
Fluid Review
Audited core: seven reports from four named firms
of 10
Fluid scores 5.0 among lending protocols, with a 9 for audit disclosure and marks of 3 to 5 elsewhere. Fees and most liquidation values are not documented as figures, and its licence allows educational use only. Re-scored from 4.2 on desk research checked November 1, 2026.
Overall score
5.0 = (3 + 3 + 5 + 5 + 9) / 5; was 4.2
Audits
7 reports: PeckShield, StateMind (2), MixBytes (3), Cantina; undated
Licence
BUSL-1.1, educational use only; GPL-2.0-or-later from Dec 19, 2027
Liquidation
Threshold, then automatic past a maximum; 1% penalty on ETH/USDC
Governance
Ownership moved to governance Feb 2024; 24h timelock cited in code
Fees
Borrow fee, DEX fee and revenue cut exist as levers; values not published
Scores
Each criterion carries equal weight. The overall score is the average of these 5 scores — (3.0 + 3.0 + 5.0 + 5.0 + 9.0) ÷ 5 = 5.0.
Pros
- Audit disclosure 9: seven linked reports from PeckShield, StateMind, MixBytes and Cantina
- The Liquidity Layer, vaults and DEX each have at least one audit report
- Liquidation terms 5: logic explained, with a 1% penalty stated for the ETH/USDC vault
- Governance 5: core contracts under governance since February 2024, with a 24-hour timelock in governance code
Cons
- Fee disclosure 3: fee levers described, but no schedule of current values in the docs
- Licence 3: BUSL-1.1 grant allows educational use only until December 19, 2027
- The docs state no timelock delay, and a team multisig keeps guardian and vault-deployer powers
- Audit reports are undated on the page, and no bug bounty is mentioned
How Fluid scores in crypto lending
This entry rates Fluid, the protocol that runs lending, vault borrowing and a DEX on one shared Liquidity Layer, in our lending ranking. The basis is desk research of Fluid's documentation and guides, its public contracts repository and its governance forum, checked on November 1, 2026. No position was opened. The category uses five criteria, each marked 0 to 10 and weighted equally, as described in our ratings methodology.
| Criterion | What the sources show | Mark |
|---|---|---|
| Fee disclosure | Borrow-fee, DEX fee and revenue-cut levers are described. No schedule of current values is published in the docs. | 3 |
| Licence & code openness | BUSL-1.1 whose use grant allows educational use only and prohibits production use, until it converts to GPL-2.0-or-later on December 19, 2027. | 3 |
| Liquidation terms | The threshold and automatic-liquidation logic is explained. The guides give one penalty figure (1% on ETH/USDC) and point to an app statistics page for the rest. | 5 |
| Governance & timelock | Core contracts are owned by governance, and governance code uses a 24-hour FluidTimelockController. The docs name the contract but state no delay. | 5 |
| Audit disclosure | Seven linked reports from PeckShield, StateMind, MixBytes and Cantina, covering the Liquidity Layer, vaults and DEX. None is dated on the page. | 9 |
The overall score is the plain average: (3 + 3 + 5 + 5 + 9) ÷ 5 = 25 ÷ 5 = 5.0. That still leaves Fluid below every other rated lending protocol in its peer list.
Two marks were re-scored from current sources on this check. Governance and timelock rose from 2 to 5: the previous mark recorded that nothing could be found, but Fluid's governance forum and repository show core contracts under governance ownership and a 24-hour timelock. Liquidation terms rose from 4 to 5 because the liquidation guide now gives a penalty figure and points to per-vault values. The overall score moves from 4.2 to 5.0.
Strongest criterion: the audit record
Audit disclosure (9)
Fluid's audits and security page links seven PDF reports from four named firms. PeckShield reviewed the protocol before launch. StateMind has two reports, one on Liquidity Layer updates. MixBytes has three, covering the vault protocol, the DEX and the Liquidity Layer. Cantina reviewed the DEX. Every core component has at least one report, and the Liquidity Layer, which holds all protocol funds, has more than one. The page does not date any report and does not mention a bug bounty, so a reader cannot tell from it how current the record is. The mark of 9 is the only criterion where Fluid scores near the top of the category. Audits review code at a point in time and do not insure deposits.
Weakest criteria and the middle marks
Governance & timelock (5): in place, but not in the docs
The documentation still states no governance process or delay. Its audits page lists a FluidTimelockController contract under a Governance heading but says nothing about how it is used or how long it delays changes. Fluid's own governance records fill part of the gap. A forum post of February 27, 2024 says the team transferred ownership of the Liquidity Layer, the fToken and vault factories and the reserve contract to governance. It adds that a team multisig can still deploy vaults (which governance must list) and pause lending and vault access to liquidity as guardian. A governance pull request merged on September 19, 2026 refers to a "24h FluidTimelockController" and moves one power from an instant team multisig action behind it. So governance control and a one-day delay exist, but a reader has to piece them together from forum posts and code changes, and a team multisig keeps guardian powers. The category gives 5 to protocols with owner or governance control and no documented delay, and 7 or more where the delay is stated; Fluid sits at the lower of these until its docs state the timelock.
Fee disclosure (3): a deficiency
Fluid describes its fee levers rather than their values. Borrowers pay a variable rate on vault debt, governance sets each DEX pool's trading fee and can take a revenue cut, and the vault configuration code includes a borrow-fee field. No schedule of current values appears in the documentation. The rubric asks for figures, not configurable parameters, so this is a measured gap. A borrower has to read the live figures in the app or on-chain; our guide to reading a DeFi lending market shows what to check.
Licence & code openness (3): a deficiency
The LICENSE file in fluid-contracts-public is Business Source License 1.1, with Instadapp Labs as licensor. Its additional use grant is narrower than most in this category. It allows the code to be used "for educational purposes only" and expressly prohibits production use, including hosted or embedded use that competes with Instadapp Labs. The change date is December 19, 2027, when it converts to GPL-2.0-or-later. The source is public to read, but the terms allow almost nothing beyond study until then.
Liquidation terms (5)
The vault liquidation guide explains the logic. A vault past its liquidation threshold can be liquidated, and past a higher maximum threshold it is liquidated automatically. Only the amount needed to restore health is liquidated, and at-risk positions are processed together in one transaction. The only figure given is a 1% penalty for the ETH/USDC vault. Other thresholds and penalties are left to a statistics page in the app. One real figure and a pointer to per-vault values puts Fluid at 5, below protocols whose documentation publishes the thresholds and penalties a borrower can plan around.
What the score does not cover
- Smart collateral and smart debt. Using collateral or debt as DEX liquidity adds trading exposure to a loan. It is not scored.
- Withdrawal limits. Automated limits cap withdrawals and borrows over 12-hour windows, which can delay a large exit. This sits outside the criteria.
- Rates and yields. Supply and borrow rates were not measured.
- Networks. Deployments other than Ethereum, and the Fluid Foundation's planned IP transfer, are not assessed.
Fluid vs Compound and Spark
Compound, the next protocol up at 5.6, shares Fluid's 3 for fee disclosure. It leads on licence (6 against 3), liquidation terms (6 against 5) and governance (7 against 5), but trails on audits, 6 against 9. Spark scores 6.2 and Silo Finance 6.0. Spark leads Fluid on licence (6), liquidation terms (8) and governance (6). Silo matches Fluid's 3 for licence and 5 for governance, and its lead comes from fees (6 against 3) and liquidation terms (7), with audits level at 9. Across these peers, Fluid's gap lies mainly in fee and licence disclosure, where it marks 3.
Who this rating suits
The score suits readers who weigh an audited codebase most heavily and are prepared to read fees, penalties and governance settings from the app, forum and contracts themselves. Readers who want those terms stated in the documentation, or code they can reuse, should weigh the four lower marks. Borrowing at high loan-to-value ratios raises liquidation risk; the rating describes published documentation and is not advice to lend or borrow.
How it compares

