Executive Summary
bench3.ai assessed the official USYC deployment surface on Ethereum, BNB Chain, Arc and Solana. The review covered proxy and runtime identity, initialization, role and capability configuration, mint/burn authority, Teller pricing and fee behavior, the Ethereum-BNB CCTP route, Solana Token-2022 extensions and control accounts, and the boundary between public token state and the private fund register and assets. [E01-E11]
Assessment conclusion
B3-USYC-F01 is a confirmed deterministic implementation defect: the Teller applies the current transaction's DST offset when converting a historical oracle timestamp. Its narrow DST-transition condition depends on a trusted-reporter timestamp, and all 520 reviewed rounds were weekday reports outside that condition. Supported realistic reachability and impact are insufficient for severity assignment. Six EVM control questions were otherwise resolved against fixed production state and source/configuration evidence, and three other targeted control and economic assessments did not establish an ordinary-actor path. The Solana production paths were corroborated, but the current Yieldcoin Manager binary lacks public exact source/build correspondence. [E02-E09]
| Classification | Recorded result |
|---|---|
| Severity-assigned vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Confirmed implementation defects | 1; B3-USYC-F01, realistic reachability and impact insufficiently established for severity assignment |
| Control observations | 2; Solana upgrade/management concentration and issuer-authorized balance-control powers |
| Material limitations | Solana source/build/IDL correspondence, private key governance, legal register, NAV/reserves and full cross-network reconciliation |
Material residual risk
USYC is a permissioned asset. Configured issuers, minters, entitlement administrators and Solana program authorities can mint, burn, freeze, thaw, pause and change aspects of pricing or permissions. Those powers are part of the operating model, but compromise or misuse can have substantial effect. The recorded review did not establish an ordinary-caller authorization bypass; custody, quorum, rotation and monitoring of the controlling keys were not independently verified. [E02-E09; B3-USYC-O01-O02]
The Solana mint is active, and its nine enumerated token-account balances reconciled exactly to the recorded supply. Representative production subscription and redemption transactions moved USDC and minted/burned USYC as expected. The Yieldcoin Manager remains upgradeable by one direct on-curve key, and no issuer-published mainnet source, IDL or reproducible build matched the deployed binary. Public state therefore supports the specific observed routes, not an exhaustive source-code opinion over the Solana program. [E08-E09]