Skip to content
PROTOCOL RESEARCH

Sky risk

Sky remains the most battle-tested stablecoin design in DeFi, and this run proved more of it on-chain than the draft did: USDS has been upgraded exactly zero times (one Upgraded event, at deployment), it carries no freeze or blacklist, burn cannot confiscate, and exactly two wards exist. But three draft claims failed verification. The governance pause delay is not a one-way improvement: it reads 48h today yet was 24h as recently as 2026-05-01 and 30h through 2024, so it oscillates by spell. The PSM exit the draft calls your escape window can be halted instantly by LITE_PSM_MOM with no delay at all. And the quoted peg band of $0.948 to $1.057 uses only USDS's short history, omitting that the same system as DAI printed $0.882 in the March 2023 USDC depeg, which is precisely the transmission path the report flags. The collateral split and holder concentration are both unsourceable while $5.5B+ sits in off-chain institutional custody and reserves sit at 55% of their own floor, which is why this process would have downgraded it; the curator kept solid on the decade-long record and the absence of any red dimension, and the gap is stated in full below.
SolidResearched Aug 5, 2026

Scorecard

strong: Audits & contractsRoster verified this run from Sky's own security docs, not carried forward: ChainSecurity, Cantina, Certora, Octane, Unvariant, FPS, Trail of Bits, PeckShield, Quantstamp, Gauntlet, ABDK and Sherlock. Immunefi bounty confirmed at $10M max, $150k min, 249 assets in scope. Proven on-chain: exactly one Upgraded event on USDS, at the deployment block, pointing to the implementation live today, so the token logic has never been swapped. No freeze or blacklist in the ABI, and burn requires allowance so wards cannot confiscate balances.
watch: Admin controlExactly two wards on USDS, enumerated from full Rely/Deny logs rather than a single lookup: the pause proxy and UsdsJoin, a 5-function immutable adapter that cannot upgrade or grant. But the 48h GSM delay is a mutable parameter, not a guarantee: it read 24h on 2026-05-01, 30h through 2024, and 48h in May 2025. A separate MOM layer (LITE_PSM_MOM, CLIPPER_MOM, LINE_MOM, OSM_MOM and others) plus the ESM act with no delay at all.
strong: OracleChronicle primary per DefiLlama's oracle breakdown, correcting the July report's Chainlink wording. Oracle Security Module hop() reads 3600 seconds on both PIP_ETH and PIP_WSTETH, confirming the one-hour delay is live and not merely documented. Two caveats stated plainly: only two of many collateral OSMs were sampled, and Chronicle was spun out of MakerDAO itself, so feed operator and protocol are not fully independent.
watch: Liquidity & exitDowngraded from the draft's green. The PSM does redeem 1:1 against USDC and peg sits at $0.9999, but LITE_PSM_MOM exposes halt(address,uint8) callable through the governance authority with no timelock, so the exit route can close instantly while the 48h delay guards only token admin. The honest depeg record is also worse than the draft's $0.948 floor: the same system as DAI traded to $0.88196 on 2023-03-10 during the USDC depeg, the exact transmission path the PSM still carries.
strong: Yield (real vs emission)sUSDS pays 3.52% funded by borrower stability fees plus Treasury and RWA income rather than emissions, with over $250M distributed since inception and a $419.08M annualized gross revenue run rate behind it. Cross-checked two independent ways: BA Labs reports sUSDS TVL of $4.7468B against an on-chain totalAssets read of $4.7484B, a 0.03% gap. SKY staking at 6.75% and stUSDS at 6.31% are separate, riskier streams.
watch: Holder concentrationStill unsourceable and now stated without false comfort (_refresh_): Etherscan top-holders is Pro-gated and Nansen returned 403. The draft's reassurance that 99.7% circulating means no overhang is a non-sequitur and has been removed, since a circulating-to-total ratio says nothing about distribution across holders. It is also incomplete: CoinGecko still shows 88,438 MKR outstanding, which at the 1:24,000 upgrade ratio is roughly 2.1B SKY of latent conversion supply.
watch: Track recordNearly a decade live, no exploit of current contracts and no Maker, Sky or USDS entry across 612 records in DefiLlama's hacks database. The incident record honestly includes two events, not one: Black Thursday 2020 ($8.32M liquidated through zero-bid auctions, 5.67M DAI of bad debt, borrowers voted not compensated) and the March 2023 USDC depeg that took DAI to $0.882. Supply has contracted from roughly $12B at the Q1 peak to about $9.84B with the peg intact.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$5.65B
30d↓1%
Audits2
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

