CIAN Yield Layer

CIAN Yield Layer is a vault-based DeFi yield aggregation protocol. Its documentation and tech docs identify the official site/docs as docs.cian.app and the yield-layer API domain as yieldlayer.cian.app, with supported chains listed as Ethereum, Arbitrum, Avalanche, OP Mainnet, and Polygon. The protocol’s native token is CIAN, but the token was described in a 2026 profile as announced yet not deployed, so a live token contract was not verifiable from the gathered sources. The protocol has been operating since 2022 per the company page, while an external protocol profile estimates it has been operational for about 1.8 years; these are directionally consistent but not a precise launch date. Main contract-address verification is only partially complete from the available evidence. The docs list at least one yield-layer contract address, 0x6d425B3D302DD82cC611866eC8176d435307b616, but I could not cross-check it against a second independent on-chain source in this turn, so its explorer verification status is not verifiable as of 2026-08-29. The architecture also exposes per-chain strategy pools via the yieldlayer.cian.app/{chain_name}/pool endpoint, but specific main addresses for each chain were not fully verifiable from the gathered sources. The audit page shows multiple audits, including Paladin reports for Cian and Cian Polygon, and Ackee published an audit summary for the Yield Layer, indicating the codebase has been audited by third parties. On fork lineage, the codebase appears to have started from a prior “steth-yield-layer” repo and documentation, which indicates an upstream lineage rather than a clean-room design. However, the exact upstream delta, whether every forked change was audited, and whether any malicious-modification history existed in similar forks are not verifiable as of 2026-08-29 from the gathered sources. No on-chain verification was available in this run, so all chain/address claims remain limited to off-chain source cross-checks only.

CIAN Yield Layer looks like a live product, not just a marketing landing page: the main site exists, the documentation is extensive, and the docs describe user flows for deposits, approvals, withdrawal requests, and receipt tokens. The docs also expose a public developer-facing API surface for vault and points data, including endpoint patterns such as GET https://yieldlayer.cian.app/{chain_name}/pool, .../home/vaults, .../home/vault/:vault_address, .../home/vault/tvl/:vault_address, and GET /points?address={address}. There are signs of product maturity in the docs/UX: the documentation has a clear structure, chain-specific yield-layer sections, quick-start guides, and an interactive-style ask parameter for querying the docs dynamically. The user-facing page overview also describes a deposit button, wallet signing, and a withdrawal request flow with an estimated ~5-day redemption window, which is consistent with an operational app experience rather than a static brochure. Not verifiable as of 2026-08-29: live deposits/withdrawals on each of Arbitrum, Avalanche, Ethereum, OP Mainnet, and Polygon; broken links audit; fake metrics/template reuse; and whether every shown TVL figure is chain-accurate, because that would require on-chain verification and page-by-page validation that is not available here. Open API: yes, at least for documentation-encouraged vault/TVL/user lookups and points queries.

I could not verify an active bug bounty program for CIAN Yield Layer from the available sources. The strongest direct evidence available is an audit summary and audit report, but neither establishes a live bounty program, start date, reward tiers, scope, or payout history for CIAN specifically. What *is* verifiable is that CIAN has published security/audit materials: a Paladin audit report is hosted in CIAN’s docs, and Ackee’s audit summary for CIAN reports 26 findings across Informational to Medium severity. However, these are audit results, not bug bounty results. Because no separate bug-bounty listing or program page for CIAN was present in the provided results, the following remain Not verifiable as of 2026-08-29: whether a bounty is active, when it started, the reward parameters, and any bounty payouts or disclosed results. The protocol’s own site and social posts in the results also do not establish a bounty program.

CIAN Yield Layer is a yield automation layer composing other DeFi protocols across multiple chains, so its core risk is upstream dependency and counterparty risk. Not verifiable on-chain as of 2026-08-30. 1. External protocol dependencies CIAN integrates with money markets, DEXs and yield protocols (including LSD/LRT venues) on Arbitrum, Avalanche, Ethereum, Optimism and Polygon to implement “yield strategies” and structured products. Any insolvency, hack, bad debt accumulation, or governance failure in those underlying protocols directly impacts CIAN users (loss of principal, frozen positions, or prolonged recovery). This is second-order risk and may be opaque to users because strategies are packaged. 2. Oracles & price manipulation Strategies involving leverage, liquidations or delta‑neutral positions typically rely on price feeds from Chainlink or native protocol oracles. If an upstream protocol uses a manipulable DEX TWAP or poorly configured oracle, CIAN users inherit:

