Curvance High Yield AUSD (hyAUSD)

Audits and Due Diligence Disclosures

Curvance has six published reports. Firm names, dates and scope were read directly out of the PDFs in the repo audit directory:

Firm	Date	Scope (as stated in the report)	Report
TrustSec	Nov 22, 2025	Curvance core (follow-up; BorrowableCToken, MarketManagerIsolated in scope)	PDF
TrustSec	Oct 17, 2025	Curvance core lending stack (BorrowableCToken ×68, MarketManagerIsolated ×42 references)	PDF
Sherlock	Aug 25 – Sep 29, 2025	curvance-contracts @ 478fc3be…: CentralRegistry, DAOTimelock, calldata checkers, ActionRegistry; plus Atlas-Integration/AuctionManager.sol	PDF
Trail of Bits	December 9, 2025 (filename says 2025.5.23; the PDF cover and fix-review are dated Dec 9, 2025)	Curvance security assessment; Appendix D fix review states all 17 issues resolved	PDF
Cantina	Apr 16, 2025	Public audit competition (oracles, CVE bridging, veCVE, fee routing)	PDF
Trail of Bits	Mar 13, 2024	Invariant development engagement	PDF

Critical scoping finding — the assessed contract is not covered by any published audit. Every one of the six PDFs was text-extracted and searched: the strings LendingOptimizer and optimizer appear zero times in all six reports. The most recent audit predates the LendingOptimizer deployment (June 23, 2026) by seven months. The markets underneath the vault are audited (BorrowableCToken and MarketManagerIsolated appear 68/42 times in TrustSec 1, 25/8 times in Sherlock), and so is CentralRegistry/DAOTimelock — but the 1,513-line contract that actually custodies hyAUSD depositors' AUSD has no public third-party review.

Complexity. The optimizer itself is moderately complex: pro-rata deposit/withdraw routing with per-market liquidity caps, a rounding-adjusted share burn on withdraw, a high-watermark performance-fee accrual, and cToken conversion round-trips on mint()/redeem(). The stack beneath it (isolated market managers, dynamic IRM, dual-aggregator oracles, a dynamic liquidation engine with auctions, position managers, plugin/zapper system) is substantially more complex than a Compound/Morpho-style lender.

Deployed code matches the public repo. The verified MonadScan source for the optimizer was diffed against contracts/market/optimizer/LendingOptimizer.sol on develop. The 82-line diff is entirely NatSpec comments — no logic differences. Notably, the repo version adds several risk disclosures written after deployment (unrecognised credit impairment, non-continuous allocation caps, transitive-dependency requirements); those are quoted where relevant below.

Remediation status is published, and it is good. Each report carries its own fix review: Trail of Bits states verbatim "Curvance has resolved all 17 issues disclosed in this report" (Detailed Fix Review Results); Sherlock's remediation overview shows no finding left both unfixed and unacknowledged (33 "resolved", 19 "fixed", 6 "acknowledged" across the text); TrustSec 1 records 123 "fixed" and 37 "acknowledged"; TrustSec 2 records 8 "fixed" and 4 "acknowledged". No finding was located that remains open and unacknowledged.

Bug Bounty

• Self-run program, reports to security@curvance.com. Maximum payouts: Critical $250,000, High $50,000, Medium $5,000, Low/Informational no guaranteed reward (source). No Immunefi / Cantina / HackerOne / Sherlock hosted program was found for the deployed contracts.
• The assessed vault is out of bounty scope. The program states: "Only Curvance contracts with a populated Monad mainnet address on the Monad Contract Addresses page and currently in active use are in scope. Blank or placeholder entries… are out of scope." On that page, the Earn Vaults section contains a single row — "AUSD Flagship" — with an empty address cell. 0xaD663aC8…00Bf does not appear anywhere on the page. Coverage of the two markets underneath it is split: the savUSD market 0xD1BFEA17…91D4 and its manager 0x4B0a39eC…09F7 are listed, under "Avant Markets", so they are in scope; the PT market 0xbDe2459A…6c93 and its manager 0xdDd5681f…ec2e are not. The uncovered surface is therefore the vault itself plus the 60% PT leg, not the whole stack. Verified by string search of the page markdown on September 8, 2026.
• Safe Harbor / SEAL: not found. No Curvance entry was located in SEAL Safe Harbor material or in Curvance's own security docs. Treated as unverified/not adopted.

Historical Track Record

• Vault time in production: 76 days. LendingOptimizer was deployed June 23, 2026 16:28 UTC (block 83,204,988, tx 0x8cca706e…57f8) by deployer 0x029cf33e…7b5c. The two markets it lends into are barely older: market B June 8, 2026; market A June 20, 2026.
• Protocol time in production on Monad: ~9.5 months. CentralRegistry was deployed November 25, 2025 (tx 0xe05befec…db89). Curvance itself was founded in 2022 and ran a long Monad testnet campaign before mainnet.
• Security incidents: one — a frontend/DNS attack on February 16, 2026, detected by security partners and blocked before any user funds or approvals were compromised; core contracts were unaffected (report). No smart-contract exploit is known.
• Protocol TVL history (DefiLlama): $8.0M (Nov 28, 2025) → $43M (Jan 2026) → dip to $32M (Feb 2026) → $57M (Apr) → $99.5M peak (Aug 7, 2026) → $130.09M supplied / $78.74M borrowed (September 6, 2026). Growth has been steady with one ~25% drawdown in Jan–Feb 2026, and the protocol grew ~47% over the three weeks the vault itself shrank. Curvance is a Monad-only deployment.
• hyAUSD concentration has improved materially. Reconstructed from all 2,546 Transfer logs (reconstructed supply 13,244,080.73 vs onchain totalSupply() 13,244,080.81 — matches): 104 holders, with:

Rank	Holder	Balance	Share	Type
1	0x6cc60a0b…c4bd	2,405,906	18.17%	EOA
2	0x1cde180f…d891	2,214,496	16.72%	Safe (2-of-N)
3	0x4f87de7d…0545	1,983,626	14.98%	—
4	0xa1226872…e7c6	1,983,508	14.98%	—
5	0xa5190552…c6bd	1,785,009	13.48%	"FUSDE Boring Vault"

Top 5 = 78.32%, down from 89.6% on August 17. The former 45.97% whale 0x9f1a1479…bd1a has fully exited — which both removed the single largest concentration and demonstrated that a position several times larger than instant liquidity can in fact be unwound. The largest remaining holder (2.41M) still roughly matches total instantly-available exit liquidity (≈2.40M AUSD, see Liquidity Risk), so the structural constraint has narrowed rather than disappeared.

• Peg / NAV history: hyAUSD is a non-rebasing yield share, not a pegged token. Exchange rate has moved monotonically from 1.000000 to 1.011141 since inception — including through the 27% redemption wave of late August, the strongest available evidence that redemptions are priced fairly; PerformanceFeeAccrued has never fired (fee is 0) and ExcessRecovered (skim) has never fired.

Funds Management

🔴 CRITICAL ISSUE — savUSD collateral (40% of the vault)

The single most serious finding in this assessment. 40% of hyAUSD's assets fund loans made at 92% LTV against Avant savUSD, and ~99.4% of what backs that collateral cannot be verified by anyone outside Avant: $0.01 sits in AvantMintingV2 and $911,710 at the sole registered custodian, against 133,978,406 avUSD outstanding. Collateral is routed straight from depositor to custodian at mint time and never touches a protocol contract. No reserve attestation was located.

Compounding it, the Curvance oracle prices savUSD as USDC/USD × savUSD/avUSD with no avUSD/USD feed anywhere in the route — so avUSD is assumed to be worth $1. If avUSD breaks, the 92%-LTV book does not liquidate, and the resulting bad debt is socialised directly into hyAUSD's exchange rate. Opaque backing and an oracle that cannot price it is the combination that makes this critical rather than merely custodial.

Every admin power over avUSD, savUSD, the minting contract and the Monad CCIP pool sits on one address with no onchain quorum and no timelock, able to appoint itself an avUSD minter via setMinter.

This does not trigger the "Unverifiable reserves" critical gate, and the distinction matters: hyAUSD's own reserves are fully onchain and reconcile exactly (see below). What is unverifiable is the collateral two layers down, which is a collateral-quality problem scored in Category 3, not a reserve-provability problem for the assessed token.

Mitigations are real and were verified rather than assumed — a ~14% first-loss buffer, no seizure path to the Monad collateral, and a protected savUSD/avUSD rate. They bound the loss; they do not make the backing observable.

