Strata

Contract Addresses

Core Ethena USDe Market Contracts (Ethereum)

Contract	Address	Type
srUSDe (Senior Tranche)	0x3d7d6fdf07EE548B939A80edbc9B2256d0cdc003	ERC-4626 Meta Vault, Upgradeable Proxy
jrUSDe (Junior Tranche)	0xC58D044404d8B14e953C115E67823784dEA53d8F	ERC-4626 Vault, Upgradeable Proxy
StrataCDO	0x908B3921aaE4fC17191D382BB61020f2Ee6C0e20	Core Orchestrator, Upgradeable Proxy
Accounting	0xa436c5Dd1Ba62c55D112C10cd10E988bb3355102	TVL calculations, fee accrual
sUSDeStrategy	0xdbf4FB6C310C1C85D0b41B5DbCA06096F2E7099F	Deposits into Ethena sUSDe Vault
ERC20Cooldown	0xd6dAD17d025cDdDEd27305aEbAB8b277996A6fAF	Token lockup for cooldown period
UnstakeCooldown	0x735edDF50Ca2371aa48466469C742e684c610F74	sUSDe unstaking cooldown
SUSDeCooldownRequestImpl	0x00A96056c30A22b684fF7a09F4A0AfEaE426dde2	Cooldown workflow for sUSDe
TrancheDepositor	0x50E850641F43F65BF8fB3a7d0CF082a1D252F47e	Routes deposits into tranches
AprPairFeed	0x2bb416614D740E5313aA64A0E3e419B39e800EC2	Benchmark & Collateral APY inputs
AaveAprPairProvider	0x1c137776e04803F807616c382AbBA12d9BF0AF73	Fetches APR values from Aave
AccessControlManager	0x1d19E18ECaC4ef332a0d5d6Aa3a0f0f772605f60	Role-based access control
TwoStepConfigManager	0x0f93bAC77c3dDD1341d3Ecc388c5F8A180818994	Two-step exit-fee governance

Governance & Multisig Contracts

Contract	Address	Configuration
Admin Multisig	0xA27cA9292268ee0f0258B749f1D5740c9Bb68B50	3-of-4 Gnosis Safe, cold wallets, internal team + founding contributors
Operational Multisig	0x4be3749a0F6557b8fd98F3967e859DbD7C694eF4	2-of-3 Gnosis Safe, internal team
Timelock (48h)	0xb2A3CF69C97AFD4dE7882E5fEE120e4efC77B706	Proposer: Admin Multisig. Canceller: Guardian
Timelock (24h)	0x4f2682b78F37910704fB1AFF29358A1da07E022d	Strategy config changes
Guardian	0x277D26a45Add5775F21256159F089769892CEa5B	Patrick Collins (Cyfrin CEO) -- can cancel timelock transactions

Proxy Infrastructure

Contract	ProxyAdmin
srUSDe	0x30a17D6bcBdbf1579D6FbBA453aCf776d01fBb50
jrUSDe	0x89d2573471Dc0BF81c7c553fFfc1E31Ce9E75BF1
StrataCDO	0xcAb791D0D44eBaC17378fF2AF6356c012F15c9e6
sUSDeStrategy	0x32D0D70A8dA4c0c2f354a986fD3738aFe92542f7
Accounting	0x25A733FEBA393A48C07a76441777324B471d212E
ERC20Cooldown	0xeD6c7b379F73DF0618406d263b13b2386E398166

All proxy admins are owned by the 48h Timelock (0xb2A3CF69C97AFD4dE7882E5fEE120e4efC77B706).

On-Chain Verification

All core contracts are verified on Etherscan:

Contract	Etherscan Name	Proxy
srUSDe	TransparentUpgradeableProxy → Tranche (impl 0xe894055ca1c73648927e225f3ca38ed48e30210b)	Yes
jrUSDe	TransparentUpgradeableProxy → Tranche (impl 0xe91869f96806b480dd61d57e17919068d35ac09c)	Yes
StrataCDO	TransparentUpgradeableProxy → StrataCDO (impl 0xb3d4f2c2123f8c3ca85ae7a6d48aa2ef049c79ba)	Yes
sUSDeStrategy	TransparentUpgradeableProxy → sUSDeStrategy (impl 0x2b9796606c8480312a572742c00f606ef4adb107)	Yes
Accounting	TransparentUpgradeableProxy → Accounting (impl 0x5a8d34d785b5008cce9b9f4aaa0e445f6959cbff)	Yes
AccessControlManager	AccessControlManager	No
Admin Multisig	GnosisSafeProxy	Yes
Operational Multisig	SafeProxy	Yes
48h Timelock	StrataMasterChef (OZ TimelockController)	No
24h Timelock	StrataMasterChef (OZ TimelockController)	No
Guardian	EOA (not a contract)	N/A

Note: Both timelocks are registered on Etherscan as StrataMasterChef but contain standard OpenZeppelin TimelockController functions (schedule, execute, cancel, getMinDelay). Delays are 172,800 seconds (48h) and 86,400 seconds (24h). Each proxy contract has its own dedicated ProxyAdmin, all owned by the 48h Timelock.

