TL;DR
- What it is: Tokenized private fund running a crypto basis trade (long spot BTC/ETH/SOL/XRP at Anchorage, short CME futures) plus staking (weETH, SOL) and USTB carry. ERC-20 on Ethereum, allowlisted to Qualified Purchasers, NAV published daily by Chainlink. Investment management transferred from Superstate to Bitwise Asset Management effective 2026-06-01 (marketed as Bitwise Crypto Carry Fund; same ticker, contracts, and on-chain admin).
- Yield source: Short-vol carry on the crypto basis spread (guaranteed convergence at CME expiry, mark-to-market risk in between) + staking + T-bill carry. No token incentives.
- Biggest risk: All token authority — mint, burn, pause, oracle, proxy upgrade — sits behind a single un-timelocked Superstate EOA; a compromise is catastrophic and unilateral, and the 2026-06-01 Bitwise transition left it unchanged (Risk #1).
- For detail: 0xMacro audits A-1..A-11, Steakhouse overview, Bitwise transition PR.
How it works
USCC is a Delaware Statutory Trust offered under SEC Reg D 506(c) / ICA Section 3(c)(7) — accredited / Qualified Purchasers only, audited annually by EY. The fund holds spot BTC, ETH (as weETH), SOL (staked), and XRP at Anchorage Digital Bank, shorts the corresponding CME futures to capture the basis (the premium of futures over spot, which converges to zero at expiry), and parks remaining cash in USTB (Superstate’s tokenized T-bill fund) and USDC. Management fee 0.75%; portfolio yield ~4.9% and 30-day ~3.3% (superstate.com, 2026-05-06 — off-chain and pre-transition, refresh from Bitwise). Effective 2026-06-01 investment management transferred from Superstate Advisers LLC to Bitwise Asset Management ($11B+ client assets); the fund is marketed as the Bitwise Crypto Carry Fund but keeps the USCC ticker and contracts — and on-chain the token is still named “Superstate Crypto Carry Fund” (2026-06-08). Superstate retains the on-chain infrastructure (issuance, transfer agent, oracle) via its FundOS platform — the same split Invesco took with USTB in March 2026.
Shares are minted to allowlisted wallets after off-chain subscription. The token proxy 0x14d60e7fdc0d71d8611742720e4c50e7a974020c is custody for transfers and the upgrade target; eligibility is gated by AllowlistV3 (0x02f1fa8b196d21c7b733eb2700b825611d8a38e5), whose owner — a separate EOA 0x7747…b2Fe — can revoke an address at any time and force redemption at NAV. NAV is published daily to a single Chainlink adapter 0xAfFd8F5578E8590665de561bdE9E7BAdb99300d9 (= $11.6019, 6 decimals, 2026-06-08); the adapter and its aggregator are owned by a 4-of-9 Superstate Safe (0x21f73D…73CA). That feed is what Aave Horizon and every other integrator price USCC at. Token admin functions (mint, adminBurn, pause, setOracle) and the ProxyAdmin (0x2bb7…AF3d) that controls upgrades both sit behind a single unlabeled EOA 0x8abC…0bDd1 — no timelock, no multisig (owner() and ProxyAdmin.owner() both confirmed 2026-06-08). 0xMacro recommended a timelock in audits A-4, A-7, and A-10 and Superstate did not act; the Bitwise transition did not change it.
Redemption is custodial. offchainRedeem() burns the tokens on-chain — irreversibly — and signals settlement of USD/USDC at the next day’s NAV (T+1). There is no atomic on-chain redemption contract (no equivalent of USTB’s RedemptionIdle). 85% of on-chain supply (~10.49M USCC) now sits as collateral in the Aave Horizon USCC market via aToken 0x08b798c40b9AB931356d9aB4235F548325C4cb80 (LTV 85%, LT 88%), up from 77% at last review — so a NAV drop or oracle stall there dumps redemption pressure onto the fund mechanically.
Capital quality. Retention for a QP-only fund with a handful of holders isn’t readable as organic stickiness, but the on-chain trend is legible and mildly negative: total supply fell 16% in 33 days (14.75M → 12.35M USCC), and because the Horizon collateral has been static since ~05-25, the entire contraction came out of non-Horizon free-float, which collapsed ~45% to 1.86M USCC ($21.6M). What stayed is overwhelmingly the leveraged Aave position — sticky because it is locked as borrow collateral, not from conviction, and reflexive: a NAV wobble forces liquidations that become redemptions (Risk #2). Yield is real (basis carry + staking + T-bill, no emissions), so the capital isn’t emission-mercenary — but its dominant form is leverage-dependent, the opposite of durable. On integrity, NAV published continuously through the 2026-06-01 handoff with no gap and ticked up over the month (slight softening the past week), and no admin/upgrade event fired — the transition left no on-chain footprint.
