Reassess Sky USDS & sUSDS — September 9, 2026

[spalen0]

Closes #411.

Focused refresh of reports/report/sky-usds.md at snapshot block 25939320 (September 9, 2026). All figures re-read onchain via cast, the Sky chainlog, the Sky governance portal, DefiLlama, and Block Analitica's Observatory.

Changed facts

Supply and rates

• USDS mainnet totalSupply(): 7,821,339,325 → 6,645,559,216 (−15%)
• sUSDS totalAssets(): 5,875,069,384 → 4,674,942,773; share of mainnet supply 75.1% → 70.3%
• chi 1.1002 → 1.1090; ssr unchanged at ~3.60% APY
• VAT debt() 12.76B → 12.06B; DAI+USDS issued 12.04B → 11.22B
• Cross-chain USDS (DefiLlama): ~8.18B → ~6.64B; Sky Lending TVL $5.81B → **$5.51B**

PSM

• buf 400M → 800M DAI (786.5M held at snapshot); tin = tout = 0 unchanged
• Pocket USDC 4,109,011,415 → 3,948,440,886

Cross-chain (largest structural change)

• On 2026-07-13 the Spark Liquidity Layer withdrew its Base, Optimism and Unichain USDS/sUSDS positions to its mainnet ALM Proxy over the canonical rollup bridges (146.6M USDS from Base, 192.0M sUSDS).
• Native-escrow USDS ~448M → ~102M; escrowed sUSDS ~812M → ~343M; ~97% of escrowed USDS is now in the Arbitrum escrow.
• LayerZero-locked USDS ~48.7M → ~6.67M; sUSDS OFT still locks 0.
• This was an allocator rebalance over the ordinary bridge path — escrow contracts, wards, and bridge ownership are unchanged.

Collateralization (accuracy fix, not just a refresh)
The previous report's backing table omitted the Prime allocator vaults, which are the largest issuance class. Restated from onchain MCD_VAT.ilks Art × rate:

• LITE-PSM-USDC-A ~$4.73B (39.3%), ALLOCATOR-SPARK-A ~$3.06B, ALLOCATOR-BLOOM-A (Grove) ~$2.50B, ALLOCATOR-OBEX-A ~$403M, ALLOCATOR-PRYSM-A ~$25.0M, ALLOCATOR-GROVE-A $16.6M — allocators total **$6.01B, ~49.8% of VAT debt**
• All 35 ilks in ILK_REGISTRY enumerated: Σ(Art × rate) $11,367,876,592.81 + vat.vice() $690,101,841.19 = vat.debt() $12,057,978,434.00 exactly
• Crypto CDPs ~$388M (3.2%), LockStake ~$159M, legacy RWA ~$77.6M (0.6%)
• PSM-GUSD-A / PSM-PAX-A are dust (~$0.57 / ~$0.38) and DIRECT-SPK-AAVE-LIDO-USDS is zero — all three previously described as live secondary channels
• Observatory: offchain/tokenized credit ~$2.90B = 29.3% of loan-coverage backing (24.0% of VAT debt, down from ~25.9%); onchain 70.7%. The LitePSM is booked at the Pocket value, so the $786M pre-minted buf DAI is excluded from the backing denominator. Balance sheet ~$11.49B assets vs ~$11.42B liabilities
• The ~$690M vice was previously described as Vow surplus. It is unbacked debt created structurally by SSR/DSR accrual (drip() → vat.suck(vow, …)). Vow surplus vat.dai(vow) is $633.2M; net Vow position −$56.9M, matching Observatory's Operating Cash Balance line
• The VAT-debt vs DAI+USDS token-supply gap (~$837M) is internal VAT balances never withdrawn as tokens: Vow surplus $633.2M + Pot DSR deposits $203.5M. It was previously described as fee accrual and surplus

sUSDS mechanics (accuracy fix)

• The report said withdrawn USDS is minted on demand. redeem() burns sUSDS and transfers USDS the vault already holds; drip() mints only accrued yield via USDS_JOIN. The vault held 4,674,942,458 USDS against totalAssets() 4,674,942,773 at the snapshot

External dependencies (accuracy fix)

