code/cl8y-dex-terraclassic
4
0
Fork 0
Code Issues 35 Pull requests 6 Projects Releases Packages Wiki Activity

research: UST1 collateral — Noble USDC ~3.5% yield vs Venus vFDUSD 6–8% APR (depeg, bank-run, protocol incidents) #574

New issue
Closed
opened 2026-08-19 11:49:44 +00:00 by PlasticDigits · 11 comments
PlasticDigits commented 2026-08-19 11:49:44 +00:00 (Migrated from gitlab.com)
Copy link

Summary

Research / decision only — do not implement a collateral switch in this issue.

Bundle into one investigation (do not split yield vs depeg vs protocol-incident tickets):

  1. Feasibility of using USDC + ~3.5% liquid-staking / yield-bearing dollar on Noble (typically USDN / Noble Dollar, minted against native Noble USDC via M^0) as the UST1 window / treasury backing asset.
  2. Comparison against the current live path: Venus vFDUSD on BSC, whose headline 6–8% average annual APR is a claim to verify, not a number to bake into copy or oracles.
  3. Historical bank-run and depeg records for USDC and FDUSD.
  4. Incremental risk of Noble / M^0 yield mechanics vs Venus Core Pool staking (vToken exchangeRate accrual), including protocol incidents.

Related live work: #502 (Phase 4 window + wrap), #506 (/ust1 vFDUSD↔UST1), #503 (ops / Venus-pause trigger), #508 (secondary UST1 AMM), #515 / #550 (CEX FDUSD labeled vFDUSD), #571 / #572 (Protocol Venus redeem rate — display only). IBC-hooks gate: #407.

Not in scope: shipping a USDC/USDN CW20, changing ust1-window allowlist U5, adding indexer ticker usdc, opening IBC/CCTP from the dApp, or marketing a guaranteed APR.

Current codebase

CL8Y’s economic dollar-ish hub is UST1, minted/redeemed only against bridged Venus FDUSD (vFDUSD) through the ust1-window. There is no USDC, Noble, USDN, CCTP, or IBC receive path in this repo.

Layer Behavior today
Window (settlement) /ust1 deposit pay token = vFDUSD only; withdraw pay = UST1 only (U5). Execute is CW20 Send to ust1-window, not the AMM router (U3). Quotes from on-chain effective_swap (U4).
Mainnet addresses vFDUSD terra1mnl9azefrqpmu888ar2u6zrcwr80hxlt3avf4300r576cw5ar7esvxsvj3; UST1 terra1f0eqgy9w7e5e7up97vjudqwx38tesf8ylx75x2lv3nwm0clry0pqmgfy72; window terra1zxwpzpzpleatqn39r00grau4yt29sld8pw78s7ktvjafnj5nsaxq0h3rh2; oracle terra1fmht0t6svq3n24zx03nkfja0m40zhfyyxkdcvlrkl6u7gfe6aagq4gch8n. Params: fee_bps=100, per-tx 1000 UST1, rolling 24h 10000 UST1.
Token identity Tokenlist name Venus FDUSD (bridged), 6 decimals. This is a bridged Venus vToken, not naked FDUSD and not USDC.
Venus (BSC) Canonical Core Pool vFDUSD 0xC4eF4229FEc74Ccfe17B2bdeF7715fAC740BA0ba; underlying FDUSD 0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409. Yield is vToken exchange-rate accrual (borrower interest ± incentives), not a lockup stake. This repo does not poll Venus today (planned display-only in #571/#572).
Treasury / capacity CMM treasury vFDUSD balance + allowance to the window bound UST1 withdraw capacity (O4). Health: scripts/check-ust1-wrap-ops-health.sh.
Incident control Prefer ust1-oracle set_paused when Venus/BSC rate integrity is suspect; window set_paused for window-local maintenance (O3 / runbook A2). Wrap-stack governance terra1xsecn4… ≠ DEX multisig (O6).
Indexer CEX OracleTicker::Vfdusd polls FDUSD (MEXC FDUSDUSDT, CoinGecko first-digital-usd). Path /api/v1/oracle/price/vfdusd. X4: never used for DEX volume_usd. P550-9 / X5: not $1, not the window rate. No usdc ticker.
Secondary AMM Preferred UST1/vFDUSD; live UST1/cUSTC and UST1/USTR exist. Factory rejects native uusd/uluna as pair assets.
CW20 policy cw20-whitelist-policy.md: rebase / elastic-supply / balance-mutating tokens are forbidden as pair/escrow assets (pair credits declared transfer amounts, not balance deltas). A yield-bearing USDN-style rebase CW20 cannot be a factory pair leg without a non-rebasing wrapper.
IBC DEX wasm has no ibc_receive / ack / timeout (SEC-D02/D03, make verify-no-ibc-hooks-in-contracts). Bridging Noble USDC/USDN onto Classic would be a new chain + bridge + wrap program, not a tokenlist edit.
CSP Browser connect-src is LCD/RPC/indexer + WalletConnect. Must not call BSC, Noble, Circle, or Venus HTTP from the dApp.
Copy / NFA Retail copy skill #489; first-visit risk modal #138. APR must not be presented as a guaranteed return.

Yield figures in the title are hypotheses. Spot-check (2026-08, public third-party, must be re-dated in the memo): Venus Core Pool FDUSD supply APY has printed well below 6–8% on some aggregators (single-digit / ~1% band); Noble Dollar (USDN) marketing has printed ~3.3–4.3% (T-bill / M^0 index, variable). The investigation must replace 3.5% and 6–8% with sourced time series, not treat them as constants.

Why this is needed

  1. UST1 inherit’s the backing stack. Window inventory, treasury allowance, and (if seeded) UST1/vFDUSD AMM all sit on Venus vFDUSD → FDUSD → First Digital reserves. A collateral switch to USDC → Noble/USDN → Circle + M^0 changes issuer, chain, oracle, pause playbooks, and bank-run contagion — not just APR.
  2. Headline APR is the wrong ranking function. 6–8% vs 3.5% ignores utilization/redeem liquidity (Venus), T-bill rate path (USDN), depeg convexity, Circle freeze, IBC/CCTP, and CL8Y rebase-token ban. Operators need a risk-adjusted comparison before any product ADR.
  3. Both stables have already depegged in public markets. USDC ($0.87, Mar 2023, SVB reserve freeze) and FDUSD ($0.87–$0.91, Apr 2025, issuer-insolvency allegation) are not theoretical. UST1 mint at a stale window rate during a depeg is an inventory + solvency event (O4, oracle pause).
  4. Staking/yield layers add protocol risk on top of issuer risk. Venus has a documented incident history (XVS oracle/liquidity 2021 bad debt; LUNA oracle stall 2022; wUSDM donation / ERC-4626 2024–25; THE donation/cap bypass 2026 class). Noble/USDN adds M^0 module, T-bill wrapper, and Cosmos IBC/CCTP surface that this DEX does not run today.
  5. Without a written go/no-go, agents will “helpfully” add USDC tickers, fake $1 pegs, or rebase pair legs — the same class of mix-up #515 / P550-9 already forbids.

Constraints / guardrails

  1. Research deliverable only. Default outcome is an ADR + risk memo. No factory CreatePair, no window allowlist change, no Coolify VITE_USDC_*, no indexer usdc/usdn ticker, no IBC module in DEX wasm.
  2. Do not hardcode $1 for USDC, FDUSD, vFDUSD, USDN, or UST1 (X5 / P550-9). Peg history is part of the answer.
  3. Do not treat APR as settlement. Window rate stays effective_swap; CEX feeds stay advisory; Venus exchangeRateStored (if cited) is redeem FDUSD-out, not USD.
  4. Keep oracles unconfused. CEX FDUSD ≠ Venus vToken rate ≠ UST1 window ≠ pair TWAP ≠ Circle USDC ≠ Noble USDN index.
  5. Rebase / yield-accruing CW20 cannot be a pair or limit-escrow asset (cw20-whitelist-policy.md). If USDN rebases, the memo must say wrapper required or window-only, never AMM leg.
  6. Do not open IBC or CCTP from the frontend. CSP + SEC-D02 stand. Any “how would USDC arrive on Classic?” section is architecture, not a deploy plan in this issue.
  7. Do not widen CW20 whitelist to “try USDC” (O7).
  8. Pause remains fail-closed. Research must map each incident class to oracle pause vs window pause vs wrap pause — not “wait for peg to recover while mint stays live.”
  9. Copy / NFA. No “earn 6–8% risk-free on UST1.” Any user-facing sentence in the memo is labeled non-promissory.
  10. Primary sources over blogs. Issuer attestations, on-chain market contracts, Circle/First Digital/Noble/M^0 docs, Venus post-mortems, Fed/FDIC notes. Aggregator APYs need timestamp + method (supply APY vs incentive vs 30d avg).
  11. Upstream repos. Window/oracle live in ust1-window; wrap in ustr-cmm. This issue does not mutate those contracts.
  12. No exploit PoCs, payloads, or attack scripts — describe vectors and historical incidents; do not reproduce them.

Relevant files

Path Role
docs/runbooks/ust1-window-ui.md U1–U8; vFDUSD-only window
docs/runbooks/ust1-wrap-production-ops.md O1–O8; Venus/BSC → oracle pause
deployments/mainnet-ust1-wrap/REGISTRY.md Canonical columbus-5 addresses
docs/runbooks/cw20-whitelist-policy.md Rebase / FoT ban
docs/runbooks/indexer-external-oracle.md CEX FDUSD as vfdusd; X1–X6
docs/security-model.md SEC-D02 IBC-hooks
docs/exploit-replay-matrix.md Historical incident template
docs/adr/0001-hybrid-quoting-and-routing.md ADR format to copy
frontend-dapp/src/pages/Ust1Page.tsx /ust1 UI
frontend-dapp/src/services/terraclassic/ust1Window.ts effective_swap + CW20 Send
frontend-dapp/src/utils/ust1WindowGates.ts Pause / stale / limit gates
frontend-dapp/src/utils/tokenRegistry.ts vFDUSD identity
tokenlist/tokenlist.json Listed CW20s
indexer/src/indexer/oracle.rs FDUSD CEX poller
scripts/check-ust1-wrap-ops-health.sh Inventory / pause / oracle age
docs/runbooks/ust1-secondary-amm-pair.md UST1/vFDUSD AMM
skills/AGENTS_UST1_WINDOW_UI.md Agent window rules
skills/AGENTS_UST1_WRAP_PRODUCTION_OPS.md Agent ops rules
skills/AGENTS_INDEXER_EXTERNAL_ORACLE.md Do not alias fdusd/usdc
docs/frontend.md P550-9, /ust1 vs /mint
new: docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md (suggested) Decision memo

Upstream (read-only for this issue): ust1-window effective_swap / oracle updater; ustr-cmm treasury + wrap-mapper.

Recommended direction

  1. Write ADR docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md (Status: Proposed) plus a short pointer from docs/README.md Architecture. Optional agent skill stub only if the ADR is accepted later.

  2. Decompose each option into a risk stack (do not compare “USDC” vs “vFDUSD” as single tokens):

    Layer Status quo Alternative under study
    Issuer / reserves First Digital / FDUSD Circle / USDC
    Bank / custodian FDUSD trust / T-bill claims Circle banks + T-bills (SVB-class)
    Yield venue Venus Core Pool (BSC) vToken Noble USDN / M^0 T-bill index (~3.5% claim)
    Receipt token vFDUSD (exchange-rate) USDN or staked USDC derivative
    Bridge to Classic Existing bridged CW20 Noble IBC + CCTP + new wrap (greenfield)
    CL8Y settlement ust1-window vFDUSD↔UST1 New allowlist / new window / dual inventory

  3. Required memo sections

    • Yield: dated supply APY vs incentive vs 30/90/365d realized; utilization; redeem queue; USDN index vs advertised 3.5%.
    • Depeg / bank-run chronology (min. USDC Mar 2023 SVB; FDUSD Apr 2025 allegation + any earlier FDUSD prints; DAI/USDP contagion as second-order). Depth, duration, primary-market halt vs secondary only, recovery path (Fed backstop vs issuer PR).
    • Protocol incidents: Venus (2021 XVS, 2022 LUNA oracle, 2024–26 donation/ERC-4626/cap-bypass class) and Noble/M^0/USDN (audits, pauses, IBC incidents — explicitly “none found” if so, with search log).
    • CL8Y blast radius: window mint at stale rate; treasury drain; AMM LP; indexer $1 lie; retail APR copy.
    • Scorecard: issuer, depeg convexity, redeem liquidity, smart-contract, bridge/IBC, rebase-compat, ops pause mapping, regulatory/freeze (Circle blacklist vs FDUSD), implementation cost on Classic.
    • Decision: Stay on vFDUSD / Reject Noble USDC for UST1 / Defer / Dual-inventory (explicitly disallowed unless justified). Dual backing without a new product spec is a fail.

