TL;DR
Our 2026-07-02 and 2026-07-18 reports both said avoid and named three upgrade conditions. This run, two of them clear. The audit reports are real: four PDFs on Saturn's own gitbook, which we downloaded and read end to end rather than trusting the filenames. They are not marketing artifacts. They name the repositories, the commit hashes, the exact core files, and the fix commits. The custody chain is also named at last: the STRC shares sit with Clear Street, Galaxy's custodian partner, inside a British Virgin Islands professional fund administered by Securitize, a US-registered broker-dealer and transfer agent. The third condition fails exactly as before. Both timelocks still have one plain externally owned key as their only proposer, and we re-confirmed both on-chain this run. That is enough to move the verdict from avoid to caution, and not one step further.
Read the rest before treating caution as comfort, because the thing this review found is worse than the number that usually gets quoted. sUSDat is not near a dollar and it did not merely drift. It held $1.00 through April and most of May, peaked at $1.0089 on 13 May, and then fell for six straight weeks to $0.7478 on 28 June, with an intraday all-time low of $0.7026. That is a drawdown of about 26 percent, not the 12 percent you get by measuring from May to today. It has since recovered to $0.8787, so a holder who bought at par and never sold is down roughly 12 percent, and a holder who needed liquidity in the last week of June was down a quarter. This is not a bug. sUSDat floats with the net asset value of STRC, Strategy's preferred stock, which closed Friday at $85.29 against a $100 stated amount and traded near $73 at the June trough. The dividend rate ratcheted to 12.00 percent for record dates from 1 July, which sounds like good news and is the opposite: under the policy Strategy adopted on 29 June, a monthly VWAP below $95 triggers an increase of at least 50 basis points, and the increases are permanent. The protocol worked as designed. The design is the risk.
Checklist
Audits & contracts. The single biggest change, and it is real. Three Sigma audited Saturn Dollar over a 1.6 person-week engagement across 30 December 2025 to 12 January 2026, scoping 532 nSLOC: StakedUSDat.sol, WithdrawalQueue.sol, USDat.sol, TokenizedSTRC.sol. That is the core, not a peripheral helper. Result: zero critical, two high (both addressed), five medium (four addressed), thirteen low (eleven addressed), three informational. Certora then ran three engagements. The January 2026 review found fifteen issues, none critical or high, eleven fixed. The February 2026 review of the M0 Extensions rebuild found two high, both fixed: a supply-cap decimals mismatch, and a MIN_WITHDRAWAL threshold incompatible with USDat decimals that would have permanently blocked all redemptions. The fourth report extends that work to 9 April 2026 and adds eleven machine-proved properties covering vault solvency, withdrawal-queue burn integrity, USDat backing and access control, including "Processor cannot burn more STRC than exists" and "users always receive at least the minimum USDat they specified." All eleven come back Verified. We correct our prior report without hedging: the claim that zero reports were published was true when written and is false now.
Three honest caveats, one of which the draft of this report missed. First, the acknowledged findings cluster on a single theme, the gap between off-chain settlement and on-chain accounting. Three Sigma M03 flags incorrect share pricing if USDat ever depegs, since totalAssets assumes USDat is always worth a dollar. Certora L-01 flags that USDat can be briefly unbacked because of the lag between the off-chain STRC purchase and the on-chain burn, and I-03 that a paused USDat can leave sUSDat unbacked. All were acknowledged rather than repaired. Second, and this is Certora's own words rather than our inference, "the repository does not include test coverage for StakedUSDat or the associated withdrawal and processing modules." A $176M vault whose withdrawal path was shipped without unit tests is worth knowing about even after four audits. Third, both tokens remain upgradeable proxies, so the audited bytecode is replaceable by whoever controls the upgrade path. That last risk is scored under Admin control, where it belongs. The Zellic timelock review Saturn cited in June is still not among the four published files, and the transparency page makes no mention of Zellic at all.
Admin control. Nothing moved, and this is why the verdict cannot go past caution. We checked both keys again this run and both return bytecode 0x. 0x610182581c93687ca03f4a8e7f124f8cec616820 is still the admin timelock's only proposer, proven previously from the deployment constructor arguments and a complete nine-transaction history. 0xa18f34a03788cfc566ce5ccb21b2715f072da3ad is still the asset-cap timelock's sole proposer. Two timelocks, two single keys, no multisig anywhere. The 5-day delay is the mitigation and it is a genuine one: a malicious operation sits in a public queue for five days, and as the exit section shows, five days is enough time to sell at size. But a delay is a warning system, not a permission system, and it only works if somebody is watching. Certora puts the emphasis somewhere adjacent: it names PROCESSOR_ROLE, which supplies totalStrcSold, totalUsdatReceived and executionPrice, as "the most significant trust boundary" in the protocol, and notes the tolerance band that constrains it defaults to 20 percent. That role reports the results of trades nobody on-chain can see, inside a 20 percent envelope.
