Dolomite

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

UNDER REVIEW, with a recommendation to reject protocol-wide approval and permit a later market-specific review only. The engineering case is real but narrower than the prior memo implied. Dolomite documents six audit firms across its inherited core and actively developed modules and reports 100% line, statement, and branch coverage; the same page warns that module audit scopes differ as integrations change. The core accounting layer is generally immutable, while mutable modules wrap external assets and strategies. That distinction is the file. A USDC lender is not simply taking stablecoin-credit risk: all deposits enter a virtual balance usable across lending, internal trading, margin, and integrated isolation-mode wrappers. Governance and operators can list assets, change risk parameters, approve global operators, and use specified emergency functions without the ordinary timelock. The current protocol has no located bad-debt event, but the project record is not exploit-free: a retired 2019 Loopring-era contract with stale user approvals was exploited for about $1.8M on 2024-03-20; 90% was recovered and the treasury reimbursed the rest. At the 2026-08-14 check, DefiLlama reports about $187.4M of TVL across chains and $304.8M of borrowed value, an adapter/accounting relationship this review has not reconciled to Dolomite’s virtual-liquidity ledger. The audit count cannot substitute for underwriting each collateral, oracle, wrapper, caps, available cash, and admin path. No client allocation should proceed until a named USDC or USDT market dossier proves that its borrowers and liquidation routes exclude the exotic integration surface.

Kill criteria: the events that revoke this verdict
• Any bad debt exceeding the safety buffer
• Virtual liquidity permitting a DEX failure to reach lending depositors
• New collateral listings that cannot be partially liquidated

The research file

The mechanism

Dolomite combines a money market, internal exchange, margin engine, and strategy integrations around DolomiteMargin. A deposit becomes a virtual Dolomite Balance: trades and borrows can change the internal ledger without transferring the token out of the core contract. The same deposited asset can remain economically active inside an integrated wrapper—for example earning or exercising native rights—while also serving as collateral. This is capital efficient, but it makes “plain supply” a claim on a shared accounting and liquidation system rather than a segregated cash vault. Borrow positions are separated by account number, can contain up to 32 assets, and a liquidation in one position does not seize an unrelated idle balance.

Isolation Mode wraps an external asset and restricts which collateral and debt may coexist with it. Once enabled it cannot be removed, although its settings can change. This reduces direct cross-collateral propagation but adds wrapper, oracle, unwrapper, and external-protocol dependencies. Dolomite documents pause sentinels for several GMX and Pendle integrations whose operation depends on the external market, withdrawal state, or callback configuration. Liquidations may be full or partial at the contract level, while the documentation says the production bot was still performing full liquidations at its last update. “Supports partial” is therefore not evidence that every listed asset has a dependable partial-liquidation path in practice.

Who controls it

The architecture has an immutable core and mutable modules, but the core still has administrative configuration. Dolomite documents a 2-of-3 Safe owning a delayed multisig. The launch delay was one day; the page instructs readers to query the live secondsTimeLocked value rather than assume the text remains current. Certain functions can bypass that delay, including closing a market, changing its maximum supply, and changing the interest setter. Admins can set price oracles, collateral and liquidation parameters, earnings rates, and global operators that act across accounts. These are meaningful lender-risk powers even though they cannot rewrite the immutable accounting bytecode.

veDOLO governance can vote on listings, delistings, risk parameters, treasury, incentives, and tokenomics. The governance documentation also says protocol operators may perform listings and risk-parameter changes operationally. The DAO is represented by a Marshall Islands entity; Dolomite Ltd in the BVI issues the token, the Cayman foundation acts as steward, and Leavitt Innovations is contracted for development and maintenance. The memo did not verify the current Safe signers, the live delay, operator addresses, or which powers have migrated to token votes.

The record

The security page lists OpenZeppelin, Bramah, SECBIT, and Cyfrin reviews for the core, and Zokyo, Guardian, and Cyfrin work for modules. It explicitly says module development is active and each report covers a different scope. The claimed 100% line, statement, and branch coverage is a project-reported test metric, not a proof that every external integration or economic state is covered. No loss in the current Arbitrum/Ethereum production system was located in the sources reviewed.

