IPOR (Fusion)

IPOR Fusion: How the On-Chain Vault Framework Works

IPOR Fusion is a framework for building and running automated DeFi vaults. Each Fusion vault takes a single deposit asset. A curator, called an "Atomist", decides which protocols and markets it may use, and an executor, called an "Alpha", moves funds between them within those limits ²³⁴. Swiss company IPOR Labs AG builds the code and runs the app at app.ipor.io ¹. Governance runs through the community Fusion DAO ¹⁵. Fusion replaced IPOR's original business, on-chain interest-rate swaps. That product has been phased out, and no new swaps have been opened since April 2, 2026 ¹⁴.

Facts checked October 23, 2026 19 cited sources No score on this page, no affiliate links

IPOR (Fusion) rating and evidence Best yield aggregators ranking app.ipor.io

Founded—Yield aggregator Official siteapp.ipor.ioopens in a new tab Incidents10 with recovery confirmed In our ratingsYield aggregatorsopen the scorecard

At a glance

Company: IPOR Labs AG (Swiss law governs the app terms) ¹
Product: IPOR Fusion vault framework; vaults run by third-party curators ²³
Legacy product: IPOR Derivatives (IPOR Index, interest-rate swaps): phased out, new swaps paused since April 2, 2026 ¹⁴
Governance: Fusion DAO (successor to IPOR DAO under IIP-35); Snapshot votes ¹⁵
Chains: 12, including Ethereum, Arbitrum, Base, Avalanche, Unichain and Hyperliquid L1 (DefiLlama) ¹⁷
Value locked: About $85 million (DefiLlama, October 23, 2026) ¹⁷
Custody: Smart-contract vaults; non-custodial ¹⁶
Fees: Set per vault: management, performance and optional entry/exit contributions ⁷⁸⁹
Access limits: App terms restrict US and Chinese residents and sanctioned countries ¹
Official site: ipor.io (app: app.ipor.io)
Last checked: October 23, 2026

What IPOR is

IPOR started as an interest-rate protocol. Its IPOR Index published a benchmark DeFi lending rate on-chain, and an automated market maker let users trade fixed-for-floating interest-rate swaps against it ¹⁴. That derivatives business is now closed to new positions, and its docs remain for reference only ¹⁴.

Today IPOR Labs focuses on Fusion, which it describes as vault infrastructure for asset managers, DAOs and institutions ¹⁶. IPOR Labs writes the contracts and provides the web interfaces. Strategy decisions in each vault belong to whoever configures that vault. The IPOR DAO was succeeded by the Fusion DAO through proposal IIP-35. It uses Discord for discussion and Snapshot for token-weighted votes ¹⁵.

How Fusion vaults work

A Fusion vault is built from three components:

Atomist (curator). The Atomist designs the strategy: which assets, which lending or DEX markets, and which risk limits. Atomists can be risk curators, funds, protocols or DAO treasuries ³.
Alpha (executor). The Alpha prepares and sends the vault's transactions. It can be a bot, an AI agent, a smart contract or a key-holding service, and a vault can have several. An Alpha can only act through the integrations the Atomist has connected ⁴.
Fuses (adapters). These are small, non-upgradable contracts that translate the vault's "enter" and "exit" calls into a specific protocol's functions. A vault can only reach protocols for which a fuse is attached ⁵.

As a depositor, you deposit the vault's asset and receive vault shares. The app shows the connected markets, current allocation and performance history ². Each vault keeps its own accounts on-chain through "balance fuses", and risk is siloed so that a problem in one vault does not spread to others ¹¹.

Because many different curators run vaults on Fusion, two vaults on the same chain can differ widely in strategy, leverage, fees and withdrawal terms. Read each vault's info page before depositing.

