TL;DR
Felix is a licensed Liquity V2 CDP fork on HyperEVM that mints feUSD, sitting next to a larger Morpho vault business, a tokenized-equities product and, until June, a perps venue. The standing question across two prior runs was the admin surface: how many multisig signers, what threshold, any timelock. This run read it on-chain and settled most of it. The answer contradicts the protocol's own Terms. Every one of the 51 core CDP contracts in Felix's published address registry, spanning all four collateral branches and including the feUSD token itself, is an EIP-1967 upgradeable proxy sharing a single ProxyAdmin, and the ownership chain above that admin terminates in a 3-of-6 Safe. The Terms state the opposite in as many words: the CDP "operates through immutable Smart Contracts ... without reliance on upgradeable proxy structures." Nothing has gone wrong yet. No exploit, no depeg, no bad debt, feUSD prints $1.0013, the CDP is collateralized at 270%. But the property that made this protocol look structurally safe is not a property it has.
Checklist
Audits & contracts. The audit stack is real and was verified name by name against the audits page, not assumed. Inherited from Liquity V2: ChainSecurity (core December 2024, governance January 2025), Dedaub (core August and November 2024, governance August, November and December 2024), Certora formal verification (December 2024), Coinspect (Bold core December 2024, Bold governance January 2025) and Recon (October 2024). Felix commissioned Dedaub and Coinspect on its own modifications, namely mint caps, admin trove-parameter adjustments and protocol pausing, and Three Sigma on the price feeds. No firm named in this report is fabricated and none of the engagements is misattributed. What no audit covers is the deployment shape. Sweeping the EIP-1967 admin slot across every address in felixprotocol/felix-contracts addresses/999.json returned 51 of 51 core contracts as proxies under ProxyAdmin 0x44a600c0, with zero exceptions. That includes BorrowerOperations, TroveManager, StabilityPool, ActivePool, DefaultPool, CollSurplusPool, SortedTroves, TroveNFT and PriceFeed on each of the four branches, plus CollateralRegistry and feUSD. The feUSD token returns owner() = 0x0, which looks like renounced control and is not: renouncing Ownable on the implementation says nothing about the proxy above it. One point in Felix's favor, verified rather than assumed: the Morpho vaults genuinely are not proxies. Their implementation and admin slots are both zero, so the Terms' separate claim that "neither the Vanilla Markets nor the associated Vaults employ proxy contracts" is accurate. The false claim is the one about the CDP.
Admin control. This is the finding of the run and it is reproducible in four calls. ProxyAdmin 0x44a600c0 is owned by AdminController 0xf42fdd95, which is itself an upgradeable proxy. Its ProxyAdmin 0xdf1293b4 is owned by Safe 0x699090e7, which returns threshold 3 over six owners. The AdminController implements OpenZeppelin AccessControl with DEFAULT_ADMIN_ROLE() and PROPOSER_ROLE() both answering, a propose-and-execute shape, but getMinDelay(), delay() and timelock() all revert, so whether any delay guards that path could not be read from a public getter. On the vault side, all nine Felix vaults are owned by Safe 0x4A827418, threshold 4 over six owners, and those six owner addresses are byte-for-byte identical, in the same order, to the six behind the 3-of-6. The same key set therefore guards the vaults at a higher threshold than it guards the power to replace the CDP contracts and the stablecoin. The curator is Safe 0x18e49614, threshold 1 over three owners, sitting above $75.2M of deposits. Every vault returns guardian() = 0x0 and pendingGuardian() empty, with timelock() = 259200 (three days) and fee() of 10%, even though the Terms name Anthias Labs as "Curator, Allocator, and Guardian." The three-day window and the 4-of-6 owner's ability to revoke a pending action are the real brakes here. A guardian is not.
Oracle. The risk-management page names RedStone as the pricing solution and exposes no numeric parameters at all: no LTV, no MCR or CCR, no mint caps. The Three Sigma audit ran 23 to 25 July 2025 over 198 lines of Solidity in two price-feed contracts and returned 0 critical, 0 high, 2 medium and 1 informational. M01 was a hidden USDC peg dependency, where feeds assumed USDC equals $1 rather than composing HYPE/USDC by USDC/USD; M02 was deviation constants set at 1% or 2% against oracles that actually update at 0.5%, which made the redemption use-max path trigger too broadly. Both were fixed in commit 398ca73, and the only evidence of that remediation is the auditor's own write-up. The HyperStone layer that served the perps product is ten nodes with a 3-of-5 signature rule inside a 1% deviation threshold and a 2.5 to 3 second publish path; RedStone's additional claims of a 4-of-6 verification quorum, $3.4B secured volume and zero mispricing events are vendor-reported and are treated as such.
