KETJU Research

← The Register

Dollar lending

Alpend

Not approved Runs only on a chain Ketju does not approve
Verdict
Not approved
Runs only on a chain Ketju does not approve
Who can freeze it
Protocol
Governance can pause deposits, borrows and withdrawals for each asset, and by design these pauses have no timelock.
Withdrawals
A supplier can withdraw at any time, within two limits.
Reviewed
2026-10-16 · next 2027-01-16
Class rule for protocols on unapproved chains

Summary

Ketju does not approve Alpend under the class rule for protocols on unapproved chains: Alpend runs only on Canton Network, and Ketju has not reviewed Canton. Alpend is a pooled lending market written in Daml. A supplier deposits Canton Coin, CBTC or USDCx into that asset’s pool, earns a rate that borrowers pay, and collects Canton Coin rewards on top. On 2026-10-16 the DefiLlama yield feed showed four pools worth about $2.27M. DefiLlama’s protocol page showed about $2.22M supplied, net of $0.68M borrowed. We made no finding that Alpend is defective. The facts below are for the review that would follow a Canton approval.

Research

How it works

Each market is an isolated pool: suppliers deposit one asset and earn from borrowers of that same asset. Every supplied balance counts as collateral at once. A borrower may draw from any market against the whole basket, up to per-asset loan-to-value limits. The borrow rate follows a two-slope utilisation curve of the Aave kind. The supply rate is the borrow rate times utilisation, less a reserve factor that the docs put at 10% by default. Interest accrues to an index that updates hourly. Halborn’s report describes the design as Aave v3 written in Daml, with one difference for Canton: Canton Coin carries a holding fee that reduces balances over time, and the interest logic must account for it.

Size and holdings

The yield feed reads each pool from CC Tools, a third-party Canton data service. It reports supplied minus borrowed as the pool size. On 2026-10-16 it listed CC at about $1.87M, CBTC at $0.23M, USDCx at $0.15M and USDXLR at $0.03M. The docs name only three markets, so Alpend added the USDXLR market after it published the market list.

The feed also shows a reward rate of 4 to 10 points on top of base rates of 0.1% to 8.7%. Alpend pays that reward in Canton Coin under the Ascent II programme. Each market has a fixed daily CC budget, shared pro rata by supplied balance, so the effective rate falls as supply grows. Alpend’s own docs call the emissions a discretionary programme that Alpend can change or end. The reward is not interest from borrowers, and a reader should not treat it as a forward rate.

Who controls it

Alpend is in mainnet beta, and access is permissioned. Alpend must whitelist a wallet through waitlist.alpend.com, and the wallet logs in through Loop, the one supported Canton wallet. Only liquidators that governance approves may liquidate, and there is no grace period once the health factor falls below 1.0.

A protocol multisig changes parameters behind a timelock. BitSafe’s DecMan tool spreads control of sensitive actions across independent Canton nodes. The docs do not publish the signers, the threshold or the delay. Governance can pause deposits, borrows and withdrawals for each asset, and by design these pauses have no timelock. Loop hosts the protocol party on its multiparty hosting, so no single participant node holds it. An external oracle supplies prices; the audit page names a Chainlink Data Streams verifier in testing. We did not verify the multisig signers, the timelock length, the DecMan node set or the oracle feed.

Losses and incidents

Halborn assessed the Daml lending contracts between 8 and 19 June 2026. It reported 30 findings: 1 high, 9 medium, 16 low and 4 informational. Halborn marked all of them solved in the remediation commit. Most findings concerned fee and reserve accounting, oracle handling, liquidation safety and parameter controls. Alpend lists no bug bounty, only a disclosure email. We found no incident or loss. DefiLlama has listed the protocol since 2026-09-26, so its operating history is three weeks.

Withdrawals

A supplier can withdraw at any time, within two limits. The pool must hold enough unlent liquidity, and the withdrawal must not push the supplier’s own health factor below 1.0. At full utilisation, nobody can withdraw until borrowers repay or new supply arrives. The docs say the steep second rate slope pushes borrowers to repay, but they do not promise instant liquidity. During a security event, governance can pause withdrawals for one asset without delay. Canton itself provides confidentiality, finality and settlement. The disclaimer says validator downtime, network bugs or a fork could affect availability or finality. No Alpend position trades on a secondary market, so a holder can only withdraw through the pool.

Class rule

The class rule for protocols on unapproved chains covers protocols whose live yield venues settle only on a chain that has not passed Ketju’s chain review, or that Ketju has not approved. Canton is the first case of a chain with no review at all. Ketju does not approve a protocol while its only reachable deployment depends on an unreviewed chain. Every state change, oracle update, liquidation and withdrawal depends on that chain’s validators, finality and emergency controls, and an audit of the contracts cannot remove that dependence. On an approved chain, stablecoin lending uses the same deposit mechanism on a reviewed base. Alpend offers no venue that an advisor can reach without depending on Canton.

Ketju will review Alpend again only if Ketju approves Canton, or Alpend launches a material deployment on an approved chain. Either event would start a full review and would not by itself approve Alpend. Alpend is also below the size limit for a full review, which alone would leave it unapproved.

Sources

Each claim above comes from one of these sources. Where Ketju could not verify a number, the memo states that.

The asset and the chain

This memo covers the protocol. A position also holds an asset and settles on a chain. Whichever of the three holds the most power over the position decides who can freeze it. These tables describe control and do not judge quality.

ChainVerdictFreezeWhat it can do
Every memo is public. Subscribers link the research to the positions their clients hold, and Ketju emails them when the evidence changes. $299 per firm per month, first 30 days free. Start the trial.