risk: add Noon sUSN risk assessment (3.5/5.0 Elevated Risk) by spalen0 · Pull Request #67 · yearn/risk-score

spalen0 · 2026-03-01T10:34:55Z

Summary

Risk assessment report for Noon sUSN (Staked USN) on Ethereum
Final Score: 3.5/5.0 — Elevated Risk (was 3.4 Medium Risk before May 11 reassessment of Liquidity Risk for the Morpho collateral use case)
All key data points reverified on-chain via cast (governance state, MinterHandler params, Morpho oracle architecture)
Latest metrics refresh: May 11, 2026 (block 25,074,135)

Score Breakdown (current)

Category	Score	Weight	Weighted
Audits & Historical	3.0	20%	0.60
Centralization & Control	3.5	30%	1.05
Funds Management	3.5	30%	1.05
Liquidity Risk	4.0	15%	0.60
Operational Risk	3.0	5%	0.15
Final Score			3.45 → 3.5

Risk Tier: Elevated Risk (lower bound — Limited approval, strict position-size limits recommended)

Score evolution

3.6 → 3.4 at Mar 23 reassessment after team feedback (incorporated 48-hour timelock on proxy upgrades, public source code, DCLM market maker liquidation backstop)
Apr 22, Apr 27 refreshes — score unchanged at 3.4
3.4 → 3.5 on May 11 — Liquidity Risk bumped from 3.5 to 4.0 driven by the Morpho collateral use case: 5-day handler queue + maxRedeem = 0 + ~$42/day sUSN DEX volume + 89.5% Morpho utilization with ~$890K headroom. The DCLM backstop is helpful but contractual/off-chain only

Key Findings (current as of May 11)

48h timelock on proxy upgrades (verified on-chain) — both ProxyAdmins owned by Timelock at 0xE5e412C212B4FBbF550A94e7BD5e83dB0B315A7F
Operational functions still untimelocked — blacklist, rescueToken, rebase, USN admin, role grants are immediately executable by 3-of-6 anonymous Safe
Unbacked minting via mintAndRebase() — multisig can mint USN with zero collateral (rebaseLimit 50K/call, adjustable without timelock)
2 EOAs hold REBASE_MANAGER_ROLE on sUSN vault (still true on May 11)
Off-chain custodial reserves — Alpaca/Dinari tokenization claim not verified on-chain
5-day withdrawal lockup — maxRedeem() returns 0
Stork USN/USD oracle — single source for Morpho market, no fallback
No bug bounty on Immunefi/Sherlock/Cantina
DCLM market maker backstop — contractually buys sUSN at prior-day price within 24h on >1% depeg
TVL ~$29.10M (up 9.5% from Apr 27, down 5.4% from Mar 23), USN supply rebounded +16.4% to 27.66M while sUSN supply fell 4.4% to 16.78M (staking ratio dropped from 87% to ~72%), Morpho 89.5% utilized, USN well-pegged at $0.9997

Closes #66

Test plan

🤖 Generated with Claude Code

Risk assessment for Noon protocol's sUSN (Staked USN) token on Ethereum. Final score: 3.6/5.0 (Elevated Risk). Key findings include no timelock on 3-of-6 multisig, off-chain custodial reserves, 5-day withdrawal lockup, and Stork oracle dependency. Closes #66 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel · 2026-03-01T10:35:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
risk-score	Ready	Preview, Comment	May 18, 2026 7:00pm

- Remove multisig signer addresses (per skill.md guidelines) - Add full Risk Tier table with final tier bolded - Verify and annotate collateral wallet types on-chain: Collateral 1 (4-of-5 Safe), Collateral 2 (3-of-4 Safe), Collateral 3 (EOA - flagged as higher risk) - Expand monitoring section: blacklist events, RBAC changes, withdrawal period changes, EOA collateral wallet alerts - Fix placeholder deployment tx links - Fix typo (redeplooys -> redeploys) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Update all on-chain metrics: exchange rate 1.1680 (was 1.1659), TVL ~$31M (was ~$28M), chain distribution shifted to Ethereum - Update DEX volume with accurate CoinGecko data (~$33K USN, ~$156 sUSN) - Update Morpho market data, oracle values, Stork/Chainlink feed values - Add USN peg monitoring section (was missing from monitoring) - Update timeline references to ~14 months beta - Verify all contract ownership unchanged (multisig 3-of-6) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add NOON governance token launch on KuCoin (March 5, 2026) with veToken system details — does not change underlying multisig admin - Add US GENIUS Act regulatory risk for BVI stablecoin issuers - Add tBTC Bitcoin Yield Vault product expansion note - Add Serenity Research link (paywalled analysis) - Note NOON token in governance section Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

spalen0 · 2026-03-16T13:36:34Z

Review: Noon Team Responses (March 14 Google Sheets)