Liquidity & exit. feUSD is structurally redeemable for $1 of collateral and prints $1.0013. The market around it is small and shrinking. On-chain totalSupply() returns 11,256,453.8, down 86.3% from an $82.51M peak on 2025-07-14, and the whole secondary book is roughly $151.5k of 24h volume spread across ten pairs, of which the Hyperliquid spot book is 52% and the largest actual DEX pool, Curve feUSD/USDe, is 15%. The 24h range is $0.9851 to $1.05, which is wide for a stablecoin and reflects thin books rather than a peg event. Note that CoinGecko's own supply data for feUSD is broken: it reports 75.0M circulating, a $75.06M market cap and an $8.9B FDV. Supply last stood above $75M on 2025-08-08. The prior version of this report carried that stale figure; it is not used here.
Yield (real vs emission). DefiLlama lists four stability pools paying 4.96% (WHYPE), 2.45% (UBTC), 8.20% (kHYPE) and 9.57% (wstHYPE). None returns an apyBase or apyReward, so the split between borrow interest, liquidation gains and any points program cannot be decomposed from that source. The economics are the right shape for real yield: borrowers pay interest, stability-pool depositors buy liquidated collateral at a discount, and the deployed constants set SP_YIELD_SPLIT at 75% with annual interest bounded between 0.5% and 250%. The vaults take a 10% performance fee.
Holder concentration. Measured on the CDP alone, which is the correct denominator for what backs feUSD, collateral is $23.82M WHYPE (78.3%), $4.02M kHYPE (13.2%), $1.76M feUBTC (5.8%) and $0.82M wstHYPE (2.7%). HYPE-linked collateral is 94.2%, and stepping back monthly it has been 93.4% or higher at every checkpoint since 2026-05-13 and above 87% for the past year. The prior report's "~70% WHYPE" came from the combined parent slug, which mixes in vault stablecoins that never back a trove; across the whole parent, HYPE-linked assets are 41.9%. Two further concentrations matter: 86.9% of all feUSD sits inside stability pools rather than circulating, and the single Felix USDC (Frontier) vault holds $37.08M, or 49.2% of the vault side.
Track record. Live since April 2025, so about sixteen months, with the CDP TVL series beginning 2025-04-08 and the vault series running back to 2025-02-19. Felix appears nowhere on the DefiLlama hacks list, which carries five other Hyperliquid L1 entries over the same window: LND ($1.3M, 2025-05-09), HyperVault ($3.6M, 2025-09-26), Hyperdrive HL Lending ($773k, 2025-09-27), Raga Finance ($18.5k, 2025-11-22) and Purrlend ($1.5M, 2026-04-25). No Felix depeg, bad-debt event, liquidation cascade or oracle incident was found. The correction to make against the prior draft is directional. The surface did not keep widening. Hyperion DeFi, the Nasdaq-listed counterparty that supplied 500,000 HYPE for Felix's HIP-3 perp markets, announced on 2026-06-08 that Felix would close its perpetuals exchange by 2026-06-22, with the HYPE freed by 2026-06-29; The Block reported the same unwind. The cause was external rather than a Felix failure, since those markets were quoted against Hyperliquid's USDH, which was itself being sunset, and the wind-down ran to schedule. What remains notable is the disclosure gap: Felix's documentation still presents perpetual futures as a live product with no discontinuation notice. That is the second place in this review where Felix's own docs and verifiable reality disagree.