  4. If the ADR ever recommends a switch, spawn follow-up implementation issues (window, oracle, treasury, indexer tickers, AMM, Coolify, pause runbooks). Do not sneak them into this MR.

  5. Verify script scripts/qa/verify-issue-NNN.sh: required ADR headings present; no VITE_USDC / indexer usdc ticker introduced by the same MR unless the ADR status is Accepted and a linked implementation issue exists (this issue’s MR should be docs-only).

Acceptance criteria

  • AC1. One ADR (or equivalent memo) in-repo covering both stacks; yield, depegs, and protocol incidents are not split across issues.
  • AC2. Title APR claims (3.5% vs 6–8%) are replaced or falsified with dated primary/aggregator sources and methodology (supply APY vs incentives vs realized).
  • AC3. USDC depeg/bank-run: at least SVB 2023-03 (Circle ~$3.3B / ~8% reserves frozen; secondary ~$0.87; primary halt; recovery via US systemic-risk exception) with citations.
  • AC4. FDUSD depeg/bank-run: at least 2025-04 issuer-insolvency allegation print (~$0.87–$0.91 band, duration, supply response) with citations; any additional FDUSD events in the search window listed or marked none.
  • AC5. Venus incident table with dates, mechanism, bad-debt/loss band, and whether Core Pool vFDUSD was directly in the blast radius (in-scope vs “other market / other chain”).
  • AC6. Noble / M^0 / USDN / CCTP / IBC risk table (module, redemption, freeze, bridge); gaps called out as unknown, not assumed safe.
  • AC7. Explicit mapping onto CL8Y invariants U5, O3, O4, O7, X4, X5, P550-9, SEC-D02, and the rebase/FoT whitelist ban.
  • AC8. Scorecard + single product decision (stay / reject / defer) with residual risks. No “quietly add USDC later.”
  • AC9. Docs-only MR for this issue: no window/oracle/indexer ticker/factory whitelist change.
  • AC10. docs/README.md (or runbook) links the ADR; NFA / non-promissory language on any APR.
  • AC11. Follow-up implementation issues listed only if decision ≠ stay; otherwise “no impl spawn.”

Test plan (all research paths)

These are document and process tests, not chain deploys. Each path must appear in the ADR (or an appendix checklist) with pass/fail.

ID Path How to test
P1 Status quo stack vFDUSD = Venus vToken bridged CW20; window U5; CEX feed is FDUSD Trace addresses from REGISTRY.md + tokenlist + oracle.rs; confirm no USDC symbol in window client
P2 Yield — Venus Supply APY vs borrow utilization vs XVS/incentive vs 30/90d Snapshot Core Pool vFDUSD supplyRatePerBlock / UI APY with UTC timestamp; state whether 6–8% is current, historical, or marketing
P3 Yield — Noble USDC vs USDN vs “liquid staking” naming Identify the exact instrument (USDN mint vs a third-party staker); T-bill index vs advertised 3.5%; lockup vs liquid
P4 Depeg — USDC SVB 2023 chronology Primary: Circle disclosure, Fed/FDIC notes; min/max print; hours to re-peg; whether blacklist/pause fired (historical: market depeg, not a contract pause)
P5 Depeg — FDUSD 2025-04 and others Primary: issuer statements + CEX prints; duration; redemption halt?; supply change
P6 Venus incidents 2021 / 2022 / 2024–26 class Official post-mortems preferred; tag Core vs Isolated vs zkSync; vFDUSD market affected Y/N
P7 Noble/M^0 incidents Audits + pauses + IBC Search log (dates, queries); “none found” allowed only with log
P8 Bridge/IBC How USDC would reach Classic CCTP → Noble → IBC → wrap; contrast with current vFDUSD bridge; SEC-D02 no DEX IBC entry points
P9 Rebase compatibility USDN/vToken as pair asset Apply whitelist policy: exchange-rate vToken bridged as static CW20 vs rebasing USDN; window-only vs AMM
P10 Ops mapping Each incident class → pause lever Oracle pause vs window pause vs wrap pause vs do-nothing; cite A / A2 runbook
P11 Indexer/UI lie $1 or wrong ticker Confirm ADR forbids usdc alias to vfdusd and forbids hard peg
P12 Dual inventory Two backing assets in one window Show why dual mint without new product spec fails U5 / O4; reject or specify a new window
P13 Retail copy APR on /ust1 or /protocol Any sample sentence checked against #489 / NFA modal; no guaranteed yield
P14 Decision close-out Stay vs switch One checked option; residual risk list; impl issues only if switch

Negative / skip paths

  • N1. Memo that only compares “USDC is safer than FDUSD” without Venus vs Noble yield layers → fail.
  • N2. Memo that ranks solely on APR → fail.
  • N3. Implementation diff (new ticker, pair, env) in the research MR → fail AC9.
  • N4. Using /ust1 effective_swap as a Venus or USDC USD price → fail.

Test plan — attack, hack, and abuse vectors

Research must evaluate each vector against both stacks and against today’s UST1/vFDUSD blast radius. Do not write exploits, PoCs, or attack procedures.

ID Vector What the memo must show Fail if
A1 Issuer/bank run SVB-style reserve freeze; FDUSD insolvency allegation Primary vs secondary market; UST1 mint still open? Treats depeg as “temporary noise” with window left live
A2 Redemption halt Circle/First Digital pause primary redeem; CEX conversion halt Window + treasury still quote 1:1 via stale oracle No pause mapping
A3 Circle freeze/blacklist USDC address freeze / contract pause Noble USDC + CCTP + any Classic wrap inherit freeze Ignores centralized freeze that FDUSD/vToken also may have in other forms
A4 Venus utilization run High utilization → vFDUSD redeem of FDUSD illiquid O4 withdraw capacity; UST1 holders cannot exit to FDUSD Counts 6–8% APR without redeem-liquidity stress
A5 Venus oracle / donation / bad debt Historical XVS, LUNA stall, ERC-4626 donation, supply-cap bypass Whether vFDUSD exchangeRate or FDUSD cash can be skewed; pause A2 “Venus is battle-tested” without incident table
A6 Exchange-rate manipulation Donate-to-vault / share inflation (wUSDM class) vToken vs USDN index; bridged CW20 may not rebase with Venus Assumes bridged vFDUSD exchangeRate tracks BSC 1:1 without evidence
A7 Noble/M^0 module bug Mint/redeem halt, index freeze, wrong yield Audits + admin keys + pause Assumes T-bill wrapper cannot fail
A8 IBC/CCTP bridge Packet timeout, fake denom, hooks re-entry on peer chains DEX has no IBC entry; bridged token still toxic in pools (SEC-D02) Adds IBC callbacks to DEX “to support USDC” in this issue
A9 Rebase pair insolvency Yield token as AMM/limit asset Whitelist ban; LP/escrow desync Recommends listing rebasing USDN as factory pair
A10 Fake token / ticker alias Spoof symbol=USDC / path /price/usdc → vfdusd Same class as forbidden fdusd alias (X2) Proposes aliasing tickers
A11 Stale window mint during depeg Oracle still updating a CEX print while issuer is halted O2 (do not disable age checks); pause vs keep minting “Keep minting, arb will fix it”
A12 Treasury drain / bank-run on UST1 Race to withdraw vFDUSD while FDUSD depegged Inventory monitors; per-tx / 24h caps are not peg defense Treats 1000/10k caps as sufficient peg insurance
A13 Governance social engineering “Emergency add USDC code ID / dual window” O7; 2-of-3 vs wrap-stack split O6 Recommends panic whitelist widen
A14 Retail APR fraud / phishing Fake “stake UST1 for 8%” copy or scam site NFA; no APR CTA on /ust1 from this research Adds yield badge to window UI
A15 Indexer DoS / feed injection Poison USDC/FDUSD CEX or future Venus RPC Soft-fail; X5 advisory; CSP no browser RPC Live-scan Noble/BSC from the browser
A16 Regulatory seizure Issuer or custodian freeze Compare Circle (US) vs First Digital (HK) vs M^0 T-bill vehicle Single-jurisdiction handwave

Verification criteria

Issue is done when all of the following hold:

  1. ADR docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md (or the path named in the MR) is merged with AC1–AC11.
  2. scripts/qa/verify-issue-<iid>.sh exists and is wired in the Makefile (verify-issue-<iid>): greps required headings (Yield, USDC depeg, FDUSD depeg, Venus incidents, Noble/M0, Scorecard, Decision); greps ADR for U5 / O4 / X5 / rebase ban; fails if indexer grows an usdc ticker or frontend grows VITE_USDC in the same research MR.
  3. make verify-issue-<iid> passes on the docs MR.
  4. GitLab issue comment records: decision string (stay / reject Noble USDC for UST1 / defer), date of yield snapshots, and links to citations (no secrets).
  5. Existing gates still pass unchanged: make verify-issue-506, make verify-issue-503 (docs grep), make verify-issue-515 / 550 if oracle docs were only cross-linked — no behavior change.
  6. No mainnet txs, no whitelist change, no Coolify env for USDC.

Out of scope for “done”: implementing USDC/Noble, changing Venus pollers (#571/#572), seeding UST1/vFDUSD AMM (#508), or pausing the window.

## Summary **Research / decision only — do not implement a collateral switch in this issue.** Bundle into **one** investigation (do not split yield vs depeg vs protocol-incident tickets): 1. Feasibility of using **USDC + ~3.5% liquid-staking / yield-bearing dollar on Noble** (typically **USDN / Noble Dollar**, minted against native Noble USDC via M^0) as the UST1 window / treasury backing asset. 2. Comparison against the **current live path: Venus vFDUSD on BSC**, whose headline **6–8% average annual APR** is a **claim to verify**, not a number to bake into copy or oracles. 3. Historical **bank-run and depeg** records for **USDC** and **FDUSD**. 4. Incremental risk of **Noble / M^0 yield mechanics** vs **Venus Core Pool staking** (vToken `exchangeRate` accrual), including **protocol incidents**. Related live work: [#502](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/502) (Phase 4 window + wrap), [#506](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/506) (`/ust1` vFDUSD↔UST1), [#503](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/503) (ops / Venus-pause trigger), [#508](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/508) (secondary UST1 AMM), [#515](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/515) / [#550](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/550) (CEX FDUSD labeled vFDUSD), [#571](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/571) / [#572](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/572) (Protocol Venus redeem rate — display only). IBC-hooks gate: [#407](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/407). **Not in scope:** shipping a USDC/USDN CW20, changing `ust1-window` allowlist **U5**, adding indexer ticker `usdc`, opening IBC/CCTP from the dApp, or marketing a guaranteed APR. --- ## Current codebase CL8Y’s economic dollar-ish hub is **UST1**, minted/redeemed **only** against bridged **Venus FDUSD (vFDUSD)** through the **ust1-window**. There is **no** USDC, Noble, USDN, CCTP, or IBC receive path in this repo. | Layer | Behavior today | |-------|----------------| | **Window (settlement)** | `/ust1` deposit pay token = **vFDUSD only**; withdraw pay = **UST1 only** (**U5**). Execute is CW20 `Send` to ust1-window, **not** the AMM router (**U3**). Quotes from on-chain `effective_swap` (**U4**). | | **Mainnet addresses** | vFDUSD `terra1mnl9azefrqpmu888ar2u6zrcwr80hxlt3avf4300r576cw5ar7esvxsvj3`; UST1 `terra1f0eqgy9w7e5e7up97vjudqwx38tesf8ylx75x2lv3nwm0clry0pqmgfy72`; window `terra1zxwpzpzpleatqn39r00grau4yt29sld8pw78s7ktvjafnj5nsaxq0h3rh2`; oracle `terra1fmht0t6svq3n24zx03nkfja0m40zhfyyxkdcvlrkl6u7gfe6aagq4gch8n`. Params: `fee_bps=100`, per-tx **1000** UST1, rolling 24h **10000** UST1. | | **Token identity** | Tokenlist name **Venus FDUSD (bridged)**, 6 decimals. This is a bridged **Venus vToken**, not naked FDUSD and not USDC. | | **Venus (BSC)** | Canonical Core Pool vFDUSD `0xC4eF4229FEc74Ccfe17B2bdeF7715fAC740BA0ba`; underlying FDUSD `0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409`. Yield is **vToken exchange-rate accrual** (borrower interest ± incentives), **not** a lockup stake. This repo does **not** poll Venus today (planned display-only in #571/#572). | | **Treasury / capacity** | CMM treasury vFDUSD **balance + allowance to the window** bound UST1 withdraw capacity (**O4**). Health: `scripts/check-ust1-wrap-ops-health.sh`. | | **Incident control** | Prefer **ust1-oracle `set_paused`** when Venus/BSC rate integrity is suspect; window `set_paused` for window-local maintenance (**O3** / runbook A2). Wrap-stack governance `terra1xsecn4…` ≠ DEX multisig (**O6**). | | **Indexer CEX** | `OracleTicker::Vfdusd` polls **FDUSD** (MEXC `FDUSDUSDT`, CoinGecko `first-digital-usd`). Path `/api/v1/oracle/price/vfdusd`. **X4:** never used for DEX `volume_usd`. **P550-9 / X5:** not `$1`, not the window rate. No `usdc` ticker. | | **Secondary AMM** | Preferred UST1/vFDUSD; live UST1/cUSTC and UST1/USTR exist. Factory rejects native `uusd`/`uluna` as pair assets. | | **CW20 policy** | [`cw20-whitelist-policy.md`](docs/runbooks/cw20-whitelist-policy.md): **rebase / elastic-supply / balance-mutating** tokens are **forbidden** as pair/escrow assets (pair credits declared transfer amounts, not balance deltas). A yield-bearing USDN-style rebase CW20 **cannot** be a factory pair leg without a non-rebasing wrapper. | | **IBC** | DEX wasm has **no** `ibc_receive` / ack / timeout (**SEC-D02/D03**, `make verify-no-ibc-hooks-in-contracts`). Bridging Noble USDC/USDN onto Classic would be a **new chain + bridge + wrap** program, not a tokenlist edit. | | **CSP** | Browser `connect-src` is LCD/RPC/indexer + WalletConnect. Must **not** call BSC, Noble, Circle, or Venus HTTP from the dApp. | | **Copy / NFA** | Retail copy skill [#489](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/489); first-visit risk modal [#138](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/138). APR must not be presented as a guaranteed return. | **Yield figures in the title are hypotheses.** Spot-check (2026-08, public third-party, **must be re-dated in the memo**): Venus Core Pool FDUSD supply APY has printed **well below 6–8%** on some aggregators (single-digit / ~1% band); Noble Dollar (USDN) marketing has printed **~3.3–4.3%** (T-bill / M^0 index, variable). The investigation must **replace** 3.5% and 6–8% with sourced time series, not treat them as constants. --- ## Why this is needed 1. **UST1 inherit’s the backing stack.** Window inventory, treasury allowance, and (if seeded) UST1/vFDUSD AMM all sit on **Venus vFDUSD → FDUSD → First Digital reserves**. A collateral switch to **USDC → Noble/USDN → Circle + M^0** changes issuer, chain, oracle, pause playbooks, and bank-run contagion — not just APR. 2. **Headline APR is the wrong ranking function.** 6–8% vs 3.5% ignores utilization/redeem liquidity (Venus), T-bill rate path (USDN), depeg convexity, Circle freeze, IBC/CCTP, and CL8Y rebase-token ban. Operators need a **risk-adjusted** comparison before any product ADR. 3. **Both stables have already depegged in public markets.** USDC (~$0.87, Mar 2023, SVB reserve freeze) and FDUSD (~$0.87–$0.91, Apr 2025, issuer-insolvency allegation) are not theoretical. UST1 mint at a stale window rate during a depeg is an **inventory + solvency** event (**O4**, oracle pause). 4. **Staking/yield layers add protocol risk on top of issuer risk.** Venus has a documented incident history (XVS oracle/liquidity 2021 bad debt; LUNA oracle stall 2022; wUSDM donation / ERC-4626 2024–25; THE donation/cap bypass 2026 class). Noble/USDN adds M^0 module, T-bill wrapper, and Cosmos IBC/CCTP surface that this DEX does not run today. 5. **Without a written go/no-go, agents will “helpfully” add USDC tickers, fake `$1` pegs, or rebase pair legs** — the same class of mix-up #515 / **P550-9** already forbids. --- ## Constraints / guardrails 1. **Research deliverable only.** Default outcome is an ADR + risk memo. **No** factory `CreatePair`, **no** window allowlist change, **no** Coolify `VITE_USDC_*`, **no** indexer `usdc`/`usdn` ticker, **no** IBC module in DEX wasm. 2. **Do not hardcode `$1`** for USDC, FDUSD, vFDUSD, USDN, or UST1 (**X5** / **P550-9**). Peg history is part of the answer. 3. **Do not treat APR as settlement.** Window rate stays `effective_swap`; CEX feeds stay advisory; Venus `exchangeRateStored` (if cited) is redeem FDUSD-out, not USD. 4. **Keep oracles unconfused.** CEX FDUSD ≠ Venus vToken rate ≠ UST1 window ≠ pair TWAP ≠ Circle USDC ≠ Noble USDN index. 5. **Rebase / yield-accruing CW20 cannot be a pair or limit-escrow asset** ([`cw20-whitelist-policy.md`](docs/runbooks/cw20-whitelist-policy.md)). If USDN rebases, the memo must say **wrapper required** or **window-only, never AMM leg**. 6. **Do not open IBC or CCTP from the frontend.** CSP + **SEC-D02** stand. Any “how would USDC arrive on Classic?” section is architecture, not a deploy plan in this issue. 7. **Do not widen CW20 whitelist** to “try USDC” (**O7**). 8. **Pause remains fail-closed.** Research must map each incident class to **oracle pause vs window pause vs wrap pause** — not “wait for peg to recover while mint stays live.” 9. **Copy / NFA.** No “earn 6–8% risk-free on UST1.” Any user-facing sentence in the memo is labeled non-promissory. 10. **Primary sources over blogs.** Issuer attestations, on-chain market contracts, Circle/First Digital/Noble/M^0 docs, Venus post-mortems, Fed/FDIC notes. Aggregator APYs need **timestamp + method** (supply APY vs incentive vs 30d avg). 11. **Upstream repos.** Window/oracle live in [ust1-window](https://gitlab.com/PlasticDigits/ust1-window); wrap in ustr-cmm. This issue does **not** mutate those contracts. 12. **No exploit PoCs, payloads, or attack scripts** — describe vectors and historical incidents; do not reproduce them. --- ## Relevant files | Path | Role | |------|------| | [`docs/runbooks/ust1-window-ui.md`](docs/runbooks/ust1-window-ui.md) | **U1–U8**; vFDUSD-only window | | [`docs/runbooks/ust1-wrap-production-ops.md`](docs/runbooks/ust1-wrap-production-ops.md) | **O1–O8**; Venus/BSC → oracle pause | | [`deployments/mainnet-ust1-wrap/REGISTRY.md`](deployments/mainnet-ust1-wrap/REGISTRY.md) | Canonical columbus-5 addresses | | [`docs/runbooks/cw20-whitelist-policy.md`](docs/runbooks/cw20-whitelist-policy.md) | Rebase / FoT ban | | [`docs/runbooks/indexer-external-oracle.md`](docs/runbooks/indexer-external-oracle.md) | CEX FDUSD as `vfdusd`; **X1–X6** | | [`docs/security-model.md`](docs/security-model.md) | SEC-D02 IBC-hooks | | [`docs/exploit-replay-matrix.md`](docs/exploit-replay-matrix.md) | Historical incident template | | [`docs/adr/0001-hybrid-quoting-and-routing.md`](docs/adr/0001-hybrid-quoting-and-routing.md) | ADR format to copy | | [`frontend-dapp/src/pages/Ust1Page.tsx`](frontend-dapp/src/pages/Ust1Page.tsx) | `/ust1` UI | | [`frontend-dapp/src/services/terraclassic/ust1Window.ts`](frontend-dapp/src/services/terraclassic/ust1Window.ts) | `effective_swap` + CW20 Send | | [`frontend-dapp/src/utils/ust1WindowGates.ts`](frontend-dapp/src/utils/ust1WindowGates.ts) | Pause / stale / limit gates | | [`frontend-dapp/src/utils/tokenRegistry.ts`](frontend-dapp/src/utils/tokenRegistry.ts) | vFDUSD identity | | [`tokenlist/tokenlist.json`](tokenlist/tokenlist.json) | Listed CW20s | | [`indexer/src/indexer/oracle.rs`](indexer/src/indexer/oracle.rs) | FDUSD CEX poller | | [`scripts/check-ust1-wrap-ops-health.sh`](scripts/check-ust1-wrap-ops-health.sh) | Inventory / pause / oracle age | | [`docs/runbooks/ust1-secondary-amm-pair.md`](docs/runbooks/ust1-secondary-amm-pair.md) | UST1/vFDUSD AMM | | [`skills/AGENTS_UST1_WINDOW_UI.md`](skills/AGENTS_UST1_WINDOW_UI.md) | Agent window rules | | [`skills/AGENTS_UST1_WRAP_PRODUCTION_OPS.md`](skills/AGENTS_UST1_WRAP_PRODUCTION_OPS.md) | Agent ops rules | | [`skills/AGENTS_INDEXER_EXTERNAL_ORACLE.md`](skills/AGENTS_INDEXER_EXTERNAL_ORACLE.md) | Do not alias `fdusd`/`usdc` | | [`docs/frontend.md`](docs/frontend.md) | **P550-9**, `/ust1` vs `/mint` | | new: `docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md` (suggested) | Decision memo | Upstream (read-only for this issue): ust1-window `effective_swap` / oracle updater; ustr-cmm treasury + wrap-mapper. --- ## Recommended direction 1. **Write ADR `docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md`** (Status: Proposed) plus a short pointer from [`docs/README.md`](docs/README.md) Architecture. Optional agent skill stub **only if** the ADR is accepted later. 2. **Decompose each option into a risk stack** (do not compare “USDC” vs “vFDUSD” as single tokens): | Layer | Status quo | Alternative under study | |-------|------------|-------------------------| | Issuer / reserves | First Digital / FDUSD | Circle / USDC | | Bank / custodian | FDUSD trust / T-bill claims | Circle banks + T-bills (SVB-class) | | Yield venue | Venus Core Pool (BSC) vToken | Noble USDN / M^0 T-bill index (~3.5% claim) | | Receipt token | vFDUSD (exchange-rate) | USDN or staked USDC derivative | | Bridge to Classic | Existing bridged CW20 | Noble IBC + CCTP + new wrap (greenfield) | | CL8Y settlement | ust1-window vFDUSD↔UST1 | New allowlist / new window / dual inventory | 3. **Required memo sections** - **Yield:** dated supply APY vs incentive vs 30/90/365d realized; utilization; redeem queue; USDN index vs advertised 3.5%. - **Depeg / bank-run chronology** (min. USDC Mar 2023 SVB; FDUSD Apr 2025 allegation + any earlier FDUSD prints; DAI/USDP contagion as second-order). Depth, duration, primary-market halt vs secondary only, recovery path (Fed backstop vs issuer PR). - **Protocol incidents:** Venus (2021 XVS, 2022 LUNA oracle, 2024–26 donation/ERC-4626/cap-bypass class) **and** Noble/M^0/USDN (audits, pauses, IBC incidents — explicitly “none found” if so, with search log). - **CL8Y blast radius:** window mint at stale rate; treasury drain; AMM LP; indexer `$1` lie; retail APR copy. - **Scorecard:** issuer, depeg convexity, redeem liquidity, smart-contract, bridge/IBC, rebase-compat, ops pause mapping, regulatory/freeze (Circle blacklist vs FDUSD), implementation cost on Classic. - **Decision:** **Stay on vFDUSD** / **Reject Noble USDC for UST1** / **Defer** / **Dual-inventory (explicitly disallowed unless justified)**. Dual backing without a new product spec is a **fail**. 4. **If** the ADR ever recommends a switch, spawn **follow-up implementation issues** (window, oracle, treasury, indexer tickers, AMM, Coolify, pause runbooks). Do not sneak them into this MR. 5. **Verify script** `scripts/qa/verify-issue-NNN.sh`: required ADR headings present; no `VITE_USDC` / indexer `usdc` ticker introduced by the same MR unless the ADR status is Accepted **and** a linked implementation issue exists (this issue’s MR should be docs-only). --- ## Acceptance criteria - [ ] **AC1.** One ADR (or equivalent memo) in-repo covering **both** stacks; yield, depegs, and protocol incidents are **not** split across issues. - [ ] **AC2.** Title APR claims (3.5% vs 6–8%) are **replaced or falsified** with dated primary/aggregator sources and methodology (supply APY vs incentives vs realized). - [ ] **AC3.** USDC depeg/bank-run: at least SVB **2023-03** (Circle ~$3.3B / ~8% reserves frozen; secondary ~$0.87; primary halt; recovery via US systemic-risk exception) with citations. - [ ] **AC4.** FDUSD depeg/bank-run: at least **2025-04** issuer-insolvency allegation print (~$0.87–$0.91 band, duration, supply response) with citations; any additional FDUSD events in the search window listed or marked none. - [ ] **AC5.** Venus incident table with dates, mechanism, bad-debt/loss band, and **whether Core Pool vFDUSD was directly in the blast radius** (in-scope vs “other market / other chain”). - [ ] **AC6.** Noble / M^0 / USDN / CCTP / IBC risk table (module, redemption, freeze, bridge); gaps called out as **unknown**, not assumed safe. - [ ] **AC7.** Explicit mapping onto CL8Y invariants **U5, O3, O4, O7, X4, X5, P550-9, SEC-D02**, and the rebase/FoT whitelist ban. - [ ] **AC8.** Scorecard + **single product decision** (stay / reject / defer) with residual risks. No “quietly add USDC later.” - [ ] **AC9.** Docs-only MR for this issue: no window/oracle/indexer ticker/factory whitelist change. - [ ] **AC10.** `docs/README.md` (or runbook) links the ADR; NFA / non-promissory language on any APR. - [ ] **AC11.** Follow-up implementation issues listed **only if** decision ≠ stay; otherwise “no impl spawn.” --- ## Test plan (all research paths) These are **document and process tests**, not chain deploys. Each path must appear in the ADR (or an appendix checklist) with pass/fail. | ID | Path | How to test | |----|------|-------------| | **P1 Status quo stack** | vFDUSD = Venus vToken bridged CW20; window U5; CEX feed is FDUSD | Trace addresses from `REGISTRY.md` + tokenlist + `oracle.rs`; confirm no USDC symbol in window client | | **P2 Yield — Venus** | Supply APY vs borrow utilization vs XVS/incentive vs 30/90d | Snapshot Core Pool vFDUSD `supplyRatePerBlock` / UI APY with UTC timestamp; state whether 6–8% is current, historical, or marketing | | **P3 Yield — Noble** | USDC vs USDN vs “liquid staking” naming | Identify the **exact** instrument (USDN mint vs a third-party staker); T-bill index vs advertised 3.5%; lockup vs liquid | | **P4 Depeg — USDC** | SVB 2023 chronology | Primary: Circle disclosure, Fed/FDIC notes; min/max print; hours to re-peg; whether `blacklist`/`pause` fired (historical: market depeg, not a contract pause) | | **P5 Depeg — FDUSD** | 2025-04 and others | Primary: issuer statements + CEX prints; duration; redemption halt?; supply change | | **P6 Venus incidents** | 2021 / 2022 / 2024–26 class | Official post-mortems preferred; tag Core vs Isolated vs zkSync; vFDUSD market affected Y/N | | **P7 Noble/M^0 incidents** | Audits + pauses + IBC | Search log (dates, queries); “none found” allowed only with log | | **P8 Bridge/IBC** | How USDC would reach Classic | CCTP → Noble → IBC → wrap; contrast with current vFDUSD bridge; **SEC-D02** no DEX IBC entry points | | **P9 Rebase compatibility** | USDN/vToken as pair asset | Apply whitelist policy: exchange-rate vToken **bridged as static CW20** vs rebasing USDN; window-only vs AMM | | **P10 Ops mapping** | Each incident class → pause lever | Oracle pause vs window pause vs wrap pause vs do-nothing; cite A / A2 runbook | | **P11 Indexer/UI lie** | `$1` or wrong ticker | Confirm ADR forbids `usdc` alias to `vfdusd` and forbids hard peg | | **P12 Dual inventory** | Two backing assets in one window | Show why dual mint without new product spec fails U5 / O4; reject or specify a new window | | **P13 Retail copy** | APR on `/ust1` or `/protocol` | Any sample sentence checked against #489 / NFA modal; no guaranteed yield | | **P14 Decision close-out** | Stay vs switch | One checked option; residual risk list; impl issues only if switch | **Negative / skip paths** - [ ] **N1.** Memo that only compares “USDC is safer than FDUSD” without Venus vs Noble yield layers → **fail**. - [ ] **N2.** Memo that ranks solely on APR → **fail**. - [ ] **N3.** Implementation diff (new ticker, pair, env) in the research MR → **fail** AC9. - [ ] **N4.** Using `/ust1` `effective_swap` as a Venus or USDC USD price → **fail**. --- ## Test plan — attack, hack, and abuse vectors Research must **evaluate** each vector against **both** stacks and against **today’s UST1/vFDUSD** blast radius. **Do not** write exploits, PoCs, or attack procedures. | ID | Vector | What the memo must show | Fail if | |----|--------|-------------------------|---------| | **A1 Issuer/bank run** | SVB-style reserve freeze; FDUSD insolvency allegation | Primary vs secondary market; UST1 mint still open? | Treats depeg as “temporary noise” with window left live | | **A2 Redemption halt** | Circle/First Digital pause primary redeem; CEX conversion halt | Window + treasury still quote 1:1 via stale oracle | No pause mapping | | **A3 Circle freeze/blacklist** | USDC address freeze / contract pause | Noble USDC + CCTP + any Classic wrap inherit freeze | Ignores centralized freeze that FDUSD/vToken also may have in other forms | | **A4 Venus utilization run** | High utilization → vFDUSD redeem of FDUSD illiquid | **O4** withdraw capacity; UST1 holders cannot exit to FDUSD | Counts 6–8% APR without redeem-liquidity stress | | **A5 Venus oracle / donation / bad debt** | Historical XVS, LUNA stall, ERC-4626 donation, supply-cap bypass | Whether vFDUSD exchangeRate or FDUSD cash can be skewed; pause A2 | “Venus is battle-tested” without incident table | | **A6 Exchange-rate manipulation** | Donate-to-vault / share inflation (wUSDM class) | vToken vs USDN index; bridged CW20 may **not** rebase with Venus | Assumes bridged vFDUSD exchangeRate tracks BSC 1:1 without evidence | | **A7 Noble/M^0 module bug** | Mint/redeem halt, index freeze, wrong yield | Audits + admin keys + pause | Assumes T-bill wrapper cannot fail | | **A8 IBC/CCTP bridge** | Packet timeout, fake denom, hooks re-entry on **peer** chains | DEX has no IBC entry; **bridged token** still toxic in pools (**SEC-D02**) | Adds IBC callbacks to DEX “to support USDC” in this issue | | **A9 Rebase pair insolvency** | Yield token as AMM/limit asset | Whitelist ban; LP/escrow desync | Recommends listing rebasing USDN as factory pair | | **A10 Fake token / ticker alias** | Spoof `symbol=USDC` / path `/price/usdc` → vfdusd | Same class as forbidden `fdusd` alias (**X2**) | Proposes aliasing tickers | | **A11 Stale window mint during depeg** | Oracle still updating a CEX print while issuer is halted | **O2** (do not disable age checks); pause vs keep minting | “Keep minting, arb will fix it” | | **A12 Treasury drain / bank-run on UST1** | Race to withdraw vFDUSD while FDUSD depegged | Inventory monitors; per-tx / 24h caps are **not** peg defense | Treats 1000/10k caps as sufficient peg insurance | | **A13 Governance social engineering** | “Emergency add USDC code ID / dual window” | **O7**; 2-of-3 vs wrap-stack split **O6** | Recommends panic whitelist widen | | **A14 Retail APR fraud / phishing** | Fake “stake UST1 for 8%” copy or scam site | NFA; no APR CTA on `/ust1` from this research | Adds yield badge to window UI | | **A15 Indexer DoS / feed injection** | Poison USDC/FDUSD CEX or future Venus RPC | Soft-fail; **X5** advisory; CSP no browser RPC | Live-scan Noble/BSC from the browser | | **A16 Regulatory seizure** | Issuer or custodian freeze | Compare Circle (US) vs First Digital (HK) vs M^0 T-bill vehicle | Single-jurisdiction handwave | --- ## Verification criteria Issue is **done** when all of the following hold: 1. ADR `docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md` (or the path named in the MR) is merged with **AC1–AC11**. 2. `scripts/qa/verify-issue-<iid>.sh` exists and is wired in the Makefile (`verify-issue-<iid>`): greps required headings (`Yield`, `USDC depeg`, `FDUSD depeg`, `Venus incidents`, `Noble/M0`, `Scorecard`, `Decision`); greps ADR for **U5** / **O4** / **X5** / rebase ban; fails if `indexer` grows an `usdc` ticker or frontend grows `VITE_USDC` **in the same research MR**. 3. `make verify-issue-<iid>` passes on the docs MR. 4. GitLab issue comment records: decision string (**stay** / **reject Noble USDC for UST1** / **defer**), date of yield snapshots, and links to citations (no secrets). 5. Existing gates still pass unchanged: `make verify-issue-506`, `make verify-issue-503` (docs grep), `make verify-issue-515` / `550` if oracle docs were only cross-linked — **no** behavior change. 6. No mainnet txs, no whitelist change, no Coolify env for USDC. **Out of scope for “done”:** implementing USDC/Noble, changing Venus pollers (#571/#572), seeding UST1/vFDUSD AMM (#508), or pausing the window.
PlasticDigits commented 2026-08-19 11:49:49 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #407