On custody, the picture finally has names in it. Saturn's documentation states that STRC is custodied with Clear Street, that the fund is incorporated in the BVI as a professional fund, and that Securitize administers it as a US-registered broker-dealer and transfer agent. Those are checkable counterparties, a real improvement over an unnamed custodian. What the page does not say matters too, and we looked for it specifically: the words bankruptcy remote, segregated and SIPC do not appear anywhere on it. So we know who holds the shares. We still do not know what happens to your claim on them if the fund or its manager fails.
Oracle. Broadly as we recorded it, with one correction against the draft. The verified StrcPriceOracle at 0x5f7ecd0d045c393da6cb6c933c671ac305a871bf wraps a Chainlink-compatible feed and enforces a 26-hour staleness cap against a 24-hour heartbeat plus price bounds of $20 to $150. With STRC at $85.29 the bounds are not close to binding, though note how wide they are: the floor sits 80 percent below the stated amount. The correction is on the NAV pipeline. Saturn's transparency page says it "is working with Accountable to provide real-time proof of reserves" and that "Chainlink will also publish a NAV oracle using the Accountable data feed." That is future tense in Saturn's own documentation, so treat the pipeline as announced rather than confirmed live, which is a step down from how we described it in July. Certora's description of the M0 build confirms the on-chain half, that totalAssets is computed from a Chainlink-compatible oracle price with tolerance checks. One open question we could not close: Certora explicitly lists "staleness during NASDAQ weekend closures" among the attack vectors it considered, and a 26-hour cap sits inside a market that is shut for roughly 65 hours every weekend. How the feed behaves across that gap is not something we verified.
Liquidity & exit. Better than the last two reports could establish, because this time we priced it. The Ethereum PT-sUSDat market holds $3.27M and a $250,000 sell executes at 0.026 percent price impact for about $82 in swap fees, roughly 7.6 percent of the pool. The BSC market holds a further $3.30M. For retail and small-desk size, the secondary exit works. The primary exit is a different animal. Certora describes it precisely: withdrawals are asynchronous through a WithdrawalQueue implemented as an ERC721, users escrow shares and specify a minimum USDat, the processor locks and fills requests in batches by selling STRC off-chain, and requests cannot be cancelled once submitted. Saturn's own channels put the wait at 3 to 7 days, which reaches us through secondary coverage rather than the docs. At the end of it, Saturn's documentation is explicit that "onboarded users can mint and redeem 1:1 with USDC," so KYC still stands between most holders and par.
PT exit mechanics, since this is where the money actually sits. The chain has four links and most people only look at the first. PT-sUSDat matures 2026-08-27, 39 days out. At expiry one PT redeems for one unit of the SY underlying, which for this market is a sUSDat-denominated unit rather than dollars. This is the part that costs money if you miss it: the 11.49 percent implied yield is fixed in that unit, not in USD. Your dollar return is that fixed rate multiplied by whatever sUSDat NAV does between now and expiry, and sUSDat NAV moved 26 percent in six weeks earlier this summer. A buyer who locks 11.49 percent for 39 days has locked about 1.2 percent of nominal accrual against an instrument that recently moved twenty times that in the wrong direction. Link two: sUSDat converts to USDat through the non-cancellable queue above, at whatever NAV clears when the processor sells. Link three: USDat to USDC at 1:1, onboarded addresses only. Link four, the alternative to all of that, is selling into the Pendle AMM before expiry, which today is the cleanest route and the only one that needs neither KYC nor a queue. That option depends on pool depth persisting, and the pool is $3.27M against a $176M protocol.