Full inventory: Appendix B — savUSD Risk Inventory.

Yes — the vault delegates 100% of deposits to other contracts. It holds zero idle AUSD (AUSD.balanceOf(vault) = 0) and its entire NAV is two cToken positions:

Position	Asset value	Underlying market state
cAUSD (PT market) 0xbDe2459A…6c93	8,041,680 AUSD	supply 11,608,850; debt 10,068,390; idle 1,540,457; utilisation 86.73%
cAUSD (savUSD market) 0xD1BFEA17…91D4	5,350,095 AUSD	supply 15,211,169; debt 14,355,112; idle 856,031; utilisation 94.37%

Sum = 13,391,775.13 AUSD against a cached totalAssets() of 13,391,636.97 (the gap is accrual staleness between blocks) and a share supply of 13,244,080.81 — i.e. reserves ≥ shares, and the whole reconciliation is a two-call onchain read. The two markets have diverged since August: the PT market de-levered (utilisation 90.97% → 86.73%) while the savUSD market levered up (89.66% → 94.37%), leaving only 856K of idle cash behind the vault's 5.35M position there. See Provability.

How funds delegation changes. Only three functions can change where the money sits, and all three are permissioned:

Function	Permission required	Effect
rebalance(actions, bounds)	hasHarvestPermissions or hasMarketPermissions	Moves AUSD between already-approved markets. Withdrawal total must equal deposit total; post-state must respect per-market caps and caller-supplied bounds.
addApprovedAsset(cToken, capBps)	hasElevatedPermissions	Adds a new market to the approved set (max 8).
removeApprovedAsset(cToken, actions, bounds)	hasMarketPermissions	Redeems a market entirely and redistributes by BPS across remaining markets.

Monitoring hooks: Rebalanced, MarketAdded, MarketRemoved, AllocationCapUpdated events on the vault (see Monitoring). getApprovedMarkets() and allocationCaps(cToken) give current state in two calls.

Rebalance cadence. 81 Rebalanced events between June 24, 2026 and September 7, 2026, median gap ~3 hours. Every one was sent by harvester EOA 0xd21dc65f…cbc7. Rebalance plans are computed offchain by the OptimizerReader "route planner" described in the Earn Vaults docs, including a defensive path that excludes markets with stale oracle feeds or breached price guards.

Cap history. Market B's cap has been raised twice, both times executed directly through the Emergency Council Safe, not the 5-day timelock: 2000 → 3000 BPS on July 4, 2026 (tx 0x9addc49d…942f) and 3000 → 4000 BPS on August 13, 2026 (tx 0x1312c516…d373d). The vault is currently at its market-B cap.

Caps are not continuous exposure limits. The protocol's own operations doc is explicit: "Allocation caps constrain post-rebalance and post-removal allocations. They are not continuous hard limits on live exposure. Different market yields, donated cTokens, and other balance changes can move a market above its configured cap. Normal deposits are routed according to current allocations and can preserve an already over-cap ratio." Monitoring must compare live positions to caps rather than assume the cap binds.

Accessibility

• Deposit/mint: permissionless. deposit(assets, receiver) and mint(shares, receiver) are open to anyone. Gated only by mintPaused == 1 and by no approved market being mint-paused (_checkMintPaused).
• Withdraw/redeem: permissionless, but see the pause coupling and liquidity cap below.
• Atomic: yes in both directions. Deposit pulls AUSD, deposits into each cToken and mints shares in one transaction; redeem withdraws from cTokens and transfers AUSD in one transaction. There is no queue, no cooldown and no epoch.
• Fees: the performance fee is currently 0 BPS (fee() = 0) and has never been changed (FeeUpdated has zero events). Ceiling is MAX_FEE_BPS = 5000 (50%) and it is charged only on NAV above the exchange-rate high watermark, minted as shares to centralRegistry.daoAddress(). There is no deposit or withdrawal fee. The underlying markets take interestFee() = 1000 BPS (10%) of borrower interest before it reaches suppliers.
• Rate limits: none at the vault. maxDeposit/maxMint return type(uint256).max while unpaused; there is no deposit cap. maxWithdraw/maxRedeem are throttled by market idle cash.
• Non-standard ERC-20 behaviour: transfer/transferFrom revert on zero amount and on self-transfer, and both accrue underlying market NAV before executing. Any integrating strategy must not assume vanilla ERC-20 semantics.

Token Mint Authority

Mint mechanism: Open, permissionless ERC-4626-style mint via collateral deposit. There is no role-gated mint, no MINTER_ROLE, no whitelist, no owner() and no bridge minter. _mint is reachable from exactly three places in LendingOptimizer.sol: deposit(), mint(), and two privileged-but-backed paths (initializeDeposits() dead shares, and the performance-fee share mint inside _accrueIfNeeded()).

Mint requires backing: Yes — atomic and measured. deposit() pulls AUSD with safeTransferFrom before routing, then derives shares from trackedAssets (the recoverable value after cToken share rounding, not the input amount) using the pre-deposit denominator. mint() reverts with LendingOptimizer__AssetMismatch if the tracked value would not cover the requested shares.

Per-address mint authority (verified onchain August 17, 2026 from 0xaD663aC8…00Bf):

Address	Can Mint	Can Burn	Role / Mechanism	Notes
Any address	✓	✓	deposit() / mint() / withdraw() / redeem()	Permissionless, atomically collateral-backed. No allow-list.
0x0Acb7eF4…5C02	✓ (fee shares only)	—	_accrueIfNeeded() → _mint(centralRegistry.daoAddress(), feeShares)	Curvance DAO Safe, 3-of-4. Receives performance-fee shares. Fee is currently 0, so this path mints nothing; a setFee change (market permissions) can enable it up to 50% of NAV growth above the high watermark.
0x379D4a8F…399c / 0x26777386…8C08	✓ (one-time)	—	initializeDeposits() → _mint(address(0), 77777)	Emergency Council Safe / DAOTimelock (both hasMarketPermissions). Already executed and permanently locked out (mintPaused != 0 ⇒ AlreadyInitialized). The 77,777 dead shares sit at address(0) as inflation-attack protection.

Rate limits / supply caps: none. No global supply cap, no per-minter cap, no per-block limit. Supply is bounded only by the fact that every share must be paid for in AUSD.

Backing check at mint time: Atomic. Every non-fee share is minted against AUSD that has already been transferred in and deposited into a cToken in the same transaction, and shares are derived from the post-rounding recoverable value so rounding never favours the minter.

No unbacked-mint path exists at the vault level. The realistic loss paths for a hyAUSD holder are (a) NAV impairment from the markets underneath, and (b) governance re-pointing where the AUSD sits — both covered below, not unbacked issuance.

Collateralization

hyAUSD is not a stablecoin and has no collateral ratio of its own — it is a 1:1 pro-rata claim on the vault's AUSD-denominated cToken positions. The meaningful collateral question is what backs the loans the vault is funding. Both markets are IS_CORRELATED_ASSET_MARKET() == true, which unlocks Curvance's highest LTV band.

Market A — PT-AUSD-8OCT2026 (manager 0xdDd5681f…ec2e, collateral cToken 0x6eD14BA7…3bF8):

Parameter	Value
Collateral ratio (max LTV)	9500 BPS (95%)
Soft liquidation collateral requirement	10300 BPS (103%)
Hard liquidation collateral requirement	10250 BPS (102.5%)
Collateral cap	30,000,000 PT
Debt cap	30,000,000 AUSD
Collateral posted	11,000,931 PT ≈ $10.91M at oracle $0.99156
Outstanding AUSD debt	10,068,390
Implied market-wide CR	≈108.3%

The collateral is a Pendle Principal Token with expiry() = 1,791,417,600 (October 8, 2026 24:00 UTC), redeemable 1:1 into AUSD at maturity via SY AUSD (whose yieldToken() is AUSD itself). This is the better of the two collaterals: at maturity the collateral becomes the same asset the vault lends.

