The current DeFiLlama Multipli adapter does not compute TVL from on-chain balances. It calls Multipli's own API and returns data.payload[api.chain] for each chain. The API payload includes large self-reported balances, including protocol-issued tokens and off-chain/custodial claims that are not backed by observed on-chain assets at the reported addresses.

This is a TVL/adapter-integrity issue, not a confirmed external money-moving exploit.

Confirmed observations

Adapter problem

Observed source URL: https://raw.githubusercontent.com/DefiLlama/DefiLlama-Adapters/main/projects/multipli/index.js

Observed adapter logic:

const axios = require('axios')
const API = "https://api.multipli.fi/multipli/v1/external-aggregator/defillama/tvl/"

const tvl = async (api) => {
  const { data } = await axios.get(API)
  return data.payload[api.chain]
}

This means DeFiLlama currently trusts https://api.multipli.fi/multipli/v1/external-aggregator/defillama/tvl/ rather than deriving balances from chain state.

Selected API payload values observed

Read-only RPC observations

Observed through read-only eth_call/eth_getBalance against Base, Ethereum, Avalanche, and Monad.

Base

Interpretation: the Base API TVL is dominated by a protocol token whose vault asset() is the same protocol token, not observed external collateral.

Ethereum

Interpretation: the observed Ethereum rwaUSDi contract does not custody the USDC/USDT/WBTC amounts reported in the API payload.

Avalanche and Monad real-fund context

These balances show that some real vault funds exist, but at tiny scale relative to the API-reported TVL.

Risk classification

Confirmed: DeFiLlama TVL integrity issue / self-reported adapter issue.

Confirmed: reported TVL includes protocol-issued tokens and API-only claims not matched by observed collateral at the checked contracts.

Confirmed: small real vault balances exist on Avalanche and Monad, so the protocol is not purely empty; however, observed on-chain funds are orders of magnitude below the API-reported TVL.

Not proven: unauthorized external withdrawal, mint, redeem, bridge release, vault share theft, liquidation abuse, or user-level execution of value-moving admin logic.

Not proven: that the protocol has stolen funds or that all API-reported USDC/USDT/WBTC is nonexistent. The unobserved amounts may be off-chain/custodial or in contracts not identified here. They should not be counted as DeFiLlama TVL unless independently verifiable on-chain.

Requested remediation

1. Disable the current Multipli adapter or mark it as misreported until TVL can be computed from on-chain balances.
2. Replace the API-trusting implementation with explicit on-chain balance accounting per vault and per chain.
3. Exclude protocol-issued/self-minted assets such as rwaUSDi from TVL unless independently backed by verifiable, non-recursive collateral.
4. Exclude off-chain/custodial strategy balances unless DeFiLlama policy permits them and the proof source is independently auditable.
5. Require Multipli to provide a complete list of vault/fund-manager/custody addresses for each chain before re-enabling full TVL.