marked as related to #407
PlasticDigits commented 2026-08-19 11:49:49 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #502

marked as related to #502
PlasticDigits commented 2026-08-19 11:49:50 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #503

marked as related to #503
PlasticDigits commented 2026-08-19 11:49:51 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #506

marked as related to #506
PlasticDigits commented 2026-08-19 11:49:52 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #508

marked as related to #508
PlasticDigits commented 2026-08-19 11:49:52 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #515

marked as related to #515
PlasticDigits commented 2026-08-19 11:49:53 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #550

marked as related to #550
PlasticDigits commented 2026-08-19 11:49:54 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #572

marked as related to #572
PlasticDigits commented 2026-08-20 01:02:04 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #575

mentioned in issue #575
PlasticDigits commented 2026-08-21 11:30:54 +00:00 (Migrated from gitlab.com)
Copy link

Research note — #574 UST1 collateral: Noble USDC/USDN vs Venus vFDUSD

Status: research comment only (not the in-repo ADR). No window/oracle/indexer/factory change. No APR is a guaranteed return.

Research recommendation (2026-08-21): Stay on vFDUSD / Reject Noble USDC/USDN as UST1 window collateral. Dual inventory: reject (fails U5 / O4 without a new product spec). No implementation issues to spawn.

Title APRs are falsified for current conditions. Venus Core Pool FDUSD supply APY is in the ~0.9–1.3% band on aggregators today (not 6–8%). Noble Dollar (USDN) marketing/30d prints are ~3.3–3.4%, tracking short T-bills (not a locked stake). Ranking solely on APR would invert the title — and would still be the wrong ranking function.

1. Instruments (do not conflate)

Label What it actually is Yield mechanic
USDC Circle fiat-backed dollar. Native on Noble via CCTP; IBC-transferred onward. 0% holder yield. Issuer keeps T-bill/cash carry.
USDN (Noble Dollar) M0 $M extension on Noble. This is the ~3.5% instrument. T-bill index; rebasing global index; holders claim minted rewards.
FDUSD First Digital (HK) fiat-backed dollar. 0% holder yield.
vFDUSD Venus Core Pool vToken on BSC (0xC4eF4229FEc74Ccfe17B2bdeF7715fAC740BA0ba), underlying FDUSD 0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409. CL8Y window asset is the bridged CW20 of this vToken. exchangeRate accrual (borrower interest ± incentives). Not a lockup stake.

Official mechanics:

NFA: none of the APYs below is a promised UST1 return. Window settlement stays effective_swap. Do not put an APR badge on /ust1 or /protocol.

2. Yield — title claims replaced (snapshot 2026-08-21)

Venus Core Pool FDUSD — 6–8% is not current

Source (method) Print As-of
YieldRadar ← DeFiLlama, Venus Core Pool FDUSD, base supply APY (no incentive add-on shown) 1.34%, TVL ~$6.5M, 7d +0.16pp 2026-08-21 (live, ~15 min refresh) — https://yieldradar.org/token/fdusd
StakingBoard, same pool 0.88% spot; 30d mean 1.36%; rewards 0.0% 2026-08-21 — https://stakingboard.com/pools/6679b470-7a53-4b96-88c8-262ea927b4b5
TokenToria ← DeFiLlama 1.96% (stale vs other aggregators; shows how prints drift) retrieved 2026-08-21 — https://tokentoria.com/en/staking/first-digital-usd/

Methodology: aggregator “APY” ≈ annualized supplyRatePerBlock (utilization-driven interest), not a 30/90d realized treasury return, not XVS incentives (currently reported 0), not vToken USD price. Official formula: https://docs-v4.venus.io/guides/protocol-math

Where 6–8% could have come from: historical Binance Launchpool / Venus Prime incentive periods (proposal to add FDUSD as Prime with a 100k FDUSD grant): https://community.venus.io/t/proposal-add-fdusd-as-a-prime-market-to-the-venus-core-pool-on-bnb-chain/4989 — marketing/incentive, not 2026-08 Core Pool base APY.

Redeem-liquidity stress (A4): Allez Labs 2026-06-23 recommended FDUSD Core Pool collateral factor 75% → 50% because BSC DEX depth is exhausted above ~$100k (vs USDC/USDT >$5M): https://community.venus.io/t/allez-labs-risk-parameter-updates-2026-06-23/5835 — headline APY without utilization/redeem depth is incomplete.

On-chain check (not done in this comment): vFDUSD.supplyRatePerBlock() at 0xC4eF4229… on BSC; re-date before any ADR merge.

Noble / USDN — ~3.5% is the right ballpark, variable, T-bill-linked

Source Print As-of
Official marketing site dollar.noble.xyz “est. at 3.3% APY” / comparison table 3.33% retrieved 2026-08-21 (page also has wallet CTA; yield figure is marketing) — https://dollar.noble.xyz/
Stablewatch USDN APY30d 3.39%; TVL/mcap $3.14M retrieved 2026-08-21 — https://www.stablewatch.io/analytics/assets/USDN-Noble-Dollar
M0 launch PR (historical) ~4.15% at 2025-03-05 launch https://www.m0.org/press-releases/noble-launches-usdn-a-programmatic-and-composable-yield-stablecoin-for-application-developers
US 3-month T-bill (path, not USDN itself) FRED DGS3MO 3.86% (2026-08-19); Trading Economics 3M 3.80% (2026-08-21) https://fred.stlouisfed.org/series/DGS3MO — https://home.treasury.gov/resource-center/data-chart-center/interest-rates/TextView?field_tdr_date_value_month=202608&type=daily_treasury_yield_curve

Noble docs: 102% overcollateralization is a governance parameter; yield is claimable rebase, not auto-wallet-balance on every chain: https://docs.noble.xyz/learn/usdn/overview/

Exact instrument for the title “Noble USDC ~3.5%”: USDN minted against M0 $M, not a third-party liquid-staker of native Noble USDC, and not holding raw USDC (0% yield).

3. USDC depeg / bank-run — SVB 2023-03 (AC3)

Chronology (primary + official research):

  1. 2023-03-10 — SVB closed after >$40B same-day withdrawals; FDIC receivership.
  2. ~22:00 ET 2023-03-10 — Circle: $3.3B (~8%) of then-~$40B USDC reserves stuck at SVB (uninsured deposits).
  3. Weekend: primary mint/redeem halted (US banking hours). Secondary sold off.
  4. Trough: Federal Reserve FEDS Note (2025-12-17): secondary 86 cents. CNBC contemporaneous: below 87 cents (CoinDesk). Bloomberg headline print went as low as 81.5 cents on some venues — treat venue prints as a band, not one tick.
  5. 2023-03-12 — Treasury / Fed / FDIC systemic-risk exception: all SVB (and Signature) depositors made whole; access Monday 13 Mar. Not a standing federal backstop for stablecoin issuers.
  6. 2023-03-12/13 — Circle: $3.3B “reserve risk removed”; 77% T-bills / 23% cash (BNY Mellon / BlackRock USDXX).
  7. 2023-03-13–15 — primary reopens; Circle redeemed $3.8B and minted $0.8B by 15 Mar close.

Contract pause/blacklist: this episode was a market + primary-halt depeg, not a USDC pause() / blacklist(). Circle still has both:

Contagion (Fed note): Maker USDC PSM drained at a 950M daily cap; DAI, then GUSD/USDP, depegged with no SVB reserve exposure. Hard-coded 1:1 windows transmit issuer stress — the same class as leaving ust1-window live on a stale rate.

CL8Y mapping: issuer/bank-run → oracle set_paused (O3 / A2) immediately; do not keep minting because “arb will fix it” (A11). Per-tx 1000 / 24h 10k UST1 caps are not peg insurance (A12 / O4).

4. FDUSD depeg / bank-run — 2025-04 issuer-insolvency allegation (AC4)

Primary trigger was reputational / legal adjacency, not a published FDUSD reserve hole.

  1. 2025-04-02 — CoinDesk: Techteryx (TUSD) HK filings allege ~$456M TUSD reserves diverted into illiquid Aria structures while First Digital Trust was reserve manager.
  2. Same day — Justin Sun (X): FDT “effectively insolvent.” FDUSD (FDT’s own stablecoin) sold off.
  3. Prints: ~$0.87–$0.91 band (~9–13% below peg) within hours; The Block ~9% / −$130M mcap; Blockworks ~$0.91 then recover.
  4. First Digital: allegation false; dispute is TUSD not FDUSD; “fully solvent”; T-bill backing; legal action. CEO later: FDT was custodian not fiduciary (contested).
  5. Duration: recovered toward ~$0.98–$0.99 within ~hours to 1 day (secondary). Issuer/third-party claimed redemptions continued ($25.8M cited in secondary writeups — treat as unverified here pending issuer primary).
  6. 2025-04-03 — Binance: re-checked Feb attestation; $2.05B reserves vs circulation (Prescient Assurance, as-of ~2025-03-01).
  7. Aave froze FDUSD supply/borrow on BNB (Blockworks). Venus Core Pool vFDUSD was not shown as the blast-radius market in those reports (unknown / not asserted).
  8. 2025-11-18 — Dubai court freeze of the $456M TUSD/Aria pool; FDT “welcomes” recovery steps. Does not prove FDUSD reserve impairment; it keeps the trustee-reputation channel open.

Issuer transparency (primary portal; Cloudflare blocked this agent fetch): https://www.firstdigitallabs.com/transparency — monthly attestations (Prescient Assurance). Treat attestations as point-in-time, not continuous audits. Bluechip (via CoinDesk) C grade: reserves “reasonably sound” but bankruptcy-remoteness / parent-debt concern.

Other FDUSD prints (not 2025-04 class):

Date Print Class Source
2023-08 ~$0.94 (secondary, market-wide vol) brief liquidity https://news.bitcoin.com/usde-and-fdusd-experience-brief-depegs-amid-saturdays-crypto-market-shake-up/
2024-04-13 ~$0.956, ~30–45 min BTC shock, recovered ~$0.99 same
2024-06-08 ~$0.990 (1%) minor; some registries list as only “depeg” https://stableregistry.com/stablecoins/fdusd/

CL8Y: FDUSD CEX feed (OracleTicker::Vfdusd) is advisory (X4/X5, P550-9). A 13-cent print while the window still mints is an inventory/solvency event. Pause; do not hardcode $1.

5. Venus incidents (AC5)

Date Event Mechanism Loss band Core Pool vFDUSD in blast radius?
2021-05-18 XVS oracle/liquidity XVS $76→$144→crash; borrow BTC/ETH against inflated XVS; liquidations >$200M; bad debt **$95–100M** (2k BTC + ~5.7k ETH) protocol-level Core Pool (XVS/BTC/ETH) Indirect / no — not an FDUSD market event. Same money-market + oracle class.
2022-05-12 LUNA oracle stall Chainlink LUNA/USD floored/suspended at $0.107 vs spot ~$0.01; 230M LUNA deposited; **$13.5M** borrowed; shortfall ~$11.2–14.2M; PauseGuardian ~15:15 UTC; 48h pause Core Pool LUNA/UST markets No (other market). Pause class = O3.
2025-02-27 (post-mortem dated 2024-02-27 in-forum; Chaos Labs 2025-03-27) wUSDM ERC-4626 donation (zkSync) Flash-loan donate-to-vault; wUSDM XR 1.06→~1.76; self-liq $902k bad debt − recoveries ≈ $717k net No — zkSync Isolated, not BSC Core vFDUSD. Same donation/XR class as A6.
2026-03-15 THE (Thena) donation + cap bypass Direct THE transfers to vTHE inflate exchangeRate via getCashPrior()=balanceOf; supply cap only on mint; 3.81× XR; 53.2M THE vs 14.5M cap; ~$14.9M borrowed ~$2.15M bad debt (CAKE/THE). Official: limited to THE/CAKE; other CFs set 0 as precaution No (not vFDUSD). Yes (BSC Core Pool architecture). Vector was a known Code4rena-2023 finding, previously dismissed.

Bridged-CW20 caveat (A6): Classic vFDUSD is a static bridged CW20. It does not automatically inherit BSC exchangeRate rebases. Treasury redeem capacity is Venus liquidity + bridge honesty + FDUSD issuer, not a live XR oracle. Do not assume 1 bridged vFDUSD = 1 live BSC redeemable FDUSD without evidence.

