Verify a decision

{"actor":"system:backfill","investigation_id":"2cd8b4ee-1846-40ab-ad99-a82e94b720b5","kind":"publish","page_slug":"felix","published_at":"2026-10-13T05:24:36.827Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Felix","sections":[{"content":"Three Sigma describes feUSD as a USD-pegged stablecoin minted through a Liquity V2-style collateralised debt position (CDP) market on Hyperliquid. Borrowers deposit collateral such as HYPE, UBTC or liquid staking tokens and choose their own interest rate and target loan-to-value. feUSD is intended to be redeemable for $1 worth of collateral, which gives arbitrageurs a peg mechanism, and Stability Pool depositors stake feUSD to absorb liquidations in exchange for borrower interest, a share of upfront fees and liquidation gains. Felix also operates Vanilla, a set of variable-rate lending pools for assets such as HYPE, HUSD and USDC. The feUSD is therefore backed by overcollateralised crypto positions rather than fiat reserves. Dedaub's audits describe the codebase as a fork of Liquity V2 adapted for Hyperliquid.","heading":"How feUSD is backed and how the protocol works","severity":"low","sources":[{"credibility":2,"name":"Three Sigma - Felix Protocol case study","type":"research","url":"https://threesigma.xyz/case-studies/lending/felix-protocol"},{"credibility":2,"name":"Dedaub - Felix audit, 18 Dec 2024","type":"research","url":"https://dedaub.com/audits/felix/felix-dec-18-2024/"}]},{"content":"The requester's figure of about $71.3M TVL (DefiLlama, 7 Oct 2026) could not be re-verified in this run: the DefiLlama protocol page returned HTTP 403, and the vault/CDP split was not visible. DefiLlama's API for the Felix parent entry showed about $65.7M TVL on Hyperliquid L1 on or around 13 Oct 2026, with no child-protocol breakdown in the portion of the response that was read. The difference from $71.3M is consistent with normal TVL movement over several days but is not confirmed. TVL is a volatile, aggregator-reported metric. Earlier third-party articles cited much higher figures (for example outstanding loans above $100M), without dates in the retrieved text.","heading":"TVL figures","severity":"low","sources":[{"credibility":2,"name":"DefiLlama API - Felix","type":"other","url":"https://api.llama.fi/protocol/felix"},{"credibility":2,"name":"The Defiant - Felix crosses $100 million in outstanding loans","type":"news_article","url":"https://thedefiant.io/news/defi/hyperliquid-based-felix-protocol-crosses-usd100-million-in-outstanding-loans"}]},{"content":"Dedaub's January 2025 audit states that HYPE may lack sufficient liquidity, making its price susceptible to manipulation. It also notes HYPE was not widely listed on major centralised exchanges, so the oracle depends on Hyperliquid's own market and validator-provided prices, exposing it to latency, liveness and accuracy problems. If the oracle fails, the system falls back to the last good price, and if the market then drops below it, redemptions may become unprofitable even when the stablecoin trades near $1, potentially creating bad debt; the Felix team acknowledged this risk. The December 2024 audit separately flagged that a zero price reverts rather than falling back, requiring manual market shutdown (M1), and that manipulated oracle data could enable redemption arbitrage (M2, dismissed by the team). Three Sigma's July 2025 audit noted a structural exposure for kHYPE, whose multi-day withdrawal queue can let market prices drift below canonical value in stress, for which it said no protocol-only fix exists. No reporting of an actual feUSD depeg event was found in this run; aggregator price snapshots seen were undated and do not establish whether any depeg occurred.","heading":"Depeg and liquidation risk","severity":"high","sources":[{"credibility":2,"name":"Dedaub - Felix 2nd audit, 21 Jan 2025","type":"research","url":"https://dedaub.com/audits/felix/felix-2nd-audit-january-21-2025/"},{"credibility":2,"name":"Dedaub - Felix audit, 18 Dec 2024","type":"research","url":"https://dedaub.com/audits/felix/felix-dec-18-2024/"},{"credibility":2,"name":"Three Sigma - Felix Protocol case study","type":"research","url":"https://threesigma.xyz/case-studies/lending/felix-protocol"}]},{"content":"Dedaub audited Felix twice. The first review (18 Dec 2024; two auditors, 6 days) reported 20 findings: 0 critical, 1 high, 2 medium, 6 low, 2 centralization and 9 advisory; 14 resolved, 1 dismissed and 5 informational. The second (21 Jan 2025; 5 days) covered assembly rewrites, a role-based AdminController and branch shutdown/resumption. It reported 1 critical (incorrect aggregate debt after branch resumption, marked resolved by disabling resumption of shut-down branches), 2 medium (resolved), 1 low (open) and 3 centralization notes. Three Sigma's code audit dated 2025-07-23 covered only the kHYPE and wstHYPE price feeds (198 lines) and reported 2 medium findings, addressed in a later commit. Both Dedaub reports reviewed private repositories and the scope was limited to the changes from Liquity V2, so the