Upgrade history (Upgraded events on each proxy): srUSDe, jrUSDe, StrataCDO, and sUSDeStrategy were last upgraded on December 6, 2025 (block 23956716); Accounting was last upgraded on February 23, 2026 (block 24519364). No srUSDe-market implementation has been replaced since.

Audits and Due Diligence Disclosures

Strata has completed an extensive, multi-phased audit process with 3 reputable firms across at least 8 distinct audit engagements, per the protocol's audits page.

Audit History

#	Firm	Date	Scope	C	H	M	L	Info	Report
1	Cyfrin	Oct 8, 2025	Protocol v1 (Tranches)	1	2	6	5	12	PDF
2	Guardian Audits	Oct 10, 2025	Protocol v1 (Tranches)	1	5	14	5	8	PDF
3	Quantstamp	~Q4 2025	Protocol v1 (Tranches)	-	-	-	-	-	Certificate
4	Quantstamp	~Q4 2025	Redemption Fee (Update to Tranches)	-	-	-	-	-	Certificate
5	Cyfrin	Jan 23, 2026	Coverage-aware redemption / Shares Cooldown mechanism	0	0	6	3	10	PDF
6	Quantstamp	~Q1 2026	Discrete accounting mechanism	-	-	-	-	-	Certificate
7	Cyfrin	Jun 11, 2025	Pre-Deposit Vaults	1	1	3	16	9	PDF
8	Quantstamp	~2025	Pre-Deposit Vaults	-	-	-	-	-	Papermark

Quantstamp reports hosted on JS-rendered platforms; finding counts require browser access. Dashes indicate data not programmatically extractable.

Total findings across Cyfrin + Guardian reports: 3 Critical, 8 High, 29 Medium, 29 Low (all resolved).

Coverage gap: no published audit covers the Neutrl, Midas, Saturn, or Hastra PRIME markets. Protocol docs state the tranche contracts share the srUSDe codebase, but each market ships its own Strategy, Accounting, and APR-provider contracts — the market-specific code is unaudited in public reports.

Notable Critical/High findings (all resolved):

• C: Withdrawers of sUSDe always incur a loss (Cyfrin #1) -- Inverted parameters in Tranche::_withdraw caused users to receive significantly less than entitled
• C: Reserve withdrawal unit mismatch (Guardian #2) -- StrataCDO.reduceReserve forwarded incorrect amounts, breaking internal accounting
• C: Attacker can drain entire protocol sUSDe balance (Cyfrin #6) -- Incorrect redemption accounting in pre-deposit vault could drain funds
• H: Withdrawal active requests DoS (Cyfrin #1, Guardian #2) -- Spam tiny withdrawal requests on behalf of another user causing out-of-gas during finalization
• H: MEV APR front-run (Guardian #2) -- Front-running of APR changes via onAprChanged
• H: JR tranche bankrun susceptibility (Cyfrin #5) -- SharesCooldown finalization bypassed minimumJrtSrtRatio

Guardian Audits recommended an independent follow-up review after finding 1 Critical + 5 High issues, which was conducted by Quantstamp.

On-Chain Complexity

The architecture is moderately complex:

• CDO Pattern: Core orchestrator (StrataCDO) connects tranches, accounting, and strategy contracts
• Multiple Proxy Contracts: Most core contracts use OpenZeppelin TransparentUpgradeableProxy
• Cooldown Mechanisms: Two-stage withdrawal with ERC20Cooldown and UnstakeCooldown contracts
• APR Feed System: Onchain APR calculation using Aave data feeds
• Multi-token deposits: The srUSDe Meta Vault accepts USDe, sUSDe, USDT, USDC, and DAI

Bug Bounty

Strata has an active Immunefi bug bounty with a $250,000 maximum smart-contract reward, paid in USDC on Ethereum. The program has been live since October 1, 2025 and was last updated July 8, 2026. Its scope covers current and future Solidity files in the listed core-contract directories plus the cooldown, tranche-depositor, and exit-fee components; critical impacts include direct theft, permanent freezing, and protocol insolvency.

