TL;DR
- What it is: ERC-4626 savings token on Ethereum. Deposit USDS, receive sUSDS — share price accrues at the governance-set Sky Savings Rate. Ex-MakerDAO; the Sky Frontier Foundation (Grand Cayman) is the ecosystem’s Cayman entity but explicitly disclaims issuing, custodying or redeeming USDS — so there is no single legal issuer standing behind the token, which is a weaker counterparty story than “issued by X” implies. ~$4.75B TVL, still DeFi’s largest USD-stablecoin yield venue, down ~24% since June — mostly Spark’s mechanical deleveraging, not a run (Risk #5).
- Yield source: Real protocol revenue — stability fees on overcollateralised USDS loans, RWA carry from BlackRock BUIDL + Janus Henderson JTRSY held via Cayman SPVs (~$985M, Jul 2025 per S&P), and LitePSM USDC float. No emissions. 3.60% APY today, unchanged.
- Biggest risk: Sky governance (or a lawful order routed through it) can seize the GnosisDAO Safe specifically — by upgrading the USDS implementation to insert seizure or blocklist logic. 48h GSM delay, no peg signal, addressable to NOCA alone (Risk #1).
- For detail: S&P (Aug 2025, B-), LlamaRisk (Sep 2024), DeFiScan.
How it works
Sky (rebranded from MakerDAO Aug 2024) mints USDS against crypto vaults (ETH, wstETH) plus an allocator framework that lets sub-protocols like Spark borrow USDS at 0% duty against debt ceilings. Users deposit USDS into the sUSDS proxy (0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD, UUPS, upgradeable by governance) and receive sUSDS; each drip() mints fresh USDS to pay the rate and books an offsetting Sin debt in the Vow. Stability-fee + RWA revenue cancels the Sin; excess flows to surplus. The Smart Burn Engine has been actively buying back SKY through 2025–2026 — the prior eval’s “surplus auctions disabled” framing was wrong.
Exit is atomic in two hops: sUSDS → USDS via ERC-4626 redeem() (no fee, no lockup; share price 1.103736 USDS per sUSDS), then USDS → USDC via the LitePSM pocket (0x37305B1cD40574E4C5Ce33f8e8306Be057fD7341, the USDC store for the LitePSM contract 0xf6e72Db5454dd049d0788e411b06CfAF16853042; ~$4.54B USDC, 1:1, no fee). Governance: SKY holders vote, the elected spell (hat() on the chief MCD_ADM 0x929d9A1435662357F54AdcF64DcEE4d6b867a6f9 — confirmed via MCD_PAUSE.authority(), 2026-07-21) is lifted to MCD_PAUSE_PROXY (0xBE8E3e3618f7474F8cB1d074A26afFef007E98FB), executes after the 48h GSM delay (MCD_PAUSE.delay() = 172800 confirmed; the raise from 24h landed on-chain 2025-05-02, not the May-15 spell the prior eval credited). MCD_PAUSE_PROXY is a ward on both USDS and sUSDS, so it can mint, burn, deny, or upgrade either contract once the clock expires. Protego (May 2025, 0x5C9c3cb0490938c9234ABddeD37a191576ED8624) lets governance cancel its own pending spells; the original Emergency Shutdown Module is disabled (MCD_ESM.min() = uint256 max).
The share price has only ever accrued — it never took a haircut through any market-wide crisis, and it gained through stress: +60% in the two weeks after the Oct-2025 liquidation cascade (flight-to-safety; Spark held zero sUSDS then). That is a utility-driven and legacy/defensive holder base, not rented incentive capital (there are no emissions to chase). But the base is no longer growing: totalAssets ran $2.08B (Sep-2025) → $6.29B (Jun-2026) → $4.75B (Jul-2026), a steady ~6-week bleed with no single-day break. Spark’s mechanical deleveraging is ~56% of it; the non-Spark base fell ~14% on its own. More consequential than the size: the top of the book turned over — Spark halved out of the #1 slot and was replaced by large, unattributed direct depositors (Risk #5). The Apr-2026 bridge-attack run is in Risks #5 and Liquidity.
Audits: ChainSecurity, Cantina, Sherlock public contest (security docs); $10M Immunefi bounty. Trail of Bits is legacy MakerDAO, not in Sky’s current register.
