{"investigation":{"slug":"tenderize-v2","entity_name":"Tenderize V2","trust_score":37,"severity_base":null,"score_modifier":-15,"confidence":0.62,"status":"published","content_type":"investigation","summary":"Tenderize V2 is a DeFi liquid staking protocol launched on January 29, 2024, enabling users to mint validator-specific liquid staked tokens (tTokens) for assets including MATIC, LPT, and GRT across Ethereum, Arbitrum, and Sei Network. The protocol suffered a protocol logic exploit on April 7, 2025, resulting in a loss of approximately $10,850 via a proxy upgrade skim technique on Ethereum; the incident was relatively small in dollar terms but raised concerns about smart contract integrity. ZachXBT has flagged this entity, and while the protocol holds multiple security audits including a Hacken audit scoring 9.8/10 and a Halborn audit, its current TVL of approximately $495,000 reflects limited adoption relative to the broader liquid staking market.","sections":[{"content":"Tenderize V2 is a liquid staking protocol developed by Tenderize Labs, founded by Nico Vergauwen. The protocol launched on mainnet on January 29, 2024, following approximately 18 months of development. It is designed to address centralization concerns common in existing liquid staking solutions by introducing validator-specific liquid staked tokens (tTokens). Unlike traditional liquid staking platforms where stake is aggregated and managed by a single entity, Tenderize V2 allows users to select individual validators, preserving network decentralization and censorship resistance. The V2 architecture comprises three core on-chain modules: TenderVaults, which mint tTokens representing staked assets and accrued rewards; TenderSwap, a shared decentralized exchange enabling tToken-to-unstaked-asset swaps with pooled liquidity; and BeefBank, a facility for depositing tTokens as collateral to mint Steaks Dollar (SD), an over-collateralized LST-backed stablecoin. At launch, supported assets included MATIC (Polygon), LPT (Livepeer), and GRT (The Graph), with unstaking windows of 2 days, 7 days, and 28-56 days respectively. The protocol deployed on Ethereum L1 and Arbitrum L2. In September 2025, Tenderize expanded to the Sei network, offering tSEI and liquid delegation products.","heading":"Protocol Overview and Architecture","sources":[{"url":"https://blog.tenderize.me/introducing-tenderize-v2-our-new-look-2/","name":"blog.tenderize.me","type":"other","credibility":3},{"url":"https://blog.tenderize.me/the-cookout-tenderize-v2-mainnet-launch/","name":"blog.tenderize.me","type":"other","credibility":3},{"url":"https://blog.tenderize.me/tenderize-is-live-on-sei/","name":"blog.tenderize.me","type":"other","credibility":3},{"url":"https://everstake.one/blog/what-is-tenderize-v2-an-overview","name":"everstake.one","type":"other","credibility":3}],"severity":"medium"},{"content":"On April 7, 2025, Tenderize V2 suffered a security incident on the Ethereum chain, resulting in an alleged loss of approximately $10,850. The exploit has been classified by DeFi Llama's hacks database as a 'Protocol Logic' vulnerability utilizing a 'Proxy Upgrade Skim' technique. Proxy upgrade skim attacks generally involve exploiting the upgrade mechanism of upgradeable smart contracts — in particular, the gap between when a proxy's implementation is updated and when access controls are fully enforced — to siphon funds or manipulate state. The dollar amount lost was relatively modest compared to major DeFi exploits, but the incident is notable because Tenderize V2 had received multiple security audits prior to the event, including reviews by Halborn and Hacken. No post-mortem or official incident report has been located in publicly available sources as of the date of this investigation. ZachXBT has flagged this entity; the precise nature or context of the flag has not been independently confirmed from primary sources and should be treated as alleged pending further verification. The protocol's current TVL on Arbitrum and Ethereum stands at approximately $495,000 as of mid-2025, suggesting the exploit did not cause a complete user exodus but may have contributed to limited growth.","heading":"April 2025 Protocol Logic