Skip to content
PROTOCOL RESEARCH

USD.ai risk

PT-sUSDai on Arbitrum pays about 9.9% implied into 15 Oct 2026 and an $80k PT sale moves the Pendle price only 0.05%, but the draft's two central claims were wrong on the facts: the upgrade key is identifiable (a 48-hour OpenZeppelin timelock behind a 3-of-3 Safe, verified on-chain, and it executed a live implementation swap on 14 Jul 2026), and the protocol is not quiet, with TVL down about 71% from its Nov 2025 peak of $702M to $206.5M. It stays caution, sized as credit, because the money-moving roles sit outside that timelock on three shared signer keys and the collateral is off-chain.
CautionResearched Jul 20, 2026

Scorecard

watch: Audits & contractsFirms verified real and dated: Cantina review 26 Apr to 7 May 2025 (report 12 May 2025; 0 critical, 0 high, 1 medium, 8 low, 10 informational, confirmed on Cantina's public portfolio page), ktl x4 (14 May 2025, 29 Oct 2025, 27 Nov 2025, 12 Mar 2026), Quantstamp 3 Feb 2026, plus a live Cantina bounty. sUSDai is an OZ TransparentUpgradeableProxy carrying twelve Upgraded events, the latest executed 14 Jul 2026, so the audited bytecode is not what is running today.
weak: Admin controlUpgrade path is now fully verified and better than reported: ProxyAdmin owned by an OZ TimelockController (0x0eea1ee0) with a 48-hour minDelay, proposer/canceller/executor a 3-of-3 Safe v1.4.1, delay honoured on all 8 scheduled operations. But the money roles bypass it: STRATEGY_ADMIN_ROLE (serviceRedemptions, position managers) is a 3-of-4 Safe, DEFAULT_ADMIN_ROLE a 3-of-3, PAUSE_ADMIN a 2-of-3, all untimelocked and all drawn from the same three signer EOAs, over collateral custodied off-chain in Delaware SPVs.
watch: OracleChainlink prices loan-currency FX only; GPU collateral is not oracle-priced and loans mark down only on default, so NAV is issuer-computed. Read on-chain this run: depositSharePrice 1.099064, redemptionSharePrice 1.095327 (the draft's 1.089 to 1.087 decline is wrong; the price rose). sUSDai NAV computes to about $196.6M from supply times redemption price.
watch: Liquidity & exitAn $80k PT sale costs 0.051% impact and a $47.45 fee on the Oct-2026 market ($12.69M liquidity), but the quote settles in SY-sUSDai, not USDC; the dollar leg runs on through about $35.8M of Fluid sUSDai depth. Protocol-native exit is still a 30-day FIFO epoch queue, and USDai spot reserve across all listed Arbitrum pools is only about $623k.
strong: Yield (real vs emission)Real: GPU-loan interest plus T-bill-style yield on idle reserves, about $10M paid in 2026 at a 7.0% YTD realized average. DeFiLlama independently reports $202,975,465 borrowed against the issuer's '$202M deployed', so the loan book is corroborated. The PT's 9.86% is a market-priced 265bp premium over the 7.21% underlying, not an emission.
watch: Holder concentrationTop-N sUSDai holder distribution still unverified (explorer holder pages 403 on both routes). The concentration that matters is the book: one $98.1M three-year facility to Duos Edge AI (subsidiary of NASDAQ: DUOT, 2,304 NVIDIA B300s, announced 5 Jun 2026, managed by Hydra Host) is about 49% of $202M deployed across 13 loans, and its tenor runs well past the Oct 2026 PT expiry.
watch: Track recordAbout ten months live, no exploit (0 matches across DeFiLlama's 588 hack entries), no depeg, no reported default or missed redemption window, and paused() reads false. But TVL is down about 71% from a $701,980,435 peak on 22 Nov 2025 and about 27% in 90 days, sliding every month since January. No incident, but not a quiet book either.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$174.7M
30d↑8%
Audits2
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

This is a refresh of our 9 July caution, aimed at one question: what happens if you put $30k to $80k into PT-sUSDai on Arbitrum. Two things we could not see last time are now visible, and they cut in opposite directions.

The good one: the upgrade key is no longer a mystery. Both the sUSDai and USDai proxies are administered by an OpenZeppelin TimelockController at 0x0eea1ee0 with a 48-hour minimum delay, proposed and executed by a 3-of-3 Gnosis Safe, and every one of the eight operations it has ever scheduled used the full 48 hours. That is real governance, and our previous report was wrong to grade it as unknowable.

