Flying Tulip — FT Lend (ftDNMM)

Contract Addresses

Original addresses were verified onchain at block 25675412 (August 3, 2026); the TRS additions below were verified September 4 through block 25904682. Core lending contracts and the two new engine implementations are source-verified. The EIP-7702 executor's delegated implementation was not verified on Etherscan or Blockscout at the check and is called out separately.

Core Lending Contracts (Ethereum)

Contract	Address	Type	Implementation
PositionsManager	0xbe4050a73a7Fb384c65E885a15C33461A4B20055	UUPS proxy	0xaa3d5fc8…a23b
ConfigRegistry	0xA8777c3D446fa7F0b0FC97a80C1Ea1d37F1ca33E	UUPS proxy	0xd25f964e…47e5
PMWrapper (PM admin)	0xBDD80028c9e4b9A2D268D2cF62Fb54Ec8697C68B	admin wrapper	—
RfqEngine (legacy liquidation module)	0xEB00B335Ca52216Fb60fdFFA361397367C39Dc32	engine + liquidation module	—
LeverageRfqEngine (legacy / ftUSD hedge)	0x8263a07504d93cB95e0a74f3627bb15faaf140e2	engine	—
RfqEngine v2 (Trade / liquidation)	0xc64516d58f8b83bc256448bc69d7bf2361557fdb	ERC-1967 proxy; engine + liquidation module	0xD5b3B315…4bB4
LeverageRfqEngine v2 (TRS)	0x93496075909f56d93b33302DF5D1655568Eb6e70	UUPS proxy; engine	0x6595C190…8734
MetaActions	0x3633eb60d08756674472e2d34d6ffb5f4c1c29f2	engine + meta-module	—
MetaSessionActions	0x4f83ac5c8a79986d0916a8849730d9cef63a3497	engine + meta-module	—
RelayerAuth	0x823a97a2c32985e0f5457fc8103F36698D1F53F4	session layer	—
SessionManager	0xF9f3ddF2E96Cabef94e2634c326DC6dde99360f8	session layer	—
CircuitBreaker	0x9676E697399581AB288844cDE5F73d0887eC18e0	outflow limiter	—
Stable IRM	0x3253739A68640E308c8209384bb44E4ADA38710d	pure rate model	—
Major IRM	0x07eC8583B1bC7D97646409a2b51DdBed6725D12F	pure rate model	—
LongTail IRM	0x09cd852f47aCa224eE6B4AccC29BD2694F29Ef69	pure rate model	—

Live TRS Execution Contracts (Ethereum)

Contract	Address	Role
SessionManager v2	0x880A371CE2C5Dbb2EB47EC0023b358e8aE80071b	Delegated session authorization used by the live TRS frontend
LeverageRfqBatchModule	0x91Ecc9c9E9B32fe198a3e2c7F2FCB27C0A57Bf24	Batch-matches leverage orders; delegate-called by the TRS engine
Permissioned executor	0xa505815A526f1200c17B7ffaE0067318d734b9d8	Authorized RFQ filler; EIP-7702 delegates to 0x4428809A…a5c, whose source was not verified at the check

The live TRS API identifies the v2 engine, session manager and executor above. Onchain, LeverageRfqEngine.permissionedFillers(executor) is true, the Admin Safe is also an authorized filler, and both new engines were registered on PositionsManager in block 25812534 (August 22, 2026). This is a material post-snapshot privilege change, not merely a frontend release.

ftUSD Contracts (summary — see the dedicated report)

ftUSD is an accepted collateral and borrowable asset here, and the contract that holds its backing is this market's largest single supplier. Full enumeration, mint authority, and the staking product are covered in Flying Tulip — ftUSD & Staked ftUSD.

Contract	Address	Relevance to FT Lend
ftUSD	0xF7D85EC4E7710f71992752eac2111312e73E9C9C	Collateral + borrowable asset, 11.4% of TVL
Delta-Neutral strategy	0xe0E445967256EE60111e243e0F0F94DD1D351A59	Largest supplier in this market — 35.1% of TVL. Holds ftUSD's backing
MintAndRedeem	0xAa48EcBC843cF7E9A29155D112b8Cb27902bD23C	Source of the ftUSD price used for liquidations here
FT token	0x5DD1A7A369e8273371d2DBf9d83356057088082c	Reward token paid to suppliers; enabled but unpriced asset

Governance & Multisig

Contract	Address	Threshold	Notes
Admin Safe	0x1118e1c057211306a40A4d7006C040dbfE1370Cb	3 of 5	Gnosis Safe v1.3.0. Root of all authority. No timelock
Guardian Safe	0x22246a9183cE2CE6e2c2a9973F94aEA91435017C	3 of 4	Strict subset of admin signers
WBTC strategy-manager Safe	0x5557729b169082f07d3131D560E2f2cb5e6c48f6	3 of 5	Identical five signers to the admin Safe
YieldClaimer	0x88432bB6EA62e774cB6d87995CC5277568d01397	contract	Holds wrapper execute() arbitrary-call
Treasury	0x9B2F12De620d4E2993068e5cab6D6c7451f6cDe5	UUPS proxy	setStrategyDelay; impl 0xf32adbe8…7d21
Fee collector / epoch settler	0x5cd6Abe67f8af1C0c699dF36d90a6469Eaf1958a	UUPS proxy	impl 0x63176fda…beb5

Admin Safe signers (undisclosed in docs, presumed team EOAs): 0xB7B54333…08bc8, 0x3c427497…1B4E, 0xf9E5aF16…9a10, 0x09E2B492…7881, 0xD0CA8838…6f5A. The Guardian Safe holds the same set minus 0xf9E5aF16…9a10.

FT Lend Yield Wrappers & Strategies

Asset	Wrapper	Strategy	Venue	strategyManager
USDC	0xD2e4A5ac4B4Da102317cF7C9A1289aDF082639E2	0xfBE0736e…b0e5	Spark	Admin Safe
USDT	0x28b0905d83BCe5FFA6c54651F25858828A38123B	0x852dc763…6a42	Spark	Admin Safe
WETH	0x460494aF61BcB92B59797B4e09C26A5ADecb2da2	0x4df6f4f8…F2a7	Spark	Admin Safe
WBTC	0x1A5730c71576D77048E9FdC79DD40e4B1E8Fe042	0x06980dC5…3B92	Aave	0x5557…48f6 Safe
wstETH	0x01980BD1B58313bD3767f6adc75Af8b6464f3db7	none	—	Admin Safe
ftUSD	0xc67D966f761e8cf13Faa0a1E774425290c8453d9	none	idle	Admin Safe
FT	0x7127BB9d9ad0f47B8dA9087e634D67F3946F840E	none	reward pool	Admin Safe

All seven wrappers share the implementation 0xfaed20b307a6789481ee383adc10b9b0090b1157 (ftYieldWrapper).

Oracle Stack

Asset	Router feed	Type	Underlying	Owner	Staleness	Deviation
USDC	0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6	Chainlink EACAggregatorProxy	USDC/USD	Chainlink	88,200s	25 bps
USDT	0x3E7d1eAB13ad0104d2750B8863b489D65364e32D	Chainlink EACAggregatorProxy	USDT/USD	Chainlink	88,200s	25 bps
WETH	0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419	Chainlink EACAggregatorProxy	ETH/USD	Chainlink	5,400s	50 bps
WBTC	0x183dB475d8184aA7a018ed2164e11A887afBDA55	ChainlinkLatestAnswerProxy	CL BTC/USD + Aave CLSynchronicityPriceAdapterPegToBase	Admin Safe	88,200s	50 bps
wstETH	0x000bb128a8aBCFa05B871C97CC9C5f88e7Dcf35a	ChainlinkLatestAnswerProxy	CL ETH/USD + Aave WstETHPriceCapAdapter	Admin Safe	5,400s	50 bps
ftUSD	0xA69f7a38B6c91a4bc2477f097DC8a1F16DAADFf8	FtUsdMintRedeemOracleProxy	CL USDC/USD × MintAndRedeem redeem factors — f(USDC price, mint history); does not read ftUSD collateral	Admin Safe	86,400s	0 bps
FT	—	no feed configured	priceUSD(FT) reverts	—	—	—

On the three protocol-owned wrappers, baseFeed and adapter are immutable — the owner can setPaused, setAnswerBounds and setMaxStaleness, but cannot repoint the feed. The arbitrary-price path is at the router, not here (see Provability).

Can Holders Lose Money?