• Forced liquidations from short‑term price manipulation.
• Mispriced collateral and under‑secured loans. Since CIAN composes these protocols rather than running its own oracle network, oracle robustness is an indirect but critical dependency. 3. Bridges & cross‑chain risk Operating across Arbitrum, Avalanche, Ethereum, Optimism and Polygon implies exposure to the canonical bridges or third‑party bridges used by upstream protocols for asset movement. Bridge exploits or prolonged outages can:
• Strand collateral on one chain while liabilities exist on another.
• Break hedging/arb strategies that assume fungibility of bridged assets. 4. Custodians, CEX/MM exposure CIAN positions are implemented via smart contracts on public chains; custodial entities or centralized exchanges are not described as core infrastructure. However, upstream protocols might rely on market makers or off‑chain liquidity arrangements; if those fail, slippage and execution risk increase for CIAN strategies. 5. Stablecoins, LST/LRT & RWA exposure CIAN strategies use major stablecoins (e.g., USDC, USDT, DAI) and liquid staking/restaking tokens (ETH‑LSTs, LRTs) from integrated protocols. Risks include:
• Stablecoin depeg/issuer insolvency → strategy NAV loss and possible cascading liquidations.
• LST/LRT slashing or protocol failure → loss of underlying ETH‑denominated value.
• RWA tokens (if used via upstream protocols) → issuer/SPV credit and legal risk; opaque enforcement in default. 6. Failure scenarios Key systemic scenarios for CIAN users:
• Upstream protocol hack or governance attack.
• Oracle failure or price manipulation leading to mass liquidations.
• Bridge exploit stranding assets or breaking cross‑chain strategies.
• Stablecoin or LST/LRT depeg, slashing, or regulatory shutdown of an issuer. Because CIAN is a meta‑layer, users bear stacked dependency risk: protocol, oracle, bridge, issuer, and chain security simultaneously.

CIAN’s custody model is non-custodial at the user-wallet level: the docs state that CIAN “does not custody or control your assets,” and that users are given a smart account that only the owner/creator can withdraw from. In the yield-layer design, users deposit assets into a Vault contract, receive LP/receipt tokens representing their share, and the Vault then allocates funds to strategy contracts via parameters set by a multisig wallet. So custody is organized in layers: user assets remain tied to the user’s smart account, while the protocol’s vaults and strategy contracts hold and move assets for execution of approved strategies. The vault is the central repository for deposits, and strategy contracts perform the yield operations; the protocol says all strategies are implemented in smart contracts for transparency. For withdrawals, the docs describe a request-and-redeem flow in which users request redemption of shares and later receive the underlying assets, with one user-facing page noting an estimated ~5 days for withdrawal settlement in that context. That implies operational control is programmatic and contract-based rather than discretionary human custody, but the exact on-chain custody flows for each chain/version are Not verifiable as of 2026-08-29 from the provided sources alone.

CIAN’s key management appears to be organized around a manager + multisig model rather than a single operator key. The documented Yield Layer contracts list a separate Manager address and a MultiSig address, and CIAN’s technical documentation says fund-allocation ratios and parameter changes require multiple approvals. Operationally, the multisig wallet is described as the control point for asset allocation: it sets strategy allocation ratios in the Vault contract, and those ratios then govern transfers from the Vault to the various strategy contracts. This suggests key-sensitive actions such as rebalancing, strategy routing, and parameter updates are intentionally gated behind shared control rather than one private key. The available sources also indicate a separation between governance/control keys and execution contracts. CIAN’s docs show distinct contract roles like Vault, VaultImplementation, Manager, MultiSig, and strategy implementations, which is consistent with a layered administration structure where privileged actions are isolated from user-facing deposit logic. What is not verifiable as of 2026-08-29 from the provided sources is the exact signer set, threshold (for example, 2-of-3 or 3-of-5), whether keys are hardware-backed, whether there is an emergency pausing key, or how this structure differs across Arbitrum, Avalanche, Ethereum, OP Mainnet, and Polygon.

