TL;DR
Cap issues cUSD, a dollar backed by a reserve of regulated stablecoins, and stcUSD, its yield-bearing wrapper. Yield is outsourced: whitelisted operators borrow from the reserve and run their own strategies, and restakers on EigenLayer and Symbiotic post collateral that gets slashed if an operator defaults. Both questions left open by the 2026-07-04 report are now answered on-chain, and they split in opposite directions. Upgrade authority is genuinely well built: a 24 hour timelock is the single holder of the admin role, and that is verifiable by enumeration rather than inference. Credit authority is not: the same 3-of-5 developer Safe that proposes timelocked upgrades can also whitelist a new borrower and set that borrower's loan-to-value in one instant transaction, with no delay and nobody able to veto it. Cap sets no protocol-wide minimum coverage ratio, so those per-borrower settings are the only floor that exists. Meanwhile July brought a governance mess that cost the protocol a third of its supply in five days and left cUSD quoting below par for about eleven days.
Checklist
Audits and contracts. Re-listed the public repo (cap-labs-dev/cap-audits) on 2026-08-05: nine PDFs from eight firms, filenames and dates confirmed one by one. Zellic, Trail of Bits, Electisec, Spearbit (two engagements), Recon, Sherlock, Certora on the EigenLayer AVS, and Octane. For a protocol this size that is a deep roster, and no firm named here is invented. Two caveats. The newest report is dated 2026-03-24, so nothing in the set covers code changes since March. And DeFiLlama still reports an audit count of 2, which is its own tally and understates the real surface.
Admin control. Last month's standing question is closed, and the answer is worse than the draft of this report first suggested. The good half first. Cap's access registry (0x7731...c683) is enumerable, so role holders can be listed rather than guessed. getRoleMemberCount(DEFAULT_ADMIN_ROLE) returns exactly 1, and the single member is the TimelockController (0xD823...29ab), whose getMinDelay() returns 86400 seconds. No residual deployer EOA holds admin. Per Cap's docs the bytes4(0) selector gates UUPS upgrades, and for cUSD, stcUSD, the Lender, the Delegation contract and the registry itself, that role has exactly one holder each, the timelock. grantAccess and revokeAccess are also timelock-only, so the Safe cannot quietly widen its own permissions. That is a real and independently checkable result.
The bad half is what the Safe already holds. The 3-of-5 developer Safe (0xb8FC...8793) holds, with no timelock at all: addAgent on the Symbiotic agent manager and addEigenAgent on the EigenLayer one, which are the calls that whitelist a borrowing operator and carry that operator's ltv, liquidationThreshold, delegationRate and coverageCap inside a single config struct; modifyAgent on the Delegation contract, which changes an existing operator's LTV and liquidation threshold after the fact; plus setLtvBuffer, registerNetwork, setInsuranceFund, setWhitelist and pauseAsset. In other words, the parameters that decide how much can be borrowed against how much collateral are under instant 3-of-5 control, while only the code is timelocked. The same Safe is proposer, executor and canceller on the timelock, and the CAP token owner Safe (0x80A2...c2eA) is 3-of-5 with the identical five signers, so there is no second independent quorum anywhere. Two further items worth stating plainly: the Safe also holds mint, pause and the upgrade role on the live rCAP token (0x9999...9999, 9.6B supply) with no timelock, and one guardian EOA that can call pauseProtocol on cUSD is itself registered as a borrowing agent. The prior run's finding that no freeze, blacklist or seizure path exists on the tokens is carried forward, and the pause holders it named (a 3-of-5 Safe plus two EOAs) match what is on-chain today.
