Supported Protocols
11 protocol modules with versions, strategy defaults, audit context, and incident history.
Philidor tracks vaults across 11 protocol modules registered publicly, plus Kamino staged below in the indexer.
Protocol Modules
| Protocol Module | Strategy Coverage | Versions | Launch Date | Audits | Bug Bounty |
|---|---|---|---|---|---|
| Aave | lending | v2, v3, v3-lido, v3-etherfi | 2020-01-08 | 8 | Immunefi |
| Aave V4 | lending | v4 hub-spoke | 2026-03-30 | 5 | Immunefi |
| Yearn | yield_aggregation | v2, v3 | 2020-07-17 | 8 | Immunefi |
| Beefy | yield_aggregation | v2 | 2020-10-08 | 6 | Immunefi |
| Morpho | isolated_lending | v1, v2 | 2024-01-10 | 8 | Morpho |
| Spark | savings and lending | v1, v2 | 2023-05-09 | 8 | Spark Security |
| Compound | lending | v3 Comet | 2022-08-26 | 3 | Immunefi |
| Uniswap V2 | liquidity_provision | v2 | 2020-05-18 | 9 | Uniswap Security |
| Uniswap V3 | liquidity_provision | v3 | 2021-05-05 | 9 | Uniswap Security |
| Uniswap V4 | liquidity_provision | v4 | 2025-01-31 | 9 | Uniswap Security |
| Nest | multi_market and savings | v1 | 2025-01-01 | 1 | Nest Security |
The strategy column describes module coverage. Individual vault rows carry the canonical strategy_type used for scoring.
Kamino (Solana) — rolling out
Kamino is Philidor's first non-EVM protocol module, covering both Kamino
programs: K-Lend (isolated lending markets whose reserves become
vault rows, and whose markets are served first-class by
/v1/markets) and Kamino Earn
kVaults (curated vaults allocating across K-Lend reserves, with
allocation snapshots and curator attribution).
What is different from the EVM modules, by construction:
- Identity: addresses are base58 and case-sensitive; the chain id is
the synthetic
1399811149. The standards-based CAIP-2 key is served by/v1/chainsonce Solana's first vault rows are public (the endpoint lists active-vault chains). - Verification: every published figure is reconciled against finalized on-chain account state decoded with pinned program IDLs — vendor API values that disagree with chain state are withheld, not served.
- Control scoring: program upgrade authority and emergency powers, not contract admins — see Control and Governance.
- Oracles: reserve price sources resolve through Kamino's Scope aggregator with worst-of attribution — see Oracle Providers.
Rollout status: the chain, scoring, reconciliation and event ingestion
are live internally; Kamino vault rows appear in the public API when the
staged rollout gate flips the chain to supported. Until then
?chain=solana validly returns an empty list.
Aave V4 markets and hubs
Aave V4 is hub-and-spoke: a hub pools liquidity per asset and owns the rate accounting, while spokes are the user-facing markets that draw on it, each with its own collateral set and risk policy. Several spokes can share one hub — bespoke risk without fragmenting liquidity.
Each spoke reserve is a vault row in /v1/vaults. The spokes
themselves are served as first-class markets by
/v1/markets, with supplied/borrowed rollups and hub_address so
markets sharing liquidity stay identifiable.
Instances beyond the Aave DAO deployments
Some Aave V4 instances are operated by third parties rather than the Aave DAO. They clear Aave governance (TEMP CHECK / ARFC / AIP) but are absent from the official Aave API and changelog, so Philidor indexes them directly from chain against a reviewed allowlist of hub addresses:
| Instance | Chain | Discovery | Notes |
|---|---|---|---|
| Aave DAO deployments | Ethereum, Avalanche | Aave API | Main, Bluechip, Forex, Gold, Lido, Etherfi, … |
| EtherFi Cash | Optimism | On-chain | ether.fi-operated; powers the ether.fi Cash card backend |
Numbers for on-chain-discovered instances come from the same on-chain reads as every other Aave V4
row. Two limits are worth knowing: supply caps are not read on-chain, so deposit_capacity_usd is
null rather than unlimited; and borrow availability is reported unknown rather than inferred —
on EtherFi Cash, borrowing is permissioned to KYC'd cardholders while supply is open.
Key Auditors
Across all protocols, primary audit firms include OpenZeppelin, Trail of Bits, ChainSecurity, Spearbit, Cantina, Certora, Zellic, ABDK, and PeckShield.
Contest platforms such as Code4rena and Sherlock receive additional credit in audit density scoring.
Notable Incidents
| Protocol | Date | Incident | Loss Evidence | Severity |
|---|---|---|---|---|
| Yearn | 2021-02-05 | yDAI V1 Flash Loan | Material | Major v1 |
| Yearn | 2023-03-13 | Euler exposure | Material | Major v2 |
| Yearn | 2023-04-13 | yUSDT Legacy iearn | Material | Major v1 |
| Aave | 2022-06-24 | Harmony Bridge Hack | Peripheral | Minor |
| Aave | 2024-08-28 | ParaSwap Adapter exploit | Peripheral | Minor |
| Spark | 2020-03-12 | MakerDAO Black Thursday | Dependency | Major |
| Beefy | 2024-05-14 | Sonne Finance exposure | None recorded | Minor |
Incidents affect the Platform vector through severity-aware incident caps.
Using Protocol Filters
curl "https://api.philidor.io/v1/vaults?protocol=morpho"
curl "https://api.philidor.io/v1/protocols/morpho"