Executive Summary
bench3.ai assessed the official Ethereum smart-contract deployment of MONY, the My OnChain Net Yield Fund. J.P. Morgan Asset Management identifies entrypoint 0x6a7c6aa2b8b8a6A891dE552bDEFFa87c3F53bD46. The assessment covered the EIP-2535 Diamond dispatcher, all 16 current facets and 68 selectors, initialization and upgrade history, ownership and roles, account restrictions, issuance and burn workflows, on-chain supply, administrative smart accounts and the boundary between token state and private fund operations. [E01-E07; S01-S05]
At Ethereum block 26,077,991, the MONY entrypoint had a 6,958-byte runtime with Keccak-256 0xf2dea1946270fa0b2005d60f1f55ab8a2be4ce89a8124c1559b530c2c33bf24f. The same 16-facet/68-selector address set was recorded at blocks 26,070,626, 26,077,242 and 26,077,991; every current facet had Sourcify exact creation/runtime correspondence, and no later DiamondCut or relevant role/ownership transition was recorded through the assessment block. [E01-E04]
Assessment conclusion
No reportable implementation vulnerability was confirmed in the examined MONY public-contract paths. Three material control observations are reported: immediate owner-directed upgrades, single-controller administrative accounts, and the legal/settlement boundary outside public token state. These observations are not included in vulnerability severity totals.
| Classification | Recorded result |
|---|---|
| Confirmed vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Control observations | 3; privileged control, account concentration and off-chain settlement boundary |
| Unconfirmed candidates | 0 |
| Assessment boundary | Official public Ethereum contract system; private fund operations excluded |
Material residual risk
The Diamond owner can replace MONY's executable surface through diamondCut without the installed 3,600-second governance delay applying to that action. The owner/TOKEN_ADMIN, ACCOUNT_ADMIN and TOKENIZATION_AGENT positions are held by separate Alchemy LightAccount proxies, each with one direct controller. These are significant custody and operational dependencies. Exact wrappers and read-only negative calls did not reveal an unrelated-caller route to exercise them. [E01-E04; B3-MONY-O01-O02]
Public chain state establishes token balances, supply and contract execution, not the private-placement register, investor rights, NAV, portfolio assets or final payment. MONY's private offering materials and authoritative operating records were not public. On-chain supply conservation therefore does not establish reserve sufficiency, legal ownership or completed subscription/redemption settlement. [E01; E05; B3-MONY-O03]