Fees

Fusion has no single protocol-wide fee. Each vault sets its own charges ⁷⁸⁹:

Charge	How it works	Example in IPOR's docs
Management fee	Accrues every second on assets under management; paid in newly minted vault shares	0.2% a year → 2 USDC on 1,000 USDC over a year ⁷
Performance fee	Charged only on new profit above the vault's previous peak (high-water mark)	10% of a 100 USDC gain = 10 USDC ⁸
Onboarding / offboarding contribution	Optional percentage on deposit or exit; returned to remaining depositors to cover rebalancing costs	Rate set per vault ⁹

Gas on the vault's chain is extra. The examples above are illustrations from IPOR's docs, not actual rates. Check the "Vault Info" page for the specific vault.

Withdrawals

Fusion vaults offer three withdrawal types ⁶:

Instant: for vaults with liquid strategies, such as lending optimizers.
Scheduled: for strategies that must unwind positions, such as leveraged looping. You submit a request, the manager has a set window to prepare liquidity, and then you finalize. If you miss the finalization window, the process restarts and may incur another offboarding contribution.
Hybrid: instant withdrawals from a liquid buffer, with scheduled withdrawals for the rest.

A vault can also be paused. The Guardian role can freeze strategy execution, deposits and withdrawals during a suspected exploit, an oracle failure or extreme volatility. Funds cannot move until the pause is lifted ¹⁰.

Security and risks

Audits. IPOR lists a Protofire audit (September 2024) and a BlockSec audit (February 2025) of the Fusion vault and core modules. It also describes internal AI-assisted review and checks on deployed vault configurations ¹³. Audits reduce the risk of bugs but do not rule it out.
Curator and executor risk. Your outcome depends on the Atomist's choices and the Alpha's execution. Both are third parties in many vaults ³⁴.
Integrated-protocol and oracle risk. A vault inherits the risks of every lending market or DEX it uses, and of its price feeds ¹².
Admin-key hygiene. The January 2026 incident (below) came from an administrator account setup, not from user error ¹⁸.
Access restrictions. The app terms bar US and Chinese residents and sanctioned countries from restricted parts of the interface, and prohibit using a VPN to get around this ¹.

Incident record

1 outcome unclear

Legacy Arbitrum vault exploit

January 6, 2026outcome unclear

About $336,000 was drained from a legacy vault, "IPOR USDC Lending Optimizer Arbitrum", deployed in Fusion's first batch. IPOR's post-mortem traces it to two combined faults. The vault lacked validation on its instant-withdrawal fuse setup, which newer vaults enforce. Its administrator account had used EIP-7702 to delegate to a helper contract that let anyone make arbitrary calls. The attacker used the admin identity to add a malicious fuse and withdraw the funds ¹⁸. DefiLlama classifies the incident as an access-control exploit on Arbitrum ¹⁹. On January 7, 2026, the attacker returned 92 ETH and kept a 10% bounty, which the IPOR DAO covered. IPOR says the vault received back 336,580 USDC, 100% of the amount taken, and that "no depositor lost funds". IPOR has declared the incident closed ¹⁸.

Outcome: Fully recovered (funds returned to the vault; bounty paid by the DAO, per IPOR's account with on-chain transactions).

Source: ipor.io

Hacks in DefiLlama’s public database are also scored as the security record on the IPOR (Fusion) rating page.

Questions about IPOR (Fusion)

Is IPOR still offering interest rate swaps?

No. IPOR Derivatives has been phased out, with new swaps paused since April 2, 2026. The docs remain for reference ¹⁴.

Who manages a Fusion vault?

The vault's Atomist sets the strategy and limits. One or more Alphas execute within them. IPOR Labs provides the infrastructure ³⁴.

Can I withdraw from an IPOR Fusion vault at any time?

It depends on the vault. Some allow instant withdrawals; others need a scheduled request and a waiting window. Any vault can be paused in an emergency ⁶¹⁰.

Can US residents use the IPOR app?

IPOR Labs' terms restrict US residents from restricted portions of the interface ¹.

Did depositors lose money in the 2026 exploit?

According to IPOR's post-mortem, no. The stolen amount was returned the next day, minus a bounty the DAO paid ¹⁸.

For CoinPulse's separate assessment, see CoinPulse's Fusion by IPOR rating and evidence and the yield aggregator ratings. For background, read what yield farming is.