Risks
| # | Risk | Mechanism | Source + our delta |
|---|---|---|---|
| 1 | Admin-key centralization on the token contract | Single unlabeled EOA 0x8abC…0bDd1 is owner() of the USCC proxy (mint, adminBurn, pause, setOracle) and of the ProxyAdmin (0x2bb7…AF3d) controlling upgrades — no timelock, no multisig (confirmed 2026-06-08). Compromise enables arbitrary mint, burn, or transfer freeze; it is a single point of failure for both funds and liveness. The 2026-06-01 Bitwise transition did not harden it — Superstate kept the EOA. Trigger: any Upgraded event on the proxy, any OwnershipTransferred, or any owner-only call outside the documented redemption flow. | 0xMacro A-4 / A-7 / A-10 (“Extensive Admin Privileges”, recommends timelock); Superstate acknowledged in each and did not act. We confirm the EOA persisted unchanged through the IM transfer — a deliberate, standing operational choice. |
| 2 | Aave Horizon concentration + reflexive redemption | 85% of on-chain supply (~10.49M USCC, ~$122M at NAV) sits in the Horizon market as collateral (LT 88% base, 90% E-Mode), up from 77% as free-float redeemed away. A NAV decline or oracle stall triggers automated liquidations; liquidators receive USCC and can only exit via Superstate redemption, dumping mechanical pressure onto the fund’s cash buffer at the same moment as our own exit. Free-float outside Horizon is now only | On-chain: aToken 0x08b7…cb80 = 10.49M USCC, 85% of supply (2026-06-08); CollateralConfigurationChanged 2025-12-12. LlamaRisk monitors via Aave Horizon weekly highlights, no standalone USCC view. NOCA delta: concentration rose and free-float collapsed since last review — the reflexive loop is tighter now. |
| 3 | Bitwise IM transition — dual-counterparty redemption (now live) | Investment management transferred to Bitwise effective 2026-06-01; Bitwise runs the basis book (futures rolling, margin, staking) while Superstate keeps the admin EOA, oracle, and FundOS — so redemption now requires both Bitwise (fund liquidity) and Superstate (token burn + settlement) functioning. On-chain the handoff was a non-event (NAV published continuously, no admin/upgrade event, keys unchanged, 7 days in). The risk is the operational tail, not the on-chain mechanics. Trigger: any operational incident in the first 90 days post-transition (through ~2026-08-30), or any change to the admin EOA / oracle publisher. | Bitwise PR 2026-05-07; USTB/Invesco precedent (2026-03) completed cleanly but USTB is passive T-bills, weak evidence for an active basis book. NOCA delta: 7 days observed clean on-chain; the dual-counterparty structure is now real and the single-EOA admin is retained under a different manager. |
| 4 | Chainlink NAV oracle is single-sourced | The Chainlink USCC feed 0xAfFd…00d9 is updated once daily; no fallback, no second publisher. Adapter + aggregator owned by a 4-of-9 Superstate Safe (0x21f73D…). Stale or wrong NAV mis-prices the token for every integrator — most consequentially Aave Horizon (85% of supply). Observed cadence stretches to ~26h between some updates, so the daily rhythm sits right at the staleness line. Trigger: any single missed daily update (>26h staleness). | Superstate docs; latestRoundData() = $11.6019 (2026-06-08); rounds 606–614 show continuous publication through the transition. NOCA delta: publisher is a 4/9 Safe (better-gated than the EOAs), but it is still a single source and the cadence is tight against the trigger. |
| 5 | Short-vol carry can invert | Basis is short-vol: in backwardation (futures < spot, typically sharp selloffs forcing leveraged-long unwinds) new trades earn nothing and existing trades take mark-to-market hits before converging at expiry. CME margin calls on the short notional can force unwinds at unfavorable levels if Anchorage cash is tight. Staking legs (weETH, staked SOL) are price-hedged by the futures but not for protocol/slashing/depeg — those losses are unhedged. Trigger: sustained negative funding >30d, or weETH discount >1% to ETH. | Basis-trade mechanics; portfolio composition (superstate.com, 2026-05-06, off-chain/pre-transition). Historical: the 2022 bear market drove crypto basis to zero/negative for months. NOCA delta: NAV softened slightly the past week (~$11.608 → $11.602), consistent with basis compression — watch. |
| 6 | Allowlist revocation / forced exit at NAV | AllowlistV3 (0x02f1…38e5) controls who can hold USCC; its owner — a separate EOA 0x7747…b2Fe — can remove an address, forcing redemption at the next NAV. With custodial T+1 settlement, the holder has no path to refuse or contest. Intentional for compliance, but a unilateral issuer lever, and a second independent single-EOA key. Trigger: any change in our wallet’s allowlist status. | 0xMacro A-9; Superstate docs. NOCA delta: the allowlist owner is a distinct EOA from the token admin — two separate single keys, neither timelocked. |
Key-compromise threshold
USCC concentrates authority in unhardened single keys: two bare EOAs and one 4-of-9 Safe, none timelocked. The 2026-06-01 Bitwise transition did not change this.
