Loading…
RESEARCH DESK
Risk research
Dated risk reports on every protocol we track: verdict, 7-dimension scorecard, worst case, data appendix. Refreshed monthly. Not financial advice; DYOR.
50 reports6 solid · 36 caution · 8 avoidlatest Sep 20
All reports
RSS ↗50 / 50 reports
| Protocol | Verdict | Category | Researched | Summary |
|---|---|---|---|---|
| Aave V3 | caution | Lending | Sep 20 | Caution holds for a third month, and the reasons changed on both sides. The audit picture is better than the last two reports said: the registry holds 49 files including a full v3.7 release audited by six firms, and GitHub's commit history proves those files landed on 2026-03-31, so the August report's "40 files" and "newest audit is nine months old" were errors in that run, not changes at Aave. Guardian thresholds (4-of-7 and 5-of-9) were re-verified on-chain rather than from docs, and no new Aave incident appears in the DeFiLlama hacks registry through 2026-09-17. Against that, one finding outweighs everything else: the April rsETH bad debt is still open on Aave's own books. The Ethereum Core Pool reports a WETH reserve deficit of 52,964.45 WETH, about $139M, realized in early May and unchanged to the wei for four months, now 2.51% of the aWETH supply against about 1.54% in April because the reserve shrank while the hole did not. "Backing fully restored on 26 May" described Kelp's rsETH, not Aave's WETH reserve, and the two were conflated. Also corrected: the Risk Steward fast path is wider than the draft claimed, with caps movable 100% of current value every 1.5 days on-chain rather than 50% every 5 days. TVL is $18.058B, up 29.3%, but ETH rose 40.4% and the ETH-family deposit base is flat in units, so depositors have not come back. |
| Kamino Lend | caution | Lending | Sep 20 | Solana's largest lending venue at $1.38B and now 21% ahead of Jupiter Lend, with TVL recovered to 41.0% of its October 2025 peak and up 25.6% over 90 days after the previous quarter's 24.2% fall; the 5-of-10 Squads v4 multisig and its 86400 second timelock re-verified on chain and observed enforced on the 2026-08-20 lending upgrade, but this run read Kamino's own source and found the TWAP and heuristic price guards are required to borrow and not required to liquidate, on a program where 372 of 594 reserves are configured by keys that are not Kamino's. |
| Morpho Blue | solid | Lending | Sep 20 | Core re-verified on chain today and the verification is stronger than the draft claimed: the deployed bytecode is byte-identical to our August read, owner() still returns the governance Safe, and that Safe answers threshold 5 with the same nine signer addresses, zero modules and no guard, having executed no transaction since 2026-08-11. TVL is at an all-time high of $10.73B and August's open audit caveat is closed. One new market-layer event on 2026-08-25 liquidated about $36.4M of leveraged PT-reUSD positions with no bad debt and no lender loss. Solid is held on doxe's August oracle call, not on new evidence. |
| Spark | solid | Lending | Sep 20 | Sky's lending and savings Star, now $7.109B on the DeFiLlama parent record against $4.598B on 2026-08-05, same basis both times, which is a recovery to 82 percent of the October 2025 peak rather than a new high. Two of last month's open questions closed in Spark's favour and both were re-verified on-chain this run. The 2026-09-10 spell, which executed 2026-09-14 14:00 UTC, set the Ethena rate limits to zero (USDe mint, USDe burn, sUSDe cooldown and the sUSDe 4626 deposit key all read maxAmount 0, slope 0), so the $1.1B authorisation that last month sat undrawn but live can no longer be redrawn by a relayer without a new governance spell. The same spell zeroed 35 rate limits across unused integrations including the B2C2 OTC legs, deprecated LBTC as collateral and finished the Gnosis wind-down. The oracle stopped being a two-month _refresh_: SparkLend's price oracle resolves to feed contracts that self-describe as aggregated ETH/USD and BTC/USD from Chronicle, Chainlink and RedStone, returning live prices. Four claims in this month's draft are corrected. The Liquidity Layer's large spUSDS, spUSDT, spDAI and spPYUSD lines are SparkLend deposit receipts, not Spark Savings vault shares, and the ALM Proxy holds zero shares of all four V2 savings vaults. The V2 savings buffer is documented at up to $10 million per vault, which against spUSDT at $397.5M is about 2.5 percent, so most of a savings position exits through an off-chain-fulfilled queue rather than atomically. The advertised savings rate is a manually set on-chain parameter that reproduces 3.5000, 3.6000 and 1.3500 percent exactly, not a measured pass-through of Layer earnings. And the oracle feed returns roundId 1 with updatedAt equal to block.timestamp on every call, so its timestamp cannot evidence freshness. Credit-shaped exposure is $260.4M against $7.109B, 3.7 percent of TVL, down from 6.1 percent in August. No Spark entry in a hacks database that has grown to 1,273 records, and an X sweep across 2026-08-01 to 2026-09-20 found nothing. |
