Is Homora V2 Safe?
Risk Grade: C+ (40/100)
Homora V2 is rated as elevated risk — multiple novel mechanisms and notable interaction risks.
Elevated risk — historic $37.5M exploit and high-leverage mechanics create substantial risk, partially offset by post-exploit code remediation and audits.
Homora V2 is a leveraged yield farming protocol allowing up to 9x leverage on DEX liquidity positions, with $110M TVL across Ethereum, Avalanche, and other chains. Its C+ grade reflects the February 2021 $37.5M exploit (patched and re-audited), high leverage amplifying liquidation risk, and the custom spell system that expands smart contract attack surface beyond standard lending protocols.
TVL
$110M
Mechanisms
5
Interactions
4
Value Grade
D
Key Risks for Homora V2 Users
Homora V2 was exploited for $37.5M in February 2021 through a flash loan attack. While the vulnerability was patched and the code re-audited, the incident demonstrates the protocol's complex attack surface.
Users can take up to 9x leveraged positions on yield farming strategies. This means small price drops can lead to rapid liquidation of positions, and during volatile markets, cascading liquidations can occur.
The protocol depends on external DEX protocols like Curve, Uniswap, and SushiSwap for underlying yield. If any of these protocols experience issues, Homora users with leveraged positions face amplified losses.
Top Risk Factors
- •The protocol suffered a $37.5M exploit in February 2021 via a complex flash loan attack that exploited missing input checks and rounding errors in Iron Bank integration — the codebase has since been patched and re-audited but the same core architecture remains.
- •Leveraged yield farming up to 9x amplifies liquidation risk during volatile markets; oracle delays on underlying LP token pricing can cause cascading liquidations across leveraged positions.
- •Dependency on external DEX protocols (Curve, Balancer, SushiSwap, Uniswap) for underlying yield strategies means vulnerabilities in those protocols directly affect Homora users.
- •Custom spell system allows users to execute complex leveraged strategies in a single transaction, increasing smart contract attack surface beyond standard lending protocols.
How Homora V2 Compares to Peers
Homora V2 ranks #43 of 68 DeFi protocols (below-median — riskier than average). At a risk score of 40/100, it's 4 points riskier than the sector average of 36/100.
Adjacent peers: Tokemak (C+, 39/100) is ranked just safer, and io.net (C+, 40/100) is ranked just riskier.
See the full DeFi sector leaderboard or the Homora V2 vs io.net comparison.
Common Questions about Homora V2
Plain-English answers based on Homora V2's scores across Hindenrank's 8 risk dimensions. The highest-scoring (riskiest) dimension is Track Record (9/15).
Has Homora V2 ever been hacked or exploited?
Homora V2 has had some operational issues or moderate incidents in its history. The track record dimension scored 9/15 — not catastrophic, but enough to flag. Look at the specific events and whether they were addressed by the team before drawing conclusions.
How much money is at stake in Homora V2?
Homora V2 currently holds more than $110M in user deposits. A protocol of this size typically has deeper liquidity, more eyes on the code, and more attention from auditors — but it also means a single failure has a much larger blast radius.
What's the worst-case scenario for Homora V2?
Hindenrank has identified specific collapse scenarios for Homora V2. The most prominent: "Flash Loan Exploit via Spell System Composition". The trigger condition is An attacker discovers a state manipulation vulnerability in a new spell or spell combination, similar to the 2021 Iron Bank exploit vector, enabling extraction of lending pool funds via flash loan-powered transactions. Reading through the full scenario list on the protocol page is the single best way to understand the actual failure modes — generic "smart contract risk" is rarely the thing that takes a protocol down.
Is Homora V2 regulated or insured?
Homora V2 has some regulatory exposure (4/10), typical of mid-sized DeFi protocols. There is no specific enforcement action on record, but the structure includes elements that regulators have flagged in similar protocols. No DeFi protocol carries FDIC-style insurance — even with low regulatory risk, depositors are not protected in the way bank customers are.
What are the biggest red flags for Homora V2?
Hindenrank's retail-focused risk audit flagged: Homora V2 was exploited for $37.5M in February 2021 through a flash loan attack. While the vulnerability was patched and the code re-audited, the incident demonstrates the protocol's complex attack surface. Users can take up to 9x leveraged positions on yield farming strategies. This means small price drops can lead to rapid liquidation of positions, and during volatile markets, cascading liquidations can occur. The protocol depends on external DEX protocols like Curve, Uniswap, and SushiSwap for underlying yield. If any of these protocols experience issues, Homora users with leveraged positions face amplified losses.
Should beginners deposit into Homora V2?
Homora V2's C+ grade puts it in the elevated-risk band. This is not a beginner-friendly protocol. Anyone depositing here should treat the position as speculative and avoid concentrating significant savings in it.
How does Homora V2 compare to safer DeFi alternatives?
Homora V2 is one protocol in Hindenrank's DeFi coverage. The safest DeFi protocols on the leaderboard tend to share three traits: a long incident-free track record, conservative mechanism design, and high-quality public documentation. Compare Homora V2 against the full DeFi ranking before committing capital.
For the full 8-dimension score breakdown, the radar chart, and dependency graph, see the Homora V2 risk report.
Read the Full Homora V2 Risk Report
This protocol has 2 collapse scenarios. 2 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.