• Category 2C listed only USDC, Chainlink and LayerZero. Now enumerates the allocator counterparties from Observatory: offchain credit (Janus Henderson Treasury Fund $758.7M, BlackRock BUIDL $568.7M, Maple Syrup $398.6M, Galaxy $320.0M, Janus Henderson Anemoy AAA CLO $262.2M, Anchorage $220.0M, Securitize, Apollo, legacy RWA), onchain venues (SparkLend ~$1.25B, Steakhouse Morpho vaults ~$261M, Uniswap V3/V4 ~$176M) and third-party stablecoins (RLUSD $307.7M, PYUSD $240.0M)

Governance

• Chief hat() rotated 0x0aE3…e253 → 0x2bf5…2E05 (executed spell)
• SKY locked in Chief 7.02B → 7.17B (30.6% of supply); hat approvals 7.05B (98.3% of locked)
• Supporter concentration eased: largest (cloaky) 48.59% → 45.07%; top-3 95.95% → 90.6%. New top-5 supporter Tango (6.06%)

Other

• Immunefi scope 216 → 255 assets, last updated Sep 4, 2026
• Peg (365d daily series): min 0.9975 (2025-10-11), max 1.0011 (2026-02-23), latest 0.9999; hourly low 0.9947 (2025-10-06)
• DEX pool table refreshed — Curve USDS pairs have largely moved to Uniswap V4
• Added a cross-reference to the separate sky-stusds report (~209M USDS in stUSDS)

Unchanged critical controls

Verified at the snapshot, all identical to the June 2026 assessment:

• USDS impl 0x1923DfeE706A8E78157416C29cBCCFDe7cdF4102, sUSDS impl 0x4e7991e5C547ce825BdEb665EE14a3274f9F61e0 — no Upgraded events since block 25345447
• USDS.wards = {USDS_JOIN, PauseProxy} only — no Rely/Deny events since block 25345447
• MCD_PAUSE.delay() = 172800 (48 h), owner = address(0)
• LITE_PSM_MOM authority = Chief, owner = PauseProxy; full log scan still returns exactly 4 events, none a Halt
• Both OFT adapters owner = PauseProxy; every configured channel (USDS↔Solana, USDS↔Avalanche, sUSDS↔Avalanche) still 2-of-2 DVN (LayerZero Labs + Nethermind), 12/32 confirmations. sUSDS↔Solana has no peer set, so its 4-DVN reading is the LayerZero default and carries no exposure
• All chainlog addresses in the report unchanged

Score

1.3 → 1.67 / 5.0 — Minimal Risk → Low Risk (Approved with standard monitoring).

Category	Weight	June 2026	Now
Audits & Historical	20%	1.0	1.0
Centralization & Control	30%	1.2	2.00 (Governance 1.0 · Programmability 1.0 · Dependencies 1.5 → 4.0)
Funds Management	30%	1.8	2.25 (Collateralization 2.0 → 3.0 · Provability 1.5)
Liquidity	15%	1.0	1.0
Operational	5%	1.0	1.0
Final		1.3	1.67

The move is a scoring correction from newly documented facts, not a deterioration in the protocol. The supply contraction was orderly (no depeg beyond 0.25% on the daily series, no PSM halt, no fee change), and the offchain share of backing actually fell.

• External Dependencies 4.0 — a dozen-plus counterparties on which USDS solvency collectively depends matches rubric Score 4 ("many dependencies; critical functionality depends on them"). No single counterparty exceeds ~7.7% of backing, so Score 5 does not apply.
• Collateralization 3.0 — ~29.3% of backing is offchain and verified by periodic attestation, matching the rubric's Score-3 backing and verifiability columns; ~49.8% of VAT debt sits in allocator vaults whose assets are only visible through Observatory's look-through.
• Governance stays 1.0 — the rubric now awards Score 1 for a 48h+ timelock on critical operations (changed in 951bdf0), and MCD_PAUSE.delay() is exactly 48 h. Any reduction below 48 h would drop it to Score 2.
• Final score follows master's two-decimal round-down rule and hard tier lines (fix: round scores down (2dp, 1dp on reports list) with hard tier lines #484): 1.675 → 1.67.

Assessment History table seeded with the June 18, 2026 initial assessment plus this reassessment.

Companion artifacts

• reports/graph/sky-usds.yaml — node notes refreshed (sUSDS totalAssets(), Pocket USDC); added three Prime allocator nodes, two downstream dependency nodes, and allocates-to / deposits-into / controls edges. Governance path, proxies and mint authority are unchanged.
• src/data/bridges.json — both sky-usds detail strings updated for the new locked/escrowed amounts.