- Funds (theft / unbacked mint / burn): 1 EOA — the token admin (
0x8abC…0bDd1) alone can mint unbacked USCC,adminBurnholder tokens, or upgrade the proxy to malicious logic via the ProxyAdmin it also owns. No timelock, no multisig → single point of failure. A second, higher-bar path: the 4-of-9 oracle Safe (0x21f73D…) can publish a false NAV to enable mispriced redemptions and cascade Aave liquidations (funds damage without direct theft). - Liveness (freeze / NAV distortion / forced exit): 1 EOA, three independent levers — the token admin can
pause()all transfers/redemptions; the allowlist owner EOA (0x7747…b2Fe) can revoke our address and force redemption at NAV; NAV publication can be stalled or distorted (the 4-of-9 oracle Safe, or the token admin viasetOracle). Any one suffices. - Single point of failure: yes — the token admin EOA breaches both tiers alone, and the allowlist EOA independently breaches forced-exit liveness. This is the eval’s headline risk (Risk #1).
Liquidity & exit
Primary path: offchainRedeem() burns tokens on-chain; Superstate (now Bitwise + Superstate jointly) settles USD/USDC at next-day NAV (T+1). No minimum, but the burn is irreversible before payout. Secondary path: none meaningful — allowlist restriction kills DEX/OTC liquidity; Aave Horizon is a borrow venue, not a sell venue, and free-float outside it is only ~$21.6M. Worst case: if FundOS or the off-chain settlement leg fails after burn, the holder has burned tokens with no trustless recourse — docs provide no contingency.
On-chain reads (2026-06-08): NAV 0xAfFd…00d9 = $11.6019/share (age ~2h) · totalSupply() 0x14d6…020c = 12,347,277.61 USCC (−16% in 33d) · Aave Horizon aToken 0x08b7…cb80 = 10.49M USCC (85% of supply) · implied on-chain tokenized value $143.3M. Fund AUM ($278.19M) and cash buffer ($61M) are off-chain, dated 2026-05-06, and pre-transition — not on-chain-verifiable and now stale; refresh from Bitwise before relying.
Defensible size at current liquidity (post-haircut): $15M — provisional. The prior math ($15M = 25% of a $61M cash buffer, 5.4% of $278M AUM) holds only if that buffer survived the transition and the 16% supply contraction — neither is confirmable on-chain. Redemption is at NAV (zero slippage, T+1 latency), so size is set by the fund’s cash buffer, not free-float; but with the buffer unverifiable and the on-chain trend negative (supply −16%, concentration 85%, free-float ~$21.6M, NAV softening), treat $15M as provisional pending a post-transition buffer confirmation from Bitwise.
Stress scenario: “NOCA exits 50% in 7d while Horizon liquidations and transition uncertainty drive concurrent redemptions.” A NAV drop pushes Horizon borrowers toward LT 88%; liquidator-driven redemptions plus general fear flow can plausibly exceed the cash buffer in days, forcing portfolio unwinds. CME futures and spot BTC/XRP close quickly; weETH (~16% of AUM) is the bottleneck — Ethereum DEX depth ~$30M, 24h volume ~$16M (DexScreener, 2026-05-06), so the weETH leg cannot be liquidated in a single day, and the unwrap-and-unstake path routes through the validator exit queue (days to weeks). At $15M we don’t touch that constraint; at $50M+ a concurrent stampede pushes our T+1 settlement out by days while NAV is marked down through forced sales. The now-thinner free-float and higher Horizon concentration make a stress redemption queue more likely than at last review.
External reviews
Source links for the third-party takes in the Risks table. No standalone risk rating (Bluechip, a dedicated LlamaRisk report, DeFiScan stage, or Exponential grade) exists for USCC — coverage is audit-focused. Per rubric.md, reviews older than 90d (⚠️) are stale — refresh before relying.