Historical Track Record

• Time in Production: srUSDe proxy deployed October 2, 2025 (block 23492392). In production for ~10 months as of August 5, 2026. Pre-deposit vaults with TVL existed from July 2025.
• GitHub Repository: Development moved repositories. The original Strata-Money/contracts-tranches (created September 16, 2025) received its last push on February 25, 2026 and is frozen. The current Strata-Markets/contracts repository, created February 26, 2026, is public and actively developed; its latest push was August 4, 2026.
• TVL History (DeFiLlama, protocol-wide totals):

Period	TVL	Notes
Jul 2025	~$18M	Pre-deposit vaults / soft launch
Aug 2025	$18M - $53M	Steady growth
Sep 2025	$53M - $172M	Rapid growth
Oct 8, 2025	~$326M	Peak TVL (ATH)
Oct 13, 2025	~$110M (srUSDe market only)	Official launch on Ethena USDe
Jan 8-17, 2026	$230M → $122M	First sharp drawdown (~$108M outflow in ~10 days; -62.6% from peak)
Apr 2-4, 2026	$242M → $114M	Second sharp drawdown (-53% in 2 days)
Apr 23-25, 2026	$119M → $84M	Third sharp drawdown (-29% in 2 days)
Jun 26, 2026	$83.3M → $67.6M	Fourth sharp drawdown (−19% in a single day)
Aug 5, 2026	~$75.8M	Current (~77% below ATH)

• TVL Volatility: The protocol has experienced four distinct large drawdown events (Jan, early Apr, late Apr, and Jun-Jul 2026), each shedding 19-55% of TVL within days. Peak-to-current decline is ~77%, and the trough-to-current recovery since July 15 is +50%. The repeated boom-bust pattern is consistent with large depositor concentration and is likely driven in part by points-program farming behavior — the single-day ±16-19% steps in June and July are the signature of individual whale entries and exits rather than broad retail flow.
• Incidents: No reported security incidents, exploits, or hacks.
• Governance Activity:
  • 48h Timelock: 74 CallScheduled, 74 CallExecuted, 0 Cancelled events since deployment (event counts, not operation counts — a batched operation emits one event per call). The July 21, 2026 operation calling setReserveBps(0) on SaturnAccounting 0x180f7b3b… executed on July 30, 2026 (tx 0xcb220999…). It targets the Saturn USDat market, not srUSDe.
  • 24h Timelock: 0 CallScheduled and 0 CallExecuted events since deployment in October 2025.
• Exchange Rate and Tranche Sizes (block 25689464):
  • srUSDe convertToAssets(1e18) = 1.028479213064204045 USDe per srUSDe
  • srUSDe totalAssets() = 59,081,900 USDe; totalSupply() = 57,445,886 srUSDe
  • jrUSDe totalAssets() = 6,635,632 USDe; totalSupply() = 6,219,341 jrUSDe (price per share 1.0669)
  • Senior:Junior asset ratio ~8.90:1; system collateralization ~111.2% of senior assets — above the 105% circuit breaker
  • Exchange-rate growth of approximately +0.68% over the 78 days to August 5 annualizes to ~3.2%

Funds Management

Deposit/Withdrawal Flow

Deposit: Users deposit USDe (or sUSDe, USDT, USDC, DAI) into the srUSDe Meta Vault. Deposited assets are exchanged for shares proportional to the current exchange rate and passed to the sUSDeStrategy, which stakes them into Ethena's sUSDe vault.

Entry-asset distinction: A USDe holder entering srUSDe adds Strata's smart-contract and tranching risk on top of an existing USDe position. A USDC or other stablecoin holder entering srUSDe, whether by swapping first or through the vault's multi-token route, additionally takes Ethena/USDe risk before taking Strata risk. The junior tranche protects the srUSDe position after entry; it does not make USDe equivalent to the depositor's original stablecoin. This is a strategy and portfolio-allocation consideration, not an additional Strata protocol risk.

Withdrawal: The redemption path depends on the token the user exits into. sUSDeStrategy.getSupportedTokens() returns sUSDe and USDe.

1. Exit in sUSDe — atomic, no cooldown. sUSDeStrategy.withdraw routes to ERC20Cooldown.transfer(..., cooldownSeconds) where cooldownSeconds is sUSDeCooldownSrt for the senior tranche. Both sUSDeCooldownSrt() and sUSDeCooldownJrt() read 0, and ERC20Cooldown.cooldownDisabled(sUSDe) reads true. In the contract, cooldownSeconds == 0 takes an early-return branch that performs an immediate safeTransferFrom and emits Finalized in the same transaction. The senior tranche has been configured this way since deployment (October 2, 2025); the junior tranche's 7-day cooldown was zeroed on December 11, 2025 (tx 0xb887bdbf…). 173 Finalized events since block 25,500,000 confirm redemptions settling in one transaction in practice.
2. Exit in USDe — ~1 day. Routes through UnstakeCooldown, which triggers Ethena's own sUSDe cooldown. Ethena reduced sUSDe.cooldownDuration() from 604,800 seconds (7 days) to 86,400 seconds (1 day) on March 16, 2026 (tx 0x05856199…).
3. Each withdrawal request is handled independently per user; new requests do not extend or affect earlier requests.