Worst case
Two paths, unequal in size. The economic path is a fast HYPE drawdown. 94.2% of trove collateral is HYPE-denominated, stability pools hold $9.78M against $30.42M of collateral, and if liquidations outrun those pools and on-chain HYPE liquidity at once, the residue is bad debt against a stablecoin whose entire secondary market turns over six figures a day. A USDC dislocation is a second-order version of the same thing, since USDC still sits under the price stack even after the M01 fix. The custody path is worse and faster. Three of six keys can replace the implementation behind BorrowerOperations, ActivePool, the PriceFeed or the feUSD token, with no delay readable from any public getter, and a single key on a 1-of-3 Safe can queue a malicious market or cap change into $75.2M of vaults where the only brake is a three-day timer and a 4-of-6 owner who has to be watching it. RedStone's own 2026 write-up attributes more than $600M of DeFi losses in the first four months of this year to key management and low multisig thresholds rather than contract bugs. No insurance fund is named anywhere in the docs. Position sizing and a peg alert are the mitigation.
Bottom line
Caution, and now for a documented reason rather than an inferred one. The engineering quality, the audit coverage, the 270% collateral ratio, the orderly perps wind-down and a clean sixteen-month record are all real and all argue against avoid. What forces caution is that the strongest safety claim in Felix's documentation is flatly contradicted by its own deployment. The Terms say the CDP runs without upgradeable proxy structures; 51 of 51 core contracts are upgradeable proxies, the stablecoin among them. The same documentation names a Guardian that the chain says is the zero address, and still advertises a perpetuals product that a Nasdaq-listed counterparty announced closed in June. Add a 1-of-3 curator over $75M, 94% HYPE concentration on the borrowing side, and a feUSD float down 86% from its peak, and this is a monitored, sized position rather than a place to park size and stop looking. If the AdminController turns out to enforce a real delay and the curator Safe raises its threshold, most of the red here becomes yellow. Read the chain, not the Terms.
Data appendix
- TVL: $105.88M parent (DefiLlama
felix), verified. Against 30d ago ($125.25M) it is down 15.5%; against 90d ago ($128.25M) down 17.4%; against this report's own 2026-07-01 snapshot of $101.19M it is up 4.6%, so the month-over-month read is flat to slightly up while the quarter is down. ATH $482.33M on 2025-12-07, a 78.0% drawdown. Source: api.llama.fi. - Split: Felix Vaults $75.17M, Felix CDP $30.42M, Felix USDhl $0.46M, Felix Perps $0. Children sum to $106.05M against a $105.88M parent, a rounding-scale gap. Felix Perps is listed under category "Interface" with no chains, so its $0 is a reporting artifact and not a measurement of an active venue. Source: api.llama.fi/protocols.
- CDP collateral: WHYPE $23.82M (78.3%), kHYPE $4.02M (13.2%), feUBTC $1.76M (5.8%), wstHYPE $0.82M (2.7%). HYPE-linked 94.2%; monthly checkpoints 95.1% (2026-07-13), 95.4% (2026-06-13), 93.4% (2026-05-13), and above 87% throughout the past year. Source: api.llama.fi/protocol/felix-cdp, tokensInUsd.
- Vault assets: USDC $50.45M (67.1%), WHYPE $15.67M (20.9%), USDT0 $8.38M (11.1%), USDe $0.48M, USDhl $0.16M, USDH $0.02M. Nine Felix vaults on Morpho summing to $75.32M; largest is Felix USDC (Frontier) at $37.08M, 49.2% of the vault side. Sources: api.llama.fi/protocol/felix-vaults, api.morpho.org/graphql.
- feUSD:
totalSupply()on0x02c6a2fa58cc01a18b8d9e00ea48d65e4df26c70returns 11,256,453.80; DefiLlama circulating $11.27M at $1.00135, pegMechanism crypto-backed; ATH $82.51M on 2025-07-14, a drawdown of 86.3%. Collateral ratio 270.2%. Stability pools hold $9.78M, or 86.9% of supply. CoinGecko's 75.0M circulating, $75.06M cap and $8.9B FDV are stale (supply last exceeded $75M on 2025-08-08) and were not used. Sources: HyperEVM RPC, stablecoins.llama.fi id 251, CoinGecko. - Secondary market: roughly $151,536 of 24h volume across ten pairs and seven venues: Hyperliquid FEUSD/USDC 52.1%, Curve FEUSD/USDe 14.8%, HyperSwap V3 FEUSD/USDT0 12.1%, HyperSwap V3 FEUSD/USDhl 5.2%, Project X FEUSD/USDT0 3.7%, then HyperSwap, Hybra and Kittenswap tails. 24h range $0.9851 to $1.05. Source: CoinGecko.