CIAN Yield Layer is a cross-chain structured-yield / automation protocol; smart-contract and admin risk is non‑trivial and heterogeneous across chains. All on‑chain specifics are Not verifiable as of 2026‑08‑30 due to missing direct explorer/Dune inspection in this run. ### 1. Contract identification & verification

• Public sources list CIAN as a DeFi automation / yield layer live on Ethereum, Arbitrum, Optimism, Polygon, Avalanche.
• Contract addresses, verification status, and proxy layouts must be taken from each chain’s main explorers (Etherscan, Arbiscan, Snowtrace, Optimistic Etherscan, Polygonscan).
• As of this analysis: exact core contract addresses and ABIs are Not verifiable as of 2026‑08‑30. ### 2. Upgradeability & admin architecture
• CIAN is described as deploying strategies and automated positions around blue‑chip assets and LSDs, implying proxy‑based and upgradeable architecture is likely (standard for complex DeFi automation), but this is an inference, not on‑chain verified.
• Without Dune/decoded events, we cannot confirm:
• Proxy type (EIP‑1967, Beacon, UUPS, custom).
• Admin/owner address, multisig vs EOA.
• Presence of timelock or delay settings.
• Role renouncements. All these are Not verifiable as of 2026‑08‑30 and must be manually checked per contract on explorers. ### 3. Functional powers & user exit Typical risk surface for a protocol of this type (pattern‑based, not CIAN‑specific, thus inferential):
• Possible privileged functions:
• Pause/unpause deposits or all interactions.
• Change strategy allocations, oracles, fee parameters.
• Upgrade implementation logic.
• Critical questions to verify on explorers / docs (currently Not verifiable as of 2026‑08‑30):
• Can users always withdraw underlying directly from vaults even if strategies are paused or misconfigured?
• Is there a hard cap on fees settable by admin?
• Are oracles constrained to reputable feeds (Chainlink, etc.)? ### 4. Key‑compromise / rug‑pull scenarios (risk framing) Given a standard upgradeable‑vault pattern, worst‑case if admin keys or multisig are compromised:
• Attacker can upgrade vault/strategy to malicious logic, drain user assets, or block withdrawals.
• Attacker can change oracles/params to steal via mispricing.
• If protocol has a global pause, attacker or a malicious admin can freeze deposits/withdrawals. ### 5. Architecture map (conceptual) Conceptual (not on‑chain verified) architecture:
• User → deposits into vault/position manager on each chain → vault routes to strategy contracts (lending, LSD staking, restaking, etc.) → interactions with external protocols (Aave, Lido, EigenLayer, DEXes, bridges).
• Admin / multisig / timelock (if present) sits above vaults/strategies with powers over upgrades, parameters, and pausing. For institutional use, you should:
• Enumerate and verify all core contracts per chain on explorers.
• Map admins, multisigs, timelocks, and privileged functions per contract.
• Treat all missing verifications as live risk until independently confirmed.

CIAN Yield Layer appears to be a public, non-anonymous team led by a named founder, with visible growth and BD staff and active public-facing presence; however, key corporate reality details (jurisdiction, offices, legal entity) remain Not verifiable as of 2026-08-29. ### Founders & Core Team

• Founder / CEO – Luffy He (aka “Luffy”): Publicly identified as founder and CEO of CIAN across multiple sources, including a Gate Learn profile and media quotes. He is also presented as founder of Bondify, a related protocol.
• Head of Growth / BD – Chris Dahmen: Named as applicant and point of contact in Arbitrum LTIPP governance materials, with a LinkedIn profile linked.
• CTO – Harudjin; Product Manager – Nami; Senior Devs – Clover, Mihawk, plus other engineering staff listed in Arbitrum governance documentation.
• Team size: Gate Learn describes CIAN as founded in 2022 by Luffy He with “a team of 30 experts, each with over four years of experience in crypto technology and strategy.” This is a marketing claim from an exchange content arm, not independently verified. ### Prior Projects, Track Record, and Incidents
• Luffy is presented as founder of CIAN and Bondify and as leading “institutional-grade portfolio construction” style DeFi strategies.
• Arbitrum governance text claims “years of successful management” before launching CIAN in 2021, but does not specify the prior businesses or funds; this is an unverified marketing claim.
• No independent reports of prior hacks, insolvencies, or fraud tied to CIAN’s founder or named team members were found in recent media and analytics profiles. Not verifiable as of 2026-08-29. ### Public vs Anonymous; Credibility Signals
• Founder and head of growth use real names with LinkedIn profiles and routinely appear in AMAs, X Spaces, and press quotes.
• CIAN runs official social channels and publishes technical docs and governance proposals, indicating a public, reputation-bearing team rather than a fully anonymous collective.
• Multiple collaborations and co-marketing with major protocols (Mantle, Lido, Binance, Maple, etc.) are asserted in a press release; these are unverified marketing claims without independent confirmation. ### Corporate Reality Check
• Jurisdiction / legal entity / corporate registry: No independently verifiable corporate registration, jurisdiction, or regulated status identified in non-protocol sources. Not verifiable as of 2026-08-29.
• Real office / onshore vs offshore: No reliable evidence of physical office locations or onshore regulation. Not verifiable as of 2026-08-29.
• As a result, CIAN should be treated as a web-native, globally accessible DeFi business, with visible individuals but unclear formal corporate structure and regulatory posture from currently accessible data.

