f(x) Protocol — fxUSD

Revision Notes

This is the second pass on this report. The first pass (March 29, 2026) scored fxUSD at 2.5 with two material risk drivers: (1) no timelock on proxy upgrades and (2) modest TVL (~$29M). Both have changed since:

1. 3-day timelock now controls all proxy upgrades. On April 20, 2026 (block 24,920,358, tx 0xeb7c71fc855cd928bb4b300eaf7cc5e8b0ad86b625a109f3308b0552068b9fd8), ProxyAdmin ownership was transferred from the 6/9 operational multisig directly to a TimelockController at 0x68863fb8855b04509a835082478D6E3D0bE4E61a with a 259,200-second (3-day) minimum delay. The 6/9 multisig now holds PROPOSER, EXECUTOR, and CANCELLER roles but is no longer admin of the timelock itself.
2. fxUSD supply and TVL grew substantially. Supply ~18.1M → ~53.9M (~3x). DeFi Llama TVL ~$29M → ~$89M (60-day peak $91M on May 12, 2026; all-time peak $271M on August 24, 2025; 182 days above $100M between May–November 2025).

These changes lower the Centralization (Governance) subcategory from 4.0 → 2.5 and the Historical Track Record subcategory from 2.5 → 2.0, moving the overall score from 2.5 → 2.2 and the risk tier from Medium → Low.

Contract Addresses

Core Token Contracts

Contract	Address	Type
fxUSD	0x085780639CC2cACd35E474e71f4d000e2405d8f6	TransparentUpgradeableProxy (impl: FxUSDRegeneracy 0xf729422d68c2cf00574fb5712972454cf402a9b1)
FXN (governance token)	0x365AccFCa291e7D3914637ABf1F7635dB165Bb09	ERC-20
veFXN	0xEC6B8A3F3605B083F7044C0F31f2cac0caf1d469	Vote-escrowed FXN

V2 Collateral (PoolManager — Primary Custodian)

In V2, all position collateral is custodied by the PoolManager contract — individual pool contracts (xstETH, xWBTC) are accounting/NFT contracts only and hold zero tokens.

Contract	Address	Role
PoolManager (Long)	0x250893CA4Ba5d05626C785e8da758026928FCD24	Custodies all V2 collateral, manages xPOSITION/fxMINT
ShortPoolManager	0xaCDc0AB51178d0Ae8F70c1EAd7d3cF5421FDd66D	Manages sPOSITION positions (borrows from PoolManager)

Collateral held in PoolManager (May 13, 2026):

Asset	Amount	USD Value
wstETH (xstETH pool 0x6ecfa38fee8a5277b91efda204c235814f0122e8)	~4,451.58 wstETH	~$12.38M
WBTC (xWBTC pool 0xab709e26fa6b0a30c119d8c55b887ded24952473)	~901.78 WBTC	~$71.76M
Total		~$84.14M

Overall V2 collateralization ratio: ~156% (~$84.14M collateral / ~$53.89M fxUSD debt at NAV $0.9993). Prices from Chainlink: BTC $79,585.64; ETH $2,252.94; wstETH/stETH ratio 1.2344.

Note: fxUSD.isUnderCollateral() returns true — this flag reflects legacy V1 market status (wstETH treasury at 81% CR with only ~$8.5K remaining). The V2 system via PoolManager maintains >150% collateralization.

Legacy V1 Treasury Contracts (Minimal Remaining Value)

Treasury	Address	Base Token	Remaining Value
stETH Treasury	0xED803540037B0ae069c93420F89Cd653B6e3Df1f	wstETH	~$8.6K (under-collateralized, ~264 legacy fxUSD)
sfrxETH Treasury	0xcfEEfF214b256063110d3236ea12Db49d2dF2359	sfrxETH	~$149K

Reserve Pool

Contract	Address	Holdings
Reserve Pool	0xE93F5DD55eC9bdAbbba5eA88E4b4f3C253ee45Ed	17.43 wstETH (~$43K) + 0.38 WBTC (~$25K) + 1,229 fxUSD

