Audit log

Every state-changing event for Lulo: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-01 13:20:11Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,599,835

   sig

   45KTDqrB5zGw…vNQ8oJXLcopyexplorer ↗

   hash

   4jxEZzb34jAF…uBXppjSCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (21662 B) ▸

   {"actor":"system:backfill","investigation_id":"04a32c20-2ba5-48d5-afb8-13498a20b9ce","kind":"publish","page_slug":"lulo","published_at":"2026-06-01T13:20:11.420Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Lulo","sections":[{"content":"Lulo is a non-custodial yield aggregator built on the Solana blockchain that automatically allocates user-deposited stablecoins to the lending protocol currently offering the highest rate. The project was conceived at the Miami Solana hacker house in 2022 by co-founders Daniel Garay and Jesse Brauner. The initial vision was a peer-to-peer lending order book; over a weekend in late 2023 the team built 'FlexLend,' a simpler aggregator product that quickly outgrew the original project in user adoption. The protocol operated under the Flexlend brand before formally rebranding to Lulo in May 2024. Lulo is incorporated in and operates as a private startup; no token governance exists as of early 2026. The platform is listed on Solana's official ecosystem directory and has been recognized by Circle as a member of the Circle Alliance.","heading":"Overview and Background","severity":"low","sources":[{"credibility":2,"name":"Solfate Podcast #70 — How Lulo is Making DeFi Stupidly Simple","type":"news_article","url":"https://solfate.com/podcast/70"},{"credibility":2,"name":"Lulo (frmly Flexlend) rebranding announcement on LinkedIn","type":"official","url":"https://www.linkedin.com/posts/uselulo_flexlend-is-rebranding-to-lulo-this-marks-activity-7191485636430749696-I4BA"},{"credibility":2,"name":"Lulo on the Solana Ecosystem Directory","type":"official","url":"https://solana.com/ecosystem/lulo"},{"credibility":2,"name":"Lulo Joins the Circle Alliance, Reinforcing DeFi Credibility — Solana Floor","type":"news_article","url":"https://solanafloor.com/news/lulo-joins-the-circle-alliance-reinforcing-defi-credibility"}]},{"content":"The two co-founders are publicly named: Daniel Garay (CEO), a Cornell University computer science graduate who previously held roles at Google, Ripple, and Maple Finance, and Jesse Brauner (co-founder, CTO). Both maintain public LinkedIn profiles and Daniel operates under the X handle @nicechute. Additional team members identified include a Head of Growth named Maurice (surname Chalfin per LinkedIn) and a UX Product Lead. The team is small-startup sized and does not publish a comprehensive public org chart, but the founding layer is adequately disclosed by named-founder standards. No prior controversies, regulatory actions, or adverse professional history have been identified for any named team member. Daniel Garay's prior position at Maple Finance is a relevant credential given Maple is one of Lulo's integrated lending protocols; no conflict of interest has been alleged.","heading":"Team Transparency","severity":"low","sources":[{"credibility":2,"name":"Daniel Garay — LinkedIn","type":"official","url":"https://www.linkedin.com/in/garayd/"},{"credibility":2,"name":"Jesse Brauner — Co-Founder @ Lulo, LinkedIn","type":"official","url":"https://www.linkedin.com/in/jesse-brauner"},{"credibility":2,"name":"How Lulo is Making DeFi Stupidly Simple — Solana.com Solfate Podcast","type":"news_article","url":"https://solana.com/podcasts/solfate/episodes/how-lulo-is-making-defi-stupidly-simple-w-daniel-co-founder-and-ceo-lulo-2025-02-11"},{"credibility":2,"name":"The DeFi Savings Account: Solana's Answer to Real User Adoption — Decentral Park Capital","type":"research","url":"https://decentralparkcapital.substack.com/p/the-defi-savings-account-solanas"}]},{"content":"Lulo states it has undergone five independent security audits conducted by Certora, Halborn, OtterSec, Offside Labs, and Sec3 — firms with established reputations in Solana and EVM smart contract security. Certora published a report covering a manual audit of Lulo's Rust smart contracts on the Solana ecosystem conducted between November 18, 2024 and January 23, 2025. The Certora report identified several critical-severity vulnerability categories including oracle update failures, referral fee exploits, and