Oracle. RedStone prices the reserve and the stablecoins, Chainlink covers the delegation assets (wstETH, wBTC), and an Aave adapter supplies borrow rates. Carried from the 2026-07-04 doc read, not re-verified this run, and live per-feed health is not something a doc read establishes anyway. refresh
Liquidity and exit. Last month this was untested. It is not untested anymore. Between 11 and 16 July, cUSD supply fell from $90.47M to $61.04M, a 32.5% contraction in five days. Redemption at par kept working and no queue or gate was reported, which is a genuine pass. But the buffer did not absorb it alone: operator borrowings fell from $41.87M on 14 July to $37.96M on 15 July, a $3.92M reduction at the trough, so loans were partly unwound to meet redemptions. Protos reported roughly $11M instantly available at the time against about $57M outstanding, which is tighter than the DeFiLlama series alone implies. Utilization peaked at 66.6% on 14 July. The structural limit has not moved: as of 2026-08-05, $44.83M of the $94.13M supply is lent to operators, so 52.4% of supply is instantly redeemable and the rest depends on loans that do not repay on demand. Separately, cUSD has almost no secondary market to exit into: two Uniswap pools hold about $6.1k of combined liquidity today, quoting $0.980 and $0.987. Since the Safe and two guardian EOAs can pause mint and redeem instantly, a pause would leave holders with no meaningful market at all.
Yield: real vs emission. Unchanged, and still the healthiest part of the design. The return is the credit spread operators pay plus an Aave yield floor. CAP is a pure governance token and is not the source of the yield.
Holder concentration. Two concentrations, not one. On the insurance side, of the $220.0M of delegated collateral on 2026-08-05, uniBTC alone accounts for $158.2M. That is 71.9% of the backing and 58.7% of headline TVL, so the guarantee rests mostly on a single wrapped-BTC token from Bedrock, which lost about $2M to a mint-rate exploit on 2024-09-27 (remediated, with reimbursement announced). Cap's per-operator siloing does not help here, because the concentration is in the asset rather than the allocation. On the credit side, 42 operators are registered but only 19 carry any debt, and the largest single operator holds $17.12M, or 38.2% of all borrowings; the top three hold 65.6%. CAP unlocks and cUSD holder distribution remain unpulled. refresh
Track record. No exploit, no operator default, no slashing event since launch in August 2025, and that part of the record holds under a fresh search. What broke this month was conduct and confidence. On Friday 12 July, Cap cut its promised stablecoin airdrop from $12M to $4.2M, redirecting the remainder toward Frontier and Homestead participants who had taken net losses buying Pendle YT tokens; backlash peaked by Monday 14 July. Founder Benjamin Peillard apologised, calling the original promise a mistake premised on an unconfirmed $250M valuation, against a June sale that actually cleared at up to $106M FDV. Protos reported that a wallet linked to Peillard's earlier project QiDAO had accumulated YTs ahead of the announcement; Peillard denied affiliation, describing the wallet as an old colleague and close friend. The allegation is unresolved rather than proven, and is reported as such. What is not in dispute is the market's verdict: about a third of supply left within five days, and CoinGecko's hourly series printed cUSD below $0.995 in 221 of 337 hours between 12 and 24 July, median $0.9755, low $0.9110, before snapping back to $0.9999 on 24 July. That is a sustained sub-par quote for roughly eleven days rather than a stale tick, though in a market this thin it signals stress rather than proven under-backing. It belongs in the record either way.
Worst case
The cheap worst case needs no default at all, and it is faster than a day. Three of five keys are compromised or coerced; the holder whitelists a new operator with a high LTV, or raises an existing one's LTV via modifyAgent, and borrows the idle reserve. Nothing about that path is timelocked. The 24 hour delay protects the code, not the credit parameters, so "holders get a day to leave" is not a defence here. The slower worst case is an operator default during a drawdown. Slashed collateral goes to a Dutch auction to refill the reserve, which means selling BTC and ETH liquid-staking tokens into exactly the conditions that produced the default. Aggregate cover looks generous at 4.91x ($220.0M against $44.83M borrowed), but that ratio is inflated by the 23 registered operators who borrow nothing at all. What binds per loan is the per-agent LTV, readable on-chain: most agents sit at 50% (200% collateralization at full draw, which is the figure Cap's docs present only as an illustration), three sit at 80%, meaning 125% collateralization with liquidation triggered at 85%. Cap sets no protocol-wide minimum, so those settings are conventions the Safe can change instantly, not invariants. Add the EigenLayer effectiveness delay on freshly delegated stake (17.5 days per the prior report, not re-verified this run), the 71.9% uniBTC concentration, a single borrower at 38.2% of the book, and an off-chain legal agreement carrying part of the recovery, and the shortfall path is real. Cap's own docs do not state what happens to lenders if liquidated collateral falls short.
