Spark has been rapidly iterating and evolving, continuously adding incremental security features. We believe that now is a good time to release a comprehensive overview of Spark's risk management capabilities.

Spark Savings

Spark Savings is a set of non-custodial savings vaults that allow users to deposit stablecoins (such as USDT, USDC, USDS, etc.) to earn on-chain yields.

Asset Backing

All deposits in Spark Savings, denominated in US dollars, are backed by USDS at a 1:1 ratio. Spark Savings and USDS share the same priority level, and the full financial strength of Sky backs every deposit.

First Loss Capital

USDS (and Spark Savings) features a multi-layer loss protection mechanism at the Prime level.

First Layer – Internal Primary Risk Capital (Prime Level): Internal primary risk capital is the capital that first bears investment losses under the allocation system. Each Prime holds primary capital in the treasury according to its risk-weighted allocation ratio, serving as the first line of defense when losses occur. Spark is well-capitalized, holding over 35 million dollars in stablecoin equity capital.

Second Layer – External Primary Risk Capital for Prime: Prime can obtain additional primary risk capital from other Primes. This risk capital enjoys the same priority as Prime's internal primary risk capital and is used to cover losses related to Prime's allocation and risk exposure.

Third Layer – External Senior Risk Capital (srUSDS): This feature is planned for deployment in the near future. External senior risk capital is provided by the srUSDS smart contract, allowing users to supply USDS to Sky Core to act as senior risk capital, only beginning to bear losses after the complete loss of primary risk capital.

Fourth Layer – Surplus Buffer (Internal Senior Risk Capital): The Sky protocol buffer—namely the "surplus buffer"—is accumulated from stability fees and liquidation penalties to cover bad debts in the event of residual losses.

Fifth Layer – Comprehensive Surplus Buffer: After the surplus buffer is exhausted, losses will be covered by Sky's comprehensive surplus buffer, allowing Sky to utilize the corresponding portion of other Prime internal primary risk capital funded by Sky to address significant loss events.

Sixth Layer – Token Backing: If losses exceed the above sources of risk capital, Sky will mint SKY tokens to recapitalize the protocol and cover any residual bad debts.

Fair Loss Socialization: Only when all other sources of primary risk capital and token backing have been exhausted will any residual losses be equally shared among all USDS holders, including the Spark Savings stablecoin vaults (which are fully backed by USDS).

The multi-layered capital backing mechanism of the Sky ecosystem provides high assurance to Spark Savings vault users against incurring losses. Taken together, Spark Savings vaults are protected against losses and risk events valued at hundreds of millions of dollars.

Liquidity

Spark Savings vaults maintain industry-leading instant liquidity levels, suitable for institutional-grade use cases. The Spark Savings USDT vault maintains an instant liquidity buffer of over 400 million USDT available for redemption, while the Spark Savings USDC vault boasts redemption capabilities amounting to billions of dollars through integration with Sky PSM.

The savings vault contract maintains a liquidity buffer of up to 10 million dollars, meeting daily withdrawal demands through atomic redemptions. For large withdrawals, Spark provides an asynchronous liquidity intent mechanism that allows users to sign withdrawal requests for any amount, which are then quickly fulfilled through the Spark liquidity layer; in most cases, large withdrawal requests can be met within 1 minute (5 Ethereum blocks).

Transparency and Third-Party Ratings

Spark Savings vaults maintain industry-leading transparency regarding backing assets and related allocation strategies. Real-time backing data for Spark and Sky can be accessed through multiple open resources, including:

• Spark Data Dashboard: data.spark.fi
• Sky Information Dashboard: info.skyeco.com
• Spark App: app.spark.fi

Additionally, Spark has received ratings for the Spark Savings product from Credora—a leading independent crypto-native risk rating agency. Relevant ratings are linked in the Spark App, and the full report can be accessed on Credora's official website.

Event Response

If potential losses that may affect Spark Savings vaults occur, Spark can put the vault in recovery mode to mitigate risks. Temporarily pausing withdrawals ensures all users are treated equitably and avoids scenarios of bank runs.

