How Does INIT Capital Work?
INIT Capital is a composable lending protocol on Mantle and Blast that introduced 'Liquidity Hooks' — a plugin architecture allowing third-party dApps to access its lending pools for leveraged strategies without building their own liquidity. Earning a C grade, the protocol's ~$2.25M current TVL (down ~95% from its 2024 peak of ~$45M) reflects a severe adoption decline. Primary risks include external hook contract code risk, limited oracle redundancy (API3 only, no active fallback), and a pre-token governance structure without formal on-chain accountability. The protocol has no known exploits but remains in an early and fragile operational state.
TVL
$2M
Sector
Lending
Risk Grade
C
Value Grade
D
Core Mechanisms
Lending/Pooled-Lending
Per-asset isolated lending pools with Multi-Silo Position isolation
Each asset has its own lending pool (not shared). Multi-Silo positions isolate each borrowing position independently, similar to Euler Finance's isolated pools but at the position level. Lenders supply to specific asset pools; borrowers draw from specific pools.
Lending/Hook-Architecture
NovelLiquidity Hook composable plugin system for third-party dApp integration
Novel composable architecture where external protocols submit hook contracts to access INIT's lending pools without building their own liquidity. Hooks handle looping, leveraged LP, perpetual margin, and flash-borrow strategies. Growth flywheel: more hooks → more borrowing demand → higher lend APY → more liquidity. No other major lending protocol uses this exact plugin model (< 3 protocols for < 3 years).
Lending/Interest-Rate-Model
Per-pool interest rate model with mode-specific parameters
Standard utilization-based interest rate models with auto E-Mode groupings (Stable, LST, Non-Stable modes) allowing different leverage tiers for correlated assets.
Lending/Liquidation
NovelMinimal Liquidation with dynamic health-factor-based premium formula
Premium = (1/HF - 1) × mode_factor × max(borrow_liq_factor, collateral_liq_factor). Premium scales linearly with health factor deterioration — worse position = higher liquidator incentive. Ceiling prevents full position seizure; liquidation stops once HF recovers to mode-specific max. This dynamic formula design differs from the fixed-bonus liquidation used by Compound, Aave, and most forks.
Lending/FlashLoan
Flash Borrow (cross-asset repayment with open position allowed)
Modified flash loan allowing repayment in different assets than borrowed and leaving a healthy position open at end of transaction. Used for one-click leverage looping. Related to Aave/Balancer flash loans but with the cross-asset repayment twist that is increasingly common.
Oracle/Multi-Source
INIT Oracle with API3 primary and Pyth secondary (pending activation)
Multi-source aggregation with deviation threshold check. If sources diverge beyond threshold, protocol pauses all actions (no fallback price — hard halt). Pyth listed as coming soon; API3 is only confirmed active feed, creating limited redundancy in practice.
Lending/Risk-Parameters
Auto E-Mode with per-asset debt ceilings and lending caps
Assets assigned to modes (Stable/LST/Non-Stable) with correlated-asset higher LTV. Debt ceilings per mode limit contagion; lending caps prevent infinite-mint token attacks. Similar to Aave V3's E-Mode concept.
Lending/Collateral
ERC20/ERC721/ERC1155 LP token collateral with yield-bearing asset support
Accepts standard tokens, Uniswap V3 NFT positions, and yield-bearing assets (mETH, USDY) as collateral. Flash-borrow-then-supply in a single transaction enables one-click LP collateralization.
How the Pieces Interact
An audited but malicious or buggy hook contract can interact directly with the INIT Position Manager on behalf of users, creating an external attack surface that bypasses core lending pool security — one compromised hook could drain positions that granted it approval.
With only API3 as the confirmed active price source, any API3 outage or manipulation triggers a full protocol pause rather than a fallback, creating binary availability risk (all-or-nothing) for users with open positions needing to manage health factors during volatility.
Each position is independently tracked; during rapid price declines, monitoring multiple open positions simultaneously may exceed liquidation bot capacity, allowing some positions to become severely undercollateralized before liquidators reach them — exacerbated by the Minimal Liquidation design that prevents full immediate liquidation.
Flash Borrow's ability to return different assets than borrowed creates a more complex attack surface than standard flash loans; interactions between flash borrow, hook contracts, and collateral manipulation could enable novel economic exploits not present in standard lending protocols.
If collateral price drops faster than the dynamic liquidation premium can attract liquidators (particularly for low-liquidity assets), positions may become insolvent before full health restoration — the Minimal Liquidation ceiling prevents over-liquidation but also limits emergency collateral extraction speed.
What Could Go Wrong
- Liquidity Hook architecture introduces external smart contract risk: third-party hook contracts (e.g., DEX loop hooks for MerchantMoe, Agni, Ethena) interact directly with user positions in INIT's core, and a buggy or malicious hook could drain positions — 'Official Partner' status requires an audit but permissionless hook submissions have lower scrutiny.
- Oracle infrastructure is under-redundant: API3 is the primary price source with Pyth listed as 'coming soon,' and when oracle sources deviate beyond thresholds, INIT pauses all protocol actions rather than falling back to a secondary price — creating a hard dependency on a single active feed.
- Severe TVL collapse since mid-2024 peak ($45M → $2.25M, ~95% decline) suggests the hook-based liquidity flywheel has not self-reinforced; the Blast chain deployment is effectively dormant ($93K TVL), and development activity appears sparse since late 2024.
- Pre-token status means no protocol-owned governance or formal risk committee: parameter changes require manual operator action with limited on-chain accountability, introducing key-person risk for oracle threshold and debt ceiling adjustments.
Compromised Hook Contract Drains User Positions via Position Manager Access
TailTrigger: A Liquidity Hook contract registered as an 'Official Partner' (after audit) contains a latent exploit — such as an admin key that can drain approved user positions — or a subsequently-deployed hook upgrade introduces a vulnerability.
- 1.Attacker identifies a registered hook contract with an admin key or upgrade proxy that they control or have compromised — The hook has been granted Position Manager approval by users who opened positions through it (e.g., the Ethena USDe looping hook or a MerchantMoe leveraged LP hook)
- 2.Attacker pushes a malicious upgrade or calls an admin function on the hook contract to redirect position collateral withdrawal permissions — The hook contract, acting as an authorized caller of INIT's Position Manager, begins extracting collateral from user positions without user consent
- 3.INIT's Position Manager processes the collateral withdrawal requests from the hook as legitimate (hook is approved caller) — User positions are drained; Minimal Liquidation mechanics do not apply (this is not a liquidation — it is an authorized withdrawal from a compromised caller)
- 4.Attacker repays any outstanding borrows with stolen collateral to prevent detection, then bridges funds off Mantle — Full collateral loss for affected position holders; no risk fund or backstop mechanism for hook-mediated exploits
Risk Profile at a Glance
Overall: C (44/100)
Lower score = safer