Bottom line
Caution, and held there rather than lowered. Two open questions closed. Upgrade control turned out better than the last report could confirm: timelocked, single-admin, and provable by enumeration rather than assertion. Credit control turned out worse: a 3-of-5 Safe with no independent counterparty decides who borrows and on what terms, instantly, and there is no protocol-level coverage floor behind it. The machinery itself did work. The reserve honoured a 32% run at par, deposits have since recovered to $94.3M, and no operator has defaulted in a year of operation. But three dimensions sit red. The insurance layer is 72% one asset, the loan book is 38% one borrower, and the team reneged on a public commitment while facing unresolved insider allegations, which matters more than usual on a protocol where that same team decides who is allowed to borrow. Note also that recovery is local, not absolute: cUSD supply peaked at $443.2M on 2026-01-28, so today's $94.3M is about 79% below the high, not a new one. Gate logic stops at caution rather than avoid because nothing in the protocol failed, redeemers were made whole at par, and the audit and upgrade surface is genuinely strong. Size it as an experimental credit position, not a cash park. Re-rate down on a substantiated self-dealing finding, a first operator default, or any further LTV increase on the largest borrower. Re-rate up on a published per-operator coverage table, or on the agent-management roles moving behind the timelock.
Data appendix
- TVL: $269,341,838 (
api.llama.fi/tvl/cap), against $234,140,422 on 2026-07-04 in the same series, so up 15.0% (the prior report's rounded ~$233M gives ~15.6%). The rise is deposits, not price. Idle stablecoin reserve grew $21.9M ($27.4M to $49.3M) and delegated collateral grew $13.4M ($206.8M to $220.0M), of which roughly $6.6M is BTC (+2.6%) and ETH LST (+6.5%) appreciation. Unit counts confirm it: USDC rose $25.97M, wstETH units rose 22.5% and LBTC units 69% on new delegation, while uniBTC units fell 1.3% and weETH and SolvBTC were exactly flat. - What that TVL actually is: 81.7% of it ($220.0M) is restaking collateral, not cUSD backing. Only $49.3M of idle reserve assets (USDC $44.21M, WTGXX $5.10M, plus dust) sits in the vault. Reading $269M as "backing for cUSD" is wrong, and this figure feeds our dependency map.
- cUSD supply and peg: on-chain
totalSupply94,134,308 (0xcCcc62962d17b8914c62D74FfB843d73B2a3cccC); DeFiLlama live stablecoins endpoint $94,191,705; DeFiLlama daily USD series $94,279,179. The three agree within 0.16%. Quoted price $0.9998, but the only two DEX pools quote $0.9799 and $0.9869 on about $6.1k of combined liquidity, so the aggregate price is not market-verified at size. stcUSDtotalSupply82,676,882 units (0x88887bE419578051FF9F4eb6C858A951921D8888). - Borrowed and utilization: $44,831,695 borrowed (DeFiLlama
chainTvlsEthereum-borrowed), independently reconstructed on-chain by summingLender.debt(agent, USDC)across all 42 registered agents to $44,846,928, a 0.03% difference. Utilization 47.6%; instant redemption capacity 52.4% of supply. Correction to last month: the prior report cited a third-party "~18 operators borrowing ~$14M" snapshot, but DeFiLlama's own series put borrowings at $43.87M on 2026-07-04, so that figure understated live exposure roughly threefold on its own publication date. - July run (on-chain series): supply $90.47M on 07-11, $79.25M on 07-13, $62.85M on 07-14, trough $61.04M on 07-16, back to $94.28M by 08-05. Borrowings were not flat: $42.02M on 07-13, $41.87M on 07-14, then $37.96M on 07-15, a $3.92M (9.4%) reduction, recovering above $45M from 07-22. Utilization peaked at 66.6% on 07-14. All-time supply peak was $443.2M on 2026-01-28.