Enumerated loss paths for a Yearn deposit into FT Lend, ordered by how directly they reach supplied principal:

#	Path	Mechanism	Gating	Severity
1	Admin upgrades PositionsManager	PMWrapper.upgradePM replaces the engine with arbitrary code that can transfer any balance	3/5 Safe, no timelock	Total loss
2	Admin rewrites the oracle price	OracleRouterChainlink.setLastGoodPrice(asset, price) writes an arbitrary price, making solvent positions liquidatable or insolvent ones invisible	3/5 Safe	Total loss
3	Admin redirects lender capital	wrapper.setStrategy + confirmStrategy with strategyDelayConfig = 0 moves deployed funds to an arbitrary strategy in one block	3/5 Safe (WBTC: 0x5557…48f6 Safe)	Total loss
4	YieldClaimer arbitrary call	wrapper.execute(strategy, to, value, data) forwards an arbitrary call through the strategy contract	YieldClaimer contract	Total loss
5	Unbacked ftUSD mint	Safe registers a new ftUSD Core module (or replaces minter()) and issues ftUSD with no collateral; ftUSD is collateral in FT Lend	3/5 Safe	Severe — dilutes ftUSD collateral
6	ftUSD blacklist / balance wipe	blacklist + wipeBlacklistedAddress freezes and burns a holder's ftUSD, including a Yearn position	3/5 Safe	Severe
7	Bad debt from a failed liquidation	The novel time-sliced/RFQ liquidation path fails to clear a position; the insolvency exception in liquidateFlash explicitly permits seizing all collateral and leaving debt. Blue-chip collateral and a 1.25 target health factor mitigate likelihood, but reserves are negligible	permissionless caller via RfqEngine	Partial, socialized
8	Reflexive ftUSD impairment	ftUSD's backing is a supply position in FT Lend; a loss here impairs ftUSD, which is 11.8% of the market's collateral and is priced by a feed blind to that backing	structural	Partial
9	Spark or Aave exit shortfall	Wrappers hold zero idle buffer (deployed() == capital()); a freeze or cash shortfall at either otherwise low-risk venue blocks or impairs exits	external (concentrated exposure)	Partial to total per-asset
10	Withdrawal pause / breaker	setWithdrawPaused, CircuitBreaker, or flipping marginRestrictWithdrawToSettlement / marginWithdrawRequiresNoDebt to true traps funds	3/5 Safe / guardian	Temporary lockup
11	Chainlink feed failure	Single feed per asset; a stale or wrong price mis-liquidates. Adapters are immutable but the owner can setPaused the wrapper, denying pricing	external / 3/5 Safe	Partial

Paths 1–6 require trusting a single 3-of-5 multisig with no delay. Paths 7–11 are structural or external. There is no insurance fund and no SEAL Safe Harbor enrolment behind any of them; a live Sherlock bug bounty provides a public disclosure and reward channel.

Audits and Due Diligence Disclosures

The team provides gated portal access to the in-scope FT Lend / ftDNMM contracts and ftUSD have been audited multiple times by reputable firms, and keeps the reports and finding-level detail private.

An investor-relations portal does host a structured Audits registry — its front-end code contains a component that renders an "Audits" heading over a list, with per-row states for entries that have no attached report file. The portal is behind a unique-access-code wall: every page renders only "Enter Your Unique Code Below" and fetches no audit data until authenticated. No firm name, date, scope, or finding count could be verified for this assessment.

Item	Status
Public bug bounty	LIVE — Sherlock Flying Tulip Bug Bounty #248, max reward 1,000,000 USDC; the bounty's Additional Scope incorporates Flying Tulip's dynamic list of all deployed production contracts, including FT Lend (see below)
SEAL Safe Harbor enrolment	Not enrolled (absent from the security-alliance/safe-harbor registry)
Contract source verification on Etherscan	PASS — all 20 contracts checked are verified (see Appendix B)

• The docs' Risks page states a policy of "external audits before enabling capital-bearing features" and lists "Transparency. Publish parameters, addresses, audit reports, and incident post-mortems" as a security principle. The audit reports are not public.
• Only two reviews are publicly confirmable, and neither covers the assessed contracts: the token-sale Escrow (PeckShield #2025-170, Oct 2025; Cantina Managed, Oct 2025) and the separate ftPUT product (Sherlock contest #1223, Jan 2026).
• Accepted risks from the Sherlock ftPUT contest README — relevant because the same team and patterns build Lend: "protocol-level loss handling and backstops are out-of-scope," "malicious strategy manager cannot be removed," "caps updates can be front-run," and a circuit-breaker that does not cover all flows. Each of these is observable in the deployed Lend contracts (see Centralization).

Contract complexity is high: a novel dynamic-LTV money market with snapshot LTVs, an RFQ/relayer/session layer, flash-liquidations, epoch settlement, cross-product shared collateral, and a stablecoin whose backing is actively managed by a strategy contract. Complexity of this order is precisely where public, finding-level audit disclosure matters most.

Bug Bounty

LIVE. Sherlock's Flying Tulip Bug Bounty #248 has been live since June 18, 2026 and advertises a maximum reward of 1,000,000 USDC. Its Additional Scope states that contracts deployed for the bounty are found either in Sherlock's static Scope section or in Flying Tulip's linked Contract Addresses directory. That directory points to Flying Tulip's Smart Search, the protocol-maintained dynamic list of all deployed production contracts. Accordingly, the live bounty covers the deployed contracts assessed here, including PositionsManager, ConfigRegistry, the RFQ engines, the IRMs, the wrappers and strategies, and the related ftUSD contracts, even when an address is not duplicated in Sherlock's static address table.

Scoring note. This does not trigger the "No audit" critical gate — a real audit registry demonstrably exists, so asserting "no audit" would be false. Audits can be access with team permission.

Historical Track Record

• Production history. TGE / mainnet ~Feb 23, 2026; ftUSD deployed Feb 21, 2026. The assessed lending engine is newer: ConfigRegistry and PositionsManager were deployed April 27, 2026 (block 24974967) and the first Deposit event is April 29, 2026 (block 24986969). Protocol ~5.4 months old; FT Lend in its current deployment ~3.2 months.
• TVL (DeFiLlama, whole protocol): ~$12.56M on August 3, 2026 — Ethereum $12.14M, Sonic $0.42M (API). Peak ~$12.58M on July 31, 2026; tracked since ~May 12, 2026 (85 data points). The marketed "$126M+ TVL" figure is raise capital parked in Aave, not protocol usage.
• FT Lend onchain TVL: $12.48M supplied / $0.97M borrowed (6.43% utilization) — reconciles with DeFiLlama's $12.14M Ethereum figure.
• Genuine third-party TVL is $8.11M, not $12.48M. $4.38M (35.1%) is the protocol's own ftUSD backing collateral supplied back into the market by its own strategy contract.
• Incidents / exploits / depegs: NONE FOUND for Flying Tulip itself through August 2026. (An April 23, 2026 news item concerns Flying Tulip adding a withdrawal circuit breaker after other protocols' April exploits — preventive, not a breach.)
• ftUSD: supply 4,142,539; oracle price ~$0.9988; maxSupply cap 100M (raised from 5M); thinly traded.

TVL history

DeFiLlama daily series (protocol-wide, API); tracking began ~May 12, 2026:

Month	Open	Close	Low	High
May 2026	$2.93M	$5.05M	$2.93M	$5.05M
June 2026	$5.75M	$8.97M	$4.56M	$8.97M
July 2026	$8.92M	$12.58M	$8.92M	$12.58M
August 2026 (MTD)	$12.41M	$12.63M	$12.41M	$12.63M

Growth has been monotonic apart from one drawdown: −20.7% from the running peak on June 6, 2026. That is the only stress episode in the series and it was a growth-phase dip, not a redemption event. Chain split at the latest point: Ethereum $12.20M (96.6%), Sonic $0.42M (3.4%), borrowed $1.11M protocol-wide. Sonic is immaterial and out of scope for this report.

Two caveats on reading this series: (1) it starts only ~2 weeks after FT Lend opened, so there is no pre-launch baseline; (2) ~35.1% of the Ethereum figure is the protocol's own recycled ftUSD collateral — the Delta-Neutral strategy deposits ftUSD's USDC/USDT backing into this same market — so the growth curve overstates third-party adoption. See Reflexive supply.