Market & Infrastructure Contracts

Contract	Address	Purpose
PegKeeper	0x50562fe7e870420F5AAe480B7F94EB4ace2fcd70	Maintains fxUSD peg via Stability Pool
Configuration	0x16b334f2644cc00b85DB1A1efF0C2C395e00C28d	Protocol parameter configuration
ProxyAdmin	0x9b54b7703551d9d0ced177a78367560a8b2edda4	Controls all proxy upgrades; owned by TimelockController (since April 20, 2026)
TimelockController	0x68863fb8855b04509a835082478D6E3D0bE4E61a	3-day (259,200s) minimum delay on ProxyAdmin actions; PROPOSER/EXECUTOR/CANCELLER = 6/9 multisig
GatewayRouter	0xA5e2Ec4682a32605b9098Ddd7204fe84Ab932fE4	User-facing router
GaugeController	0xe60eB8098B34eD775ac44B1ddE864e098C6d7f37	FXN emissions gauge voting

Stability Pool & fxSAVE

Contract	Address	Purpose
fxSP (Stability Pool)	0x65C9A641afCEB9C0E6034e558A319488FA0FA3be	Holds fxUSD + USDC for peg maintenance
fxSAVE	0x7743e50F534a7f9F1791DdE7dCD89F7783Eefc39	Auto-compounding fxSP vault (~$30M)

Governance

Contract	Address	Configuration
Operational Multisig	0x26B2ec4E02ebe2F54583af25b647b1D619e67BbF	6-of-9 Gnosis Safe (v1.3.0), 594 nonce
Emergency Multisig	0x28c921adAC4c1072658eB01a28DA06b5F651eF62	3-of-4 Gnosis Safe (emergency pause)

DEX Liquidity Pools

Pool	Address	TVL
Curve USDC/fxUSD	0x5018BE882DccE5E3F2f3B0913AE2096B9b3fB61f	~$7.73M (3.67M USDC + 4.07M fxUSD)
Curve DeFi Stable Avengers	0x8B878AFE454e31CF0A79c6D7cf2f077DD286C12f	~$25K of fxUSD (drained materially since March 2026)

Audits and Due Diligence Disclosures

f(x) Protocol has an extensive audit history with 21 audit reports from 3 reputable security firms:

Audit Scope	Date	Auditor	Link
f(x) Protocol V1	June 14, 2023	Secbit	Report
Stability Pool	July 25, 2023	Secbit	Report
f(x) Protocol V1 Update	September 17, 2023	Secbit	Report
V1 Gauge Mechanism	November 29, 2023	Secbit	Report
Stability Pool Boost	December 13, 2023	Secbit	Report
veFXN Boost Delegation	January 18, 2024	Secbit	Report
V1 fxUSD	February 23, 2024	Secbit	Report
f(x) Protocol Overall	April 16, 2024	Trail of Bits	Report
btcUSD	April 19, 2024	Secbit	Report
New Oracle Design	May 14, 2024	Secbit	Report
arUSD	June 18, 2024	Secbit	Report
New Oracle Design	July 10, 2024	Trail of Bits	Report
aFXN	July 26, 2024	Secbit	Report
f(x) Protocol V2	January 1, 2025	Secbit	Report
V2 WBTC Oracle & Batch Ops	March 17, 2025	Secbit	Report
fxSAVE	March 17, 2025	Secbit	Report
V2.1 (sPOSITIONs)	July 22, 2025	Secbit	Report
f(x) Protocol V2.0	August 4, 2025	OpenZeppelin	Report
Limit Orders & fxMINT	October 30, 2025	Secbit	Report
Omnichain fxUSD (EIP-3009)	January 26, 2026	Secbit	Report
f(x) 2.0 for Katana Chain	March 9, 2026	Secbit	Report

The protocol has a complex smart contract architecture spanning multiple treasuries, markets, position managers, stability pools, oracle systems, and governance contracts. All core contracts are upgradeable proxies controlled by the ProxyAdmin. Every version of the protocol in production has been audited, with continuous audit coverage from Secbit since V1.

Bug Bounty

No bug bounty program was found on Immunefi, Code4rena, Sherlock, or other major platforms. The protocol is not registered with SEAL Safe Harbor. Despite the extensive audit history, the absence of a bug bounty program is a notable gap.