The bad one: this protocol is not sitting still. That same timelock executed a live implementation swap on the sUSDai vault on 14 July 2026, five days after our last report and five days before this one. And TVL has fallen from a peak of $701,980,435 on 22 November 2025 to $206,514,192 today, about 71% off the top, down every single month since January. Nothing broke. No exploit, no depeg, no failed redemption window. But a report that says "nothing has happened" while a book shrinks by two thirds is not telling you the truth.

The exit mechanics are genuinely fine at your size. What you are buying is not.

Checklist

Audits & contracts. All three firms check out, and we verified the dates independently rather than carrying them forward. Cantina reviewed 26 April to 7 May 2025 and published on 12 May; its public portfolio page confirms zero critical, zero high, one medium, eight low, ten informational and one gas finding, twenty in total. ktl filed four reports, dated 14 May 2025, 29 October 2025, 27 November 2025 and 12 March 2026, which is a wider span than we credited last time. Quantstamp reported 3 February 2026. A live Cantina bounty sits on top. No firm here is invented, and the coverage is respectable for a protocol this size. The caveat is upgradeability, and it is not theoretical: the sUSDai proxy carries twelve Upgraded events, one at deployment and eleven since, the most recent on 14 July 2026 moving the implementation to 0x23783ee8. Whatever those audit PDFs reviewed, it is not exactly what is holding your money today.

Admin control. This is the section that changed most, and it deserves the detail. The upgrade path resolves cleanly. The sUSDai proxy's ProxyAdmin (0x0b3296b6) and the USDai proxy's ProxyAdmin (0x2ddf39c7) are both owned by the TimelockController at 0x0eea1ee0, whose getMinDelay() returns 172,800 seconds, exactly 48 hours. Ownership moved from a bare Safe to that timelock on 7 April 2026, which is a deliberate hardening step. PROPOSER, CANCELLER and EXECUTOR sit with Safe 0x783b08aa, a 3-of-3 on Safe v1.4.1, with a second executor Safe added in May. The July upgrade was scheduled on 9 July at 16:37 UTC and executed on 14 July at 00:29 UTC, roughly four and a half days, comfortably clear of the minimum. The process works and is being used as designed.

So why is this still red. Because the timelock guards the code, not the cash. Three roles on the vault sit entirely outside it. STRATEGY_ADMIN_ROLE, which manages position managers and calls serviceRedemptions() to clear the queue, is held by a 3-of-4 Safe. DEFAULT_ADMIN_ROLE, which can grant or revoke every other role instantly, is a 3-of-3 Safe. PAUSE_ADMIN_ROLE, which can freeze the vault, is a 2-of-3, the lowest bar on the board. None of the three has a delay. And every one of these Safes, including the timelock's own proposer, is signed by the same three externally owned accounts. There is no signer diversity anywhere in the structure: compromise those three keys and the 48-hour timelock is the only thing standing, and it does not stand in front of the money-moving role. Add off-chain custody of the collateral in Delaware bankruptcy-remote SPVs with Wilmington Trust escrow and an enforcement Agent, which no on-chain check can ever verify, and the honest grade is still red. It is red for a better reason than last month, which is worth something, but the fund-loss surface has not moved.

One quiet change: BRIDGE_ADMIN_ROLE was revoked on 29 April 2026 and never regranted, and DeFiLlama now attributes 100% of TVL to Arbitrum. The Ethereum, Base and Plasma deployments our July report mentioned look dormant. Treat this as an Arbitrum-only protocol.

Oracle. Unchanged in structure, corrected in numbers. ChainlinkPriceOracle covers loan-currency FX back into USDai and nothing else. GPU hardware is not oracle-priced, loans are carried at outstanding balance and marked down only on default, so NAV is smooth right up until it is not. We read both share prices directly from the contract this run rather than from the docs: depositSharePrice() returns 1.099064 and redemptionSharePrice() returns 1.095327. The draft's claim that published fair value slipped from 1.089 to 1.087 is wrong on both the level and the direction; the price is higher than either figure and rising. The practical consequence for a PT holder is that one PT settles into about 0.913 sUSDai, not 0.92. Multiply the 179,521,449 sUSDai in supply by the redemption price and the vault's own NAV comes to roughly $196.6M, which is a number you can check yourself without trusting anyone.

Liquidity & exit. The depth is real and we re-quoted it live. Selling $80k of PT on the October 2026 market (0xcbf6...87d8, $12.69M liquidity) costs 0.051% in price impact and $47.45 in fees, leaving you at 0.6% of the pool, and Pendle flags it safe to execute. Use that market, not the February 2027 one, which holds $2.08M and would make the same order roughly 4% of the pool.