FT Lend market state — onchain, block 25697429 (August 6, 2026)

Asset	IRM	Maint. margin	Borrowable	Collateral	Supplied	Borrowed	Util	Supply cap	Cap used
USDC	Stable	1.50%	✓	✓	3,175,623 ($3.17M)	241,018	7.6%	10M	32%
USDT	Stable	1.50%	✓	✓	1,429,877 ($1.43M)	223,541	15.6%	10M	14%
WETH	Major	19.0%	✓	✓	736.92 ($1.41M)	95.35	12.9%	1,000	74%
WBTC	Major	22.0%	✓	✓	75.18 ($4.86M)	0	0%	100	75%
wstETH	Major	21.0%	—	✓	76.54 ($0.18M)	0	—	300	26%
ftUSD	Stable	1.50%	✓	✓	1,428,403 ($1.43M)	322,186	22.6%	1.5M	95%
FT	LongTail	0%	—	—	763.25 (unpriced)	—	—	0	—
Total					$12.48M	$0.97M	7.8%

Prices at block 25697429: USDC $0.9998, USDT $0.9991, WETH $1,911.99, WBTC $64,680.05, wstETH $2,372.33, ftUSD $0.9988. FT has no configured price feed — priceUSD(FT) reverts.

The market changed materially between August 3 and August 6. wstETH went from 0 supplied to 76.54, and WETH borrows from 0.35 to 95.35 — both driven by the Delta-Neutral strategy activating its hedge leg (see below). WETH utilization went from 0.05% to 12.9% in three days. A market that moves this fast on one actor's decision warrants a shorter reassessment interval than its size alone would suggest.

Cap headroom is a live constraint. ftUSD is at 95% of its 1.5M supply cap; WBTC and WETH at ~75%. Caps are raised by the admin Safe in one transaction via PMWrapper.setCaps with no delay.

Interest rate models

borrowAPR(asset, utilizationWad) sampled directly on each IRM contract (all pure, so the curves are fixed until the ConfigRegistry points an asset at a different IRM):

Utilization	Stable IRM	Major IRM	LongTail IRM
0%	1.50%	1.00%	6.00%
25%	4.44%	2.92%	13.69%
50%	7.38%	4.85%	21.38%
75%	10.32%	6.77%	68.86%
80%	10.91%	12.45%	90.29%
90%	38.17%	39.73%	133.14%
100%	91.50%	67.00%	176.00%

Kinks sit at ~80% for Stable and Major and ~50–75% for LongTail. The curves are conventional and adequately steep above the kink to defend exit liquidity. At today's 6.4% utilization, suppliers earn near the base rate, so most of the realised supply yield comes from the Spark/Aave strategies rather than from borrowers.

Funds Management

How supplying works

A lender calls deposit(asset, amount) on the PositionsManager. Un-borrowed liquidity is held by the asset's ftYieldWrapper; where a strategy is configured the wrapper deploys it. Borrower interest and strategy yield accrue through the supply index. Withdrawals (withdraw) pull from currently available wrapper liquidity.

Asset	FT Lend yield wrapper	Strategy	Venue
USDC	0xD2e4A5ac…39E2	0xfBE0736e…b0e5 SparkSavingsStrategy	Spark
USDT	0x28b0905d…123B	0x852dc763…6a42 SparkSavingsStrategy	Spark
WETH	0x460494aF…2da2	0x4df6f4f8…F2a7 SparkSavingsStrategy	Spark
WBTC	0x1A5730c7…E042	0x06980dC5…3B92 AaveStrategy	Aave
wstETH	0x01980BD1…3db7	none	—
ftUSD	0xc67D966f…53d9	none	held idle in wrapper
FT	0x7127BB9d…840E	none	circuit breaker unset (address(0))

There is no idle buffer. On all four wrappers with a strategy, deployed() equals capital() to the wei — 2,902,577.215876 USDC, 1,180,959.539429 of 1,180,959.539430 USDT, 736.579217 WETH and 7,518,219,204 WBTC units are inside Spark/Aave, not in the wrapper. Every lender withdrawal is a Spark or Aave withdrawal in the same transaction and inherits that venue's liquidity and pause state. Only the ftUSD wrapper (1,109,633 ftUSD, no strategy) holds its balance locally.

Fees, reserves and revenue

Flow	Parameter	Value	Set by
Lending protocol reserves	astate.reserves	7.72 USDC · 13.16 USDT · 303.01 ftUSD · 0.0000257 WETH · 0 WBTC	accrued from interest
Reserve withdrawal	PMWrapper.withdrawReserves	unrestricted	Admin Safe

Protocol reserves are negligible — a few hundred dollars in total against a $12.48M book. The current book uses blue-chip collateral and a 1.25 target health factor, which reduce expected bad-debt risk. Reserves nevertheless provide no meaningful buffer against any residual loss; bad debt would be borne by suppliers of the affected asset. ftUSD mint/redeem fees are covered in the ftUSD report.

Supplier rewards are discretionary FT emissions

settleEpoch(asset, interest) on the PositionsManager is onlyAdmin. The admin transfers FT tokens into the contract, which are deposited to the FT wrapper and distributed to that asset's suppliers pro-rata by supply-time (totalSuppliedTime), with the epoch rate recorded as rateRay. This is a material and undocumented component of advertised supply yield, and it is entirely discretionary — no rule obliges the admin to fund an epoch, and no schedule is published.

Settlement history by asset (latest settled epoch, read from astate and epochs):

Asset	Epochs settled	Last settlement	FT emissions received
USDC	126	Aug 2, 2026	yes, ongoing
USDT	120	Aug 2, 2026	yes, ongoing
WETH	28	Aug 1, 2026	yes, ongoing
WBTC	0	never (epoch t_end still the Apr 27 deploy timestamp)	none
ftUSD	0	never	none
wstETH	0	never (no supply)	none

WBTC and ftUSD suppliers have never received a single FT emission — that is 39.5% and 11.4% of TVL respectively earning only base interest, while USDC/USDT/WETH suppliers receive FT on top. Total emitted to date is the FT wrapper's balance: 43,792.78 FT (~$4,353 at $0.0994). Any yield figure quoted for this market must be checked against which asset it applies to, and treated as revocable.

Liquidation mechanics

liquidateFlash(user, seizeTo, seizeAssets, seizeAmounts, repayAssets, repayAmounts, callbackData) is callable only by a registered liquidation module — currently RfqEngine 0xEB00B335…Dc32 alone. The flow is:

1. Pre-check — hfPre < marginHfTargetBps (1.25), else revert.
2. Seize — collateral is withdrawn from the user's avail balance to seizeTo, an address the module chooses, in module-specified amounts.
3. Callback — onLiquidationFlash lets the module trade the seized collateral and source repayment. The RFQ caller chooses the debt and collateral bundles; the engine's repayment cap permits partial fills sized around restoring the HF corridor, which is what "time-sliced / RFQ-routed" means here. Each fill is atomic — there is no onchain timer or automatic sequence of slices.
4. Repay — the engine's funds are pulled and booked against the user's debt, capped at its balance and allowance.
5. Post-check — hfPost >= marginHfTargetBps, with an insolvency exception: if equityUSDPre == 0 and all seizable collateral is exhausted (collUSDWadPost == 0), the check is skipped so bad debt can be cleaned up rather than blocked.

The liquidator proposes the price, but cannot set an arbitrary penalty. Live at block 25776852, RfqEngine.liqBonusBps() is 750 (7.5%), so oracle-valued collateral seized cannot exceed actual debt repaid × 1.075. The protocol receives 10% of the realized bonus (protocolLiqSplitBps = 1000): at the maximum, repaying $100 can seize $107.50, of which $0.75 goes to the protocol and $106.75 to the filler. This uses FT Lend's oracle values, not the collateral's realized DEX sale price.

Proposed RFQ fill	Result	Why
Repay $100; seize $107.50	Maximum permitted ordinary fill, subject to HF and dust checks	Exactly the 7.5% oracle-value cap
Repay $100; seize $110	Reverts	Seized value exceeds repay × 1.075
Repay $50; seize $53.75 in an ordinary partial liquidation	Reverts	Fairness cap passes, but collateral-seizing partial fills have a $100 minimum repayment
Repay $50; seize nothing	Not blocked by the $100 floor; normal HF checks still apply	Pure repayment is exempt; the payer receives no collateral
Repay $50; seize at most $53.75 and close all debt	Permitted by the minimum-size rule	Full debt closure is exempt, but the 7.5% fairness cap still applies
Repay $50; seize at most $53.75 and exhaust an already-insolvent account's collateral	Permitted by the minimum-size rule	Terminal insolvency is exempt from the minimum and normal post-HF/dust checks, but not the fairness cap

Terminal bad debt is narrowly identified, not declared by the liquidator. The engine computes terminalBadDebt = (equityUSDPre == 0 && collUSDWadPost == 0): the account must already have zero economic equity before the fill, and the fill must leave no oracle-valued collateral. The seize-fairness cap is checked before this exception, so even a terminal fill cannot take more than repayment plus the 7.5% bonus. Any debt left after the last collateral is removed is unsecured; it can still be repaid at any size through a pure-repayment RFQ or repayFor, but there is no collateral incentive or funded backstop to make a third party do so.

