TL;DR
- What it is: Kiln’s “open yield layer” built on Hopper Labs’ Lagoon ERC-7540 async vaults, wrapping two curator-run strategies — Monarq ETH Yield Vault (leveraged carry, target 5–8%) and CoinShares USDC Conservative Diversified Income (unlevered fund-of-yields, target 5.67%).
- Why we don’t deploy: Both live Railnet vaults have a single-key EOA as curator (not the Gnosis Safe the marketing describes); one key controls strategy execution, NAV publishing, and redemption gating. That’s a hard no on counterparty/governance regardless of composite math.
- Compounding the no: The pitched Monarq ETH vault is not deployed on the Lagoon factory we verified (only Monarq WBTC, $1M TVL, exists), and railnet.org claims $378M TVL on the CoinShares vault vs $53M on-chain — a 7× unreconciled gap.
- Replicable in-house: Both strategies decompose into venues we already evaluate (Aave, Morpho, Maple, Ondo, Ethena, plus BUIDL/USTB direct for Monarq). At current rates, unlevered WETH on Aave (~2.0%) actually outperforms a full replication of Monarq’s levered structure (~1.7%) — and the CoinShares replication captures ~5–6% gross with no curator key risk.
- Revisit if: Kiln replaces curator EOAs with a ≥3/5 Gnosis Safe with identifiable reputable signers, deploys the Monarq ETH vault, reconciles the TVL gap, and introduces a verifiable redemption-settlement obligation. Until then, closed.
How it works
Three-layer stack. Lagoon Finance (Hopper Labs) ships an open-source ERC-7540 async vault implementation on Safe + Zodiac via factory 0x8D6f5479…f9B1. Kiln’s Railnet sits on top as a registry / “open yield layer” marketed as a STEAM state machine for plugging external DeFi + RWA strategies into a common interface. Curator-run strategies sit at the top: Monarq Asset Management (FalconX-majority-owned, NFA-registered CPO) for ETH/BTC; CoinShares Asset Management (AIFMD/MiFID/MiCA-regulated) for USDC. Deposits route to the curator, who allocates and settles redemptions in batches.
Monarq ETH (pitched, not live): WETH collateral supplied to Aave V3, borrows USDC/USDT at 60–70% LTV (86% LLTV), deploys borrowed stables across DeFi lending (Aave/Morpho/Euler + on-chain basis), RWAs (BUIDL, USTB, ACRED at 1–2× leverage), and AMM LP (Curve, Uniswap). Target 5–8% ETH-denominated; 1% mgmt + 15% perf; weekly redemption with 7d notice. CoinShares USDC (live, $53M on-chain): unlevered allocation across Aave (20%), Morpho USDC/wstETH (20%) and USDC/WBTC (20%), Maple secured lending (10%), Ethena sUSDe (10%), Ondo OUSG (18%), Ondo IG bond ETF (1%). Weekly rebalance; 15% perf only; “24/7 liquidity” claimed.
Both live vaults share the same Lagoon implementation 0xe50554ec…3dedf behind a transparent upgradeable proxy (24h–30d admin-set delay). Redemption is requestRedeem → curator calls settleRedeem at curator-published NAV — no on-chain forcing function. The two curator addresses (Monarq WBTC 0x9d24f6D4…c264, CoinShares USDC IG 0x59d10f03…4806) are EOAs with no contract code: one private key per vault controls allocation, NAV, and the redemption gate.
