Venus Protocol Review
Dated audit catalog and timelocks stated to the hour
of 10
Venus Protocol scores 7.6/10 in lending on desk research of its v4 docs and code, checked November 1, 2026. It links 115 dated audits and states each governance timelock, but gives liquidation figures only as examples and does not publish reserve factors.
Licence
BSD 3-Clause (venus-protocol)
Timelocks (BNB Chain)
Normal 48 h, fast-track 6 h, critical 1 h (no permissions)
Risk steward bounds
10% safe delta on collateral factors; 6 h timelock above it
Reserve revenue split
40% treasury, 40% Venus Prime, 20% risk fund
Audits
115 reports, 12 firms, Feb 2023 to Oct 23, 2026
Scores
Each criterion carries equal weight. The overall score is the average of these 5 scores — (5.0 + 9.0 + 5.0 + 9.0 + 10.0) ÷ 5 = 7.6.
Pros
- 115 linked audit reports from 12 named firms, nearly all dated, through October 2026
- Timelocks stated per route: 48 hours normal, 6 hours fast-track, 1 hour critical
- Critical route stripped of all permissions by VIP-645
- BSD 3-Clause licence on the core protocol repository
- Revenue split published: 40% treasury, 40% Prime, 20% risk fund
Cons
- Liquidation figures in the docs are labelled assumptions, not live parameters
- Reserve factors and per-market collateral factors are not published
- Risk stewards can move liquidation thresholds by up to 10% without a timelock
How Venus Protocol scores in crypto lending
This entry rates Venus Protocol's lending markets, centered on the Core Pool on BNB Chain, in our lending ranking. The basis is desk research of the Venus v4 documentation and the venus-protocol GitHub repository, checked on November 1, 2026. No position was opened. The category uses five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.
| Criterion | What the sources show | Mark |
|---|---|---|
| Fee disclosure | How reserve revenue is split is published (40% treasury, 40% Venus Prime, 20% risk fund; 60/20/20 for liquidation income). Reserve factors per market are not. | 5 |
| Licence & code openness | BSD 3-Clause in the venus-protocol LICENSE file, copyright Venus Labs, Inc. | 9 |
| Liquidation terms | The liquidation guide works through a 50% close factor and a 110% incentive, but labels them assumptions. Live values are read on-chain. | 5 |
| Governance & timelock | Three routes with stated timelocks (48, 6 and 1 hours), read from the Governor at a cited block. Risk stewards can move collateral factors and liquidation thresholds by up to 10% at once. | 9 |
| Audit disclosure | 115 linked reports from 12 named firms, almost all dated, February 2023 to October 23, 2026. | 10 |
The overall score is the plain average: (5 + 9 + 5 + 9 + 10) ÷ 5 = 38 ÷ 5 = 7.6, up from 7.4. Two marks moved on this pass. Audit disclosure rose from 8 to 10 because the security page now catalogs 115 dated reports, not the three firms the old mark counted. Governance and timelock fell from 10 to 9 because the documentation now describes risk stewards that can change collateral factors and liquidation thresholds within a 10% band without a timelock.
Strongest criteria: audits, governance and licence
Audit disclosure (10)
The Security & Audits page is a catalog of 115 reports, each tied to a component, a repository commit or pull request, and a scope. The firms are Certik (41 reports), PeckShield, Quantstamp, Fairyproof, OpenZeppelin, HashDit, Hacken, Pessimistic, Cantina, HashEx, Bailsec and Sherlock. All but a handful carry a date in the label, and the newest, from Bailsec and Sherlock, are dated October 23, 2026. The page also warns that an audit "does not make a protocol" safe, and asks readers to match deployed code to the reviewed commit. That is the long, current, named and dated record the rubric places at the top. Audits do not insure deposits, and the record did not prevent the March 2026 THE market attack described below.
Governance & timelock (9)
The governance page gives the configuration read from the BNB Chain Governor at block 118,362,254. All three routes need 1,000,000 XVS to propose and 1,500,000 For votes for quorum. Normal and fast-track proposals vote for 192,384 blocks, about 24 hours, then wait 48 hours or 6 hours. Critical proposals vote for 48,096 blocks and wait 1 hour, but VIP-645 removed every permission the Critical Timelock held, so that route cannot currently change anything. An Access Control Manager grants narrow permissions to guardians, for example to pause one market action.
The new element is the risk steward framework enabled by VIP-592. Whitelisted risk providers, such as Allez Labs, publish recommendations to an on-chain risk oracle. A collateral factor or liquidation threshold change within a 10% safe delta applies immediately; larger ones wait 6 hours and a Venus executor can reject them. A 3-day debounce limits repeat changes. Every step is documented and bounded, but a borrower's liquidation threshold can now move without a waiting period. That is the same reason Aave, whose stewards are also bounded, marks 9 rather than 10.
Licence & code openness (9)
The LICENSE file is the BSD 3-Clause licence, copyright Venus Labs, Inc. (2020). It is a recognised open-source licence with no change date and no restriction on production use. The mark is unchanged.