Risks
Verified on-chain (2026-07-21, block 25,582,684): sUSDS NAV and share price, ssr(), USDS supply, LitePSM pocket balance, MCD_PAUSE.delay() and authority(), wards(MCD_PAUSE_PROXY) on both USDS and sUSDS, the chief’s hat() and its SKY approvals, SKY supply, the Vow surplus, MCD_ESM.min(), per-ilk debt across the registry, Spark’s balance, and top-holder balances (Dune cohorts cross-checked with cast balanceOf). The ward’s powers were tested by simulated call, not inferred: upgradeToAndCall and mint succeed from MCD_PAUSE_PROXY; burn reverts Usds/insufficient-allowance even for a ward. Taken on trust: the RWA leg’s composition and size (BUIDL/JTRSY via Cayman SPVs, per S&P), S&P’s and BA Labs’ analysis, and the Feb-2025 takeover-attempt narrative. Open: the identity of the two new top-holder EOAs — provenance traced on-chain, attribution not established.
| # | Risk | Mechanism | Source + NOCA delta |
|---|---|---|---|
| 1 | GnosisDAO Safe seizure by Sky governance. | The vector is an implementation upgrade, not a live seizure function. Verified by simulated call 2026-07-21: upgradeToAndCall from MCD_PAUSE_PROXY (a ward, wards = 1 on USDS and sUSDS) succeeds, while the same call from a non-ward reverts Usds/not-authorized. Governance can therefore upgrade USDS to logic containing a blocklist or seizure path. Correction to the prior eval: burn(address,uint256) is not a ward power — called from MCD_PAUSE_PROXY against a third party’s balance it reverts Usds/insufficient-allowance, byte-identical to a call from a random address. Ward status confers rely/deny/mint/upgradeToAndCall, not seizure. That raises the bar slightly (an upgrade is a visible, discrete spell action) but does not remove the risk. 48h GSM delay, no peg signal (address-targeted). Trigger: any pending spell touching the USDS proxy implementation or blocklist storage → exit. | DLNews/The Block (2024) covered the GnosisDAO ↔ Sky political conflict. Two prior-eval corrections now stand: the “no waiting period” claim (it is 48h) and the burn mechanism (allowance-gated, not ward-gated). Spell discovery remains on us. |
| 2 | Exit blocked if USDC depegs or LitePSM is drained. | PSM holds ~$4.54B USDC as the 1:1 reserve. If USDC drops or the pocket empties, USDS loses its dollar floor. SVB Mar 2023: USDC → $0.87, DAI → $0.88. Trigger: exit if PSM USDC < $1B sustained 24h. | CoinDesk; on-chain (2026-07-21). Materially better than last review: the pocket grew while USDS supply shrank, so 1:1 coverage of USDS went ~52% → 68%, and the PSM now sits 4.5× above the $1B trigger. RWA leg (BUIDL+JTRSY) is a T-bill backstop but settles ≥1 business day off-chain. |
| 3 | Hostile-takeover or malicious governance spell. | Founder ~9% of SKY, low voter turnout. The live hat is secured by only 6.60B SKY of approvals out of 23.46B supply (28%, 2026-07-21) — the bar to overtake it. Feb 2025 attempt nearly succeeded — defended only by founder borrowing against his SKY at 125% LR; liquidation of that position re-opens the hole. Protego cancels pending spells only if the same majority chooses to. | S&P p.3. Monitor hat() with ≤4h SLO → ≥44h exit window before a hostile spell lands. |
| 4 | Bad debt from collateral crash, RWA default, or oracle/keeper failure. | SSR is funded by allocator and vault debt across 35 ilks (vat.ilks × rate, 2026-07-21): Grove’s ALLOCATOR-BLOOM-A is now the largest at $2.46B, ahead of ALLOCATOR-SPARK-A at $2.40B, with crypto vaults LSEV2-SKY-A). The prior eval’s “legacy ~$534M + Spark ~$3.35B” was wrong on both figures and omitted Bloom entirely — and Bloom is Grove, the same allocator anchoring our janus-henderson-anemoy-jaaa and Securitize STAC positions, so Sky’s largest debtor is a decision-maker we are already exposed to elsewhere. Fast ETH crash, OSM freeze at wrong price, keeper outage, or RWA default erodes surplus → if depleted, SKY debt auctions (flop) dilute SKY (USDS holders not directly diluted). Black Thursday Mar 2020: ~$5.67M bad debt cleared via MKR auctions. Trigger: exit if surplus (vat.dai(vow) − vow.Sin) < $100M. | BA Labs (paid by Sky — discount). Surplus $343M (dai − vow.Sin = cushion before flop dilutes SKY; 2026-07-21), up from $267M in June and still growing, now 3.4× the trigger — but not dynamically sized to asset mix; S&P RAC 0.4%. (Fully-netted dai − vat.sin(vow) ≈ −$81M, but that is un-healed operational drip-Sin covered by ongoing fees, not a deficit.) |
| 5 | Concentrated redeemer base — and the concentration moved to discretionary hands. | Top 10 still hold 0x1601843c…8347E) halved to **13.2% (0x176f3dab…a132, a bare EOA now #1 at 0xd00e0079…a5fc, a second EOA at | On-chain balanceOf + Dune cohorts, cross-checked (2026-07-21) + DeFiScan Spark. Attribution of the two new EOAs is open — provenance traced, identity not established. |
| 6 | SSR set to zero — or set too high. | Governance parameter, no floor, no upper guardrail. Drop kills yield with 48h notice; too-high rate grows Sin faster than revenue, bleeds surplus. | On-chain ssr() = 3.60% APY (2026-07-21), unchanged across the quarter. Re-evaluate if SSR drops below T-bill opportunity cost net of fees. |
Key-compromise threshold
Governance is SKY-token-weighted, not an N-of-M multisig — so the threshold is a voting bloc, not a key count. The live hat (chief MCD_ADM 0x929d9A14…, = MCD_PAUSE.authority()) is secured by 6.599B SKY of approvals out of 23.46B supply — 28.1% (2026-07-21; the seated spell is the 2026-07-16 executive, already executed). Every privileged action on USDS and sUSDS routes through MCD_PAUSE_PROXY (0xBE8E…98FB), a ward on both (wards = 1 on each), which executes only spells lifted by the chief, after the 48h GSM delay.