Sky is the renamed and re-architected MakerDAO. It mints USDS, pays a real savings rate through sUSDS, and remains the most battle-tested stablecoin design in DeFi. This run proved more of that on-chain than the previous one did, and it also broke three claims the draft of this report wanted to make.

What held up, and is now proven rather than inferred: USDS has been upgraded exactly zero times. A log scan across the token's full life finds a single Upgraded event, at the deployment block, pointing to the same implementation running today. The per-address freeze people worry about is not in the code, and neither is a blacklist. Better still, burn requires an allowance when the caller is not the holder, so even a fully authorized ward cannot confiscate your balance. There are exactly two wards on the token, enumerated from the complete Rely and Deny history rather than a single spot check, and the second one is a five-function immutable adapter that cannot upgrade or grant anything.

What did not hold up: the governance pause delay is not a one-way improvement. It reads 48 hours today, but it read 24 hours on 2026-05-01, 30 hours through 2024, and 48 hours back in May 2025. It oscillates by spell. The peg-stability module the draft calls your exit window can be shut instantly by an emergency module that answers to no timelock. And the peg band quoted as historical uses only USDS's two-year life, quietly omitting that the same system, under the DAI ticker, printed $0.882 during the March 2023 USDC depeg, which is exactly the failure path this report identifies as live today.

The scar remains honest and unchanged: Black Thursday, March 2020, when a zero-bid liquidation bug left roughly 5.67M DAI of bad debt and cost some borrowers their entire collateral, about $8.32M taken at zero. The protocol recapitalized by minting and auctioning MKR. The vault owners themselves were voted not to be compensated.

Checklist

Audits and contracts. The audit roster was re-opened this run rather than carried forward, and it is broader than the draft claimed. Sky's own security documentation names twelve firms: ChainSecurity, Cantina, Certora, Octane, Unvariant, FPS, Trail of Bits, PeckShield, Quantstamp, Gauntlet, ABDK and Sherlock. ChainSecurity's engagements on the USDS token, the Chief contracts and stUSDS are individually published. Sherlock ran the public Endgame contest. No named firm is invented, and five real ones were missing from the draft. The Immunefi bounty is confirmed at a $10M maximum, a $150k minimum and 249 assets in scope. Note that DefiLlama's audit link for this protocol points at security.makerdao.com, a domain that no longer resolves, so anyone verifying through DefiLlama alone will hit a dead end.

The contract evidence is stronger than any roster. The USDS proxy's implementation slot reads 0x1923dfee706a8e78157416c29cbccfde7cdf4102, and a full log scan for Upgraded events returns exactly one, at deployment block 20663730, naming that same address. The scan was validated with a control query that correctly returned the known Rely events first, so the zero result afterward means something. The implementation ABI is the plain Maker ERC20 plus permit plus rely and deny wards. There is no freeze, no blacklist, no frozen-balance path.

Admin control. Governance is real and powerful, and the draft's reassurance needs two corrections.

