in early 2024 following persistent peg instability caused by borrower selling pressure and thin DEX liquidity.","heading":"Protocol Risks and User Considerations","sources":[{"url":"https://silodocs2.netlify.app/docs/security/risks/","name":"silodocs2.netlify.app","type":"other","credibility":3},{"url":"https://silopedia.silo.finance/risks/overview","name":"silopedia.silo.finance","type":"other","credibility":3},{"url":"https://gov.silo.finance/t/a-plan-to-deprecate-xai-stablecoin/443","name":"gov.silo.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, a widely followed on-chain investigator known for identifying scams, rug pulls, and security failures in DeFi, has flagged Silo Finance in the context of security concerns. The specific nature and timing of ZachXBT's flag for the V1 protocol could not be independently verified through public sources at the time of this investigation. Community-level signals around the 2023 vulnerability disclosures were mixed: some participants viewed the white-hat outcomes as evidence of a functioning security culture, while others raised concerns about the Immunefi scope gap that delayed response to the July 2023 incentives-contract vulnerability. No evidence of rug pull, team fund misappropriation, or regulatory action against Silo Finance V1 was found in public records. The protocol's declining TVL — from a higher historical baseline to approximately $1.55 million by 2026 — reflects both competitive pressure from successor versions and the general migration of users toward Silo V2 and V3.","heading":"ZachXBT Flag and Community Signals","sources":[{"url":"https://defillama.com/protocol/silo-v1","name":"defillama.com","type":"other","credibility":3},{"url":"https://hackmd.io/@yesthatdog/silo-whitehat","name":"hackmd.io","type":"other","credibility":3},{"url":"https://immunefi.com/bug-bounty/silofinance/","name":"immunefi.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-12","event":"SILO governance token launch; protocol begins minting 1 billion tokens over four years.","source":"","date_original":"2021-12-01"},{"date":"2022","event":"Early community airdrop distributed to initial participants.","source":"","date_original":"2022-01-01"},{"date":"2022-04","event":"SILO token reaches all-time high of approximately $1.05.","source":"","date_original":"2022-04-01"},{"date":"2022-05-07","event":"Certora begins formal verification of Silo V1 protocol; process runs through July 15, 2022.","source":""},{"date":"2022-07-15","event":"Certora formal verification completes; five issues uncovered (two high, three medium) that ABDK and Quantstamp had missed.","source":""},{"date":"2022-08","event":"Silo V1 launches in beta on Ethereum mainnet with nine pools capped at 500 ETH each.","source":"","date_original":"2022-08-01"},{"date":"2022-09","event":"Silo V1 full public launch on Ethereum mainnet.","source":"","date_original":"2022-09-01"},{"date":"2023-02","event":"Silo V1 deployed on Arbitrum.","source":"","date_original":"2023-02-01"},{"date":"2023-04-27","event":"White-hat researcher @kankodu reports critical interest rate manipulation vulnerability (IRMv1) via Immunefi; estimated $3 million at risk on Ethereum mainnet.","source":""},{"date":"2023-05","event":"New interest rate model (IRMv2) coded, tested, and deployed on Arbitrum markets, capping utilization at 100% and interest at 10,000% per year.","source":"","date_original":"2023-05-01"},{"date":"2023-05-07","event":"Governance proposal executed on Ethereum to transfer control and apply IRMv2 fix to mainnet markets.","source":""},{"date":"2023-05-10","event":"Certora begins formal verification of IRMv2 fix.","source":""},{"date":"2023-05-24","event":"Certora confirms IRMv2 eliminates all identified exploit vectors; no user funds were lost.","source":""},{"date":"2023-06-06","event":"Silo Finance publishes public vulnerability disclosure detailing the IRMv1 flaw, attack mechanics, and remediation. Immunefi publishes bugfix review. Bounty of 100,000 USDC awarded to researcher.","source":""},{"date":"2023-07-21","event":"RAMSES protocol discovers vulnerability in Silo incentives contract allowing full drain of approximately $45,000 in SILO tokens. Immunefi closes bug report as out-of-scope. RAMSES performs white-hat drain to RAMSES Treasury.","source":""},{"date":"2023-07-22","event":"RAMSES contacts Silo team directly; drained funds returned in full. Both parties attribute communication failure to Immunefi triage process.","source":""},{"date":"2024","event":"Governance proposal to deprecate XAI stablecoin published, citing peg instability and pool imbalances.","source":"","date_original":"2024-01-01"},{"date":"2024","event":"Silo Finance publishes 2024 roadmap announcing transition toward V2 