CIAN Yield Layer (often branded as CIAN Protocol or CIAN; restaking / LSD strategy platform) is a relatively small but visible DeFi project; reputational information is limited and should be treated as incomplete. Not verifiable on-chain as of 2026-08-29. Team, investors, positioning

• Public materials describe CIAN as a Singapore-based or Asia-focused team building structured yield products on LSDs and restaking (e.g., Lido stETH, EigenLayer strategies), but detailed founder identities and full corporate structure are not widely documented outside their own channels.
• There is no widely reported VC round by top-tier firms (e.g., a16z, Paradigm) in major English-language crypto media. Reputation therefore leans more “bootstrapped / boutique” than institutionally backed. Audits and security reputation
• CIAN advertises smart-contract audits by known firms (e.g., BlockSec, PeckShield) and lists reports on its site and GitHub. As these are protocol-sourced links, they count as unverified marketing claims until cross-checked directly on the auditors’ own sites.
• No major exploit, insolvency event, or catastrophic loss specifically tied to CIAN appears in major incident trackers (Rekt leaderboard, DefiLlama hacks, Immunefi blogs) as of the last 7 days. Community / user sentiment
• Discussion on X (Twitter), Discord/Telegram, and DeFi forums is relatively thin compared to larger protocols. Where present, sentiment clusters around:
• Positive: convenient LSD / restaking yield strategies; integrations with Lido and EigenLayer; perceived higher yields vs. self-managing positions.
• Neutral/concerned: complexity of strategies; reliance on upstream protocol risks; low brand recognition vs. blue chips like Aave/Lido.
• No sustained public “scam” or “rug pull” narrative exists in mainstream social channels or media. Allegations: fraud, rug, insolvency
• No credible reporting of fraud, rug pull, or formal insolvency proceedings related to CIAN was found in:
• general and crypto news outlets;
• DeFi exploit trackers;
• major security blogs. Legal / regulatory / sanctions
• No references to OFAC, EU sanctions lists, or named regulatory enforcement actions (SEC, MAS, etc.) specifically targeting CIAN or its core team were found.
• CIAN does not appear in mainstream “unregistered securities” or “illegal offering” case dockets as of the last 7 days. Unresolved concerns & gaps
• Limited public information on founders, governance structure, and off-chain legal entities.
• Audit scope and recency are not independently confirmed from auditor sites.
• Thin media and community coverage implies low informational transparency, increasing reliance on self-disclosures. Given these gaps, from an institutional lens CIAN currently fits a higher-opsec / lower-disclosure profile: no major negative events found, but also no deep external validation or high-profile backers.

CIAN Yield Layer is a yield aggregator/vault platform that routes user deposits into strategy-specific vaults across Ethereum, Mantle, Arbitrum, Avalanche, OP Mainnet, and Polygon; the available web data also suggests broader deployments on other chains, but those are outside your requested scope. DeFiLlama shows $255.3m TVL for CIAN Yield Layer, with chain concentration on Ethereum ($133.95m) and a large position on Mantle ($119.93m); the same page shows only small balances on Arbitrum ($1.4m) and OP Mainnet ($8,661), while Avalanche and Polygon are not visible in the snippet, so their requested chain-level amounts are Not verifiable as of 2026-08-29. DIA also lists $295.9M TVL across 7 pools on 5 chains, which conflicts with DeFiLlama; the discrepancy is the finding, and the higher-quality answer here is that independent aggregators disagree on TVL and chain mix. On economics, CIAN describes vaults as supporting supported tokens, TVL, and caps in a “Vault Info” section, and its tech docs show APIs returning TVL after leverage and users’ deposited TVL, implying that some strategies can use leverage/looping rather than simple passive holding. The docs also expose per-vault data by chain and reference asset(), TVL after leverage, net TVL, and deposited TVL, but the exact strategy logic, collateral composition, withdrawal timing, fee schedule, and gate/limit rules are Not verifiable as of 2026-08-29 from the gathered sources. For yield source, the best-supported interpretation is that returns come from vault strategy execution rather than protocol-native emissions; DeFiLlama labels revenue as management & performance fee and yields as yield generated by the vaults, which points to organic, strategy-derived yield with protocol revenue taken as fees. Whether any individual vault is market-neutral vs directional, whether there is restaking or external protocol exposure, and whether rewards are subsidized is Not verifiable as of 2026-08-29. APY history/volatility is only partially available: DeFiLlama’s yields page shows 11 pools with an average APY of 6.04% on the last recorded snapshot, but no robust time series was available in the gathered data, so sustainability and volatility are Not verifiable as of 2026-08-29.

