Executive Summary
bench3.ai assessed the official USTBL deployments on Ethereum, Polygon, Base, Arbitrum, Etherlink, Starknet, Stellar and Solana. The assessment addressed proxy and implementation identity, meta-transaction authorization, mint/burn and eligibility controls, redemption state transitions, upgrade authority, non-EVM source correspondence, and cross-network supply reconciliation using non-atomic observations collected over approximately 41 minutes. [E01-E07]
Assessment conclusion
No reportable vulnerability was confirmed in the examined public-production scope. The conclusion is qualified by materially different non-EVM evidence: all three Starknet production classes and ABIs matched the pinned source build; the live Stellar token executable did not match a public repository artifact; and the Solana minter and Gate had strong correspondence while the deployed Token ACL remained source-unresolved and its shared upgrade controller was not publicly identified.
| Classification | Recorded result |
|---|---|
| Confirmed vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Control observations | 3; privileged control concentration, Solana eligibility lifecycle and Stellar emergency-pause configuration |
| Supply reconciliation | 154,448,726.41002 USTBL across eight networks; zero base-unit difference from the issuer totals API over a non-atomic observation window from 18:27:04 to 19:08:06 UTC |
The supply match is strong bounded accounting evidence across the approximately 41-minute observation window, not an atomic snapshot or proof of continuous cross-network conservation, legal-register equality, asset custody or completed cash settlement. Private KYC, legal-register, NAV, signer-custody, bank and redemption-reconciliation records were not available. [E03-E07]