spark.fi
Summary
Spark is a Sky/Maker ecosystem capital allocator with roughly $4.8B TVL across eight chains, offering SparkLend (Aave v3 fork), Spark Savings vaults, and a $2.1B cross-chain liquidity layer. It has operated since 2023 with no direct fund losses and one of DeFi's stronger audit programs (22+ tier-1 reviews, $5M Immunefi bounty). Primary risks are deep Sky/USDS dependency, 13 unverified contracts (22%) including L2 governance executors, executive control via Sky's SubProxy rather than SPK token voting, and acute SPK token unlock pressure in June 2026. Overall risk is moderate at 4.9/10.
Trust Assumptions
Users trust that Sky governance and the SubProxy (warded by Sky Pause Proxy and StarGuard's 7-day spell window) will act in depositors' interest, that Sky's USDS vault and Savings Rate remain solvent and accessible, that Chainlink and median oracles (Chronicle, RedStone) price collateral accurately, that deployed bytecode matches audited code despite 22% unverified contracts, and that emergency multisigs (SparkLend 3-of-5, ALM 2-of-4) use freeze powers only in genuine incidents.
What Could Go Wrong
A Sky USDS depeg, vault pause, or governance change could block Spark's $2.1B liquidity layer from drawing capital and disrupt Savings yields across all chains. Thirteen unverified contracts—including PoolConfigurator, KillSwitchOracle, and L2 Spark Executors—mean upgrade paths and cross-chain spell execution cannot be independently confirmed; a compromised ward holder could execute immediate SubProxy delegatecalls without an on-chain timelock. Oracle failure on Chainlink feeds (no on-chain fallback configured) or stale SSR data on L2s could misprice collateral and trigger bad liquidations, while an exploit at any ALM-integrated venue (Aave, Ethena, Curve) could drain funds within rate-limit bounds.
Recommendation
Spark is suitable for yield-seeking capital given its clean three-year track record, layered emergency tooling, and strong audit history, but size exposure to your tolerance for Sky ecosystem coupling and governance centralization. Monitor USDS peg health, new SparkLend market listings, unverified contract verification status, and the June 2026 SPK unlock cluster (~770–900M tokens). Reduce exposure if SubProxy ward holders change, critical contracts remain unverified, or ALM deployments expand to unaudited integrations beyond v1.7.0 differential reviews.
Key Findings (30)
Analysis Sections
Spark executive control is concentrated in the SubProxy (0x3300…8c4), authorized via wards by Sky Pause Proxy and Spark StarGuard (7-day max delay). SPK Snapshot voting is signaling-only; on-chain changes flow through Sky executive spells. Operational freezer multisigs (SparkLend 3/5, ALM 2/4) hold limited emergency powers. Cross-chain governance uses Gov Relay with timelocked L2 executors, but Arbitrum's Spark Executor is unverified.
Findings (8)
On-chain verification shows SubProxy wards are held by Sky Pause Proxy (0xBE8E3e36…) and Spark StarGuard (0x6605aa12…), not SPK token holders. SubProxy owns PoolAddressesProvider, is ACL admin, holds POOL_ADMIN and EMERGENCY_ADMIN on ACLManager, and DEFAULT_ADMIN on ALM MainnetController. SPK governance is off-chain Snapshot signaling; execution requires Sky Atlas updates and executive spells.
SubProxy.exec() performs immediate delegatecall execution for any address with wards. While StarGuard enforces a 7-day maxDelay for whitelisted proxy spells, the SubProxy contract itself has no built-in timelock. Sky Pause Proxy can authorize and execute changes without an on-chain delay at the SubProxy layer.
Cross-chain governance on Arbitrum routes L1 SubProxy messages through ArbitrumReceiver (l1Authority=SubProxy) to Spark Executor 0x65d946…f7a1, which is unverified on-chain. This creates a governance asymmetry: mainnet contracts are verified and auditable, but the primary Arbitrum execution target cannot be source-audited.
ALM Freezer multisig (0x90D8c80…3431) is a 2-of-4 Gnosis Safe verified on-chain. It holds the FREEZER role on MainnetController, enabling removal of ALM relayers without governance spell. This is a low-threshold operational backstop separate from SPK/Sky governance.
SparkLend Freezer (0x44efFc4…eC3) is a 3-of-5 Gnosis Safe. On-chain checks show it does not hold ACL EMERGENCY_ADMIN or POOL_ADMIN directly; emergency pause authority for SparkLend sits with SubProxy (EMERGENCY_ADMIN). The freezer multisig provides operational incident response but its exact on-chain permissions require spell-granted roles.
L2 Sky Gov Relay contracts accept messages only from L1 counterparts (Arbitrum L1 relay 0x9ba25c…; Base L1 relay 0x1ee0ae8…). Gnosis uses AMBBridgeExecutor with controller=SubProxy (delay=0, gracePeriod=3 days). Optimism Executor has delay=0 and gracePeriod=7 days. Cross-chain governance inherits bridge liveness and security assumptions.
Spark StarGuard (0x6605aa12…E45E) is warded on SubProxy and enforces maxDelay of 7 days for whitelisted proxy spells, adding a validation layer between Sky executive approval and SubProxy execution.
Spark operates a weekly governance cycle with Spark Risk Council review, Operational Facilitator verification, and Snapshot voting (>50% approval). Proposals require 1% SPK (100M tokens) or nested contributor status. This provides process rigor but remains off-chain and non-binding until Sky spells execute.
Governance Checklist
Key Governance Entities
Governance Parameters
Operational Multisig Signers
| Multisig | Threshold | Signer Address |
|---|---|---|
| SparkLend Freezer | 3/5 | 0x8a714da4cd3ad43442a092227db52860329e0742 |
| SparkLend Freezer | 3/5 | 0x3126c94c032a1d9be9294cf5be2da99255b00cc8 |
| SparkLend Freezer | 3/5 | 0xcff27a5979f423f2fe073e22fec07050b157f656 |
| SparkLend Freezer | 3/5 | 0x8541ccfc6e7eacebd233c6789a0fbf7c708b0e68 |
| SparkLend Freezer | 3/5 | 0x52a8305f29f85bec5fa6ee78b87ddd2218d8e12e |
| ALM Freezer | 2/4 | 0x52a8305f29f85bec5fa6ee78b87ddd2218d8e12e |
| ALM Freezer | 2/4 | 0x3126c94c032a1d9be9294cf5be2da99255b00cc8 |
| ALM Freezer | 2/4 | 0x8541ccfc6e7eacebd233c6789a0fbf7c708b0e68 |
| ALM Freezer | 2/4 | 0xacd204885e9ea069c1cd3e4b12a75ce478de6f1d |