Market B — savUSD (manager 0x4B0a39eC…09F7, collateral cToken 0x2552232c…7c2f):

Parameter	Value
Collateral ratio (max LTV)	9200 BPS (92%)
Soft liquidation collateral requirement	10450 BPS (104.5%)
Hard liquidation collateral requirement	10350 BPS (103.5%)
Collateral cap	20,000,000 savUSD
Debt cap	20,000,000 AUSD
Collateral posted	18,545,882 savUSD ≈ $22.23M at oracle $1.19862
Outstanding AUSD debt	14,355,112
Implied market-wide CR	≈154.9% (121.2% on August 17 — materially improved)

savUSD on Monad is not the canonical Avant token — it is a Chainlink CCIP burn-and-mint representation. 0x9648dB94…06c6 reports typeAndVersion() = "FactoryBurnMintERC20 1.6.2", and its sole minter/burner is 0xc5cAAC64…8D3E, a BurnMintTokenPool 1.5.1 owned by 0xd4d23209…57cb (which is also the token's owner() and getCCIPAdmin()). The pool serves 7 remote lanes; the Avalanche lane inbound bucket has capacity 44,881,724 savUSD refilling at ~519 savUSD/s — roughly 2.4× the posted collateral, so the rate limiter is not a meaningful throttle at this size. Underneath, avUSD is a delta-neutral synthetic dollar with offchain-managed strategies and a senior/junior tranche structure (Avant docs).

Tracing the canonical Avant stack on Avalanche shows the backing for this collateral is almost entirely offchain, under single-EOA control. Addresses confirmed against Avant's own contract-addresses page and then read onchain (Avalanche, August 17, 2026):

Fact	Value
avUSD total supply	133,978,406 avUSD
USDC + USDT held by AvantMintingV2 0xcb43139E…A49c	$0.01 (0.000000% of supply)
Sole registered custodian 0x3bbcb84f…e0ec — an EOA, no code, nonce 3698	$911,710 USDC (0.68% of supply)
avUSD staked in savUSD vault 0x06d47F3f…219E	108,231,057 avUSD (matches totalAssets() 108,210,389)

Three things follow, each verified from source rather than inferred:

1. Collateral never touches a protocol contract. AvantMintingV2._transferCollateral() executes token.safeTransferFrom(benefactor, addresses[i], …) — the depositor's USDC/USDT is routed directly to custodian addresses at mint time. There were zero CustodyTransfer events in the contract's history, because the escrow-then-sweep path is never used. So ~99.4% of what backs avUSD is not observable onchain at all; it sits in offchain venues supporting the delta-neutral position.

2. A single non-multisig address is the entire admin surface. 0xd4d23209…57cb has no code on Avalanche (nonce 270) or Monad. It is simultaneously: owner() of avUSD, owner() + DEFAULT_ADMIN_ROLE of savUSD, owner() + DEFAULT_ADMIN_ROLE + COLLATERAL_MANAGER_ROLE of AvantMintingV2, and owner() + getCCIPAdmin() of the Monad savUSD token and its CCIP pool. avUSD is Ownable2Step with setMinter(address,bool) onlyOwner, so that key can appoint itself a minter and issue unbacked avUSD without limit (maxMintPerBlock is 25,000,000 avUSD, and the admin sets that too).

   Important qualifier — do not read "no code" as "hot EOA." An MPC wallet is indistinguishable from an EOA onchain, and Avant explicitly documents MPC custody for its Reserve Fund wallets and an ongoing Trail of Bits OPSEC engagement covering "treasury management and transaction controls," "infrastructure security and access controls," and incident response (audits page). What is verifiable is that this key is not an onchain multisig and carries no timelock, so there is no onchain quorum or delay on any of the powers above. The offchain signing policy behind it is undisclosed — treat it as unverified, not as a single hot key.

3. Avant retained Ethena's blacklist-and-seize powers. StakedAvUSD keeps FULL_RESTRICTED_STAKER_ROLE plus redistributeLockedAmount(from, to), letting DEFAULT_ADMIN_ROLE burn a blacklisted holder's entire savUSD balance and reassign it.

Two bounding facts cut the other way, and both were checked rather than assumed:

• The Monad collateral cannot be seized. FactoryBurnMintERC20.burnFrom() still routes through OpenZeppelin's _spendAllowance(account, msg.sender, amount), so the burner — even though the EOA controls it — cannot burn savUSD out of the Curvance market without an allowance the market never grants. The Monad-side risk is unbacked minting, not confiscation. Likewise redistributeLockedAmount acts on the Avalanche token, not the bridged Monad one.
• The savUSD/avUSD rate cannot be drained. StakedAvUSD.rescueTokens() reverts when token == asset(), so the admin cannot pull staked avUSD out of the vault to crash the exchange rate the Monad oracle reads. The 108.23M avUSD backing 90.63M savUSD shares is real and onchain.
• savUSD sits behind a real ~14% first-loss buffer. Avant runs a senior/junior structure, and unlike the "planned" governance backstop, both live layers are countable onchain: the junior tranche avUSDx / "avUSD MAX" 0xDd1cDFA5…B3B9 has a supply of 14,462,519 avUSDx, and the USD Reserve Fund 0xd98e1faf…f43a holds 751,078 savUSD. Both must be converted to avUSD before they can be summed — avUSDx is priced at 1.251942 avUSD by its PriceStorage.lastPrice() 0x7b4e8103…9777, and savUSD at 1.199477 avUSD via convertToAssets. That gives 18,106,235 + 900,900 = 19,007,136 avUSD, or 14.19% of the 133,978,406 senior supply, absorbed before savUSD takes a loss. Two caveats: the Reserve Fund is denominated in savUSD, so it is a claim on the same pool it protects rather than independent capital, and the governance backstop layer is explicitly described as future work.
• Security posture is more developed than the key structure suggests. Avant publishes eight smart-contract audit files and states no critical or high-severity findings, runs a continuous Trail of Bits OPSEC engagement, and uses Hypernative for real-time threat monitoring. Avant's Security Partners page names the firms: Omniscia and Dedaub on the smart contracts, Trail of Bits on OPSEC. The PDFs themselves are served as GitBook file blobs, so per-report dates and findings counts could not be extracted from the page text.

Net: the savUSD/avUSD ratio is sound and onchain-verifiable; what is neither sound nor verifiable is what one avUSD is worth, because that rests on offchain custody controlled by a single EOA — and the Curvance oracle has no avUSD/USD feed to price it (see External Dependencies).

Liquidations are onchain, run by Curvance's Dynamic Liquidation Engine with a soft/hard tier (market A: 1.25% base incentive, 25 BPS step, close factors 40%/60%; market B: 2.00% incentive, 50 BPS step). liquidationPaused() = 1 (active) on both markets. MIN_HOLD_PERIOD = 1200 s on both.

Bad debt is socialized to lenders — i.e. to hyAUSD. Per the Curvance docs: "the deficit is socialized across the entire lender market… Each lender's token value for redemption is slightly reduced." A liquidation shortfall in either market lowers the cAUSD exchange rate, which lowers totalAssets(), which lowers hyAUSD NAV. There is no insurance fund, junior tranche, or first-loss buffer between hyAUSD depositors and a market shortfall.

Risk curation is Curvance-operated. Collateral ratios, caps and IRM parameters are set by market-permissioned addresses; a family of ProtocolManager contracts exists to delegate bounded parameter changes to ops bots, but none of them currently manages the two markets behind this vault (config(address) returns false for both cTokens and both managers on all five deployed ProtocolManager instances). Parameter changes on these two markets therefore go through the Emergency Council or the timelock directly.

Provability

• Everything that determines hyAUSD's value is onchain and permissionlessly readable. NAV = convertToAssets(cToken.balanceOf(vault)) summed over getApprovedMarkets(). Exchange rate = totalAssets() * 1e18 / totalSupply(). Anyone can force a fresh accrual with the permissionless accrueIfNeeded() or exchangeRateUpdated(), which call accrueIfNeeded() on each underlying cToken first. There is no offchain price feed, no admin-set unit price, no keeper-submitted NAV.
• Yield is computed onchain, absorbed immediately into _totalAssets on every accrual (cToken-style), which is what blocks yield-frontrunning: _accrueIfNeeded() runs before every user action.
• Freshness caveat. totalAssets(), exchangeRate(), previews and max* methods return cached values and are stale between accruals — deliberately so, because deposit() reads totalAssets() after depositing into cTokens. The protocol's own doc says: "Do not use a raw optimizer view as authoritative collateral or credit state. Force stateful accrual in the same atomic execution as the final authoritative read." Any Yearn strategy reporting on hyAUSD must call accrueIfNeeded() in the same transaction as its valuation read.
• Credit impairment is NOT reflected in NAV until the cToken recognises it. This is the single most important provability caveat and Curvance documents it plainly: "Borrower health can be negative while a borrowable cToken still accounts for the loan at par. The loss reaches optimizer NAV only when the cToken recognizes it, such as during liquidation and bad-debt accounting." Combined with pooled withdrawal routing, this creates a first-mover advantage: "an exit can be funded by healthy-market cash before an impaired cToken recognizes its loss. If that loss is recognized later, remaining holders own the resulting concentration." A large, slow-to-react holder (a Yearn vault) is structurally on the wrong side of that race.
• Third-party verification: none required — there is no offchain collateral. Collateral pricing, however, depends on Chainlink OCR2 feeds on Monad (see External Dependencies).