| Hyperliquid | caution | Perp / funding | Sep 19 | The core venue got materially stronger this month while every risk that set the verdict stayed where it was: open interest nearly doubled to $12.79B, HIP-3's delegated-oracle surface is flat at $3.83B (now 23% of the platform rather than 36%), and the one external audit named in the docs covers a legacy bridge that today holds 8.6% of HyperCore's USDC. |
| Kinetiq | caution | Restaking / LRT | Sep 19 | Six weeks on, Kinetiq's control surface is unchanged and still unexercised against kHYPE, but the same 4-of-8 Safe with no timelock proved on 2026-09-15 that it can pause a live production proxy, replace its implementation and unpause it in 51 minutes, while same-day exit capacity fell to about 1.36% of backing from 1.54% and the withdrawal queue grew from 1.5% of supply to 3.7%. |
| Pacifica | avoid | Perp / funding | Sep 19 | The audit is real and we read it end to end, but the draft's framing was wrong: BlockSec published the Perp Contracts report to its own GitHub repository on 2026-04-30, three months before our August report declared it missing, so this run corrects our error rather than crediting a Pacifica fix. Admin control got worse under inspection. The upgrade authority is still an ordinary on-curve key, it doubles as the program's own admin role, and a second ordinary key signs unlimited batch withdrawals live every few minutes, a power the auditor documented in writing. Custody is still deposit to venue with no documented unilateral exit, the SOL side has no cold storage at all, and the venue is still in Closed Beta by its own docs, so the gate holds. |
| Pendle | caution | Fixed yield | Sep 19 | Downgraded from solid: the SY adapter that actually custodies all 393,262 kHYPE behind this PT is an upgradeable proxy whose ProxyAdmin is owned by a 3-of-5 Safe with no timelock, and the power to freeze it sits with a single codeless EOA holding the GUARDIAN role, neither of which the two prior reports checked because the PT and the market above them are immutable. |
| Babylon | caution | Restaking / LRT | Aug 12 | BTC genuinely never leaves self-custody, and contrary to our July report the exit is unilateral and about 50 hours, not seven days and not gated by the covenant committee, which signs your unbonding transaction before your stake is ever active. What earns the caution is everything around that core: rewards in a token down 93% with no supply cap, 79.6% of the earning stake behind one exchange brand, and five high-severity chain advisories in fifteen months. |
| Dolomite | caution | Lending | Aug 12 | Last month's trapped USD1 pool has genuinely cleared (54.3% utilization, $124.8M idle confirmed on-chain three ways), but two reds replace it: admin authority over $896M of supplied assets now sits behind a 300-second delay and a 2-of-3 Safe whose three signers are plain EOAs, and 43.1% of the collateral base is a single underlying token in two wrappers, both parked at their supply caps, one of them a 35-day-old upgradeable proxy whose own timelock has never been switched on. |
| edgeX | caution | Perp / funding | Aug 12 | Non-custodial StarkEx perp DEX with a fully corroborated eight-report audit set and a clean 24-month custody record, but L2BEAT now carries two CRITICAL admin flags, and the unverified implementation sitting in the fund path since 6 July 2026 is the main USDT escrow itself, confirmed unverified on Etherscan today, while deposits fell 52% in 90 days, so caution holds on weaker footing than last month. |
| Ether.fi Liquid | cautionreview | Restaking / LRT | Aug 12 | The eETH/weETH core is the best-fenced LRT we track and every admin claim in its docs now checks out on-chain, but the Liquid vault layer this file is slugged for is a separate product of roughly $283M whose entire privileged surface answers to one 4-of-6 Safe with no timelock, which ether.fi's own trust matrix explicitly does not cover, and which shares a signer with ether.fi's Operating Admin, so the report as a whole is caution rather than solid. |