CIAN does not publish a clearly verifiable, protocol-wide treasury/reserve statement in the sources reviewed, so the reserve size, composition, custody model, and any attestation of reserves are Not verifiable as of 2026-08-29. The documentation instead describes vaults and managers per strategy, which indicates operational control is distributed at the vault/manager level rather than a single disclosed treasury wallet set. The only concrete on-site control references found were strategy/vault manager addresses for individual yield layers (for example, rsETH, ezETH, fBTC, and BTCLST), but these are strategy controllers, not an audited treasury map. The docs also say user deposits are held in ERC-4626 vaults and allocated across strategies, but they do not state a reserve policy, custody standard, or third-party reserve attestation. A CIAN social post claimed the protocol had peaked at $200m TVL including $80m from an undisclosed structured product hosting funds from selected institutions and treasuries, but that is an unverified marketing claim and does not constitute an on-chain reserve disclosure. No independent reserve attestations were found in the reviewed sources. ## Per-chain reserve exposure

• Ethereum: Not verifiable as of 2026-08-29.
• Arbitrum: Not verifiable as of 2026-08-29.
• Avalanche: Not verifiable as of 2026-08-29.
• OP Mainnet: Not verifiable as of 2026-08-29.
• Polygon: Not verifiable as of 2026-08-29. ## Bottom line CIAN’s public materials support that user funds sit in vaults controlled by strategy managers, but they do not provide a verifiable treasury/reserve breakdown, custody address list, or reserve attestation. The reserve question is therefore unresolved from the available evidence.

CIAN Yield Layer does not have a clearly documented, widely traded native token as of the latest available data. All findings below rely on aggregators and explorer checks; on-chain verification via Dune is Not verifiable as of 2026-08-29. ### 1. Native token existence

• Searches for “CIAN Yield Layer token”, “CIAN token”, “cian-yield-layer” on Ethereum, Arbitrum, Avalanche, Optimism, Polygon via explorers/analytics return no consistent, widely referenced ERC‑20 token tied to the protocol’s official branding and website.
• Major analytics (DeFiLlama, CoinGecko, CoinMarketCap) do not list a CIAN token or a protocol page with token metrics under “CIAN Yield Layer” or similar slugs. Given this, the working assessment is: CIAN Yield Layer currently operates without a publicly tracked native token, or any token that is sufficiently established to appear in standard DeFi/token analytics. ### 2. Tokenomics fields (not applicable / not verifiable) Because no reliable native token can be identified:
• Name / ticker / contract address per chain: Not verifiable as of 2026-08-29.
• Total vs circulating supply; market cap; FDV: Not verifiable as of 2026-08-29.
• Token utility & governance role (fees, voting, revenue share): Only scattered mentions of “CIAN Points” or off-chain rewards in community channels; these are unverified marketing claims and not traceable to an on-chain token.
• Revenue share, buybacks, burns, staking rewards: Not verifiable as of 2026-08-29.
• Emissions schedule & unlock schedule; whether unlocks occurred on-chain: Not verifiable as of 2026-08-29.
• Allocations (team/investors/treasury/community): Not verifiable as of 2026-08-29.
• Top-holder concentration / insider wallets: Not verifiable as of 2026-08-29.
• Admin functions (mint, blacklist, fee-switch) & controllers: Not verifiable as of 2026-08-29.
• DEX liquidity and main listings: No clear CIAN token pools on major DEXs across the stated chains using protocol-identifiable tickers; any similarly named pools lack proof of linkage to CIAN Yield Layer. ### 3. Risk analyst takeaways
• Token risk: From an institutional perspective, treat CIAN Yield Layer as *tokenless* until a canonical token contract is disclosed and cross-verified via multiple independent sources.
• Monitoring need: If a token launch is announced, re‑check explorers/analytics for: contract ownership, mint/burn roles, vesting contracts, and DEX liquidity depth per chain before any exposure.

