Summary
Position: two treasury Safes supply 11.330m USDC and borrow 11.002m USDC against 7,500 wstETH in Compound Institutional. The structure also carries 9.003m USDS debt against 7,000 wstETH on Spark, with borrow proceeds in 5.003m steakUSDC and 6.000m syrupUSDC.
Exit: transferring our Compound supply claim to the borrowing Safe cancels its debt internally. The fork recovered all Compound collateral even with zero pool USDC. Cash repayment followed by competing withdrawals instead left up to 4.048m USDC unavailable in the refreshed withdrawal sequence. That result established illiquidity, not permanent loss or a universal loss bound.
Dominant risk: the 3-of-4 governor can authorize transfers of custody assets without an upgrade. Pauses can obstruct repayment or collateral withdrawal; liquidation and counterparty bad debt can destroy value. The full strategy’s net return and benchmark comparison remain unresolved; commercial rewards are excluded.
Position, economics and protocol-risk assessment use the September 15 evidence below. Withdrawal-order and internal-cancellation tests were refreshed at block 25,989,240 on September 16.
Mechanism and true exposure
| Account / venue | Assets or claims | Debt |
|---|---|---|
| Supply Safe A — Compound | 11.330m USDC supply claim | — |
| Supply Safe A — Spark | 7,000 wstETH collateral | 9.003m USDS |
| Borrow Safe B — Compound | 7,500 wstETH collateral | 11.002m USDC |
| Borrow Safe B — vaults | 5.003m steakUSDC; 6.000m syrupUSDC, measured in underlying USDC | — |
Spark borrowing funds part of Safe A’s Compound supply through USDS/DAI/USDC conversion. Safe B borrows Compound USDC and holds the vault shares. This creates two loans against wstETH, two liquidation venues and a redemption dependency on the vaults.
The diagram shows the verified structure; balances and executable scenarios are in the tables.
Compound lends USDC, while wstETH remains collateral in custody. Our supply claim also bears exposure to 3.847m USDC borrowed by others against the market’s WETH, wstETH, cbBTC and WBTC collateral set. Our own supply and borrow balances are not automatically offset across Safes.
Oracle and liquidation: wstETH is valued using Chainlink ETH/USD × the capped Lido conversion ratio; no secondary-market wstETH discount enters that feed. Borrow capacity is 85% of collateral value; liquidation begins when debt exceeds 92% of collateral value. At the assessment pin, the borrowing Safe’s boundary was approximately $1,594.38/wstETH, holding debt and USDC price fixed. Liquidation deducts 7% of collateral valuation. Spark has its own liquidation test.
Net economics, benchmark and capacity
Return convention: USDC-equivalent income from Compound supply and both vaults, less Compound and Spark interest, vault fees, conversion costs and gas. Lido staking return and wstETH price changes should be shown separately when comparing leveraged carry with simply holding wstETH.
The pinned Compound rates were 2.664% supply APR / 3.556% borrow APR. Applied to the assessed balances, these imply approximately 302k USDC received − 391k paid = 89k annual Compound interest cost, assuming unchanged rates and balances. This is only the Compound component, not the full strategy return. Both on-chain reward tracking speeds were zero; no commercial reward entitlement, deadline or payout is counted.
Capacity: the pool held 5.264m USDC cash, with 20.064m supplied, 14.850m borrowed and 49,321 USDC reserves. The wstETH cap was 12,000, leaving 4,500 wstETH of top-up room. Adding supply or borrowing changes utilisation and both interest rates; no fixed marginal yield is assumed.
Open economic condition: refresh Spark borrowing cost, net vault yields and fees, and an executable same-denomination benchmark before stating full net carry or excess return. Earlier estimates for the smaller position do not describe this structure.
Exit, cost and latency
Internal cancellation: Safe A transfers its Compound supply claim to Safe B; Compound offsets the debt, after which Safe B withdraws its wstETH. This consumes the supply claim instead of returning its full face value in cash. Each Safe requires three owner signatures.
Cash repayment: redeem vault holdings, repay with USDC, then withdraw collateral and the supply claim. Repayment restores pool cash that other suppliers can withdraw before us.
| Executed scenario | Compound wstETH recovered | Remaining Compound USDC claim unavailable |
|---|---|---|
| Pool cash exhausted; cancel debt internally | All 7,500 | ≈327k USDC |
| Repay with cash; nobody withdraws between our transactions | All 7,500 | 0 |
| Others exhaust cash; we repay and withdraw first | All 7,500 | ≈327k USDC |
| Others exhaust cash; we repay; they withdraw again before us | All 7,500 | ≈4.048m USDC |
These refreshed withdrawal-order tests used block 25,989,240 (September 16), with no new borrowing or defaults and the necessary functions enabled. Received cash plus remaining recorded claims reconciled to the starting claim and accrued interest. See the withdrawal and protocol-risk research.
Full-structure exit: steakUSDC redeemed in one transaction. Syrup required a redemption request and Maple delegate processing; an actual large holder queueing first left our request unfunded. That blocked full Spark repayment even though Compound collateral could exit. With cooperative Syrup processing, the complete simulated unwind recovered all 14,500 posted wstETH and left approximately 2.327m USDC, consuming 2.26m gas across the component calls. PSM conversion fees were zero in that test. Safe execution overhead, live gas prices, swap execution and elapsed queue time were not established; no maximum exit latency is claimed.