6. Noble / M0 / USDN / CCTP / IBC (AC6)

Module What we know Gaps
USDN token Rebasing index; claim to mint; composable yield via IBC/Hyperlane Claim UX vs auto-rebase differs by integration — wrapper required before any Classic pair/escrow
M0 $M Ethereum issuance; T-bill overcollateral; permissioned minters/validators/TTG Validator double-count H-01 found and marked Fixed (Fedoseev): https://github.com/m0-foundation/documentation/blob/main/protocol-audit-reports/Kirill%20Fedoseev%20Independent%20Auditor%20Report.md
Audits Official list (Quantstamp, Three Sigma, Certora, ChainSecurity, OZ, Sherlock, …) 2024–2026 https://docs.m0.org/resources/audits — reports are PDFs; this note did not re-litigate every finding
M0 Portal USDN mint = lock $M via Wormhole NTT (and Hyperlane “Portal Lite”) Bridge set is new vs current vFDUSD wrap. Wormhole/Hyperlane liveness = unknown residual
CCTP on Noble Native USDC issuance hub for Cosmos; legacy CCTP v1 module (not EVM contracts) https://developers.circle.com/cctp/v1/noble-cosmos-module — https://noble.xyz/usdc
CCTP mint-bug class Asymmetric Research: Noble ReceiveMessage historically did not bind message.Sender the way EVM TokenMessenger does — ** theoretically** fake burn → mint. Writeup says they did not confirm a live exploit https://blog.asymmetric.re/circles-cctp-noble-mint-bug/ — treat as historical module risk, patch status unknown without Noble release notes
IBC USDC/USDN leave Noble as IBC denoms (packet-forwarded) Classic DEX wasm has no ibc_receive (SEC-D02). Arrival would be new wrap program, not a tokenlist row
USDN scale Stablewatch TVL ~$3.1M (2026-08-21) Orders of magnitude below USDC/FDUSD; exit liquidity unknown at UST1 inventory size
M0-adjacent depeg (Usual) 2025-01 USD0++ redemption-floor change → ~$0.87–0.92. Not USDN. Shows extension issuers can rewrite exit terms https://www.theblock.co/post/333995/usual-money-protocol-update
Pauses / incidents on USDN itself None found in this search window “None found” ≠ safe. Search log below

How USDC would reach Classic (architecture only — not a deploy plan): Circle USDC → CCTP v1 → Noble native USDC → IBC → some CosmWasm wrap → new CW20. USDN adds Ethereum $M + Wormhole Portal before Noble. Contrast: current path is BSC Venus vFDUSD → existing bridge → listed CW20. Do not add IBC callbacks to DEX wasm in any follow-up (SEC-D02, A8).

7. CL8Y invariants (AC7)

Invariant Implication for this research
U5 Window pay-in = vFDUSD only; pay-out = UST1 only. Dual mint assets without a new window spec = fail.
O3 Venus/BSC/issuer integrity suspect → ust1-oracle set_paused. Window pause = local maintenance. Fail-closed.
O4 Withdraw capacity = CMM vFDUSD balance + allowance. Depeg + race-to-redeem drains treasury. Caps ≠ peg defense.
O7 No panic whitelist widen / “emergency USDC code ID”.
X4 / X5 / P550-9 CEX FDUSD ≠ Venus XR ≠ window effective_swap ≠ USDC ≠ USDN index. No $1. No usdc ticker alias to vfdusd.
SEC-D02 No IBC entry points in DEX wasm. Bridged toxic assets can still sit in pools.
Rebase/FoT ban docs/runbooks/cw20-whitelist-policy.md: USDN cannot be a factory pair or limit-escrow asset. Window-only would still need a non-rebasing wrapper. Bridged vFDUSD is already static CW20 (allowed as a template class, not a risk blessing).

Pause mapping (P10 / A1–A3, A11):

Incident class Lever
FDUSD or USDC secondary depeg / primary halt / insolvency allegation Oracle pause first (stop mint at stale rate)
Venus Core / bridge / XR integrity Oracle pause; wrap pause if wrap-stack involved
Window contract / allowlist maintenance Window pause
Circle blacklist of a treasury/wrap address Treat as frozen inventory; oracle+window pause; do not “add USDC” as workaround (O7)
IBC/CCTP packet failure N/A today; if a future wrap exists, pause that wrap — not DEX IBC hooks

8. Scorecard + decision (AC8)

Factor Stay vFDUSD (today) Switch to Noble USDC Switch to USDN (the yield token)
Issuer First Digital (HK); TUSD-adjacent reputational channel (2025-04, 2025-11) Circle (US); Big-4 attestations; weekly reserve page https://www.circle.com/transparency M0 T-bill vehicle + Noble extension governance
Depeg convexity 2025-04 ~13¢; recovered ~1d; redemptions claimed live 2023-03 ~14¢; recovered via systemic-risk exception No USDN bank-run found; Usual shows extension-term risk
Redeem liquidity Venus utilization + thin BSC FDUSD DEX Circle primary (KYC) + CCTP/IBC M0 redeem + Portal + claim UX; USDN TVL ~$3M
Smart contract Venus Core (2021/2022/2026 class) + bridge CCTP module + wrap Rebase module + Wormhole/Hyperlane + M0
Bridge / IBC Existing vFDUSD wrap New CCTP+IBC+wrap program New + extra Portal hop
Rebase-compat Bridged static CW20 Non-rebase USDC OK as template class Forbidden as pair/escrow
Ops / pause Playbooks exist (O3/O4, #503) New oracles, denoms, pause runbooks Same + index/claim monitors
Freeze / regulatory HK trustee / attestation regime Circle blacklist + pause; US legislative path Circle (if USDC leg) + M0/Noble admin keys
Implementation cost on Classic Zero (already live) High (new chain+bridge+wrap; SEC-D02) Higher + wrapper
Headline carry (2026-08-21, not a reason to switch) ~0.9–1.3% supply APY 0% ~3.3% T-bill index

Decision: Stay on vFDUSD. Reject Noble USDC/USDN as UST1 collateral.

Not because “FDUSD is safer than USDC.” Circle’s issuer/attestation/regulatory stack is stronger on paper. The reject is because (1) the live product already settles vFDUSD, (2) USDN is rebase-incompatible and tiny, (3) USDC arrival is a new bridge program, (4) title yield advantage of Venus is false today, and (5) dual inventory without a new window is a fail.

Residual risks of staying: FDUSD trustee-reputation shocks; Venus Core donation/oracle class (vFDUSD not historically hit, architecture shared); thin FDUSD DEX depth; bridged CW20 / Venus redeem desync; no $1 in indexer.

If a future ADR ever accepts a switch: spawn separate issues (window, oracle, treasury, indexer tickers, AMM, Coolify, pause runbooks). Do not sneak them into a research MR.

9. Attack-vector evaluation (no PoCs)

Both stacks inherit issuer run + primary halt + stale-window mint. Venus adds utilization lock + donation/XR + oracle stall. Noble/USDN adds CCTP/IBC/Wormhole + rebase accounting + M0/TTG keys. Circle adds address freeze that a Classic wrap would inherit. FDUSD/vToken freezes take other legal/custodial forms — do not treat either as “uncensorable.” Retail APR copy on /ust1 is A14 / NFA.

10. Search log (P7 / “none found”)

Queries used 2026-08-21 (web + official docs; no browser RPC to BSC/Noble from the dApp):

USDC depeg March 2023 Silicon Valley Bank Circle · Circle official blog Silicon Valley Bank · FDIC Treasury Federal Reserve joint statement March 12 2023 · FDUSD depeg April 2025 First Digital insolvency · CoinDesk Techteryx First Digital Trust lawsuit TUSD $456 million · FDUSD other depeg events besides April 2025 · Venus Protocol FDUSD supply APY Core Pool · Venus Protocol XVS 2021 · Venus Protocol LUNA 2022 · Venus wUSDM donation ERC-4626 · Venus THE donation 2026 · Noble Dollar USDN M0 yield · M0 dashboard current yield · M0 protocol official audits · Noble USDC CCTP IBC · Circle CCTP Noble mint bug · Usual USD0 depeg M0 · Circle USDC blacklist freeze · US 3-month Treasury bill yield August 2026

USDN-specific pause/hack/depeg: no primary incident found in this window (Usual is a different M0 extension).

11. This comment vs issue “done”

This note is the GitLab citation dump (verification item 4). It does not close AC1–AC11. Still required for done: ADR docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md, scripts/qa/verify-issue-574.sh, docs-only MR, docs/README.md link, NFA language, no VITE_USDC / indexer usdc ticker.