withdrawal manipulation. The disposition of these findings — whether patched prior to or following audit publication — is not publicly confirmed in available secondary sources; the full remediation status would require reviewing the complete audit PDF. Halborn and Certik are cited in some secondary sources as earlier auditors (March 2023, June 2023) from the FlexLend era. Lulo also maintains a public bug bounty program. The audit coverage and named auditor roster represent industry-standard diligence for a Solana DeFi protocol at this scale.","heading":"Smart Contract Audits","severity":"medium","sources":[{"credibility":1,"name":"Lulo Solana Smart Contract Security Audit Report — Certora","type":"research","url":"https://www.certora.com/reports/lulo-smart-contract-security-assessment-report"},{"credibility":2,"name":"Risks & Audits | Lulo Documentation","type":"official","url":"https://docs.lulo.fi/risks-and-audits"},{"credibility":2,"name":"Lulo on Solana — Solana Compass Project Review","type":"news_article","url":"https://solanacompass.com/projects/lulo"}]},{"content":"Lulo operates a non-custodial pass-through model: user deposits are routed via Lulo's audited smart contracts directly into the underlying lending protocols rather than held in Lulo's own vaults. The platform minimizes deposit dwell time in its own contracts, with allocation and reallocation executed directly with integrated dApps. Integrated protocols as of 2025 include Kamino, Drift, Marginfi (Save), Morpho, Maple Finance, Pendle, Jupiter, Manifest, and Neutrl, spanning both Solana and Ethereum. This architecture creates multi-layer composability risk: a failure at any integrated downstream protocol — via an exploit, oracle failure, or bad-debt event — propagates losses to Lulo depositors. Lulo's 'Protected' tier addresses this risk through a peer-to-peer mutual coverage mechanism enforced at the smart contract level, designed to compensate Protected depositors for a total loss in any single integrated protocol. The 'Boost' tier offers higher yield by having depositors underwrite this coverage layer, accepting first-loss exposure. Coverage explicitly does not extend to systemic risks outside Lulo's control, such as Solana network outages or stablecoin depegging. Allocation weights across protocols are not fully publicly disclosed, which limits independent verification of concentration risk. The Certora audit identified withdrawal manipulation and oracle update failure vulnerabilities, which are directly relevant to the composability model.","heading":"Custody Model and Composability Risk","severity":"medium","sources":[{"credibility":2,"name":"Protect | Lulo Documentation","type":"official","url":"https://docs.lulo.fi/protect"},{"credibility":2,"name":"Lulo — How It Works","type":"official","url":"https://www.lulo.fi/docs/how-it-works"},{"credibility":2,"name":"Lulo Review: Simplifying Stablecoin Yields on Solana — CoinCodeCap","type":"news_article","url":"https://coincodecap.com/lulo-review"},{"credibility":2,"name":"Solana DeFi Stack: Routers, Lending, Perps — Eco Support","type":"other","url":"https://eco.com/support/en/articles/14801178-solana-defi-stack-routers-lending-perps"}]},{"content":"Lulo launched in early 2024 as Flexlend and grew rapidly. By August 2024, TVL reached a then-record of $38.7 million, doubling over that month driven by integration of PayPal's PYUSD stablecoin, which grew from zero to $20 million in deposits within a single month. By August 2024 the platform ranked as the eighth-largest yield aggregator in DeFi. Active user accounts stood at approximately 5,464 by mid-2024. As of late 2024 and into 2025, the platform reported surpassing $100 million in cumulative USDC deposits and maintains over 50 live integrations. DefiLlama data cited in secondary sources as of mid-2025 showed approximately $86.4 million in TVL, reflecting a broader Solana ecosystem TVL contraction (Solana ecosystem TVL declined roughly 56% from its August 2025 all-time high). Lulo's TVL trajectory from near zero to nine figures within approximately 18 months of live operation is notable for a Solana-native DeFi protocol.","heading":"TVL and Growth Metrics","severity":"low","sources":[{"credibility":2,"name":"DeFi Yield Aggregator Lulo Hits Record TVL Fueled by PayPal's Stablecoin — NFTgators","type":"news_article","url":"https://www.nftgators.com/defi-yield-aggregator-lulo-hits-record-tvl-fueled-by-paypals-stablecoin/"},{"credibility":2,"name":"Lulo TVL Stats & Charts — DefiLlama","type":"on_chain","url":"https://defillama.com/protocol/lulo"},{"credibility":2,"name":"Lulo Secures $34M in Directed Liquidity as Solana Stablecoins Soar — Solana Floor","type":"news_article","url":"https://solanafloor.com/news/lulo-secures-34m-directed-liquidity-solana-stablecoins-soar"},{"credibility":2,"name":"Lulo Review: Simplifying Stablecoin Yields on Solana — CoinCodeCap","type":"news_article","url":"https://coincodecap.com/lulo-review"}]},{"content":"Lulo has raised a confirmed seed round of $350,000 from investors including Alliance DAO, Castle Island Ventures, Circle Ventures, GoldenTree Asset Management, and Gami Capital, representing approximately nine total investors per Crunchbase data. The protocol is also listed as a portfolio company of Solana Ventures in secondary sources. Circle Ventures' participation is strategically aligned with Lulo's USDC-first deposit model. Castle Island Ventures is a Boston-based institutional crypto VC. GoldenTree Asset Management is a large alternative asset manager. Alliance DAO is a crypto-native accelerator. The funding round is modest ($350K) relative to Lulo's current TVL, which suggests the company operates on a lean basis and has not raised a significant Series A as of available data. No ICO, public token sale, or governance token has been issued.","heading":"Funding and Investor Backing","severity":"low","sources":[{"credibility":2,"name":"Lulo — Crunchbase Company Profile & Funding","type":"other","url":"https://www.crunchbase.com/organization/lulo-d653"},{"credibility":2,"name":"Lulo | Circle Alliance Directory","type":"official","url":"https://partners.circle.com/partner/lulo"},{"credibility":2,"name":"Lulo Joins the Circle Alliance, Reinforcing DeFi Credibility — Solana Floor","type":"news_article","url":"https://solanafloor.com/news/lulo-joins-the-circle-alliance-reinforcing-defi-credibility"}]},{"content":"No successful exploit, hack, or user-fund loss event attributable to Lulo's own smart contracts has been identified in publicly available sources as of the investigation date. The Certora audit (November 2024 – January 2025) identified critical-severity vulnerabilities — oracle update failures, referral fee exploits, and withdrawal manipulation — which were reported pre-publication; remediation status should be verified directly with Lulo or in the full audit PDF. No regulatory enforcement actions, SEC/CFTC investigations, or law enforcement actions have been identified. No rug-pull, exit scam, or fraudulent behavior allegations have been found. The protocol has been operating since early 2024 without a publicly reported major incident, which is a positive signal for a protocol at this TVL scale in the Solana ecosystem.","heading":"Security Incidents and Adverse Events","severity":"low","sources":[{"credibility":1,"name":"Lulo Solana Smart Contract Security Audit Report — Certora","type":"research","url":"https://www.certora.com/reports/lulo-smart-contract-security-assessment-report"},{"credibility":2,"name":"Lulo on Solana — Solana Compass Project Review","type":"news_article","url":"https://solanacompass.com/projects/lulo"}]},{"content":"Lulo has not issued a native governance token as of the investigation date. A low-market-cap token trading under the LULO ticker on Solana (contract FbvoiCGJQg1F9myTJYgC76ybiDJMLNCvmvb6eAKyUNKZ) has been identified on Phantom's token explorer with a circulating supply near 998.55 million and a reported market cap of approximately $1,700 as of March 2026, which strongly indicates this is an unofficial or community-created token unaffiliated with the protocol. Lulo's FAQ and official documentation do not reference a live token. Users should exercise caution with any token claiming affiliation with Lulo that has not been officially announced through the protocol's verified channels. The absence of a governance token also means there is no DAO mechanism, and protocol decisions remain centralized with the founding team.","heading":"Token and Governance","severity":"medium","sources":[{"credibility":2,"name":"LULO Token Price Chart — Phantom","type":"on_chain","url":"https://phantom.com/tokens/solana/FbvoiCGJQg1F9myTJYgC76ybiDJMLNCvmvb6eAKyUNKZ"},{"credibility":2,"name":"FAQ | Lulo","type":"official","url":"https://docs.lulo.fi/faq"},{"credibility":2,"name":"Lulo Price — CryptoRank","type":"other","url":"https://cryptorank.io/price/lulo"}]},{"content":"Lulo benefits from affiliation with high-credibility ecosystem actors: Circle (USDC issuer), Solana Ventures (ecosystem fund), and Castle Island Ventures. It is listed on Solana's official ecosystem page and has appeared in reputable crypto media including The Block's ecosystem coverage and Solana Floor. The protocol was highlighted at the 2022 Alliance DAO demo day. Lulo's 'Protected' insurance model has drawn favorable comparisons to traditional savings accounts in crypto media. Community sentiment in publicly available sources is broadly positive with no significant organized criticism or fraud allegations found. ScamAdviser rates lulo.fi as 'very likely not a scam.' The protocol's lack of a native token has been noted as limiting future DAO governance evolution, but also means there is no token issuance risk or associated speculative pressure on the product.","heading":"Ecosystem and Reputation","severity":"low","sources":[{"credibility":2,"name":"Lulo on the Solana Ecosystem Directory","type":"official","url":"https://solana.com/ecosystem/lulo"},{"credibility":1,"name":"Meet the newest crypto builders from Alliance DAO's demo day — TechCrunch","type":"news_article","url":"https://techcrunch.com/2022/07/13/meet-the-newest-crypto-builders-from-web3-accelerator-alliance-daos-demo-day/"},{"credibility":3,"name":"lulo.fi Reviews — ScamAdviser","type":"other","url":"https://www.scamadviser.com/check-website/lulo.fi"},{"credibility":2,"name":"Easy stablecoin yields on Solana — Exponential DeFi","type":"research","url":"https://exponential.fi/blog/easy-stablecoin-yields-on-solana"}]}],"sources_used":[{"credibility":1,"name":"Lulo Official Website","type":"official","url":"https://www.lulo.fi/"},{"credibility":1,"name":"Lulo Documentation","type":"official","url":"https://lulo.fi/docs"},{"credibility":1,"name":"Protect | Lulo Documentation","type":"official","url":"https://docs.lulo.fi/protect"},{"credibility":1,"name":"Risks & Audits | Lulo Documentation","type":"official","url":"https://docs.lulo.fi/risks-and-audits"},{"credibility":1,"name":"Lulo Solana Smart Contract Security Audit Report — Certora","type":"research","url":"https://www.certora.com/reports/lulo-smart-contract-security-assessment-report"},{"credibility":2,"name":"Lulo TVL Stats & Charts — DefiLlama","type":"on_chain","url":"https://defillama.com/protocol/lulo"},{"credibility":2,"name":"Lulo on Solana — Solana Compass","type":"news_article","url":"https://solanacompass.com/projects/lulo"},{"credibility":2,"name":"Lulo's Vision for Simplified DeFi — Solana Compass","type":"news_article","url":"https://solanacompass.com/learn/Solfate/how-lulo-is-making-defi-stupidly-simple-w-daniel-co-founder-and-ceo-at-lulo"},{"credibility":2,"name":"How Lulo is Making DeFi Stupidly Simple — Solana.com Solfate Podcast","type":"news_article","url":"https://solana.com/podcasts/solfate/episodes/how-lulo-is-making-defi-stupidly-simple-w-daniel-co-founder-and-ceo-lulo-2025-02-11"},{"credibility":2,"name":"Solfate Podcast #70","type":"news_article","url":"https://solfate.com/podcast/70"},{"credibility":2,"name":"DeFi Yield Aggregator Lulo Hits Record TVL — NFTgators","type":"news_article","url":"https://www.nftgators.com/defi-yield-aggregator-lulo-hits-record-tvl-fueled-by-paypals-stablecoin/"},{"credibility":2,"name":"Lulo Secures $34M in Directed Liquidity — Solana Floor","type":"news_article","url":"https://solanafloor.com/news/lulo-secures-34m-directed-liquidity-solana-stablecoins-soar"},{"credibility":2,"name":"Lulo Joins the Circle Alliance — Solana Floor","type":"news_article","url":"https://solanafloor.com/news/lulo-joins-the-circle-alliance-reinforcing-defi-credibility"},{"credibility":2,"name":"Lulo | Circle Alliance Directory","type":"official","url":"https://partners.circle.com/partner/lulo"},{"credibility":2,"name":"Lulo Attracts $15.3M in AUM — Solana Floor","type":"news_article","url":"https://solanafloor.com/news/lulo-attracts-15m-aum"},{"credibility":2,"name":"The DeFi Savings Account: Solana's Answer to Real User Adoption — Decentral Park Capital","type":"research","url":"https://decentralparkcapital.substack.com/p/the-defi-savings-account-solanas"},{"credibility":2,"name":"Lulo Review: Simplifying Stablecoin Yields on Solana — CoinCodeCap","type":"news_article","url":"https://coincodecap.com/lulo-review"},{"credibility":2,"name":"Lulo on the Solana Ecosystem Directory","type":"official","url":"https://solana.com/ecosystem/lulo"},{"credibility":1,"name":"Meet the newest crypto builders from Alliance DAO's demo day — TechCrunch","type":"news_article","url":"https://techcrunch.com/2022/07/13/meet-the-newest-crypto-builders-from-web3-accelerator-alliance-daos-demo-day/"},{"credibility":2,"name":"Lulo — Crunchbase","type":"other","url":"https://www.crunchbase.com/organization/lulo-d653"},{"credibility":2,"name":"Daniel Garay — LinkedIn","type":"official","url":"https://www.linkedin.com/in/garayd/"},{"credibility":2,"name":"Jesse Brauner — LinkedIn","type":"official","url":"https://www.linkedin.com/in/jesse-brauner"},{"credibility":2,"name":"Lulo Labs — GitHub","type":"official","url":"https://github.com/lulo-labs"},{"credibility":2,"name":"Easy stablecoin yields on Solana — Exponential DeFi","type":"research","url":"https://exponential.fi/blog/easy-stablecoin-yields-on-solana"}],"summary":"Lulo (lulo.fi), formerly known as Flexlend, is a Solana-based DeFi lending aggregator that automatically routes stablecoin deposits to the highest-yielding protocols on the network, including Kamino, Drift, Marginfi, Morpho, Maple, and Pendle. Founded in 2022 and formally launched in early 2024, the protocol has grown to over $86 million in TVL and surpassed $100 million in cumulative deposits, supported by five independent security audits and backing from Circle Ventures and Solana Ventures. The platform's primary risk profile is composability-layer exposure: deposits are routed across multiple third-party protocols, meaning a failure at any underlying venue could affect user funds, although Lulo's 'Protected' tier includes automated on-chain coverage for such events.","timeline":[{"date":"2022-07-13","event":"Lulo (then a peer-to-peer lending order book concept) appears at Alliance DAO's demo day","source":"TechCrunch","source_url":"https://techcrunch.com/2022/07/13/meet-the-newest-crypto-builders-from-web3-accelerator-alliance-daos-demo-day/"},{"date":"2023-12-01","event":"Team pivots to FlexLend lending aggregator product, built over a weekend; FlexLend surpasses the original project in user adoption within weeks","source":"Solfate Podcast / Solana Compass","source_url":"https://solanacompass.com/learn/Solfate/how-lulo-is-making-defi-stupidly-simple-w-daniel-co-founder-and-ceo-at-lulo"},{"date":"2024-01-01","event":"Lulo/Flexlend live launch on Solana mainnet; Saga phone dApp store listing announced December 2023","source":"Lulo X / Solana Floor","source_url":"https://x.com/uselulo/status/1741090192402809311"},{"date":"2024-05-01","event":"Flexlend formally rebrands to Lulo","source":"Lulo LinkedIn","source_url":"https://www.linkedin.com/posts/uselulo_flexlend-is-rebranding-to-lulo-this-marks-activity-7191485636430749696-I4BA"},{"date":"2024-08-27","event":"Lulo hits record TVL of $38.7 million, driven by PYUSD integration; TVL more than doubled during August 2024","source":"NFTgators","source_url":"https://www.nftgators.com/defi-yield-aggregator-lulo-hits-record-tvl-fueled-by-paypals-stablecoin/"},{"date":"2024-11-18","event":"Certora begins manual smart contract security audit of Lulo Rust programs","source":"Certora Audit Report","source_url":"https://www.certora.com/reports/lulo-smart-contract-security-assessment-report"},{"date":"2025-01-23","event":"Certora completes audit, identifying critical-severity vulnerabilities including oracle update failures, referral fee exploits, and withdrawal manipulation","source":"Certora Audit Report","source_url":"https://www.certora.com/reports/lulo-smart-contract-security-assessment-report"},{"date":"2025-02-11","event":"Daniel Garay (CEO) appears on Solfate Podcast episode 70, discussing Lulo Protect product launch and roadmap","source":"Solana.com / Solfate Podcast","source_url":"https://solana.com/podcasts/solfate/episodes/how-lulo-is-making-defi-stupidly-simple-w-daniel-co-founder-and-ceo-lulo-2025-02-11"},{"date":"2025-11-01","event":"Lulo reports surpassing $100 million in cumulative USDC deposits; five independent audits and 50+ live integrations cited","source":"CoinCodeCap Review","source_url":"https://coincodecap.com/lulo-review"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 404cfdf9-3185-40a2-ba8f-caf6d6f9cacecopy