| Exponent | caution | Fixed yield | Aug 12 | Solana yield-tokenization protocol at $134.38M across three distinct products, effectively back at its July 2025 peak, with genuinely deep audit coverage (25 engagements listed, 24 completed reports published across six firms, $300k bounty) and no exploit of its own code in 22 months; this run verified the previously-open admin question on-chain (two Squads 3-of-5 multisigs sharing one five-key signer set, one with a 4h timelock and one with none, all ten programs upgradeable), and the binding flaw is the valuation input, which reaches further than the newest products because the ONyc exposure that anchors roughly 30% of the book is an off-chain reinsurance NAV that the junior tranche eats first. |
| Fluid | caution | Lending | Aug 12 | Audit coverage, immutable per-vault contracts and genuinely real yield all hold up, but every deposit sits behind one upgradeable proxy guarded by a one-day timelock (not the two days our July report claimed), and this run found a power July missed entirely: a wrapper deployed 2026-03-29 lets the team multisig transfer user position NFTs to itself with no timelock in seven still-allowlisted Resolv (wstUSR) markets. Oracle wiring went unverified and can no longer be exonerated by the Resolv event, and the 2026 record still carries a ~$21M bad-debt episode cured by a discretionary treasury backstop drawn before the authorizing vote. |
| Jupiter Lend | caution | Lending | Aug 12 | Solana money market by the Jupiter team, $942.71M TVL, with a genuinely disciplined three-tier Squads admin verified on-chain and honest borrow-interest yield, but five upgradeable programs, an admin price-override path, 56.6% of the collateral base in Jupiter's own tokens, LST and JLP collateral priced off issuer state rather than markets, and a brand-new v2 DEX layer that shipped two days before this review outside every listed audit window. |
| Jupiter (suite) | caution | Perp / funding | Aug 12 | Solana's dominant swap router plus perps, JupSOL and JUP, $1.1452B once Jupiter Lend is excluded to our own separate page; the router genuinely custodies nothing, but I read the upgrade authorities on chain this run and found a 4-of-7 Squads v3 multisig with no timelock over a swap program that shipped code on 2026-08-05 and eleven more times since 2026-05-03, ten months past its newest audit, six of those seven signers also sitting on the 4-of-8 perps multisig, JupSOL's $396.7M running on a non-canonical stake-pool program Jupiter does not control with no audit listed and a single plain key in its staker role, and half of all JupSOL plus 42% of all JLP pledged inside Jupiter's own lender. |
| Lombard | caution | Restaking / LRT | Aug 12 | LBTC is Babylon-staked BTC whose mint and redeem path is validated by a 14-member consortium at a 2/3 threshold, but the contract-upgrade path is not: on-chain the LBTC proxy admin and the token's owner() both resolve to a timelock whose proposer and executor rights sit with a 3-of-5 Gnosis Safe of unlabeled EOAs plus a still-active deployer EOA, behind a 24-hour delay that was 1 hour at deployment. The peg measured tight (worst daily discount 0.49% across 360 days, zero days below 0.995), audits run current through July 2026, and no incident has occurred, but a five-key multisig over a token representing about 11,500 BTC is a narrower trust base than the consortium framing implies, and BTC-denominated TVL is down 13.7% in 90 days. |
| Mellow | caution | Restaking / LRT | Aug 12 | The slug this report tracks holds $20.81M and is down 97.7% from its 2024 peak; the money moved to Mellow Core, where one vault, earnETH, is 71% of the whole book and deploys 90.6% of its assets into a second Mellow vault whose price is submitted and self-accepted by a single 5-of-8 Safe, over an upgrade path with no timelock anywhere on it. |
| Puffer | caution | Restaking / LRT | Aug 12 | Deep audit roster and no exploit in about two and a half years, but three keys can upgrade the vault with zero delay, one unlabeled wallet holds 50.26% of pufETH supply, and the book that fell from $1.84B to $45.97M sits behind a 2.13% liquid buffer. |