Validation

Re-run after merging origin/master (cbec543):

• npm run build — passes (update_stats → check_bridges → check_graphs → astro build); 0 graph errors, remaining warnings are in other reports
• npm test — 0 failures
• uv run scripts/check_defillama_links.py reports/report/sky-usds.md — all links valid

Unresolved / unverified

• The allocator counterparty amounts come from Block Analitica's Observatory look-through, not from contract reads. Only the Pocket USDC and the onchain lending/LP positions are independently verifiable; the offchain slice relies on attestations. The Key Risks bullet that named Monetalis and BlockTower was corrected, since those ilks (RWA007-A, RWA013-A) now read zero and dust onchain.
• What each Prime allocator actually holds is only visible through Observatory, not from the VAT ilk. Given this is ~49.8% of issuance, a dedicated per-allocator assessment would be worth scoping separately.
• The 1-year peg range shifted versus the June report (0.9953 → 0.9975 at the minimum) because CoinGecko returns daily granularity over a 365-day window; the report now states the methodology and adds the hourly low for the October 2025 stress event.

Follow-up (not in this PR)

Other reports still cite USDS as 1.3 / Minimal Risk: sky-stusds.md (lines 387, 802) and yearn-yvusd.md (lines 161, 408). They feed the USDS score into their own assessments, so they need their own reassessment rather than a find-and-replace. sky-stusds is being refreshed in #493.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
risk-score	Ready	Preview	Sep 9, 2026 9:35pm UTC

[spalen0]

Worked through the external review — verified every finding onchain at block 25939320 before changing anything. Five of seven stand and are fixed; two do not hold as stated.

Accepted

#1 Collateralization remainder (High) — confirmed as an error, with different numbers. "The remainder (~$733M) is stability-fee accrual and surplus held in MCD_VOW" was wrong. I enumerated all 35 ilks in ILK_REGISTRY and the VAT identity now reconciles to the cent:

Σ(Art × rate) over 35 ilks   $11,367,876,592.81
vat.vice()                      $690,101,841.19
                             -------------------
                             $12,057,978,434.00  = vat.debt()  ✅

So the gap is vice plus ~$41.8M of ilks the table had omitted (ALLOCATOR-PRYSM-A $25.0M, ALLOCATOR-GROVE-A $16.6M, WBTC-A $0.8M, WBTC-B $0.19M) — all now listed. Allocator share corrected 49.5% → 49.8%.

#3–#6 all confirmed and fixed: stale peg figures (0.9953, 0.47%), 216 assets in the Category 1 table, GUSD-A/PAX-A dust (verified Art = 0.5700 and 0.3808 DAI → "~$0.57 / ~$0.38"), and the ~30%+ USDC figure — now stated precisely as 39.3% of VAT debt for the LitePSM ilk, of which USDC itself is 32.7%.

Corrected

#1's evidence. MCD_VOW.bump() is not surplus — it is the flap auction lot size. bump() = 0 together with hump() = 2^256−1 means flap() is unreachable, i.e. legacy surplus auctions are disabled; it does not mean surplus is zero. The actual surplus is vat.dai(vow):

Getter	Value
vat.dai(vow) — surplus	$633,161,570.63
vat.sin(vow) — unbacked debt	$690,101,841.19
vow.Sin() — queued subset	$228,195,621.87
vow.Ash() — on auction	0
Net Vow position	−$56,940,270.55

Two consequences: Sin() is the queued subset, so $228.2M understates total unbacked debt ($690.1M); and that debt is not simply realized losses. sUSDS.drip() calls vat.suck(address(vow), address(this), diff * RAY) (verified in the deployed SUsds source at 0x4e79…61e0), so SSR/DSR accrual structurally mints sin at the Vow. The meaningful figure is the net position, −$56.9M — which matches Observatory's "Operating Cash Balance" liability line of $56,940,271 exactly. The report now states all of this.

#2 Cross-chain supply — not irreconcilable. Every Sky bridge is lock-and-mint, so escrowed L1 tokens are reattributed to the destination chain, not added on top. The all-chain total should therefore ≈ mainnet totalSupply(), not exceed it:

• Sept 9: mainnet 6,645,559,216; escrowed/locked 109,103,413; DefiLlama total 6,637,875,749 → 0.12% below the onchain total. Consistent.
• June 18: mainnet 7,821,343,827; escrowed 496,677,687; DefiLlama total 8,192,161,729 → 371M above mainnet. DefiLlama's "Ethereum" line was 7,695,484,042, i.e. it removed only ~126M of the ~497M escrowed, double-counting the rest.