Noon provided responses to our risk assessment findings here:
https://docs.google.com/spreadsheets/d/1PW0sPbCdYBohsNtUOdFSrgwWrZshtkjwwjcb93l3abs/edit?usp=sharing

Planned Remediations (commitments, not yet verified on-chain)

Timelock (items 1, 9): Adding 2-day timelock "by week's end" (~March 21); increase to 7 days at 100M TVL
Open source code (item 7): Will make GitHub repo public "by early next week" (~March 21)
rescueToken() restrictions (item 10): Will add restrictions preventing extraction of vault tokens or underlying assets
Bug bounty (item 3): Can accelerate Immunefi proposal; planned for 50M TVL
Blacklist timelock (item 13): Will add timelock; says blacklisting is required for regulatory compliance (sanctions lists)
Oracle redundancy (item 12): Building redundant data pathway for Stork; notes oracle is reserve-based, not market-price-based

New Information to Investigate

Market maker liquidation agreement (item 6): Noon says a market maker can enter a liquidation agreement to handle the 5-day sUSN withdrawal lockup for Morpho. This is not in the report and is directly relevant to the Yearn use case — needs details
Off-chain reserves claim (item 2): Noon claims off-chain assets are "limited to Fasanara Private Credit position" only. This contradicts our report which documents Ceffu (CEX arb) and Alpaca Securities (T-Bills/CLOs) as also being off-chain custodial. Needs clarification
Protocol age: Noon says 17 months live (since Oct 2024), report says ~14 months (since public beta Jan 2025). Minor discrepancy — contracts deployed Oct 2024 but public beta launched Jan 2025

Items With No Remediation Offered

Anonymous multisig signers (item 4): No fix planned. Commitment to add known signers after >$100M TVL; open to Yearn as signer
Small/young protocol (item 5): "Limited remediation possible"
BVI jurisdiction (item 8): "Limited remediation possible"

Next Steps (updated March 23, 2026)

Verify on-chain whether timelock has been implemented (~March 21) — VERIFIED: Custom Timelock at 0xE5e412C212B4FBbF550A94e7BD5e83dB0B315A7F, 48h delay. Both ProxyAdmins now owned by timelock. Token contracts (USN, sUSN) still directly owned by multisig — operational functions NOT timelocked
Check if GitHub repo is now public — VERIFIED: Protocol-Core and Governance-Core public since March 18-19. CI includes Slither + Mythril. Test coverage 96-100%
Get details on the market maker liquidation agreement — VERIFIED: DCL Markets Ltd (DCLM) contractually obligated to buy sUSN at previous day's price (USDT/USDC) within 24h (+24h grace) if sUSN depegs >1%. Must execute even at a loss. BVI law, JAMS arbitration in London. 45-day termination notice
Clarify the off-chain reserves claim (Ceffu, Alpaca still custodial?) — INVESTIGATED: Ceffu funding rate arb paused 12+ months per team. Alpaca/Dinari tokenization claim NOT verified on-chain — no Dinari dShares or tokenized T-bill tokens in any collateral wallet. T-bills appear to remain off-chain at Alpaca Securities
Update report with team responses section and any verified changes — DONE: Report updated with all findings, scores reassessed
Scores should NOT change until commitments are verified on-chain — DONE: Timelock verified on-chain. Score changed from 3.6 → 3.4 (Elevated → Medium Risk)

Additional Findings During Reassessment

Unbacked minting via mintAndRebase(): Multisig can mint USN with zero collateral — no supply cap, no cooldown, no daily limit. setRebaseLimit() has no upper bound. Not behind timelock. Historical: 25 calls, ~178K USN minted, limit raised twice (30K → 40K → 50K)
2 EOAs hold REBASE_MANAGER_ROLE on sUSN vault (0x173806...d699 deployer, 0xcc2447...b11f unknown) — should be revoked
Morpho market at 100% utilization (was 89.6%) — all supplied USDC is borrowed
rescueToken() restrictions: NOT yet implemented (still callable without timelock)
Bug bounty: NOT yet implemented
Blacklist timelock: NOT yet implemented
Oracle redundancy: NOT yet implemented