The senior tranche's zero cooldown is a governance-mutable parameter, not a structural property: sUSDeStrategy.setCooldowns is callable by UPDATER_STRAT_CONFIG_ROLE (48h and 24h Timelocks) and can reinstate a cooldown up to a hard-coded 7-day maximum. A 48h-timelocked action can therefore convert srUSDe from an instantly redeemable position into a 7-day-locked one.

Accessibility

• Deposits: Permissionless. Anyone can deposit USDe, sUSDe, USDT, USDC, or DAI
• Redemptions: Permissionless. Atomic when exiting in sUSDe; ~1 day when exiting in USDe via Ethena's unstaking cooldown
• Deposit limit: StrataCDO.maxDeposit(srUSDe) = ~51.5M USDe of remaining senior headroom. This is not a fixed cap — it is derived from minimumJrtSrtRatioBuffer (6%), so senior capacity is jrtNav / 0.06 minus current senior NAV and shrinks as the junior tranche shrinks. maxDeposit(jrUSDe) is unbounded
• Fees: Exit fees are onchain: exitFeeSrt() = 2.5e14 (0.025%) for senior and exitFeeJrt() = 1e15 (0.1%) for junior. Exit-fee changes are governed by a two-step process via TwoStepConfigManager

Collateralization

• Backing: srUSDe is backed by the underlying USDe/sUSDe staked in Ethena's vault, with additional over-collateralization from the junior tranche (jrUSDe) which serves as first-loss capital. sUSDeStrategy holds 53,023,275 sUSDe, worth 65,862,142 USDe per sUSDeStrategy.totalAssets(). This reconciles against the tranches: 59,081,900 senior + 6,635,632 junior = 65,717,532 USDe of tranche NAV, with the ~145K remainder held as protocol reserve
• Senior coverage ratio: ~111.2% (senior + junior assets / senior assets). The circuit breaker is enforced by Accounting.minimumJrtSrtRatio() = 5e16, i.e. junior NAV must stay ≥ 5% of senior NAV, equivalent to a 105% coverage floor. A separate minimumJrtSrtRatioBuffer() = 6e16 (6%) gates new senior deposits ahead of the hard floor. Current junior/senior ratio is 11.23%, so the tranche retains a little over half its junior buffer before deposits gate and before the hard floor
• Underlying collateral: USDe is Ethena's synthetic dollar backed by a delta-neutral strategy (ETH/BTC spot + short perpetual futures). Ethena maintains proof of reserves via third-party verification
• Risk hierarchy: Senior tranche (srUSDe) is paid first in the base asset, while the junior tranche absorbs losses before senior holders. Once junior capital is depleted, senior holders are exposed to any subsequent loss in the underlying USDe/sUSDe position
• Automatic shortfall pause: StrataCDO.jrtShortfallPausePrice() = 1e16, so deposits to both tranches auto-pause only once the junior price per share reaches 0.01 USDe. This is a terminal backstop, not an early-warning control: the 5% minimumJrtSrtRatio floor and 6% senior-deposit gate are the operative tranche-protection controls
• Reserve mechanism: Accounting.reserveBps() = 5e16, which in this contract is WAD-scaled (PERCENTAGE_100 = 1e18), so 5% — applied to gains, not to TVL, and hard-capped at RESERVE_BPS_MAX = 0.1e18 (10%). RESERVE_MANAGER_ROLE is currently held only by the 24h Timelock, whose executor route is not configured. The 48h Timelock is a DEFAULT_ADMIN_ROLE holder on the AccessControlManager and can grant or reassign RESERVE_MANAGER_ROLE through a 48h-delayed action. StrataCDO.treasury() is additionally unset, so reserve withdrawal would require both role remediation and a treasury configuration

Provability

• Exchange rate: Calculated onchain via ERC-4626 standard (convertToAssets()/convertToShares()). Anyone can verify
• Underlying sUSDe balance: Verifiable onchain by checking the strategy's sUSDe holdings
• Yield calculation: DYS mechanism computes yields onchain using the AprPairFeed contract. Benchmark rate sourced from Aave v3 Core. However, risk-premium parameters (x, y, k) are set by the team
• Accounting: Onchain Accounting contract tracks raw TVL, balances, inflows/outflows, fees, and reward distribution for both tranches

