Supported Protocols
13 protocol modules with versions, strategy defaults, audit context, and incident history.
Philidor tracks vaults across 13 protocol modules registered publicly.
Protocol Modules
| Protocol Module | Strategy Coverage | Versions | Launch Date | Audits | Bug Bounty |
|---|---|---|---|---|---|
| Aave | lending | v2, v3, v3-lido, v3-etherfi | 2020-01-08 | 8 | Immunefi |
| Aave V4 | lending | v4 hub-spoke | 2026-03-30 | 5 | Immunefi |
| Yearn | yield_aggregation | v2, v3 | 2020-07-17 | 8 | Immunefi |
| Beefy | yield_aggregation | v2 | 2020-10-08 | 6 | Immunefi |
| Morpho | isolated_lending | v1, v2 | 2024-01-10 | 8 | Morpho |
| Spark | savings and lending | v1, v2 | 2023-05-09 | 8 | Spark Security |
| Compound | lending | v3 Comet | 2022-08-26 | 3 | Immunefi |
| Uniswap V2 | liquidity_provision | v2 | 2020-05-18 | 9 | Uniswap Security |
| Uniswap V3 | liquidity_provision | v3 | 2021-05-05 | 9 | Uniswap Security |
| Uniswap V4 | liquidity_provision | v4 | 2025-01-31 | 9 | Uniswap Security |
| Nest | multi_market and savings | v1 | 2025-01-01 | 1 | Nest Security |
| Maple | underwritten credit | v2 | 2021-05-13 | 16 | Immunefi |
| Kamino | lending and multi_market | klend, kvault | 2022-08-30 | 20 | Immunefi |
The strategy column describes module coverage. Individual vault rows carry the canonical strategy_type when the shared taxonomy applies; Maple instead exposes protocol-specific credit evidence because a generic lending label would overstate comparability.
Maple Finance (Ethereum)
Maple V2 covers institutional credit pools and the retail-facing Syrup share tokens. Pool delegates underwrite named, KYC-verified borrowers and lenders redeem through withdrawal managers. Because loan collateral and margin terms are negotiated per borrower rather than expressed as one pool-wide LTV, Philidor publishes Maple's credit and withdrawal evidence without inventing generic utilization, borrow APR, or liquidation metrics that do not describe the pool.
Kamino (Solana)
Kamino is Philidor's first non-EVM protocol module, covering both Kamino
programs: K-Lend (isolated lending markets whose reserves become
vault rows, and whose markets are served first-class by
/v1/markets) and Kamino Earn
kVaults (curated vaults allocating across K-Lend reserves, with
allocation snapshots and curator attribution).
What is different from the EVM modules, by construction:
- Identity: addresses are base58 and case-sensitive; the chain id is
the synthetic
1399811149. The standards-based CAIP-2 key is served by/v1/chains. - Verification: every published figure is reconciled against finalized on-chain account state decoded with pinned program IDLs — vendor API values that disagree with chain state are withheld, not served.
- Control scoring: program upgrade authority and emergency powers, not contract admins — see Control and Governance.
- Events: published Solana activity and risk events are available on vault detail and event-history surfaces.
- Oracles: reserve price sources resolve through Kamino's Scope aggregator with worst-of attribution — see Oracle Providers.
Aave V4 markets and hubs
Aave V4 is hub-and-spoke: a hub pools liquidity per asset and owns the rate accounting, while spokes are the user-facing markets that draw on it, each with its own collateral set and risk policy. Several spokes can share one hub — bespoke risk without fragmenting liquidity.
Each spoke reserve is a vault row in /v1/vaults. The spokes
themselves are served as first-class markets by
/v1/markets, with supplied/borrowed rollups and hub_address so
markets sharing liquidity stay identifiable.
Instances beyond the Aave DAO deployments
Some Aave V4 instances are operated by third parties rather than the Aave DAO. They clear Aave governance (TEMP CHECK / ARFC / AIP) but are absent from the official Aave API and changelog, so Philidor indexes them directly from chain against a reviewed allowlist of hub addresses:
| Instance | Chain | Discovery | Notes |
|---|---|---|---|
| Aave DAO deployments | Ethereum, Avalanche | Aave API | Main, Bluechip, Forex, Gold, Lido, Etherfi, … |
| EtherFi Cash | Optimism | On-chain | ether.fi-operated; powers the ether.fi Cash card backend |
Numbers for on-chain-discovered instances come from the same on-chain reads as every other Aave V4
row, availability included: borrow_status and is_depositable come from the spoke's reserve
flags and the hub's per-spoke gate (active, halted, draw and add caps), and
deposit_capacity_usd is the hub add-cap headroom — null when the spoke is uncapped or the
headroom could not be observed (hub gate, added assets or price unread), never a stand-in for
unlimited; is_depositable is null in the unobserved case. On EtherFi Cash the chain reports USDC
and WETH as borrow_status: open and its collateral-only liquid tokens as disabled, with supply
open across the spoke. See
Aave V4 availability.
Key Auditors
Across all protocols, primary audit firms include OpenZeppelin, Trail of Bits, ChainSecurity, Spearbit, Cantina, Certora, Zellic, ABDK, and PeckShield.
Contest platforms such as Code4rena and Sherlock receive additional credit in audit density scoring.
Notable Incidents
| Protocol | Date | Incident | Loss Evidence | Severity |
|---|---|---|---|---|
| Yearn | 2021-02-05 | yDAI V1 Flash Loan | Material | Major v1 |
| Yearn | 2023-03-13 | Euler exposure | Material | Major v2 |
| Yearn | 2023-04-13 | yUSDT Legacy iearn | Material | Major v1 |
| Aave | 2022-06-24 | Harmony Bridge Hack | Peripheral | Minor |
| Aave | 2024-08-28 | ParaSwap Adapter exploit | Peripheral | Minor |
| Spark | 2020-03-12 | MakerDAO Black Thursday | Dependency | Major |
| Beefy | 2024-05-14 | Sonne Finance exposure | None recorded | Minor |
Incidents affect the Platform vector through severity-aware incident caps.
Using Protocol Filters
curl "https://api.philidor.io/v1/vaults?protocol=morpho"
curl "https://api.philidor.io/v1/protocols/morpho"