Huma Finance

Huma Finance receives a C- risk grade (55/100) from Hindenrank, where lower scores indicate lower risk. Elevated risk — concentrated off-chain counterparty dependency on Arf and regulated PSPs creates structural risk that smart contracts cannot eliminate, partially offset by real payment flow yield and a 0% credit default rate on the current codebase. Huma Finance is a PayFi protocol on Solana that provides USDC liquidity to licensed payment service providers (PSPs) for cross-border payment pre-funding, generating real-world yield from 1-5 day revolving credit lines managed through its Arf partnership (a Swiss VQF-regulated entity). With $164M in TVL, $46.3M raised across two funding rounds, and a reported 0% credit default rate since inception, it is the leading PayFi protocol in DeFi. Its C- grade reflects concentrated counterparty risk on Arf and its regulated institutional borrower network, PST composable token integration risks across Solana DeFi (Kamino, RateX, Meteora), and significant regulatory dependency on Arf's Swiss VQF license — structural risks inherent to bridging real-world payment finance with on-chain liquidity pools. A minor V1 exploit ($101K) occurred on deprecated Polygon contracts in May 2026; V2 is a complete rewrite on Solana with no shared code and 6+ security audits.

The key risks identified for Huma Finance are: (1) The protocol's yield comes from off-chain payment flows underwritten by Arf (Swiss VQF-regulated). If Arf loses its regulatory standing or institutional PSP/MTO borrowers default, pool yields collapse and principal recovery depends on off-chain legal enforcement rather than smart contract guarantees. On-chain protections (first-loss cover reserves, junior tranche buffer) are finite. (2) PST tokens are composable across Solana DeFi — used as collateral in Kamino, split into yield/principal tokens in RateX, and provided as liquidity in Meteora. A secondary market discount on PST, even without actual underlying defaults, can trigger cascading liquidations across integrated protocols, amplifying losses beyond the Huma pool itself. (3) The Evaluation Agent (EA) model requires a permissioned on-chain actor to approve all credit draws. EA key compromise could enable fraudulent drawdowns against pool liquidity. Six security audits since 2025 have reviewed this surface with no critical EA-specific findings. (4) LP capital is locked for 3-6 months with asynchronous epoch-based redemption. During market stress, simultaneous lockup expirations combined with slower PayFi repayment cycles could create redemption queues extending significantly beyond the stated lockup period. (5) HUMA token's Maxi Mode offers 0% base APY with yield entirely from token rewards. The token declined approximately 80% from its May 2025 TGE peak of $0.1156, and 82.67% of total supply remains locked with investor/team unlocks beginning in late 2026 — creating potential sell pressure as vesting schedules activate.

Huma Finance scores 55/100 across eight risk dimensions: Mechanism Novelty: 9/15, Interaction Severity: 17/20, Oracle Surface: 5/10, Documentation Gaps: 4/10, Track Record: 3/15, Scale Exposure: 5/10, Regulatory Risk: 6/10, Vitality Risk: 6/10. The highest risk area is Interaction Severity at 17/20.

Among 121 rated Yield protocols on Hindenrank, Huma Finance ranks #118 by safety (lowest risk score = safest). Its 55/100 risk score and C- grade place it among the riskier Yield protocols.

Huma Finance scores 3/15 on the Track Record risk dimension, indicating some history of security incidents or exploits. Higher scores reflect more severe or frequent incidents. Review the full risk report for details.