## Research note — #574 UST1 collateral: Noble USDC/USDN vs Venus vFDUSD **Status:** research comment only (not the in-repo ADR). No window/oracle/indexer/factory change. No APR is a guaranteed return. **Research recommendation (2026-08-21):** **Stay on vFDUSD** / **Reject Noble USDC/USDN as UST1 window collateral**. Dual inventory: **reject** (fails **U5** / **O4** without a new product spec). **No implementation issues to spawn.** Title APRs are **falsified for current conditions**. Venus Core Pool FDUSD supply APY is in the **~0.9–1.3%** band on aggregators today (not 6–8%). Noble Dollar (USDN) marketing/30d prints are **~3.3–3.4%**, tracking short T-bills (not a locked stake). Ranking solely on APR would invert the title — and would still be the wrong ranking function. --- ### 1. Instruments (do not conflate) | Label | What it actually is | Yield mechanic | |---|---|---| | **USDC** | Circle fiat-backed dollar. Native on Noble via CCTP; IBC-transferred onward. **0% holder yield.** | Issuer keeps T-bill/cash carry. | | **USDN (Noble Dollar)** | M0 `$M` extension on Noble. **This is the ~3.5% instrument.** | T-bill index; **rebasing** global index; holders **claim** minted rewards. | | **FDUSD** | First Digital (HK) fiat-backed dollar. | 0% holder yield. | | **vFDUSD** | Venus Core Pool vToken on BSC (`0xC4eF4229FEc74Ccfe17B2bdeF7715fAC740BA0ba`), underlying FDUSD `0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409`. CL8Y window asset is the **bridged CW20** of this vToken. | **exchangeRate accrual** (borrower interest ± incentives). Not a lockup stake. | Official mechanics: - USDN: https://docs.noble.xyz/learn/usdn/overview/ - USDN mint path = lock `$M` on Ethereum via M0 Portal (Wormhole NTT): https://github.com/noble-assets/dollar - Venus APY from `supplyRatePerBlock`: https://docs-v4.venus.io/guides/protocol-math - Venus market addresses: https://docs-v4.venus.io/deployed-contracts/markets - Venus app: https://app.venus.io **NFA:** none of the APYs below is a promised UST1 return. Window settlement stays `effective_swap`. Do not put an APR badge on `/ust1` or `/protocol`. --- ### 2. Yield — title claims replaced (snapshot 2026-08-21) #### Venus Core Pool FDUSD — **6–8% is not current** | Source (method) | Print | As-of | |---|---|---| | YieldRadar ← DeFiLlama, Venus Core Pool FDUSD, **base supply APY** (no incentive add-on shown) | **1.34%**, TVL ~$6.5M, 7d +0.16pp | 2026-08-21 (live, ~15 min refresh) — https://yieldradar.org/token/fdusd | | StakingBoard, same pool | **0.88%** spot; **30d mean 1.36%**; rewards **0.0%** | 2026-08-21 — https://stakingboard.com/pools/6679b470-7a53-4b96-88c8-262ea927b4b5 | | TokenToria ← DeFiLlama | **1.96%** (stale vs other aggregators; shows how prints drift) | retrieved 2026-08-21 — https://tokentoria.com/en/staking/first-digital-usd/ | **Methodology:** aggregator “APY” ≈ annualized `supplyRatePerBlock` (utilization-driven interest), **not** a 30/90d realized treasury return, **not** XVS incentives (currently reported 0), **not** vToken USD price. Official formula: https://docs-v4.venus.io/guides/protocol-math **Where 6–8% could have come from:** historical Binance Launchpool / Venus Prime **incentive** periods (proposal to add FDUSD as Prime with a 100k FDUSD grant): https://community.venus.io/t/proposal-add-fdusd-as-a-prime-market-to-the-venus-core-pool-on-bnb-chain/4989 — **marketing/incentive, not 2026-08 Core Pool base APY**. **Redeem-liquidity stress (A4):** Allez Labs 2026-06-23 recommended FDUSD Core Pool collateral factor **75% → 50%** because BSC DEX depth is exhausted above ~$100k (vs USDC/USDT >$5M): https://community.venus.io/t/allez-labs-risk-parameter-updates-2026-06-23/5835 — headline APY without utilization/redeem depth is incomplete. On-chain check (not done in this comment): `vFDUSD.supplyRatePerBlock()` at `0xC4eF4229…` on BSC; re-date before any ADR merge. #### Noble / USDN — **~3.5% is the right ballpark, variable, T-bill-linked** | Source | Print | As-of | |---|---|---| | Official marketing site `dollar.noble.xyz` | **“est. at 3.3% APY”** / comparison table **3.33%** | retrieved 2026-08-21 (page also has wallet CTA; yield figure is marketing) — https://dollar.noble.xyz/ | | Stablewatch USDN | **APY30d 3.39%**; TVL/mcap **$3.14M** | retrieved 2026-08-21 — https://www.stablewatch.io/analytics/assets/USDN-Noble-Dollar | | M0 launch PR (historical) | **~4.15%** at 2025-03-05 launch | https://www.m0.org/press-releases/noble-launches-usdn-a-programmatic-and-composable-yield-stablecoin-for-application-developers | | US 3-month T-bill (path, not USDN itself) | FRED **DGS3MO 3.86%** (2026-08-19); Trading Economics 3M **3.80%** (2026-08-21) | https://fred.stlouisfed.org/series/DGS3MO — https://home.treasury.gov/resource-center/data-chart-center/interest-rates/TextView?field_tdr_date_value_month=202608&type=daily_treasury_yield_curve | Noble docs: 102% overcollateralization is a **governance parameter**; yield is **claimable rebase**, not auto-wallet-balance on every chain: https://docs.noble.xyz/learn/usdn/overview/ **Exact instrument for the title “Noble USDC ~3.5%”:** **USDN minted against M0 `$M`**, not a third-party liquid-staker of native Noble USDC, and **not** holding raw USDC (0% yield). --- ### 3. USDC depeg / bank-run — SVB 2023-03 (AC3) **Chronology (primary + official research):** 1. **2023-03-10** — SVB closed after >$40B same-day withdrawals; FDIC receivership. 2. **~22:00 ET 2023-03-10** — Circle: **$3.3B (~8%)** of then-~$40B USDC reserves stuck at SVB (uninsured deposits). - Fed citation of Circle post (Wayback): https://web.archive.org/web/20230311202753/https:/www.circle.com/blog/an-update-on-usdc-and-silicon-valley-bank 3. Weekend: **primary mint/redeem halted** (US banking hours). Secondary sold off. 4. **Trough:** Federal Reserve FEDS Note (2025-12-17): secondary **86 cents**. CNBC contemporaneous: **below 87 cents** (CoinDesk). Bloomberg headline print went as low as **81.5 cents** on some venues — treat venue prints as a band, not one tick. - Fed: https://www.federalreserve.gov/econres/notes/feds-notes/in-the-shadow-of-bank-run-lessons-from-the-silicon-valley-bank-failure-and-its-impact-on-stablecoins-20251217.html - Reuters: https://www.reuters.com/business/crypto-firm-circle-reveals-33-bln-exposure-silicon-valley-bank-2023-03-11/ - CNBC: https://www.cnbc.com/2023/03/11/stablecoin-usdc-breaks-dollar-peg-after-firm-reveals-it-has-3point3-billion-in-svb-exposure.html 5. **2023-03-12** — Treasury / Fed / FDIC **systemic-risk exception**: all SVB (and Signature) depositors made whole; access Monday 13 Mar. **Not** a standing federal backstop for stablecoin issuers. - Treasury: https://home.treasury.gov/news/press-releases/jy1337 - FDIC: https://www.fdic.gov/news/press-releases/2023/pr23017.html - Fed: https://www.federalreserve.gov/newsevents/pressreleases/monetary20230312b.htm 6. **2023-03-12/13** — Circle: $3.3B “reserve risk removed”; 77% T-bills / 23% cash (BNY Mellon / BlackRock USDXX). - https://www.circle.com/pressroom/3-3-billion-of-usdc-reserve-risk-removed-dollar-de-peg-closes 7. **2023-03-13–15** — primary reopens; Circle redeemed **$3.8B** and minted **$0.8B** by 15 Mar close. - https://www.circle.com/blog/march-15-update-on-usdc-operations **Contract pause/blacklist:** this episode was a **market + primary-halt depeg**, not a USDC `pause()` / `blacklist()`. Circle still has both: - Risk factors (Blocked Addresses; no guarantee of $1 on third-party venues): https://www.circle.com/legal/usdc-risk-factors - Terms: https://www.circle.com/legal/usdc-terms - Contract roles (`blacklist` / `pause`) documented in Circle v2.2 notes: https://www.circle.com/blog/announcing-usdc-v2-2 **Contagion (Fed note):** Maker **USDC PSM** drained at a 950M daily cap; DAI, then GUSD/USDP, depegged **with no SVB reserve exposure**. Hard-coded 1:1 windows transmit issuer stress — the same class as leaving `ust1-window` live on a stale rate. **CL8Y mapping:** issuer/bank-run → **oracle `set_paused` (O3 / A2)** immediately; do not keep minting because “arb will fix it” (**A11**). Per-tx 1000 / 24h 10k UST1 caps are **not** peg insurance (**A12** / **O4**). --- ### 4. FDUSD depeg / bank-run — 2025-04 issuer-insolvency allegation (AC4) **Primary trigger was reputational / legal adjacency, not a published FDUSD reserve hole.** 1. **2025-04-02** — CoinDesk: Techteryx (TUSD) HK filings allege **~$456M** TUSD reserves diverted into illiquid Aria structures while First Digital Trust was reserve manager. - https://www.coindesk.com/markets/2025/04/02/tron-s-justin-sun-bailed-out-tusd-as-stablecoin-s-usd456m-reserves-were-stuck-in-limbo 2. Same day — Justin Sun (X): FDT “effectively insolvent.” **FDUSD** (FDT’s *own* stablecoin) sold off. 3. Prints: **~$0.87–$0.91** band (~9–13% below peg) within hours; The Block ~9% / −$130M mcap; Blockworks ~$0.91 then recover. - https://www.theblock.co/post/349289/tron-justin-sun-trueusd-fiduciary-insolvent-techteryx-tusd-first-digital-aria - https://www.coindesk.com/markets/2025/04/02/first-digital-to-pursue-legal-action-over-justin-sun-allegations-as-fdusd-drops - https://thedefiant.io/news/defi/fdusd-depegs-after-justin-sun-alleges-insolvency - https://blockworks.co/news/fdusd-depeg-sun-justin-insolvency-stablecoin 4. First Digital: allegation **false**; dispute is **TUSD not FDUSD**; “fully solvent”; T-bill backing; legal action. CEO later: FDT was **custodian not fiduciary** (contested). - https://www.theblock.co/post/350324/first-digital-ceo-pushes-back-against-justin-suns-accusations-says-it-acted-as-custodian-not-fiduciary 5. **Duration:** recovered toward ~$0.98–$0.99 within ~hours to ~1 day (secondary). Issuer/third-party claimed redemptions continued (~$25.8M cited in secondary writeups — treat as **unverified here** pending issuer primary). 6. **2025-04-03** — Binance: re-checked Feb attestation; **$2.05B** reserves vs circulation (Prescient Assurance, as-of ~2025-03-01). - https://crypto.news/binance-confirms-fdusd-reserves-are-accurate-after-a-brief-de-pegging-event/ 7. Aave **froze FDUSD** supply/borrow on BNB (Blockworks). Venus Core Pool vFDUSD was **not** shown as the blast-radius market in those reports (**unknown / not asserted**). 