The broader project did suffer a material incident. On 2024-03-20 an attacker used invalid Loopring orders and lingering approvals to a retired Dolomite contract deployed in 2019, taking about $1.8M from 187 wallets. Dolomite’s post-mortem says the contract was disabled within an hour, 90% was recovered by March 24, and the treasury supplied the remaining 10% before reimbursements on March 26. The affected code was not the current product, but the event disproves the old “never exploited” framing and is relevant to lifecycle controls over deprecated approvals. DefiLlama reported $187.4M current TVL versus a $929.5M peak on 2025-03-03 at this review.

The exit

A supplier may withdraw only the underlying liquidity currently available. Dolomite’s developer documentation states that a withdrawal above available liquidity fails; the user must wait for repayment or swap the virtual balance into another withdrawable asset. That alternative is a trade, not a contractual cash redemption: it introduces price impact and depends on internal or external market liquidity. Isolation-mode assets add wrapper-specific exit rules and can be paused when an integrated protocol disables withdrawals or its unwrapper fails.

For a client sleeve, the relevant liquidity number is therefore not protocol TVL. It is free cash in the exact supplied asset, the market’s utilization and caps, the concentration and liquidation route of its borrowers, and executable swap depth under stress. None of those point-in-time measures is frozen in this memo. The $10M registry floor cannot be treated as met until the named market dossier measures an exit without counting borrowed balances or unrelated protocol TVL.

The comparison

Aave V3 offers a long operating record and governance-controlled pooled markets; Morpho offers immutable base markets but moves the hard decision to each market and curator; Dolomite adds internal trading, margin accounts, and external wrappers to the lending ledger. Its position-level account separation is better than treating every wallet balance as one cross-collateral pool, but it does not isolate a USDC supplier from the quality of borrowers using that USDC pool. The architecture earns a place in the research universe, not a protocol-wide approval.

The decision recommendation is to reject the protocol-level entry at the next formal decision and replace it, if warranted, with a specific-chain, specific-asset market file. Approval would require the same discipline used for a Morpho vault: named collateral set, oracle paths, caps, admin controls, bad-debt waterfall, and exit liquidity, all monitored independently.

Open questions

Reconcile DefiLlama’s $187.4M TVL and $304.8M borrowed figures to Dolomite’s virtual-liquidity accounting without double counting. Identify the current 2-of-3 Safe signers, live timelock, bypass whitelist, global operators, and which governance actions remain operational rather than vote-bound. Publish current bad debt and any reserve or insurance balance by chain; the prior thesis’s claimed liquidation-funded safety buffer was not located in authoritative documentation and should not be relied on.

For any candidate USDC or USDT allocation, record current available cash, total borrows, top collateral and borrower concentrations, oracle contracts and fallback behavior, supply and borrow caps, liquidation execution by asset, and the exact module versions covered by audits. Reopen only when that market-level package is complete and shows no route from an unapproved wrapper or collateral into client principal.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Dolomite documentation — protocol architecture and virtual liquidity · primary · accessed 2026-08-14
  Supports: architecture, immutable core, virtual liquidity
• Dolomite documentation — balances · primary · accessed 2026-08-14
  Supports: virtual balance, internal ledger, capital reuse
• Dolomite documentation — risk management · primary · accessed 2026-08-14
  Supports: isolation mode, liquidations, pause sentinels
• Dolomite documentation — admin privileges · primary · accessed 2026-08-14
  Supports: 2-of-3 Safe, timelock, emergency bypasses
• Dolomite documentation — governance · primary · accessed 2026-08-14
  Supports: governance scope, operational authority, legal entities
• Dolomite documentation — audits and security · primary · accessed 2026-08-14
  Supports: audit firms, scope limitations, test coverage claim
• Dolomite developer documentation — depositing and withdrawing · primary · accessed 2026-08-14
  Supports: withdrawal availability, virtual-balance swap exit
• Dolomite post-mortem — legacy contract vulnerability · primary · accessed 2026-08-14
  Supports: 2024 legacy exploit, loss and recovery, user reimbursement
• DefiLlama — Dolomite protocol data · secondary · accessed 2026-08-14
  Supports: current TVL, borrowed value, historical peak

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.