- Funds (theft / unbacked mint / burn): out-approve the 6.599B SKY backing the hat (>28% of supply) → install a spell → 48h GSM → then either mint unbacked USDS (
mintfrom the ward simulates successfully) orupgradeToAndCallseizure/blocklist logic into USDS or sUSDS (also simulates successfully). Note there is no directburnpath — that function is allowance-gated even for a ward (Risk #1). The founder’s ~9% (~2.1B SKY) is insufficient alone; the Feb-2025 attempt (Risk #3) shows a borrow-funded bloc is the realistic path. No faster route: no standalone EOAwardis documented (DeFiScan Stage 0), andMCD_ESMis disabled (min() = uint256 max). - Liveness (freeze / NAV distortion / forced exit): the same >28%-SKY → spell → 48h path — set
ssr()to zero (Risk #6), pause the LitePSM rail, or upgrade sUSDS to blockredeem(). ERC-4626redeem()and PSMbuyGemare otherwise permissionless, so there is no lower-threshold freeze key. - Single point of failure: no single EOA — both tiers require a >28%-SKY voting bloc. But that bloc is a single decision node: a hostile majority, or a lawful order compelling the existing one, breaches both tiers at once (this is Risks #1 and #3). The only brakes are the 48h GSM delay and Protego (
0x5C9c…8624) — which lets governance cancel its own pending spells, but only if the same majority chooses to.
Liquidity & exit
Primary path: sUSDS → USDS via ERC-4626 redeem() (atomic, no fee, no lockup) → USDS → USDC via LitePSM (1:1, no fee, capped by pocket balance). Backup: Curve/Uniswap (thinner, exposed to peg dislocation).
On-chain (2026-07-21, block 25,582,684): sUSDS.totalAssets() = 4,751,277,588 · USDS.totalSupply() = 6,681,484,080 · LitePSM_pocket.balanceOf(USDC) = $4,541,758,735 · MCD_PAUSE.delay() = 172,800s (48h) · sUSDS.convertToAssets(1e18) = 1.103736 USDS · ssr() = 3.60% APY.
Defensible size at current liquidity (post-haircut): $50M. $50M = 1.1% of PSM depth, current slippage <1bps in 1d. The sizing is set by the PSM, not by sUSDS TVL — so the quarter’s ~24% TVL decline does not cut it: the pocket grew over the same window and 1:1 coverage of USDS improved to ~68%. The worst real stress on record validates this: in the Apr-2026 bridge-attack run the external (non-Spark) sUSDS base redeemed ~$1.2B in ~7d, drawing the PSM from $4.067B → $3.261B (−$806M, −19.8%) over 4 days — it never neared the $1B floor (3.3× above it), redemptions stayed atomic at 1:1, and the PSM fully recovered to $4.07B within ~2 weeks. At the April trough, $50M was still only 1.5% of remaining PSM depth, exiting at ~0bps. Sizing holds with wide margin. (Spark ALM’s larger swings — e.g. 0.97B → 1.98B sUSDS in two weeks — are mechanical deleveraging that burns USDS internally and barely touches the PSM, so they are not the liquidity threat.)
Stress scenario: NOCA exits 50% ($25M) in 7d concurrent with another April-scale external run (~$1.2B drawing ~20% of the PSM). PSM trough ~$3.3B absorbs our $25M at ~0bps; the USDS DEX peg may sag 10–25bps but the 1:1 PSM floor holds while it has USDC. The binding case remains Risk #1 — if the trigger is the seize-vector, exit is to the Safe being seized, which is the failure mode.
External reviews
Source links for the third-party takes in the Risks table. Per rubric.md, reviews older than 90d (⚠️) are stale — refresh before relying.
- S&P Global — credit rating, B- (stable) · 2025-08-07 · ⚠️ stale
- LlamaRisk — Aave onboarding assessment · 2024-09-13 · ⚠️ stale
- DeFiScan — decentralization stage (Stage 0) · live dashboard
- BA Labs — Sky risk dashboard · ongoing · paid by Sky (discount)
- Bluechip — safety rating (DAI-era B+) · 2023-06-04 · ⚠️ stale, pre-USDS