But correct one thing the draft got wrong about its own plumbing: that quote does not pay you USDC. It pays SY-sUSDai (0x30cc...2f62). Getting to dollars means unwrapping to sUSDai and then selling that, which runs through Fluid's sUSDai/USDC pool at $18.10M and sUSDai/USDT at $17.72M, about $35.8M of Fluid depth with $1.81M more on Curve. At $30k to $80k that leg clears the same day and the total cost stays small, so the headline answer of "minutes to USDC" survives. It is just two legs, not one, and the second leg is the one that would gap in a stress event.

Hold to expiry and you get the same asset, not dollars: on 15 October each PT becomes one USDai of accounting value, about 0.913 sUSDai, and you are back on the Fluid path. The protocol's own exit remains a FIFO queue serviced at fixed 30-day windows, zero to 30 days depending on when you join, with a limited instant-liquidity buffer and no early loan liquidation to fund you. The thinnest part of the whole stack is USDai spot: every listed Arbitrum pool together holds about $623k of reserve, not the $723k the draft printed, even though the Uniswap V4 0.001% pool turned over $3.6M in a day. Incentivized depth is doing the work here, and incentivized depth leaves.

Yield: real vs emission. Real income, correctly priced as risky, and now independently corroborated. USD.AI reports about $10M of yield paid in 2026 at a 7.0% YTD average, ARR of $14.3M YTD against $1.1M in 2025, and projects 12.4% at full deployment. DeFiLlama separately reports $202,975,465 of borrows against the issuer's "$202M deployed", which is close enough to treat the loan book's headline size as verified rather than asserted. The PT's 9.86% implied sits 265 basis points above the 7.21% underlying APY. That gap is the market charging you for credit risk on an illiquid book, for a redemption queue that stops arbitrageurs from cheaply closing any PT-to-NAV gap, and for a young protocol. Read it as compensation, not edge. We did not benchmark comparable-tenor mainnet stablecoin PTs this run.

Holder concentration. Token-level distribution is still unverified; explorer holder pages returned 403 on both routes again, so the roughly 3,000 Arbitrum holders reported in early June 2026 remains the last datapoint. Ignore it. The concentration that should drive your sizing is on the asset side: 13 active loans, $202M deployed, $283M of collateral, average loan $15.8M, and a single $98.1M facility to Duos Edge AI, a subsidiary of the NASDAQ-listed Duos Technologies Group, closed on 5 June 2026 for 2,304 NVIDIA B300 GPUs managed by Hydra Host. That is about 49% of deployed capital in one borrower. Two details the draft missed and you should not: the facility runs three years, so it does not amortize to completion anywhere near your October 2026 expiry, and the borrower's parent is public, which at least means its distress would be visible in filings before it reached the vault's NAV.

Track record. About ten months of public operation. We found no exploit, and DeFiLlama's hack registry has zero matches across 588 entries. No lasting depeg, no reported default or delinquency, no missed or partially filled redemption window we could find, and paused() reads false right now. That is a clean incident record and we are not going to manufacture one.

What we will not do is call the book quiet. TVL peaked at $701,980,435 on 22 November 2025. It was $684M in January, $641M in February, $467M in March, $311M in April, $250M in May, $293M in June and about $196M to $206M in July. That is roughly 71% off the peak and 27% down in 90 days, declining in seven of the last eight months. None of that is evidence of a failure; loans amortize, promotional yield ends, capital rotates, and a shrinking book that pays everyone on time is a functioning book. But it is the single most important fact about this protocol's last six months, and any report that omits it while asserting nothing has happened is misleading you. The first borrowers are only now completing full payment cycles, so there is still no seasoned repayment history underneath the shrinkage.

Worst case

Duos Edge AI, or another borrower of similar weight, stops paying. NAV writes down only at that moment, so the first honest price is a step down rather than a drift, and because that facility runs three years it is still fully outstanding at your October expiry. You hold PT, which fixes your yield but not the vault's NAV, so the loss reaches you. Selling before expiry means finding $12.7M of Pendle depth and then $35.8M of Fluid depth still there, and a credit event is precisely when incentivized liquidity stops being reliable on both legs at once. After expiry you hold sUSDai and the protocol-native exit is a 30-day queue that will not liquidate loans early to pay you, with recovery depending on an off-chain Agent repossessing and reselling hardware and on the insurance and Barkr reinsurance layers actually paying.