First, the ward set. Checking that the pause proxy holds a ward does not establish that it holds the only one, and _authorizeUpgrade is gated on auth, meaning any ward could upgrade the token. Enumerating the complete Rely and Deny history settles it: the deployer was granted and then revoked, and exactly two wards remain. One is the Sky pause proxy. The other is UsdsJoin, the canonical Chainlog adapter, a five-function immutable contract exposing only join, exit and three getters. It can mint and burn against the CDP engine and it cannot upgrade the token or grant rights to anyone. So the conclusion the draft wanted is correct, but it needed this evidence rather than a single lookup.

Second, the delay. MCD_PAUSE.delay() reads 172800 seconds, a flat 48 hours. That is true and it is also the least durable fact in this report. Read at dated historical blocks on two independent archive providers that agree: 30 hours through 2024 and into January 2025, 48 hours in May 2025, 24 hours from October 2025 through 2026-05-01, and 48 hours only since early May 2026. This is a governance-set parameter that moves both directions, and the current value is about three months old. Treat 48 hours as today's setting, not as a property of the system.

There is also a layer the draft did not mention, and it cuts against the delay rather than for it. Alongside Protego, which can cancel a queued spell, the Chainlog carries a family of emergency modules that act with no delay whatsoever: LITE_PSM_MOM, CLIPPER_MOM, LINE_MOM, OSM_MOM, DIRECT_MOM, SPBEAM_MOM, SPLITTER_MOM and STUSDS_MOM, plus the Emergency Shutdown Module. These exist to defend the protocol quickly, which is legitimate. They also mean the 48-hour window does not cover every action that can affect you.

One point of vocabulary, since it recurs in Sky commentary: rely and deny are the Maker authorization pattern for granting and revoking admin rights. They do not lock a user's balance. Anyone reading deny as a blacklist has misread the contract.

Oracle. Chronicle is the primary feed per DefiLlama's oracle breakdown, correcting the Chainlink wording this report carried in July. Above it sits the Oracle Security Module, and hop() reads 3600 on both PIP_ETH and PIP_WSTETH, confirming the one-hour price delay is live rather than merely documented. A single bad tick cannot instantly cascade liquidations, which is the direct structural answer to 2020. Two honest limits: only two of many collateral OSMs were sampled, and Chronicle was spun out of MakerDAO itself, so the feed operator and the protocol are not independent parties.

Liquidity and exit. This is where the draft was too generous, and it is downgraded.

The mechanism works. USDS redeems 1:1 against USDC through the PSM in both directions inside a small governance-set fee window, and the peg sits at $0.9999 today. But two things qualify it.

The exit can be closed without warning. LITE_PSM_MOM exposes halt(address psm, uint8 what), callable through the governance authority with no timelock in front of it. The draft told readers the 48-hour delay was their window to redeem into USDC and leave. That is not right: the delay guards token admin, while the redemption route itself can be stopped in one transaction. In a crisis, the tool most likely to be reached for first is the one with no delay on it.

And the quoted peg history understates the risk. USDS's own band of $0.948 to $1.057 covers only October 2024 onward, because the token is that young. The system behind it is not. Under the DAI ticker it traded to $0.88196 on 2023-03-10, when USDC broke during the Silicon Valley Bank failure and the PSM transmitted the dislocation straight through, and to $1.22 on 2020-03-12 during Black Thursday. The March 2023 print is not a historical curiosity. It is a live demonstration of the exact dependency this section describes, and quoting a 5.2% floor while a 11.8% one exists in the same system's record would have been misleading.

Yield: real versus emission. The Sky Savings Rate is 3.52%, paid out of borrower stability fees plus Treasury and real-world-asset income, not emissions. Sky reports a $419.08M annualized gross revenue run rate and cumulative sUSDS distributions above $250M since inception. The TVL behind it cross-checks two independent ways: BA Labs reports $4.7468B while an on-chain totalAssets read returns $4.7484B, a 0.03% difference. Two separate and riskier streams should not be blended into this: SKY staking at 6.75%, and stUSDS at 6.31%, which Sky's own documentation describes as risk capital funding SKY-collateralized borrowing.