Reassessment incorporating team data from feedback spreadsheet: Verified improvements: - 48h timelock on proxy upgrades (0xE5e4...5A7F, on-chain verified) - Source code now public (Protocol-Core + Governance-Core, Slither/Mythril CI) - DCLM market maker liquidation backstop (24h execution on >1% depeg) - Ceffu funding rate arb paused 12+ months New findings: - mintAndRebase() allows unbacked USN minting (no supply cap, no cooldown, no daily limit, rebaseLimit adjustable to uint256.max, not behind timelock) - 2 EOAs still hold REBASE_MANAGER_ROLE on sUSN vault - Alpaca/Dinari tokenization NOT verified on-chain - Morpho market at 100% utilization (was 89.6%) - Anonymous signers: no fix planned (commitment after >$100M TVL) Score changes: - Audits: 3.5 → 3.0 (public code, 17mo production) - Centralization: 4.0 → 3.5 (timelock on proxy upgrades) - Operational: 3.5 → 3.0 (public repos, CI) - Final: 3.6 → 3.4 (Elevated → Medium Risk) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

On-chain reverification (block 24,973,944) confirms governance state unchanged: 3-of-6 multisig, 48h timelock on proxy upgrades, both ProxyAdmins owned by timelock, 2 EOAs still hold REBASE_MANAGER_ROLE, Collateral 3 still EOA, MinterHandler params unchanged. Refreshed metrics: - TVL: $30.75M (Mar 23) → $26.91M (Apr 22) → $26.57M (Apr 27, DeFiLlama) - USN supply: 27.70M → 24.10M → 23.76M (-14.2% from Mar 23) - sUSN supply: 18.20M → 17.66M → 17.55M (-3.5% from Mar 23) - sUSN exchange rate: 1.1717 → 1.1822 → 1.1824 - Morpho utilization: 100% → ~90% → 89.6% (~$880K supply headroom) - DEX volume: USN $33K → $626 → $5.7K/day; sUSN $156 → $118 → $1.6/day - USN price: $0.9997 (well-pegged, CoinGecko) - Oracle price: 1.1826 USDC/sUSN Score unchanged at 3.4 (Medium Risk). TVL contraction worth watching against the $15M reassessment trigger but well outside it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

spalen0 · 2026-04-28T00:56:29Z

+
+- **Oracle**: [`0xC415Cc3F04F9074A9562aEEe02591e65D39A94aa`](https://etherscan.io/address/0xC415Cc3F04F9074A9562aEEe02591e65D39A94aa)
+  - Monitor oracle price for staleness or deviation from sUSN vault exchange rate
+  - **Alert**: If Stork feed deviates >1% from sUSN's on-chain `convertToAssets()` value


Current on-chain values make this alert fire permanently if implemented literally: BASE_FEED_1.latestAnswer() is 1e18 (USN/USD), while sUSN.convertToAssets(1e18) is 1.182370407318935270e18 (sUSN/USN). The Stork feed should be monitored against USN/USD peg/market sources or expected 1e18 plus staleness; the full Morpho price() can be compared against convertToAssets * USN/USD / USDC/USD after normalizing decimals.

Addressed in 66b3a9e:

Removed the broken Stork feed deviates from convertToAssets() alert (different units, would always fire)

Oracle now monitored against the expected convertToAssets × USN/USD ÷ USDC/USD formula

Stork USN/USD feed monitored against 1e18 ($1.00) and against off-chain market USN/USD price (oracle-vs-market divergence is the actual depeg risk)

Added Chainlink USDC/USD feed monitoring with standard staleness checks

Documented the non-Unix updatedAt issue with the Stork adapter and the cadence-based workaround

spalen0 · 2026-04-28T00:56:38Z

+- **MinterHandlerV2**: [`0xB91b361ebE4022Bb62dF0651bDD09b21209ac058`](https://etherscan.io/address/0xB91b361ebE4022Bb62dF0651bDD09b21209ac058)
+  - Monitor `MintAndRebase(amount)` events — each call mints USN without collateral
+  - **Alert**: If `mintAndRebase` called more than once per day or with amount close to `rebaseLimit`
+  - Monitor for `setRebaseLimit()`, `setAdmin()` calls — parameter changes with no timelock


setAdmin() is on the USN token (0xdA67...1eD), not on the MinterHandlerV2 address listed in this subsection. If the monitor follows this literally and watches only MinterHandler calls, it will miss the critical admin-replacement path. I would split this into setRebaseLimit(uint256) on MinterHandler and setAdmin(address) / selector 0x704b6c02 on USN, or monitor the Safe transactions by target contract.