whole current protocol is not shown to be covered by an audit. An Immunefi bounty page for Felix exists in search results, but its content could not be retrieved (HTTP 404), so bounty terms are unverified.","heading":"Audits and bug bounty","severity":"medium","sources":[{"credibility":2,"name":"Dedaub - Felix audit, 18 Dec 2024","type":"research","url":"https://dedaub.com/audits/felix/felix-dec-18-2024/"},{"credibility":2,"name":"Dedaub - Felix 2nd audit, 21 Jan 2025","type":"research","url":"https://dedaub.com/audits/felix/felix-2nd-audit-january-21-2025/"},{"credibility":2,"name":"Three Sigma - Felix Protocol case study","type":"research","url":"https://threesigma.xyz/case-studies/lending/felix-protocol"}]},{"content":"Both Dedaub reports state that Felix's contracts are upgradeable through transparent proxies with a 3-day timelock (unlike the immutable Liquity V2 design), that critical parameters such as minimum and critical collateral ratios and the price feed are mutable, and that administrators control branch shutdown and resumption. Dedaub noted that poorly set parameters could cause bad debt and that users might miss the timelock window. Holders therefore depend on the operators' governance and key management.","heading":"Centralization and upgradeability","severity":"medium","sources":[{"credibility":2,"name":"Dedaub - Felix audit, 18 Dec 2024","type":"research","url":"https://dedaub.com/audits/felix/felix-dec-18-2024/"},{"credibility":2,"name":"Dedaub - Felix 2nd audit, 21 Jan 2025","type":"research","url":"https://dedaub.com/audits/felix/felix-2nd-audit-january-21-2025/"}]},{"content":"No primary source reviewed in this run clearly documents the Felix team. A search snippet from a Hyperion DeFi partnership release names a Felix co-founder, and IQ.wiki (a community wiki) attributes risk-management experience to the founding team, but the release page could not be retrieved and these claims are not independently verified here. No regulatory actions, lawsuits, hacks or exploits involving Felix were found in the searches run; absence of results is not proof none exist. Funding details were not found.","heading":"Team and transparency","severity":"medium","sources":[{"credibility":3,"name":"Hyperion DeFi partnership with Felix (Barchart)","type":"news_article","url":"https://www.barchart.com/story/news/35758100/hyperion-defi-announces-strategic-partnership-with-felix-to-launch-hip-3-powered-perpetual-futures-market"},{"credibility":3,"name":"IQ.wiki - Felix Protocol","type":"community_report","url":"https://www.iq.wiki/en/wiki/felix-protocol"}]}],"sources_used":[{"credibility":2,"name":"Dedaub - Felix audit, 18 Dec 2024","type":"research","url":"https://dedaub.com/audits/felix/felix-dec-18-2024/"},{"credibility":2,"name":"Dedaub - Felix 2nd audit, 21 Jan 2025","type":"research","url":"https://dedaub.com/audits/felix/felix-2nd-audit-january-21-2025/"},{"credibility":2,"name":"Three Sigma - Felix Protocol case study","type":"research","url":"https://threesigma.xyz/case-studies/lending/felix-protocol"},{"credibility":2,"name":"DefiLlama API - Felix","type":"other","url":"https://api.llama.fi/protocol/felix"},{"credibility":2,"name":"The Defiant - Felix crosses $100 million in outstanding loans","type":"news_article","url":"https://thedefiant.io/news/defi/hyperliquid-based-felix-protocol-crosses-usd100-million-in-outstanding-loans"},{"credibility":3,"name":"Hyperion DeFi partnership with Felix (Barchart)","type":"news_article","url":"https://www.barchart.com/story/news/35758100/hyperion-defi-announces-strategic-partnership-with-felix-to-launch-hip-3-powered-perpetual-futures-market"},{"credibility":3,"name":"IQ.wiki - Felix Protocol","type":"community_report","url":"https://www.iq.wiki/en/wiki/felix-protocol"}],"summary":"Felix is a lending and stablecoin protocol on Hyperliquid's HyperEVM. Its CDP module is a licensed fork of Liquity V2 that mints the USD-pegged feUSD against collateral such as HYPE, UBTC and liquid staking tokens, alongside a separate Vanilla lending module. Public audits (Dedaub, Three Sigma) and a bounty exist, but the audited code is private, the contracts are upgradeable and admin-controlled, HYPE collateral carries oracle and liquidity risks, and the team is not clearly documented in the sources reviewed.","timeline":[{"date":"2024-12-18","date_evidence":"Date: December 18, 2024","event":"Dedaub publishes first security audit of Felix's Liquity V2 fork (20 findings).","source":"Dedaub","source_url":"https://dedaub.com/audits/felix/felix-dec-18-2024/"},{"date":"2025-01-21","date_evidence":"Date: January 21, 2025","event":"Dedaub publishes second audit covering AdminController, assembly rewrites and branch shutdown.","source":"Dedaub","source_url":"https://dedaub.com/audits/felix/felix-2nd-audit-january-21-2025/"},{"date":"2025-07-23","date_evidence":"Date: 2025-07-23 (engagement ran 23-25 July 2025)","event":"Three Sigma audits the kHYPE and wstHYPE price feeds.","source":"Three Sigma","source_url":"https://threesigma.xyz/case-studies/lending/felix-protocol"}]},"v":1}