Liquidity Risk

Primary Exit Mechanisms

1. Redeem from srUSDe vault into sUSDe: Atomic — no Strata cooldown and no Ethena unstaking, settled in a single transaction. This is the deepest and fastest exit, and it inherits sUSDe's own liquidity
2. Redeem from srUSDe vault into USDe: ~1 day, gated by Ethena's cooldownDuration() of 86,400 seconds
3. DEX swap: Negligible onchain DEX liquidity — ~$80.3K across 40 pools with ~$3.2K of 24h volume (GeckoTerminal). Largest is a Uniswap V4 srUSDe/USDe 1.01% pool at ~$45.5K. No Curve or Balancer pools exist. CoinGecko does not list srUSDe
4. Pendle markets: The PT-srUSDe-25JUN2026 market expired June 25, 2026. One active srUSDe market remains: PT-srUSDe-22OCT2026 (market 0x66ec657c…, PT 0x59bc9fae…), $4.60M LP liquidity at a 3.97% implied APY (Pendle API). A parallel jrUSDe market (0x78f6927a…) holds $0.57M. These trade the fixed-yield PT, not raw srUSDe
5. Morpho markets: The raw srUSDe/USDe market (0xc184c2aa…) has $0 supply and $0 borrow. All PT-srUSDe markets are dust (largest is PT-srUSDe-15JAN2026/USDC at ~$37.5K on an expired PT). No srUSDe/USDC market exists on Morpho — see the note on Yearn use case #2 below

Withdrawal Restrictions

• Cooldown period: None for sUSDe redemptions; ~1 day for USDe redemptions. Both are governance-mutable — setCooldowns can reimpose up to 7 days on the Strata side, and Ethena independently controls its own cooldownDuration
• Coverage protection binds junior, not senior: Accounting.maxWithdraw caps junior redemptions so junior NAV cannot fall below 5% of senior, and the 6% buffer gates new senior deposits. Neither restricts senior redemptions — maxWithdraw(srUSDe) returns the full srtNav
• Pause is the real restriction: StrataCDO.maxWithdraw returns 0 whenever actionsSrt.isWithdrawEnabled is false, and setActionStates is callable instantly by the 2-of-3 Operational Multisig with no timelock
• Self-balancing: The coverage mechanism is designed to be self-balancing -- thinner junior coverage attracts more liquidity via higher junior yields

Liquidity Assessment

• Primary liquidity: The redemption path is the main exit and it is fast — atomic in sUSDe, ~1 day in USDe. For a $59.1M senior tranche sitting on $65.9M of strategy assets, redemption capacity is effectively the full position rather than a rationed queue
• Secondary market: Secondary venues are thin. Pendle at $4.60M covers ~7.8% of senior TVL; DEX pools at ~$80.3K are immaterial; Morpho srUSDe markets are empty
• Large holder impact: Large holders can exit at scale through redemption, which is what the June-July outflows demonstrate — the protocol shed ~$49M of TVL between June 1 and July 15 without a queue backlog or a depeg
• Same-value redemption: srUSDe redeems for USDe or sUSDe (both stablecoin-denominated), so price-impact risk on exit is minimal
• Note on Yearn use case #2: the intended "srUSDe as collateral on Morpho for srUSDe/USDC markets" does not currently exist onchain. The only raw srUSDe market on Morpho Blue is srUSDe/USDe at 92% LLTV with zero supply and zero borrow. Using srUSDe as Morpho collateral would require a new market to be created and seeded

Centralization & Control Risks

Governance

Strata uses a layered Role-Based Access Control (RBAC) system in the AccessControlManager (0x1d19E18ECaC4ef332a0d5d6Aa3a0f0f772605f60). The contract is not AccessControlEnumerable — getRoleMemberCount reverts — so holders are resolved by hashing each role string with keccak256 and querying hasRole(role, address) against every known principal. Where the table diverges from the protocol documentation, the onchain result is authoritative.

Role	Onchain Holder(s)	Description	Key Functions
DEFAULT_ADMIN_ROLE (0x0000…)	48h Timelock + 24h Timelock	AccessControlManager super-admin (can grant/revoke any role)	grantRole, revokeRole, grantCall, revokeCall
PAUSER_ROLE	Operational Multisig (2/3) (docs state Admin Multisig — docs are wrong)	Pause/resume deposits and redemptions	StrataCDO::setActionStates, StrataCDO::setJrtShortfallPausePrice
UPDATER_FEED_ROLE	Operational Multisig (2/3)	Trigger APR refresh and recalculation	Accounting::onAprChanged, AprPairFeed::updateRoundData
UPDATER_CDO_APR_ROLE	AprPairFeed contract + EOA 0x1f3aab5b…	Push APR updates into the CDO	Accounting::onAprChanged (internal-only path)
UPDATER_STRAT_CONFIG_ROLE	48h Timelock + 24h Timelock (docs list 24h only)	Update strategy risk parameters and cooldowns	Accounting::setRiskParameters, sUSDeStrategy::setCooldowns
RESERVE_MANAGER_ROLE	24h Timelock only	Redistribute reserves or withdraw to treasury	StrataCDO::reduceReserve, StrataCDO::distributeReserve, StrataCDO::setReserveTreasury
PROPOSER_CONFIG_ROLE	Admin Multisig (3/4)	Propose exit-fee configuration changes	TwoStepConfigManager::scheduleExitFeeChange
DEPOSITOR_CONFIG_ROLE	Operational Multisig (2/3)	Configure the TrancheDepositor accepted-token whitelist and routing	TrancheDepositor::* config
COOLDOWN_WORKER_ROLE	sUSDeStrategy + 24h Timelock + EOA 0x99fe6bb5…	Finalize cooldown unstakes on behalf of the strategy	ERC20Cooldown/UnstakeCooldown worker hooks
Ownable owner() (not a role in ACM)	48h Timelock	High-level protocol configuration on Ownable contracts (StrataCDO, srUSDe, jrUSDe, Accounting, sUSDeStrategy all return 48h Timelock as owner())	Accounting::setAprPairFeed, setReserveBps, setFeeRetentionBps, setMinimumJrtSrtRatio[Buffer], UnstakCooldown::setImplementations, AprPairFeed::setProvider/setRoundStaleAfter

Multisig and timelock details:

• Admin Multisig (0xA27cA929…): 3-of-4 Gnosis Safe (getThreshold() = 3), 4 owners.
• Operational Multisig (0x4be3749a…): 2-of-3 Gnosis Safe (getThreshold() = 2), 3 owners. Two of its three signers also sit on the Admin Multisig — the two safes are not fully independent.
• 48h Timelock (0xb2A3CF69…): getMinDelay() = 172,800. PROPOSER → Admin Multisig; CANCELLER → Admin Multisig + Guardian; EXECUTOR is open (zero-address holds the role, so anyone can execute after the delay). 74 CallScheduled / 74 CallExecuted / 0 Cancelled events.
• 24h Timelock (0x4f2682b7…): getMinDelay() = 86,400. PROPOSER → Admin Multisig; CANCELLER → Admin Multisig (Guardian is not assigned CANCELLER on the 24h timelock); EXECUTOR is unset — the executor list at deployment was empty per constructor calldata, the zero-address sentinel was never granted, and no principal has been granted since. Consequently 0 CallScheduled and 0 CallExecuted events in the contract's ~10-month lifetime — see finding below.
• Guardian (0x277D26a4…): Patrick Collins (Co-Founder & CEO of Cyfrin). Externally-owned account. Holds CANCELLER_ROLE on the 48h Timelock; does not hold CANCELLER on the 24h Timelock and does not hold any role in the AccessControlManager.

Key concerns:

• Admin Multisig is only 3-of-4 (relatively low threshold) and Operational Multisig is only 2-of-3 (low threshold). Two signers overlap between the two safes, reducing key-set independence.
• All multisig keys held by internal team -- no external/independent signers.
• Pause is fast and low-threshold: Operational Multisig (2/3, internal-only) can pause the protocol immediately with no timelock. This is good for emergency response but means a 2-of-3 internal-key compromise can halt user activity. Deposits and withdrawals are currently enabled for both tranches (actionsSrt and actionsJrt both return (true, true)).
• Reserve management's assigned 24h route is unavailable: RESERVE_MANAGER_ROLE sits on the 24h Timelock, whose executor route is not configured. The 48h Timelock's DEFAULT_ADMIN_ROLE on the AccessControlManager provides a slower recovery path: it can grant or reassign RESERVE_MANAGER_ROLE after a 48h-delayed Admin Multisig proposal.
• Redemption speed is a governance parameter: UPDATER_STRAT_CONFIG_ROLE (both timelocks) can call sUSDeStrategy.setCooldowns to reimpose a cooldown of up to 7 days on senior redemptions. srUSDe's current instant-exit property is a configuration choice that a 48h-timelocked action can reverse.
• 24h Timelock route is not configured for execution: no executor was granted at deployment (verified by inspecting both hasRole(EXECUTOR_ROLE, …) for all principals including the zero address, and the deployment-tx constructor calldata which shows executors = []). Consequently, the 24h route for RESERVE_MANAGER_ROLE and UPDATER_STRAT_CONFIG_ROLE is unavailable. For srUSDe, this is an operational and documentation gap rather than a direct fund-safety issue: the working 48h Timelock holds the same UPDATER_STRAT_CONFIG_ROLE and the relevant Ownable powers, and can reassign operational roles through its AccessControlManager super-admin authority.
• No onchain governance yet (planned for future).

Programmability

• srUSDe exchange rate: Calculated onchain via ERC-4626 standard. Programmatic, no admin input needed
• Yield distribution (DYS): Mostly programmatic. AprPairFeed fetches benchmark rate from Aave onchain. However, risk-premium parameters (x, y, k) are set by the team initially
• APR updates: Triggered by Operational Multisig via updateRoundData. This is a manual trigger for an onchain computation
• Accounting: Fully onchain. TVL, balances, fees, and reward distribution tracked programmatically
• Withdrawals: Programmatic cooldown mechanism. No manual intervention needed after initiation

External Dependencies

Dependency	Type	Criticality	Impact of Failure
Ethena (sUSDe/USDe)	Yield source & collateral	Core underlying exposure	All deposited assets staked in Ethena's sUSDe vault. An Ethena insolvency, USDe depegging, or sUSDe exploit would be reflected in srUSDe; junior capital absorbs losses first
Aave v3 Core	Benchmark rate oracle	High	Supply-weighted average of USDC/USDT lending rates used for benchmark. While the pushed round is stale, a failed provider read reverts APR-dependent deposit and redemption accounting until an authorized fresh push or provider replacement
Monitoring stack	Internal and third-party monitoring	Medium	Security documentation describes continuous anomaly detection and protective responses, but does not identify every current vendor or publish service-level guarantees

Underlying exposure: srUSDe is intentionally a tranche over Ethena's sUSDe. All senior assets sit in sUSDe, so an Ethena insolvency, USDe depeg, or sUSDe exploit would be reflected in srUSDe after junior capital absorbs losses first. This is the product's underlying asset exposure, not a separate protocol-specific critical finding.

Benchmark rate path: AprPairFeed prefers a pushed round (sourcePref = Feed) but falls back to reading the provider live once a round is older than roundStaleAfter() = 14,400s (4h). The last pushed round dates to May 7, 2026, roughly 90 days stale, so the operative path today is a live read of AaveAprPairProvider, which returns a current timestamp on every call. There is no automatic alternate provider. Because Accounting.updateBalanceFlow() fetches APRs after deposits and redemptions, a failed live Aave read can revert those transactions until the Operational Multisig supplies a fresh pushed round or governance replaces the provider. No principal is deposited into Aave.

Shared governance with sister markets: Strata runs six live markets, each with its own CDO/Strategy/Accounting stack but sharing srUSDe's multisigs and timelocks. Only one aspect of this is an srUSDe risk — the shared 48h Timelock queue. Its July 30, 2026 execution targeted the Saturn market's Accounting contract, so sister-market changes flow through the same governance path that can upgrade srUSDe, and reviewers monitoring that timelock must triage operations that have nothing to do with this token. The sister markets are not srUSDe dependencies and their yield sources create no exposure for srUSDe holders.

Operational Risk

• Team Transparency: Vishvendra Singh Dhayal was introduced as co-founder and CEO of Frontera Labs, the developer behind Strata, in a May 24, 2026 podcast (LinkedIn). Ramiro Gamen (LinkedIn) appears among the employees listed on Frontera Labs' company page — a self-published source, so weaker evidence than the podcast. Patrick Collins (Cyfrin CEO) is separately identified as Guardian. Protocol documentation does not map any of these individuals to multisig keys or day-to-day control responsibilities
• Documentation: Comprehensive docs at docs.strata.markets covering mechanism, technical architecture, contracts, roles, and risks, with contract tables for all six markets. However, the roles page remains out-of-date with onchain state — it claims PAUSER_ROLE is held by the Admin Multisig and that UPDATER_STRAT_CONFIG_ROLE sits only on the 24h Timelock; onchain, PAUSER_ROLE is held by the Operational Multisig and UPDATER_STRAT_CONFIG_ROLE is held by both timelocks. Yearn should treat onchain hasRole results as authoritative
• Legal Structure: Frontera Labs, Inc., a Delaware (USA) corporation, operates the Interface (front-end) only. The company explicitly disclaims ownership or control of the protocol smart contracts. Protocol contracts are licensed under BUSL-1.1. A planned transition to a Cayman Islands foundation is referenced in the Terms of Service (last updated Nov 28, 2025). US users are geo-blocked. Contact: legal@strata.markets
• Incident Response: Not formally documented, but the protocol has multiple layers of defense:
  • Continuous internal and third-party onchain monitoring, with documented automatic protective responses; current vendors and service-level details are not fully disclosed
  • Guardian (Patrick Collins) can cancel timelock transactions on the 48h Timelock
  • Operational Multisig (2/3) can pause the protocol immediately (no timelock)
• Open Source: Contracts are public and actively developed at Strata-Markets/contracts, with repository activity through August 4, 2026. The migration from the older Strata-Money/contracts-tranches repository in late February 2026 was not announced in the docs changelog, so third parties tracking the original repo would incorrectly conclude development had stopped
• Points Program: Strata runs a "Strata Points Program" (incentive/airdrop mechanism). Repeated TVL boom-bust cycles in Jan/Apr 2026 are consistent with points-program farming behavior

Monitoring

srUSDe Vault Monitoring

• srUSDe contract: 0x3d7d6fdf07EE548B939A80edbc9B2256d0cdc003
  • Monitor convertToAssets(1e18) for exchange rate changes (should only increase)
  • Alert: If exchange rate decreases -- indicates potential issue with yield distribution or losses
  • Monitor Deposit, Withdraw events for large deposits/withdrawals (>$1M)
  • Alert: Single deposits/withdrawals >$5M (potential whale activity)

StrataCDO Monitoring

• StrataCDO: 0x908B3921aaE4fC17191D382BB61020f2Ee6C0e20

  • Monitor the junior/senior NAV ratio against Accounting.minimumJrtSrtRatio() (5%) and minimumJrtSrtRatioBuffer() (6%); currently 11.23%
  • Alert: junior/senior ratio below 6% (senior deposits gate) and below 5% (hard coverage floor)
  • Monitor actionsSrt() / actionsJrt() for pause state and setActionStates calls
  • Monitor StrataCDO.maxDeposit(srUSDe) for senior deposit headroom; currently ~51.5M USDe

• sUSDeStrategy redemption config: 0xdbf4FB6C310C1C85D0b41B5DbCA06096F2E7099F

  • Monitor sUSDeCooldownSrt() and CooldownsChanged events; currently 0 (atomic sUSDe redemption)
  • Alert: any non-zero sUSDeCooldownSrt — srUSDe would cease to be instantly redeemable
  • Monitor Ethena sUSDe.cooldownDuration() and CooldownDurationUpdated events; currently 86,400s
  • Alert: any increase in Ethena's cooldown duration (lengthens the USDe exit path)

Strategy Monitoring

• sUSDeStrategy: 0xdbf4FB6C310C1C85D0b41B5DbCA06096F2E7099F
  • Monitor sUSDe balance held by strategy
  • Alert: If strategy balance drops significantly relative to total deposits

Governance Monitoring

• Admin Multisig: 0xA27cA9292268ee0f0258B749f1D5740c9Bb68B50

  • Monitor for owner/signer changes and threshold modifications
  • Alert: Immediately on any signer replacement or threshold change

• 48h Timelock: 0xb2A3CF69C97AFD4dE7882E5fEE120e4efC77B706

  • Monitor CallScheduled, CallExecuted, Cancelled events
  • Alert: Immediately on any CallScheduled event (48h window to review changes)

• 24h Timelock: 0x4f2682b78F37910704fB1AFF29358A1da07E022d

  • Monitor CallScheduled, CallExecuted, Cancelled events
  • Alert: On any CallScheduled event (24h window for strategy config changes)

Ethena Dependency Monitoring

• USDe peg: Monitor USDe price on DEXes
  • Alert: If USDe deviates >0.5% from $1.00 peg
  • Alert: If USDe deviates >2% from $1.00 peg (critical -- srUSDe value directly impacted)
• sUSDe vault: Monitor Ethena's sUSDe vault for any anomalies, cooldown period changes

Monitoring Frequency

Category	Frequency	Priority
Timelock scheduled calls (both 48h and 24h)	Real-time	Critical
Proxy upgrade events	Real-time	Critical
Multisig signer/threshold changes	Real-time	Critical
srUSDe exchange rate	Every 6 hours	High
Senior coverage ratio	Every 6 hours	High
USDe peg stability	Hourly	High
Strategy sUSDe balance	Daily	Medium
Protocol TVL changes	Daily	Medium

Reassessment Triggers

• Time-based: Reassess in 60 days (per reassessment-scan threshold) or sooner if any of the below trigger
• TVL-based: Reassess if TVL changes by more than 50% (from current ~$75.8M)
• Repository-based: Track Strata-Markets/contracts, not the frozen original repo; the feat/multi-strategy-dys branch would change the srUSDe strategy architecture if merged and deployed
• Incident-based: Reassess after any exploit, governance change, collateral modification, or Ethena incident
• Dependency-based: Reassess if Ethena modifies sUSDe mechanics, cooldown periods, or undergoes significant changes
• Bug bounty: Reassess if the Immunefi program's scope, status, or $250,000 maximum reward materially changes
• Governance-based: Reassess when onchain governance is activated, when risk-premium parameters transition to independent managers, or if the 24h-Timelock executor route is configured
• Redemption-speed-based: Reassess immediately if sUSDeStrategy.sUSDeCooldownSrt() becomes non-zero or Ethena raises sUSDe.cooldownDuration() — the Liquidity score depends directly on both
• Coverage-based: Reassess if the junior/senior NAV ratio falls below 6% (senior deposit gate)
• Market expansion: Reassess if the Neutrl/Midas/Saturn/Hastra markets receive separate audits, if a further market is launched, or if any of them experience an incident (operational spillover risk to srUSDe)
• Pendle liquidity: Reassess if/when new Pendle markets are created or if the PT-srUSDe-22OCT2026 market expires
• Morpho-based: Reassess if an srUSDe/USDC market is created on Morpho Blue, since Yearn use case #2 depends on it