Addressed in 66b3a9e:

setAdmin(address) (selector 0x704b6c02, verified via cast sig) moved to the USN token monitoring section

MinterHandlerV2 monitoring now lists only setRebaseLimit(uint256)

Added the alternative suggestion to monitor by Safe transaction target contract (USN vs MinterHandlerV2) rather than event-name parsing

spalen0 · 2026-04-28T00:56:57Z

Review pass notes (Apr 28, 2026):

Rechecked the main on-chain claims at latest Ethereum block 24,975,100 via cast / publicnode RPC. Governance state matches the report: USN and sUSN owners are still the 0x1ea1...327f 3-of-6 Safe, both ProxyAdmins are owned by the 0xE5e4...5A7F timelock, and delay() is 172800 seconds.
Rechecked core metrics: USN supply 23,761,212, sUSN supply 17,554,251, sUSN totalAssets() 20,755,626, convertToAssets(1e18) 1.182370407318935270, and maxRedeem() 0. These match the Apr 27 snapshot.
Rechecked privileged roles and MinterHandler params: all four reported REBASE_MANAGER_ROLE holders are still active, Safe still has MINTER_ROLE, rebaseLimit is 50,000 USN, directMintLimitPerDay and mintLimitPerBlock are both 10M USN, and USN admin() is still MinterHandlerV2.
Rechecked Morpho market/oracle: market params match the report, market assets are roughly $8.45M supply / $7.57M borrow, Stork feed is 1e18, USDC feed is 99,979,871, and oracle price() is 1.182608447254347827674232e24.
DeFiLlama current TVL still matches the report at about $26.58M; CoinGecko still shows sUSN volume effectively zero.

I left two inline comments on monitoring details that should be fixed before relying on the report operationally. Also, the PR title/body are stale: they still advertise 3.6/5.0 Elevated Risk, while the report now says 3.4/5.0 Medium Risk.

No TODO/TBD placeholders were left in reports/report/noon-susn.md.

Two inline review issues from spalen0 (Apr 28): 1. setAdmin() is on the USN token, not MinterHandlerV2. Split the bullets so USN watches setAdmin(address) (selector 0x704b6c02) and MinterHandlerV2 watches only setRebaseLimit(uint256). Note the option to monitor by Safe transaction target contract. 2. Stork USN/USD feed (1e18) was being compared to convertToAssets (1.18e18) — different units, so the alert would fire permanently. Rewrite to: - Monitor oracle price() against expected convertToAssets × USN/USD ÷ USDC/USD formula - Monitor Stork against $1.00 directly and against off-chain market USN/USD price (oracle-vs-market divergence is the depeg risk) - Note Stork's non-Unix updatedAt — wall-clock staleness checks don't work; use update-cadence checks instead - Add explicit Chainlink USDC/USD monitoring Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Updates all on-chain data, TVL, DEX volumes and prior-period comparisons to block 25,074,135. Key narrative changes from Apr 27: - USN total supply rebounded +16.4% (23.76M -> 27.66M) but did not enter sUSN; staking ratio dropped from 87.4% to ~72% - sUSN total supply down 4.4%; exchange rate up to 1.1870 (from 1.1824) - TVL grew +9.5% to $29.10M, but L2 deployments collapsed (Sophon -79.6%, zkSync Era -76.8%) - Morpho market utilization 89.5% (was 89.6%); supply ~$8.53M, borrow ~$7.63M, ~$890K withdrawable headroom - DEX volumes still negligible: USN ~$1.0K/day, sUSN ~$42/day - Governance state and REBASE_MANAGER_ROLE holders unchanged

Reassess Liquidity Risk from 3.5 to 4.0 to better reflect the use-case-specific exit profile for sUSN as Morpho collateral: - 5-day handler queue with maxRedeem() = 0 (no on-chain instant redeem) - DEX exit effectively absent — ~$42/day sUSN, ~$1.0K/day USN vs $29M TVL - Morpho market 89.5% utilized, only ~$890K withdrawable headroom - DCLM backstop is contractual/off-chain only, not on-chain enforceable These factors collectively meet the score-4 rubric criteria better than score-3 (market-based >$1M exit in 3-7 days). Recomputed final score 3.45 -> 3.5 (rounded), tier change from Medium to Elevated Risk. Tier change reflects use-case liquidity, not protocol deterioration.