Holder concentration. Still not published, because it still cannot be sourced honestly. Etherscan's top-holder endpoint is Pro-gated and the Nansen holder call returned 403 this run.

The draft tried to soften that gap by noting 23.39B SKY circulating against 23.46B total and concluding there is no large overhang. That inference has been removed, for two reasons. A circulating-to-total ratio describes float, not distribution, so it says nothing about whether ten addresses can carry an executive vote. And it is not even complete on its own terms: CoinGecko still shows 88,438 MKR outstanding, which at the 1:24,000 upgrade ratio corresponds to roughly 2.1B SKY of latent conversion supply sitting outside that reconciliation. Token-weighted voting over a protocol that can upgrade its own stablecoin is a real surface, and we cannot currently size who holds it.

Track record. Nearly a decade live across every cycle, no exploit of the current Sky contracts, and no Maker, Sky or USDS entry anywhere in the 612 records of DefiLlama's hacks database. The only near-matches there, DAO Maker and Skyward Finance, are unrelated protocols.

The honest incident record contains two events rather than one. Black Thursday 2020 is the famous one. The March 2023 USDC depeg is the one more relevant to how the system is built today, because nothing structural has changed about PSM transmission since.

Set against that, the balance sheet is in a softer patch. USDS supply has fallen from roughly $12B at the Q1 peak to $11.14B in May, $10.04B at June month-end and about $9.84B now, which Sky attributes to a market-wide stablecoin contraction rather than anything USDS-specific. The peg did not move through any of it.

Worst case

Three shapes, in rough order of how much they should worry you.

A backing-quality event is the most plausible. Over $5.5B is deployed through Sky Agents into products run by Janus Henderson ($1.24B), BlackRock's BUIDL ($713M), Anchorage ($260M), PayPal ($236M), Securitize ($102M) and Galaxy ($27M). If USDC dislocates or an RWA counterparty defaults, USDS inherits it, and the PSM transmits rather than absorbs. March 2023 is the worked example. The cushion is thinner than the headline collateral figure suggests: Sky Reserves closed June at $82.5M, which is 55% of the protocol's own $150M floor target and under 1% of USDS supply. It is being rebuilt deliberately, with $33.7M added since March, but it is not at target.

Governance capture is second, and the mitigation is weaker than previously described. A captured executive vote could push a malicious spell or upgrade a freeze into a token that does not have one today. The delay in front of that is 48 hours right now, was 24 hours three months ago, and is itself changeable by spell. Meanwhile the redemption route you would use to leave can be halted immediately by an emergency module. Plan around the possibility that your exit is narrower and faster-closing than the headline number implies.

A liquidation-engine failure in a violent crash is the tail. The one-hour OSM delay and the rebuilt Liquidations 2.0 engine are the direct answers to 2020, and they have held through every cycle since.

There is no retail insurance fund. The final backstop is fresh SKY minting, which dilutes holders.

Bottom line

Solid, and it is a curator's call made over this process's own default. Sky is not fragile. The code is unupgraded and independently audited by twelve firms, the token cannot freeze or confiscate you, the yield is real and funded by revenue Sky publishes, and nearly a decade has passed without an exploit of the core system.

What the rating does not settle is what still cannot be checked. The exact collateral split could not be sourced this run or last, while over $5.5B sits with off-chain institutional custodians whose holdings cannot be confirmed on-chain. Holder concentration cannot be sourced at all, in a system where token-weighted votes can upgrade the stablecoin. Reserves are at 55% of a floor Sky set for itself. When the backing of a stablecoin is unverifiable in that specific way, this process defaults to caution. On 2026-08-05 the curator overrode that default and kept solid, on three grounds: no dimension on the scorecard is red, nearly ten years have passed with no exploit of the core system, and the verification gap is about our access to the data rather than about anything Sky has done. Read the rating as solid with a declared blind spot, not as solid because the blind spot is closed. Three things would flip it: a collateral split that gets sourced and fails, a PSM halt actually used, or a first exploit of the current contracts.