Notable vulnerability: In April 2025, ChainSecurity responsibly disclosed a double flash loan vulnerability that could have resulted in >$2M in losses. The f(x) team promptly fixed it by removing the Balancer V2 flash loan integration. This was caught through external research, not through a bug bounty program.

Historical Track Record

• In production since: February 23, 2024 (~27 months as of May 2026)
• Current TVL: ~$89.4M (DeFi Llama); ~$84.14M collateral backing ~$53.89M fxUSD debt in PoolManager
• TVL history: Spent 182 days above $100M between May–November 2025; all-time peak $271M on August 24, 2025. Currently $89.4M with last-60-day peak of $91M.
• fxUSD supply growth: ~18.1M (March 2026) → ~53.9M (May 2026), roughly 3x in 6 weeks
• Peg stability: fxUSD has generally maintained its peg, with an ATL of $0.953 on December 5, 2024. Current NAV ~$0.9993
• Security incidents: One responsibly disclosed vulnerability (ChainSecurity, April 2025) — no exploits or fund losses
• No concentration risk data available — top holder information requires PRO Etherscan tier

The protocol has operated for over 2 years with no exploits or fund losses. The December 2024 ATL of $0.953 (~4.7% deviation) is notable but represents a relatively mild depeg for a DeFi stablecoin. TVL has scaled from launch to a sustained $100M+ band in mid-2025 and is currently in the $80–$90M range.

Funds Management

In V2, all fxUSD position collateral is custodied by the PoolManager contract (0x250893CA4Ba5d05626C785e8da758026928FCD24), which currently holds ~4,451.58 wstETH (~$12.38M) and ~901.78 WBTC (~$71.76M) — totaling ~$84.14M backing ~$53.89M fxUSD debt (~156% CR). The system does not delegate position collateral to external protocols. The Stability Pool separately deploys USDC to Aave (up to 80% cap) for yield generation on behalf of fxSP depositors.

Accessibility

• Who can mint: Anyone can mint fxUSD by depositing collateral (wstETH, WBTC in V2) through fxMINT or by opening xPOSITION/sPOSITION positions. No whitelist required.
• Minting mechanism: Atomic in a single transaction via flash loans. Users deposit collateral, fxUSD is minted proportional to their leverage/debt position.
• Redemption: Anyone can redeem fxUSD for $1 worth of underlying collateral (wstETH/WBTC) as a last-resort peg mechanism, with a 0.5% fee (creating a hard floor at ~$0.995).
• Fees: Opening fee: 0.5% of minted debt (fxMINT), 0.3% (xPOSITION/sPOSITION). Closing fee: 0.2% (fxMINT), 0.1% (xPOSITION/sPOSITION). 0% ongoing annual interest for fxMINT.
• Rate limits: Maximum concurrent redemption is 20% of xPOSITION (highest leverage first).

Collateralization

• Fully collateralized onchain by crypto-native assets held in the PoolManager: wstETH (~$12.38M) and WBTC (~$71.76M)
• Over-collateralization: The V2 system maintains ~156% CR (~$84.14M collateral backing ~$53.89M fxUSD debt). The system requires >100% CR; Stability Mode triggers protective measures at CR <130%. Note: fxUSD.isUnderCollateral() currently returns true due to the legacy V1 wstETH market (81% CR with only ~$8.5K remaining) — the V2 PoolManager system is healthy at >150%.
• Collateral quality: wstETH (Lido) and WBTC — blue-chip DeFi assets with deep liquidity. V2 concentrates collateral in two high-quality assets rather than the V1 approach of 6+ collateral types.
• Liquidations are on-chain via two mechanisms:
  • Rebalancing (Liquidation Brake): Triggered at 88% LTV — partial position reduction, 2.5% bounty
  • Hard Liquidation: Triggered at 95% LTV — full position closure, 4% bounty
• Band system: Positions are grouped into 0.15% price bands for efficient batch rebalancing by keepers
• Peg stability mechanisms (5 layers):
  1. Organic market pressure from position open/close
  2. Stability Pool peg keeper (buys fxUSD below peg using USDC)
  3. Funding Level I: triggered when Stability Pool USDC <5%, cost = Aave USDC borrow rate
  4. Enhanced protection: Curve EMA < $0.998 triggers mint pause + Funding Level II (10x Aave rate)
  5. Redemption: hard floor at $0.995 via 1:1 collateral redemption with 0.5% fee
• Risk curation: Governance-adjustable parameters include LTV thresholds, fees, oracle deviations, and collateral caps

