Falcon Finance

Green · 76/100

Executive summary

Falcon Finance is a synthetic-dollar protocol issuing USDf backed by crypto and RWA collateral, using basis/funding arbitrage and staking strategies; it scores 58/100 (orange band), reflecting material custody, governance, and depeg risks despite multiple audits.

  • Security: Three audits by Zellic and Pashov (Feb–Sep 2025) found 0 Critical, 1 Medium (reward miscalculation, fixed), and low-severity issues; a June 2026 live-infrastructure review flagged 1 Critical (single-EOA mint authority) and 2 High findings (arbitrary burn EOA, no CCIP rate limits), all marked Open or Accepted.
  • Incidents: Two documented depegs—July 2025 to ~$0.92 (collateral/liquidity stress, 7-day redemption lag) and January 2026 to ~$0.9871 (mild, cause unconfirmed); both resolved, but no verified user-loss or reimbursement data.
  • Governance & custody: Effective control by Falcon Digital Limited (BVI); Ethereum admin is a 4-of-6 Safe with no timelock, enabling immediate upgrades and role changes; single-EOA mint/burn authorities create material user-fund risk; DAO governance is symbolic (Snapshot votes exist, but docs say governance is "Coming Soon").
  • Top risks: High counterparty exposure (Ceffu, Fireblocks, Binance, Bybit custody/execution; reserve attestations did not verify liens or segregation); collateral depeg/liquidity risk (volatile assets, stablecoin correlation); privileged admin can drain or freeze; off-chain strategy losses not on-chain verifiable; regulatory status unclear (BVI entity, no license, U.S. persons excluded).
  • Strengths: Broad collateral acceptance (stables, BTC, ETH, RWAs); diversified yield (basis, funding-rate, cross-exchange arb); overcollateralization and insurance fund (unverified scale); weekly reserve updates and third-party attestations; public founder (Andrei Grachev, DWF Labs).
  • Unverified: Current Ethereum reserve composition, on-chain TVL breakdown, holder concentration, exact custodian exposure splits, insurance-fund size, unlock schedule, and whether all claimed controls are live; reserve letters confirmed sight of assets but not beneficial ownership or encumbrances.
  • Recommended exposure: Maximum 1–2% allocation for sophisticated allocators only, conditional on independent verification of current reserve composition, custodian segregation, and admin-key rotation to timelock multisig; avoid if unable to verify real-time collateral or if depeg tolerance is low; treat as high-beta stablecoin with custody and governance tail risk.
  • Open questions: Verify current Ethereum reserve wallet addresses and on-chain balances; confirm custodian segregation terms and lien-free status; assess whether single-EOA mint/burn authorities have been replaced by multisig+timelock; review insurance-fund adequacy for largest-counterparty default; clarify DAO governance roadmap and whether token holders will control upgrades.

Score

Component Weight Raw Points Reason
Security 20% 100 20.0 4 audit(s); fresh audit bonus; active bug bounty bonus
Audits 20% 100 20.0 full audit within 365 days (latest 2025-09-19)
Incidents 20% 100 20.0 no open incidents
Governance 20% 75 15.0 a single party can withdraw funds (admin_can_drain)
TVL 20% 7 1.4 TVL $1,175,944,079 = 7% of reference ($17,538,184,136)
Data confidence 88 7/7 critical categories; 15/37 verified facts; 37/37 fresh (180d)

Identification

protocol identification

one source

Falcon Finance appears to be an extremely low‑visibility or defunct project; key protocol identifiers and contracts cannot be confidently established. Not verifiable as of 2026-09-03. 1. Protocol identification