So the June figure was the anomaly, not this one. That said, the metrics row did invite the misreading, so it has been rewritten to state the lock-and-mint methodology explicitly.

#7 Collateralization score — raised

Agreed on re-examination. Rubric Score 2 requires "100% onchain collateral"; ~24.0% of VAT debt is offchain credit confirmed by periodic attestation, which is squarely the Score-3 backing and verifiability profile. Against that, ~76% is onchain and real-time verifiable (USDC PSM alone is 39.3%), which is better than a flat 3.

The deciding factor is allocator opacity: ~49.8% of VAT debt sits in Prime allocator vaults where the ilk exposes only drawn debt, and reconstructing the assets requires Observatory's look-through rather than the VAT. That structure was undocumented in the June assessment.

Collateralization 2.0 → 2.5, Cat 3 1.8 → 2.0, final 1.3 → 1.4. Tier unchanged (Minimal Risk, 1.0–1.5). This is a scoring correction from newly documented facts, not a deterioration — the offchain share actually fell from 25.9% to 24.0%.

Follow-up needed (not touched here)

The score change makes three cross-references in other reports stale — sky-stusds.md (two spots) and yearn-yvusd.md (two spots) cite "Score 1.3". I have deliberately not edited them: those reports feed the USDS score into their own derivations, so they need their own reassessment rather than a blind find-and-replace. The tier they rely on ("Minimal Risk") is unchanged.

Validation after changes: npm run build passes (114 pages), check-graphs 0 errors, check-bridges ok, DefiLlama links valid. No new warnings attributable to sky-usds.

[spalen0]

Both P2 findings verified and both hold. Fixed in 665a72a.

P2-1 — Backing denominator

Confirmed, and the check that settles it is that Observatory books the LitePSM at the Pocket value, not the ilk debt:

Observatory "Lite-PSM (USDC)" backed   $3,948,693,131
LITE-PSM-USDC-A ilk debt (Art × rate)  $4,734,912,210
difference                               $786,219,079  ← pre-minted DAI

That is exactly the buf inventory, so the reviewer is right that it establishes no independent collateral — it is system-issued DAI sitting in the PSM waiting to be swapped for incoming USDC. The vice point lands the same way: $690.1M is unbacked by construction, so including it in a backing denominator inflates the onchain share.

Recomputed on a consistent denominator (Observatory loan-coverage backing, same 10:50 UTC snapshot already cited):

	Amount	Share of backing
Onchain	$7,009,621,225	70.74%
Offchain / tokenized credit	$2,898,832,111	29.26%
Total backed	$9,908,453,336	100%

So "~76% onchain" was wrong; it is 70.7%. The 24.0%-of-VAT-debt and 29.3%-of-backing figures were both arithmetically correct but answer different questions, and I had used the first to justify a claim about the second. The report now carries an explicit note on which denominator applies where, keeps the VAT-debt view only for the issuance table (labelled as such), and uses the backing denominator everywhere collateral quality is characterised. Also added the distinction you asked for between reported holdings and independently verified reserves — only the Pocket USDC and the onchain lending/LP positions survive a contract read; the offchain slice is attested.

Score justification rewritten on the corrected numbers. Collateralization stays 2.5, but I have written the case for 3.0 into the report explicitly — two of the rubric's three columns match Score 3 outright — and labelled it the least settled judgment in the assessment.

P2-2 — Allocator dependencies

Also correct. Category 2C listed three dependencies while ~49.8% of VAT debt sat in allocator vaults with entirely unlisted downstream exposure. Pulled the named counterparties from Observatory:

Offchain / tokenized credit (~29.3% of backing, ~$2.90B) — Janus Henderson Treasury Fund $758.7M · BlackRock BUIDL I Class $568.7M · Maple Syrup USDC $398.6M · Galaxy Warehouse OTC $320.0M · Janus Henderson Anemoy AAA CLO $262.2M · Anchorage OTC $220.0M · Janus Henderson AAA CLO $130.9M · Securitize Tokenized AAA CLO $103.2M · Anemoy/Apollo Diversified Credit $20.7M · legacy RWA $77.6M

Onchain (~21.4%, ~$2.12B) — SparkLend USDS/USDT/USDC/DAI/PYUSD ~$1.25B · Steakhouse-curated Morpho vaults ~$261M · Uniswap V4 PYUSD/USDS and USDT/USDS ~$150M · Uniswap V3 AUSD/USDC ~$26M

Third-party stablecoins held as backing — RLUSD $307.7M, PayPal USD $240.0M

The mechanical link is direct, which is why it belongs in the score: impairment at a counterparty hits the allocator's ilk, settles as sin at the Vow, and degrades USDS backing. Three rows added to the dependency table; graph updated with three allocator nodes, two downstream dependency nodes, and allocates-to / deposits-into / controls edges.

