TL;DR
- What it is: ERC-4626 IPOR Fusion PlasmaVault (
0xb9e8…663c) taking WETH, built to run a levered Liquity V2 BOLD carry (curated by Sentinel Codes) — but as of 2026-07-08 fully de-risked (LP exited, trove at min debt): an unlevered wstETH holding, re-leverable anytime. - Yield (when deployed): thin organic carry (LST staking + modest Curve fees net of borrow) under a larger layer of redirected incentives (CRV + a LQTY-steered PIL/BOLD subsidy) — mostly subsidy; today it earns neither.
- Biggest risk: a single-key multisig (1-of-3 bare EOAs, no timelock) holds Owner + Atomist + Fuse-Manager + Guardian and can re-route or drain the vault in one transaction (Risk #1).
- For detail: Liquity V2 and IPOR Fusion audits (below); no arms-length rating of this specific vault exists.
How it works
WETH deposits mint rETHLPC ERC-4626 shares (20-decimal, non-rebasing). An off-chain “Alpha” moves capital only through pre-approved fuses on whitelisted substrates, never to arbitrary addresses. Sentinel Codes curates and operates it (Atomist + Alpha); IPOR Labs supplies only the framework. The design: mint BOLD against a WETH-family Liquity V2 trove, LP it with USDC in the Curve BOLD/USDC pool (0xefc6…4b3e), and stake the gauge (0x07a0…05e9) for CRV + BOLD. As of 2026-07-08 the carry is undeployed — hours before review the operator exited the LP and repaid the trove to Liquity’s 2,000-BOLD minimum, leaving one unlevered trove (523 wstETH, ICR 560×, rate 4.05%) + idle WETH; $1.32M). So a vault named “rETH … LP Carry” holds no rETH, LP, or leverage today — just wstETH and cash.totalAssets = 764.5 WETH (
Yield (re-levered): low-single-digit organic carry (wstETH staking + sub-1% fees − borrow) under a larger, roughly-fixed subsidy layer (CRV + a Liquity PIL/BOLD subsidy via LQTY votes) that dilutes as TVL grows. Oracle: IPOR’s PriceOracleMiddleware (0x687c…579d) marks NAV in USD — WETH/USDC on Chainlink, wstETH on a Chainlink-style feed (0x6006…), rETH on a rate-based adapter (0x475c…, no staleness, so it ignores a market discount), BOLD ~$1.00 from a source independent of the Curve pool (NAV under-reacts to a BOLD depeg — monitor pool spot). Trove liquidation runs on Liquity’s own branch oracle, not this middleware. Exit: getInstantWithdrawalFuses() empty; redemptions queue via WithdrawManager, only the idle buffer same-cycle.
Risks
Verified on-chain (2026-07-08): NAV & share price, the full de-lever (gauge 0, trove debt 2,000 BOLD, ICR ~560×, rate 4.05%), Safe threshold/signers/roles/delays, the two Alpha holders, oracle sources & BOLD mark, pool depth, holder count; plus audit scope (BlocSec/Protofire; not in Immunefi) and PIL figures vs voting.liquity.org. Taken on trust: the June-2026 fork-sim results (Tenderly unavailable to re-run this pass).
| # | Risk | Mechanism | Source + our delta |
|---|---|---|---|
| 1 | Owner+Atomist+Fuse-Manager+Guardian on a single-key Safe, no timelock | Safe 0x3278…6543 holds Owner+Guardian+Atomist+Fuse-Manager at exec-delay 0; threshold 1 of 3 bare-EOA signers; targetAdminDelay=0. One key can register a fuse and sweep funds in one tx. Trigger: any new-fuse, substrate-add, or admin/signer grant. | IPOR’s Jan-2026 Arbitrum drain (~$336K) is the unvalidated-fuse precedent; we add that 1-of-3 + zero-timelock collapses the worst case to one private key, and a new signer (0x016E…E82E) was added 2026-07-01. |
| 2 | Book is 100% operator-directed, can change wholesale in hours | Leverage, venue, and rate are set off-chain, no autonomous rules. On 2026-07-08 the operator delevered the whole book + re-set the rate intraday (NAV flat) — positioning may not match this eval. Trigger: re-underwrite on any material book change. | On-chain; no third-party take. The discretion risk Risk 1 enables, made concrete. |
| 3 | Trove liquidation & leverage — conditional on redeployment | Currently moot (ICR ~560×, min debt, rate 4.05%). Re-levered, delever is a keeper action (no on-chain trigger short of liquidation) selling wstETH pro-cyclically; a drawdown drives ICR toward the ~120% MCR → SP liquidation. Trigger: re-levered — ICR nearing MCR or LST depeg. | Liquity V2 mechanics (docs.liquity.org; CCR 160% on-chain); Chaos Labs is Liquity’s risk partner. A June fork sim liquidated the then-live trove for ≈$26K (on trust). |