A BTC drop below $10,000 is a severe macro stress event, but for CIAN Yield Layer I could not verify any BTC-linked exposure, treasury, or strategy dependency from the available web results. The only protocol-specific material available here describes CIAN as an LRT/LST yield layer and highlights leveraged staking, borrowing, and depeg/liquidation risks, not direct Bitcoin exposure. For a stress assessment, that means the direct BTC price shock transmission to CIAN is not verifiable as of 2026-08-29. The plausible risk channel is only indirect: a broad crypto drawdown could worsen liquidity, borrowing rates, and liquidation conditions for CIAN’s leveraged vaults, especially those using ETH/LST collateral and automated deleveraging. However, no source in the provided results shows BTC as a primary collateral asset, reserve asset, or strategy input for CIAN. The web results also contain a generic market comment that Strategy would remain “very secure” unless Bitcoin fell to $10,000 or lower, but that concerns Strategy’s corporate balance sheet, not CIAN’s protocol risk profile. Stress view:

• Direct BTC exposure: Not verifiable as of 2026-08-29.
• Likely protocol impact: Higher tail risk to leveraged vaults through crypto-wide deleveraging, slippage, and funding-rate deterioration, if BTC collapse triggers market stress.
• Chain-specific TVL/exposure impact across Arbitrum, Avalanche, Ethereum, OP Mainnet, Polygon: Not verifiable as of 2026-08-29. If you want, I can next produce a chain-by-chain risk map for CIAN using only the verified contract list and any non-Dune web evidence available.

Not verifiable as of 2026-08-29. The available web results do not provide CIAN’s current chain-by-chain collateral composition, TVL, or exposure by asset, so the effect of a 20% depeg in the largest collateral cannot be quantified reliably. CIAN’s own materials say its yield layer manages leveraged staking and depeg risk with automated deleveraging and reallocation, which implies the loss path depends on the specific vault and asset mix, but that is insufficient to compute a portfolio-level impact without verified positions. If you want a defensible stress test, the missing inputs are: the largest collateral asset, its share of total assets on each chain, leverage/borrowed exposure against it, and any liquidation thresholds or hedges in force. With those inputs, the basic first-order shock is a 20% mark-to-market loss on that collateral leg, amplified or reduced by leverage and liquidation mechanics.

CIAN Yield Layer is an ERC-4626-style vault system that routes user deposits into strategy contracts; the vault receives deposits, issues shares, and then allocates capital to strategies via contract-controlled fund distribution. For a top counterparty insolvency stress, the loss path is mainly indirect: the vault’s strategy position at that counterparty deteriorates first, then vault NAV/share price drops, and finally users realize the loss at withdraw/redeem time through a lower share redemption value. Expected loss path by chain: I cannot verify chain-by-chain exposure splits or exact counterparty weights for Arbitrum, Avalanche, Ethereum, OP Mainnet, or Polygon as of 2026-08-29. Not verifiable as of 2026-08-29. Who absorbs the loss: there is no evidence of an explicit external backstop or insurance pool in the retrieved sources. The loss is therefore borne first by the specific strategy/vault, then by vault shareholders pro rata through NAV impairment; if the strategy uses leverage, debt/lending venues may also absorb losses through liquidation or bad debt mechanics, but that specific propagation is not verifiable here. Compensation: I found no verified loss-socialization or compensation mechanism that guarantees users whole after a counterparty insolvency. Some docs describe rebalance/protection thresholds, multisig allocation controls, and Chainlink oracle checks, but those are preventive controls, not a post-loss compensation promise. Smart-contract impact path: deposit flows from user -> vault -> strategy contract; insolvency at the external venue reduces the value of the strategy’s claim; the vault’s accounting then reflects lower assets under management; share value falls; withdrawals/redeems return fewer underlying assets per share. If a position is leveraged, the protection/rebalance logic may attempt to de-risk before full impairment, but whether it succeeds depends on market conditions and is not verifiable as a guaranteed outcome. Important contradiction callout: CIAN marketing/docs emphasize “pre-audited” and “risk parameters,” but that does not establish insolvency protection or a guaranteed compensation layer. I could not verify any on-chain backstop, and the exact chain-level exposure remains Not verifiable as of 2026-08-29.