architecture.","source":"","date_original":"2024-01-01"}],"sources_used":[{"url":"https://medium.com/silo-protocol/silo-is-live-in-beta-mainnet-94b6b0164258","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://defillama.com/protocol/silo-v1","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250911090747/https://defillama.com/protocol/silo-v1","credibility":3,"archive_timestamp":"2025-09-11T09:07:47+00:00"},{"url":"https://gov.silo.finance/t/a-plan-to-deprecate-xai-stablecoin/443","name":"gov.silo.finance","type":"other","archive_url":"https://web.archive.org/web/20260829080517/https://gov.silo.finance/t/a-plan-to-deprecate-xai-stablecoin/443","credibility":3,"archive_timestamp":"2026-08-29T08:05:17+00:00"},{"url":"https://nansen.ai/post/what-is-silo-finance-defis-risk-isolated-lending-markets","name":"nansen.ai","type":"other","archive_url":"http://web.archive.org/web/20260513132855/https://nansen.ai/post/what-is-silo-finance-defis-risk-isolated-lending-markets","credibility":3,"archive_timestamp":"2026-05-13T13:28:55+00:00"},{"url":"https://medium.com/silo-protocol/vulnerability-disclosure-2023-06-06-c1dfd4c4dbb8","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/immunefi/silo-finance-logic-error-bugfix-review-35de29bd934a","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260610104509/https://medium.com/immunefi/silo-finance-logic-error-bugfix-review-35de29bd934a","credibility":3,"archive_timestamp":"2026-06-10T10:45:09+00:00"},{"url":"https://medium.com/certora/silo-finance-post-mortem-3b690fffeb08","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20250914194542/https://medium.com/certora/silo-finance-post-mortem-3b690fffeb08","credibility":3,"archive_timestamp":"2025-09-14T19:45:42+00:00"},{"url":"https://www.certora.com/blog/silo-finance-post-mortem","name":"certora.com","type":"other","archive_url":"http://web.archive.org/web/20250907181220/https://www.certora.com/blog/silo-finance-post-mortem","credibility":3,"archive_timestamp":"2025-09-07T18:12:20+00:00"},{"url":"https://hackmd.io/@yesthatdog/silo-whitehat","name":"hackmd.io","type":"other","archive_url":"http://web.archive.org/web/20260829033916/https://hackmd.io/@yesthatdog/silo-whitehat","credibility":3,"archive_timestamp":"2026-08-29T03:39:16+00:00"},{"url":"https://devdocs.silo.finance/security/audits-and-formal-verification","name":"devdocs.silo.finance","type":"other","archive_url":"http://web.archive.org/web/20260511235638/https://devdocs.silo.finance/security/audits-and-formal-verification","credibility":3,"archive_timestamp":"2026-05-11T23:56:38+00:00"},{"url":"https://cryptopanic.com/news/16005261/RT-SiloFinance-4-Silo-v111-is-audited-by-ABDK-amp-Quantstamp-The-deployed-version-differs-from-the-audited-one-Read-about-the-audi","name":"cryptopanic.com","type":"other","archive_url":"https://web.archive.org/web/20260830032257/https://cryptopanic.com/news/16005261/RT-SiloFinance-4-Silo-v111-is-audited-by-ABDK-amp-Quantstamp-The-deployed-version-differs-from-the-audited-one-Read-about-the-audi","credibility":3,"archive_timestamp":"2026-08-30T03:22:57+00:00"},{"url":"https://www.certora.com/reports/silo-report","name":"certora.com","type":"other","archive_url":"https://web.archive.org/web/20260829044557/https://www.certora.com/reports/silo-report","credibility":3,"archive_timestamp":"2026-08-29T04:45:57+00:00"},{"url":"https://silopedia.silo.finance/silodao/usdsilo","name":"silopedia.silo.finance","type":"other","archive_url":"http://web.archive.org/web/20251012174411/https://silopedia.silo.finance/silodao/usdsilo","credibility":3,"archive_timestamp":"2025-10-12T17:44:11+00:00"},{"url":"https://iq.wiki/wiki/silo-finance","name":"iq.wiki","type":"other","archive_url":"http://web.archive.org/web/20260212100743/https://iq.wiki/wiki/silo-finance","credibility":3,"archive_timestamp":"2026-02-12T10:07:43+00:00"},{"url":"https://resources.silo.finance/governance/the-silo-dao","name":"resources.silo.finance","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coingecko.com/en/coins/silo-finance","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20260725145328/https://www.coingecko.com/en/coins/silo-finance","credibility":3,"archive_timestamp":"2026-07-25T14:53:28+00:00"},{"url":"https://silodocs2.netlify.app/docs/security/risks/","name":"silodocs2.netlify.app","type":"other","archive_url":"http://web.archive.org/web/20260124142601/https://silodocs2.netlify.app/docs/security/risks/","credibility":3,"archive_timestamp":"2026-01-24T14:26:01+00:00"},{"url":"https://silopedia.silo.finance/risks/overview","name":"silopedia.silo.finance","type":"other","archive_url":"https://web.archive.org/web/20260829040925/https://app.gitbook.com/o/c7FN8fhflepVHJbQA3OQ/sites/site_vmDIq/risks/overview","credibility":3,"archive_timestamp":"2026-08-29T04:09:25+00:00"},{"url":"https://immunefi.com/bug-bounty/silofinance/","name":"immunefi.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:22.623078+00:00","updated_at":"2026-08-30T03:54:59.682823+00:00"}}