SparkLend

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

SparkLend is an Ethereum Aave v3 fork with Sky-governed parameters and unusually deep stablecoin liquidity supplied through Sky. This review corrects the previous memo: a SparkLend supplier is not a pro-rata investor in the Spark Liquidity Layer’s CeFi or RWA book. Spark says assets supplied to a SparkLend reserve stay there; the SLL can add or remove its own liquidity but does not redeploy the client’s aToken claim. The relevant risks are therefore Aave-style borrower bad debt, collateral and oracle failure, governance or upgrade action, available cash at exit, and — for DAI or USDS exposure — the Sky balance sheet and peg. The architecture is credible, but a recommendation still needs a position-specific asset choice and live liquidity test rather than a protocol-wide approval.

Kill criteria: the events that revoke this verdict
• Any selected reserve with unresolved bad debt, an unbacked aToken balance, or a failed proposed-size withdrawal
• USDS depeg beyond 1% for more than 24h
• Utilization above 90% for 30 days in the selected reserve, or an emergency freeze lasting more than 24 hours
• A selected collateral oracle running without the documented multi-feed or ratio-killswitch protections
• Any unaudited upgrade to a custom oracle, rate strategy, cap automator, or pool implementation used by the selected reserve

The research file

Mechanism and claim

A supplier transfers an asset into one reserve of an Aave v3-style pooled money market and receives an interest-bearing aToken claim. Borrowers draw reserve liquidity against overcollateralized positions; interest accrues to suppliers after the reserve factor. If a borrower’s health factor falls below one, third-party liquidators repay debt and receive collateral plus the configured bonus. The close factor is up to 50% while health factor is above 0.95 and up to 100% at or below 0.95, according to Spark’s current docs.

The decisive correction is scope. Spark explicitly says collateral supplied to SparkLend stays in the reserve and is not sent into external strategies. The SLL is a large participant and dynamically tops up or removes its own USDS, USDC and USDT inventory. CeFi counterparty opacity matters to Sky and SLL solvency, but it is not the direct source of a third-party SparkLend supplier’s yield. USDS and DAI remain distinct: their value and some rates depend on Sky governance and the wider Sky balance sheet.

Control, upgrades, and risk boundaries

Sky Governance controls listings, LTVs, liquidation thresholds and bonuses, caps, e-mode, interest-rate strategies, oracle configuration, freezes and upgrades. That is active risk management, not immutable code. Spark documents per-reserve supply and borrow caps and a Cap Automator that can adjust within governance-set bounds. Its oracle design uses RedStone, Chainlink and Chronicle with median or fallback logic, plus ratio-oracle kill switches for selected wrapped assets. Those layers reduce single-feed and infinite-mint risk but add custom contracts and operational automation to the Aave base.

ChainSecurity verified that the original deployment closely matched Aave v3 but expressly said its work was deployment verification, not a security assessment or parameter review. Spark publishes separate audits and an Immunefi bounty. Approval therefore cannot rest on the phrase “Aave fork”; each custom oracle, interest-rate strategy, cap automator and governance path must remain in the monitored perimeter.

Failure and incident record

No user-fund exploit of SparkLend was identified in this pass, but there is a non-zero operational record. In September 2023 a governance parameter change exposed an error in the custom DAI interest-rate strategy: assets and liabilities diverged, leaving more than $214,000 of unaccounted protocol assets when discovered. The published post-mortem says end users were not affected, the amount was recoverable to the Maker treasury, and the strategy was replaced. On 2025-05-28 operators froze new DAI supplies and borrows for about six hours after an alarming burn event; investigation found normal rebasing-token accounting and the market reopened without loss.

The first event demonstrates that custom rate logic can defeat the comfort of the Aave inheritance; the second demonstrates both discretionary freeze power and a functioning response process. Neither proves future solvency. The next review should reconcile published incidents against on-chain bad-debt and reserve-factor balances rather than infer “no losses” from missing headlines.

Exit and liquidity

A supplier can withdraw only the reserve’s available liquidity. There is no contractual maturity, but utilization can make an immediate exit partial or impossible until borrowers repay, liquidators clear debt, or the SLL adds inventory. Spark says the SLL targets utilization and can top up stablecoin reserves; that is a useful liquidity backstop, not a depositor guarantee. A frozen reserve can also block new activity while leaving the exact permitted actions dependent on its Aave reserve state.

Before allocation, test the exact withdrawal at proposed trade size against on-chain available liquidity, utilization, borrow concentration and cap headroom. For a stable sleeve, prefer the asset whose redemption path is independently acceptable; a liquid USDC reserve does not cure USDS peg risk, and a deep USDS reserve does not create a legal claim on Sky collateral.

Comparison and decision frame

Against Aave v3, SparkLend offers a narrower listed set, Sky-supplied stablecoin depth, custom multi-oracle defenses and governance-managed rates. The trade is greater dependence on one governance and balance-sheet complex. Against Morpho, Spark socializes borrower and collateral risk across each reserve rather than isolating it in individually curated vaults; that is simpler for exit but less granular for underwriting. Against direct sUSDS, SparkLend supply earns borrower interest and bears money-market bad-debt risk, whereas sUSDS is a direct Sky savings claim with a governance-set rate.

Keep under review. Reopen for approval only for a named supplied asset when a live position-size withdrawal quote succeeds, utilization and cap headroom remain within a written limit, the relevant oracle and collateral set are approved independently, and no unresolved bad debt or incident exists. A protocol-wide TVL number is not a substitute for those reserve-level tests.

Open questions and observable triggers

ChainSecurity’s deployment verification identifies the Ethereum SparkLend Pool proxy as 0xC13e21B648A5Ee794902342038FF3aDAB66BE987 and the reviewed implementation as 0x62DA45546A0f87b23941ffe5ca22f9d2a8fa7DF3. That pins the contract boundary, but it does not select a client reserve: USDC, USDS, DAI, and WETH have distinct cash, collateral, oracle, and peg risks. No proposed client withdrawal size was specified, so an executable exit test cannot honestly be claimed in this pass. Those omissions keep allocation at zero. The current admin and emergency-role addresses, multisig thresholds, and full governance execution delay were not independently read on-chain this pass. Nor were current reserve-level cash, utilization, borrower concentration, bad debt, or liquidation performance. The docs describe a three-oracle system, but the exact live feed configuration must be verified for the asset actually selected.

Observable reopen tests: proposed-size withdrawal succeeds at par; utilization stays below 90% for 30 days; the selected reserve has no unbacked aToken or unresolved bad debt; all custom components in its path have published audits; and governance/emergency authorities and delay are recorded from chain state. A later formal verdict should be asset-specific, not a blanket SparkLend vote.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• SparkLend architecture and risk controls · primary · accessed 2026-08-15
  Supports: reserve architecture, SLL liquidity role, oracle and risk controls
• SparkLend liquidation documentation · primary · accessed 2026-08-15
  Supports: health factor, close factor, liquidation mechanism
• Spark security audits · primary · accessed 2026-08-15
  Supports: audit inventory, custom component scope, deployment reviews
• ChainSecurity SparkLend deployment verification · primary · accessed 2026-08-15
  Supports: Pool proxy address, implementation address, initial reserve configuration
• SparkLend Advanced contracts repository · primary · accessed 2026-08-15
  Supports: custom rate strategies, oracle components, cap automator code
• Sky DAI market accounting post-mortem · primary · accessed 2026-08-15
  Supports: DAI accounting incident, impact and remediation, reserve record
• Sky spDAI market-freeze post-mortem · primary · accessed 2026-08-15
  Supports: spDAI freeze, oracle or reserve response, incident remediation

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.