8. **2025-11-18** — Dubai court freeze of the **$456M TUSD/Aria** pool; FDT “welcomes” recovery steps. **Does not prove FDUSD reserve impairment**; it keeps the trustee-reputation channel open. - https://www.coindesk.com/markets/2025/11/18/fdt-welcomes-dubai-s-usd456m-freeze-as-techteryx-seeks-to-recover-trueusd-reserves-from-aria **Issuer transparency (primary portal; Cloudflare blocked this agent fetch):** https://www.firstdigitallabs.com/transparency — monthly attestations (Prescient Assurance). Treat attestations as **point-in-time**, not continuous audits. Bluechip (via CoinDesk) **C** grade: reserves “reasonably sound” but **bankruptcy-remoteness / parent-debt** concern. **Other FDUSD prints (not 2025-04 class):** | Date | Print | Class | Source | |---|---|---|---| | 2023-08 | ~$0.94 (secondary, market-wide vol) | brief liquidity | https://news.bitcoin.com/usde-and-fdusd-experience-brief-depegs-amid-saturdays-crypto-market-shake-up/ | | 2024-04-13 | ~$0.956, ~30–45 min | BTC shock, recovered ~$0.99 | same | | 2024-06-08 | ~$0.990 (1%) | minor; some registries list as only “depeg” | https://stableregistry.com/stablecoins/fdusd/ | **CL8Y:** FDUSD CEX feed (`OracleTicker::Vfdusd`) is **advisory** (**X4/X5**, **P550-9**). A 13-cent print while the window still mints is an **inventory/solvency** event. Pause; do not hardcode `$1`. --- ### 5. Venus incidents (AC5) | Date | Event | Mechanism | Loss band | Core Pool vFDUSD in blast radius? | |---|---|---|---|---| | **2021-05-18** | XVS oracle/liquidity | XVS ~$76→$144→crash; borrow BTC/ETH against inflated XVS; liquidations **>$200M**; bad debt **~$95–100M** (2k BTC + ~5.7k ETH) | protocol-level Core Pool (XVS/BTC/ETH) | **Indirect / no** — not an FDUSD market event. Same money-market + oracle class. | https://www.theblock.co/post/105301/bsc-venus-protocol-liquidations-xvs-token-possible-price-manipulation | | **2022-05-12** | LUNA oracle stall | Chainlink LUNA/USD floored/suspended at **$0.107** vs spot **~$0.01**; ~230M LUNA deposited; **~$13.5M** borrowed; shortfall **~$11.2–14.2M**; **PauseGuardian** ~15:15 UTC; 48h pause | Core Pool LUNA/UST markets | **No** (other market). Pause class = **O3**. | https://community.venus.io/t/venus-protocol-luna-incident-update-2/2654 | | **2025-02-27** (post-mortem dated 2024-02-27 in-forum; Chaos Labs 2025-03-27) | wUSDM ERC-4626 donation (zkSync) | Flash-loan donate-to-vault; wUSDM XR **1.06→~1.76**; self-liq | **$902k** bad debt − recoveries ≈ **$717k** net | **No** — **zkSync Isolated**, not BSC Core vFDUSD. **Same donation/XR class** as A6. | https://community.venus.io/t/post-mortem-wusdm-donation-attack-on-venus-zksync/5004 | | **2026-03-15** | THE (Thena) donation + cap bypass | Direct THE transfers to `vTHE` inflate `exchangeRate` via `getCashPrior()=balanceOf`; supply cap only on `mint`; **3.81×** XR; **53.2M THE** vs 14.5M cap; **~$14.9M** borrowed | **~$2.15M** bad debt (CAKE/THE). Official: limited to THE/CAKE; other CFs set 0 as precaution | **No (not vFDUSD)**. **Yes (BSC Core Pool architecture).** Vector was a **known Code4rena-2023 finding**, previously dismissed. | https://community.venus.io/t/the-market-incident-post-mortem/5712 — patch: https://community.venus.io/t/multi-chain-patch-fix-for-the-market-donation-attack/5718 | **Bridged-CW20 caveat (A6):** Classic vFDUSD is a **static bridged CW20**. It does **not** automatically inherit BSC `exchangeRate` rebases. Treasury redeem capacity is **Venus liquidity + bridge honesty + FDUSD issuer**, not a live XR oracle. Do not assume 1 bridged vFDUSD = 1 live BSC redeemable FDUSD without evidence. --- ### 6. Noble / M0 / USDN / CCTP / IBC (AC6) | Module | What we know | Gaps | |---|---|---| | **USDN token** | Rebasing index; claim to mint; composable yield via IBC/Hyperlane | Claim UX vs auto-rebase differs by integration — **wrapper required** before any Classic pair/escrow | | **M0 `$M`** | Ethereum issuance; T-bill overcollateral; permissioned minters/validators/TTG | Validator double-count **H-01** found and marked **Fixed** (Fedoseev): https://github.com/m0-foundation/documentation/blob/main/protocol-audit-reports/Kirill%20Fedoseev%20Independent%20Auditor%20Report.md | | **Audits** | Official list (Quantstamp, Three Sigma, Certora, ChainSecurity, OZ, Sherlock, …) 2024–2026 | https://docs.m0.org/resources/audits — reports are PDFs; this note did **not** re-litigate every finding | | **M0 Portal** | USDN mint = lock `$M` via **Wormhole NTT** (and Hyperlane “Portal Lite”) | Bridge set is **new** vs current vFDUSD wrap. Wormhole/Hyperlane liveness = unknown residual | | **CCTP on Noble** | Native USDC issuance hub for Cosmos; **legacy CCTP v1 module** (not EVM contracts) | https://developers.circle.com/cctp/v1/noble-cosmos-module — https://noble.xyz/usdc | | **CCTP mint-bug class** | Asymmetric Research: Noble `ReceiveMessage` historically did not bind `message.Sender` the way EVM TokenMessenger does — ** theoretically** fake burn → mint. Writeup says they **did not** confirm a live exploit | https://blog.asymmetric.re/circles-cctp-noble-mint-bug/ — treat as **historical module risk**, patch status **unknown** without Noble release notes | | **IBC** | USDC/USDN leave Noble as IBC denoms (packet-forwarded) | Classic DEX wasm has **no** `ibc_receive` (**SEC-D02**). Arrival would be **new wrap program**, not a tokenlist row | | **USDN scale** | Stablewatch TVL **~$3.1M** (2026-08-21) | Orders of magnitude below USDC/FDUSD; exit liquidity **unknown** at UST1 inventory size | | **M0-adjacent depeg (Usual)** | 2025-01 USD0++ redemption-floor change → ~$0.87–0.92. **Not USDN**. Shows **extension issuers can rewrite exit terms** | https://www.theblock.co/post/333995/usual-money-protocol-update | | **Pauses / incidents on USDN itself** | **None found** in this search window | “None found” ≠ safe. Search log below | **How USDC would reach Classic (architecture only — not a deploy plan):** Circle USDC → **CCTP v1** → Noble native USDC → **IBC** → some CosmWasm wrap → new CW20. USDN adds **Ethereum `$M` + Wormhole Portal** before Noble. Contrast: current path is **BSC Venus vFDUSD → existing bridge → listed CW20**. **Do not** add IBC callbacks to DEX wasm in any follow-up (**SEC-D02**, **A8**). --- ### 7. CL8Y invariants (AC7) | Invariant | Implication for this research | |---|---| | **U5** | Window pay-in = vFDUSD only; pay-out = UST1 only. Dual mint assets without a new window spec = **fail**. | | **O3** | Venus/BSC/issuer integrity suspect → **ust1-oracle `set_paused`**. Window pause = local maintenance. Fail-closed. | | **O4** | Withdraw capacity = CMM vFDUSD **balance + allowance**. Depeg + race-to-redeem drains treasury. Caps ≠ peg defense. | | **O7** | No panic whitelist widen / “emergency USDC code ID”. | | **X4 / X5 / P550-9** | CEX FDUSD ≠ Venus XR ≠ window `effective_swap` ≠ USDC ≠ USDN index. **No `$1`**. **No `usdc` ticker alias to `vfdusd`.** | | **SEC-D02** | No IBC entry points in DEX wasm. Bridged toxic assets can still sit in **pools**. | | **Rebase/FoT ban** | [`docs/runbooks/cw20-whitelist-policy.md`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/blob/main/docs/runbooks/cw20-whitelist-policy.md): USDN **cannot** be a factory pair or limit-escrow asset. Window-only would still need a **non-rebasing wrapper**. Bridged vFDUSD is already static CW20 (allowed *as a template class*, not a risk blessing). | **Pause mapping (P10 / A1–A3, A11):** | Incident class | Lever | |---|---| | FDUSD or USDC secondary depeg / primary halt / insolvency allegation | **Oracle pause** first (stop mint at stale rate) | | Venus Core / bridge / XR integrity | **Oracle pause**; wrap pause if wrap-stack involved | | Window contract / allowlist maintenance | **Window pause** | | Circle blacklist of a treasury/wrap address | Treat as **frozen inventory**; oracle+window pause; **do not** “add USDC” as workaround (**O7**) | | IBC/CCTP packet failure | N/A today; if a future wrap exists, pause that wrap — **not** DEX IBC hooks | --- ### 8. Scorecard + decision (AC8) | Factor | Stay vFDUSD (today) | Switch to Noble USDC | Switch to USDN (the yield token) | |---|---|---|---| | Issuer | First Digital (HK); TUSD-adjacent reputational channel (2025-04, 2025-11) | Circle (US); Big-4 attestations; weekly reserve page https://www.circle.com/transparency | M0 T-bill vehicle + Noble extension governance | | Depeg convexity | 2025-04 ~13¢; recovered ~1d; redemptions claimed live | 2023-03 ~14¢; recovered via **systemic-risk exception** | No USDN bank-run found; Usual shows extension-term risk | | Redeem liquidity | Venus utilization + thin BSC FDUSD DEX | Circle primary (KYC) + CCTP/IBC | M0 redeem + Portal + claim UX; USDN TVL ~$3M | | Smart contract | Venus Core (2021/2022/2026 class) + bridge | CCTP module + wrap | Rebase module + Wormhole/Hyperlane + M0 | | Bridge / IBC | Existing vFDUSD wrap | **New** CCTP+IBC+wrap program | **New** + extra Portal hop | | Rebase-compat | Bridged static CW20 | Non-rebase USDC OK as template class | **Forbidden** as pair/escrow | | Ops / pause | Playbooks exist (**O3/O4**, #503) | New oracles, denoms, pause runbooks | Same + index/claim monitors | | Freeze / regulatory | HK trustee / attestation regime | Circle blacklist + pause; US legislative path | Circle (if USDC leg) + M0/Noble admin keys | | Implementation cost on Classic | **Zero** (already live) | High (new chain+bridge+wrap; SEC-D02) | Higher + wrapper | | Headline carry (2026-08-21, **not** a reason to switch) | **~0.9–1.3%** supply APY | **0%** | **~3.3%** T-bill index | **Decision: Stay on vFDUSD. Reject Noble USDC/USDN as UST1 collateral.** Not because “FDUSD is safer than USDC.” Circle’s issuer/attestation/regulatory stack is stronger on paper. The reject is because (1) the live product already settles vFDUSD, (2) USDN is rebase-incompatible and tiny, (3) USDC arrival is a **new bridge program**, (4) title yield advantage of Venus is **false today**, and (5) dual inventory without a new window is a fail. **Residual risks of staying:** FDUSD trustee-reputation shocks; Venus Core donation/oracle class (vFDUSD not historically hit, architecture shared); thin FDUSD DEX depth; bridged CW20 / Venus redeem desync; no `$1` in indexer. **If** a future ADR ever accepts a switch: spawn separate issues (window, oracle, treasury, indexer tickers, AMM, Coolify, pause runbooks). Do not sneak them into a research MR. --- ### 9. Attack-vector evaluation (no PoCs) Both stacks inherit **issuer run + primary halt + stale-window mint**. Venus adds **utilization lock + donation/XR + oracle stall**. Noble/USDN adds **CCTP/IBC/Wormhole + rebase accounting + M0/TTG keys**. Circle adds **address freeze** that a Classic wrap would inherit. FDUSD/vToken freezes take other legal/custodial forms — do not treat either as “uncensorable.” Retail APR copy on `/ust1` is **A14 / NFA**. --- ### 10. Search log (P7 / “none found”) Queries used 2026-08-21 (web + official docs; no browser RPC to BSC/Noble from the dApp): `USDC depeg March 2023 Silicon Valley Bank Circle` · `Circle official blog Silicon Valley Bank` · `FDIC Treasury Federal Reserve joint statement March 12 2023` · `FDUSD depeg April 2025 First Digital insolvency` · `CoinDesk Techteryx First Digital Trust lawsuit TUSD $456 million` · `FDUSD other depeg events besides April 2025` · `Venus Protocol FDUSD supply APY Core Pool` · `Venus Protocol XVS 2021` · `Venus Protocol LUNA 2022` · `Venus wUSDM donation ERC-4626` · `Venus THE donation 2026` · `Noble Dollar USDN M0 yield` · `M0 dashboard current yield` · `M0 protocol official audits` · `Noble USDC CCTP IBC` · `Circle CCTP Noble mint bug` · `Usual USD0 depeg M0` · `Circle USDC blacklist freeze` · `US 3-month Treasury bill yield August 2026` **USDN-specific pause/hack/depeg:** no primary incident found in this window (Usual is a **different** M0 extension). --- ### 11. This comment vs issue “done” This note is the **GitLab citation dump** (verification item 4). It does **not** close AC1–AC11. Still required for done: ADR `docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md`, `scripts/qa/verify-issue-574.sh`, docs-only MR, `docs/README.md` link, NFA language, no `VITE_USDC` / indexer `usdc` ticker.
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-08-23 11:26:29 +00:00
PlasticDigits commented 2026-08-23 11:26:30 +00:00 (Migrated from gitlab.com)
Copy link

