Should You Use Scallop? Risks, Rewards, and What to Consider Before Depositing

[johnblockbuster]

Q: What returns can you realistically expect from depositing on Scallop?
Returns on Scallop depend on the asset you deposit and the current utilization rate of each lending pool — the higher the demand from borrowers, the higher the interest rate lenders earn. SUI depositors earn yield from borrowing activity plus any additional incentive rewards distributed through the sSUI spool system. Rates fluctuate with market conditions and are generally higher during periods of strong DeFi activity on Sui and lower during quieter periods. As with all DeFi lending protocols, advertised APY figures can change significantly over short periods, so treating current rates as a long-term guarantee is not advisable.

Q: What are the main risks of using Scallop?
The April 2026 exploit illustrated the most important risk category for any DeFi protocol: smart contract vulnerabilities in peripheral or legacy code that can be exploited even when the core protocol remains secure. Additional risks include liquidation risk for borrowers if collateral values fall sharply, market risk from the underlying volatility of Sui ecosystem assets, and the general risks associated with a relatively young DeFi ecosystem that has not yet been tested across multiple full market cycles. Sui's DeFi total value locked has grown rapidly, but the string of peripheral exploits across multiple protocols in early 2026 — including Scallop and Volo — suggests the ecosystem is still maturing its security practices.
Q: How does Scallop compare to other lending protocols on Sui?
Scallop is one of the most established money market protocols on Sui and has built a reputation as a core piece of the network's DeFi infrastructure. Its response to the April 2026 exploit — full treasury reimbursement and rapid incident containment — reinforced confidence among users who remained in the protocol through the incident. Compared to newer Sui lending protocols, Scallop benefits from a longer track record, deeper liquidity, and broader integrations across the Sui ecosystem. However, as the exploit demonstrated, longevity alone does not guarantee security, and any deposit into a DeFi protocol should be sized according to your personal risk tolerance and never represent capital you cannot afford to lose.

[madmax]

"longevity alone does not guarantee security" — Scallop getting exploited 17 months after deploying the vulnerable code really proved that one personally