Provability

• Reserves fully verifiable on-chain — all collateral sits in treasury contracts readable by anyone
• Exchange rate / NAV: Computed on-chain algorithmically via the f(x) invariant formula. No off-chain inputs for NAV calculation.
• Oracle system: Multi-source design:
  • stETH/USD: Chainlink ETH/USD + Uniswap V3 USDC/ETH (0.05% and 0.3% pools) + Curve stETH/ETH EMA + Uniswap V3 stETH/ETH. 1% deviation threshold.
  • WBTC/USD: Chainlink BTC/USD + Chainlink WBTC/BTC + Uniswap V3 pools (WBTC/USDC, WBTC/ETH, USDC/ETH). 2% deviation threshold.
• Admin minting: The fxUSD contract is upgradeable (TransparentUpgradeableProxy). The 6/9 multisig controls the ProxyAdmin and could theoretically upgrade the implementation to allow unbacked minting. Under the current implementation, fxUSD can only be minted against collateral through the PoolManager.
• isUnderCollateral flag: The fxUSD contract currently reports isUnderCollateral() = true due to a legacy V1 wstETH market with 81% CR (~$8.5K remaining, negligible). The active V2 system holds ~$84.14M collateral against ~$53.89M fxUSD debt (~156% CR).
• No third-party verification (no Chainlink PoR or custodian attestation needed — all on-chain)

Liquidity Risk

• Primary liquidity: Curve USDC/fxUSD pool at ~$7.73M TVL with balanced composition (~47% USDC, ~53% fxUSD)
• Secondary pools: Multiple smaller Curve pools (DeFi Stable Avengers, MSUSD/fxUSD, USDNR/fxUSD, REUSD/fxUSD) — most have shrunk materially since the original March 2026 assessment as supply migrated toward the primary USDC pool; the DeFi Stable Avengers pool now holds only ~$25K of fxUSD (verified onchain May 13, 2026)
• Redemption mechanism: Direct 1:1 redemption for underlying collateral (wstETH/WBTC) with 0.5% fee, capped at 20% of xPOSITION per redemption event
• Stability Pool exits: 1% early exit fee, 60-minute redemption window
• Slippage analysis: With ~$7.73M in the primary Curve pool, a $500K swap would experience moderate slippage. For larger exits ($1M+), the direct redemption mechanism at 0.5% fee provides a reliable floor.
• Historical liquidity during stress: The December 2024 depeg to $0.953 suggests that liquidity was somewhat thin during that period, though the peg recovered.
• Large holder exit: Given ~$53.9M market cap and ~$7.73M primary DEX pool (~14% of supply), DEX liquidity has not scaled with the 3x supply growth since March 2026. Large holders (>$1M) would likely rely primarily on direct redemption rather than DEX exits.

Centralization & Control Risks

Governance

• All contracts are upgradeable via TransparentUpgradeableProxy, controlled by ProxyAdmin 0x9b54b7703551d9d0ced177a78367560a8b2edda4
• 3-day timelock on upgrades (since April 20, 2026): ProxyAdmin is now owned by a TimelockController at 0x68863fb8855b04509a835082478D6E3D0bE4E61a with a 259,200-second (3-day) minimum delay. Any upgrade or admin call must be scheduled, then executed after 3 days, giving users time to react.
• Operational multisig: 6-of-9 Gnosis Safe 0x26B2ec4E02ebe2F54583af25b647b1D619e67BbF
  • Known signers: Diligent Deer, Paul, chiaki644, Gordon, Guo Yu, Jamie, Martin Krung, Sharlyn Wu, vfat
  • Mix of known and semi-anonymous contributors
  • Holds PROPOSER, EXECUTOR, and CANCELLER roles on the TimelockController (but not TIMELOCK_ADMIN_ROLE)
• Emergency multisig: 3-of-4 Gnosis Safe 0x28c921adAC4c1072658eB01a28DA06b5F651eF62
  • Signers: Gordon, Guo Yu, Jamie, Sharlyn Wu (all team members)
  • Can pause xPOSITION and sPOSITION operations directly (pause path does not go through the timelock)
• Governance voting: Snapshot space fxn.eth using veFXN voting power. 32 proposals to date with low voter participation (4-16 voters, ~118-172K veFXN per vote).
• Privileged roles: The 6/9 multisig can propose to upgrade all contracts, change fee parameters, modify oracle configurations, and alter system addresses — all subject to the 3-day timelock delay. The 3/4 emergency multisig can pause position operations without delay.

