Summary
Ketju does not approve the Venus Core Pool: it has lost lenders' money repeatedly since 2021, and it runs on BNB Smart Chain, which Ketju does not approve. Venus's own post-mortem puts the May 2021 protocol loss near $77M; some accounts give $95M. More losses followed. The May 2022 LUNA oracle freeze left a roughly $14.2M shortfall, and an snBNB oracle error caused another in 2023. The 2025 wUSDM donation attack cost $716,789 net. The October 2025 WBETH oracle-depeg liquidations needed compensation. In March 2026 an attacker bypassed the THE supply cap and manipulated its price. In March 2026 governance proposed repaying about $2.20M of remaining Core Pool bad debt across 19 assets from treasury and risk-fund resources. Venus V4 adds isolated pools, multi-source oracle checks, risk funds and several governance routes. The Core Pool still shares collateral, oracle and liquidity risk across all its markets. The chain alone keeps Venus off the approved list, and the repeated shortfalls make the finding stronger. A September 2025 phishing theft from one user was not a protocol loss, and we do not count it.
Review triggers
- A named Venus pool runs on an approved chain for 24 consecutive months without new bad debt, oracle-caused liquidation or supplier loss
- Venus publishes per-market history of bad debt, liquidations, utilization and failed withdrawals, and it matches on-chain state
- Every listed collateral, oracle source, guardian, risk steward and timelock authority is documented and matches deployed contracts
- Readily realizable pool risk-fund assets exceed the written stress loss without discretionary treasury support
- A stablecoin withdrawal and a collateral liquidation test at the proposed size pass the written time and slippage limits under stressed utilization
Facts
- Verdict
- Not approved
- Type
- Dollar lending
- Chains examined
- BSC
- Reviewed
- Last confirmed