Executive Summary
bench3.ai assessed the public thBILL smart-contract system across four networks. The system separates four materially different layers: the canonical Ethereum thBILL proxy and IToken implementation; tULTRA as the canonical wrapper's configured asset; TTokenRouterV2 and its privileged mint-service account; and a LayerZero OFT mesh comprising an Ethereum lock/unlock adapter plus native burn/mint OFTs on Arbitrum, Base and HyperEVM. [E01-E05; S01-S05]
The synchronized fixed-height review confirmed the canonical proxy implementation and initialized state, reconstructed the Router's sole surviving MINTER_ROLE holder, distinguished the Ethereum adapter from the three direct OFTs, verified all 12 directional remote peer edges, and reconciled adapter custody against aggregate sidechain supply at the recorded blocks. [E01-E03]
Assessment conclusion
No reportable implementation vulnerability was confirmed in the examined canonical-token, Router authorization, OFT peer, adapter-custody or holder-eligibility paths. Three material control observations are reported. The conclusion does not cover the private production mint service or establish legal or custodial backing beyond the public on-chain layers.
| Classification | Recorded result |
|---|---|
| Confirmed vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Control observations | 3; private-service trust, cross-chain governance and RWA wrapper boundaries |
| Unresolved technical issues | No ordinary-caller defect was established; private mint-service behavior remains outside the assessed boundary |
Material residual risk
TTokenRouterV2.depositOptimistic is restricted to MINTER_ROLE but accepts economically coupled fields—including assetIn, amountAssetIn, assetReceiver, tTokenAssets, iToken and to—from that privileged caller without an on-chain signed quote binding them together. The sole current role holder was an authenticated EIP-7702 account rather than a public forwarder. No ordinary-caller exploit was established, but the private service that authenticates users and constructs these calls was not reviewed. [E01; O01; L01]
The public on-chain backing chain is layered rather than a direct claim on Treasury securities. Canonical thBILL was configured against tULTRA; the Ethereum OFT adapter held canonical thBILL against sidechain OFT supply; and tULTRA's pending/optimistic quantities must ultimately reconcile to formal ULTRA shares, legal records and custody assets outside the public contract boundary. [E01, E06; O03; L02]