Trust model: The 6/9 multisig retains broad upgrade authority but can no longer act instantly; users have 3 days to detect and respond to any scheduled change. The CANCELLER role (also held by the multisig itself) means a compromised multisig could theoretically schedule and immediately cancel actions to spam, but cannot bypass the 3-day delay for an actual upgrade. The emergency 3/4 multisig retains immediate pause authority but cannot upgrade contracts.

Programmability

• Highly programmatic: Core operations (minting, redemption, liquidation, rebalancing, peg keeping) are all handled by smart contracts
• NAV/PPS: Calculated on-chain algorithmically via the f(x) invariant — no manual price updates
• Keepers: Rebalancing and liquidation depend on external keepers to trigger transactions. Keeper incentive is 1% (0.01% for fxSAVE harvesting). If keepers fail to act, positions may not be rebalanced in time.
• Stability Pool peg keeper: Automated but depends on sufficient USDC deposits in the pool
• Oracle updates: Chainlink feeds + Uniswap/Curve on-chain TWAP/EMA — no off-chain dependencies for price feeds

External Dependencies

• Chainlink: ETH/USD and BTC/USD price feeds — critical for all position operations and liquidations
• Uniswap V3: TWAP oracle data used as secondary/validation price source
• Curve: stETH/ETH EMA oracle + fxUSD/USDC pool for peg monitoring
• Aave: Stability Pool deploys USDC to Aave Core (up to 80% cap) and wstETH to Aave Prime (up to 80%)
• Lido: wstETH is the primary ETH collateral in V2 (~$12.38M)
• LayerZero: Used for omnichain fxUSD bridging (cross-chain OFT)

The protocol depends on multiple well-established DeFi protocols. Chainlink is the most critical dependency — oracle failure would impair pricing and liquidations. Aave exposure is capped and non-critical to core fxUSD backing.

Operational Risk

• Team transparency: AladdinDAO was launched by 14 founding contributors including well-known figures: Sharlyn Wu (former CIO of Huobi), Robert Leshner (Compound founder), Kain Warwick (Synthetix founder), Hart Lambur (UMA co-founder). Core development team (~12) and boule members (~30) are partially doxxed.
• Institutional backers: Polychain Capital, Digital Currency Group, 1kx, Multicoin Capital, CMS, Nascent, Alameda Research, DeFi Alliance
• Documentation quality: Good — comprehensive GitBook documentation covering mechanisms, risk framework, fees, and deployments. Active GitHub with open-source contracts.
• Legal structure: AladdinDAO is structured as a DAO. No clear traditional legal entity disclosed.
• Incident response: The ChainSecurity flash loan vulnerability was handled promptly (April 2025). The protocol has a defined 5-layer risk framework with recapitalization as the final safety mechanism.