Two things the draft treated as improvements are not. The pause delay did not ratchet up, it oscillated and happens to be high today. The exit window is not 48 hours, because the redemption route has no timelock in front of it at all.

Size it as a core-stable position if you hold it, prefer sUSDS over the SKY staking and stUSDS products, watch the collateral mix and the reserve rebuild, and do not assume the 48-hour delay is either permanent or sufficient.

Data appendix

  • TVL: $5,662,401,688 (DeFiLlama "sky-lending", 2026-08-05), up about 3.5% from ~$5.47B on 2026-07-01. Counted collateral rose while USDS supply fell.
  • Supply and market cap: USDS $9.837B market cap, 9.8397B circulating, price $0.999863 (CoinGecko). SKY market cap $1.326B, 23.394B circulating of 23.463B total, price $0.056694. Ethereum-mainnet USDS totalSupply reads 6,681,784,013 on-chain; the remainder is bridged to other chains. TVL and stablecoin supply are different metrics, and the gap between $5.66B and $9.84B is expected: TVL counts collateral in Sky's own vaults and PSM, not every USDS in existence.
  • DAI has not been retired. DAI still trades with a $4.599B market cap alongside USDS. USDS is a parallel token with 1:1 conversion through UsdsJoin, not a straight rename, which is why the system's price history spans both tickers.
  • Peg band, corrected: USDS's own range is $0.948265 (2024-10-03) to $1.057 (2024-10-28). The system's range under the DAI ticker is $0.88196 (2023-03-10, USDC depeg) to $1.22 (2020-03-12, Black Thursday), per CoinGecko. The July report's $1.15 high dated 2026-04-02 does not appear in CoinGecko today and is withdrawn.
  • Audits, verified this run: ChainSecurity, Cantina, Certora, Octane, Unvariant, FPS, Trail of Bits, PeckShield, Quantstamp, Gauntlet, ABDK, Sherlock (Endgame public contest), per Sky's own security documentation. Immunefi bounty: $10M maximum, $150k minimum, 249 assets in scope. DefiLlama's audit link (security.makerdao.com) no longer resolves.
  • Contracts verified on-chain (2026-08-05): USDS proxy 0xdC035D45d973E3EC169d2276DDab16f1e407384F; EIP-1967 implementation slot reads 0x1923dfee706a8e78157416c29cbccfde7cdf4102. A full Upgraded log scan returns exactly one event, at deployment block 20663730, naming that implementation, so USDS has never been upgraded. The scan was validated against a control query that first returned the known Rely events. Implementation ABI: allowance, approve, balanceOf, burn, decimals, deny, getImplementation, initialize, mint, name, nonces, permit, proxiableUUID, rely, symbol, totalSupply, transfer, transferFrom, upgradeToAndCall, version, wards, plus DOMAIN_SEPARATOR, PERMIT_TYPEHASH and UPGRADE_INTERFACE_VERSION. No freeze, blacklist or frozen function. Source confirms burn(address,uint256) requires an allowance when caller is not the holder, so wards cannot confiscate balances; mint and _authorizeUpgrade are ward-gated.
  • Ward set, fully enumerated: all Rely and Deny events on the USDS proxy from deployment to block 25688446. Deployer 0x4ec216...cfb8 relied at block 20663730 and denied at 20663732. Current wards are exactly two: MCD_PAUSE_PROXY 0xBE8E3e3618f7474F8cB1d074A26afFef007E98FB (verified wards() = 1) and USDS_JOIN 0x3c0f895007ca717aa01c8693e59df1e8c3777feb (verified wards() = 1), the latter being UsdsJoin, an immutable 1165-byte adapter whose only functions are join, exit, dai, usds and vat, with no upgrade or grant capability.
