Blockaid Partners with Mellow Finance to Secure Its Vault Infrastructure

Executive Summary

Mellow is a vault infrastructure protocol for onchain asset management. Curators, asset managers, and protocol teams use Mellow to design and operate structured products, with strategies executing across integrated DeFi venues inside limits enforced at the contract level. That infrastructure now underpins some of the most recognized products in DeFi, including Lido's EarnETH and EarnUSD vaults, and holds more than $250+ million in TVL across its Core Vaults architecture.

Mellow has partnered with Blockaid to secure that infrastructure. Onchain Monitoring is live across Mellow's environment, delivering continuous detection against exploits, anomalous fund flows, and emerging threats across the contracts their vaults run on and the protocols those vaults route into. Alerts reach the team in real time with the forensic context needed to act.

Deposits from many parties flow into strategies that touch many protocols, so the security surface of vault infrastructure extends well beyond the contracts a team deploys itself. Blockaid closes that gap with a monitoring layer that watches every dependency continuously, surfacing threats the moment they emerge so teams can act while it matters.

The Partnership: Monitoring Built for Vault Infrastructure

A vault's security depends on everything its strategies touch and on how its operators respond when something breaks. Strategies allocate across lending markets, DEXs, and yield venues, and each integration adds a dependency whose failure can reach the deposits inside. For an infrastructure provider like Mellow, monitoring has to cover that full graph, the vaults themselves, the contracts they interact with, and the third-party protocols underneath, and it has to connect detection to action, with response measures that reach from pausing deposits and withdrawals to blacklisting known exploit addresses.

With Onchain Monitoring live, Mellow's coverage spans the full monitoring lifecycle:

• Monitor: Continuously watch vault contracts and the positions inside them, along with the lending markets, DEXs, and yield venues their strategies allocate into.
• Detect: Identify exploits, abnormal fund movement, and strategy behavior that breaks from expected patterns across a vault's full dependency graph, surfaced as it happens rather than after withdrawals are already draining.
• Investigate: Trace each alert to its source, from the attacker's funding trail to the specific contracts involved, and close the gap between detection and resolution.
• Respond: Push detections into the team's shared channels the moment they fire, with severity and affected contracts attached, so response starts in minutes.

Infrastructure that other teams build on carries a different standard of care. Curators run strategies on Mellow, fintechs and exchanges integrate its vaults into their products, and depositors trust those strategies with their capital, which means a single missed signal can reach well beyond one team's balance sheet. With Blockaid live across that infrastructure, Mellow adds a protection layer that covers the platform and everyone operating on it.

Learn more about Blockaid's Onchain Monitoring →

First Exploit Caught: Detection Proven Days Into the Partnership

Days after the partnership began, that coverage was tested by a live event. Blockaid's detection flagged active exploit transactions targeting legacy third-party vault deployments built on early Mellow contracts, code from 2021 that Mellow itself no longer operates. The attacker was using flash loans to manipulate the legacy vaults' share accounting, redeeming more than they deposited, and draining funds that liquidity providers still held in the contracts. It was a live, repeating pattern, with a second attack following the first within minutes, and sibling vaults still holding assets sat exposed to the same technique.

Within minutes of the attack, Blockaid's alert reached Mellow's team with the attacker's addresses, every affected contract, and recommended actions to contain it. Mellow confirmed its live infrastructure was unaffected, relayed the findings to the team operating the affected deployments, and deposits on the vulnerable contracts were paused, ending the attacker's run before it reached the vaults still holding funds. An unfolding exploit became a contained one, and the difference was knowing in real time.

Share accounting manipulation is precisely the class of risk vault infrastructure carries, and exploits like this rarely stop at one transaction. When detection is continuous, the window between the first malicious transaction and drained funds stops being the attacker's advantage. Positions stay intact, depositors stay whole, and for infrastructure that other teams build businesses on, the trust that everything running on it is watched stays intact with it. Days into the partnership, that is what Mellow saw work.

Looking Ahead: Securing Vaults as a Service Platforms 

Mellow is building for a market where structured products move onchain at institutional scale. Its model is vaults as a service, where Mellow sets the operating framework and security setup so that the curators and institutions building on it can focus entirely on defining their strategies.

Core Vaults encode strategy constraints directly into vault configuration, which integrations can be used, which actions are permitted, and how capital moves, with enforcement happening onchain. As more capital enters that model, the infrastructure carrying it becomes a larger target, and the cost of a missed signal grows with every deposit.

Continuous onchain monitoring is part of that infrastructure. This is the foundation of Blockaid's View on Security, that onchain security has to operate at the speed of the blockchain itself, across the full stack of signals. Mellow building that layer in as it scales is what securing institutional DeFi looks like in practice.

About Blockaid

Blockaid is the onchain security platform trusted by the largest companies operating in Web3. Built by veterans of elite intelligence and cybersecurity units, Blockaid provides end-to-end protection for financial institutions, protocols, and end users, combining direct wallet and dApp integrations with real-time monitoring, detection, and response across smart contracts, infrastructure, and externally owned accounts. Since 2025, Blockaid scanned over 6.3 billion transactions and blocked 585 million attacks. Blockaid is the security infrastructure behind Coinbase, MetaMask, Uniswap, Safe, and dozens of the most widely used platforms in the industry.

Learn more at blockaid.io, and follow us on Twitter and LinkedIn.