Three structural observations:

• Two RFQ liquidation modules now exist. The legacy module remains mostly permissionless for normal underwater accounts; its sole privileged account, the ftUSD strategy 0xe0E445…1A59, has no permissioned liquidator there. The v2 module 0xc645…7fdb was authorized on August 22, also marks that strategy privileged, and authorizes the Admin Safe as both ordinary and privileged liquidator. The strategy is therefore no longer unliquidatable across all available paths, but its v2 liquidation availability depends on the same Safe that governs it.
• No liq bonus or close factor in PositionsManager. Seize/repay sizing lives in RfqEngine (onchain module, not the core ledger). Core only requires HF ≥1.25 after — bounds under-liquidation, not how much collateral value the borrower loses per unit of debt repaid.
• The insolvency exception is an explicit bad-debt path. It permits a position to end with all collateral seized and debt outstanding. The debt remains technically repayable, but without collateral there is no liquidator incentive or funded backstop; unless the borrower or protocol supplies the missing asset, the economic shortfall falls on suppliers against reserves of essentially zero.

Because liquidation modules are admin-authorized through setLiquidationModule, liquidation access and economics are governance parameters, not code invariants. The allowed set expanded post-launch from one module to two. Both currently expose a 7.5% maximum bonus and 10% protocol share of that bonus, but either implementation or authorization can change without a timelock.

Reflexive supply: ftUSD backing lent into FT Lend

The single largest supplier to FT Lend is not a third party. It is 0xe0E44596…1A59, the MultiCollateralDeltaNeutralStakingStrategy that holds ftUSD's collateral, which deposits that collateral into this market (35.1% of TVL today):

Position	Amount	USD
USDC supplied	2,780,139.26	$2.78M
USDT supplied	1,417,609.56	$1.42M
wstETH supplied (collateral for its hedge)	76.54	$0.18M
Total		$4.38M = 35.1% of TVL
WETH borrowed (hedge leg)	95.01	99.6% of all WETH debt

What a lender needs to take from this:

1. Headline TVL overstates third-party capital. Genuine third-party TVL is $8.11M, not $12.48M.
2. ftUSD and FT Lend cannot fail independently. ftUSD's backing is a claim on this market; ftUSD is 11.4% of this market's collateral; and ftUSD's price feed is blind to that backing. A loss event propagates in a circle while the protocol feed does not register the backing impairment.
3. The largest supplier is also a leveraged borrower. It is now 99.6% of all WETH debt, so its health factor is a solvency variable for this market — and it is operated by a key set that includes a plain EOA.
4. It can leave. A 35.1% supplier unwinding would be the largest liquidity event this market has seen.

Full derivation of the backing chain, the collateral reconciliation, the strategy's operator model, and the risks to ftUSD holders themselves are in Flying Tulip — ftUSD & Staked ftUSD.

Accessibility

Action	Who	Atomic?	Fees	Limits
Supply to FT Lend	permissionless	yes, same tx	none	per-asset supplyCap
Withdraw from FT Lend	permissionless	yes, if wrapper liquidity available	none	withdrawPaused, CircuitBreaker, available liquidity
Borrow	permissionless, over-collateralized	yes	interest per IRM	borrowCap, mmBps, HF ≥ 1.25, $250 min equity
Liquidate	module-gated through either authorized RfqEngine; legacy callers permissionless except for privilegedAccounts, v2 has permissioned liquidator roles	yes	module-defined (liqBonusBps etc.)	HF < 1.25

There are no withdrawal queues, cooldowns, or lockups on the lending path in normal operation — a genuine strength, and a real difference from the staked-ftUSD product, which is rate-limited. All gating here is either liquidity-based or admin-flippable.

Token Mint Authority

Not applicable to the assessed position. An FT Lend supply position is an internal balance on the PositionsManager, not a transferable or mintable token — there are no supply receipts and no mint authority to enumerate.

The relevant mint authority is ftUSD's, because ftUSD is 11.4% of this market's collateral and an unbacked mint would dilute that collateral. In short: the 3/5 admin Safe is ftUSD owner + masterMinter and can register an arbitrary new mint module or replace the minter outright, issuing ftUSD with no backing. Full enumeration in Flying Tulip — ftUSD & Staked ftUSD.

Softener, not a fix: the FT Lend CircuitBreaker can rate-limit post-mint outflows (wrapper withdrawals, redemptions, unstaking), which can slow a dump / run cascade into this market after an unbacked mint. They do not prevent the mint, reverse dilution, or act as an independent check — the same admin Safe owns / can unset those breakers.

Collateralization

• Backing. Borrowing is over-collateralized and enforced onchain via per-asset maintenance margins (ConfigRegistry.assetCfg) and account health (Hf - health factor): marginHfSafeBps = 15000 (1.50), marginHfTargetBps = 12500 (1.25), marginMinEquityUSDWad = 250e18 ($250 minimum position equity).
• Collateral quality. Blue-chip (WETH, WBTC, wstETH, USDC, USDT) plus ftUSD. The blue-chip leg is genuinely high quality; ftUSD (11.4% of TVL) carries the reflexivity above.
• Maintenance margins are thin on stables. mmBps = 150 implies a 1.5% maintenance floor. The documented AMM-depth/volatility dynamic-LTV haircut is not implemented in the deployed ConfigRegistry or PositionsManager; the admin-set constant and account-health target are what the contracts enforce. TRS therefore adds live leveraged use without adding the documented dynamic risk input.
• Liquidations. Onchain, module-gated through the legacy RfqEngine 0xEB00B335…Dc32 and v2 0xc64516d5…7fdb, added August 22. Both are RFQ-routed, module-defined and untested at scale. The v2 path introduces permissioned liquidator roles and makes the Admin Safe the privileged liquidator for the ftUSD strategy. Per the team's own accepted-risk list there is no protocol-level loss backstop / insurance fund for bad debt.
• Reserves are negligible. astate.reserves across all assets: 7.72 USDC, 13.16 USDT, 0.0000257 WETH, 303.01 ftUSD, 0 WBTC. There is effectively no protocol-side buffer to absorb a shortfall.
• Curation. The 3/5 Safe sets every risk parameter — which assets are enabled/collateral/borrowable, maintenance margins, supply/borrow caps, IRMs, and the oracle.

Provability

• Reserves are fully onchain and reconcile exactly. Verified two independent ways at block 25675412: (a) summing every supplier's getBalance across all assets reproduces each astate.totalSupplied and totals $12,127,035; (b) summing debtShares pro-rata reproduces astate.borrows and totals $780,125. The ftUSD backing chain reconciles to the wei (table above). This is a genuine strength — the accounting is honest and independently checkable.
• Oracle — better than "admin-controlled", worse than "canonical Chainlink". Three of six feeds are canonical Chainlink EACAggregatorProxy contracts owned by Chainlink. Three are protocol-deployed wrappers owned by the admin Safe — but with immutable base feeds and adapters, so the owner cannot repoint them:

Asset	Router feed	Type	Wraps	Owner	Staleness	Dev.
USDC	0x8fFfFfd4…18f6	Chainlink EACAggregatorProxy	USDC/USD	Chainlink	88,200s	25 bps
USDT	0x3E7d1eAB…e32D	Chainlink EACAggregatorProxy	USDT/USD	Chainlink	88,200s	25 bps
WETH	0x5f4eC3Df…8419	Chainlink EACAggregatorProxy	ETH/USD	Chainlink	5,400s	50 bps
WBTC	0x183dB475…DA55	ChainlinkLatestAnswerProxy	Chainlink BTC/USD + Aave CLSynchronicityPriceAdapterPegToBase	3/5 Safe	88,200s	50 bps
wstETH	0x000bb128…f35a	ChainlinkLatestAnswerProxy	Chainlink ETH/USD + Aave WstETHPriceCapAdapter	3/5 Safe	5,400s	50 bps
ftUSD	0xA69f7a38…DFf8	FtUsdMintRedeemOracleProxy	Chainlink USDC/USD × MintAndRedeem redeem factor	3/5 Safe	86,400s	0 bps

Using Aave's audited peg and cap adapters for WBTC and wstETH is a sound choice and better than a raw feed. The residual concerns are: the owner can setPaused(true) on any wrapper (a price-denial, not a price-forgery, path); ftUSD's price is blind to its own backing (the redeem factors are functions of the USDC price and cumulative mint history, not of the collateral) and carries a 0 bps deviation tolerance; and WBTC's 88,200s (24.5h) staleness window is long for a 39.5%-of-TVL asset.