Liquidity Risk

• Exit mechanism: direct redemption at NAV, no queue, no fee, no delay — but hard-capped by the idle cash in the underlying markets. _availableWithdrawLiquidity() sums min(vault position, cToken.assetsHeld()) per market.
• Instantly available exit liquidity: 1,540,457 + 856,031 = 2,396,488 AUSD, or 17.9% of the vault's 13.39M NAV (was 21.0% on August 17). Beyond that, withdraw/redeem revert with LendingOptimizer__InsufficientLiquidity until borrowers repay, borrowers are liquidated, or new suppliers arrive. The savUSD market now sits at 94.37% utilisation and the PT market at 86.73% — high utilisation is the design point for these looping markets, not an anomaly, but the savUSD leg has tightened.
• The largest holder roughly equals available liquidity. Holder #1 (18.17%, ≈2.43M AUSD of claim) is just above the 2.40M available; any two of the top five exiting together would exhaust it several times over. This is materially better than August 17, when the top holder alone was 2.2× available liquidity.
• The mechanism has now been tested. Between August 17 and September 7 the vault serviced ~17.0M AUSD of withdrawals — including the complete exit of the former 45.97% holder — against instant liquidity that never exceeded ~3.9M, while the exchange rate rose throughout. Exits were funded by borrower repayment and fresh deposits over time rather than by standing cash, which is exactly the designed behaviour, but it does confirm that a large position can be unwound over weeks rather than being structurally trapped.
• Withdrawals are all-or-nothing across markets. _checkRedeemPaused() reverts the entire vault's withdrawals if any single approved market has redeemPaused() set. The docs frame this as fairness ("prevents early users from withdrawing from only the healthy markets while later users are left bearing the paused one"), and it is a defensible design — but from an integrator's view it means one paused market anywhere in the approved set freezes 100% of hyAUSD exits, not the affected fraction. The same coupling applies to deposits via _checkMintPaused().
• Recovery mechanism: the dynamic IRM raises borrow rates sharply as utilisation approaches the vertex, which pulls repayments and new supply. This is a real but rate-dependent, hours-to-days mechanism, not a guarantee.
• Secondary market: effectively none. hyAUSD is a 104-holder Monad-native share token with no DEX pool located. There is no market exit; redemption is the only exit.
• Reflexive leverage on hyAUSD exists. Two LendingOptimizerShareCToken markets accept hyAUSD as collateral — 0xbaAD847D…cA30 (manager 0x120E3ef1…cE6a) and 0xc3DfC3CD…7F28 (manager 0x8AF3E980…5974). These competed for the same idle-cash budget during the August–September redemption wave. A liquidation cascade there would force hyAUSD redemptions into the same thin idle-cash budget that ordinary holders rely on.
• Historical stress: one real test, passed. Between August 17 and September 7, 2026 the vault processed ~17.0M AUSD of withdrawals — including the complete exit of a holder who had been 45.97% of supply — against instant liquidity that never exceeded ~3.9M. NAV fell 27% (18.35M → 13.39M) while the exchange rate rose 1.007984 → 1.011141, so this was orderly redemption with no impairment. Exits were funded by borrower repayment and new deposits over time; the constraint is speed, not solvency.

Centralization & Control Risks

Governance

Upgradeability: none. LendingOptimizer, both BorrowableCToken markets, both MarketManagerIsolated contracts, CentralRegistry and DAOTimelock are all non-proxy, source-verified contracts (Proxy: 0, empty Implementation on the Etherscan V2 getsourcecode response for chain 143). Code cannot be swapped under depositors. centralRegistry is immutable on the optimizer, so the vault's permission root cannot be re-pointed either.

Permission root: CentralRegistry 0x1310f352…12fF. It exposes four boolean mappings (hasDaoPermissions, hasElevatedPermissions, hasMarketPermissions, hasHarvestPermissions). Current holders, enumerated from all 48 PermissionsUpdated and 7 PermissionsTransferred events since deployment and then re-checked live onchain:

Address	DAO	Elevated	Market	Harvest	Type
0x0Acb7eF4…5C02	✓	—	—	—	DAO Safe, 3-of-4 (Safe v1.4.1)
0x379D4a8F…399c	✓	✓	✓	—	Emergency Council Safe, 4-of-5
0x26777386…8C08	✓	✓	✓	—	DAOTimelock, getMinDelay() = 432,000 s = 5 days
0x1482192D…3e4c	—	—	✓	—	ProtocolManagerDeployment, owner = EIP-7702 EOA 0x6D3DA13B…bCE8
0xbb82aee1…ad73	—	—	✓	—	ProtocolManagerMassPause, owner = Emergency Council, canUnpause = true
0x89d2253b…7803	—	—	✓	—	ProtocolManagerMassPause, owner = 0x25D41348…0902 (Safe, threshold 1-of-5), canUnpause = false
0xc3a29745…21a1, 0x7d89822c…4441, 0x4dad55e3…a012, 0xb68f3241…c3a4, 0x1cfeaa99…38cc	—	—	✓	—	Five ProtocolManager instances, each with one immutable bot caller and per-parameter limits. None manages this vault's markets.
0x97f6886d…4521	—	—	—	✓	EOA (original deployer)
0xd21dc65f…cbc7	—	—	—	✓	EOA (active rebalance keeper)

Privileged-role harm matrix on hyAUSD:

Action	Who can do it	Delay	Harm potential
setFee(0 → 5000)	Market perms: EC Safe (4-of-5), timelock	None via EC	Medium — up to 50% of all future NAV growth above the high watermark diverted to the DAO Safe. Cannot touch principal or accrued past yield.
setMintPaused(true)	Market perms	None via EC	Low — blocks deposits only; withdrawals unaffected.
updateCap(cToken, bps)	Market perms	None via EC	Low alone — caps constrain future rebalances; changing a cap moves no assets. Already exercised twice via the EC.
removeApprovedAsset(...)	Market perms	None via EC	Medium — forcibly redeems a market and redistributes into the remaining approved set. Funds stay in the vault.
rebalance(...)	Harvest perms (two EOAs) or market perms	None	Medium — can concentrate up to the caps (90% into market A). Cannot move assets outside approved markets and cannot move assets out of the vault. Bounds are caller-supplied, so they protect the caller against races, not depositors against the caller.
skim()	DAO perms	None	Negligible — sweeps only idle underlying, which is 0 by construction.
addApprovedAsset(cToken, cap)	Elevated perms: EC Safe (4-of-5), timelock	None via EC	Critical — this is the drain path (see below).
Grant any permission to any address	Elevated perms	None via EC	Critical — the EC can hand market/harvest permissions to an arbitrary address instantly.
Pause redemptions on any Curvance market	ProtocolManagerMassPause owner — including a 1-of-5 Safe	None	High — freezes 100% of hyAUSD withdrawals (see below).

Critical path 1 — a 4-of-5 multisig can drain the vault with no delay. addApprovedAsset only checks that the candidate cToken (a) has asset() == AUSD, (b) is isBorrowable(), (c) has a marketManager registered in CentralRegistry.isMarketManager, and (d) is listed there. addMarketManager is itself gated by the same _checkElevatedPermissions(). So an actor with elevated permissions can register a market manager it controls, list a cToken it controls, addApprovedAsset it, then rebalance the vault's AUSD into it and withdraw. Both the Emergency Council Safe (4-of-5, instant) and the DAOTimelock (5-day delay) hold elevated permissions. The 5-day timelock is therefore not a binding constraint on this path — it is one of two parallel routes, and the observed operating practice (both cap changes) uses the EC route.

Critical path 2 — a 1-of-5 Safe can freeze all hyAUSD withdrawals. ProtocolManagerMassPause 0x89d2253b…7803 holds market permissions and exposes pauseAll(markets) / pauseTokenLevelEntryActions(...), with an empty array meaning every registered market. Its owner() is a Safe with getThreshold() = 1 over five signers, and canUnpause = false. So any single one of five signers can set redeemPaused on the markets behind hyAUSD, which makes _checkRedeemPaused() revert every withdraw and redeem — and that key cannot itself undo the pause. Unpausing requires the second mass-pause key (owned by the 4-of-5 EC) or the EC/timelock directly. The design intent is clearly a fast, low-friction emergency brake with a deliberate asymmetry, and the pause is recoverable — but it is a genuine single-signer freeze of user funds and should be scored as one.

