Summary

Position: two treasury Safes supply 11.330m USDC and borrow 11.002m USDC against 7,500 wstETH in Compound Institutional. The structure also carries 9.003m USDS debt against 7,000 wstETH on Spark, with borrow proceeds in 5.003m steakUSDC and 6.000m syrupUSDC.

Exit: transferring our Compound supply claim to the borrowing Safe cancels its debt internally. The fork recovered all Compound collateral even with zero pool USDC. Cash repayment followed by competing withdrawals instead left up to 4.048m USDC unavailable in the refreshed withdrawal sequence. That result established illiquidity, not permanent loss or a universal loss bound.

Dominant risk: the 3-of-4 governor can authorize transfers of custody assets without an upgrade. Pauses can obstruct repayment or collateral withdrawal; liquidation and counterparty bad debt can destroy value. The full strategy’s net return and benchmark comparison remain unresolved; commercial rewards are excluded.

Position, economics and protocol-risk assessment use the September 15 evidence below. Withdrawal-order and internal-cancellation tests were refreshed at block 25,989,240 on September 16.

Mechanism and true exposure

Account / venueAssets or claimsDebt
Supply Safe A — Compound11.330m USDC supply claim
Supply Safe A — Spark7,000 wstETH collateral9.003m USDS
Borrow Safe B — Compound7,500 wstETH collateral11.002m USDC
Borrow Safe B — vaults5.003m steakUSDC; 6.000m syrupUSDC, measured in underlying USDC

Spark borrowing funds part of Safe A’s Compound supply through USDS/DAI/USDC conversion. Safe B borrows Compound USDC and holds the vault shares. This creates two loans against wstETH, two liquidation venues and a redemption dependency on the vaults.

Safe ASupplies USDC to CompoundAlso owes USDS to SparkSafe BBorrows USDC against wstETHHolds steakUSDC + syrupUSDCCompoundUSDC supply claimCompoundUSDC debt + wstETH collateralResidual USDC withdrawalRequires available pool cashSpark needs separate repaymentwstETH withdrawalAfter debt is cancelledRequires withdrawals enabled ownsowes / posts transfer claimcancels debtremaining claimdebt cleared

The diagram shows the verified structure; balances and executable scenarios are in the tables.

Compound lends USDC, while wstETH remains collateral in custody. Our supply claim also bears exposure to 3.847m USDC borrowed by others against the market’s WETH, wstETH, cbBTC and WBTC collateral set. Our own supply and borrow balances are not automatically offset across Safes.

Oracle and liquidation: wstETH is valued using Chainlink ETH/USD × the capped Lido conversion ratio; no secondary-market wstETH discount enters that feed. Borrow capacity is 85% of collateral value; liquidation begins when debt exceeds 92% of collateral value. At the assessment pin, the borrowing Safe’s boundary was approximately $1,594.38/wstETH, holding debt and USDC price fixed. Liquidation deducts 7% of collateral valuation. Spark has its own liquidation test.

Net economics, benchmark and capacity

Return convention: USDC-equivalent income from Compound supply and both vaults, less Compound and Spark interest, vault fees, conversion costs and gas. Lido staking return and wstETH price changes should be shown separately when comparing leveraged carry with simply holding wstETH.

The pinned Compound rates were 2.664% supply APR / 3.556% borrow APR. Applied to the assessed balances, these imply approximately 302k USDC received − 391k paid = 89k annual Compound interest cost, assuming unchanged rates and balances. This is only the Compound component, not the full strategy return. Both on-chain reward tracking speeds were zero; no commercial reward entitlement, deadline or payout is counted.

Capacity: the pool held 5.264m USDC cash, with 20.064m supplied, 14.850m borrowed and 49,321 USDC reserves. The wstETH cap was 12,000, leaving 4,500 wstETH of top-up room. Adding supply or borrowing changes utilisation and both interest rates; no fixed marginal yield is assumed.

Open economic condition: refresh Spark borrowing cost, net vault yields and fees, and an executable same-denomination benchmark before stating full net carry or excess return. Earlier estimates for the smaller position do not describe this structure.

Exit, cost and latency

Internal cancellation: Safe A transfers its Compound supply claim to Safe B; Compound offsets the debt, after which Safe B withdraws its wstETH. This consumes the supply claim instead of returning its full face value in cash. Each Safe requires three owner signatures.

Cash repayment: redeem vault holdings, repay with USDC, then withdraw collateral and the supply claim. Repayment restores pool cash that other suppliers can withdraw before us.

Executed scenarioCompound wstETH recoveredRemaining Compound USDC claim unavailable
Pool cash exhausted; cancel debt internallyAll 7,500≈327k USDC
Repay with cash; nobody withdraws between our transactionsAll 7,5000
Others exhaust cash; we repay and withdraw firstAll 7,500≈327k USDC
Others exhaust cash; we repay; they withdraw again before usAll 7,500≈4.048m USDC

These refreshed withdrawal-order tests used block 25,989,240 (September 16), with no new borrowing or defaults and the necessary functions enabled. Received cash plus remaining recorded claims reconciled to the starting claim and accrued interest. See the withdrawal and protocol-risk research.