Closing, additional work not needed at this time

Closing, additional work not needed at this time
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/tokio-util-0.x-lockfile
renovate/thiserror-2.x-lockfile
renovate/serde_json-1.x-lockfile
renovate/serde-monorepo
renovate/libc-0.x-lockfile
renovate/chrono-0.x-lockfile
cac-design-issue-1206
cac-design-issue-1317
cac-design-issue-1316
cac-design-issue-1311
cac-design-issue-1300
cac-design-issue-1306
cac-design-issue-1305
cac-design-issue-1302
cac-design-issue-1277
No results found.
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:implement
Queue implement gate

  
agent:implement
Queue implement gate

  
agent:open_issues

   
agent:ready

   
agent:research

   
agent:security_audit

   
agent:verify

   
architecture
Architecture

  
backend
API and services

  
blocker:hybrid
Blocks hybrid launch

  
blocker:launch
Blocks launch

  
blocker:limit-orders
Blocks limits launch

  
blocker:v2
Blocks v2

  
block:log_only

   
block:security

   
bug

   
ci

   
contracts
Smart contracts

  
correctness

   
deploy

   
dev

   
devops

   
docs

   
documentation

   
duplicate

   
e2e

   
enhancement

   
epic
Epic

  
feature

   
frontend

   
functional-completion
Functional

  
gas

   
good first issue

   
governance

   
help wanted

   
high-risk

   
hooks

   
hybrid
Hybrid swaps

  
indexer
Indexer

  
infra
CI/CD

  
infrastructure

   
integrators

   
invalid

   
launch-blocker

   
limit-orders
Limit orders

  
localnet

   
localterra

   
low priority

   
missing-implementation
Implementation

  
needs-design
Design decision required

  
ops

   
performance
  
priority
high

  
priority
medium

  
product

   
qa

   
QA

   
question

   
ready
Definition of Ready

  
ready
Definition of Ready

  
research

   
scripts

   
security
Security

  
security-hardening
Security hardening

  
smartcontracts

   
tech-debt

   
testing
Testing

  
ux

   
UX

   
v2
Pool-only swaps

  
verification

   
wontfix
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-dex-terraclassic#574
No description provided.