Executive Summary
bench3.ai assessed the public OpenEden TBILL Vault V5 deployments on Ethereum, Arbitrum One and BNB Smart Chain. The review covered deployment and source identity, initialization and upgrade boundaries, KYC-gated subscriptions, queued and instant redemption paths, price freshness, fees and configured limits, and the distinction between on-chain TBILL accounting and the fund's private valuation, register and custody records. [E01-E07]
Assessment conclusion
No reportable implementation vulnerability or confirmed ordinary-investor loss was established at the recorded configurations. The contracts accept a price almost seven days old, but every inspected production price increase was below the approximately 10.0075 bps weekday round-trip break-even, ordinary redemption is queued and operator processed, and the governing repricing/equalization/cancellation policy is private. The stale-NAV question is therefore a material business-invariant limitation, not a confirmed exploit. [E02, E04, E07-E08]
| Classification | Recorded result |
|---|---|
| Confirmed vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Control observations | 3; stale-NAV policy boundary, unused FeeManager maxima, dormant Ethereum instant-redemption mismatch |
| Material limitation | The controlling stale-NAV and oracle-outage dealing rules were not publicly available. |
Material residual risk
A whitelisted investor can subscribe while the latest oracle value remains younger than the contract's seven-day threshold. If a later upward NAV correction exceeds fees, and if the resulting allocation is final rather than repriced, equalized, cancelled or clawed back, the stale mint can dilute prior holders. Those conditions were not established together: the actor cannot cause the price delay or update, no inspected update crossed break-even, and the current PPM or signed dealing policy was unavailable. The report does not convert this absent business invariant into a confirmed loss. [E02, E04, E07-E08; B3-TBILL-O01; L01]
TBILL remains administratively controlled. The operator processes queued redemptions; the maintainer can cancel queue entries and burn tokens; KYC administrators can revoke eligibility; and contract owners control upgrades and configuration. These powers can contain or correct incidents but are trust dependencies, not automatic proof that every economically adverse subscription would be reversed. [E02-E03]