| Symbiotic | caution | Restaking / LRT | Aug 12 | Unusually deeply audited base layer with no exploit of its own contracts in 18 months, but the collateral book is down 87.5% from its peak, nearly half of what remains sits in one BTC wrapper, and a 2-of-3 Safe of plain EOAs with no timelock decides which code vaults can be upgraded onto and can switch on protocol fees of up to 5% a year instantly. |
| Tydro | caution | Perp / funding | Aug 12 | Aave whitelabel market on Ink with a 48-hour timelock that is not just configured but demonstrably enforced on its last four executed payloads, and a measured realized bad debt of about seven cents, gated to caution by an audit trail nobody will name, an oracle with no fallback configured, and a top depositor holding 53% of the largest market. |
| Uniswap | solid | DEX / AMM | Aug 12 | Contract source pulled this run confirms the strongest fact: a v3 pool exposes 11 external functions and exactly two are owner-gated, both fee-only and capped in code, a v2 pair has zero governance levers, and the v4 PoolManager has no upgrade, no pause and no delegatecall path, so nobody can reach LP funds; zero Uniswap entries in a 621-row hacks tracker that does catalogue the hook layer under its own names; the live risks are impermanent loss, pool selection, and any third-party hook you attach yourself. |
| YieldBasis | caution | Fixed yield | Aug 12 | Non-upgradeable, genuinely well-audited Curve-native leverage protocol whose 2x is a hard-coded constant rather than an admin dial, but insider and treasury contracts hold 65% of YB supply (measured on-chain), the markets holding today's $132.5M are eleven weeks old after a second full redeploy, Curve's own 5-of-9 Emergency DAO holds the kill switch, the governing DAO runs in Aragon early-execution mode so the 7-day vote is a ceiling and not a delay, and net fees were negative on 18 of the last 30 days. |
| Compound | caution | Lending | Aug 11 | Compound III has the strongest structural governance record in lending, and every piece of it verifies on-chain today (one Timelock, a real 2-day delay, a 5-of-9 guardian that can freeze but not seize). But the draft's clean-record framing did not survive checking: withdrawals were frozen on mainnet comets twice in nine months, a collateral listing left the protocol with $15.57M of impaired exposure of which about $3.5M was never recovered, and the USDC comet is 90% utilized right now. |
| Velocity (Drift) | avoid | Perp / funding | Aug 11 | Drift has rebranded to Velocity after the April 1, 2026 admin-compromise drain that DeFiLlama records at $295M (not the $285.0M in our table); users still hold unredeemable DFX claim tokens 4.5 months on, gated on a recovery pool that is stuck at $3.8M against a $5M threshold, and the relaunched code has no published audit, so avoid stands even though the on-chain admin setup and the insurance fund have genuinely improved. |
| Felix | caution | Lending | Aug 11 | A licensed Liquity V2 CDP fork minting feUSD on HyperEVM with a deep inherited audit stack and no exploit, depeg or bad-debt event in sixteen months, but this run settled the standing admin gap on-chain and the answer is worse than the docs: all 51 core CDP contracts are upgradeable proxies under one ProxyAdmin whose path ends in a 3-of-6 Safe, while the Terms state the CDP runs "without reliance on upgradeable proxy structures"; the $75.2M Morpho vault side runs under a 1-of-3 curator with the guardian slot unset; 94.2% of CDP collateral is HYPE-linked; and the perps venue the prior draft counted as expansion was announced closed as of 2026-06-22. |
| KernelDAO (Kelp) | avoid | Restaking / LRT | Aug 11 | Backing and peg genuinely recovered (rsETH trades at a 0.28% discount to an on-chain NAV that cross-checks against independently computed TVL within 1.1%, and core upgrades sit behind a verified 10-day timelock guarded by a 6-of-11 Safe), but the admin change that caused the loss was never behind that timelock, Aave still has rsETH frozen at 0% LTV nearly four months after the $292M bridge exploit, and deposits keep leaving, so this stays avoid on fresh evidence. |
| Lido | solid | Restaking / LRT | Aug 11 | Re-verified on-chain rather than carried over: 5-of-9 oracle quorum, a 96h Dual Governance timelock sitting in Normal state, stETH within 6bp of parity and a short native exit. Two claims from the draft did not survive measurement: the withdrawal queue is not covered by the protocol buffer (5.5%, and Lido's own estimator says the queue is served by exiting validators), and the 2026 incident record is not two small items, it also includes a $21M third-party exposure in a Lido-branded vault that the DAO had to backstop. |
| Neutrl | avoid | Stables / RWA | Aug 11 | A single externally-owned account holds DEFAULT_ADMIN_ROLE and owner() on all nine core Neutrl contracts, including the reserve and the lock holding 19.4% of supply, and the single-admin design is deliberate: the deployed access-control library is named SingleAdminAccessControl, while a working 2-of-4 Safe in the same deployment guards only the bridge adapters. Supply is down 23.8% in five weeks and the real retail exit is $1.59M of USDC in one Curve pool against $53.65M outstanding. |
| Save | caution | Lending | Aug 11 | Save (formerly Solend) is a five-year-old Solana lending protocol whose program upgrade authority is verifiably a single keypair with no multisig and no timelock, whose audit trail names three firms but publishes one undated PDF (the two other firms have no report covering this Solana program), and where 52.1% of protocol-wide supply now sits in reserves at 100.0000% utilization from which nothing can be withdrawn. The main pool itself is liquid, Pyth-priced and clean. |
| World Liberty Financial | avoid | Points farms | Aug 11 | Politically affiliated token and stablecoin whose reserve story genuinely improved this run (BitGo moved the attestation from Crowe LLP to KPMG LLP, which signed an unmodified June 2026 examination showing assets $4.6346B against 4.6344B tokens) but whose admin surface got sharper on re-verification: one plain EOA can freeze any USD1 address, a second funded and already-used EOA can mint USD1 with no cap, the WLFI token owner can blacklist, batch-reallocate, burn and strip votes, and no path carries a timelock. USD1 also briefly traded below peg on 2026-02-23 during an incident that included compromised co-founder social accounts. Two reds on fund-loss surfaces gate it to avoid. |
| Curve LlamaLend | avoid | Lending | Aug 6 | Curve is winding V1 down: no new V1 markets, a deprecation sweep in mid-2026 and a DAO risk-team mandate that names "the sunset of V1", while lenders in the CRV market have been unable to withdraw in full since October 2025 and a market oracle was exploited in March 2026. |
| Apyx | avoid | Stables / RWA | Aug 5 | apxUSD has recovered to $0.9177 because STRC rallied 24%, not because anything was repaired: attested collateral is still 92.24%, there is still no atomic redemption, and the dollar-side exit behind a float DeFiLlama marks near $298M is about $1.96M of USDC across every apxUSD/USDC pool plus roughly $253K of Kraken bids whose best bid is $0.83. STRC concentration did not grow, contrary to the draft: it is flat at about 84% of asset reserves and down from roughly 74% to 70% on the wider base. |
| Cap | caution | Stables / RWA | Aug 5 | Both standing unknowns are now closed on-chain, and the answers split. Upgrades are genuinely timelocked (24h, single admin, verified by enumeration), but the 3-of-5 developer Safe can whitelist a borrowing operator and set its LTV instantly with no delay, which is the parameter that actually governs loss. July added a reneged airdrop, unresolved founder self-dealing allegations, a 32% redemption run, and roughly eleven days of sub-par cUSD quotes. |
| Curvance | caution | Lending | Aug 5 | Genuinely strong audit coverage and non-upgradeable core contracts, undercut by three verified problems: an Emergency Council that can skip the 5-day timelock and can replace the timelock outright, a dual-feed oracle circuit breaker that is switched off across roughly $93M of the $97M book, and a record that is not clean, because about $868k of real WBTC was already borrowed out of Curvance against fraudulently minted collateral in May 2026. |
| Curve | caution | Stables / RWA | Aug 5 | Deep, battle-tested stableswap AMM at $1.277B TVL, but crvUSD's backing has drifted away from user collateral: about 17% of circulating supply is over-collateralized LLAMMA debt and another 15% is PegKeeper-minted, leaving roughly two thirds traceable mostly to DAO-authorized minting, decided by a veCRV electorate in which Convex alone holds a reported majority and which lost its independent risk manager in July 2026. |