• The real override is at the router. OracleRouterChainlink 0xe4372dB4…674A exposes setLastGoodPrice(asset, price) to its owner — the 3/5 Safe — which writes an arbitrary price directly, bypassing every adapter safeguard above. setPriceFeed, setStaleFallback, setPriceDeviation and setOwner are likewise owner-only; disablePrice is guardian-only. Immutable adapters do not constrain this path.
• Source availability. All 20 assessed contracts are source-verified on Etherscan (Appendix B). No public GitHub repo for the lending or ftUSD code, and no public audit reports, so review is limited to reading verified bytecode.

Liquidity Risk

Lender-exit frame: a supplier leaves via withdraw against available (un-borrowed) wrapper liquidity. Secondary-market depth for ftUSD is noted below only as context for the ftUSD collateral/supply leg — it does not exit a USDC/WETH/WBTC lending position.

• Exit mechanism. Suppliers withdraw against available wrapper liquidity: 2.903M USDC of 3.140M supplied (7.6% utilized), 1.181M USDT of 1.404M (15.9%), 736.58 of 736.92 WETH (0.05%), all 75.18 WBTC (0%), 1.110M of 1.428M ftUSD (22.3%). Exit is instant today; borrowed funds are unavailable until repaid or liquidated. Utilization is the primary liquidity constraint.
• Depth of the market. Thin absolutely: largest pool is WBTC at $4.79M, then USDC at $3.14M. Supply receipts are internal balances (normal for lending); no transferable receipt to sell.
• Concentration is the dominant liquidity risk. Only 25 addresses hold the entire $12.13M. Excluding the protocol's own Delta-Neutral strategy, three genuinely third-party addresses hold 96.1% of the $8.11M third-party TVL:

Supplier	Type	USD	% of total TVL	% of third-party TVL	Holdings
0xef6953…ae0d	EOA	$4.62M	38.1%	58.1%	72.18 WBTC + 21.9K USDC
0xe0E445…1A59	protocol strategy	$4.38M	35.1%	—	2.78M USDC + 1.42M USDT + 76.5 wstETH
0x666130…701c	Safe	$1.87M	15.4%	23.5%	1.43M ftUSD + 237.4 WETH
0x0d5dc6…4e83	Safe	$1.15M	9.5%	14.5%	485.1 WETH + 245.2K USDC
21 others	mixed	$0.31M	2.5%	3.9%	—

• Borrowing is one account. 11 addresses carry debt; the same EOA 0xef6953…ae0d holds 72.7% of all outstanding debt ($567K across USDC/USDT/ftUSD) while being the largest supplier. It is simultaneously the market's biggest lender, biggest borrower, and sole WBTC depositor of size. A single account's liquidation, exit, or default is the dominant tail risk.
• Secondary market depth for ftUSD: real, and deeper than the market itself is utilized. The dominant venue is a Curve StableSwap-NG pool:

Venue	Pool	ftUSD side	Quote side	Notes
Curve StableSwap-NG	0xafec61e7…2630	118,921 ftUSD	130,034 USDC	~$249K, A=1000, fee 0.2%; >85% smaller than initial snapshot
Curve Twocrypto	0x68102ff5…ad6c	48,838 ftUSD	FT	FT/ftUSD pair
Uniswap V3 0.05%	0x99986c44…bf2c	0.000033 ftUSD	0.00064 USDC	dust — not a usable venue
Uniswap V3/V2 (other tiers)	—	no pool deployed	—	—

Measured slippage on the Curve pool (get_dy, ftUSD → USDC):

Size	Out	Slippage
10,000 ftUSD	~9,979 USDC	~0.21%
50,000 ftUSD	49,880.65 USDC	0.239%
100,000 ftUSD	99,616.85 USDC	0.383%
150,000 ftUSD	129,378.67 USDC	13.75%

The initial August 6 snapshot supported a $500K exit at 0.30%, but the dominant LP exited on August 28 and the pool fell from ~$1.87M to ~$249K. On September 4, $100K exits at about 0.38%, while $150K incurs about 13.75% slippage. The pool remains an external price signal and exit for ftUSD, but no longer provides deep corroboration. This does not change the FT Lend supplier liquidity score because Curve cannot exit a USDC/WETH/WBTC lending position. ftUSD also circulates as collateral in Morpho (629,675 ftUSD), which is independent third-party acceptance of the asset.

• The supply receipts themselves have no secondary market which is normal for lending protocols. A lender's FT Lend position is an internal balance, not a transferable token, so exit is redemption-only against wrapper liquidity — which is a Spark/Aave withdrawal. The Curve venue above is an exit for ftUSD holders, not for USDC/WETH/WBTC lenders. This distinction matters: it improves the ftUSD collateral leg and the ftUSD-supplier leg, and does nothing for the other 88% of the market.

• Throttles / pause. The admin can pause deposits/borrows/withdrawals per asset (setDepositPaused / setBorrowPaused / setWithdrawPaused); a CircuitBreaker 0x9676E697…18e0 can halt flows; config flags marginRestrictWithdrawToSettlement and marginWithdrawRequiresNoDebt can gate withdrawals (both currently false). The breaker is owned by the admin Safe, each wrapper's setCircuitBreaker is onlyStrategyManager and accepts address(0), and the wrappers expose withdrawBypassCB. It is an operational rate limiter, not a safeguard against the admin.

• Dependency. Exit liquidity for USDC/USDT/WETH/WBTC depends entirely on Spark/Aave withdrawability — zero idle buffer.

• Stress history: none. No drawdown, mass exit, or liquidation cascade has occurred.

Centralization & Control Risks

Governance

A single 3-of-5 Gnosis Safe is the root of all authority, with no timelock.

• Admin Safe: 0x1118e1c057211306a40A4d7006C040dbfE1370Cb — Gnosis Safe v1.3.0, threshold 3 of 5. Signers (undisclosed in docs, presumed team EOAs): 0xB7B54333…08bc8, 0x3c427497…1B4E, 0xf9E5aF16…9a10, 0x09E2B492…7881, 0xD0CA8838…6f5A.
• Guardian Safe: 0x22246a9183cE2CE6e2c2a9973F94aEA91435017C — 3 of 4, signer set a strict subset of the admin Safe. No independent parties.
• WBTC strategy-manager Safe: 0x5557729b169082f07d3131D560E2f2cb5e6c48f6 — a third Safe, 3 of 5, with the identical five signers as the admin Safe. strategyManager of the WBTC wrapper only. Separate address, zero added independence.
• Upgradeability: every core contract is an OpenZeppelin UUPS proxy (EIP-1967 admin slot empty; upgrade gated by owner()/admin()). PositionsManager.admin() is PMWrapper 0xBDD80028…C68B, whose admin() is the same 3/5 Safe and which can upgradePM, setCaps, pause, and withdrawReserves.

With no delay, the 3/5 Safe can: upgrade any contract to arbitrary code, change which assets/caps/margins apply, write an arbitrary oracle price, pause user funds, redirect where lender capital is deployed, and (for ftUSD) authorize a new issuance path that need not enforce collateral, blacklist, and burn balances. The current production mint module is collateralized and no evidence of privileged unbacked issuance was found. There is no timelock, no DAO, and no independent guardian.

Admin powers over FT Lend (verified onchain)

Role	Who	Powers
Owner — ConfigRegistry, OracleRouter, MintAndRedeem, ftUSD Core, CircuitBreaker, all 7 yield wrappers; ftUSD owner/masterMinter/pauser/blacklister	3/5 Safe 0x1118…70Cb	Enable/disable assets, set maintenance margins, set IRMs, set/override oracle prices, upgrade all proxies, mint/seize ftUSD
PositionsManager admin (via PMWrapper)	3/5 Safe	upgradePM, setCaps, setBorrowPaused/setDepositPaused/setWithdrawPaused, setLiquidationModule, setEngine, withdrawReserves, settleEpoch
Guardian — ConfigRegistry, OracleRouter	3/4 Safe 0x22246a…017C	disablePrice, pause
Yield-wrapper strategyManager (6 of 7 wrappers)	3/5 Safe	setStrategy, removeStrategy, setStrategiesOrder, setCircuitBreaker (incl. address(0)), setDepositor, setPutManager
Yield-wrapper strategyManager (WBTC only)	3/5 Safe 0x5557729b…48f6	Same powers over the wrapper holding 39.5% of TVL
Yield-wrapper yieldClaimer	YieldClaimer 0x88432bB6…1397	execute(strategy, to, value, data) — arbitrary call forwarded through the strategy — plus forceWithdrawToWrapper, claimYield
Yield-wrapper treasury	0x9B2F12De…cDe5	setStrategyDelay (UUPS proxy, impl 0xf32adbe8…7d21)
Fee collector / epoch settler	0x5cd6Abe6…958a	Receives reserves/fees, settles epochs (UUPS proxy, impl 0x63176fda…beb5)

strategyDelayConfig is 0 on every wrapper. The two-step setStrategy → confirmStrategy flow exists but its timelock is set to zero, so a strategy manager can register and activate a new strategy — redirecting where lender capital is deployed — in the same block. Combined with execute's arbitrary-call path and the Safe's ability to upgrade the wrapper proxies, custody of supplied assets is fully discretionary.