Weakest criteria: fees and liquidation terms
Fee disclosure (5)
The tokenomics page publishes where protocol revenue goes. On eligible deployments, reserves from borrower interest are split 40% to the treasury, 40% to Venus Prime and 20% to the risk fund. Liquidation and other income is split 60%, 20% and 20%. Ethereum and Arbitrum One send everything to their treasuries. What the docs do not give is the reserve factor itself, the share of each market's interest that becomes reserves. The deployed-markets page says collateral factors and other settings can change by governance and should be verified on-chain. The rubric credits published splits, but asks for the fee figures, so the mark holds at 5.
Liquidation terms (5): examples, not parameters
The liquidation guide explains the mechanics: in the Core Pool the liquidation threshold equals the collateral factor, part of the seized collateral goes to the protocol, and small insolvent accounts are handled by healAccount. Its worked examples use a 50% collateral factor, 50% close factor, 60% threshold and 110% incentive, and present them as assumptions. A borrower cannot plan around those numbers, and live per-market values have to be read on-chain or in the app. This is a measured gap, not an unchecked one. Our guide to reading a DeFi lending market covers where to find the live figures.
What the score does not cover
- Incidents. On March 15, 2026, a donation attack on the THE market in the BNB Chain Core Pool left about $2.15 million of bad debt, according to Venus's post-mortem. Incident history is not one of the five criteria.
- Rates, XVS and Prime rewards. Interest rates, vault reward speeds and Prime boosts are governance-set and were not measured.
- VAI. The stablecoin's stability fee is outside the lending rubric.
- Legacy isolated pools. Several are exit-only and are not scored separately.
Venus Protocol vs Morpho and Kamino
Morpho scores 8.8, 1.2 points above Venus. It marks 10 for licence and 10 for liquidation terms, against Venus's 9 and 5, while Venus leads on governance and audits. Kamino follows at 7.2. It marks 10 for fees, double Venus's 5, and 7 for liquidation terms against Venus's 5, but trails on licence (4) and governance (6).
Who this rating suits
The score suits readers who weigh governance process and audit depth most heavily: Venus states how long each kind of change waits and links a dated report for nearly every component. Readers who need the live reserve factor, close factor and incentive in the documentation before borrowing should weigh the two 5s. Borrowing against volatile collateral can end in liquidation; this rating describes published documentation and is not advice to lend or borrow.
How it compares
Morpho
Open-source code and liquidation terms fixed by formula
Kamino
Publishes its fee spread per market and states no other fees
Euler
Dated, linked audit record and fee limits enforced in code
Aave
Deep, dated audit archive and documented governance delays
Spark
Publishes the health factor at which full liquidation applies
Silo Finance
Liquidation fee fixed for each market's lifetime
Compound
One documented timelock over every Compound III market
Fluid
Audited core: seven reports from four named firms
Sources
Scored from published primary sources rather than hands-on use. Every figure above comes from one of the pages below, on the date shown. Manufacturers change prices and specifications without notice — if something here no longer matches the source, tell us and we will correct it.
- 1.Venus docs — Governance VIPs (routes and timelocks) — checked
- 2.Venus docs — Risk Oracle and Risk Stewards — checked
- 3.Venus docs — Tokenomics (revenue distribution) — checked
- 4.Venus docs — Liquidations guide — checked
- 5.Venus docs — Deployed markets — checked
- 6.Venus docs — Security and audits — checked
- 7.GitHub — venus-protocol LICENSE (BSD 3-Clause) — checked
- 8.Venus community — THE market incident post-mortem — checked
Frequently asked questions
Why does Venus Protocol score 7.6?
Its marks are 5 for fees, 9 for licence, 5 for liquidation terms, 9 for governance and 10 for audits, which average to 7.6. Audits, governance and an open-source licence carry the score; missing live fee and liquidation figures hold it back.
What changed in Venus's score on November 1, 2026?
Audit disclosure rose from 8 to 10 because the security page now lists 115 dated reports from 12 firms. Governance fell from 10 to 9 because risk stewards can now change collateral factors and liquidation thresholds within a 10% band without a timelock. The overall score went from 7.4 to 7.6.
Can Venus change my liquidation threshold without a vote?
Within limits, yes. Under the risk steward framework, a whitelisted risk provider's recommendation can move a collateral factor or liquidation threshold by up to 10% immediately. Larger changes wait 6 hours and can be rejected, and a 3-day debounce limits repeat changes.
What does the Venus score not measure?
Interest rates, XVS and Prime rewards, the VAI stablecoin and incident history, including the March 2026 THE market attack. It covers only published fees, licence, liquidation terms, governance and audits.
How does Venus compare with Morpho and Kamino?
Morpho scores 8.8 with stronger licence and liquidation marks. Kamino scores 7.2: stronger on fees and liquidation terms, weaker on licence and governance.
Nothing here is financial advice. Editorial policy · How we score · How we're funded.