Skip to content

Risk Assessment: Origin OUSD (1.90/5.0 — Low Risk)#136

Draft
spalen0 wants to merge 5 commits into
masterfrom
ousd
Draft

Risk Assessment: Origin OUSD (1.90/5.0 — Low Risk)#136
spalen0 wants to merge 5 commits into
masterfrom
ousd

Conversation

@spalen0
Copy link
Copy Markdown
Collaborator

@spalen0 spalen0 commented Apr 10, 2026 •
edited
Loading

Summary

  • New risk assessment for Origin Dollar (OUSD), a rebasing stablecoin backed 100% by USDC
  • Final Score: 1.90/5.0 — Low Risk (Approved with standard monitoring)
  • Governance data verified against existing Origin ARM report (same protocol, same Timelock + xOGN governance)

Key Findings

  • AMO minting: mintForStrategy() can mint OUSD without direct backing, but constrained by 99.8% solvency check, pool balance improvement modifier, and governance-controlled whitelist. Historical vault-level cap deprecated.
  • Broad untimelocked strategist surface (2-of-8 multisig): AMO ops, strategy allocation, vault params (setVaultBuffer, setDripDuration, setRebaseRateMax, setDefaultStrategy), pause controls, and OUSD token delegateYield / undelegateYield (can redirect any account's rebase yield)
  • Async withdrawal queue: requestWithdrawal / claimWithdrawal with 10-min minimum delay (withdrawalClaimDelay = 600s) and no on-chain upper bound
  • Single USDC collateral dependency (Circle freeze risk)
  • Cross-chain strategies (~12% TVL on Base/HyperEVM via Circle CCTP)
  • 9 OUSD-specific audits by 5 top firms + $1M Immunefi bounty + Certora formal verification

Test plan

  • Verify all Etherscan links resolve correctly — all addresses verified on-chain; proxy impls match (OUSD: 0xa7b7...dcc33, Vault: 0xe3a9...4578e); multisig thresholds match (Strategist 2-of-8, GOV 5-of-8, Trustee 1-of-3)
  • Cross-check governance data against Origin ARM report — Timelock, xOGN Gov, GOV Multisig, signers, roles (PROPOSER/EXECUTOR/CANCELLER), 48h min delay all match
  • Validate score calculation arithmetic — (1.75×0.20) + (2.0×0.30) + (1.75×0.30) + (2.5×0.15) + (1.0×0.05) = 1.90 ✓
  • Review AMO minting analysis for accuracy — SOLVENCY_THRESHOLD = 9.98e17 (99.8%) verified; only Curve AMO 0x26a0...Ce11 is mint-whitelisted; Morpho V2 not whitelisted; netOusdMintForStrategyThreshold() reverts (confirms deprecated)
  • Address review feedback (spalen0): async withdrawal model, expanded strategist powers table, totalSupply on token vs totalValue on vault, rescored Programmability 2.0→2.5

Closes #132

🤖 Generated with Claude Code

@spalen0 @claude
Assess Origin OUSD: rebasing stablecoin backed by USDC, score 1.85/5.0
d4feead 
Closes #132. Evaluates OUSD for Yearn strategy deposit. Key finding: AMO
can mint without direct backing but constrained by 99.8% solvency check.
Same governance as Origin ARM (xOGN + 48h timelock). Low Risk tier.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 10, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
risk-score Ready Ready Preview, Comment May 11, 2026 8:08pm

Request Review

spalen0
spalen0 commented Apr 22, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator Author

@spalen0 spalen0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Leaving the contract-level review notes here since GitHub won't let the PR author request changes on their own pull request. The main issues are the stale redemption description and the understated strategist powers; details are inline.