| 4 | Yield is mostly redirected incentives, dilutes at scale — conditional | Organic carry is low-single-digit; the rest is CRV + a LQTY-steered PIL/BOLD subsidy (roughly fixed → dilutes at scale). Zero subsidy now (out of gauge). LP leg adds BOLD/USDC depeg risk. Trigger: re-levered — PIL/gauge cut, LQTY vote, or BOLD spot >50bps/24h. | Liquity PIL thread targets ~$600/wk voter incentives and a ~10% APY (voting.liquity.org, accessed 2026-07-08); we split organic-vs-subsidy on-chain and confirm none is earned while out of the gauge. |
| 5 | IPOR Fusion contract surface | Sentinel-authored fuses on IPOR Fusion; two audits (BlocSec 2025-02, Protofire 2024-09), not in Immunefi scope; one prod exploit already (Jan-2026 Arbitrum ~$336K — fuse gap + EIP-7702 misuse). Trigger: exit on any fuse upgrade pending re-audit. | docs.ipor.io audits page; IPOR post-mortem. |
| 6 | Young, small vault; no rating; reviewer staleness | ~$1.32M TVL, 65 holders (up ~56→65 since mid-June, lagging +41% TVL), live ~5.3 months (deployed 2026-01-30); untested through a crisis, no arms-length rating. Provisional under 180d ETH-yield decay. Trigger: refresh by 2026-12-14 or halve the cap. | Internal. |
Key-compromise threshold
- Funds (theft / unbacked mint / burn): 1 — any one signer of the 1-of-3 Owner/Atomist/Fuse-Manager Safe (
0x3278…6543); all three signers are bare EOAs (codesize 0), so this is a single private key, not a real multisig. With zero timelock (targetAdminDelay=0) it can register a malicious fuse and route assets out in one tx. No separate mint/burn key. - Liveness (freeze / NAV distortion / forced exit): 1 — the same Safe (also Guardian) can re-point to an illiquid venue, set hostile trove parameters, or pause. The Alpha role has two holders — EOA
0xa2faa7…and a contract0x8ff4d4…(codesize 2824, not a Safe) — which can grief inside the walled garden but cannot exfiltrate; the 2026-07-08 de-lever shows how far routine operator power reaches. - Single point of failure: yes — one key of the 1-of-3 Safe breaches both tiers.
Liquidity & exit
Primary path: ERC-4626 redemption via the WithdrawManager request→release queue; only the idle buffer is same-cycle. WETH.balanceOf(vault) = 115.0 WETH (~15% of NAV) (2026-07-08). While de-levered the rest is unlevered wstETH collateral — a single Liquity withdrawal, no LP to unwind. Marks: totalAssets = 764.5 WETH; convertToAssets(1e20) = 0.962 WETH; getInstantWithdrawalFuses() = [].
Defensible size (post-haircut): ≤ ~$200k, staged — contingent on the current unlevered state. Same-cycle idle buffer ≈ 115 WETH (~$0.20M) clears at NAV; beyond that the operator withdraws wstETH collateral (cheap while unlevered). The binding constraint is capacity + queue latency, not slippage: NAV is ~$1.32M across 65 holders, so any material stake exits behind a discretionary release window. Re-size toward ≤$150k the moment the carry redeploys.
Stress (NOCA exits 50% in 7d while peers redeem): the idle buffer empties on the first redeemers; the rest queues behind the operator freeing collateral — clean while unlevered, but an LP-unwind + trove-close if re-levered. Worst case is a multi-cycle exit; size to the queue.
Monitoring gap: no alert YAML exists yet (
monitoring/alerts/ipor-fusion-reth-liquity-carry.yaml— to build). Verified address surface: vault0xb9e8…663c, AccessManager0x2C6C…02D2, Owner/Atomist Safe0x3278…6543, wstETH-branch TroveManager0xA289…8B22, Curve pool0xefc6…4b3e+ gauge0x07a0…05e9, price middleware0x687c…579d.
External reviews
Source links for the third-party takes in the Risks table — no restated take here. Per rubric.md, audits older than 90d (180d for ETH-yield) are stale (⚠️); refresh before relying. No arms-length risk rating of this specific IPOR Fusion vault exists as of 2026-07-08 — coverage below is of the underlying protocols only.
- Liquity — V2 redeployment notice · 2025-05-19 · ⚠️ stale
- Liquity V2 — technical docs & audits (ChainSecurity, Dedaub, Coinspect, Certora, Cantina) · accessed 2026-06-17
- Chaos Labs × Liquity — risk partnership · accessed 2026-06-17
- DeFiScan — Liquity (reflects V1; no V2-specific review found) · accessed 2026-06-17
- IPOR Fusion — docs, security & audits (BlocSec 2025-02-28, Protofire 2024-09-06) · audits ⚠️ stale
- IPOR — Immunefi bug bounty (note: Fusion contracts not in scope) · accessed 2026-06-17
- IPOR — Jan-2026 Arbitrum vault exploit post-mortem · accessed 2026-07-08
- Liquity governance — Sentinel Codes ETH-Carry PIL initiative (names this vault) · accessed 2026-07-08