Full-structure exit: steakUSDC redeemed in one transaction. Syrup required a redemption request and Maple delegate processing; an actual large holder queueing first left our request unfunded. That blocked full Spark repayment even though Compound collateral could exit. With cooperative Syrup processing, the complete simulated unwind recovered all 14,500 posted wstETH and left approximately 2.327m USDC, consuming 2.26m gas across the component calls. PSM conversion fees were zero in that test. Safe execution overhead, live gas prices, swap execution and elapsed queue time were not established; no maximum exit latency is claimed.

Risks

IDRiskMechanism and evidence
R1Administrator custody and exit controlGovernor-authorized transfers removed all 7,500 wstETH and 5.264m pool USDC in the fork. Pauses blocked repayment or collateral withdrawal, including after debt reached zero.
R2Reward dependencyBoth reward tracking speeds were zero. Commercial rewards and eligibility are excluded from verified returns.
R3Cash competition and coordinated exitsInternal cancellation worked at zero cash; cash repayment followed by competing withdrawals left 4.048m USDC illiquid in the tested sequence.
R4Liquidation and oracle dependenceAt simulated $1,590/wstETH, Compound seized all 7,500 wstETH, cleared debt and credited ≈89,008 USDC; the collateral valuation deduction was $834,750. Positive stale oracle data was accepted; a reverting feed blocked withdrawal with debt.
R5Deployed code and audit scopeThe assessed implementation matches the earlier verified runtime except its embedded asset-list address. Historical asset-extension audit coverage does not establish coverage of all institutional changes.
R6Rate changes and insufficient backingAt simulated $20,000/WBTC, one borrower’s liquidation and collateral sale left 1.059m USDC negative reserves while our displayed supply claim remained unchanged. This is a pool shortfall, not our allocated loss.
R7Spark and vault dependenciesVault redemption capacity and delegate processing constrain cash recovery; Spark debt remains until separately repaid. Their yields, fees and borrowing cost determine full net carry.
R8Shared treasury keys and manager permissionsBoth Safes share the same six owners and 3-signature threshold. A manager granted Comet.allow withdrew without another Safe action; the test grant was synthetic.
R9Governance and configuration changesThe observed upgrade at block 25,984,875 raised the wstETH cap from 8,000 to 12,000. Empty administrative Safe queues do not prevent later changes.
R10USDC issuer controlBlacklisting Comet blocked USDC repayment and withdrawal. Internal cancellation still released wstETH when Compound’s relevant functions remained enabled.

Details and assumptions: withdrawal and protocol-risk research. The monitor specification now has nine checks: it adds backing and custody deficits, folds USDC freezes into exit blockage, and tracks residual supply and Syrup queue exposure. Monitor verification records the thresholds and remaining gaps. Several required reads lack Tower catalogue support; the specification is not deployed and does not establish monitoring readiness.

Trust and control

AuthorityVerified control
Governor — 3-of-4approveThis authorizes transfers of custody tokens; can pause functions and withdraw reserves. Its three direct EOA owner keys satisfy the Safe threshold.
Proxy-admin owner — 4-of-7Replaced the implementation with mock code in one fork call. All four governor owners also belong to this Safe.
Pause guardian — 5-of-9Can block repayment, transfers or withdrawals and deactivate collateral.
Treasury — two 3-of-6 SafesIdentical owner sets; no guard or modules. Separating the positions does not diversify signer risk.

The tested administrative calls require no intervening timelock; the governor and proxy-owner Safes had no guard or modules. The oracle cap manager was the Compound DAO Timelock. The fork verified authority after impersonating callers, not actual Safe signature execution. Existing manager grants and the off-chain independence of signer custody systems were not comprehensively assessed.

Evidence boundary

Assessment pin: Ethereum 25,984,909, 15 September 2026, 19:19:47 UTC, hash 0x44d5f6e0f9189bbf1d483aef8d8f087185325cf81a2e0e0b07d272f8af1b6ec9. Protocol-risk evidence contains balances, configuration, controls, oracle and code checks, source URLs/hashes, 12 mechanism tests and the counterparty-default test.

Refreshed withdrawal pin: Ethereum 25,989,240, 16 September 2026, 09:48:23 UTC, hash 0x77d43433a4cfe3f16d51814fb552bc8a928b1511b00517d1008a6a4a4d32c776. Withdrawal evidence contains fresh balances, repayment races and internal cancellation. The broader protocol-risk and full-structure exit tests retain their original pins.

Earlier full-structure exit / vault pin: Ethereum 25,983,624, 15 September 2026, 15:01:11 UTC, hash 0x1ff67128210b667c3a217213dc3c04d78d0a43708373ff9671db6b286386e528. Vault-exit evidence contains the snapshot, vault balances, conversion fees and full-exit tests. Syrup’s stated balance comes from this earlier pin. Replay commands are in the consolidated withdrawal and protocol-risk research.

Method: local Anvil forks, impersonated callers and explicitly stated price/code shocks; no live transactions. Results demonstrate conditional mechanisms, not forecasts, recovery guarantees or a comprehensive security audit. The OpenZeppelin asset-extension audit, reviewed September 15, supplies historical scope only.

Unresolved: full net carry and benchmark; commercial reward terms; audit coverage of the deployed institutional changes; oracle heartbeat/deviation and executable market-price comparison; refreshed Spark liquidation distance; vault credit composition; complete manager-permission inventory; live exit costs and queue latency. Prior snapshots and tests remain supporting records, not competing conclusions in this memo.