Comment thread reports/report/origin-ousd.md Outdated
Comment thread reports/report/origin-ousd.md Outdated
Comment thread reports/report/origin-ousd.md Outdated
@spalen0 spalen0 changed the title Risk Assessment: Origin OUSD (1.85/5.0 — Low Risk) Risk Assessment: Origin OUSD (1.90/5.0 — Low Risk) Apr 22, 2026
@spalen0 @claude
fix: address OUSD report review feedback
4d23391 
- Correct redemption model: async requestWithdrawal/claimWithdrawal
  with 10-min minimum delay and no on-chain upper bound (was
  incorrectly described as redeem() with up to 24h)
- Expand strategist (2-of-8) untimelocked powers: setVaultBuffer,
  setDefaultStrategy, setRebaseRateMax, setDripDuration,
  withdrawAllFromStrategies, plus OUSD token delegateYield /
  undelegateYield which can redirect any account's rebase yield
- Fix monitoring: totalSupply() is on the OUSD token, totalValue()
  on the vault
- Bump Programmability subscore 2.0 -> 2.5; Centralization 1.83 -> 2.0;
  Final Score 1.85 -> 1.90 (still Low Risk tier)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@spalen0 @claude
fix: remove stale 24-hour redemption wording in Liquidity score bullet
6c35bb4 
Aligns Category 4 bullet with the rest of the report (Accessibility,
Liquidity Risk, Data flows) which already describe the async withdrawal
queue with a 10-minute minimum and no on-chain upper bound.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
spalen0
spalen0 commented Apr 28, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator Author

@spalen0 spalen0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On-chain spot check completed against the current PR head. Main findings are inline: stale TVL/allocation, overstated Curve exit liquidity, queue-reserved accounting nuance, and one stale Safe signer entry.

Comment thread reports/report/origin-ousd.md Outdated
Comment thread reports/report/origin-ousd.md Outdated
Comment thread reports/report/origin-ousd.md Outdated
Comment thread reports/report/origin-ousd.md Outdated
@spalen0 @claude
fix: refresh OUSD report with current on-chain data and fixes
88c3a8c 
Addresses spalen0 review comments on PR #136:

- TVL/allocation refreshed at block 24978666: vault.totalValue() ~$5.66M
  (was ~$7.6M), Morpho ~63% (was ~45%), Curve AMO ~17% (was ~43%),
  Cross-chain ~20% combined (was ~12%); cross-chain percentages updated
  in Overview, Allocation table, Collateralization, Provability, Liquidity,
  External Dependencies, Risk Summary, score subcategories, and the
  architecture diagram.
- Provability/Monitoring now note that totalValue() and checkBalance()
  already net out the withdrawal-queue reserve (queued - claimed); the
  vault's raw USDC balance must be read separately from
  withdrawalQueueMetadata() to reconstruct components. Effective idle
  vault USDC at snapshot is ~734 (~17,938 raw - ~17,204 reserved).
- Curve OUSD/USDC pool TVL corrected from ~$3.4M to ~$1.05M
  (~588K OUSD + ~465K USDC); liquidity narrative now reflects that the
  USDC side caps instant DEX-exit capacity. get_dy values cited.
- GOV multisig 8th signer updated from 0xa96bD9c5 to 0x9990C10c per
  current Safe getOwners() result; threshold remains 5-of-8.
- Morpho concentration (~63% in a single MetaMorpho vault) added to
  Risk Summary and elevated to a Critical external dependency.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@spalen0 @claude
fix: refresh OUSD report on-chain data to block 25074136
8bf5ab2 
Snapshot moved from block 24978666 to 25074136. Material shifts:

- vault.totalValue() $5.66M -> $5.47M (down ~3.4%)
- Morpho ~63% -> ~55% (~$3.00M; strategy balance dropped ~$560K)
- HyperEVM ~10% -> ~17% (~$914K; +69% growth)
- Cross-chain combined ~20% -> ~28%
- Curve pool TVL ~$1.05M -> ~$956K; USDC side ~$465K -> ~$328K (-30%)
- get_dy 100k OUSD ~99,903 USDC; 300k OUSD ~297,718 USDC
- Effective idle vault USDC ~734 -> ~0 (all ~17,204 raw fully
  reserved against pending withdrawal queue claims)
- Queue index 45 -> 52 (7 new requests; queue caught up)
- GOV multisig signers and threshold unchanged

Updated: Overview, TVL history, Strategy Allocation table,
Accessibility (DEX), Collateralization, Provability, Liquidity Risk,
External Dependencies, GOV signer block reference, Risk Summary,
Risk Score subcategories, and the architecture diagram.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Risk Assessment: OUSD

1 participant

@spalen0