Critical path 3 — transitive dependency safety is an offchain operator control, not an onchain check. _validateCToken() rejects only a direct sibling whose immediate asset() is the optimizer. The repo doc states plainly: "It does not walk nested receipt tokens, vaults, LP components, or oracle dependencies. Operators must separately reject every transitive dependency path that reaches this optimizer." Two Foundry verifier scripts (VerifyLendingOptimizerLaunch.s.sol, VerifyOptimizerShareDeScope.s.sol) exist for this, and the doc requires archiving their output before every addApprovedAsset. No public attestation that these were run for this vault was located — marked TODO; Curvance would need to publish the verifier output and terminal-asset manifest for the June 23, 2026 launch.

Signer sets (thresholds and counts only — per reports/TEMPLATE.md, onchain multisig signer identities are not validated in these assessments): DAO Safe 3-of-4, Emergency Council 4-of-5, mass-pause Safe 1-of-5. The material fact is the overlap: the 1-of-5 pause Safe is composed of the same five signers as the 4-of-5 Emergency Council, so the freeze key is not an independent party — it is the Emergency Council operating under a lowered threshold.

Programmability

• Accounting is fully programmatic and onchain. PPS = totalAssets() / totalSupply(), both onchain; totalAssets is re-derived from actual cToken balances on every accrual and re-synced from ground truth after every rebalance (_verifyAllocations recomputes from _getMarketAssets rather than trusting the cache). No admin sets the rate.
• The only offchain dependency is the rebalance planner. OptimizerReader computes plans offchain; the onchain rebalance() then enforces (i) exact ordering match against approvedCTokensList, (ii) withdrawals == deposits, (iii) no market paused for the relevant action, (iv) post-state within allocationCaps, (v) post-state within caller bounds. A stalled keeper degrades yield optimisation and lets allocations drift above caps; it cannot lose principal.
• accrueIfNeeded() is permissionless, so anyone (including a Yearn keeper) can force NAV to be current.
• Documented rounding forgiveness: "Permissionless accrual can therefore advance the watermark when an individual positive fee increment is too small to mint a fee share, permanently forgiving that dust amount." This is protocol-revenue dust, not user principal, and is moot while fee() == 0.

External Dependencies

Dependency	Role	Criticality	Failure mode for hyAUSD
Curvance isolated markets (2× BorrowableCToken + MarketManagerIsolated)	Where 100% of AUSD sits	Total	Bad debt socialises directly into NAV; redeem-pause freezes exits
Agora AUSD 0x00000000…012a	The underlying itself	Total	Upgradeable ERC-1967 proxy (impl 0xc1e3c7d4…12da, admin 0xB8fCC66d…dedee). Monad supply 132,763,800 AUSD. Roles read onchain: MINTER_ROLE 0x65e28662…D7fF (EOA), FREEZER_ROLE 0xcF7D2a52…4681 (EOA), ACCESS_CONTROL_MANAGER_ROLE 0x68898B77…30e2 (EOA), BRIDGE_MINTER_ROLE 0x9CaB7Ede…689b (contract). isFreezingPaused() = false, so the freezer can freeze the vault's or the markets' AUSD balances
Pendle (Monad) — PT-AUSD-8OCT2026, SY AUSD, YT	Collateral in market A	High	PT/SY contract failure, or a PT market-price gap vs the model oracle, impairs market A's collateral
Avant avUSD/savUSD	Collateral in market B	Critical	~99.4% of avUSD backing sits outside Avant's contracts, partially traceable via 23 published strategy addresses but unattested; the sole registered custodian is an EOA; one EOA holds every admin key across avUSD, savUSD, the minting contract and the CCIP pool, and can mint unbacked avUSD via setMinter. A strategy loss or a key compromise impairs market B, and the Curvance oracle has no avUSD/USD feed to see it
Chainlink CCIP (BurnMintTokenPool 0xc5cAAC64…8D3E)	Mints savUSD on Monad	High	A CCIP-path compromise or a malicious pool owner can mint unbacked savUSD, post it as collateral, and borrow out market B's AUSD, leaving socialised bad debt. Inbound capacity from the Avalanche lane is 44.88M savUSD — ~3× current posted collateral
Chainlink OCR2 data feeds (Monad)	All collateral pricing	High	AUSD/USD 0x253c9599…51Af (DualAggregator 1.0.0), savUSD/avUSD exchange rate 0x8ABac2dD…7501 (AccessControlledOCR2Aggregator 1.0.0), USDC/USD 0x6789f81a…56AB. All owned by Chainlink's 4-of-N Safe 0x73877Fe3…c4F1. Feeds were fresh at assessment (updated within seconds of the read)
Monad L1	Everything	Total	New high-throughput L1; single-sequencer/consensus risk and RPC availability are outside Curvance's control

Oracle wiring, verified onchain. CentralRegistry.oracleManager() = 0x65ADF8aE…37c5, and all three relevant assets resolve to a single ChainlinkAdaptor 0x42B318ab…22e1 — there is no second pricing adaptor per asset, so a bad route for an asset has no redundant source.

• PT-AUSD → PendlePTAggregator 0x3ED78CA0…6134, which multiplies the AUSD/USD feed by a fixed linear discount to maturity (WAD − timeToExpiry × discountOneYear / SECONDS_PER_YEAR); at maturity it returns exactly WAD. Current output $0.98590 implies ≈9.8% annualised discount. This is the conservative, non-manipulable approach (no AMM TWAP, so no Pendle-pool price manipulation vector), but it is also not a market price: if PT trades below the model — e.g. a sharp AUSD-yield repricing or a Monad Pendle liquidity crunch — the oracle keeps quoting the model value, liquidations do not trigger, and market A can be economically under-collateralized while reporting 107% CR. Because PT redeems at par on October 8, 2026, this is primarily a duration and liquidation-execution risk rather than a permanent credit loss — provided AUSD holds and the market can wait to maturity.
• savUSD → CombinedAggregator 0x7CB9a321…4999 = USDC/USD × savUSD/avUSD. There is no avUSD/USD feed anywhere in the route. avUSD is assumed to be worth exactly one USDC. Curvance's own contract comments name this exact limitation: "if AUSD depegs and loses value, this may remain hidden from the guard due to an increase in the [secondary] rate… the primary price [is left] without an effective guard." An avUSD depeg — the realistic failure mode for an offchain delta-neutral synthetic dollar — would leave market B's 92%-LTV loans priced off a collateral value that no longer exists, and the resulting bad debt lands on hyAUSD.

Fallbacks: the OptimizerReader defensive-routing path can flag a market whose collateral feed is stale or whose price guard is breached and exclude it from future allocations, pulling liquidity out when the market is not redeem-paused. This is a keeper-triggered mitigation, not an automatic onchain circuit breaker, and it cannot exit a market that has been redeem-paused.

Operational Risk

• Team: public. Curvance was founded in 2022 by Chris Carapola and Michael Butcher. Funding: $3.6M seed (Dec 2023, incl. Offchain Labs, Wormhole, Sandeep Nailwal) and a $4M strategic round in Nov 2025 led by F Prime Capital and 0xPrimal with Auros, GSR, Flowdesk, Q42 and v3v ventures (Crunchbase).
• Documentation: good in the places that matter, stale in one that matters a lot. The Earn Vaults page and the in-repo docs/lending-optimizer-integration.md are unusually candid — they self-disclose the loss-recognition race, the non-continuous caps, the fee-dust forgiveness and the transitive-dependency gap. That is above-average transparency. But the published Monad Contract Addresses page is materially out of date: the Earn Vaults section lists one row ("AUSD Flagship") with a blank address; neither hyAUSD nor either of its markets or market managers appears; and the OracleManager it lists (0x32faD39e…CDb6) is not the one CentralRegistry actually points at (0x65ADF8aE…37c5). Since the bug-bounty scope is defined by that page, the staleness has a direct security consequence, not just a documentation one.
• Legal structure: Cayman Islands per Crunchbase; Terms of Use exist but were not machine-readable for jurisdiction extraction. Governance is a "Curvance Collective" DAO around the CVE/veCVE token, but the live control surface is the two Safes above, not a token vote.
• Incident response: one real test, passed. The February 16, 2026 frontend attack was detected by security partners and blocked with no fund loss, and the team publicly committed to time-locked upgrades and a strengthened bounty afterwards. There is no published, versioned incident-response runbook. The mass-pause tooling (two purpose-built contracts, one pause-only) is concrete evidence of pre-built emergency capability.

Monitoring

Vault — 0xaD663aC84052b52BE4ed1b27BA416505e84a00Bf

What	How	Threshold / alert	Frequency
NAV per share	exchangeRateUpdated() (state-changing; forces accrual) or accrueIfNeeded() then exchangeRate()	Any decrease — this vault has no mechanism that legitimately lowers PPS except realized bad debt. Alert on any tick below the previous high	Hourly
Reserve reconciliation	totalAssets() vs Σ cToken.convertToAssets(cToken.balanceOf(vault)) over getApprovedMarkets()	Divergence >0.1% after a forced accrual	Hourly
Approved market set	getApprovedMarkets(); events MarketAdded, MarketRemoved	Any change — page immediately. This is the drain-path signal	Every block / event-driven
Allocation vs cap	cToken.convertToAssets(balanceOf(vault)) / totalAssets() vs allocationCaps(cToken)/1e18	Live allocation > cap (caps are not continuously enforced); or any market >70%	Hourly
Performance fee	fee(); event FeeUpdated	Any non-zero value (currently 0; ceiling 5000 BPS)	Event-driven
Deposit pause	mintPaused(); event ActionPaused	!= 1	Hourly
Rebalance keeper health	Rebalanced events; sender address	No event for >24 h (median gap is 3 h); or a sender other than a known harvester EOA	Hourly
Exit liquidity	Σ min(vault position, cToken.assetsHeld()) = _availableWithdrawLiquidity(); proxy via maxWithdraw(ourAddress)	< our position size, or < 15% of totalAssets()	Hourly
Share concentration	Transfer logs / top-holder balances	Top holder > 25% of supply (currently 18.17%), or top-5 > 85% (currently 78.32%)	Daily

Underlying markets — 0xbDe2459A…6c93 and 0xD1BFEA17…91D4

What	How	Threshold	Frequency
Utilisation	marketOutstandingDebt() / totalAssets()	>95% warn, >98% page (both ~90% today)	Hourly
Idle cash	assetsHeld()	< our position, or a >50% day-over-day drop	Hourly
Market-wide CR	collateral cToken marketCollateralPosted() × oracle price ÷ marketOutstandingDebt()	Market A <105% (soft-liq req 103%), Market B <108% (soft-liq req 104.5%)	Hourly
Redeem / mint / borrow pause	MarketManagerIsolated.redeemPaused(), transferPaused(), liquidationPaused(), actionsPaused(cToken)	Any value != 1 on redeem or liquidation — page immediately (redeem-pause on either market freezes all hyAUSD exits)	Every block / event-driven
Risk parameters	collConfig(collateral), collateralCaps, debtCaps, IRM()	Any change to LTV, liquidation requirement, or caps	Event-driven
cToken exchange rate	cToken.exchangeRateUpdated()	Any decrease = realized bad debt socialisation	Hourly

hyAUSD-as-collateral markets (reflexive leverage — these compete for the same exit liquidity, see Liquidity Risk)

What	How	Threshold	Frequency
hyAUSD locked as collateral	hyAUSD.balanceOf() on 0xbaAD847D…cA30 and 0xc3DfC3CD…7F28; marketCollateralPosted() on each	Combined holdings >5% of hyAUSD supply (2.72% today), or a >50% increase in 7 days — a forced unwind at that size would consume most of the ~$3.9M idle-cash budget	Daily
Their health / pause state	redeemPaused(), liquidationPaused(), actionsPaused(cToken) on managers 0x120E3ef1…cE6a and 0x8AF3E980…5974	Any value != 1, or utilisation >90% — a liquidation cascade here forces hyAUSD redemptions	Hourly

Governance — CentralRegistry 0x1310f352…12fF

What	How	Threshold	Frequency
Permission grants	Events PermissionsUpdated(string,address,bool) (topic0 0x40f7b3ef64c9e38288873dda008188d6c3cd146f84d77b978478a8731f71feb9) and PermissionsTransferred(string,address,address) (topic0 0xd8e127776f279a25ebbafc660f7deba16e71dcb8ff27626f743010802c27211d)	Any grant of Market, Harvest or a DAO/EC/Timelock transfer — page immediately	Every block
Market-manager registry	marketManagers() (26 entries today); PermissionsUpdated("Market Manager", …)	Any addition — precondition for the addApprovedAsset drain path	Every block
Governance addresses	daoAddress(), emergencyCouncil(), timelock()	Any change	Daily
Safe composition	getOwners() / getThreshold() on 0x0Acb7eF4…5C02, 0x379D4a8F…399c, and the 1-of-5 pause Safe 0x25D41348…0902	Any signer or threshold change	Daily
Timelock queue	DAOTimelock 0x26777386…8C08 scheduled-operation events	Any queued operation touching the optimizer or its markets — 5 days of warning, when this route is used	Every block
Mass-pause keys	ProtocolManagerMassPause events MassPauseExecuted, MarketPauseFailed on 0xbb82aee1…ad73 and 0x89d2253b…7803	Any execution	Every block

Offchain / cross-chain

• CCIP savUSD pool 0xc5cAAC64…8D3E: getCurrentInboundRateLimiterState(6433500567565415381) (Avalanche lane) and savUSD.totalSupply() on Monad vs the amount escrowed/burned on Avalanche. Alert on Monad supply growth >10% in 24 h, on any owner() change, or on any rate-limit capacity increase. Daily, event-driven on owner().
• Avant admin key and reserves (Avalanche): this is the least verifiable part of the exposure, so monitor it hardest. Watch avUSD.minters(address) via MinterUpdated events on 0x24dE8771…E346 — any new minter is a page-immediately event; owner()/pendingOwner() on avUSD, savUSD and AvantMintingV2; CustodianAddressAdded/Removed and CustodyTransfer on 0xcb43139E…A49c; maxMintPerBlock changes; and savUSD.totalAssets()/totalSupply() for any non-monotonic move in the exchange rate. Also alert if DEFAULT_ADMIN_ROLE on savUSD is granted to a new address, since that unlocks redistributeLockedAmount. Event-driven; the admin EOA had nonce 270 on Avalanche at assessment, so any burst of activity is itself a signal.
• Avant reserve attestation: no onchain proof of the ~99.4% offchain backing exists. Track whatever attestation Avant publishes and treat a lapse in reporting cadence as a reassessment trigger.
• Chainlink feeds: latestRoundData() staleness on all three aggregators; alert if updatedAt is older than the heartbeat + grace. Hourly.
• AUSD roles: getMinterRoleMembers(), getFreezerRoleMembers(), getAccessControlManagerRoleMembers(), proxyAdminAddress() and the ERC-1967 implementation slot on 0x00000000…012a. Alert on any implementation change or role-set change; also alert if isAccountFrozen() returns true for the vault or either market. Daily.
• Pendle PT maturity: PT-AUSD expires October 8, 2026. Market A must be rolled or wound down; reassess before that date. There is no automatic handling in the optimizer.
• DefiLlama api.llama.fi/protocol/curvance as an independent TVL cross-check. Daily.