| Ethena | caution | Stables / RWA | Aug 5 | USDe gave back about 13% of TVL and $564M of supply this month to ordinary carry contraction rather than distress, holding its peg through the whole window, but sUSDe now pays 3.95% against a 4.49% Aave USDC borrow cost, the on-chain governance is weaker than Ethena's own docs claim on two counts (a 5-of-10 Safe where the docs say 7-of-10, and a 24-hour timelock where the docs say 7 days), and the backing composition is genuinely unmeasurable: Ethena's live documentation still states 90% perpetual futures while secondary reporting says 11%. |
| Euler | caution | Lending | Aug 5 | Excellent core contracts and a fully repaid $197M V1 exploit, but V2 lets any vault deployer pick its own oracle, and that surface already blew up in November 2025 while TVL fell 83% from its peak. |
| Maple | caution | Lending | Aug 5 | Maple is institutional onchain credit: real yield, Tier-1 audits, no protocol exploit, and this run the protocol's own contracts confirm zero recognised losses and a near-empty withdrawal queue, so the ~6% TVL decline is not credit stress. It stays a caution because you underwrite borrower credit and in-house underwriting, the pools are 96% lent out behind a documented 30-day redemption ceiling, and the collateral custody path is still not publicly documented. |
| Sky | solid | Stables / RWA | Aug 5 | Sky remains the most battle-tested stablecoin design in DeFi, and this run proved more of it on-chain than the draft did: USDS has been upgraded exactly zero times (one Upgraded event, at deployment), it carries no freeze or blacklist, burn cannot confiscate, and exactly two wards exist. But three draft claims failed verification. The governance pause delay is not a one-way improvement: it reads 48h today yet was 24h as recently as 2026-05-01 and 30h through 2024, so it oscillates by spell. The PSM exit the draft calls your escape window can be halted instantly by LITE_PSM_MOM with no delay at all. And the quoted peg band of $0.948 to $1.057 uses only USDS's short history, omitting that the same system as DAI printed $0.882 in the March 2023 USDC depeg, which is precisely the transmission path the report flags. The collateral split and holder concentration are both unsourceable while $5.5B+ sits in off-chain institutional custody and reserves sit at 55% of their own floor, which is why this process would have downgraded it; the curator kept solid on the decade-long record and the absence of any red dimension, and the gap is stated in full below. |
| 3Jane | caution | Stables / RWA | Aug 4 | The TVL crash our stale-verdict net flagged was not the fund shrinking: USD3's totalAssets is flat at 75,042,961.85 USDC and the share price rose 0.29% in 16 days, so there is no credit event. What collapsed is the exit: the vault's own maxWithdraw returns 3,559,316 USDC identically for all three large holders, 4.74% of the pool against 20.28% on 19 July, deployment is 95.26%, deposits are shut on-chain at the 75M cap, and 90.74% of assets are now off-chain paper and bank cash with Slope at 90.93% of the facility book and also acting as servicer. Three of the previous draft's darker claims did not survive checking and are corrected here: the Slope delinquency tape did render and is clean at 96.94% current with zero charge-offs; the Morpho PT loop's borrow rate fell to 6.46% rather than rising to 10.10%, so carry widened rather than compressed; and the honest exit path is about 5.0M, not 9.2M. Against that, oracle risk is worse than described and now verified rather than carried: the Morpho USD3/USDC market values 17.7M of collateral using the vault's own share price with all four external feeds set to the zero address, and the PT market's oracle is a pure 30%/yr time clock that cannot see credit at all. |
| Ondo OUSG | caution | Stables / RWA | Jul 26 | Qualified-purchaser-only tokenised Treasury fund that is really a fund of tokenised funds: 36.76% State Street SWEEP, 24.73% BlackRock BUIDL, 18.87% Franklin BENJI, 18.33% Fidelity FYOXX. Instant 24/7 mint and redeem from 5,000 dollars, 0% fee until January 2027, SEC-registered adviser - but it is a 3(c)(7) fund, so almost no ordinary subscriber can legally hold it, and the administrator, custodian and auditor are not named publicly. |