- On-chain snapshot at block 25,123,989 - DeFiLlama TVL $28.59M (down ~1.7% from $29.10M on May 11) - USN supply 27.14M (-1.9%), sUSN supply 16.28M (-3.0%), totalAssets 19.37M (-2.8%) - Exchange rate 1.1897 (+0.22% from 1.1870 on May 11), staking ratio ~71.4% - Morpho market: $8.60M supply / $7.67M borrow / 89.1% utilization / ~$935K headroom - Oracle price() = 1.1900 USDC/sUSN; Stork USN/USD $1.00; Chainlink USDC/USD $0.9997 - CoinGecko: USN $1.001 (24h vol $280K, up notably); sUSN 24h vol $4.9K (still negligible) - Governance and MinterHandler params unchanged - All scores and 3.5/5.0 Elevated Risk final score unchanged Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

vercel Bot deployed to Preview March 1, 2026 12:05 View deployment

spalen0 and others added 2 commits March 10, 2026 07:52

Merge remote-tracking branch 'origin/master' into review/noon-susn

1c42b7d

vercel Bot deployed to Preview March 10, 2026 07:04 View deployment

vercel Bot deployed to Preview March 10, 2026 07:07 View deployment

spalen0 marked this pull request as ready for review March 16, 2026 14:40

spalen0 marked this pull request as draft March 16, 2026 14:40

vercel Bot deployed to Preview March 23, 2026 22:05 View deployment

vercel Bot deployed to Preview April 27, 2026 21:50 View deployment

spalen0 commented Apr 28, 2026

View reviewed changes

vercel Bot deployed to Preview April 28, 2026 12:51 View deployment

spalen0 changed the title ~~risk: add Noon sUSN risk assessment (3.6/5.0 Elevated Risk)~~ risk: add Noon sUSN risk assessment (3.4/5.0 Medium Risk) Apr 28, 2026

spalen0 marked this pull request as ready for review April 28, 2026 20:11

vercel Bot deployed to Preview May 11, 2026 20:12 View deployment

spalen0 changed the title ~~risk: add Noon sUSN risk assessment (3.4/5.0 Medium Risk)~~ risk: add Noon sUSN risk assessment (3.5/5.0 Elevated Risk) May 13, 2026

vercel Bot deployed to Preview May 13, 2026 19:38 View deployment

vercel Bot deployed to Preview May 18, 2026 19:00 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

risk: add Noon sUSN risk assessment (3.5/5.0 Elevated Risk)#67

risk: add Noon sUSN risk assessment (3.5/5.0 Elevated Risk)#67
spalen0 wants to merge 11 commits into
masterfrom
review/noon-susn

spalen0 commented Mar 1, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Mar 1, 2026 •

edited

Loading

Uh oh!

spalen0 commented Mar 16, 2026 •

edited

Loading

Uh oh!

spalen0 Apr 28, 2026

Uh oh!

spalen0 Apr 28, 2026

Uh oh!

spalen0 Apr 28, 2026

Uh oh!

spalen0 Apr 28, 2026

Uh oh!

spalen0 commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

spalen0 commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Score Breakdown (current)

Score evolution

Key Findings (current as of May 11)

Test plan

Uh oh!

vercel Bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

spalen0 commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review: Noon Team Responses (March 14 Google Sheets)

Planned Remediations (commitments, not yet verified on-chain)

New Information to Investigate

Items With No Remediation Offered

Next Steps (updated March 23, 2026)

Additional Findings During Reassessment

Uh oh!

spalen0 Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

spalen0 Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

spalen0 Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

spalen0 Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

spalen0 commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

spalen0 commented Mar 1, 2026 •

edited

Loading

vercel Bot commented Mar 1, 2026 •

edited

Loading

spalen0 commented Mar 16, 2026 •

edited

Loading