Risks
| ID | Risk | Mechanism and evidence |
|---|---|---|
| R1 | Administrator custody and exit control | Governor-authorized transfers removed all 7,500 wstETH and 5.264m pool USDC in the fork. Pauses blocked repayment or collateral withdrawal, including after debt reached zero. |
| R2 | Reward dependency | Both reward tracking speeds were zero. Commercial rewards and eligibility are excluded from verified returns. |
| R3 | Cash competition and coordinated exits | Internal cancellation worked at zero cash; cash repayment followed by competing withdrawals left 4.048m USDC illiquid in the tested sequence. |
| R4 | Liquidation and oracle dependence | At simulated $1,590/wstETH, Compound seized all 7,500 wstETH, cleared debt and credited ≈89,008 USDC; the collateral valuation deduction was $834,750. Positive stale oracle data was accepted; a reverting feed blocked withdrawal with debt. |
| R5 | Deployed code and audit scope | The assessed implementation matches the earlier verified runtime except its embedded asset-list address. Historical asset-extension audit coverage does not establish coverage of all institutional changes. |
| R6 | Rate changes and insufficient backing | At simulated $20,000/WBTC, one borrower’s liquidation and collateral sale left 1.059m USDC negative reserves while our displayed supply claim remained unchanged. This is a pool shortfall, not our allocated loss. |
| R7 | Spark and vault dependencies | Vault redemption capacity and delegate processing constrain cash recovery; Spark debt remains until separately repaid. Their yields, fees and borrowing cost determine full net carry. |
| R8 | Shared treasury keys and manager permissions | Both Safes share the same six owners and 3-signature threshold. A manager granted Comet.allow withdrew without another Safe action; the test grant was synthetic. |
| R9 | Governance and configuration changes | The observed upgrade at block 25,984,875 raised the wstETH cap from 8,000 to 12,000. Empty administrative Safe queues do not prevent later changes. |
| R10 | USDC issuer control | Blacklisting Comet blocked USDC repayment and withdrawal. Internal cancellation still released wstETH when Compound’s relevant functions remained enabled. |
Details and assumptions: withdrawal and protocol-risk research. The monitor specification now has nine checks: it adds backing and custody deficits, folds USDC freezes into exit blockage, and tracks residual supply and Syrup queue exposure. Monitor verification records the thresholds and remaining gaps. Several required reads lack Tower catalogue support; the specification is not deployed and does not establish monitoring readiness.
Trust and control
| Authority | Verified control |
|---|---|
| Governor — 3-of-4 | approveThis authorizes transfers of custody tokens; can pause functions and withdraw reserves. Its three direct EOA owner keys satisfy the Safe threshold. |
| Proxy-admin owner — 4-of-7 | Replaced the implementation with mock code in one fork call. All four governor owners also belong to this Safe. |
| Pause guardian — 5-of-9 | Can block repayment, transfers or withdrawals and deactivate collateral. |
| Treasury — two 3-of-6 Safes | Identical owner sets; no guard or modules. Separating the positions does not diversify signer risk. |
The tested administrative calls require no intervening timelock; the governor and proxy-owner Safes had no guard or modules. The oracle cap manager was the Compound DAO Timelock. The fork verified authority after impersonating callers, not actual Safe signature execution. Existing manager grants and the off-chain independence of signer custody systems were not comprehensively assessed.
Evidence boundary
Assessment pin: Ethereum 25,984,909, 15 September 2026, 19:19:47 UTC, hash 0x44d5f6e0f9189bbf1d483aef8d8f087185325cf81a2e0e0b07d272f8af1b6ec9. Protocol-risk evidence contains balances, configuration, controls, oracle and code checks, source URLs/hashes, 12 mechanism tests and the counterparty-default test.
Refreshed withdrawal pin: Ethereum 25,989,240, 16 September 2026, 09:48:23 UTC, hash 0x77d43433a4cfe3f16d51814fb552bc8a928b1511b00517d1008a6a4a4d32c776. Withdrawal evidence contains fresh balances, repayment races and internal cancellation. The broader protocol-risk and full-structure exit tests retain their original pins.
Earlier full-structure exit / vault pin: Ethereum 25,983,624, 15 September 2026, 15:01:11 UTC, hash 0x1ff67128210b667c3a217213dc3c04d78d0a43708373ff9671db6b286386e528. Vault-exit evidence contains the snapshot, vault balances, conversion fees and full-exit tests. Syrup’s stated balance comes from this earlier pin. Replay commands are in the consolidated withdrawal and protocol-risk research.
Method: local Anvil forks, impersonated callers and explicitly stated price/code shocks; no live transactions. Results demonstrate conditional mechanisms, not forecasts, recovery guarantees or a comprehensive security audit. The OpenZeppelin asset-extension audit, reviewed September 15, supplies historical scope only.
Unresolved: full net carry and benchmark; commercial reward terms; audit coverage of the deployed institutional changes; oracle heartbeat/deviation and executable market-price comparison; refreshed Spark liquidation distance; vault credit composition; complete manager-permission inventory; live exit costs and queue latency. Prior snapshots and tests remain supporting records, not competing conclusions in this memo.