Exploit","sources":[{"url":"https://defillama.com/protocol/tenderize-v2","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to and during the V2 launch, Tenderize engaged multiple third-party security firms. The protocol completed a Hacken audit in April 2022, receiving an overall score of 9.8/10. The audit initially gave a security subscore of 0/10 on the first review, which was raised to 10/10 after identified concerns were addressed by the team in a second review pass. Code quality was scored at 8/10 while documentation and architecture were scored at 10/10 each. Additionally, Tenderize reported passing audits by Halborn, a blockchain security firm, with all findings resolved prior to the V2 mainnet launch. Halborn maintains a public audit page listing engagements with Tenderize. Despite these audits, the April 2025 proxy upgrade skim exploit demonstrates that the audited codebase retained at least one exploitable vulnerability. This is consistent with broader DeFi patterns wherein post-launch upgrades or newly deployed proxy implementations introduce attack surfaces not covered by pre-launch audits. The protocol maintains open-source smart contracts across its GitHub organization under the Tenderize account, comprising over 33 public repositories including tender-core, staking, tenderswap, and lpeth. No active bug bounty program has been identified in available public sources.","heading":"Security Audits and Smart Contract Risk","sources":[{"url":"https://blog.tenderize.me/tenderize-passes-hacken-audit-with-a-9-8-10/","name":"blog.tenderize.me","type":"other","credibility":3},{"url":"https://www.halborn.com/audits/tenderize","name":"halborn.com","type":"other","credibility":3},{"url":"https://github.com/Tenderize","name":"github.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Tenderize V2's native governance and utility token is WAGYU, with a hard cap of 1 billion tokens. The WAGYU Token Generation Event (TGE) was structured around a two-phase launch campaign called 'The Cookout' and 'The Feast.' During The Cookout (January through approximately April 2024), users staked tTokens or provided liquidity to earn 'HATS,' a points-based reward that would later be converted to WAGYU at the TGE. The TGE timeline published by the team indicated a genesis airdrop and WAGYU generation event in late 2024, distributed to V1 stakers (0.5%), V2 genesis users (3.5% with 12-month linear vesting), and other categories. Protocol revenue is not distributed directly to token holders; instead, it is reinvested into a productive, yield-bearing treasury. WAGYU holders can redeem tokens proportionally against this treasury under certain conditions, creating an algorithmic price floor tied to treasury value per circulating WAGYU. WAGYU holders also participate in governance decisions including streaming fees, TenderSwap fees, BeefBank borrow fees, and treasury allocation. As of the date of this investigation, public market data for WAGYU on major tracking platforms is limited, and exchange listings appear sparse. The protocol's token model bears some structural similarities to protocol-owned liquidity designs, which carry risks related to treasury drawdowns and low secondary market liquidity.","heading":"Tokenomics and WAGYU Token","sources":[{"url":"https://blog.tenderize.me/wagyu-tokenomics-tge-timeline/","name":"blog.tenderize.me","type":"other","credibility":3},{"url":"https://www.tenderize.me/blog/wagyu-tokenomics-tge-timeline","name":"tenderize.me","type":"other","credibility":3}],"severity":"medium"},{"content":"Tenderize was founded by Nico Vergauwen, who previously served as a protocol engineer at Livepeer and launched Livepool, a precursor project that informed the liquid staking design of Tenderize. The team also drew experience from Pocket Network and Yearn Finance. On August 11, 2022, Tenderize announced a $3 million seed funding round led by Eden Block, with participation from TRGC, Encode Club, Figment, Daedalus Angels, and angels from Messari, Livepeer, and Steakwallet. The company is based in London, UK. The team's publicly stated motivation for building Tenderize V2 was to create a credibly neutral, permissionless base layer for liquid staking that avoids the validator centralization exhibited by protocols such as Lido. The protocol is community-governed via WAGYU token holders. No regulatory actions, SEC filings, DOJ involvement, or OFAC sanctions have been identified in connection with Tenderize, its team, or its protocol as of May 2026.","heading":"Funding, Team, and Background","sources":[{"url":"https://www.prnewswire.com/news-releases/tenderize-announces-3m-seed-round-301604134.