Privileged engines and modules

Six contracts are now whitelisted on the PositionsManager and can move user balances subject to user/session approvals through engineDebitAllowanceOf / engineHeld. The original four were set in deployment block 24974967; the v2 Trade and TRS engines were added in block 25812534 on August 22. The earlier conclusion that engine privileges had not changed since launch is therefore no longer true:

Contract	Address	Engine	MetaModule	Liquidation module
RfqEngine (legacy)	0xEB00B335…Dc32	✓	—	✓
LeverageRfqEngine (legacy)	0x8263a075…40e2	✓	—	—
MetaActions	0x3633eb60…29f2	✓	✓	—
MetaSessionActions	0x4f83ac5c…3497	✓	✓	—
RfqEngine v2	0xc64516d5…7fdb	✓	—	✓
LeverageRfqEngine v2	0x93496075…6e70	✓	—	—

The v2 leverage engine handles OPEN, CLOSE and collateral-SWAP orders. Its verified implementation requires a user or session signature, consumes borrow/engine allowances, enforces the signed minimum buy amount and checks the account health factor after execution. It also restricts fills to admin-selected permissionedFillers; currently the Admin Safe and the EIP-7702 executor are authorized. That is not direct custody of every lender balance, but it centralizes order availability and execution routing and adds a new way leveraged activity can create debt requiring liquidation.

Execution timing is bounded by expiry, not guaranteed settlement. The current frontend signs TRS orders with validTo = now + 3,600 seconds. The engine rejects a fill only once block.timestamp > validTo and defines no relative minimum or maximum lifetime, so an admin/frontend revision could choose another deadline. A quote can fill in seconds and settles atomically in the fill transaction; an unmatched order may remain pending until cancelled or expiry. There is no protocol guarantee that an RFQ receives a bid within the one-hour window.

Programmability

Lending accounting (supply/borrow indices, health factors) is onchain and the oracle is Chainlink-anchored — good. The offchain/operator surface is nonetheless substantial: the legacy RFQ/relayer/session layer, the new TRS SessionManager, permissioned fillers, the EIP-7702 executor, external quote/routing services, RFQ liquidation, admin-settable oracle prices, epoch settlement by a privileged collector, and — uniquely here — a discretionary strategy contract that decides where ftUSD's backing sits. TRS execution is signed and health-checked onchain, but order discovery, route construction and timely fills remain operational dependencies.

External Dependencies

• Spark & Aave — low counterparty risk, high exposure. Mature, heavily audited venues hold 100% of idle USDC/USDT/WETH/WBTC (deployed() == capital()). A freeze or withdrawal shortfall at either venue blocks lender exits only because FT Lend keeps no idle buffer — that is concentration of exit path, not a judgment that Spark/Aave are risky protocols.
• Chainlink — low counterparty risk. Canonical feeds price solvency for USDC/USDT/ETH; WBTC/wstETH use Chainlink bases plus Aave's audited peg/cap adapters (immutable). Ordinary residual: single feed per asset, no fallback oracle. The high-impact price risk in this system is the admin setLastGoodPrice override, scored under Governance — not Chainlink itself.
• Aave price adapters — CLSynchronicityPriceAdapterPegToBase (WBTC) and WstETHPriceCapAdapter (wstETH) sit in the pricing path for 39.5% of TVL; sound, audited construction.
• FT Lend itself (reflexive) — ftUSD's backing (~$4.38M) is supplied into this market by the Delta-Neutral strategy, and ftUSD is also accepted as collateral here, so the stablecoin and the money market cannot fail independently. See Reflexive supply. This is the unusual dependency — not Spark/Aave/Chainlink.
• TRS / Trade execution — now wired into FT Lend. The new RfqEngine and LeverageRfqEngine are registered directly on the assessed PositionsManager; the former is also an approved liquidation module. TRS therefore reuses lender-funded borrowing and account-level margin rather than operating as an isolated perp venue. It can increase utilization and the volume of accounts that must be liquidated, while successful liquidations still depend on executable RFQ bids.
• External execution venues. The live configuration exposes KyberSwap, Velora and 0x routes, plus internal self-fill and ftUSD MintAndRedeem adapters. A route failure, API outage or loss of permissioned-filler availability can prevent a trade or delay a close; it does not by itself transfer lender assets. The signed minimum output and post-fill health check are the onchain protections. pricingFailureMode = fail_open in the frontend session configuration warrants monitoring because route/pricing-service failure handling is partly offchain.
• Dynamic LTV remains absent. Although Trade/TRS now sources execution from spot liquidity, the deployed ConfigRegistry and PositionsManager still have no AMM-depth, order-book-depth or volatility input. mmBps and the account health thresholds remain admin-set constants. The existence of the new execution engines must not be confused with implementation of the documented dynamic-LTV model.
• Lido / wstETH — a live component of the Delta-Neutral strategy's hedge at the August 6 snapshot (76.54 wstETH financed by 95.01 WETH debt).
• Curve — a StableSwap-NG ftUSD/USDC pool is the independently executable secondary market and external ftUSD price reference. Primary exit is protocol redemption. TRS also exposes ftUSD swap routes, but those are conditional RFQ/adapter routes and are not counted as independent liquidity without a funded executable quote. After the former dominant EOA exited on August 28, pool liquidity fell by more than 85% to ~$249K. Current gauge custody is 87.1% through the Convex voter proxy, 7.1% through an EOA, and 5.6% through CurveYCRVVoter; Convex aggregation does not establish beneficial ownership. Full analysis in the ftUSD report.

Operational Risk

• Team: Founder Andre Cronje (public; founded Yearn, Keep3r, co-founded Sonic/Fantom) strong founder, but mixed reputation on other projects.
• Legal entity / jurisdiction: NOT FOUND / undisclosed (docs reference a "Foundation" with no domicile). CoinList sale excluded the US, Canada and ~21 other jurisdictions.
• Funding: ~$200M seed (Sep 2025, $1B FDV), ~$25.5M Series A (Jan 2026), public sale; the official sale-update blog reports total raised ≈ $184M (below the "$200M seed" headline — a reconciliation gap). FT token (Aug 3, 2026): max supply 10B, mainnet totalSupply() 1,197,190,528, circulating ~547M, price ~$0.0994, market cap ~$54.5M, FDV ~$119M (CoinGecko). FT is an OFT, so mainnet supply is not the cross-chain total.
• Documentation vs. reality gap. Beyond the usual omissions (oracle design, risk parameters, multisig setup), the public material does not clearly disclose that ftUSD's backing is lent into FT Lend. The hedge was inactive at the June snapshot and active by August 6, showing that strategy state can change materially between reviews. TRS's public launch article explains the high-level Lend/Trade/ftUSD relationship, but operational parameters such as the permissioned executor, route set and order lifetime are exposed through the live app/API and contracts rather than durable documentation. The docs' own transparency principle commits to publishing audit reports, which has not happened.
• Incident response: the docs claim "continuous monitoring and formal incident runbooks" and list "incident post-mortems" as a published artefact. No runbook, no post-mortem, and no security contact are public, and there have been no incidents to test the claim. Onchain emergency capability genuinely exists and is broad — per-asset pause, the CircuitBreaker, guardian disablePrice, ftUSD pause and blacklist. The live Sherlock bounty provides a public reporting channel covering deployed Flying Tulip production contracts through the dynamic contract list incorporated by its Additional Scope; Safe Harbor enrolment remains absent.
• Other deployments: Flying Tulip also runs on Sonic, which DeFiLlama puts at $0.52M — 3.8% of protocol TVL against Ethereum's $12.99M (API). It is a separate deployment: none of the contracts assessed here exists on Sonic, so nothing in this report transfers to it, and no Ethereum position is exposed to it. Deliberately out of scope rather than pending — a Sonic allocation would need its own assessment, and at 3.8% of a $13M protocol that is not currently worth the effort.
• Governance transparency: no DAO, no forum/Snapshot, multisig signer identities undisclosed.