Yield: real vs emission. No emissions, real cash income, and we are downgrading this to red anyway. Here is the reasoning, and a reader is free to disagree with the grade but not with the mechanism. STRC pays a variable preferred dividend, 12.00 percent annualized for record dates from 1 July 2026, paid semi-monthly at $0.50 per share on the $100 stated amount, passed through to sUSDat as exchange-rate appreciation. The rate is not set by market demand for the yield. Under the policy Strategy announced on 29 June 2026 it is set by STRC's own monthly VWAP: below $95 the framework calls for an increase of 50 basis points or more, between $95.00 and $98.99 for 25 basis points or more, and between $99.00 and $100.99 for no change. Increases are permanent and do not reverse when the price recovers. The rate launched at 9 percent in July 2025 and has now risen seven consecutive times. So the headline number rises precisely as the collateral deteriorates, which makes it an inverse indicator of expected return rather than a measure of it. That is a defect in the yield, not only in the collateral. The position is single-issuer corporate credit on one company whose ability to pay tracks the price of Bitcoin, and you are paid more exactly when the market thinks that is worth less. One nuance in Saturn's favour: the sUSDat reserve is documented as dynamic, allocating between Treasuries and digital credit according to the LTV of the credit strategy, so exposure is not necessarily 100 percent STRC. The current allocation is not published, and the realised drawdown suggests the STRC weight was high. Separately, and unchanged: PT jrUSDat, currently 23.1 percent implied, is Strata's product, not Saturn's, and jrUSDat is explicitly first-loss capital sitting under srUSDat. Do not read that number as Saturn yield.
Holder concentration. Unresolved for a third consecutive review. The Etherscan top-holders endpoint returned the API Pro paywall error again this run. Refresh.
Track record. Four and a half months on mainnet since the 2026-03-10 deployment. TVL has been essentially flat across three reviews: $188.6M on 2026-07-02, $176.1M on 2026-07-18, $176.3M today. No exploit, and no entry for Saturn, USDat, sUSDat, Strata or jrUSDat on the DeFiLlama hacks list. But the protocol has had one genuine stress event and the honest description of it is not the one we drafted. From $1.0089 on 13 May, sUSDat fell every week through June: $0.9772 on 3 June, $0.942 on 17 June, $0.880 on 24 June, $0.822 on 25 June, then $0.7496, $0.7523 and a $0.7478 low on 28 June, with a $0.7026 intraday all-time low. Peak to trough that is about 26 percent. Saturn's own documentation does not prepare a holder for that; the page describing how sUSDat works says its "exchange rate gradually increases" as yield accrues and says nothing about the rate falling. The June episode is the disclosure gap made visible. Separately, the April Innora disclosure, SAT-001 critical and SAT-002 high, still has no formal team response. Note the timing before crediting the new audits with answering it: all four published reports predate the 14 April disclosure. Certora's H-02, a threshold bug that would have permanently blocked all redemptions, is the same family of defect as Innora's withdrawal-freeze claim and is marked Fixed, but it was found independently in February and we cannot say Innora's specific findings were addressed.
Worst case
Three paths, and the third is no longer hypothetical. Path one: either single proposer EOA is compromised, a malicious operation is queued against $176M, and it executes after five days if nobody is watching the queue. The audits do not help here, since the upgrade path can replace the audited code. Path two: the custody chain breaks. Clear Street holds the shares inside a BVI professional fund, and nothing published says that fund is bankruptcy remote. An attestation can prove the shares exist and an oracle can publish the number, and neither makes the shares reachable if the wrapper fails. Path three is simply a repeat of June, deeper: Bitcoin falls, Strategy's capacity to service the preferred deteriorates, the ratchet fires again and STRC keeps sliding, and sUSDat NAV follows it down while the withdrawal queue fills with people trying to leave through a processor who has to sell into that same market during Nasdaq hours. June showed that path can take a quarter of NAV in six weeks with the protocol functioning exactly as specified. A PT holder waiting for the 27 August expiry has no queue priority and no floor. There is no insurance fund and no bug bounty documented for any of the three; the transparency page mentions neither.
Bottom line
Caution, upgraded from avoid, and the upgrade is earned rather than granted. Saturn published four genuine audits covering the contracts that actually hold the money, with high-severity findings fixed and eleven properties formally proved, and it named the custody chain end to end. Those were two of our three stated conditions and they are met. The third is not: one plain key still proposes to each timelock, and until that is a multisig this cannot be called solid no matter what else improves. What the flip does not mean is that the position is safe. The clearest fact in this report is that sUSDat lost about a quarter of its value between mid-May and late June, while the coupon rose to 12 percent because the collateral was falling, and Saturn's own documentation still describes the exchange rate as one that gradually increases. If you hold PT-sUSDat into 27 August you receive sUSDat, not dollars, and your 1.2 percent of locked nominal accrual sits on top of an instrument that has moved twenty times that in six weeks. Size for the June path repeating, not for the headline yield. The remaining route to solid is unchanged and short: put a multisig behind both proposer roles, and confirm the fund is bankruptcy remote.
Data appendix
- TVL: $176,311,041 (DeFiLlama /tvl/saturn, live pull). Flat versus $176,056,637 on 2026-07-18, down 6.5 percent from $188,601,408 on 2026-07-02. DeFiLlama chain list: Ethereum only, though both tokens and Pendle markets are live on BSC. Market caps per CoinGecko: USDat $106.83M, sUSDat $71.88M. 90d / ATH TVL: refresh.