Future Improvements

We are developing more enhanced features to further strengthen the security of Spark Savings vaults, including:

• Additional primary risk capital coverage at the Sky level
• Redundant withdrawal capabilities
• Ratings and reviews from industry-leading traditional financial risk experts

First Loss Capital: Spark and Sky are implementing a first loss capital vault (the third layer in the capital stack mentioned above), enabling users to earn higher yields by using funds to backstop potential losses in the protocol. This will significantly increase the scale of dedicated first loss capital, better protecting Spark Savings depositors.

Withdrawals: Spark will implement permissionless withdrawal functionality, ensuring that savings depositors can always immediately retrieve their deposits, even if Spark's infrastructure is unavailable in extreme conditions.

Ratings: We are actively collaborating with leading institutions in the traditional finance sector to acquire more institutional-level risk assessments and credit ratings, further guaranteeing that the Spark Savings vault meets the highest standards for safety and risk management.

SparkLend

SparkLend is Spark's permissionless money market. Compared to similar products, it consistently operates conservatively, with a strictly defined collateral range, multi-oracle pricing, strict rate limits, and first loss capital mechanisms. The rsETH event reminds us that these pillars do not exist in isolation; they are designed to work together to ensure that the failure of any single component (oracles, issuers, liquidators, market liquidity) does not trigger a cascade of bad debts.

Current Risk Architecture

Strictly Defined Collateral Range

SparkLend intends to control the number of listed assets to a limited range. ETH e-mode is restricted to wstETH and rETH. BTC e-mode is being completely removed: a deprecation notice has been publicly released on the Sky forum, slated for implementation in the governance operation on June 4, with remaining positions to be forcibly liquidated on June 8. The risk exposure in the affected pool is already quite small (one major borrower approximately 1.6 million dollars, along with a few small positions), and this removal is being conducted according to a pre-announced timeline, rather than immediately adjusting parameters.

Minimized Re-Staking

The collateral provided to SparkLend's reserve pool will remain within the reserve pool and will not be redeployed to external strategies.

Rate Limits

All cross-module flows of funds in SparkLend are subject to rate limits at the smart contract level: deposits, withdrawals, cross-chain bridging, and PSM exchanges each have their respective rate limits configured. Additionally, Spark's allocation system enforces debt ceilings and inventory minimum/maximum range constraints for each market. No individual depositor or single adverse event can deplete protocol funds within a block; rate limits constrain the maximum risk capital per path within a given timeframe.

Median of Three Oracles

Pricing utilizes a median aggregation of three oracles, sourced from RedStone, Chainlink, and Chronicle. When all three return valid and non-expired data, the median is taken; when two are valid, the average is taken; a single data source fallback mechanism is also in place. This ensures that if a single oracle is attacked or fails, it does not affect SparkLend's pricing.

Collateral Price Trigger Oracles

For collateral priced based on hard-coded prices or exchange rates (wstETH, rETH, weETH, cbBTC, WBTC, LBTC), collateral price trigger oracles continuously compare the market price of the asset with its underlying asset price. When deviations exceed the thresholds set for each asset, the trigger mechanism will halt new borrowing on SparkLend, preventing users from submitting damaged collateral at outdated "face value" prices and extracting healthy debt.

Programmatic Liquidity Injection

The liquidity buffer of SparkLend is not static. The Spark liquidity layer automatically injects or withdraws USDS, USDC, and USDT into or out of SparkLend based on target borrowing rates, fund utilization rates, and available inventory in other locations. When the capital utilization rate of SparkLend is high, the SLL will replenish idle liquidity to support smooth withdrawals and liquidations; if other locations provide better risk-adjusted returns, idle capital will rotate there. This is precisely why Spark operates as the largest depositor in its own market: liquidity responds to demand rather than relying solely on utilization rates to ration access.

Planned Improvements

Ongoing Collateral Risk Review

A comprehensive review of all collateral assets in SparkLend is currently underway, covering not only the independent risk profile of each asset but also their dependencies (issuers, custodians, oracle data sources, secondary liquidity, and redemption paths). This process will transition into a continuous review framework to ensure collateral risk is constantly monitored and updated in response to market conditions.