Appendix A: Contract Architecture

GOVERNANCE
  DAO Safe 3/4                  Emergency Council Safe 4/5        DAOTimelock (5 days)
  0x0Acb7eF4…5C02               0x379D4a8F…399c                   0x2677738657…8C08
  hasDaoPermissions             DAO+ELEVATED+MARKET               DAO+ELEVATED+MARKET
        │                              │        │                        │
        │                              │        └────────┐               │
        │                              │                 │               │
        └──────────────┬───────────────┴─────────────────┼───────────────┘
                       ▼                                 ▼
            ┌──────────────────────────┐   Pause Safe 1-of-5  0x25D41348…0902
            │   CentralRegistry        │        │  owns
            │   0x1310f352…12fF        │        ▼
            │  (immutable, non-proxy)  │   ProtocolManagerMassPause (pause-only)
            │  hasDao / hasElevated /  │   0x89d2253b…7803  ──► pauseAll(markets)
            │  hasMarket / hasHarvest  │        (2nd instance 0xbb82aee1…ad73,
            └──────────┬───────────────┘         owned by EC, canUnpause=true)
                       │ permission root (immutable ref on the vault)
   Harvester EOAs      │
   0x97f6886d…4521 ────┤ hasHarvestPermissions → rebalance()
   0xd21dc65f…cbc7 ────┘
                       │
VAULT / TOKEN LAYER    ▼
            ┌────────────────────────────────────────────┐
            │  LendingOptimizer  "hyAUSD"                │  totalAssets 13.39M AUSD
            │  0xaD663aC8…00Bf   (non-proxy, 6 dp)       │  totalSupply 13.24M
            │  ERC-4626-like · fee 0 BPS · HWM 1.0       │  rate 1.011141
            │  77,777 dead shares at address(0)          │  104 holders, top-1 18%
            └───────┬─────────────────────────┬──────────┘
                    │ 60.1% (cap 90%)         │ 39.9% (cap 40%)
                    ▼                         ▼
PROTOCOL LAYER  ┌──────────────────┐    ┌──────────────────┐
                │ BorrowableCToken │    │ BorrowableCToken │
                │ cAUSD (PT mkt)   │    │ cAUSD (savUSD)   │
                │ 0xbDe2459A…6c93  │    │ 0xD1BFEA17…91D4  │
                │ util 86.73%      │    │ util 94.37%      │
                │ idle 1.54M AUSD  │    │ idle 0.86M AUSD  │
                └───────┬──────────┘    └───────┬──────────┘
                        │ listed in              │ listed in
                ┌───────▼──────────┐    ┌───────▼──────────┐
                │ MarketManager    │    │ MarketManager    │
                │ Isolated         │    │ Isolated         │
                │ 0xdDd5681f…ec2e  │    │ 0x4B0a39eC…09F7  │
                │ LTV 95% soft103% │    │ LTV 92% soft104.5%│
                │ redeemPaused=1   │    │ redeemPaused=1   │
                └───────┬──────────┘    └───────┬──────────┘
                        │ collateral             │ collateral
                ┌───────▼──────────┐    ┌───────▼──────────┐
                │ cPT-AUSD-8OCT2026│    │ csavUSD          │
                │ 0x6eD14BA7…3bF8  │    │ 0x2552232c…7c2f  │
                │ 11.00M PT posted │    │ 18.55M savUSD    │
                └───────┬──────────┘    └───────┬──────────┘
UNDERLYING LAYER        ▼                        ▼
                Pendle PT-AUSD            savUSD (Monad)
                0x9FC74f8E…02d1           0x9648dB94…06c6
                expiry 2026-10-08         FactoryBurnMintERC20
                  │ SY AUSD                 │ minted by
                  ▼                         ▼
                AUSD  ◄───────────────  CCIP BurnMintTokenPool
                0x00000000…012a         0xc5cAAC64…8D3E
                (Agora, upgradeable,    owner 0xd4d23209…57cb
                 EOA minter/freezer)    ← Avant savUSD (Avalanche)

ORACLE LAYER
  OracleManager 0x65ADF8aE…37c5
        └─► ChainlinkAdaptor 0x42B318ab…22e1  (single adaptor for all three assets)
              ├─ PT-AUSD  ─► PendlePTAggregator 0x3ED78CA0…6134
              │                = AUSD/USD × linear discount to 2026-10-08
              ├─ savUSD   ─► CombinedAggregator 0x7CB9a321…4999
              │                = USDC/USD × (savUSD/avUSD)   ← NO avUSD/USD feed
              └─ AUSD     ─► EACAggregatorProxy 0xEd21588e…eBf3 → DualAggregator
                               0x253c9599…51Af (Chainlink OCR2, owner Safe 0x73877Fe3…c4F1)

Appendix B: savUSD Risk Inventory

Everything found wrong with the savUSD collateral leg, in one place. Every row was verified onchain on Avalanche (chain 43114) and Monad (chain 143) on August 17, 2026, or read from Avant's published source. This is the evidence behind Critical Risk #1 and the callout in Funds Management.

Why this leg matters: it is 40% of hyAUSD's assets (7,332,183 AUSD), lent at 92% LTV into a market at 89.66% utilisation, where bad debt socialises directly into the cAUSD exchange rate and therefore into hyAUSD's NAV. The allocation cap was raised 20% → 30% (July 4, 2026) → 40% (August 13, 2026), both times through the Emergency Council with no timelock, and the vault currently sits at that cap.

B.1 The backing is almost entirely unverifiable

Measure	Value
avUSD total supply	133,978,406
USDC + USDT held by AvantMintingV2 0xcb43139E…A49c	$0.01
Held by the sole registered custodian 0x3bbcb84f…e0ec	$911,710 USDC
Share of backing held in Avant's own contracts	≈0.68%
Stablecoins across all 23 published strategy addresses (checked August 19, 2026)	$1,194,937 — of which $1,194,287 was the custodian above
CustodyTransfer events ever emitted	0
Registered custodians (from CustodianAddressAdded, none removed)	1, and it has no code (nonce 3698)

AvantMintingV2._transferCollateral() runs token.safeTransferFrom(benefactor, addresses[i], …), so depositor USDC/USDT goes straight to custodian addresses at mint time and never enters a protocol contract. That is why the escrow-then-sweep path has never once been used.

Where the rest actually is — checked, not assumed. Avant publishes 23 avUSD strategy addresses (Strategy Addresses). All were queried on August 19, 2026: the 20 EVM addresses hold $1,194,937 in USDC+USDT combined, of which $1,194,287 is the custodian already counted above — so enumerating them adds ~$650 and does not move the figure. The other three are a Solana wallet (~11.5K of token balances), a Stacks L1 wallet, and a Lighter (perp DEX) address. All 20 EVM addresses are EOAs, 16 with transaction history, holding almost no idle stablecoins — the shape you would expect when collateral is deployed into delta-neutral positions on exchange venues.

So the accurate statement is partially traceable, not attested: Avant discloses where the wallets are, but there is no consolidated proof that the sum matches liabilities. Avant's Security Partners page states that a Chainlink Proof of Reserve is "actively developing" and "planned" — i.e. not live — and the OPSEC audit findings are explicitly not public. This remains the sharpest contrast with Ethena, the protocol Avant is forked from essentially line-for-line, which publishes per-custodian reserve breakdowns today.

B.2 The oracle cannot see a depeg

Curvance prices savUSD through CombinedAggregator 0x7CB9a321…4999 as:

savUSD/USD  =  USDC/USD  ×  (savUSD/avUSD exchange rate)

There is no avUSD/USD feed anywhere in the route — avUSD is assumed to be worth exactly one USDC. The savUSD/avUSD leg is a genuine Chainlink OCR2 feed and the rate it reports is sound, but it only measures staking accrual, not solvency. Curvance's own contract comments name this exact limitation: "if AUSD depegs and loses value, this may remain hidden from the guard due to an increase in the [secondary] rate… the primary price [is left] without an effective guard."

Consequence: an avUSD depeg does not move the collateral price, so 92%-LTV loans do not become liquidatable. The book silently goes underwater and the loss reaches hyAUSD only when the cToken recognises it. All three assets also resolve through a single ChainlinkAdaptor 0x42B318ab…22e1 — no redundant pricing route.

Re-derived independently rather than restated (August 18, 2026): walking OracleManager.getPricingAdaptors(savUSD) returns exactly one adaptor; its assetConfig resolves to the CombinedAggregator; and that aggregator's two legs report description() of "USDC / USD" and "SAVUSD / AVUSD Exchange Rate" — neither is avUSD/USD. Stronger still: getPricingAdaptors() for the bridged avUSD on Monad 0x0d9d741f…3ba4 returns an empty array — Curvance has no avUSD price source registered at all, on any route.

B.3 One key holds every admin power

0xd4d23209…57cb — no code on Avalanche (nonce 270) or Monad:

Contract	Chain	Powers held
avUSD 0x24dE8771…E346	Avalanche	owner() → setMinter(address,bool) is onlyOwner
savUSD 0x06d47F3f…219E	Avalanche	owner() + DEFAULT_ADMIN_ROLE
AvantMintingV2 0xcb43139E…A49c	Avalanche	owner() + DEFAULT_ADMIN_ROLE + COLLATERAL_MANAGER_ROLE
savUSD (bridged) 0x9648dB94…06c6	Monad	owner() + getCCIPAdmin()
CCIP pool 0xc5cAAC64…8D3E	Monad	owner(); getRateLimitAdmin() is unset, so limits are owner-only

avUSD is Ownable2Step and setMinter is onlyOwner, so this key can appoint itself a minter and issue unbacked avUSD, with no cap of any kind on that path. The 25,000,000 maxMintPerBlock limit does not apply here: it is enforced by the belowMaxMintPerBlock modifier on AvantMintingV2.mint() only. AvUSD.mint() is simply if (!minters[msg.sender]) revert OnlyMinter(); _mint(to, amount); — a minter added directly through setMinter is unbounded, and the admin also sets maxMintPerBlock in any case.