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://grtiq.com/grtiq-podcast-87-nico-vergauwen/","name":"grtiq.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of mid-2025, Tenderize V2 holds a total value locked of approximately $495,000, distributed across Arbitrum ($337,813) and Ethereum ($157,676). This places the protocol as a niche participant in the liquid staking market, significantly smaller than dominant protocols such as Lido ($17.8 billion TVL), Rocket Pool ($543 million), and StakeWise V2 ($731 million). The protocol's TVL reached a reported record of approximately $1.15 million during September of an earlier period before declining. Tenderize targets non-ETH native staking markets — specifically The Graph (GRT), Livepeer (LPT), and Polygon (MATIC) — where liquid staking infrastructure was historically limited. In September 2025 the protocol expanded to Sei Network, targeting SEI stakers as an additional market. The combination of a small and declining TVL base, a protocol logic exploit, limited WAGYU exchange liquidity, and a niche asset focus represents the primary risk factors for users considering participation in the protocol.","heading":"Market Position and TVL","sources":[{"url":"https://defillama.com/protocol/tenderize-v2","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.streetinsider.com/Accesswire/Tenderize+v2+Mainnet+Launch+Revolutionizes+DeFi+and+Liquid+Staking+Ecosystem/22627798.html","name":"streetinsider.com","type":"other","credibility":3}],"severity":"medium"},{"content":"BeefBank is a module within Tenderize V2 that allows users to deposit tTokens as collateral to mint Steaks Dollar (SD), described by the team as an over-collateralized, LST-backed stablecoin. This design introduces a layered risk profile: users face underlying staking risks from the validator, smart contract risks from TenderVaults, liquidity risks in TenderSwap, and finally collateral liquidation risks in BeefBank. Over-collateralized stablecoins backed by illiquid or thinly traded collateral assets — such as tGRT or tLPT — are susceptible to cascade liquidations if the underlying staked asset price drops sharply, particularly during unstaking windows of 28 to 56 days for GRT. The protocol describes the BeefBank system in its documentation but has not published independent third-party risk assessments for the stablecoin mechanism in sources identified during this investigation. The Sei Network deployment in September 2025 also referenced a 'BeefyBank' feature (possibly a renamed or adapted version of BeefBank for SEI), expected in October 2025. No evidence of Steaks Dollar achieving significant circulation or market adoption has been identified.","heading":"BeefBank and Steaks Dollar Stablecoin Risks","sources":[{"url":"https://everstake.one/blog/what-is-tenderize-v2-an-overview","name":"everstake.one","type":"other","credibility":3},{"url":"https://blog.tenderize.me/tenderize-is-live-on-sei/","name":"blog.tenderize.me","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-12","event":"Tenderize protocol founded by Nico Vergauwen following his work at Livepeer and the Livepool precursor project.","source":"","date_original":"2021-12-01"},{"date":"2022-04-29","event":"Tenderize completes Hacken security audit, receiving an overall score of 9.8/10; initial security subscore of 0/10 raised to 10/10 after remediation.","source":""},{"date":"2022-08-11","event":"Tenderize announces $3 million seed funding round led by Eden Block, with participation from TRGC, Encode Club, Figment, Daedalus Angels, and others.","source":""},{"date":"2024-01-29","event":"Tenderize V2 launches on mainnet on Ethereum L1 and Arbitrum L2, supporting MATIC, LPT, and GRT staking, alongside 'The Cookout' points campaign.","source":""},{"date":"2024-05","event":"WAGYU token generation event (TGE) and genesis airdrop distribution to early Cookout participants; WAGYU streamed to stakers over 33-month schedule.","source":"","date_original":"2024-05-01"},{"date":"2025-04-07","event":"Tenderize V2 suffers a protocol logic exploit via proxy upgrade skim technique on Ethereum, resulting in an alleged loss of approximately $10,850.","source":""},{"date":"2025-09-18","event":"Tenderize protocol goes live on Sei Network, offering tSEI liquid staking and TenderSwap functionality, with BeefyBank planned for October 2025.","source":""}],"sources_used":[{"url":"https://blog.tenderize.me/introducing-tenderize-v2-our-new-look-2/","name":"blog.tenderize.me","type":"other","archive_url":"http://web.archive.org/web/20260418231328/https://blog.tenderize.me/introducing-tenderize-v2-our-new-look-2/","credibility":3,"archive_timestamp":"2026-04-18T23:13:28+00:00"},{"url":"https://blog.tenderize.me/the-cookout-tenderize-v2-mainnet-launch/","name":"blog.tenderize.me","type":"other","archive_url":"http://web.archive.org/web/20260213122853/https://blog.tenderize.me/the-cookout-tenderize-v2-mainnet-launch/","credibility":3,"archive_timestamp":"2026-02-13T12:28:53+00:00"},{"url":"https://blog.tenderize.me/tenderize-is-live-on-sei/","name":"blog.tenderize.me","type":"other","archive_url":"http://web.archive.org/web/20260513224057/https://blog.tenderize.me/tenderize-is-live-on-sei/","credibility":3,"archive_timestamp":"2026-05-13T22:40:57+00:00"},{"url":"https://everstake.one/blog/what-is-tenderize-v2-an-overview","name":"everstake.one","type":"other","archive_url":"https://web.archive.org/web/20260829032905/https://everstake.com/resources/blog/what-is-tenderize-v2-an-overview","credibility":3,"archive_timestamp":"2026-08-29T03:29:05+00:00"},{"url":"https://defillama.com/protocol/tenderize-v2","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250916230612/https://defillama.com/protocol/tenderize-v2","credibility":3,"archive_timestamp":"2025-09-16T23:06:12+00:00"},{"url":"https://blog.tenderize.me/tenderize-passes-hacken-audit-with-a-9-8-10/","name":"blog.tenderize.me","type":"other","archive_url":"http://web.archive.org/web/20260418225720/https://blog.tenderize.me/tenderize-passes-hacken-audit-with-a-9-8-10/","credibility":3,"archive_timestamp":"2026-04-18T22:57:20+00:00"},{"url":"https://www.halborn.com/audits/tenderize","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20251113230920/https://www.halborn.com/audits/tenderize","credibility":3,"archive_timestamp":"2025-11-13T23:09:20+00:00"},{"url":"https://github.com/Tenderize","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260417012629/https://github.com/Tenderize","credibility":3,"archive_timestamp":"2026-04-17T01:26:29+00:00"},{"url":"https://blog.tenderize.me/wagyu-tokenomics-tge-timeline/","name":"blog.tenderize.me","type":"other","archive_url":"http://web.archive.org/web/20260418223809/https://blog.tenderize.me/wagyu-tokenomics-tge-timeline/","credibility":3,"archive_timestamp":"2026-04-18T22:38:09+00:00"},{"url":"https://www.tenderize.me/blog/wagyu-tokenomics-tge-timeline","name":"tenderize.me","type":"other","archive_url":"http://web.archive.org/web/20260316162107/https://www.tenderize.me/blog/wagyu-tokenomics-tge-timeline","credibility":3,"archive_timestamp":"2026-03-16T16:21:07+00:00"},{"url":"https://www.prnewswire.com/news-releases/tenderize-announces-3m-seed-round-301604134.html","name":"prnewswire.com","type":"other","archive_url":"https://web.archive.org/web/20260830035134/https://www.prnewswire.com/news-releases/tenderize-announces-3m-seed-round-301604134.html","credibility":3,"archive_timestamp":"2026-08-30T03:51:34+00:00"},{"url":"https://grtiq.com/grtiq-podcast-87-nico-vergauwen/","name":"grtiq.com","type":"other","archive_url":"http://web.archive.org/web/20260414115752/https://grtiq.com/grtiq-podcast-87-nico-vergauwen/","credibility":3,"archive_timestamp":"2026-04-14T11:57:52+00:00"},{"url":"https://www.streetinsider.com/Accesswire/Tenderize+v2+Mainnet+Launch+Revolutionizes+DeFi+and+Liquid+Staking+Ecosystem/22627798.html","name":"streetinsider.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:24.535845+00:00","updated_at":"2026-08-30T03:55:00.026824+00:00"}}