  • Name / website / docs: Web search surfaces multiple “Falcon”-branded crypto entities (FalconX, FalconSwap, Falcon Finance wallets/BSC projects, Falcon DAO, etc.), but no consistently referenced Ethereum DeFi yield protocol with slug *falcon-finance* matching your description.
  • Several hits refer to mobile wallets or CeFi services, not on-chain DeFi protocols.
  • Others are unrelated Falcon-branded tokens on BSC or other chains.
  • Therefore, canonical website and docs for an Ethereum DeFi yield protocol named “Falcon Finance” are Not verifiable as of 2026-09-03.
  • Category (lending / yield / DEX, etc.): Because the protocol itself cannot be reliably located, its functional category is Not verifiable as of 2026-09-03.
  • Launch date: No credible, cross-checked sources (explorer pages, analytics platforms, or independent media) identify a launch date for an Ethereum DeFi protocol named Falcon Finance. Not verifiable as of 2026-09-03.
  • Chains: You specified Ethereum, but I cannot find confirmed Ethereum contracts under a Falcon Finance brand that match a yield protocol and have non-trivial TVL or usage. Not verifiable as of 2026-09-03.
  • Native token: Multiple “Falcon” tokens exist (often on BSC or minor chains) with tickers like FALCON/FLC, but none can be reliably tied to an Ethereum yield protocol named Falcon Finance through independent sources. Name-collision risk is high. Not verifiable as of 2026-09-03.
  • Main contract addresses & explorer verification: No set of Ethereum contract addresses can be confidently attributed to *this* Falcon Finance protocol with ≥2 independent sources. Not verifiable as of 2026-09-03. 2. Fork lineage & modifications Because the underlying protocol itself cannot be reliably identified, there is no basis to:
  • Determine whether it is a fork of another protocol.
  • Assess what changes were made vs. an upstream.
  • Confirm if any such changes were audited.
  • Examine malicious-modification history in similar forks. All of the above are Not verifiable as of 2026-09-03. From a risk perspective, the inability to locate verifiable contracts, audits, or independent analytics for this protocol is itself a critical red flag for institutional deployment.
Evidence (2)

maturity

two sources

Falcon Finance appears to have a real, functioning web app rather than a pure landing page: the main site markets USDf minting, and the docs link directly into app flows for deposit, withdrawal, mint, and redeem actions under app.falcon.finance. The docs also describe step-by-step deposit and withdrawal UX, including address generation, QR codes, profile balance updates, and a withdrawal flow, which is a sign of product maturity beyond a static brochure. Live deposits/withdrawals are claimed in the docs and FAQ, with redemption and withdrawal support for KYC-verified users, plus a cooldown period on redemptions.

However, without on-chain verification in this run, it is Not verifiable as of 2026-09-03 whether those flows are currently live on Ethereum, so the operational status should be treated as partially verified from web evidence only. There are some maturity signals worth noting: the docs site exposes a Markdown/LLM index and multiple product guides, suggesting a maintained documentation set. At the same time, some source snippets are promotional rather than technical, so claims like “universal collateralization infrastructure” remain unverified marketing claims unless independently checked.

I did not find clear evidence of broken links or fake metrics in the retrieved pages, but that is also Not verifiable as of 2026-09-03 from the available evidence. For open API, the answer is no clear open API was found for the DeFi protocol itself; the search results instead surfaced a different “Falcon API” product for embedded finance, which appears unrelated and should not be conflated with Falcon Finance.

Evidence (10)

Security

bug bounty

two sources

Falcon Finance appears to have an active third-party bug bounty presence on Immunefi, but the public result page does not expose the full program parameters in the retrieved evidence. The available source shows the project has 5 bugs found and $4K total earned on Immunefi, indicating at least some bounty activity and completed payouts. However, the exact launch date, scope/eligibility rules, payout tiers, and whether the program is still formally open are Not verifiable as of 2026-09-03 from the gathered evidence.

Sources also conflict: a LlamaRisk note from 2026-01-13 said Falcon Finance planned to launch a bug bounty in 2026 Q1, while a later public page indicates bounty activity already existed by 2026-05-30.

Active
Yes
Platform
Immunefi
Since
2026-05-30
Evidence (3)

counterparty risks

unverified

Falcon Finance — Ethereum: Dependencies & Counterparty Risk Overall risk: High. The core dependency stack is not purely on-chain: Falcon documents third-party custodians/OES providers (Ceffu/MirrorX and Fireblocks), CEX execution/settlement (Binance and Bybit), liquidity pools, staking venues, and delta-neutral/funding-rate strategies. These create custodian, exchange insolvency/freeze, operational, legal-segregation, withdrawal, and strategy-loss risks. The documentation is older than seven days and is therefore stale data. Custody/CEX/MM exposure — High. The July 8, 2025 collateral letter listed assets visible through Fireblocks, Binance, Ceffu, and other wallets, but explicitly stated that ownership, control, and liens were not tested.

