Executive Summary
bench3.ai assessed the public code, configuration and recorded behavior of an Ethereum deployment that identifies itself as ChinaAMC USD Digital Money Market Fund Class I USD with symbol CUMIU. The technical correlation is very high, but no issuer-, administrator- or tokenization-agent-controlled publication was found that binds ISIN HK0001153516 to the exact proxy and implementation/RuleEngine graph. The deployment therefore remains a candidate and the opinion is provisional. [E01-E04; S01-S04]
The reviewed graph comprises an EIP-1967 proxy, an exact-matched CMTAT implementation, a nonzero RuleEngine and one active RuleWhitelist. Recorded assessment work covered initialization, upgrade and role state, rule configuration, transferFrom validation semantics, complete public event history through the cited anchor, and public RWA linkage. It did not authenticate the deployment for the legal share class or audit private registrar, allowance, key-custody, NAV or settlement records. [E01-E08]
Provisional assessment conclusion
No reportable implementation vulnerability was confirmed for the candidate deployment. One control observation and one unconfirmed candidate are reported. The unconfirmed candidate concerns a real code-level omission in delegated-transfer validation, but current public evidence does not establish the operational preconditions or policy violation required to classify it as an exploitable vulnerability.
| Classification | Recorded result |
|---|---|
| Confirmed vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Control observations | 1; privileged lifecycle and upgrade authority |
| Unconfirmed candidates | 1; delegated-transfer spender eligibility |
| Deployment identity | Candidate; issuer mapping unconfirmed |
Material qualification
The reviewed token code does not validate the transferFrom caller as a policy subject: the active path checks the token owner and recipient, while the current rule also ignores the spender. Recorded read-only behavior checks confirmed that this omission affects delegated-transfer execution. The official product model describes permissioned direct-shareholder wallets, administrator-executed transactions and no peer-to-peer or secondary-market trading; public history contained no Approval or holder-to-holder transfer event. Without an issuer-attested live allowance/operator inventory and policy for frozen or delisted spenders, the condition remains an assurance gap rather than a confirmed vulnerability. [E03-E04; B3-CUMIU-U01]