USDe Risk Audit / Control and contracts
Who can change issuance, access and the exit route?
Separate the policy decision, the operator’s permission and the external asset release. A signature count, a delay or an audit cannot establish all three.
A fixed token contract does not make the issuance policy immutable. USDe’s owner can replace its minter; the current Mint V2 route supplies a separate policy layer. A controller delay, a Safe threshold and a redemption cap each constrain something specific. None alone establishes that every harmful action is delayed or every eligible exit is funded. Control assessment.
Policy authority is not execution or payment
The 22 September documentation assessment adds governance, acceptance, liquidity-policy and published-audit evidence to the earlier control observations. The broader control assessment remains partial: there is no fresh deployed permission inventory, Mint/controller build match, Base transition test or remote-security verification. Read the full documentary chapter.
Governance is described as delegated to expert committees, with Foundation oversight and implementation through relevant parties. The committee page describes three members, six-month terms and seven days of proposal deliberation. Those are organizational rules, not all-actions contract locks or a right for USDe holders to compel payment. Governance roles and process evidence.
The 21 August 2026 Foundation announcement names Kairos, OAK and Blockworks subject to agreement signing, after screening the election results. It is a later documentary reference than the served roster—not verification that agreements were executed, every mandate became effective or committee members control the contract keys. The Foundation’s stated exclusion of K3 for structural conflicts illustrates both a conflict-control safeguard and an eligibility decision. Announcement, screening and limits.
Keep four approvals separate: an investment can be eligible backing without being a direct Mint V2 payout token; an approved custody destination does not establish segregated legal title or fast release; an admitted benefactor or beneficiary does not guarantee order acceptance. External borrowers and fund administrators retain their own release conditions. The permission-to-payment chain.
The documentation does not supply one universal control clock
The served trust-assumptions page describes seven signatures and seven-day core delays and gives inconsistent gatekeeper descriptions. The 18 September Ethereum record instead contains a five-signature Safe, a one-day controller minimum and selected immediate paths. These are different evidence types and dates. No September 22 deployment-specific reconciliation was obtained. Exact conflict and source boundaries.
Four clocks—not one guaranteed escape window
A proposal’s seven-day deliberation, contract scheduling, operational intervention and a holder’s payment deadline need not start together. A nominal delay does not guarantee that a borrower can first obtain USDC, release collateral, complete staking withdrawal and reach a funded exit. It would also be wrong to claim every action is immediate: the protection remains action-specific.
The new source evidence does not choose between the competing numerical descriptions or invent a change date. The constructor accepts a delay parameter, and the source permits different action routes. Even equal one-day notice/cooldown labels do not establish a complete exit window. The necessary-condition comparison.
One controller, more than one execution path
The observed chain of authority—and its boundary
| Component | Observed link or setting | What it does not establish |
|---|---|---|
| USDe token | Owner 0xe8dc0fab349ea169283c48ccfd09d797e6db7c94; minter 0xe3490297a08d6fc8da46edb7b6142e4f461b62d3. | A token-level reconciliation of reserves or immutable Mint V2 constraints. |
| Mint V2 | The same controller is its owner / sampled default administrator. | A complete role roster, all custody routes or signed-order invariants. |
| Owner-controller | Minimum ordinary delay of 86,400 seconds; separate whitelisted execution. | A universal 24-hour warning period. |
| Ethereum Safe | Threshold 5; proposer, executor and whitelisted-executor membership checked at block 26,005,198. | Five independent people, a fresh full owner enumeration or complete module / guard analysis. |
| sUSDe | Same owner-controller; sampled cooldown 86,400 seconds. | A one-day exit to bank dollars or the same restrictions as ordinary USDe. |
Safe: 0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862. Full core identities and dated observations.
Immediate authority can protect the system and interrupt service
At Ethereum block 26,005,198 (18 September 2026, 15:11:23 UTC), the tested delay-whitelist entries were true for Mint V2 role revocation and customer-whitelist addition/removal. They were false for the sampled global and per-asset cap setters, stable-delta and token-type settings, supported-asset changes, role grants, custodian changes and admin transfer. False for a queried selector is not proof that every alternative path is absent. Observed selector scope.
The source-supported whitelisted route identifies a target and function selector, not a separate approval for every argument. Revoking an operator can help contain compromise; removing a customer or operator can also stop service. The target contract’s checks still apply. The Safe separately held collateral-manager membership in Mint V2; its full set of deployed transfer methods and destination constraints was not verified.
Both sampled addresses returned false for the gatekeeper role. That does not mean the global gatekeeper roster is empty. Seven mint operators and four redeem operators identified in a bounded recent-event sample were checked as members at the 18 September observation—not exhaustively enumerated across history or refreshed on 22 September. A complete control explanation has to preserve this distinction between positive observed links and unseen alternatives.
A scheduled instruction, an immediate permission and a cancellation differ
The new source acquisition concerns Ethereum controller 0xe8dc0fab349ea169283c48ccfd09d797e6db7c94, not the complete Mint V2 body. The custom controller and relevant inherited scheduling, access-control and call-handling files were read. This is provider address-indexed source plus pinned public-source comparison, not an independent build/runtime match or current actor inventory. The owner/admin link to Mint remains inherited. Source scope and action table.
