Skip to main content
Sign in

Blend Pools V2

avoid.net/blend-pools-v2→32/100·100% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2iA9fF…C1Uv

Summary

Blend Pools V2 is a modular, permissionless lending protocol built on the Stellar blockchain by Script3, launched as an upgrade to Blend V1 with additions including flash loans and a reduced backstop threshold. In February 2026, a community-managed pool built on top of the protocol (YieldBlox DAO Pool) suffered a $10.8 million oracle manipulation exploit; Script3 stated the core V2 contracts were not at fault, attributing the incident to pool-operator misconfiguration of the Reflector VWAP oracle.

Connected Entities

1 entities
Organizations
□Blend Pools V2
Relationships
    Have evidence about Blend Pools V2?

    Timeline(8 events)

    3 April 2023

    Script3 publicly introduces Blend as a liquidity protocol primitive for Stellar's Soroban smart contract platform, announcing it as pre-testnet.

    25 January 2024

    Certora publishes formal audit of the Blend protocol covering the emitter, liquidity pool instances, and backstop module.

    9 April 2024

    Co-founder Markus Paulson-Luna discusses Blend's architecture and Stellar DeFi positioning in a public interview with The Defiant.

    23 February 2026

    Attacker manipulates USTRY/USDC price 100x on SDEX via thin liquidity, exploiting the YieldBlox DAO Pool on Blend V2 and borrowing 61.25M XLM and 1M USDC — approximately $10.8M total.

    23 February 2026

    Stellar Tier 1 validators coordinate to freeze approximately 48 million XLM (roughly $7.2M) in attacker accounts before bridging to Ethereum is complete.

    24 February 2026

    Script3 issues public statement attributing the exploit to pool-operator misconfiguration, stating core Blend V2 contracts are unaffected.

    24 February 2026

    YieldBlox Security Council offers a 10% white-hat bounty with a 72-hour deadline in exchange for return of funds. Attacker does not respond.

    25 February 2026

    BlockSec and Halborn publish independent post-mortems confirming oracle misconfiguration as root cause; net user loss estimated at approximately $3.6M after frozen XLM is accounted for.

    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain11 Wayback Archivessrc:defillama

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (1 event). 11 of 17 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 5/4/2026, 2:54:18 AM

    last updated: 8/30/2026, 3:54:58 AM

    avoid.net — verified advice for a post-truth world