Monitoring

Recommended frequency: hourly for pause/circuit-breaker, oracle overrides, and large supply/borrow swings; daily for governance, caps, and the reflexivity ratio.

Contracts to monitor

Contract	Address	Why
PositionsManager	0xbe4050a7…0055	astate per asset, supplyCap/borrowCap, pause flags, EngineSet/MetaModuleSet/LiquidationModuleSet, Upgraded
ConfigRegistry	0xA8777c3D…a33E	Asset enable/disable, mmBps, margins, oracle pointer, Upgraded
OracleRouterChainlink	0xe4372dB4…674A	setLastGoodPrice (arbitrary price write!), setPriceFeed, setStaleFallback, disablePrice, setOwner
Oracle wrapper proxies	WBTC 0x183dB475…DA55, wstETH 0x000bb128…f35a, ftUSD 0xA69f7a38…DFf8	PausedSet, AnswerBoundsSet, MaxStalenessSet — a pause here denies pricing
PMWrapper	0xBDD80028…C68B	upgradePM, setCaps, withdrawReserves
Admin Safe (3/5)	0x1118e1c0…70Cb	Any ExecutionSuccess; AddedOwner/RemovedOwner/ChangedThreshold
Guardian Safe (3/4)	0x22246a91…017C	Pause / disablePrice actions
WBTC strategy-mgr Safe (3/5)	0x5557729b…48f6	Any execution — controls the wrapper holding 39.5% of TVL
CircuitBreaker	0x9676E697…18e0	Trips, ownership changes, removal from wrappers
ftUSD	0xF7D85EC4…9C9C	MinterConfigured, setMaxSupply, Blacklisted, Upgraded; totalSupply vs cap
ftUSD Core	0x56c5892B…8ca9	New module enablement, globalDebtCeiling changes, moduleDebt vs totalSupply drift
MintAndRedeem	0xAa48EcBC…D23C	addCollateral, setCollateralCapFtUSD, fee changes, sweepExcess, recoverERC20
Delta-Neutral strategy	0xe0E44596…1A59	Reflexivity ratio — its FT Lend position as % of TVL; any move of ftUSD backing to a new venue
FT Lend yield wrappers ×7	see Funds Management table	setStrategy/confirmStrategy (no delay!), setCircuitBreaker, execute, available liquidity
TRS LeverageRfqEngine v2	0x93496075…6e70	Upgraded, AdminTransferred, PermissionedFillerUpdated, session/batch-module changes, orders and fills
RfqEngine v2	0xc64516d5…7fdb	Upgrades, RFQ liquidations and fee-parameter changes; now an engine and liquidation module
TRS SessionManager / executor	0x880A371C…071b / 0xa505815A…b9d8	Session creation/revocation/expiry; executor delegation code, availability and route outcomes

Governance monitoring — immediate alert, no timelock means zero warning

Event	Contract	Why it is urgent
ExecutionSuccess	all three Safes	Every privileged action in the system flows through one of these. There is no delay window in which to react after the fact
Upgraded	PositionsManager, ConfigRegistry, ftUSD, ftUSD Core, MintAndRedeem, all 7 wrappers, fee collector, treasury	Arbitrary code replacement
AddedOwner / RemovedOwner / ChangedThreshold	all three Safes	Signer-set change on the root of trust
MinterConfigured / MinterRemoved / MasterMinterChanged	ftUSD	Privileged mint-authority change; verify that the resulting path enforces collateral
module enablement	ftUSD Core	Verify immediately whether the new module independently enforces collateral before minting
EngineSet / MetaModuleSet / LiquidationModuleSet	PositionsManager	Changes who can move approved user balances or set liquidation economics. Two engines and one liquidation-module authorization were added in block 25812534; alert on every further occurrence

Oracle monitoring

• Alert on any setLastGoodPrice on the router — this is the arbitrary-price write and there is no legitimate routine use of it.
• Alert on setPriceFeed, setStaleFallback, setPriceDeviation, setOwner, setGuardian on the router, and disablePrice from the guardian.
• Alert on PausedSet, AnswerBoundsSet, MaxStalenessSet on the three protocol-owned wrapper proxies — a pause denies pricing for that asset entirely.
• Poll priceUSD(asset) against the corresponding Chainlink feed; alert on >0.5% divergence (detects a router override even without catching the event).
• Watch the ftUSD feed specially: it is derived from the USDC price and mint history rather than from ftUSD's collateral, and carries a 0 bps deviation tolerance — it will not register a genuine ftUSD discount or a backing impairment. Compare priceUSD(ftUSD) against the Curve pool's spot price (0xafec61e7…2630, get_dy(0,1,1e6)) — this is the only external reference for ftUSD and the only way to detect the protocol feed drifting from reality. Alert on >0.5% divergence, pool imbalance above 70/30, another 25% liquidity decline from the September 4 baseline, or a $100K quote exceeding 2% impact.

Reflexive-supplier monitoring

• Poll the Delta-Neutral strategy's 0xe0E44596…1A59 getBalance on the PositionsManager for USDC and USDT. Alert if its share of total TVL crosses 40% upward or 10% downward.
• Alert on any change to the strategy's operator set (OperatorSet) — it currently includes a plain EOA.
• Track its WETH debt and account health factor: it is 99.6% of all WETH borrows, so its liquidation would be this market's first at size.
• Deeper ftUSD-side monitoring (backing reconciliation, mint modules, redemption capacity) is specified in the ftUSD report.

Liquidity and exit-capacity monitoring

• Poll each funded wrapper's deployed() and capital(). They are currently equal — alert if Spark or Aave utilization exceeds 95% while that holds, which is the precise condition under which lender exits begin to fail.
• Poll astate(asset).cash per asset as the true instantaneous exit capacity.
• Attribute new borrowing and utilization to TRS where events permit. A sharp rise in TRS open interest can consume the same cash needed by ordinary FT Lend withdrawals; a TRS swap screen is not a substitute exit for a lender's internal supply balance.
• Alert on setWithdrawPaused, setDepositPaused, setBorrowPaused, any CircuitBreaker trip, setCircuitBreaker (especially to address(0)), and any flip of marginRestrictWithdrawToSettlement or marginWithdrawRequiresNoDebt to true.
• Alert on setStrategy / confirmStrategy on any wrapper — strategyDelayConfig is 0, so these can land in the same block with no warning.

TRS / RFQ execution monitoring

• Alert immediately on PermissionedFillerUpdated, AdminTransferred, SessionManagerSet, batch-module changes, or Upgraded on the v2 leverage engine. Re-read executor bytecode after any EIP-7702 delegation change.
• Track OrderBroadcast, PendingOrderOpened, OrderCancelled, OrderFill, and LeverageFillSettled. Measure quote-to-fill latency, expired/unfilled share, partial fills, and realised output versus the signed minimum and contemporaneous external spot price.
• Poll the live configuration for engine, session-manager, executor, aggregator-code, minBuyAmountBps and pricingFailureMode changes. At the September 4 check the defaults were 8,000 bps and fail_open; these are frontend/session guardrails, not immutable engine constants.
• Track fill routes separately: KyberSwap, Velora, 0x, internal self-fill, mintredeem, and composite ftUSD routes. Alert if retired/test/unknown codes execute in production, if one venue dominates, or if an external route fails repeatedly.
• Monitor TRS accounts' health and liquidations alongside ordinary borrowers. Alert if v2 RfqEngine liquidations fail to restore target health, if collateral seizure/repayment diverges from previews, or if bad debt/reserves move after a TRS liquidation.

Position and solvency monitoring

• Track the four dominant addresses via getBalance(user, asset) and debtShares(user, asset); alert on any withdrawal >25% of a position.
• The dominant EOA 0xef6953…ae0d warrants its own alert set: it is 38% of supply and 73% of debt simultaneously, so its health factor is a systemic variable. Poll its account HF and alert below 1.35 (ahead of the 1.25 liquidation threshold).
• Alert on any liquidateFlash execution — none has occurred at size; the first one is a live test of an untested engine.
• Alert if any astate.borrows exceeds astate.totalSupplied for an asset, or if reserves move (they are currently ~$325 in total, so any movement is significant relative to the balance).