Ordinary scheduling binds a particular operation and its ready time; execution requires the applicable executor, readiness and any predecessor. Separate immediate functions authorize an allowed target/function class rather than each argument of an ordinary scheduled instruction. Cancellation can remove a waiting or ready operation but cannot undo a completed one. Open ordinary execution, where configured, would not erase scheduling checks; its current configuration was not established.
Stopping and restoring do not use one universal clock
The 18 September revocation/grant contrast matters. Selected immediate revocation and customer changes were observed, while the sampled grantRole whitelist entry was false. That does not prove every restoration takes a day, but it rules out assuming the observed fast stop supplies the same fast re-grant route. The source gives no general latest execution time for a ready instruction. Stop, cancellation and service restoration.
Whitelist changes and changes to the minimum delay require controller self-calls in the examined source; a changed minimum does not simply rewrite existing operation timestamps. Controller-role renunciation is rejected, so removal depends on revocation. Constructor self-administration does not prove no additional administrator exists today. A Safe’s direct collateral-manager role at Mint is also separate from the controller’s own delay. These distinctions improve the control explanation without filling the complete target/actor gaps.
A target revert propagates through the examined call helpers, but low-level call success is not an application-specific economic receipt. Loan notices, custody releases, external assets and banking completion remain their own events. The prior payment’s event-ABI and receipt limitations are not resolved by understanding the scheduler. What successful call handling proves.
An amount guard protects nominal units—not the dollar value of a payout
| Direction | USDC / USDe amounts | Helper result |
|---|---|---|
| Mint | 100 / 100 | true |
| Mint | 100 / 101 | false |
| Mint | 100 / 99 | true |
| Redeem | 100 / 100 | true |
| Redeem | 101 / 100 | false |
| Redeem | 99 / 100 | true |
The sampled verifyStablesLimit helper rejected minting more nominal USDe than the stable collateral and redeeming more nominal stable collateral than the USDe amount. Less favourable customer amounts passed this particular helper. It is not a dollar-price oracle, a fair-quote guarantee or proof that the helper is reached on every execution path. Those inherited helper observations were not full signed-order or rollback tests; no new contract testing accompanied the documentary update. ABI, helper and implementation scope.
Mint V2’s sampled global ceilings were 200 million USDe minted per block and 10 million USDe redeemed per block. USDT, USDC and USDtb were active in the sampled settings. These are not daily allowances, actual throughput, reserve weights or redeemable inventory. The global maximum is not multiplied by the count of active assets.
Keep staking, remote control and source assurance separate
The inspected staking source has restriction and redistribution surfaces for staking shares. Those are not arbitrary confiscation powers over ordinary USDe. Shares before cooldown, a fixed queued claim and the later Silo payout have different accounting and access boundaries. Staking source scope.
On Base, the direct token owner was an intermediate controller, 0xd896f26f76ed089a1711284a00af497b19d65171, with a one-day delay getter and Safe proposer/executor roles behind it. That resolves an owner relationship; it is not evidence of a historical ownership change. Actual messaging verification, executor, delegate, rate-limit and emergency settings remain unverified. A rejected paused() probe is not proof that transfers are unpaused. Remote identity and security boundary.
Known settings do not equal complete security. Full deployment-matched Mint V2 source/build, all consequential invariants, signer independence and every bypass were not verified. The historical order-reuse finding and the named fixes-review version are audit-scope evidence, not proof of current remediation or an allegation of a present exploit. The Base meta-oracle’s concrete formula mismatch also blocks stronger fallback claims. Audit versions · Oracle mismatch.
Policy changes can affect income and access without creating cash
The March dynamic-cooldown proposal uses 1/3/5/7-day policy settings; staking documentation describes a 90-day ceiling; the 18 and 20 September observations each recorded one day. Those answer different questions. Reported framework adoption does not prove an autonomous rule or current compliance. A liquidity reclassification cannot accelerate external settlement. Policy, ceiling and observation.
The fee-switch proposal dated 27 August and the Foundation’s 8 September result reply concern conditional ENA buyback allocation. Milestones, implementation and actual transfers were not independently verified. Lower sUSDe income can alter unwind incentives; it is not itself a principal-loss finding. Zero ongoing reserve allocation likewise does not mean zero existing reserve assets. Revenue and reserve distinctions.
The 22 July PSM review conditionally supported a 20 million-USDe seed based on a test installation. The 26 September continuation adds a 28 July reviewer statement reporting a fresh timelocked deployment, plus newly located auditor artifacts. No matched production identity, completed seed/condition record or usable payout inventory was obtained. Original PDF bodies remain uninspected. Revised status; product and audit boundaries.
The complete published Pashov report and selected Code4rena scope/dispositions support version-specific audit statements. A fixes-review identifier is not current runtime correspondence; an audit index is not evidence that every report body or operating procedure was inspected. Inspected scope and remaining limits.