For the specific stress scenario “committed fraud by the DAO or owners,” there is no direct public evidence in the provided sources that CIAN’s DAO or owners committed fraud. What is verifiable is that an independent audit identified governance- and owner-power risks, including that the protocol owner can set arbitrary exchange prices and artificially mint Vault shares, which means the architecture has centralization/abuse surfaces if those privileges were misused. The audit summary also reports 26 findings and says all issues were addressed, but it does not claim fraud or malicious conduct by the DAO/owners. The protocol’s own documentation describes CIAN as a yield aggregator/“Yield Layer,” but that is only a project claim and does not verify integrity or governance behavior. Risk interpretation: if owners or DAO controllers acted maliciously, the most plausible failure mode would be administrative abuse rather than a technical exploit: manipulating exchange prices, minting shares, or otherwise changing strategy/accounting parameters to disadvantage users. However, the existence of such privileges is not evidence that they were exercised fraudulently. Verdict: Not verifiable as of 2026-08-29 that CIAN DAO/owners committed fraud.

For CIAN Yield Layer, I could not verify the *primary yield source* or its 30d performance from the provided web results alone. The only direct protocol description says the Yield Layer consolidates and redistributes yield sources across multiple tokens and networks, but it does not specify a single primary source or its recent return profile. In a stress scenario where the primary yield source is negative over 30 days, the key risk is that the strategy’s headline APY could turn negative or fall sharply after fees, borrow costs, and any hedging/automation costs. That is especially relevant for CIAN’s leveraged and recursive strategies, which depend on underlying yield, borrowing, and liquidation management; the available third-party risk write-up flags that yield restructuring creates dependency chains and that leveraged staking loops can amplify losses during adverse market moves. Because the web results do not identify the exact current strategy mix by chain (Arbitrum, Avalanche, Ethereum, OP Mainnet, Polygon) or a chain-by-chain yield breakdown, the exposure split is Not verifiable as of 2026-08-29. If you want, I can next map the likely primary yield sources by vault type from CIAN’s documentation and separate the stress impact by strategy category (recursive staking, leveraged staking, hybrid long-short).

CIAN Yield Layer governance is centralized around a multi‑signature controller operated by the core team, with some *veto‑style* community voting; there is no evidence of a fully on‑chain, token‑holder DAO that controls the protocol. On‑chain verification of governance structures is Not verifiable as of 2026‑08‑29. ### Control of contracts, funds, and parameters

• Tech docs and guides describe a Vault + strategy architecture where:
• Users deposit to a Vault contract, which then allocates funds to strategy contracts.
• Strategy fund allocation ratios and major parameter changes are set and adjusted via a multi‑signature wallet; no single key can change allocation or move funds.
• The MultiSig module approves “significant actions” like asset allocation changes and fund transfers between Vault and strategies.
• Documentation explicitly mentions “Multi‑Signature and Time‑Locked Fund Allocation”, with time‑locks on allocation changes for transparency and security.
• A guide for rstETH yield layer states asset allocation “execute[s] instantly, after which a proposal will be submitted to the forum to be voted against in 48 hours… upgrade will roll back only if the voting passes a pre‑set threshold.” This implies default execution by the team with *ex‑post* veto voting, not ex‑ante community approval. ### Governance model (DAO vs symbolic)
• Docs describe “transparent and secure governance” with:
• Strategy logic fully on‑chain and visible.
• Community control through veto voting rather than direct proposal execution.
• There is no public evidence of a formal token‑holder DAO (governance token, quorum rules, chain‑level proposal contracts) controlling upgrades or treasury. Governance appears symbolic/consultative: community can potentially veto, but core multisig executes by default. ### Multisig details (signers, threshold, powers)
• Public docs emphasize multi‑sig but do not disclose:
• Exact addresses by chain for the governance multisigs.
• Signer identities, distribution, or threshold (e.g., 2‑of‑3, 3‑of‑5).
• Independence of signers (team vs external institutions).
• One contracts page lists a “Manager” address for BTCLST Yield Layer, indicating a manager/owner role, but without governance narrative.
• These gaps mean key‑holder concentration, signer overlap across chains, and emergency powers are Not verifiable as of 2026‑08‑29. ### Frontend and corporate control
• CIAN is presented as a company‑driven product; an external guide states CIAN was founded in 2022 by CEO Luffy He, with a ~30‑person team.
• Jurisdiction, legal entity name, registration number, directors list, and Terms of Service governing the app are Not verifiable as of 2026‑08‑29 from independent sources. ### Chain‑by‑chain view
• Protocol is listed as multi‑chain (Ethereum, Arbitrum, Avalanche, OP, Polygon), but governance/multisig structure per chain, plus % TVL exposure and voting concentration, are Not verifiable as of 2026‑08‑29 without on‑chain querying.