The admin tail is now sharper, not vaguer. The 48-hour timelock protects the code, and it works. It does not protect the capital: STRATEGY_ADMIN_ROLE can move funds to position managers and service redemptions with no delay at all, DEFAULT_ADMIN_ROLE can regrant every role instantly, and all of it resolves to three signing keys that also control the timelock's proposer Safe. There is no independent party anywhere in that set who could refuse. A 2-of-3 Safe can pause the vault outright while you are queued. Mitigation is size and tenor: take the October market over February 2027, stay small enough that you are never the print that moves the pool, and do not treat 9.9% as a savings rate.

Bottom line

Caution, and a genuinely better-informed one than in July, in both directions. The exit works: minutes to USDC via Pendle and Fluid at $30k to $80k, with the 30-day queue as a fallback you should never need at this size. The governance is better than we said: a real 48-hour timelock, consistently used, behind a 3-of-3 Safe. But the thing underneath has not improved and has visibly shrunk. You are lending into 13 private GPU loans marked by the issuer, half of them one three-year borrower, through contracts whose implementation was swapped five days ago, guarded by three keys that hold every role that matters, in a book that has lost about 71% of its assets since November. That is credit exposure with a good liquidity veneer, and the veneer is the part that disappears first. Size it as credit.

Data appendix

  • TVL: $206,514,192 (DeFiLlama, slug usd-ai, 2026-07-19). All-time high $701,980,435 on 2025-11-22, so current TVL is about 71% below peak. Ninety days ago (2026-04-20) $284,021,568, a 27% decline. Monthly first-of-month prints: Jan $684M, Feb $641M, Mar $467M, Apr $311M, May $250M, Jun $293M, Jul $196M. DeFiLlama also reports $202,975,465 borrowed, corroborating the issuer's "$202M deployed". The issuer's "$398M TVL" headline in its YTD report matches DeFiLlama's level around late March 2026, so read it as a peak-during-period figure and not a current one.
  • Vault state (read on-chain, sUSDai 0x0B2b2B2076d95dda7817e785989fE353fe955ef9, Arbitrum): depositSharePrice() 1.099064, redemptionSharePrice() 1.095327, totalSupply() 179,521,448.58 sUSDai, paused() false. Supply times redemption price gives NAV of about $196.6M. A PT settling at one USDai of accounting value is worth about 0.913 sUSDai.
  • Upgrade authority (verified on-chain, corrects the prior two reports): sUSDai ProxyAdmin 0x0b3296b6f50611b28d466a6d5a49754dad4d8d9f and USDai ProxyAdmin 0x2ddf39c731377adcfa7f2a056ac60a8a81aadc3c are both owned by TimelockController 0x0eea1ee08611ff4a4e83bfe3916712751995639b, getMinDelay() = 172,800 seconds (48h). Ownership transferred from Safe 0x783b08aa to the timelock on 2026-04-07. PROPOSER, CANCELLER and EXECUTOR held by Safe 0x783b08aa21de056717173f72e04be0e91328a07b, threshold 3 of 3 owners, Safe v1.4.1; a second EXECUTOR (Safe 0x5f0bc72f, 3-of-3) added 2026-05. All 8 CallScheduled events used delay 172,800.
  • Live upgrade since the last report: sUSDai implementation changed to 0x23783ee86db1a05dfc6dc2f042606a92c97a374c, scheduled 2026-07-09 16:37 UTC and executed 2026-07-14 00:29 UTC (about 4.5 days). Previous implementation 0xb17092da8a111ff3097d8952bec5358107800653, executed 2026-06-26. Twelve Upgraded events total on the proxy.
  • Vault roles (not behind the timelock): STRATEGY_ADMIN_ROLE to Safe 0xe7e53f940f8242fec57cbe88054463d4944b3670, threshold 3 of 4. DEFAULT_ADMIN_ROLE to Safe 0x5f0bc72fb5952b2f3f2e11404398ed507b25841f, 3 of 3. PAUSE_ADMIN_ROLE to Safe 0x3a32e198cafeb0fcd061ac0c9d8a2256bccab872, 2 of 3. BRIDGE_ADMIN_ROLE revoked 2026-04-29, not regranted. All these Safes share the same three signer EOAs (0xe982b3f6, 0x986868c9, 0xd1affe27), with one extra signer on the strategy Safe.