- Audits: nine reports, eight firms, listing re-verified 2026-08-05 (
github.com/cap-labs-dev/cap-audits). Zellic 2025-03-17, Trail of Bits 2025-05-15, Electisec 2025-05-25, Spearbit 2025-06-23, Recon 2025-07-04, Sherlock 2025-09-03, Certora EigenAVS 2025-09-15, Spearbit PR review 2025-11-27, Octane 2026-03-24. - Admin and governance (verified on-chain 2026-08-05): AccessControl
0x7731129a10d51e18cDE607C5C115F26503D2c683is enumerable.getRoleMemberCount(DEFAULT_ADMIN_ROLE)= 1, sole member the Timelock0xD8236031d8279d82E615aF2BFab5FC0127A329ab,getMinDelay()= 86400. UUPS role (bytes4(0)per Cap's docs) on cUSD, stcUSD, Lender, Delegation and the registry: one holder each, the Timelock.grantAccessandrevokeAccess: Timelock only. Developer Safe0xb8FC49402dF3ee4f8587268FB89fda4d621a8793, 3 of 5, holds proposer, executor and canceller on the timelock and, with no timelock,addAgent(0x79129c5b) on the Symbiotic agent manager0x08a728cf4e6b39f4afa059c6ee376103722953ea,addEigenAgent(0x512e110e) on the EigenLayer agent manager0xa82f6f9e67e127621f3e5f3953beef926b4b5ba9, plusmodifyAgent,setLtvBuffer,registerNetwork,setInsuranceFund,setWhitelistandpauseAsset.pauseProtocolon cUSD: the Safe plus EOAs0xc1ab...6b52and0x5143...d77a. CAP token owner Safe0x80A216738E4e49B262Deae6bEb6578Bdf164c2eAis 3 of 5 with the identical signer set. Lender0x15622c3dbbc5614E6DFa9446603c1779647f01FC, Delegation0xF3E3Eae671000612CE3Fd15e1019154C1a4d693F; all addresses matchdocs.cap.app/developers/addresses. Any 3-of-6 or 10-day-timelock figures that surface under a "Cap" search belong to EigenLayer governance and must not be attributed here. - Coverage: no protocol-wide minimum ratio exists. Per Cap's docs, underwriters "assess Borrower credit, set LTVs per Borrower, and negotiate the premium bilaterally", pricing is "not by pooled governance or protocol-wide risk parameters", and the 200% figure in the docs is an illustrative example. Correcting last month's assumption, the per-borrower terms are not private:
Delegation.ltv(agent)andliquidationThreshold(agent)are readable, and across the 42 agents read 50% LTV / 80% threshold for most, 60%/80% for three, 65%/80% for one, 80%/85% for three, and 0%/80% for one. Aggregate collateral to borrowed is 4.91x ($220.0M / $44.83M) but is inflated by 23 agents with zero debt. Default triggers automated liquidation plus a Dutch auction on slashed collateral, backed by an off-chain legal right of recovery. Shortfall handling is undocumented. - Concentration: uniBTC $158.18M (71.9% of delegated collateral, 58.7% of TVL), wstETH $22.60M, weETH $16.34M, LBTC $11.58M, SolvBTC $11.13M, XAUM $0.21M. Borrower side: 42 registered agents, 19 with debt; largest $17.12M (38.2%), top three 65.6%, top five 83.9%.
- Recent news, 2026-07-04 to 2026-08-05: stabledrop cut from $12M to $4.2M announced Friday 12 July with backlash by Monday 14 July, self-dealing allegations denied by the founder (Protos; corroborated by The Defiant). No exploit, operator default, slashing or coverage-shortfall event found. An X-search pass returned no results at all this run, including no match for the project account, so it is treated as a failed check rather than a clean bill of health; the clean incident record rests on web search and the on-chain series instead.
- Peg behaviour during the July run: CoinGecko hourly, 12 to 24 July: 221 of 337 points below $0.995, median $0.9755, low $0.9110 on 20 July, recovery to $0.9999 on 24 July. Daily prints agree. This is a sustained sub-par quote, not the stale-tick artefact it might resemble, but cUSD's secondary market is roughly $6k deep, so it evidences stress rather than proven under-backing, and redemption at par continued throughout. Maintained monthly. Methodology: DeFi Research Instruction v2.