Monitoring

Key Contracts to Monitor

Contract	Address	What to Monitor
fxUSD	0x085780639CC2cACd35E474e71f4d000e2405d8f6	totalSupply changes, NAV deviations from $1.00
ProxyAdmin	0x9b54b7703551d9d0ced177a78367560a8b2edda4	Any upgrade() calls — immediate alert
TimelockController	0x68863fb8855b04509a835082478D6E3D0bE4E61a	CallScheduled, CallExecuted, Cancelled, MinDelayChange, role changes
Operational Multisig	0x26B2ec4E02ebe2F54583af25b647b1D619e67BbF	Governance parameter changes, new transactions
Emergency Multisig	0x28c921adAC4c1072658eB01a28DA06b5F651eF62	Pause events on PoolManager/ShortPoolManager
PoolManager	0x250893CA4Ba5d05626C785e8da758026928FCD24	Rebalance/Liquidation events, wstETH/WBTC balances, collateral ratio
Stability Pool (fxSP)	0x65C9A641afCEB9C0E6034e558A319488FA0FA3be	USDC balance (alert if <5% of pool), deposit/withdrawal flows
fxSAVE	0x7743e50F534a7f9F1791DdE7dCD89F7783Eefc39	Total assets, exchange rate changes
PegKeeper	0x50562fe7e870420F5AAe480B7F94EB4ace2fcd70	Peg maintenance events, funding level triggers
Curve USDC/fxUSD	0x5018BE882DccE5E3F2f3B0913AE2096B9b3fB61f	Pool balance ratio, large swaps

Critical Events & Thresholds

Event	Threshold	Action
fxUSD NAV deviation	>2% from $1.00	Immediate alert
Curve EMA price	<$0.998	Triggers enhanced protection mode
Stability Pool USDC ratio	<5% of pool	Funding Level I activates
Collateral Ratio (any market)	<130%	Stability Mode — enhanced monitoring
Collateral Ratio (any market)	<100%	Critical — recapitalization mode
TimelockController CallScheduled	Any	Investigate target/calldata; 3 days to react before execution
TimelockController MinDelayChange	Any	Immediate investigation — delay reduction is a major risk event
ProxyAdmin upgrade	Any call	Immediate investigation (should only occur after a timelock-scheduled call)
Emergency pause	Any	Immediate alert and assessment
fxUSD totalSupply	>50% change in 24h	Investigate unusual minting/burning

Key View Functions

• fxUSD.nav() — current NAV (target: 1e18 = $1.00)
• fxUSD.totalSupply() — total fxUSD in circulation
• fxUSD.isUnderCollateral() — boolean (currently true due to legacy market; monitor for V2 changes)
• PoolManager.getPoolInfo(pool) — returns (collateralCapacity, collateralBalance, rawCollateral, debtCapacity, debtBalance) per pool
• wstETH.balanceOf(PoolManager) / WBTC.balanceOf(PoolManager) — direct collateral balance checks
• StabilityPool.totalSupply() — total fxSP tokens
• fxSAVE.totalAssets() — total assets in fxSAVE vault

Recommended Monitoring Frequency

• fxUSD NAV & Curve pool balance: Every 15 minutes
• Collateral ratios: Hourly
• Multisig transactions & upgrades: Real-time (block-by-block)
• Stability Pool health: Every 4 hours
• TVL and supply metrics: Daily

