Proof-of-Yield Teardown #001 — nlo.finance. Findings as of 2026-08-08 (first scanned 2026-07-16).
There is a class of DeFi site that security scanners can't catch. The contract checkers look for honeypots and mint functions. The token sniffers look for rug mechanics. But nobody checks the thing that actually matters before you deposit: is the yield economically real?
We built a scanner that asks that question. This is what it found on its first live target.
The pitch vs. the plumbing
NLO.finance describes itself as "an autonomous AI agent that orchestrates your capital across 25,000+ liquidity pools on 170+ DEXs. Non-custodial, cross-chain, continuously rebalanced."
That is a serious infrastructure claim. Routing capital across 170 venues implies indexers, keepers, cross-chain messaging, and an operations footprint you can see from orbit.
Here is the site's own canonical tag, taken from its rendered HTML:
<link rel="canonical" href="http://158.220.112.195/">
A bare VPS IP address. Over plain HTTP. The og:url tag points to the same place. The site claiming to orchestrate capital across 170 exchanges canonicalizes itself to an unencrypted budget-host IP.
That single line is not proof of bad intent. It is proof that the operational reality and the marketing claim live in different universes — and that gap is the most reliable risk signal we know of.
Methodology: what the scanner checks
Proof-of-Yield runs two tiers of forensics and produces a 0–100 composite score:
Tier 1 — Operational forensics. Rendered-page canonical and metadata extraction, TLS certificate details, domain age via registry RDAP, DeFiLlama listing and TVL presence, and discovery of documentation, audit, GitHub, and social links.
Tier 2 — Contract forensics. Source verification checked against three independent sources (Etherscan-family, Sourcify, Blockscout) with consensus required, proxy pattern detection with implementation resolution, and privilege flags — owner, mint, upgrade, pause, blacklist — scanned across both proxy and implementation bytecode.
To calibrate, we ran the same scan against three protocols nobody disputes: Aave, Uniswap, and Pendle.
The findings
| Check | NLO.finance | Aave / Uniswap / Pendle |
|---|---|---|
| Composite score | 24 — HIGH RISK SIGNALS (28 on our first scan, 2026-07-16) | 94 / 99 / 87 |
| Canonical URL |
http:// + bare VPS IP |
Proper HTTPS domains |
| DeFiLlama presence | None — 0 protocols, $0 tracked (vs. "25,000+ pools" claim) | $14.89B / $3.00B / $1.18B tracked |
| Domain age | 165 days | 2,068–10,518 days |
| Docs / GitHub / audit links | None discovered — 0 docs, 0 github, 0 audits | Present on all three |
| TLS certificate | Valid | Valid |
(The title says 28 because that is what our first run scored it on 2026-07-16. We re-ran every check on 2026-08-08 before publishing and it came back 24 — the drop is its TLS certificate rotating, which we explain in teardown #002. Nothing about the site improved; one of our noisier checks simply stopped flattering it.)
Read the TLS row again, because it's the most important finding in this teardown.
NLO's TLS certificate is fine. The site looks trustworthy at the level most people check — the padlock is there, the design is dark and slick, the copy says "non-custodial." Every cheap trust signal passes.
What fails are the signals that cost real money and time to fake: a registry-verifiable domain history, presence in the analytics ecosystem that tracks every protocol with actual TVL, public code, public audits, a public team. Surface trust is a commodity. Economic footprint is not. Our calibration run showed the separation between a 24 and a 94 comes almost entirely from the registry-grade checks — not from certificates, not from copy analysis.
What "non-custodial" actually means here
One more thing worth saying plainly. An "agent" that "continuously rebalances" your capital requires you to grant token approvals or session keys to its contracts. If those contracts are malicious or compromised, an approval drains you exactly as thoroughly as handing over your keys. "Non-custodial" is a marketing word, not a security property, unless the contracts are verified, audited, and behaviorally constrained — none of which we could establish here, because we found no published contracts to check.
The five-minute manual version
You don't need our scanner to run the basics. Before any deposit, check:
- View source, find the canonical tag. A raw IP or a mismatched domain is disqualifying.
- Search the protocol on DeFiLlama. Big-number claims with zero tracked TVL is disqualifying.
- Find the audit, then verify it on the auditor's own site. A PDF hosted only on the project's domain doesn't count.
- Find the contracts and check verification on a block explorer. No published contract addresses is disqualifying.
- Check domain age. Under a year plus "established infrastructure" claims is a contradiction.
Five checks, five minutes, and NLO.finance fails four of them. (The fifth — TLS — it passes, which is exactly why the padlock alone should never be your basis for trust.)
The disclaimers that matter
We cannot see intent. It is possible NLO is a sincere early project with catastrophically sloppy operations, and if the team publishes verifiable contracts, audits, and an economic footprint, we will run the scan again and publish the updated score. This post describes what automated checks observed on a specific date. It is not financial advice, and the absence of evidence we describe is exactly that — observed absence, documented.
But the burden of proof in DeFi sits with whoever is asking for your approvals. We first scanned this site on 2026-07-16 and re-ran every check on 2026-08-08 before publishing. Three weeks apart, nothing moved: still no docs, still no GitHub, still no audits, still zero DeFiLlama presence, still canonicalising to a bare VPS IP over plain HTTP. On both dates, nlo.finance offered nothing that carries that burden.
Scan it yourself
Proof-of-Yield's composite scan — ops forensics plus three-source contract verification — is live. Run any protocol through it before you approve anything.
Start here: https://poy.donnyautomation.com/v1/land?src=teardown-001
Free, no signup: one POST, straight at the API —
curl -X POST https://poy.donnyautomation.com/v1/scan \
-H "Content-Type: application/json" \
-d '{"url": "https://protocol-you-are-checking.xyz"}'
Rate-limited per IP; add chain and address to include contract forensics. Higher-volume access is coming via pay-per-call — watch this space.
More teardowns coming. If there's a protocol whose yield claims you want put under the lens, send it.
Built by the team behind the Uniswap v4 Hook Risk & Reality API. Same principle: three sources or it didn't happen.
Top comments (0)