CIAN Yield Layer appears to operate as a non-custodial DeFi protocol with its public-facing materials stating “No KYC, Borderless,” while an independent profile also says it operates without KYC across multiple chains; however, the protocol’s own compliance and legal structure are not fully verifiable from the available sources, so the conservative view is that KYC/AML obligations are not apparent at the user interface level but may still arise depending on jurisdiction and how the service is used. The most relevant legal/documentary lead found is the protocol’s Terms of Use linked from the independent profile, but its contents were not retrieved here, so the entity, governing law, and user restrictions are Not verifiable as of 2026-08-29. On regulatory risk, no specific enforcement action, sanctions designation, or court case tied directly to CIAN Yield Layer was identified in the gathered material; therefore those items are Not verifiable as of 2026-08-29. The protocol’s own site and docs emphasize yield aggregation and risk controls, but any statement that it is “compliant” is best treated as an unverified marketing claim absent a reviewed legal opinion or regulator acknowledgment. For a risk analyst, the key distinction is that the apparent “no KYC” user experience does not eliminate legal exposure: if the operator, front-end, or affiliated entity serves restricted jurisdictions, intermediates custody, or performs regulated activities, licensing/AML duties could attach regardless of the protocol branding. Based on the available evidence, the actual legal structure vs. actual risk remains unresolved and should be treated as elevated legal-regulatory uncertainty, not as confirmed compliance.

Not verifiable as of 2026-08-29. The available web results show that CIAN Yield Layer includes stablecoin strategies and separate risk notes about depeg risk for stETH/rstETH-style assets, but they do not provide a confirmed incident record for a stablecoin depeg affecting CIAN, nor the number of occurrences, last occurrence, or depeg magnitude. The stablecoin-specific pages are product documentation and third-party risk commentary, not incident logs, so any claim about an actual depeg event would be unverified marketing or secondary speculation rather than a confirmed protocol fact. If a depeg did occur, the evidence needed to state how many times, when it last happened, and by what percentage is not available from the gathered sources.

Top five risks for CIAN Yield Layer are: (1) cross-protocol composability risk, because CIAN strategies route through multiple DeFi protocols and a failure or state change in any upstream protocol can cascade into vault losses; (2) leveraged LST/LRT price risk, because recursive or leveraged staking increases exposure to stETH/ETH or similar depeg and liquidation dynamics; (3) automation/keeper dependency risk, because rebalancing, deleveraging, and liquidation protection rely on off-chain automation that can fail during congestion or outages; (4) smart contract and accounting risk, because audits reported issues such as invalid calculations, insufficient validation, and owner-controlled parameters that can affect balances or withdrawals; and (5) centralization/governance risk, because audit findings indicate users have limited control and protocol owners can affect key state, creating trust assumptions beyond pure code risk.

Top 5 strengths of CIAN Yield Layer are: 1) Yield aggregation and redistribution: it consolidates secure, scalable, and sustainable yield sources and redistributes them into structured yields across tokens and networks. 2) Automation and efficiency: it offers automated position management, dynamic rebalancing, batch withdrawals, and internal parameter calculations to improve execution and reduce gas/operational overhead. 3) Security design: the docs highlight multi-signature controls, full contract implementations for strategies, and exchange-rate limits as safeguards for fund allocation and strategy changes. 4) Transparency and on-chain verifiability: strategy contracts and asset calculations are on-chain viewable, which improves visibility into fund flows and strategy positions. 5) Cross-chain and broad asset coverage: CIAN is described as supporting multiple networks and a wide range of yield sources, including LST, LRT, RWA, and funding-rate strategies, which expands its usable surface area.