Its reported collateral categories are not additive, so a reliable percentage exposure cannot be derived. This is a material counterparty-transparency gap. > Contradiction / evidence gap: Falcon describes segregated, fully collateralized reserves and MPC/multisig controls; the independent letter only confirmed sight of collateral and did not verify beneficial ownership, encumbrances, or legal segregation. The independent limitation prevails for risk assessment. Stablecoin, LST/restaking, and RWA exposure — High/Medium. Supported collateral includes USDT, USDC, DAI, USDS, USD1, FDUSD, BTC/WBTC, ETH and listed RWA tokens including XAUT, xStocks, and Superstate USTB.

Failure or depeg of a reserve stablecoin, tokenized-asset issuer, custodian, broker, or SPV could impair minting/redemptions. Falcon’s own RWA materials reference issuer due diligence and jurisdiction-specific SPVs, but issuer-level legal, liquidity, and bankruptcy-remoteness verification is unavailable. Oracles/manipulation — High uncertainty. The reviewed materials do not establish the production oracle set, fallback logic, TWAP/deviation limits, or liquidation-manipulation protections. Not verifiable as of September 5, 2026. Bridges/external DeFi. Ethereum core exposure is not shown as bridge-dependent; Falcon has separately described cross-chain USDf availability through Axelar. External integrations include Pendle, Morpho, Euler, Curve and Uniswap, creating additional liquidity, smart-contract, and composability risk where positions are deployed.

Current amounts are not verifiable. Failure scenarios: custodian/CEX freeze or insolvency; reserve stablecoin/RWA depeg; oracle failure or market manipulation; funding-rate strategy losses; bridge exploit; redemption queue/liquidity mismatch; or insurance-fund insufficiency. No current dependency failure can be confirmed: Not verifiable as of September 5, 2026. No Dune query/execution IDs are available; on-chain exposure percentages are therefore Not verifiable as of September 5, 2026. Structured fields: dependency_failure_active: null; max_exposure_pct: null

Evidence (5)

crypto custody

unverified

Falcon Finance describes custody as a hybrid institutional setup: user deposits are routed to third-party custodians rather than being held solely by the protocol, with named providers including Fireblocks, Ceffu, BitGo, and ChainUp. Its docs and disclosures say custody uses MPC and multi-signature controls, and that some reserves are held by regulated custodians while the remainder sits in multisig wallets to support onchain yield operations. Falcon also says it uses off-exchange settlement, meaning assets remain in custodian-controlled cold storage while trading and execution occur through mirrored positions on centralized exchanges.

Segregated custody is indicated in public materials that describe user collateral as stored in segregated cold-storage vaults, but a full independent verification of segregation terms is not available here. Withdrawal pause status is not verifiable as of 2026-09-05.

Segregated assets
Yes
Evidence (6)

incident

one source

Separate search results appear to describe a different entity named Falcon, an Indian invoice-discounting platform accused by police/ED of running a Ponzi scheme and causing losses around ₹1,700 crore / ~$196M. This is not verifiably the same protocol as Falcon Finance, so it should not be counted as an incident for the Ethereum DeFi protocol.

Date
2025-02-18
Cause
Other
Loss
$196.0M
Evidence (1)

incident

one source

Falcon Finance has one documented protocol incident in the provided results: a July 2025 USDf depeg to about $0.92 during redemption stress, with the depeg attributed to collateral imbalances, low-liquidity mint inputs, and a seven-day redemption lag that trapped holders during panic. The same source says the project later worked through recovery and that TVL rebounded above $2B, but this is an external commentary source, not on-chain verified here.

Date
2025-07-01
Cause
Depeg / collateral
Evidence (1)

incident

two sources

On July 8, 2025, Falcon Finance’s USDf temporarily depegged amid a sharp withdrawal of Uniswap liquidity, concerns about collateral quality/transparency, and limited redemption liquidity caused by a seven-day cooldown. Reported prices ranged from approximately $0.9783 to a brief DEX low of $0.8871; more than $2 million was reportedly withdrawn from the Uniswap USDT/USDf pool. Affected parties were USDf holders, liquidity providers, and users dependent on secondary-market liquidity.

This was a liquidity/depeg event, not a confirmed exploit. Falcon/DWF attributed the move to market sentiment and stated that reserves were overcollateralized; subsequent measures included reserve transparency reporting, external assurance, and continued peg/liquidity controls. The peg and protocol activity later recovered, so status is resolved, although the underlying reserve and off-chain-strategy risks remain.