Key thresholds / values

• Oracle integrity: alert on any setLastGoodPrice, and on any router priceUSD deviating >0.5% from the corresponding Chainlink feed.
• Governance: alert on any execution by any of the three Safes and any proxy Upgraded event — no timelock means zero warning.
• Reflexivity: alert if the Delta-Neutral strategy's share of FT Lend TVL exceeds 40%, or if ftUSD's supply cap is raised while its backing remains deployed into FT Lend.
• Caps: alert above ~90% of supplyCap — ftUSD is already at 95% — and on every setCaps.
• Concentration: track 0xef6953…ae0d (38% of supply, 73% of debt), 0x666130…701c, 0x0d5dc6…4e83 via getBalance; alert on any withdrawal >25% of a position.
• Exit capacity: alert if wrapper deployed() remains equal to capital() while Spark or Aave utilization exceeds 95% — that is the condition under which exits fail.
• Solvency: monitor liquidations and astate.reserves (currently negligible); alert on any bad-debt socialization event.
• TRS execution: alert on any permissioned-filler or executor-delegation change, >10% expired/unfilled orders over 24h, repeated quote failures, or realised output materially below contemporaneous external spot after fees.

Appendix A: Contract Architecture

GOVERNANCE (no timelock, identical signer set across all three Safes)
  Admin Safe 3/5  0x1118…70Cb ── owns/upgrades ─────────────┐
  Guardian Safe 3/4  0x22246a…017C (subset signers)         │ disablePrice / pause
  WBTC StrategyMgr Safe 3/5  0x5557…48f6 (same 5 signers)   │
        │                                                    ▼
        ▼                                            LEND ENGINE (ftDNMM)
TOKEN / STABLE LAYER                                   PositionsManager (UUPS)
  ftUSD (FiatToken, UUPS)                               ├─ admin via PMWrapper (admin=Safe)
     ▲ mint (module-gated, ceiling 100M)                ├─ config → ConfigRegistry
  ftUSD Core (sole minter)                              │    • per-asset IRM, mmBps, wrapper, flags
     ▲                                                  │    • HF safe 1.50 / target 1.25 / minEq $250
  MintAndRedeem  ── collateral in ──┐                   ├─ oracle → OracleRouterChainlink
  FT token (OFT, unpriced in Lend)  │                   │    ├─ USDC/USDT/ETH → canonical Chainlink
                                    │                   │    ├─ WBTC → CL BTC/USD + Aave peg adapter
                                    │                   │    ├─ wstETH → CL ETH/USD + Aave cap adapter
                                    │                   │    └─ ftUSD → MintAndRedeem redeem factor ⟲
                                    │                   ├─ IRMs: Stable / Major / LongTail
                                    │                   ├─ engines: legacy RFQ/leverage + MetaActions
                                    │                   │           v2 RfqEngine* + TRS LeverageRfqEngine
                                    │                   │           (*second liquidation module)
                                    │                   ├─ sessions: legacy + TRS SessionManager
                                    │                   ├─ TRS permissioned executor (EIP-7702)
                                    │                   └─ CircuitBreaker (owned by Admin Safe)
                                    │                          ▲
   ftUSD-USDC wrapper 0x6aaf…837D ──┤                          │
   ftUSD-USDT wrapper 0x28CC…47D6 ──┘                          │
        └─► MultiCollateralDeltaNeutralStakingStrategy         │
              0xe0E4…1A59  ── deposits 2.77M USDC + 1.42M USDT ┘
              (hedge leg live since ~Aug 3: 76.5 wstETH collateral, 95.0 WETH borrowed)
              ⟲ REFLEXIVITY: ftUSD backing is 35.1% of FT Lend TVL

LEND SUPPLY ROUTING (third-party lenders)          UNDERLYING YIELD
  USDC / USDT / WETH wrappers ──────────────────►  Spark   (deployed == capital, no buffer)
  WBTC wrapper ─────────────────────────────────►  Aave    (deployed == capital, no buffer)
  ftUSD / wstETH / FT wrappers ─────────────────►  no strategy configured

TRS / TRADE (live post-snapshot)
  signed OPEN / CLOSE / SWAP ─► permissioned RFQ executor ─► Kyber / Velora / 0x
                 │                         ├─ internal self-fill
                 │                         └─ ftUSD mint/redeem + composite routes
                 └──────────────► same PM balances, borrows, health checks and liquidations

Appendix B: Source-verification check

The original trust surface was checked via Etherscan getsourcecode on August 3, 2026; the new TRS contracts were checked September 4. Core lending contracts, the v2 engine proxies and their implementations, SessionManager and batch module are source-verified. The permissioned executor is an EIP-7702 account delegating to 0x4428809A…a5c; that delegated implementation was not source-verified on Etherscan or Blockscout at the check. This ancillary execution component does not custody arbitrary lender balances and cannot fill without user/session allowances, so it is treated as an external execution dependency rather than triggering the core-contract gate.

Contract	Address	Implementation (if proxy)
PositionsManager	0xbe4050a7…0055	0xaa3d5fc8…a23b
ConfigRegistry	0xA8777c3D…a33E	0xd25f964e…47e5
ftUSD (FlyingTulipUSD)	0xF7D85EC4…9C9C	0xf47bb65f…1885
ftUSD Core	0x56c5892B…8ca9	0x986841b7…5440
MintAndRedeem	0xAa48EcBC…D23C	0x8852b132…c3c6
MultiCollateralDeltaNeutralStakingStrategy	0xe0E44596…1A59	—
RfqEngine	0xEB00B335…Dc32	—
LeverageRfqEngine	0x8263a075…40e2	—
RfqEngine v2	0xc64516d5…7fdb	0xD5b3B315…4bB4
LeverageRfqEngine v2	0x93496075…6e70	0x6595C190…8734
TRS SessionManager	0x880A371C…071b	—
LeverageRfqBatchModule	0x91Ecc9c9…7Bf24	—
Permissioned executor (EIP-7702)	0xa505815A…b9d8	delegates to unverified 0x4428809A…a5c
MetaActions	0x3633eb60…29f2	—
MetaSessionActions	0x4f83ac5c…3497	—
RelayerAuth	0x823a97a2…53F4	—
SessionManager	0xF9f3ddF2…60f8	—
CircuitBreaker	0x9676E697…18e0	—
YieldClaimer	0x88432bB6…1397	—
Fee collector	0x5cd6Abe6…958a	0x63176fda…beb5
Treasury	0x9B2F12De…cDe5	0xf32adbe8…7d21
Oracle wrapper — WBTC	0x183dB475…DA55	— (immutable base feed + adapter)
Oracle wrapper — wstETH	0x000bb128…f35a	— (immutable base feed + adapter)
Oracle wrapper — ftUSD	0xA69f7a38…DFf8	— (immutable base feed + mintRedeem)
Yield wrappers ×7	see Funds Management table	0xfaed20b3…1157 (ftYieldWrapper)

---

Reassessment Triggers

• Audit status: reassess if any in-scope audit report is published with firm, date and scope, if Sherlock removes or narrows the dynamic production-contract coverage incorporated by the bounty's Additional Scope, or if the protocol enrols in SEAL Safe Harbor.
• Governance hardening: reassess if a timelock is added, if the admin Safe threshold or signer independence materially improves, or if the three Safes are given genuinely distinct signer sets.
• Reflexivity: reassess if the Delta-Neutral strategy's share of FT Lend TVL exceeds 40% or falls below 10%, if ftUSD backing is redeployed to a venue outside FT Lend, or if the hedge target or position changes materially.
• TRS / execution: reassess on any engine, liquidation-module, permissioned-filler, session-manager, batch-module or executor-delegation change; if expired/unfilled orders exceed 10% over 24h; if one route becomes dominant; or after the first material TRS liquidation. Separately, reassess if ConfigRegistry gains a depth/volatility input—the current Trade/TRS engines do not implement the documented dynamic-LTV model.
• Time-based: reassess in 2 months. Shortened from 3: the hedge leg activating mid-assessment showed this market's state can move materially in days on one actor's decision.
• TVL/usage-based: using the August 3 baseline of $7.95M third-party lending TVL, reassess if it grows above ~$24M, falls below ~$2.6M, or if any of the three dominant third-party suppliers exits.
• ftUSD market-based: the prior >50% Curve-liquidity trigger has occurred. For the ftUSD companion report, reassess on another 25% decline from the September 4 baseline, material imbalance (>70/30), or spot divergence >0.5% from priceUSD(ftUSD). This remains context only for most FT Lend suppliers.
• Cap-based: reassess if supplyCap is materially raised on any asset — ftUSD is already 95% subscribed against a 1.5M cap.
• Concentration: reassess if the dominant EOA's share of supply or debt moves by more than 15 percentage points in either direction.
• Incident-based: reassess after any exploit, bad-debt event, failed TRS/RFQ settlement, oracle override (setLastGoodPrice), oracle-wrapper pause, proxy upgrade, ftUSD depeg or unbacked mint, new ftUSD Core module enablement, or any Spark/Aave/aggregator incident affecting an active route or strategy.

---