| Ondo USDY | caution | Stables / RWA | Jul 26 | Tokenized US Treasury note from a bankruptcy-remote SPV with Ankura Trust as collateral agent, 105.45% collateralisation and a deep audit roster - the credit side is about as clean as this category gets. It gates to caution on control and access rather than credit: the token contract is a verified upgradeable proxy, every transfer checks allowlist, blocklist and sanctions contracts, Ondo used that freeze power in April 2026, buyers must be non-US and cannot transfer for 40 days after purchase. |
| Makina | avoid | Fixed yield | Jul 20 | Makina is well-audited vault infrastructure, but the dUSD Machine fails a $1M market-neutral mandate on three independently verified grounds: deposits and redemptions are both allowlist-gated on-chain (isWhitelistEnabled() returns true on the dUSD Depositor and Redeemer), the strategy is a discretionary multi-strategy USD book (lending, AMM LP, Pendle and Spectra PT, leverage looping) rather than a basis vehicle, and this exact Machine was the vehicle in a $4.13M AUM/share-price manipulation on 2026-01-20. Governance, which the draft could not resolve, is now fully verified: a 3-of-5 DAO Safe holds every config and upgrade role behind a 48-hour on-chain execution delay, with a 2-of-4 Security Council able to cancel non-admin operations. |
| Re | caution | Stables / RWA | Jul 20 | Re's reinsurance yield is real and the plumbing holds up under direct inspection: the 48h timelock answers 172800 on-chain, all 52 Hacken findings across three engagements are marked resolved with none accepted or mitigated, and the Ethereum redemption buffer sits at 27.5% of reUSD supply value today. Exit is what gates the verdict. The senior token's fallback below the 1% floor is quarterly-window-only rather than a rolling queue, the Curve pool the docs call the primary reUSD exit holds $462k, the junior token's first redemption window in protocol history is already oversubscribed against a $1.5M pool, and the observed buffer is roughly half the protocol's own stated policy of at least 50% of the deposit high-water mark. |
| Saturn | caution | Stables / RWA | Jul 20 | Two of the three published upgrade conditions are now genuinely met: four real audit reports, downloaded and read in full this run, covering the actual core contracts, and a named custody chain (Clear Street custodian, BVI professional fund, Securitize administrator), so avoid moves to caution. The third fails unchanged: both timelocks still have a single plain-EOA proposer, re-verified on-chain this run. New and worse than the draft recorded, sUSDat fell to $0.7478 on 2026-06-28, about 26 percent below its late-May level, and sits at $0.8787 today while STRC closed at $85.29 on Friday, roughly 15 percent under its $100 stated amount. |
| USD.ai | cautionreview | Stables / RWA | Jul 20 | PT-sUSDai on Arbitrum pays about 9.9% implied into 15 Oct 2026 and an $80k PT sale moves the Pendle price only 0.05%, but the draft's two central claims were wrong on the facts: the upgrade key is identifiable (a 48-hour OpenZeppelin timelock behind a 3-of-3 Safe, verified on-chain, and it executed a live implementation swap on 14 Jul 2026), and the protocol is not quiet, with TVL down about 71% from its Nov 2025 peak of $702M to $206.5M. It stays caution, sized as credit, because the money-moving roles sit outside that timelock on three shared signer keys and the collateral is off-chain. |
| Rysk | caution | Fixed yield | Jul 18 | Clean covered-call mechanics (fully collateralized, physically settled per docs, real premium yield) but upgradeable custody under a 3-of-5 multisig with no timelock at any level of the verified upgrade path, audit reports that would not open even though Rysk's own site names Trust Security, unnamed RFQ buyers, and a hard lock until expiry gate it to caution. |
| Global Dollar | solid | Stables / RWA | Jul 14 | Regulated, T-bill-backed, par-redeemable Paxos stablecoin now attested monthly by KPMG LLP (ISCA standards), with on-chain admin power verified directly from the source; the real caveats are custodial (Paxos-controlled roles can freeze, wipe and upgrade) and growth that leans on paid distribution. |
| Ethereal | caution | Points farms | Jul 1 | Non-custodial USDe perps appchain (Arbitrum settlement, Celestia DA) where our HYPE short lives; audited by ChainSecurity and Guardian (clean severity), but its own audit documents a fully trusted, upgradeable admin proxy and a single fully trusted sequencer whose keys could move user funds, plus a LayerZero exit path. |
Request a review
Missing a protocol you care about? Ask. Requests feed the research queue directly.