  • Pendle PT-sUSDai (primary target): market 0xcbf629c8d396b1261f81f55175afa010e94787d8, Arbitrum, expiry 2026-10-15 (88 days), liquidity $12,688,965, implied APY 9.856%, underlying APY 7.209%, PT 0xb459db106f645d698e74027eef6019a26a0675cc. Second market 0xf86119a39f8654f38acbbd5488bd83f3f51983c8, expiry 2027-02-25, liquidity $2,077,587, implied 9.635%. A separate PT-USDai Oct-2026 market (0xa8a0dea4) holds $50.4M at 6.60% implied, if you want the non-yield-bearing leg.
  • PT execution at size: $80k sell PT quotes -0.051% price impact, $47.45 fee, 0.6% of pool, flagged safe to execute. Output token is SY-sUSDai 0x30ccf4bbee313fcd19f3e295b3ba2920a24e2f62 (72,764.77 units), not USDC; the dollar leg is a separate hop.
  • SY wrapper (correction): SY-sUSDai has exactly one Upgraded event, at deployment on 2025-08-18, to implementation 0x9fFacbC8fcdebfc878efdbc2E2884eE1e038AC92, and has never been upgraded since. Its ERC-1967 admin slot holds 0x...01, so it is not a ProxyAdmin-managed transparent proxy; its owner() is 0x2ad631f72fb16d91c4953a7f4260a97c2fe2f31e, a Pendle-side contract, not USD.AI. The prior framing of this as a second USD.AI-controlled upgrade surface was wrong.
  • sUSDai exit depth (Arbitrum, GeckoTerminal): Fluid sUSDai/USDC $18,098,835 reserve / $287,553 24h volume; Fluid sUSDai/USDT $17,720,101 / $117,099; Curve sUSDai/USDC $1,813,650 / $104,053; Uniswap V4 0.01% $262,687. Total across listed pools about $37.9M. sUSDai spot about $1.097 to $1.098, consistent with the on-chain deposit share price.
  • USDai exit depth (Arbitrum): total reserve across all 20 listed pools $622,953 (not the $723k previously printed). Deepest single pool is a Fluid USDai/USDC at $108,895; the Uniswap V4 0.001% pool holds $65,603 but did $3,598,598 of 24h volume. USDai spot $0.9988 to $1.0007.
  • Redemption terms: ERC-7540 asynchronous redemption, FIFO queue collected continuously and processed at fixed 30-day windows, serviced by STRATEGY_ADMIN_ROLE via serviceRedemptions(); wait of 0 to 30 days depending on submission timing; limited instant-liquidity buffer; no early loan liquidation; queues may extend across multiple epochs during high utilization. Explicit redemption fee schedule and buffer size: refresh. Whether USDai withdraw() to PYUSD is open or KYC-gated is stated inconsistently across the technical overview and the FAQ: refresh.
  • Loan book: 13 active loans, $202M deployed, $283M total collateral, average loan $15.8M, largest $98.1M to Duos Edge AI Inc (subsidiary of Duos Technologies Group, NASDAQ: DUOT), announced 2026-06-05, a three-year non-recourse facility for 2,304 NVIDIA B300 GPUs managed by Hydra Host. $205M closed against 26 signed term sheets worth $817M. Loans run 70 to 80 percent LTV with a DSRA and a Barkr residual-value warranty costing about 150bp/yr netted from yield. Default and delinquency statistics are not published: refresh.
  • Yield: 7.0% average realized YTD 2026, about $10M paid, 12.4% projected at full deployment; ARR $14.3M YTD versus $1.1M in 2025, Q2 annualized $30M. (usd.ai/insights Lighthouse YTD report)
  • Audits: Cantina review 26 Apr to 7 May 2025, report 12 May 2025, 0 critical / 0 high / 1 medium / 8 low / 10 informational / 1 gas (verified on Cantina's public portfolio entry); ktl reports dated 14 May 2025, 29 Oct 2025, 27 Nov 2025, 12 Mar 2026; Quantstamp 3 Feb 2026; live Cantina bounty. Seven files are posted on the docs audits page. No new audit found covering the July 2026 implementation.
  • Incident record: zero matches for USD.ai / USDai across DeFiLlama's 588-entry hack registry. X search 2026-06-01 to 2026-07-19 returned no incident, markdown, default, queue delay, depeg or admin-change chatter; note that the same search also failed to surface the documented 71% TVL drawdown, so treat it as low-information rather than as an all-clear.
  • Holder concentration: top-N sUSDai holders refresh (403 on both routes, third consecutive failure). Prior datapoint: about 3,000 Arbitrum holders, early June 2026. Borrower concentration: one facility about 49% of deployed capital.

Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols