Blend Pools V2
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2iA9fF…C1UvSummary
Blend Pools V2 is a modular, permissionless lending protocol built on the Stellar blockchain by Script3, launched as an upgrade to Blend V1 with additions including flash loans and a reduced backstop threshold. In February 2026, a community-managed pool built on top of the protocol (YieldBlox DAO Pool) suffered a $10.8 million oracle manipulation exploit; Script3 stated the core V2 contracts were not at fault, attributing the incident to pool-operator misconfiguration of the Reflector VWAP oracle.
Connected Entities
4 entities · 60 linked investigations- Blend Pools V2→mentioned with→Ethereum(65%)
- Blend Pools V2→mentioned with→Stellar(80%)
- Blend Pools V2→mentioned with→Binance(60%)
- Stellar→mentioned with→Ethereum(60%)
- Binance→mentioned with→Ethereum(65%)
Timeline(8 events)
3 April 2023
Script3 publicly introduces Blend as a liquidity protocol primitive for Stellar's Soroban smart contract platform, announcing it as pre-testnet.
25 January 2024
Certora publishes formal audit of the Blend protocol covering the emitter, liquidity pool instances, and backstop module.
9 April 2024
Co-founder Markus Paulson-Luna discusses Blend's architecture and Stellar DeFi positioning in a public interview with The Defiant.
23 February 2026
Attacker manipulates USTRY/USDC price 100x on SDEX via thin liquidity, exploiting the YieldBlox DAO Pool on Blend V2 and borrowing 61.25M XLM and 1M USDC — approximately $10.8M total.
23 February 2026
Stellar Tier 1 validators coordinate to freeze approximately 48 million XLM (roughly $7.2M) in attacker accounts before bridging to Ethereum is complete.
24 February 2026
Script3 issues public statement attributing the exploit to pool-operator misconfiguration, stating core Blend V2 contracts are unaffected.
24 February 2026
YieldBlox Security Council offers a 10% white-hat bounty with a 72-hour deadline in exchange for return of funds. Attacker does not respond.
25 February 2026
BlockSec and Halborn publish independent post-mortems confirming oracle misconfiguration as root cause; net user loss estimated at approximately $3.6M after frozen XLM is accounted for.
Decision Log
- hash: FAXf63xsmzbqYUFFbCRRiV84ZNKGLeXNYPHZFGFYrt2V
This investigation is cryptographically anchored to the Solana blockchain (1 event). 13 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:18 AM
last updated: 8/30/2026, 12:05:00 PM
4 viewsavoid.net — verified advice for a post-truth world