Executive Summary
bench3.ai assessed the publicly identified VBILL token, onboarding, compliance, Omnibus, bridge and Solana control surfaces. The production roster comprised native token ledgers on Ethereum, BNB Chain, Avalanche and Solana; the advertised EVM bridge was also reviewed at current fixed observations. [E01-E05]
Assessment conclusion
B3-VBILL-O02 is a confirmed role-gated implementation defect: an authorized Omnibus issue/burn round trip restores balance and total supply but leaves four aggregate counters inflated and emits positive burn deltas. Authorized reachability is established; severity remains unassigned because reliance on the affected counters, configured limits and resulting production impact are not sufficiently evidenced. The Ethereum onramp, current disabled EVM bridge route and sampled Solana paths otherwise produced the bounded results described below. [E02-E05]
| Classification | Recorded result |
|---|---|
| Severity-assigned vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Confirmed implementation defects | 1; B3-VBILL-O02, role-gated; realistic impact insufficiently established for severity assignment |
| Control observations | 3; NAV-policy boundary, disabled advertised EVM bridge, Solana authority concentration |
| Material limitations | Private NAV, bridge/reconciliation, Omnibus and redemption workflows; exact Solana deployed-build provenance |
Material residual risk
The EVM NAV dependency enforces a public 30-hour technical maximum, but public evidence does not establish that 30 hours is the fund's authoritative business-validity window. This is an absent business invariant, not evidence of a stale-NAV exploit or proof that every value younger than 30 hours is economically acceptable. [E02-E03; B3-VBILL-O01; L01]
A production-shaped local fork confirmed that an authorized Omnibus bulk burn restores token balance and total supply but does not decrease four aggregate counters and emits positive burn deltas. The path was reached with the existing MASTER(1) address at the archived BNB fork, while no ordinary-holder path was established. At the recorded points the Omnibus wallet had zero balance and no Registry binding; no Omnibus TBE events were recovered from the bounded indexed Ethereum/Avalanche history. BNB and private production use and material economic impact were not established. The defect is reported separately from the three control observations, and severity remains unassigned because production reliance on the affected counters and resulting impact are not sufficiently evidenced. [E02-E03; B3-VBILL-O02]
On Solana, mint, freeze, permanent-delegate, transfer-hook, metadata and mint-close powers converge on program-derived controls governed by role accounts, while all five issuer programs share one direct upgrade-authority pubkey. Public repositories explain the architecture but do not reproduce the current deployed ELF hashes. The resulting binary and key-custody boundaries materially limit assurance. [E05; B3-VBILL-O04]