  • Governance delay, with history: MCD_PAUSE (0xbE286431454714F511008713973d3B053A2d38f3, address confirmed against the on-chain Chainlog) delay() = 172800s = 48h today. Read at dated historical blocks on two independent archive providers in agreement: 30h at 2024-08-28 and 2025-01, 48h at 2025-05-17, 24h at 2025-10-03 and 2026-05-01, 48h from 2026-05-15 onward. The parameter oscillates and the current value dates to early May 2026.
  • No-delay emergency layer: MCD_PROTEGO 0x5C9c3cb0490938c9234ABddeD37a191576ED8624 (spell cancellation) and MCD_ESM 0x09e05fF6142F2f9de8B6B65855A1d56B6cfE4c58 are both live in the Chainlog. LITE_PSM_MOM 0x467b32b0407Ad764f56304420Cddaa563bDab425 exposes halt(address psm, uint8 what) gated only by authority/owner, with no timelock, meaning PSM redemption can be stopped immediately. Also present: CLIPPER_MOM, LINE_MOM, OSM_MOM, DIRECT_MOM, SPBEAM_MOM, SPLITTER_MOM, STUSDS_MOM, STARKNET_ESCROW_MOM.
  • Oracle: Chronicle primary (DefiLlama oracle breakdown). OSM hop() = 3600 seconds on PIP_ETH 0x81FE72B5A8d1A857d176C3E7d5Bd2679A9B85763 and PIP_WSTETH 0xFe7a2aC0B945f12089aEEB6eCebf4F384D9f043F, both confirmed against the Chainlog. One OSM per collateral; only these two were sampled.
  • Yield: Sky Savings Rate 3.52% APY, sUSDS TVL $4,746,777,324 (BA Labs, the provider behind financial.skyeco.com), cross-checked against an on-chain totalAssets read of $4,748,371,494 on sUSDS 0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD, a 0.03% difference. SKY staking 6.752%; stUSDS 6.31% with $217.1M TVL across 670 depositors. Sky ecosystem TVL $18.12B; 5,886 SSR depositors.
  • Protocol financials (Sky Frontier Foundation, June 2026 update, data as of 2026-06-30): protocol collateral $12.32B at Q2 end, up 45.2% year on year; gross revenue run rate $419.08M annualized; Q2 gross revenue $107.35M and Q2 net surplus $33.29M (the draft's $29.87M was incorrect); Sky Reserves $82.5M, or 55% of the $150M target floor, with $33.7M accumulated since March; June sUSDS accrual $17.49M against cumulative distributions above $250M.
  • Off-chain and institutional exposure: over $5.5B via Sky Agents into Janus Henderson ($1.24B), BlackRock/BUIDL ($713M), Anchorage ($260M), PayPal ($236M), Securitize ($102M) and Galaxy ($27M). Sky notes these describe protocol activity, not a direct sUSDS holder claim on any specific instrument.
  • Backing mix by percentage: refresh. financial.skyeco.com is client-rendered and no public JSON endpoint for the collateral split was found. The July report's approximations (~38% USDC in PSM, ~22% RWA, ~25% crypto-collateralized) are deliberately not reprinted, since they could not be re-verified.
  • Holder concentration: refresh. Etherscan top-holders is Pro-gated and the Nansen holder endpoint returned 403. Note that 88,438 MKR remains outstanding (CoinGecko, circulating marked 0), roughly 2.1B SKY of latent conversion supply at the 1:24,000 ratio.
  • Incident scan: DefiLlama's hacks database contains 612 records and no Maker, Sky or USDS entry; the near-name matches, DAO Maker and Skyward Finance, are unrelated protocols. Historical: Black Thursday, 2020-03-12, $8.32M of ETH taken through zero-bid auctions amid mempool congestion and a 43% ETH drawdown, leaving 5.67M DAI of uncollateralized system debt covered by an MKR debt auction; affected vault owners were subsequently voted not to be compensated. March 2023: DAI to $0.88196 during the USDC depeg.

Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols