Superstate USTB

Contract Addresses

All addresses verified onchain August 17, 2026.

Contract	Address
USTB Token (Proxy)	0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e
USTB Implementation (FundToken, VERSION "1.3.0")	0xb3ac55dd09aa70e9bfbb12f45cd38a1f1597588c
USTB ProxyAdmin	0xb9d285dcad879513dc9c1a3b2e0cccb21c3c2146
AllowList V3.1 (Proxy)	0x02f1fa8b196d21c7b733eb2700b825611d8a38e5
AllowList Implementation (Allowlist, VERSION "3.1")	0x2f67d98bd20d9580f52efa5ff70edaed9f2f316d
AllowList ProxyAdmin	0xb819692a58db9dd4d3b403a875439b6ca155c610
Superstate Continuous Price Oracle (not a proxy)	0xe4fa682f94610ccd170680cc3b045d77d9e528a8
Chainlink USTB NAV/Share Oracle	0x289B5036cd942e619E1Ee48670F98d214E745AAC
RedemptionIdle (Proxy)	0x4c21b7577c8fe8b0b0669165ee7c8f67fa1454cf
RedemptionIdle Implementation	0x8efba8af37af48d2e0a04b0aae60f0e9bc8de007
RedemptionIdle ProxyAdmin	0xcaba8c12873fffed13431d98bf6b836dff08e869
USDC Sweep Destination (EOA)	0x774AE279c21B6a17a6E2BD5ab5398FF98F398807

Owner Addresses

The system is controlled by 4 distinct EOAs (all code size 0, no multisig, verified August 17, 2026):

Role	Address
USTB Token Owner + USTB ProxyAdmin Owner	0xad309bb6f13074128b4f23ef9ea2fe8552afca83
AllowList Owner + AllowList ProxyAdmin Owner	0x7747940adbc7191f877a9b90596e0da4f8deb2fe
RedemptionIdle Owner + RedemptionIdle ProxyAdmin Owner	0x8cf40e96e7d7fd8A7A9bEf70d3882fbBC4D40765
Oracle Owner	0x4B1df64357a5D484563c9b7c16a80eD8B8fB1395

Audits and Due Diligence Disclosures

Superstate has undergone 16 security audits from 5 firms (0xMacro ×11, Zellic ×2, ChainSecurity, Offside Labs, Certora), making this one of the most extensively audited RWA tokenization protocols. However, none of them scope the implementation currently deployed for USTB — see "Audit coverage gap on the live implementation" below.

Audit History

#	Firm	Date	Scope	Key Findings
A-1	0xMacro	Jul 2024	Redemption contract	2M (1 fixed, 1 won't do — USDC peg assumption)
A-2	0xMacro	Jul 2024	USTB/USCC Token + AllowList	1M (fixed — EIP-2612 non-compliance), 8 code quality
A-3	0xMacro	Nov 2024	Liquidation, Oracle, Token V2	3M (all fixed — oracle underflow, SafeERC20, deploy scripts)
A-4	0xMacro	Nov 2024	Token + Redemption V2	2H (fixed — redemption fee bypass, subscribe allowlist bypass), 1M (fixed)
A-5	0xMacro	Jan 2025	Token V3 + Redemption	No H/M/L issues — cleanest EVM audit
A-6	0xMacro	Apr 2025	Token + Redemption updates	No H/M/L issues
A-7	0xMacro	May 2025	Solana Allowlist Program	2C (fixed — ownership validation bypass), 1H (fixed — PDA frontrunning DOS)
A-8	0xMacro	May 2025	Equity Token (new product)	1H (fixed — incorrect event source)
A-9	0xMacro	Jul 2025	AllowlistV3 (EVM)	No issues found — cleanest audit
A-10	0xMacro	Nov 2025	DIP (Direct Issuance Protocol), Dippable, EquityToken	3L (1 addressed, 2 acknowledged), 4 code quality, 2 informational. No C/H/M
A-11	0xMacro	Feb 2026	DIP v1.1, Dippable, EquityToken	No issues or discrepancies found
--	Zellic	Feb 17, 2026	AllowlistV4_0, FundToken, SuperstateTokenCore + components, RedemptionV2 / RedemptionIdleV2 / RedemptionYieldV2, SuperstateOracle, Dip, EquityToken	6 findings: 4 Low, 2 Informational. No Critical / High / Medium
--	Zellic	Jun 23, 2026	AllowlistV4_2, FundTokenV1_2_0, EquityTokenV1_4_0, AccountingPausable / Bridgeable / Redeemable / Subscribable / Scalable / Dippable, ERC20MetadataSettable, Dip	2 findings: 1 Medium (v5.1→v1.2.0 migration dropped the accounting-pause flag — fixed in commit 6216afed), 1 Informational (fixed). No Critical / High
--	ChainSecurity	2023	Compound SUPTB (original token)	2 Critical (fixed — encumbrance transferability, transferFrom permission bypass)
--	Offside Labs	May 2025	Solana Allowlist program	6 findings — thaw-IX account-check bypass, PDA init failure, excessive rent, rent-refund logic, admin-authority DoS, permissionless-init frontrunning
--	Certora	Apr 21–28, 2025	Solana Allowlist program (program/src/*, api/src/*), commit cab1688 → fix 9d357c8	1 Critical + 1 High + 4 Informational, all 6 fixed. C-01: process_thaw() did not check allowlist accounts, letting anyone thaw any account. H-01: grief vector on create_pda_account

Total findings across all audits: 3 Critical, 5 High, 8 Medium — all fixed or acknowledged with rationale. The Solana allowlist thaw bypass was independently found by three firms (0xMacro A-7, Offside Labs §4.1, Certora C-01) in the same May-2025 window, and fixed.

Correction on Certora. Prior versions of this report listed Certora as "formal verification — mathematical verification of contract properties" with no date or scope. The actual Certora report is a manual security assessment of the Solana Allowlist program, not formal verification, and not of the EVM contracts. Its own methodology section states "The team performed a manual audit." No formal verification of the USTB EVM contracts is evidenced by any published Superstate document.

Audit coverage gap on the live implementation: the deployed USTB implementation is FundTokenV1_3_0 (0xb3ac55dd…, VERSION() == "1.3.0", deployed July 21, 2026).

• v1.3.0 is not covered by any published audit. Zellic's February 2026 engagement scoped token/src/fund/FundToken.sol; its June 2026 engagement scoped token/src/fund/v1.2.0/FundTokenV1_2_0.sol at commit 1b6d2c63. The deployed contract is a different, later version, shipped one day after v1.2.0 went live. The v1.2.0 → v1.3.0 delta has no public audit coverage and cannot be independently reviewed.
• The delta cannot be diffed. The v1.3.0 source is verified on Etherscan, but it is not published in a public repository — superstateinc/ustb was last pushed April 2025 and still contains the legacy SuperstateToken code, and the audited repository superstateinc/superstate-evm-audit returns 404 (private). There is no public v1.2.0 source to diff the deployed v1.3.0 against.
• What this does and does not mean. Zellic's reviews cover the architecture, component model, and migration path that v1.3.0 inherits, and the one Medium finding (accounting-pause state dropped during migration) is demonstrably fixed in the deployed bytecode — the remediation comment appears verbatim in the Etherscan-verified source. So the deployed code is not unreviewed in substance. But no auditor has attested to the exact bytecode holding ~$775M, and the size of the v1.2.0→v1.3.0 change is unknown to any outside party. TODO: obtain the v1.3.0 changelog or an audit scoped to the deployed version.

Smart Contract Complexity: Moderate-to-high. The July 2026 upgrade replaced the monolithic SuperstateTokenV5_1 with a modular FundToken built from ERC-7201 namespaced components (AccountingPausable, Allowlistable, Bridgeable, Permittable, Redeemable, Subscribable, ERC20MetadataSettable) shared with Superstate's EquityToken. V5.1-compatible getters (accountingPaused(), allowlistV2(), redemptionContract(), supportedChainIds(), SUPERSTATE_TOKEN_PRECISION) are retained so existing integrations and monitoring keep working.

Storage migration (verified onchain). initializeV1_2_0 does not read the new ERC-7201 namespaces — it reads the legacy v5.1 contiguous slots directly via sload and replays them into the new namespaced layout. This is the storage-layout-sensitive pattern that produced Zellic's one Medium finding. The slot map is stated in the deployed source's own comments and confirmed by reading the proxy's storage at block 25,773,912:

Slot	Field	cast storage value	Matches getter
754	accountingPaused	0x…0000	accountingPaused() == false ✓
755	maximumOracleDelay	0x…0e10 (3600)	maximumOracleDelay() == 3600 ✓
756	superstateOracle	0x…e4fa682f94610ccd170680cc3b045d77d9e528a8	superstateOracle() ✓
758	allowlistV2	0x…02f1fa8b196d21c7b733eb2700b825611d8a38e5	allowlist() ✓
759	redemptionContract	0x…4c21b7577c8fe8b0b0669165ee7c8f67fa1454cf	getRedemptionContract() ✓

Reproduce with cast storage 0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e <slot> --block 25773912. Note that slot 757 is unused by the migration, and that these legacy slots are not zeroed after migration — they retain stale copies while the live values sit in the ERC-7201 namespaces.

Bug Bounty

• Platform: Self-hosted (security@superstate.co)
• Formal Rewards: None — "Superstate does not have a formal reward policy. Researchers should not expect compensation for discovering vulnerabilities."
• Safe Harbor: CFAA and DMCA safe harbor language for good-faith researchers
• Note: The lack of formal monetary rewards is a weakness compared to Immunefi-style programs

Safe Harbor

Superstate is not listed on the SEAL Safe Harbor registry. This is typical for regulated RWA issuers.

Historical Track Record

• Fund Launch: February 2024 on Ethereum (~30 months in production)
• Contract Deployment: December 6, 2023 (block 18,725,909)
• Contract Upgrades: The USTB proxy has taken 10 implementation upgrades since deployment (Upgraded events on the proxy). The most recent two came a day apart in July 2026 and replaced the legacy SuperstateToken line entirely: FundTokenV1_2_0 on July 20, 2026 and FundTokenV1_3_0 on July 21, 2026. The AllowList remains on V3.1 (0x2f67d98b…) and RedemptionIdle on its original implementation (0x8efba8af…) — neither has been upgraded, despite AllowlistV4_x and RedemptionV2 having been audited.
• Smart Contract Exploits: None. No security incidents, hacks, or exploits reported.
• Price History: NAV/Share has increased monotonically from ~$10.00 (inception) to $11.177748 (August 17, 2026), consistent with steady Treasury yield accrual. ATL: $10.29 (Feb 2025), ATH: $11.177748 (current).
• Pause History: The token was paused on December 7, 2023 and unpaused on May 14, 2024 — the pre-launch/early-operations window. No pause events since. Accounting pause has never been engaged.
• Admin Burn History: adminBurn() has been exercised twice: September 5, 2025 for 611,410.45 USTB (~$6.6M at then-NAV) from 0xcfc50541…, and June 4, 2026 for 167.41 USTB from 0xc95e7dfc…. The forced-burn capability is therefore operationally live, not dormant.
• AllowList Revocation Precedent: On September 5, 2025 Superstate revoked Morpho Blue's (0xbbbbbbbb…) protocol permission for USCC, alongside 0x4095f064…. USTB protocol permissions have not been revoked, but this confirms the revocation power is used in practice against integrated DeFi protocols.
• AUM Growth:
  • Feb 2024: Launch
  • Oct 2024: ~$114M (LlamaRisk assessment, October 2024)
  • Apr 2025: Sky executive vote onboards USTB to the Spark Liquidity Layer (Spark Tokenization Grand Prix) with a 300M USDC deposit rate-limit ceiling; Spark subscribes ~$300.1M over five tranches in April and fully exits in July 2025
  • Mar 2026: Invesco partnership announced — Invesco Advisers becomes external investment manager, BNY Mellon replaces UMB Bank as custodian. ~$650M+ total AUM, ~$572M onchain TVL (DeFiLlama)
  • Apr 2026: onchain USTB TVL peaks at ~$923.8M (April 28, DeFiLlama)
  • Jun 2026: $948.1M total AUM, 85.32M shares outstanding, NAV $11.112749 (Superstate NAV API, June 13)
  • Jul 2026: Token migrated from SuperstateTokenV5_1 to the FundToken architecture over two consecutive upgrades
  • Aug 2026: $953.8M total AUM, 85.33M shares, NAV $11.177748. Ethereum onchain 69.31M USTB (~$775M); DeFiLlama USTB TVL ~$781.7M. DeFi integrations verified onchain: Aave Horizon aToken ~6.08M USTB (~$68.0M), Midas RedemptionVault ~5.68M USTB (~$63.5M), Frax FrxUSDCustodian ~2.94M USTB (~$32.9M)
• Holder Distribution: 78 onchain holders on Ethereum (Ethplorer, August 17, 2026). Top 10 holders hold ~86.5% of supply, with the single largest holder — an EOA (0x0a4956a9…, entity ID 2406) — at 31.95%. This concentration is expected for an institutional-grade permissioned fund. Top holders include EOAs (institutional investors, custodial wallets) and smart contracts (Aave Horizon, Midas, Frax).
• Incidents: None. No hacks, exploits, or adverse events involving Superstate or USTB.

Funds Management

Yield Sources

1. U.S. Treasury Bills — Primary holding. At least 95% of the fund invested in short-duration (< 1 year maturity) U.S. Treasury Bills and Agency securities.
2. Cash — Up to 5% held in cash for liquidity facilitation.

The fund uses a laddered approach with holdings spread across various near-term maturities for liquidity and interest rate management. The published portfolio (as of July 24, 2026) is 36 U.S. Treasury Bill positions totalling $819,521,318 — 99.93% of the fund — with maturities laddered from July 30, 2026 to January 7, 2027, all inside one year. Current yields on the individual bills run 2.99%–3.93%. No non-Treasury security appears in the portfolio.

Supply vs reserves reconciliation: published holdings of $819,521,318 (July 24, 2026) against a same-day reported AUM of $819,950,719.30 leaves a residual of ~$429K (0.05%), consistent with the stated 99.93% holdings coverage and a small cash balance. Independently, Ethereum totalSupply() of 69,310,953.05 USTB × the official NAV of $11.177748 = ~$775M, matching DeFiLlama's Ethereum USTB figure of ~$774.8M and the ~81% Ethereum share of 85,330,728 total outstanding shares. The disclosed reserves account for the full share count.

Accessibility

• KYC Required: Yes — investors must be Qualified Purchasers ($5M+ in investments for individuals, $25M for institutions) AND Accredited Investors. Full KYC/AML screening required.
• Subscriptions (Minting):
  • Onchain atomic: subscribe() function atomically transfers USDC and mints USTB at the Continuous NAV/S price. Available 24/7. Shares are delivered immediately for USDC orders, including non-business days.
  • Offchain: USD wire transfer, same-day for wires received before 5:00 PM ET.
  • Max subscription fee: 0.1% (10 bps), configurable per stablecoin. Currently set to 0.
• Redemptions (Burning):
  • Onchain atomic: Via RedemptionIdle contract, burns USTB and sends USDC at Continuous NAV/S price. USDC instant redemption facility with variable capacity (8,738,475 USDC as of August 17, 2026, verified onchain via balanceOf() — ~1.1% of Ethereum USTB). Superstate announced "$10M USDC instant redemption facility, refilled twice daily" on the Aave governance forum (Jan 2025), but docs only state: "USDC liquidity will be replenished in this contract regularly" — the actual onchain balance varies significantly.
  • Offchain: Transfer tokens to contract address or call offchainRedeem(). Proceeds in USDC or USD wire. USDC payouts are delivered same-day, including non-business days, subject to available liquidity; USD wires are same-day if requested before 1:00 PM ET.
  • Book-entry conversion: bridgeToBookEntry() burns tokens onchain and moves the shares to Superstate's book-entry register, an additional non-USDC exit from the token wrapper.
  • Redemption fee is 0 (redemptionFee() verified onchain), capped at 10 bps by the contract.
• Geographic Restrictions: Available to qualified purchasers in the U.S. and select offshore jurisdictions (Cayman Islands, BVI, Bermuda). Not available to sanctioned countries.
• Management Fee: 0.15% annually for all investors. The Investment Manager rebates 0.10% monthly on average daily holdings above $25M. No performance fee or performance allocation.

Collateralization

• Backing Model: Offchain — USTB tokens represent shares in a fund that holds U.S. Treasury Bills and Agency securities at The Bank of New York Mellon (systemically important U.S. custodian bank, replacing UMB Bank as of the Invesco partnership).
• Collateral Quality: U.S. Treasury Bills are considered the lowest-risk financial instrument globally — backed by the full faith and credit of the U.S. government.
• Investment Manager: Invesco Advisers, Inc. — a subsidiary of Invesco Ltd. (publicly traded, $1.7T+ AUM) — handles daily portfolio management, replacing Federated Hermes as of the March 2026 partnership. No sub-advisor.
• Bankruptcy Remoteness: The fund is a separate legal entity (series within a Delaware Statutory Trust) with inter-series liability protection, bankruptcy-remote from Superstate Inc.
• Verification: PricewaterhouseCoopers LLP conducts annual audits. NAV Fund Services provides independent NAV calculation. Line-item portfolio holdings are published publicly and can be reconciled against onchain supply.

Provability

• NAV/Price Updates: The Superstate Continuous Price Oracle (0xe4fa682f94610ccd170680cc3b045d77d9e528a8) extrapolates real-time prices using linear interpolation between NAV/S checkpoints. Updates every second, 24/7/365. Compatible with Chainlink AggregatorV3Interface. Checkpoint expiration: 5 days — if the Oracle Owner does not post a new checkpoint within 5 days, latestRoundData() reverts with StaleCheckpoint(), which causes both subscribe() and redeem() to revert, freezing all onchain USTB operations. The 5-day window covers weekends and U.S. holidays. Note: Since prices are linearly interpolated between checkpoints, the onchain price is an estimate that may diverge from the actual NAV between checkpoint updates — the price catches up only when the next checkpoint is posted by Superstate.
• Chainlink NAV Feed: Chainlink provides an independent NAV/Share data feed (0x289B5036cd942e619E1Ee48670F98d214E745AAC), 6 decimals. Its August 17, 2026 answer of $11.177748 matches the official daily NAV exactly, providing a cross-check on the Superstate oracle's interpolated price.
• Onchain Supply: Total USTB supply is verifiable onchain via totalSupply().
• Offchain Assets: The underlying Treasury portfolio is held offchain at BNY Mellon. Token holders cannot verify the specific Treasury holdings onchain, but they can now verify them offchain against a public, unauthenticated feed:
  • Independent NAV calculation by NAV Fund Services
  • Annual audit by PricewaterhouseCoopers LLP
  • Public line-item holdings, daily NAV, AUM, share count, and yield via the Superstate fund API (no login required)
  • Redundant record-keeping across fund calculation agent, internal records, and onchain records
  • Chainlink Proof of Reserves was described as in development by LlamaRisk in October 2024 and is still not live for USTB nearly two years later — reserve attestation remains issuer-published rather than onchain
• Reserve Transparency: Superstate publishes NAV, AUM, share count, yield, and full line-item portfolio holdings publicly, both on superstate.com/assets/ustb and through an open API — daily NAV, yield, and holdings. Each holding row carries security name, base value/cost, maturity date, current yield, and percent of fund. This closes the prior gap where granular holdings were only visible inside the authenticated investor portal. Two caveats remain: holdings are published as a dated snapshot (July 24, 2026 as of this assessment — roughly a 3-week lag) and are marked unaudited, and the data is self-reported by the issuer with no independent attestation between the annual PwC audits. The fund is structured under SEC exemptions with regulatory reporting requirements.

Liquidity Risk

• Primary Exit: Onchain atomic redemption via RedemptionIdle contract at Continuous NAV/S price, 0 fee. USDC instant redemption capacity varies (8,738,475 USDC as of August 17, 2026, verified onchain — ~1.1% of Ethereum USTB, regularly refilled).
• Secondary Exit: Offchain redemption via wire transfer or USDC. USDC payouts are delivered same-day including non-business days, subject to available liquidity; USD wires same-day if requested before 1:00 PM ET.
• Tertiary Exit: bridgeToBookEntry() converts tokenized shares into book-entry shares held directly with Superstate, removing the smart-contract wrapper without a cash redemption.
• DEX Liquidity: None. USTB has $0 24h trading volume on DEXs. Not listed on any exchanges. This is by design — the token is a regulated fund product, not a freely tradeable token. Superstate's own risk disclosures state Tokenized Shares "are not listed on any exchange or trading system and may only be transferred through limited peer-to-peer transactions," that the buyer pool is narrow, and that holders "may be unable to sell their Shares in a timely manner or at all."
• Transfer Restrictions: All transfers require both sender and receiver to be on the AllowList. Removing an address from the AllowList effectively freezes their tokens.
• DeFi Integrations (Liquidity Venues), verified onchain August 17, 2026:
  • Aave Horizon: USTB accepted as collateral to borrow USDC, GHO, RLUSD. The aHorRwaUSTB aToken (0x4e58a2e4…, pool 0xAe05Cd22…) holds 6,080,210.17 USTB (~$68.0M) — the largest contract holder and 8.77% of supply. Uses LlamaGuard NAV Oracle (risk-adjusted, built with Chainlink).
  • Midas RedemptionVault (0x569d7dcc…): 5,675,392.49 USTB (~$63.5M), 8.19% of supply
  • Frax FrxUSDCustodian (0x5fbaa3a3…): 2,941,516.81 USTB (~$32.9M), 4.24% of supply
  • BitGo: a WalletSimple multisig (0xbd02c511…) holds 4,483,832.09 USTB (~$50.1M), consistent with the documented tri-party derivative collateral role
  • Spark Protocol / Sky: the Spark ALM Proxy (0x1601843c…) holds 0 USTB and has done since July 2025 — see "Spark's entry and full exit" below. Spark's current Superstate exposure is to the sister fund USCC, not USTB, onboarded by the October 16, 2025 Sky executive with a 100M USDC deposit ceiling. Grove, the other Sky allocator with a SUPERSTATE_FACET in its ALM module set, holds 0 USTB and is not on the USTB AllowList (entity ID 0).
  • M^0 Protocol: USTB designated as first eligible collateral for all M^0 network stablecoins (MetaMask mUSD, Noble USDN)
  • FalconX: USTB used as prime brokerage trading collateral
• Stress Scenario: In a scenario requiring large-scale redemption, liquidity depends on Superstate's ability to sell the underlying Treasury portfolio (highly liquid) and process USDC conversions via Circle. T-Bills are among the most liquid financial instruments globally, mitigating this risk. The onchain instant facility covers only ~1.1% of Ethereum supply, so any exit above ~$8.7M falls back to the offchain same-day path and Superstate's operational discretion.

AllowList Freeze Risk (Critical for DeFi Integrations)

If an address is removed from the AllowList, the USTB tokens held by that address are completely frozen with zero exit paths:

1. transfer() reverts — AllowList checks sender AND receiver
2. transferFrom() reverts — same AllowList check
3. Onchain redemption via RedemptionIdle reverts — requires AllowList status
4. offchainRedeem() reverts — requires AllowList status
5. DEX swap impossible — $0 liquidity AND DEX contracts would also need AllowList permission

There is no fallback exit mechanism. The only recovery path is to contact Superstate to be re-whitelisted, or have Superstate perform an adminBurn() and process a manual offchain redemption.

Implications for Yearn: Yearn's vault/strategy contract must be whitelisted by Superstate via protocol address permissions. If Superstate removes this permission (regulatory action, policy change, sanctions, dispute, or operational error), Yearn's entire USTB position becomes frozen and unredeemable. This is a fundamentally different risk profile from permissionless DeFi tokens where DEX liquidity provides a fallback exit.

Onchain verification (August 17, 2026): Confirmed that DeFi protocols integrating USTB are individually whitelisted on the AllowList with assigned entity IDs — Aave Horizon aToken 0x4e58a2e4… (entity 734), Midas RedemptionVault 0x569d7dcc… (entity 114), Frax FrxUSDCustodian 0x5fbaa3a3… (entity 48). Maple Finance's protocol contracts are NOT whitelisted — Maple's USTB collateral is held by borrowers in their own wallets as offchain collateral arrangements, not locked in Maple smart contracts.

The freeze power is not hypothetical. On September 5, 2025 Superstate called setProtocolAddressPermission(0xbbbbbbbb…, "USCC", false), revoking Morpho Blue's protocol permission for its sister fund USCC (a second address, 0x4095f064…, was revoked in the same window). USCC runs on the same AllowList contract and the same admin EOA — see the separate Superstate USCC assessment. No USTB protocol permission has been revoked to date, but a live precedent exists for a whitelisted DeFi protocol's permission being withdrawn by unilateral admin action.

Centralization & Control Risks

Governance

Governance Model: Fully centralized — Superstate Inc. controls all administrative functions. No onchain governance, no DAO, no community voting.

Key Privileged Roles (verified onchain, August 17, 2026):

Role	Address	Type	Powers
USTB Token Owner + USTB ProxyAdmin Owner	0xad309bb6f13074128b4f23ef9ea2fe8552afca83	EOA	mint, bulkMint, adminBurn, pause/unpause, accountingPause/accountingUnpause, setOracle, setStablecoinConfig, setRedemptionContract, setChainIdSupport, setMaximumOracleDelay, and — new in FundToken v1.3.0 — setAllowlist, setIsPublicInstrument, setName, setSymbol. Can upgrade() / upgradeAndCall() USTB token implementation via ProxyAdmin.
AllowList Owner + AllowList ProxyAdmin Owner	0x7747940adbc7191f877a9b90596e0da4f8deb2fe	EOA	setEntityIdForAddress, setEntityAllowedForPublicInstrument, setEntityAllowedForPrivateInstrument, setProtocolAddressPermission. Can upgrade() AllowList implementation via ProxyAdmin.
RedemptionIdle Owner + RedemptionIdle ProxyAdmin Owner	0x8cf40e96e7d7fd8A7A9bEf70d3882fbBC4D40765	EOA	pause/unpause, setRedemptionFee, setSweepDestination, setMaximumOracleDelay, withdraw (extract USDC). Can upgrade() RedemptionIdle implementation via ProxyAdmin.
Oracle Owner	0x4B1df64357a5D484563c9b7c16a80eD8B8fB1395	EOA	addCheckpoint / addCheckpoints (set NAV price), setMaximumAcceptablePriceDelta. Oracle is not a proxy — cannot be upgraded.

Critical centralization concerns:

1. EOA-controlled administration — The system is controlled by 4 distinct EOAs, each with no multisig, no timelock, and no governance delay. The USTB Token Owner (0xad309bb6f13074128b4f23ef9ea2fe8552afca83) controls minting, burning from any address, pausing all operations, changing the oracle, and upgrading the USTB contract implementation. Separate EOAs control the AllowList, RedemptionIdle, and Oracle — splitting control across more keys reduces single-key blast radius but none have multisig protection.
2. Admin burn capability — The owner can call adminBurn(address, uint256) to forcibly burn tokens from any holder's address. This is documented as being for "exogenous legal circumstances" (regulatory compliance) and has been exercised twice (September 2025, June 2026).
3. No timelock on any operation — Contract upgrades, parameter changes, and critical admin functions execute immediately with no delay period for users to react. The July 2026 migration demonstrated this end to end: the entire token implementation was replaced twice in two days, each time in a single owner transaction with no announcement window, while ~$750M+ of user shares sat behind the proxy.
4. AllowList control — Removing an address from the AllowList effectively freezes their tokens (they cannot transfer or redeem). This is a compliance feature but also a centralization vector, and it has been used against an integrated DeFi protocol (Morpho Blue / USCC, September 2025).
5. Oracle pricing control — The Oracle Owner (0x4B1df64357a5D484563c9b7c16a80eD8B8fB1395) controls NAV checkpoints via addCheckpoint(). While the oracle uses programmatic linear interpolation between checkpoints, the checkpoint values themselves are set by this EOA. A malicious or compromised oracle owner could post incorrect NAV values affecting subscription/redemption pricing.
6. Expanded owner surface in v1.3.0 — The FundToken rewrite added four owner-only setters that the prior V5.1 implementation did not expose: setAllowlist() (swap the entire compliance gate for another contract), setIsPublicInstrument() (change which allowlist permission model applies), and setName() / setSymbol() (rename the token in place — used in this cycle to rebrand from "Superstate Short Duration US Government Securities Fund" to "Invesco Short Duration US Government Securities Fund"). These are convenience/compliance controls rather than direct fund-loss paths, but each widens what a single compromised key can do without an upgrade.

Mitigations:

• Turnkey secure enclaves (TEE, not MPC) — Private key operations are performed inside hardware-enforced Trusted Execution Environments. Per Turnkey's own security documentation, "private key material is only decrypted within these enclaves" and Turnkey "only stores encrypted private keys." This is materially weaker than MPC/threshold signing: a complete private key exists and is reconstituted in enclave memory on every signature, so the trust model rests on enclave integrity, Turnkey's policy engine, and the secrecy of the API credentials that authorise signing — rather than on a key that is never assembled anywhere. Onchain the distinction is invisible: all four owners produce ordinary ECDSA signatures, carry no contract code, and have no EIP-7702 delegation (cast code returns 0x for each), so an outside observer cannot verify the signing arrangement at all. TODO: Turnkey supports N-of-M policy quorums that would function as an offchain multisig, but Superstate's policy configuration is not published — the effective signing quorum behind each EOA is unknown and unverifiable.
• Two-step ownership transfer — Ownable2StepUpgradeable requires propose + accept for ownership changes, preventing accidental transfer.
• renounceOwnership disabled — Cannot accidentally or maliciously renounce ownership.
• Regulatory accountability — Superstate Advisers LLC is a fully SEC-registered investment adviser (CRD 336188, SEC #801-132908, status ACTIVE), and Superstate Services LLC is an SEC-registered transfer agent. Malicious admin actions would have direct legal consequences.
• Oracle price floor — FundToken v1.3.0 hardcodes an immutable MINIMUM_ACCEPTABLE_PRICE of $7.00 (verified onchain), below which subscriptions revert. This bounds — but does not eliminate — the damage from a corrupted or manipulated NAV checkpoint.
• Institutional-grade service providers — BNY Mellon (custodian), PricewaterhouseCoopers LLP (auditor), Invesco Advisers (investment manager), and NAV Fund Services (NAV agent) provide independent oversight of the underlying fund.

Programmability

• NAV/Price: The Continuous Price Oracle computes real-time NAV/S onchain using linear extrapolation between NAV checkpoints set by Superstate. Chainlink provides an independent feed. NAV checkpoints are set by the admin, but the extrapolation is programmatic and the token enforces an immutable $7.00 price floor on subscriptions.
• Subscriptions: Atomic onchain subscription at oracle price is programmatic (anyone allowlisted can call subscribe()).
• Redemptions: Atomic onchain redemption is programmatic (via RedemptionIdle contract).
• Transfers: Programmatic AllowList enforcement on every transfer (onchain check).
• Minting/Burning: Admin-only. Minting reflects offchain subscriptions. Admin burning is for regulatory compliance.
• Accounting: Dual pause mechanism (transfers vs. mint/burn) is admin-controlled.

External Dependencies

1. U.S. Treasury Market (Critical) — Fund holds U.S. Treasury Bills and Agency securities. An unprecedented U.S. government default would directly impact the fund. Extremely low probability.
2. BNY Mellon (Critical) — Qualified custodian for the underlying assets. The Bank of New York Mellon is one of the world's largest custodian banks with ~$50T+ assets under custody.
3. Invesco (Critical) — Investment manager handling daily portfolio management via Invesco Advisers, Inc., a subsidiary of Invesco Ltd. (publicly traded, NYSE: IVZ, $1.7T+ AUM). Replaced Federated Hermes as of March 2026.
4. Circle (High) — USDC subscriptions and redemptions route through Circle. A USDC depeg would not affect USTB NAV (backed by Treasuries) but would affect the USDC redemption path.
5. Chainlink (Medium) — NAV/Share oracle feed. Superstate also runs their own Continuous Price Oracle as primary source.
6. Turnkey (Medium) — Non-custodial key management via secure enclaves. Failure could delay admin operations.
7. PricewaterhouseCoopers LLP (Low) — Annual audit of the fund. Provides independent verification.
8. NAV Fund Services (Low) — Independent NAV calculation agent.

Cross-chain distribution — no third-party bridge. USTB is issued on Ethereum, Solana and Plume, but Superstate does not use LayerZero, CCIP, Wormhole, Axelar or any other third-party messaging protocol. The token's bridge(amount, dest, chainId) function burns on the source chain and emits a Bridge event; Superstate then mints the corresponding shares on the destination chain as an operational step, with supported destinations gated by the owner via setChainIdSupport. There is therefore no external bridge contract to audit or exploit, and no wrapped/escrowed representation — but the cross-chain leg is admin-mediated and trust-based: a user who burns on Ethereum relies entirely on Superstate to mint on the destination, with no onchain proof, no timeout, and no self-service recovery. Exposure is small in absolute terms — Solana holds 224,119.50 USTB (~$2.5M, 0.26% of shares) and Plume 170,503.72 USTB (~$1.9M, 0.20%), against 69.31M on Ethereum — and Yearn exposure would be Ethereum-only, so this is context rather than a scored risk. Because no third-party bridge is involved, USTB is intentionally absent from src/data/bridges.json; scripts/check_bridges.mjs reports 0 warnings.

Operational Risk

• Team: Robert Leshner (Co-Founder & CEO, previously co-founded Compound Finance, CFA, UPenn Economics), Reid Cuming (Co-Founder & COO, ex-Square, Stripe, Chime), Jim Hiltner (Co-Founder & Head of BD, ex-Compound Sales), Dean Swennumson (Co-Founder & Head of Ops, ex-Compound Operations). Team also includes alumni from Goldman Sachs, Coinbase, SEC, Frax Finance. ~23 employees.
• Funding: ~$100.5M raised across 3 rounds:
  • Seed: $4M (June 2023) — ParaFi, Cumberland, 1kx. TODO: no first-party Superstate announcement located for this round; figure carried from secondary coverage.
  • Series A: $14M (November 2023) — Distributed Global, CoinFund, Breyer Capital, Galaxy, Hack VC. TODO: same — secondary sourcing only.
  • Series B: $82.5M (announced January 22, 2026) — led by Bain Capital Crypto with Distributed Global; Haun Ventures, Brevan Howard Digital, Galaxy Digital, Sentinel Global participating. Sources: Superstate newsroom, CoinDesk, Orrick (deal counsel)
  • The $100.5M total is the sum of the three rounds; press coverage of the Series B independently describes total funding as "over $100 million."
• Documentation: Comprehensive docs at docs.superstate.com covering fund mechanics, legal structure, smart contracts, security. Actively maintained.
• Legal Structure:
  • Superstate Inc. (Delaware corporation) — parent company; its own adviser registration (SEC #802-129496) is now INACTIVE, having been superseded by Superstate Advisers LLC
  • Superstate Asset Trust (Delaware Statutory Trust, organized June 15, 2023) — bankruptcy-remote fund entity
  • Superstate Advisers LLC — SEC-registered investment adviser under the Investment Advisers Act of 1940 (CRD 336188, SEC #801-132908, ACTIVE), a step up from the prior exempt-reporting-adviser posture
  • Superstate Services LLC — SEC-registered transfer agent (March 2025)
  • Fund operates under Section 3(c)(7) of the Investment Company Act; offered pursuant to Rule 506(c) of Regulation D
  • Restricted to Qualified Purchasers and Accredited Investors
• Incident Response: Turnkey secure enclaves for key management. Admin can pause transfers and/or accounting independently. Can force-burn and re-mint to new addresses for compromised investor wallets. No publicly documented formal incident response playbook.
• License: BUSL 1.1 (Business Source License)
• Industry Participation: Superstate Industry Council (50+ institutional members). Active engagement with SEC Crypto Task Force (formal submission June 2025).

Monitoring

Key Contracts to Monitor

Contract	Address	Purpose	Key Events/Functions
USTB Token	0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e	Token state	Mint, AdminBurn, OffchainRedeem, Bridge, SubscribeV2, Paused/Unpaused, AccountingPaused/AccountingUnpaused, SetOracle, SetRedemptionContract, SetStablecoinConfig, SetMaximumOracleDelay, OwnershipTransferStarted, totalSupply(). New in v1.3.0: AllowlistUpdated, IsPublicInstrumentUpdated, NameSet, SymbolSet
Continuous Price Oracle	0xe4fa682f94610ccd170680cc3b045d77d9e528a8	NAV pricing (not a proxy)	NewCheckpoint, SetMaximumAcceptablePriceDelta, OwnershipTransferStarted, latestRoundData(). Public getter on USTB token: superstateOracle() returns current oracle address.
AllowList V3.1	0x02f1fa8b196d21c7b733eb2700b825611d8a38e5	Permission changes	EntityIdSet, ProtocolAddressPermissionSet, PublicInstrumentPermissionSet, PrivateInstrumentPermissionSet, OwnershipTransferStarted
RedemptionIdle	0x4c21b7577c8fe8b0b0669165ee7c8f67fa1454cf	Redemption liquidity	RedeemV2, Withdraw, SetRedemptionFee, SetSweepDestination, Paused/Unpaused, OwnershipTransferStarted, USDC balanceOf()
USTB ProxyAdmin	0xb9d285dcad879513dc9c1a3b2e0cccb21c3c2146	USTB proxy upgrades	Upgraded event on USTB proxy, OwnershipTransferred
AllowList ProxyAdmin	0xb819692a58db9dd4d3b403a875439b6ca155c610	AllowList proxy upgrades	Upgraded event on AllowList proxy, OwnershipTransferred
RedemptionIdle ProxyAdmin	0xcaba8c12873fffed13431d98bf6b836dff08e869	RedemptionIdle proxy upgrades	Upgraded event on RedemptionIdle proxy, OwnershipTransferred

Admin EOAs to Monitor

EOA	Role	Key Actions
0xad309bb6f13074128b4f23ef9ea2fe8552afca83	USTB Token + ProxyAdmin Owner	Mint, adminBurn, pause, upgrade USTB impl, set oracle/redemption/stablecoin config
0x7747940adbc7191f877a9b90596e0da4f8deb2fe	AllowList + ProxyAdmin Owner	Add/remove addresses, set permissions, upgrade AllowList impl
0x8cf40e96e7d7fd8A7A9bEf70d3882fbBC4D40765	RedemptionIdle + ProxyAdmin Owner	Pause redemptions, withdraw USDC, set fees, upgrade RedemptionIdle impl
0x4B1df64357a5D484563c9b7c16a80eD8B8fB1395	Oracle Owner	Set NAV checkpoints (pricing), set price delta

Critical Monitoring Points

• NAV/Share: Track Continuous Price Oracle (latestRoundData()) and Chainlink feed — should increase monotonically. Alert on any decrease (would indicate fund losses). Current: $11.181564 (Superstate oracle), $11.177748 (Chainlink). Staleness check: read checkpoints(latestRoundData().roundId) and take effectiveAt (second field of the (uint64 timestamp, uint64 effectiveAt, uint128 navs) tuple), compute block.timestamp - effectiveAt; alert if > 4 days (345600s) — oracle reverts StaleCheckpoint() at CHECKPOINT_EXPIRATION_PERIOD = 5 days (432000s), freezing subscribe/redeem. Latest checkpoint at assessment time was ~2.8 days old (weekend gap), well inside the window but past the alert threshold's halfway point.
• Implementation Drift: Read EIP-1967 implementation slot on the USTB proxy and alert on any change from 0xb3ac55dd09aa70e9bfbb12f45cd38a1f1597588c (FundToken v1.3.0). Also alert if VERSION() changes from "1.3.0".
• Admin Burns: Monitor AdminBurn events — forced burns from holder addresses are a critical event. Two have occurred to date.
• Pause Events: Monitor Paused/Unpaused and AccountingPaused/AccountingUnpaused on USTB Token AND RedemptionIdle.
• Contract Upgrades: Monitor all 3 ProxyAdmins for Upgraded events — USTB ProxyAdmin (0xb9d285dcad879513dc9c1a3b2e0cccb21c3c2146), AllowList ProxyAdmin (0xb819692a58db9dd4d3b403a875439b6ca155c610), and RedemptionIdle ProxyAdmin (0xcaba8c12873fffed13431d98bf6b836dff08e869). Any proxy upgrade executes immediately with no timelock.
• Token Configuration (v1.3.0 setters):
  • AllowlistUpdated — CRITICAL, page immediately. setAllowlist() swaps the entire compliance gate in one owner transaction with no timelock. A malicious or erroneous allowlist address can freeze every holder at once (if it denies all) or void KYC gating entirely (if it permits all). Alert condition: any AllowlistUpdated event, OR allowlist() returning anything other than 0x02f1fa8b196d21c7b733eb2700b825611d8a38e5. Poll allowlist() hourly as a belt-and-braces check against a missed event; on trigger, treat the USTB position as frozen-risk until the new allowlist is reviewed and confirm isAddressAllowedForFund(<our address>) still returns true.
  • IsPublicInstrumentUpdated — high. Changes which allowlist permission model applies to every transfer. Alert on any event or on isPublicInstrument() returning anything other than false.
  • NameSet / SymbolSet — informational. Cosmetic, but a symbol change breaks the Allowlistable private-instrument lookup keyed on ticker, so alert and re-verify allowlist resolution.
  • Current state: allowlist() == 0x02f1fa8b…, isPublicInstrument() == false, maximumOracleDelay() == 3600s.
• Oracle Changes: Monitor SetOracle events on USTB Token (2 to date) and NewCheckpoint events on the Oracle. Monitor SetMaximumAcceptablePriceDelta on Oracle (current: $1.00).
• AllowList Changes: Monitor ProtocolAddressPermissionSet and EntityIdSet events, especially protocol address permissions (DeFi integrations). Five ProtocolAddressPermissionSet events to date, two of them revocations.
• Redemption Capacity: Monitor USDC balanceOf() on RedemptionIdle — current 8,738,475 USDC. Also monitor Withdraw events (owner can extract USDC) and SetRedemptionFee (currently 0).
• Ownership Transfers: Monitor OwnershipTransferStarted on all 4 contracts (USTB, AllowList, RedemptionIdle, Oracle) and OwnershipTransferred on all 3 ProxyAdmins. All pendingOwner() values are currently zero.
• Large Supply Changes: Alert on mints/burns >5% of total supply in 24h. Current supply: 69,310,953.05 USTB.
• Offchain Reserve Reconciliation: Cross-check the public holdings API and NAV API against onchain totalSupply() × NAV. Alert if the holdings snapshot goes stale beyond ~45 days or if disclosed holdings fall materially below reported AUM.
• Recommended Frequency: Hourly for NAV/pause/admin events. Daily for AllowList, redemption capacity, and implementation slot. Weekly for the reserve reconciliation.

Reassessment Triggers

• Time-based: Reassess in 6 months (February 2027)
• TVL-based: Reassess if AUM changes by more than 50%
• Incident-based: Reassess after any exploit, admin key compromise, contract upgrade, governance change, or regulatory action
• Upgrade-based: Reassess on any Upgraded event, including an AllowlistV4_x or RedemptionV2 rollout, or a FundToken version past v1.3.0
• Governance-based: Reassess if Superstate adopts multisig, timelock, or other governance improvements (potential score improvement)
• AllowList-based: Reassess if any USTB protocol address permission is revoked
• Transparency-based: Reassess if the public holdings/NAV API is withdrawn or goes materially stale, or if Chainlink Proof of Reserves goes live
• Regulatory-based: Reassess if SEC takes enforcement action or Superstate's regulatory status changes (transfer agent, adviser registration)

---

Appendix A — Audit Reports

0xMacro Audits

#	Date	Scope	Link
A-1	Jul 2024	Redemption contract	Report
A-2	Jul 2024	USTB/USCC Token + AllowList	Report
A-3	Nov 2024	Liquidation, Oracle, Token V2	Report
A-4	Nov 2024	Token + Redemption V2	Report
A-5	Jan 2025	Token V3 + Redemption	Report
A-6	Apr 2025	Token + Redemption updates	Report
A-7	May 2025	Solana Allowlist Program	Report
A-8	May 2025	Equity Token	Report
A-9	Jul 2025	AllowlistV3 (EVM)	Report
A-10	Nov 2025	DIP, Dippable, EquityToken	Report
A-11	Feb 2026	DIP v1.1, Dippable, EquityToken	Report

Other Audits

Firm	Date	Scope	Link
Zellic	Feb 17, 2026	AllowlistV4_0, FundToken, SuperstateTokenCore + components, RedemptionV2 / IdleV2 / YieldV2, SuperstateOracle, Dip, EquityToken	Report PDF ("Superstate Smart Contracts — Zellic Audit Report")
Zellic	Jun 23, 2026	AllowlistV4_2, FundTokenV1_2_0, EquityTokenV1_4_0, shared components, Dip	Report PDF ("Superstate EVM — Zellic Audit Report")
ChainSecurity	2023	Compound SUPTB (original token)	Report
Offside Labs	May 2025	Solana Allowlist	Superstate Docs
Certora	--	Formal Verification	Superstate Docs

Both Zellic reports are linked as file attachments on the Smart contracts documentation page rather than at stable public URLs.

Appendix B — Contract Architecture

Verified onchain August 17, 2026. All owners are EOAs (code size 0). No multisig, no timelock on any contract.

GOVERNANCE LAYER (4 EOAs — all code size 0, no multisig)
═══════════════════════════════════════════════════════════

  [EOA-1] USTB Token owner + USTB ProxyAdmin owner
  [EOA-2] AllowList owner + AllowList ProxyAdmin owner
  [EOA-3] RedemptionIdle owner + RedemptionIdle ProxyAdmin owner
  [EOA-4] Oracle owner (addCheckpoint, setMaxAcceptablePriceDelta)
          │               │                │               │
          ▼               ▼                ▼               │
PROXY ADMIN LAYER                                          │
═════════════════                                          │
                                                           │
  [PA-1] upgrade(USTB)       ← owned by [EOA-1]           │
  [PA-2] upgrade(AllowList)  ← owned by [EOA-2]           │
  [PA-3] upgrade(Redemption) ← owned by [EOA-3]           │
          │               │                │               │
          ▼               ▼                ▼               │
TOKEN LAYER                                                │
═══════════                                                │
                                                           │
  [USTB] USTB Token (Proxy)                                │
  impl: FundTokenV1_3_0 (VERSION "1.3.0")                  │
        modular ERC-7201 components                        │
                                                           │
  Admin (owner [EOA-1] only):                              │
  ├── mint() / bulkMint()  ← no backing check onchain    │
  ├── adminBurn(address, amount)                           │
  ├── pause() / unpause()                                  │
  ├── accountingPause() / accountingUnpause()              │
  ├── setOracle(newOracle)                                 │
  ├── setRedemptionContract(newContract)                   │
  ├── setStablecoinConfig(stablecoin, dest, fee)           │
  ├── setChainIdSupport(chainId, supported)                │
  ├── setMaximumOracleDelay(delay)                         │
  ├── setAllowlist(newAllowlist)        ← new in v1.3.0  │
  ├── setIsPublicInstrument(bool)       ← new in v1.3.0  │
  └── setName() / setSymbol()           ← new in v1.3.0  │
                                                           │
  Immutable: MINIMUM_ACCEPTABLE_PRICE = $7.00              │
                                                           │
  User functions (AllowList-gated):                        │
  ├── subscribe(to, amount, stablecoin)                    │
  ├── offchainRedeem(amount)                               │
  ├── bridge(amount, dest, chainId)                        │
  ├── bridgeToBookEntry(amount)                            │
  └── transfer / transferFrom                              │
          │               │                │               │
     reads│          reads│           reads│               │
          ▼               ▼                ▼               ▼
PROTOCOL LAYER
══════════════

  [AL] AllowList V3.1 (Proxy)    [ORC] SuperstateOracle      [RI] RedemptionIdle (Proxy)
  owner: [EOA-2]                  (NOT a proxy)                owner: [EOA-3]
                                  owner: [EOA-4]
  Admin:                                                       Admin:
  ├ setEntityIdForAddress()       Admin:                       ├ pause/unpause()
  ├ setEntityAllowedFor           ├ addCheckpoint()            ├ setRedemptionFee()
  │ PublicInstrument()            ├ addCheckpoints()           ├ setSweepDestination()
  ├ setEntityAllowedFor           ├ setMaxAcceptable           ├ setMaximumOracleDelay()
  │ PrivateInstrument()           │ PriceDelta()               ├ withdraw()
  ├ setProtocolAddress            └ transferOwnership()        └ transferOwnership()
  │ Permission()
  └ transferOwnership()           Exposes:                     User:
                                  latestRoundData()            └ redeem(amount)
  Gating:                         (Chainlink-compat)
  isAddressAllowedForFund()                                    USDC bal: 8,738,475
  hasAnyProtocolPermissions()     NAV: $11.1816/share          Oracle delay: 1h
                                  Expiry: 5 days               Fee: 0

EXTERNAL / UNDERLYING LAYER
════════════════════════════

  [USDC] USDC                 [CL] Chainlink NAV Feed       Offchain
  Used for subscribe/redeem   Independent NAV source         ├── BNY Mellon (custodian)
                                                             ├── Invesco Advisers (investment mgr)
  [SWEEP] Sweep destination                                  ├── PricewaterhouseCoopers (auditor)
  (subscription + redemption USDC)                           ├── NAV Fund Services (NAV agent)
                                                             └── U.S. Treasury Bills (99.93%)

Address Legend:

Label	Address
[EOA-1]	0xad309bb6f13074128b4f23ef9ea2fe8552afca83
[EOA-2]	0x7747940adbc7191f877a9b90596e0da4f8deb2fe
[EOA-3]	0x8cf40e96e7d7fd8A7A9bEf70d3882fbBC4D40765
[EOA-4]	0x4B1df64357a5D484563c9b7c16a80eD8B8fB1395
[PA-1] USTB ProxyAdmin	0xb9d285dcad879513dc9c1a3b2e0cccb21c3c2146
[PA-2] AllowList ProxyAdmin	0xb819692a58db9dd4d3b403a875439b6ca155c610
[PA-3] RedemptionIdle ProxyAdmin	0xcaba8c12873fffed13431d98bf6b836dff08e869
[USTB] USTB Token (Proxy)	0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e
[AL] AllowList V3.1 (Proxy)	0x02f1fa8b196d21c7b733eb2700b825611d8a38e5
[ORC] SuperstateOracle	0xe4fa682f94610ccd170680cc3b045d77d9e528a8
[RI] RedemptionIdle (Proxy)	0x4c21b7577c8fe8b0b0669165ee7c8f67fa1454cf
[CL] Chainlink NAV Feed	0x289B5036cd942e619E1Ee48670F98d214E745AAC
[USDC] USDC	0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
[SWEEP] Sweep Destination (EOA)	0x774AE279c21B6a17a6E2BD5ab5398FF98F398807

Proxy Upgrade Paths

Each proxy can be upgraded immediately (no timelock) by its ProxyAdmin owner:

Proxy	ProxyAdmin	Owner (EOA)	Functions
USTB Token 0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e	0xb9d285dcad879513dc9c1a3b2e0cccb21c3c2146	0xad309bb6f13074128b4f23ef9ea2fe8552afca83	upgrade(), upgradeAndCall(), changeProxyAdmin()
AllowList 0x02f1fa8b196d21c7b733eb2700b825611d8a38e5	0xb819692a58db9dd4d3b403a875439b6ca155c610	0x7747940adbc7191f877a9b90596e0da4f8deb2fe	upgrade(), upgradeAndCall(), changeProxyAdmin()
RedemptionIdle 0x4c21b7577c8fe8b0b0669165ee7c8f67fa1454cf	0xcaba8c12873fffed13431d98bf6b836dff08e869	0x8cf40e96e7d7fd8A7A9bEf70d3882fbBC4D40765	upgrade(), upgradeAndCall(), changeProxyAdmin()

The Oracle (0xe4fa682f94610ccd170680cc3b045d77d9e528a8) is not a proxy and cannot be upgraded. However, the USTB Token owner can replace it entirely via setOracle(newAddress).