Stated precisely, because the distinction is easy to get wrong: an MPC wallet is indistinguishable from an EOA onchain, and Avant documents MPC custody for its Reserve Fund wallets plus a continuous Trail of Bits OPSEC engagement covering treasury and access controls. So "no code" does not establish a hot key on a laptop. What is established: no onchain quorum and no timelock on any of the powers above. The offchain signing policy is undisclosed and should be treated as unverified.

B.4 Blacklist-and-seize retained from Ethena

StakedAvUSD keeps SOFT_RESTRICTED_STAKER_ROLE, FULL_RESTRICTED_STAKER_ROLE and redistributeLockedAmount(from, to) — DEFAULT_ADMIN_ROLE can blacklist a holder, burn their entire savUSD balance and reassign it. This acts on the Avalanche token, so it does not reach the bridged Monad collateral directly, but it applies to anyone bridging back and to the canonical pool the Monad token redeems against.

B.5 The bridge can mint the collateral

Monad savUSD is not the canonical token: typeAndVersion() reports FactoryBurnMintERC20 1.6.2, and its sole minter/burner is the CCIP BurnMintTokenPool 1.5.1. Seven remote lanes are configured; the Avalanche lane's inbound bucket holds 44,881,724 savUSD of capacity refilling at ~519 savUSD/s — roughly 2.4× the 18,545,882 savUSD actually posted as collateral, so the rate limiter is not a meaningful throttle at this size. A CCIP-path or pool-owner compromise can mint unbacked savUSD on Monad, post it, and borrow out market B's AUSD.

B.6 The first-loss buffer is real but thin, and partly circular

Layer	Size	Status
USD Reserve Fund 0xd98e1faf…f43a	751,078 savUSD × 1.199477 = 900,900 avUSD	Live — but denominated in savUSD, i.e. a claim on the very pool it protects
Junior tranche avUSDx / "avUSD MAX" 0xDd1cDFA5…B3B9	14,462,519 avUSDx × 1.251942 = 18,106,235 avUSD	Live, and genuinely independent
Governance backstop	—	Not live; docs describe it as a "planned future backstop"
Total absorbed before savUSD	19,007,136 avUSD = 14.19% of the 133,978,406 senior supply	Independent portion ≈13.5%

Note on this figure. avUSDx and savUSD have different unit values, so their balances are converted to avUSD before being added together.

A ~14% cushion is meaningful and better than nothing comparable at Curvance's own layer (there is no first-loss buffer between a Curvance market's bad debt and hyAUSD at all). It is still thin against a delta-neutral book whose positions are not externally observable.

B.6b How much can this leg actually cost hyAUSD?

The qualitative picture in B.1–B.5 is bad, but the loss is bounded, and the bounds are worth stating because they are what a position-sizing decision should rest on. Figures at block 102,741,475 (September 7, 2026); hyAUSD holds 5,350,095 AUSD in market B, which is 35.2% of that market's suppliers, so it absorbs ~35% of any socialised loss there.

Path 1 — avUSD depegs (slow, oracle-blind). Market B is collateralised at 154.9% ($22.23M against $14.36M debt), so it takes a ~35% fall in savUSD value before collateral no longer covers debt. Avant's junior tranche and Reserve Fund absorb the first 14.19% of any strategy loss before avUSD itself depegs at all. Combining the two, the strategy would have to lose roughly $66M — about 44% of Avant's ~$153M book — before hyAUSD takes a credit loss on this leg.

Path 2 — key or CCIP compromise (fast). This is the binding case, and it is far smaller. Unbacked savUSD can be minted freely, but posting it is capped by the collateral cap (20M savUSD against 18.55M posted → 1.45M of headroom → ~1.60M AUSD borrowable at 92% LTV), and the borrow is further capped by the market's 856K of idle cash today. hyAUSD's 35.2% share of the loss is therefore roughly 301K today (2.2% of NAV), rising to ~564K (4.2% of NAV) if liquidity refills to the cap.

Path	Trigger required	hyAUSD loss
avUSD depeg	~44% loss on Avant's book	up to the full 5.35M position
Key / CCIP compromise	one signature	~301K–564K (2.2%–4.2% of NAV)

Three things break these bounds, and they are the real monitoring targets: the collateral cap is the binding protection in Path 2 and is governance-settable with no timelock; market-B CR is volatile (121.2% → 154.9% in three weeks), so the Path 1 threshold is a snapshot, not a floor; and because the oracle cannot see an avUSD depeg, that ~35% figure is a borrower-default threshold rather than a liquidation threshold — positions sit silently underwater instead of being unwound.

B.7 What Avant does have

Stated for balance, because these are real and were checked:

• Eight published smart-contract audit files, with a claim of no critical or high-severity findings. The PDFs are GitBook file blobs so per-report dates could not be extracted, but Avant's Security Partners page names the firms: Omniscia and Dedaub for the smart contracts, Trail of Bits for ongoing OPSEC.
• A continuous Trail of Bits OPSEC engagement (internal policy, treasury controls, infrastructure access, incident response); findings deliberately not public.
• Hypernative real-time threat monitoring.
• A senior/junior tranche design where savUSD is explicitly the senior, most-protected layer.
• $6.5M seed funding and an established Avalanche-ecosystem presence.

B.8 Structural protections that hold (verified, not assumed)

• The Curvance market's savUSD cannot be seized — confirmed by simulation, not just source review. FactoryBurnMintERC20.burnFrom() routes through OpenZeppelin _spendAllowance(account, msg.sender, amount). Simulating the attack with eth_call from the CCIP pool against the csavUSD market (allowance = 0) reverts on both entry points — burnFrom(market, 1e18) and the burn(address,uint256) alias — with ERC20: insufficient allowance. For contrast, the same simulation of mint(pool, 1e18) from the pool succeeds, which is exactly the asymmetry claimed in B.5: the bridge key can create supply but cannot confiscate it.
• The savUSD/avUSD rate cannot be drained. StakedAvUSD.rescueTokens() reverts when token == asset(), so staked avUSD cannot be pulled out. 108,231,057 avUSD backs 90,626,971 savUSD shares, and both figures are onchain.
• The staking vault reconciles. totalAssets() 108,210,389 against an actual avUSD balance of 108,231,057.

B.9 What would resolve this

1. Onchain multisig + timelock on the Avant admin key — removes the single-key mint and role powers.
2. Published reserve attestation with named custodians and per-custodian balances, at a committed cadence — the Ethena standard Avant is currently below.
3. An avUSD/USD oracle feed in the Curvance route — this one is Curvance's to fix, not Avant's, and is the single highest-leverage change, because it converts a silent solvency failure into a normal liquidation event.
4. A hard, agreed ceiling on the market-B allocation cap, given it has moved 20% → 30% → 40% in six weeks with no timelock and is currently at cap.

---

---

Reassessment Triggers

• Time-based: Reassess in 3 months (by December 7, 2026), or sooner — the vault is 76 days old and the score is dominated by facts that change quickly. Over the past three weeks, NAV moved 27%, exit liquidity moved by a third, and top-holder concentration moved by 28 points — the natural cadence here.
• Calendar-based: Reassess before October 8, 2026 (PT-AUSD-8OCT2026 maturity, market A collateral roll).
• TVL-based: Reassess if vault totalAssets() changes by more than 40% in 30 days, or if available exit liquidity falls below 10% of NAV.
• Scope-based: Reassess immediately if LendingOptimizer receives its first audit, or if it is added to the Monad Contract Addresses page (bug-bounty scope).
• Governance-based: Reassess immediately on any MarketAdded / MarketRemoved event, any PermissionsUpdated grant of Market or Harvest permissions, any change to the DAO/Emergency Council/timelock addresses or Safe thresholds, or any non-zero fee().
• Incident-based: Reassess after any exploit, any redeem-pause on either market, any decrease in the hyAUSD or cAUSD exchange rate (realized bad debt), any avUSD or AUSD depeg, or any CCIP incident affecting the savUSD pool.
• Counterparty-based: Reassess immediately if a new avUSD minter is appointed, if the Avant admin EOA changes or is replaced by a multisig (a material improvement worth re-scoring), or if Avant's published reserve attestation lapses or materially diverges from avUSD supply.