External Dependencies 1.5 → 3.0. The old 1.5 assumed a dependency list that stopped at USDC/Chainlink/LayerZero. Held at 3.0 rather than 4.0 because the counterparties are predominantly blue-chip rather than newer, no single allocator counterparty exceeds ~7.7% of backing, and no core user function (holding USDS, DAI conversion, SSR accrual) depends on any of them — only solvency does.

Net score movement

	Before	After
Cat 2 — Centralization	1.2	1.7
Cat 3 — Funds Management	1.8	2.0
Final	1.3	1.5

Tier unchanged: src/lib/colors.ts maps score <= 1.5 to Minimal Risk, and origin-arm, yearn-yvusdc and yearn-yvweth all sit at 1.5 with that tier.

Validation: build passes (114 pages), check-graphs 0 errors with no new warnings from the added nodes, check-bridges ok, DefiLlama links valid.

The four stale "Score 1.3" cross-references in sky-stusds.md and yearn-yvusd.md remain untouched and still need their own reassessment — the gap is now 0.2 rather than 0.1.

[ctmotox2]

I think this should be 4.0 under the current rubric. Score 4 covers many or newer dependencies where critical functionality depends on them. This section identifies more than a dozen counterparties and explicitly says they are critical to solvency. Their established reputations and diversification are useful mitigants, but solvency is itself a core requirement for USDS. Holding the token or converting it to DAI can still work mechanically even when the backing is impaired. Please raise External Dependencies to 4.0 and recalculate the category and final scores.

[spalen0]

Agreed, fixed in cbec543. External Dependencies is now 4.0. The report lists a dozen-plus counterparties (Circle; Janus Henderson/Anemoy, BlackRock BUIDL, Maple, Galaxy, Anchorage, Securitize, Apollo; SparkLend, Morpho, Uniswap; RLUSD, PYUSD), and USDS solvency depends on them collectively. That matches rubric Score 4. Established names and the ~7.7% largest single exposure are kept as mitigants but no longer lower the row. Cat 2 is now 2.00.

[ctmotox2]

I would use 3.0 here. With 29.3% of backing in offchain assets verified through periodic attestations, this matches the rubric’s score 3. The remaining onchain backing does not remove that dependence.

[spalen0]

Agreed, fixed in cbec543. Collateralization is now 3.0. About 29.3% of loan-coverage backing is offchain and verified by periodic attestation, which matches the Score-3 backing and verifiability columns. Allocator opacity (~49.8% of VAT debt) supports the same result. Cat 3 is now 2.25.

[ctmotox2]

I would score governance 2.0. The rubric requires a timelock of at least seven days for score 1, while Sky has 48 hours and broad upgrade and minting powers. Continuous voting does not extend that reaction window to seven days.

[spalen0]

Left at 1.0. After this comment was written, 951bdf0 changed the rubric so Score 1 requires a "48h+ timelock on critical operations". MCD_PAUSE.delay() is exactly 172800 (48 h), so the timelock column meets Score 1 with no margin. The report still said 48 h was "below the 7-day threshold", so that text is corrected in cbec543. The report also no longer relies on continuous voting to justify the score. It now states that any delay() reduction below 48 h would drop this row to Score 2, and that a single supporter above 50% of hat approvals triggers a re-review.

[ctmotox2]

Please correct this: redeem() burns sUSDS and transfers USDS already held by the vault. drip() mints only accrued yield via USDS_JOIN, not the full withdrawal amount.

[spalen0]

Fixed in cbec543. redeem() burns sUSDS and transfers USDS the vault already holds. drip() mints only accrued yield via vat.suck + USDS_JOIN. I checked this against the deployed SUsds source and onchain balances at block 25939320: the vault holds 4,674,942,458 USDS against totalAssets() of 4,674,942,773.

[github-actions]

Deploy preview for risk-score ready!

Project:	risk-score
Status:	✅  Deploy successful!
Preview URL:	https://risk-score-2wnvij8lu-yearn.vercel.app
Latest Commit:	cbec543

Deployed with vercel-action