- Audits (all four read this run, published at saturncredit.gitbook.io/saturn-docs/operations-and-governance/transparency-and-audits, which lists exactly four files and names no firms): (1) Three Sigma, "Saturn Dollar", conducted 30/12/2025 to 31/12/2025 and 09/01/2026 to 12/01/2026, 2 auditors, 1.6 person-weeks, repos saturn-dollar (ad2a465) and saturn-yield-dollar (aa762cc), scope 532 nSLOC across StakedUSDat.sol (214), WithdrawalQueue.sol (187), USDat.sol (80), TokenizedSTRC.sol (51); findings 0 critical, 2 high (2 addressed), 5 medium (4 addressed), 13 low (11 addressed), 3 none (2 addressed); 23 found, 19 addressed, 4 acknowledged (M03, L01, L02, N01); "Risk Section: no risks were identified". (2) Certora, "Saturn Dollar", work 16 to 23 January 2026, repos saturn-yield-dollar (c8c5a4c initial, a55f288 fix) and saturn-dollar (bfc6c91); 15 discovered, 15 confirmed, 11 fixed, 0 critical, 0 high, 2 medium, 8 low, 5 informational. (3) Certora, "Saturn Dollar M0 Extensions", March 2026 report on work 23 to 27 February 2026, commits c5b19e5/9c98678 and e8d167c/11582ff; summary table reads 10 discovered / 10 confirmed / 9 fixed, though its severity breakdown and detailed table each list 9 items, an internal inconsistency in the report itself; H-01 supply-cap decimals mismatch and H-02 MIN_WITHDRAWAL incompatible with USDat decimals (would permanently block all redemptions) both Fixed; I-03 Acknowledged. (4) Certora "Security Assessment & Formal Verification Final Report", same scope, work 23 February to 9 April 2026, FV commits 49240e5 and 8735152; 10 findings (the audit-3 set plus L-03, getUnvestedAmount() can exceed strcBalance after setVestingPeriod, Fixed), 9 fixed, plus 11 properties P-01 to P-11 all returning Verified, covering vault share price and solvency, withdrawal-queue burn integrity and slippage, USDat backing and virtual accounting, and access control (FV trust assumption: loop_iter = 3). Auditor note carried forward: "the repository does not include test coverage for StakedUSDat or the associated withdrawal and processing modules". Processor tolerance bound default: 20 percent. Zellic timelock report: claimed June 2026, not among the four files, no mention of Zellic on the page, refresh.
- Admin/governance: admin timelock proposer 0x610182581c93687ca03f4a8e7f124f8cec616820 and Asset Cap Manager Timelock (0x7D343D17896D2cd87A49b4fB8872298A883f78f7) proposer 0xa18f34a03788cfc566ce5ccb21b2715f072da3ad both re-checked this run, both return bytecode 0x, both plain EOAs; the admin one is the only proposer that timelock has ever had per prior constructor-args plus complete-history verification. Both timelocks minDelay 432000s (5 days), executor role open. Multisig: none found. DEFAULT_ADMIN_ROLE revoked from the EOA on USDat, sUSDat, StrcPriceOracle and WithdrawalQueueERC721 on 2026-06-10. Certora names PROCESSOR_ROLE (supplies totalStrcSold, totalUsdatReceived, executionPrice) as the protocol's most significant trust boundary.
- Custody (primary source: saturncredit.gitbook.io/saturn-docs/operations-and-governance/custody-of-digital-credit): "STRC is custodied with Clear Street, Galaxy's custodian partner." "The fund is incorporated in the British Virgin Islands as a professional fund." "The fund is administered by Securitize, a US-registered broker-dealer and transfer agent." The terms bankruptcy remote, segregated, SIPC and insurance do not appear on the page; investor protection in a fund-failure scenario: refresh.
- Oracle: StrcPriceOracle 0x5f7ecd0d045c393da6cb6c933c671ac305a871bf, Chainlink-compatible feed, 26h staleness cap against a 24h heartbeat, price bounds $20 to $150 (STRC at $85.29 is well inside). Corrected from draft: the transparency page states Saturn "is working with Accountable to provide real-time proof of reserves" and that "Chainlink will also publish a NAV oracle using the Accountable data feed", both future tense, so the NAV pipeline is announced rather than confirmed live. Currently configured feed address: refresh. Weekend-staleness behaviour across the roughly 65-hour Nasdaq closure: refresh (Certora lists it as a considered vector).