Appendix: Contract Architecture

┌─────────────────────────────────────────────────────────────────┐
│                     GOVERNANCE LAYER                            │
│                                                                 │
│  ┌──────────────────┐    ┌──────────────────┐                   │
│  │ Operational       │    │ Emergency         │                  │
│  │ Multisig (6/9)   │    │ Multisig (3/4)    │                  │
│  │ 0x26B2...BbF     │    │ 0x28c9...eF62     │                  │
│  └────────┬─────────┘    └────────┬──────────┘                  │
│           │ proposes/             │ can pause                   │
│           │ executes              │                             │
│  ┌────────▼─────────┐             │                             │
│  │ TimelockController │           │                             │
│  │ 0x6886...61a (3d)  │           │                             │
│  └────────┬─────────┘             │                             │
│           │ owns                  │                             │
│  ┌────────▼─────────┐    ┌───────▼───────────┐                  │
│  │ ProxyAdmin        │    │ PoolManager       │                  │
│  │ 0x9b54...da4     │    │ ShortPoolManager   │                  │
│  └────────┬─────────┘    └───────────────────┘                  │
│           │ upgrades all proxies (subject to 3-day timelock)    │
└───────────┼─────────────────────────────────────────────────────┘
            │
┌───────────▼─────────────────────────────────────────────────────┐
│                     TOKEN / VAULT LAYER                         │
│                                                                 │
│  ┌──────────────┐   ┌──────────────┐   ┌──────────────┐        │
│  │ fxUSD         │   │ fxSAVE       │   │ FXN / veFXN  │        │
│  │ 0x0857...8f6  │   │ 0x7743...39  │   │ 0x365A...09  │        │
│  │ (stablecoin)  │   │ (yield vault)│   │ (governance) │        │
│  └──────┬───────┘   └──────┬───────┘   └──────────────┘        │
│         │ minted via        │ wraps                             │
│  ┌──────▼───────┐   ┌──────▼───────┐                            │
│  │ Markets       │   │ Stability    │                            │
│  │ (MarketV2)    │   │ Pool (fxSP)  │                            │
│  │ 0xAD9A...155  │   │ 0x65C9...3be │                            │
│  └──────┬───────┘   └──────┬───────┘                            │
└─────────┼──────────────────┼────────────────────────────────────┘
          │                  │
┌─────────▼──────────────────▼────────────────────────────────────┐
│                     PROTOCOL LAYER                              │
│                                                                 │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐           │
│  │ PoolManager   │  │ PegKeeper    │  │ Configuration│           │
│  │ (Long)        │  │ 0x5056...70  │  │ 0x16b3...28d │           │
│  │ 0x2508...D24  │  └──────────────┘  └──────────────┘           │
│  ├──────────────┤  ┌──────────────┐  ┌──────────────┐           │
│  │ ShortPool     │  │ GatewayRouter│  │ GaugeControl │           │
│  │ Manager       │  │ 0xA5e2...fE4│  │ 0xe60e...37  │           │
│  │ 0xaCDc...66D  │  └──────────────┘  └──────────────┘           │
│  └──────┬───────┘                                               │
│         │ custodies ALL V2 collateral                           │
│  ┌──────▼───────────────────────────────────────────────┐       │
│  │ COLLATERAL (held in PoolManager)                      │       │
│  │ wstETH: 4,451.58 (~$12.38M) via xstETH pool          │       │
│  │ WBTC:     901.78 (~$71.76M) via xWBTC pool            │       │
│  │ Total: ~$84.14M backing ~$53.89M fxUSD (~156% CR)    │       │
│  └──────────────────────────────────────────────────────┘       │
└─────────────────────────────────────────────────────────────────┘
          │
┌─────────▼───────────────────────────────────────────────────────┐
│                     UNDERLYING LAYER                            │
│                                                                 │
│  ┌───────────┐  ┌───────────┐  ┌───────────┐  ┌───────────┐    │
│  │ Chainlink  │  │ Uniswap   │  │ Curve     │  │ Aave      │    │
│  │ (oracles)  │  │ V3 (TWAP) │  │ (EMA,DEX) │  │ (yield)   │    │
│  └───────────┘  └───────────┘  └───────────┘  └───────────┘    │
│  ┌───────────┐                                                  │
│  │ Lido      │                                                  │
│  │ (wstETH)  │                                                  │
│  └───────────┘                                                  │
└─────────────────────────────────────────────────────────────────┘

Trust boundaries:

• The 6/9 multisig has full upgrade authority over all protocol contracts, but actions are subject to a 3-day timelock (as of April 20, 2026) — this is the primary trust boundary
• The 3/4 emergency multisig can pause position operations immediately (no timelock) but cannot upgrade contracts
• Keepers are permissionless (anyone can trigger rebalancing/liquidation for bounties)
• Oracle data flows from Chainlink + Uniswap/Curve and is validated with deviation thresholds

---

Reassessment Triggers

• Time-based: Reassess in 6 months (November 2026)
• TVL-based: Reassess if TVL changes by more than 50%, or sustains above $150M for >1 month
• Incident-based: Reassess after any exploit, governance change, or collateral modification
• Governance: Reassess if the timelock delay is reduced, ProxyAdmin ownership is changed away from the TimelockController, or if multisig threshold is lowered (all negative); reassess if a bug bounty program is launched (positive)
• Peg deviation: Reassess if fxUSD trades below $0.95 for more than 24 hours