Morpho
Open-source code and liquidation terms fixed by formula

Venus Protocol
Dated audit catalog and timelocks stated to the hour

Kamino
Publishes its fee spread per market and states no other fees

Euler
Dated, linked audit record and fee limits enforced in code

Aave
Deep, dated audit archive and documented governance delays

Spark
Publishes the health factor at which full liquidation applies

Silo Finance
Liquidation fee fixed for each market's lifetime

Compound
One documented timelock over every Compound III market
Sources
Scored from published primary sources rather than hands-on use. Every figure above comes from one of the pages below, on the date shown. Manufacturers change prices and specifications without notice — if something here no longer matches the source, tell us and we will correct it.
- 1.Fluid docs — audits and security — checked
- 2.Fluid contracts — LICENSE — checked
- 3.Fluid guides — vault liquidation — checked
- 4.Fluid guides — DEX fees — checked
- 5.Fluid governance forum — ownership transfer to governance (Feb 27, 2024) — checked
- 6.Fluid governance — IGP-140 pull request (merged Sep 19, 2026) — checked
- 7.Fluid guides — Liquidity Layer risks — checked
Frequently asked questions
Why does Fluid score 5.0?
It is the plain average of five equal marks: 3 for fee disclosure, 3 for licence and code openness, 5 for liquidation terms, 5 for governance and timelock and 9 for audit disclosure. They total 25, and 25 divided by 5 is 5.0.
What holds Fluid's score back?
Fee disclosure and the licence, both marked 3. The docs describe fee levers without values, and the licence allows only educational use until December 2027. Liquidation values and the timelock delay are also missing from the docs.
What changed since the previous score of 4.2?
Two marks moved, and the score rose from 4.2 to 5.0. Governance went from 2 to 5: the core contracts have been under governance control since February 2024, and a governance pull request merged in September 2026 refers to a 24-hour FluidTimelockController, although Fluid's documentation still states no delay. Liquidation terms went from 4 to 5 because the guide now states a 1% penalty for the ETH/USDC vault and points to per-vault values.
Which criteria were actually measured?
Published fee figures, the licence file, documented liquidation terms, governance and timelock rules, and linked audits, all read on November 1, 2026. Smart collateral, withdrawal limits and rates were not scored.
How does Fluid compare with Compound?
Compound scores 5.6. It shares Fluid's 3 for fees and leads on licence, liquidation terms and governance, but marks 6 for audits against Fluid's 9.
Nothing here is financial advice. Editorial policy · How we score · How we're funded.