- PT exit mechanics (Pendle, expiry 2026-08-27, 39 days, all figures live this run): PT-sUSDat Ethereum market 0x91bc86899c8391b6caaf26535b9cd82efe49a189, PT 0xc689f76f90fe1762fac55983ff25ae71033a84f7, liquidity $3,274,598, implied APY 11.485 percent. BSC market 0x1017e73ce9c219164ce841a980136eb023c55387, liquidity $3,302,617, implied 13.79 percent. Sell-PT quote sized at $250,000 on Ethereum: price impact 0.026 percent, swap fee $82.17, 7.6 percent of pool, safe to execute. The quote's payout token is 0x8917f8c7feb840b5837edc7e128123baa2f289f9, a verified TransparentUpgradeableProxy (implementation 0xe46f056407ea36cfa9b98556678db2a3aa6e0e70) which is NOT the sUSDat ERC20 (0xd166337499e176bbc38a1fbd113ab144e5bd2df7); its implied unit price of about $0.875 matches sUSDat, so it is almost certainly a sUSDat-denominated wrapper, but the label is unconfirmed: refresh. sUSDat then exits via the ERC721 WithdrawalQueue: asynchronous, batched, minUsdatReceived specified by the user, requests cannot be cancelled, filled by the processor selling STRC off-chain (mechanics per Certora; 3 to 7 day wait per Saturn's Telegram via secondary coverage, refresh). USDat then redeems 1:1 for USDC for onboarded users only, per Saturn docs. Also live: PT-USDat Ethereum $8,467,038 at 7.49 percent and BSC $858,833 at 8.68 percent.
- sUSDat NAV history (CoinGecko daily, corrected from the draft): $1.0005 (04-08), $1.0077 (05-10), $1.0089 (05-13), $1.0039 (05-27), $0.9772 (06-03), $0.9376 (06-04), $0.942 (06-17), $0.898 (06-18), $0.880 (06-24), $0.822 (06-25), $0.7496 (06-26), $0.7523 (06-27), $0.7478 (06-28, daily low), $0.7598 (06-29), $0.8163 (06-30), $0.831 (07-01), $0.8763 (07-02), $0.873 (07-08), $0.8905 (07-15), $0.8787 spot. Peak to trough about 26 percent; CoinGecko ATH $1.033 (2026-05-10), ATL $0.7026; 60d change -12.17 percent, 30d -0.85 percent. USDat $0.9997 (ATL $0.9941).
- STRC underlying: dividend rate 12.00 percent annualized for semi-monthly periods with record dates on or after 2026-07-01, announced 2026-06-29, paid at $0.50 per share on the $100 stated amount (the prior 11.50 percent paid $0.48). Rate-setting policy adopted with the 29 June Digital Credit Capital Framework and keyed to STRC's monthly VWAP: below $95.00 recommends an increase of 50bp or more, $95.00 to $98.99 recommends 25bp or more, $99.00 to $100.99 no change; increases are permanent; board reviews monthly. Rate launched at 9 percent in July 2025 and has risen seven consecutive times. Price: closed $85.29 on 2026-07-17 and $85.42 on 07-16, about 15 percent below stated amount; $87.46 on 07-02; around $73 in pre-market on 2026-06-26 per CoinDesk, about 27 percent below stated amount, which is the trough figure, not a current one; 52-week range $71.25 to $100.42.
- sUSDat reserve construction: Saturn documents a dynamic reserve that "allocates between Treasuries and digital credit based on the Loan-To-Value (LTV) of our digital credit strategy" with a published allocation table by LTV band. Current STRC weight: refresh. The docs page describing how sUSDat works states its "exchange rate gradually increases" and contains no statement that it can fall.
- Tranche disambiguation: srUSDat and jrUSDat are issued by Strata, not Saturn. PT jrUSDat 23.09 percent implied on $302,832 liquidity; jrUSDat is first-loss capital under srUSDat (11.01 percent implied, $893,567 liquidity). Neither number is Saturn yield.
- Holder concentration: refresh (Etherscan tokenTopHolders returned "trying to access an API Pro endpoint" for the third consecutive review).
- Recent-news scan (2026-07-18 to 2026-07-19): no exploit, no new incident, no DeFiLlama hacks entry for Saturn, USDat, sUSDat, Strata or jrUSDat. Innora disclosure of 2026-04-14 (SAT-001 critical, SAT-002 high) still has no formal Saturn response; all four published audits predate it. No bug bounty and no insurance fund mentioned on the transparency page. Formal team response: refresh.
Maintained monthly. Methodology: DeFi Research Instruction v2.