Oracle Improvements

A more progressive oracle design is being developed: under normal circumstances, hard-coded prices or exchange rates will be used as the default for pricing, transitioning to market pricing only upon observing sustained deviations. The goal is to maintain existing protections against flash crashes and abnormal oracle volatility while providing the protocol with a faster automated response capability to genuine structural decoupling events, allowing for orderly liquidations rather than allowing bad debts to accumulate behind outdated prices. This design aims to complement, not replace, the existing trigger mechanism: oracles automatically handle persistent market dislocations, while the trigger mechanism acts as the final fail-safe against catastrophic failures.

Accelerating Market Parameter Updates

Currently, most parameter changes in SparkLend require a full governance process, which can result in delays of several days. While this is acceptable for routine adjustments, it is too slow for tail-risk events. Efforts are underway to delegate risk parameters within a limited scope to risk manager roles, enabling operations such as tightening LTV, reducing supply ceilings, or adjusting rate models to be executed within hours, while ultimate decision-making authority remains with the governance of Spark and Sky.

Spark Isolated Market

Pooled lending markets can provide a better user experience, but there are limitations. Spark also offers isolated markets for collateral with unique risk characteristics through Morpho.

Isolated lending allows for more effective risk pricing, removing collateral that is no longer able to provide good risk-adjusted returns.

In addition to risk management tools, Spark will utilize isolated markets for all non-Ethereum on-chain lending activities, allowing Spark to access exchanges and fintech integrations without having to deploy or maintain its own infrastructure.

Improvements

• Spark will prioritize selecting markets with advanced oracle systems, ensuring resilience against any single data source failure.
• Spark will enhance interface support in the Spark App, allowing users to participate in lending on other chains directly through the Spark App.

Spark Liquidity Layer (SLL)

The Spark Liquidity Layer (SLL) acts as Spark’s non-custodial capital allocator, operating across DeFi/CeFi and traditional financial opportunities, and has been running steadily since November 2024 without failures.

The core design of the SLL aims to ensure that capital flows are constrained, predictable, and bordered under all conditions—including periods of market stress.

Key security features of the SLL include: Spark governance must pre-set approved venues and is bound by strict rate limits. Automated wallets can only transfer funds between these pre-approved venues, according to specified rate limits.

These constraints ensure that capital cannot be rapidly depleted from any single venue and that allocation changes occur progressively rather than reactively under stress conditions. This directly addresses the core failure modes observed in recent market events: unconstrained capital flows leading to rapid liquidity depletion and triggering cascading pressures across markets.

The threat model of the SLL assumes that even if automated wallets are fully compromised, the protocol will not face any substantive risks. Even under this assumption, capital remains confined to pre-defined venues and rate limit ranges, ensuring no single component can introduce unlimited risk to the system.

Improvements

This approach extends beyond design to proactive risk management and allocation decisions:

• Spark has deprecated many markets as part of broader risk-reduction initiatives and will continue to maintain proactivity during yield opportunity integrations.
• Spark will remove support for all Aave markets from the SLL whitelist. Although all Aave funds were withdrawn shortly after the rsETH event occurred, the ability to re-deposit will also be deprecated.
• Introducing AI-driven automation to detect a wider range of DeFi events and take appropriate actions.

Cross-Chain Bridges

Currently, there are 2 operational cross-chain bridges in the Sky/Spark ecosystem.

SkyLink: Sky Official Governance and Token Bridge

SkyLink is responsible for bridging Sky governance and cross-chain USDS. The governance configuration is 4/7 DVN, providing high decentralization and redundancy; the token bridge requires 2/2 DVN.

SkyLink is deployed on Solana and Avalanche.

SkyLink has recently completed deployment with a robust configuration and is implementing additional defenses against increasingly sophisticated nation-state attackers.

Improvements: In collaboration with LayerZero, the number of DVN for the token bridge is expected to increase from 2/2.

Spark Governance Bridge (Avalanche)

Spark operates its own LayerZero governance bridge to support Spark Savings USDC on Avalanche. This bridge is currently configured at 2/2 and plans to upgrade in the coming weeks to match SkyLink's 4/7 configuration.

This bridge does not involve an associated token bridge, and the at-risk capital is very limited (approximately 2 million dollars).

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。