Risks
| # | Risk | Mechanism | Source + our delta |
|---|---|---|---|
| 1 | Curator is a single-key EOA on both live Railnet vaults, not a Safe contract. Disqualifying. | One private key signs settle() and controls strategy execution, NAV publishing, and redemption gating. No timelock, no multisig, no separation between operator and redemption gate. New pitched products inherit the same Kiln/Railnet onboarding flow — the prior is the same setup unless Kiln commits otherwise on-chain. | On-chain 2026-05-18: eth_getCode(0x9d24f6D4…c264) = 0x (Monarq WBTC curator) and eth_getCode(0x59d10f03…4806) = 0x (CoinShares curator). Marketing pitches “SAFE-controlled, strictly non-custodial”; deployed code does not match. |
| 2 | Redemption is curator-gated with no on-chain forcing function. | ERC-7540 is request-then-claim by design; curator decides when and at what NAV to settle each batch. If the curator goes silent, captured, or stalls during stress, the redemption sits and NAV continues to be curator-published. CoinShares’ “24/7 liquidity” claim is not enforceable. | Lagoon docs + ERC-7540 spec; convertToAssets(1e18) returns curator-published NAV with no oracle reconciliation. |
| 3 | The pitched Monarq ETH Yield Vault is not deployed on the Lagoon Ethereum factory. | Only Monarq WBTC (0x8b21fa55…c828, ~$1M TVL) exists on the factory. Deploying capital into “the Monarq ETH Yield Vault” today is not possible without an address Kiln has not provided. | Lagoon factory deployment scan Feb–May 2026 (~85 vaults); zero WETH-asset Monarq vaults found (2026-05-18). |
| 4 | Marketing-vs-reality TVL discrepancy on CoinShares (7×). | railnet.org claims $378.4M TVL on the CoinShares vault; on-chain totalAssets() on the only matching mainnet vault is $53M. Either an undisclosed vault exists, the figure is cumulative/notional, or the marketing number is materially overstated. The “$600M+ Active TVL” headline is Kiln’s aggregate across mostly tiny wrapper vaults ($0.95–$23.5K per Kiln’s own Dune) — not vault-specific. Marketing-vs-reality gaps are themselves a counterparty signal. | totalAssets() of 0xf606daaf…1aad = $53.0M on 2026-05-18; railnet.org fetched same day; Kiln Dune dune.com/kiln/defi. |
| 5 | Curator-published NAV with no on-chain reconciliation to collateral. | CoinShares vault reports $53M totalAssets() while the vault contract holds $0 USDC and the curator EOA holds $993 USDC + dust in aUSDC; canonical Aave/Morpho/Ondo/Maple/Ethena balances at the curator address are zero. Either the strategy holds assets via paths we haven’t traced, or the published NAV has no on-chain backing we can verify. | On-chain reads at block 25,122,145 (2026-05-18) on curator address 0x59d10f03…4806. |
| 6 | Lagoon proxy upgradeability + ERC-7540 lifecycle bug class. | Transparent upgradeable proxy with admin-set 24h–30d delay; actual delay on both live vaults unverified (could be 24h floor). Nethermind’s audits of Lagoon v0.1→v0.5 found a High-severity bug in the pending→settled state transition — exactly the surface Monarq/CoinShares depend on. Shared implementation 0xe50554ec…3dedf across both products means a future regression hits simultaneously. No production exploit reported through 2026-05-18. | Nethermind blog on Lagoon V1→V5 audits; EIP-1967 impl slot read on both live vaults. |
Liquidity & exit
No clean exit framework applies: both vaults are ERC-7540 async with curator-gated settlement, no atomic redemption, and no secondary market (zero share-Transfer events to canonical DEX routers on either live vault). Primary path is requestRedeem(shares) → curator’s discretion to call settleRedeem(...) → claim, weekly cadence for Monarq with 7d notice. There is no on-chain forcing function we can verify — if the curator EOA goes silent or is compromised during stress, the redemption sits. Defensible size: $0 under current control structure. Sizing only becomes meaningful once the curator role moves to a real Safe multisig (≥3/5, identifiable signers) and a verifiable settlement obligation (timelocked force-settle or guardian-triggered emergency redemption at last-published NAV) exists.
External reviews
Source links for the third-party takes in the Risks table. Per rubric.md, reviews older than 90d (⚠️) are stale — refresh before relying.
- Nethermind — Lagoon ERC-7540 vault audits (V1→V5) · 2026-04-22
- Trail of Bits — Kiln Lagoon vault differential review · 2026-05 · full report not on public index
- Chorus One — DeFi curator-risk industry report · 2025 · ⚠️ stale
- Kiln Risk Methodology v2.0 — curator self-rating; not public (PDF in source materials). Curator/issuer rating themselves — discount.