- Audits: Liquity V2 core and governance by ChainSecurity, Dedaub (five engagements), Certora (formal verification), Coinspect and Recon, August 2024 through January 2025; Dedaub and Coinspect on Felix modifications (mint caps, trove parameters, pausing); Three Sigma on price feeds 23 to 25 July 2025, 198 nSLOC, 1.2 person-weeks, 0 critical, 0 high, 2 medium, 1 informational, M01 hidden USDC peg dependency and M02 misaligned deviation thresholds, both fixed in commit 398ca73. No bug bounty appears on the audits page. Sources: usefelix.gitbook.io/docs/advanced/smart-contract-audits, threesigma.xyz.
- Admin / governance (on-chain, this run): all 51 unique core addresses in
addresses/999.json, across the WHYPE, UBTC, KHYPE and WSTHYPE branches plus CollateralRegistry, feUSD, hintHelpers, multiTroveGetter and metadataNFT, report EIP-1967 admin0x44a600c031dbdf652500f4a6d84b168056f13692; zero non-proxies. That ProxyAdmin'sowner()is AdminController0xf42fdd953e68d0010f5fa9d61ef1ba0fc997ef2f, itself a proxy (impl0xd2fe30df), exposingDEFAULT_ADMIN_ROLE()andPROPOSER_ROLE()(= keccak("PROPOSER_ROLE")) but reverting ongetMinDelay(),delay()andtimelock(). Its ProxyAdmin0xdf1293b46d3d8f6c090ab98094805db68922ce30is owned by Safe0x699090e73c4077ef2af42773b31788c6564f079c, threshold 3 of 6 (Safe 1.3.0). Vault owner Safe0x4A827418D632C415E19825fd011283A4ba020B3A, threshold 4 of 6, identical signer set in identical order. Vault curator Safe0x18e4961454B3E487B3f47c70b703684D894Ff979, threshold 1 of 3. All nine vaults:guardian() = 0x0,pendingGuardian()empty,timelock() = 259200,fee() = 1e17. Vault implementation and admin slots are zero, confirming the vaults are not proxies. Sources: HyperEVM RPC, api.morpho.org/graphql, github.com/felixprotocol/felix-contracts. - Terms language (verbatim): "The CDP Product similarly operates through immutable Smart Contracts administered via governance mechanisms controlled by the Platform Operator, without reliance on upgradeable proxy structures." Also "Are immutable once deployed and cannot be modified;" and "It operates through immutable Smart Contracts governed by a multisig wallet controlled by the Platform Operator, with no capacity for the Platform Operator to seize, redirect, or otherwise interfere with User's funds." Anthias Labs "serves as Curator, Allocator, and Guardian." No threshold and no timelock appear anywhere in the Terms. Source: usefelix.gitbook.io/docs/terms/terms-and-conditions.
- Oracle: RedStone named as the pricing solution on the risk-management page, which carries no numeric LTV, collateral-ratio or mint-cap parameters. HyperStone: ten nodes, 3-of-5 signatures within a 1% deviation threshold, 2.5 to 3 second publish; the 4-of-6 quorum, $3.4B secured volume and zero-mispricing claims are RedStone's own. Sources: Felix docs, blog.redstone.finance.
- Yields: stability pools WHYPE 4.96%, UBTC 2.45%, kHYPE 8.20%, wstHYPE 9.57%;
apyBaseandapyRewardnull on all eight Felix pools. Deployed constants:SP_YIELD_SPLIT75%, interest bounds 0.5% to 250%,MIN_DEBT1,000 feUSD (2,000 on UBTC), rate-adjustment cooldown 7 days. Sources: yields.llama.fi/pools, addresses/999.json. - Recent-news scan (2026-07-01 to 2026-08-11): no Felix incident, depeg, pause, bad-debt event or oracle failure found; Felix absent from api.llama.fi/hacks (621 entries). Product changes predating the window: tokenized US equities and ETFs with Ondo, 250+ assets, launched around 2026-03-26 on a partnership announced January 2026; perpetuals exchange announced closing by 2026-06-22 following the USDH sunset, per Hyperion DeFi's 2026-06-08 release and The Block. Sources: api.llama.fi/hacks, ir.hyperiondefi.com, theblock.co, thedefiant.io.
Maintained monthly. Methodology: DeFi Research Instruction v2.