Realised protocol or user loss: Not verifiable as of September 5, 2026. Attacker proceeds: Not verifiable as of September 5, 2026. Recovered amount and user reimbursement: Not verifiable as of September 5, 2026; no public evidence of a dedicated reimbursement program was located.

Date
2025-07-08
Cause
Liquidity issue
Status
resolved
Event id
falcon-usdf-depeg-2025-07-08
Evidence (4)

incident

two sources

On January 29, 2026, USDf experienced a separate brief, mild depeg, reaching approximately $0.9871 before rebounding toward the mid-$0.99 range. Public reporting did not establish a confirmed exploit, reserve impairment, or specific causal mechanism; classify the cause as an unconfirmed market/liquidity deviation. USDf holders and liquidity providers were potentially affected.

Later Falcon reporting described USDf as maintaining substantial overcollateralization and operating normally. Status: resolved. Realised protocol or user loss: Not verifiable as of September 5, 2026.

Attacker proceeds, recovered amount, and reimbursement: Not verifiable as of September 5, 2026.

Date
2026-01-29
Cause
Other
Status
resolved
Event id
falcon-usdf-depeg-2026-01-29
Evidence (3)

key management

unverified

Falcon Finance organizes key management around qualified third-party custodians plus multisig/MPC controls rather than a single protocol-held key. Its docs say user deposits are routed to custodians such as Ceffu (MirrorX) and Fireblocks (CVA), where withdrawals and vault actions require multiple approvals from separate authorized signers, and the protocol states there is no single individual or entity that can unilaterally move assets. Falcon’s own materials and whitepaper also describe MPC, multi-signature schemes, and hardware-managed keys as the main protections for user collateral, with assets held in off-exchange storage and only mirrored for certain strategies.

In practice, the custody model appears to be split across regulated providers including Fireblocks, Ceffu, BitGo, and ChainUp according to Falcon-related disclosures, while Falcon also says it uses off-exchange settlement and tier-1 on-chain liquidity venues for deployment. The key-management design is therefore best understood as a distributed custody architecture: cryptographic control is fragmented across custodians and signers, operational access is approval-gated, and online exposure is minimized through cold storage and HSM-style infrastructure. What is not verifiable as of 2026-09-03 from the available sources is the exact signer set, threshold policy, key-rotation process, and whether all claimed custodians are currently active for the Ethereum deployment; those specifics are not fully exposed in the sources provided.

Evidence (4)

smart-contract

two sources

Assessment date: September 5, 2026. Dune MCP was unavailable; therefore current proxy-admin events, role state, timelock delay, withdrawal/fee/strategy/oracle permissions, renunciation status, and latest block-level exitability are Not verifiable as of September 5, 2026. The latest independent live-state verification is stale: Ethereum block 25,229,766 on June 2, 2026. Ethereum architecture (last verified): ``text 4/6 Safe 0x1e482b...16bd7 ├─ owns ProxyAdmin 0x3ef112...6e14 → USDf proxy 0xFa2B...CeC2 → impl 0x3adf...b789 ├─ owns ProxyAdmin 0x16a260...9ace → sUSDf proxy 0xc8CF...a4B0 → impl 0x0d13...f34 ├─ DEFAULT_ADMIN on USDf, sUSDf, Minter, Distributor └─ oracle control separate: 4/9 Safe 0x21f73d...73ca single EOA 0x6cbf...5dd9 → Minter MINTER_ROLE → USDf mint single EOA 0x4873...6fdd → USDf BURNER_ROLE `` USDf and sUSDf are Transparent/EIP-1967 upgradeable proxies.

The ProxyAdmin owner is a 4-of-6 Safe; no timelock was observed in the June verification, so upgrades and privileged role changes were immediate. Oracle aggregator replacement was controlled by a separate 4-of-9 Safe, also without a timelock. The principal live-admin risks were: (1) Critical—Ethereum mint execution ultimately controlled by one EOA, with opaque off-chain authorization and no on-chain collateral verification; (2) High—one EOA could burn from arbitrary addresses; (3) Medium—Safe-controlled upgrades/role changes without delay; (4) Medium—oracle source swappability without timelock; and (5) Low/informational—no global USDf pause, only per-address freeze capability.

These findings were open/accepted at the stale verification point. Users can generally redeem USDf through the documented flow, subject to a stated seven-day cooldown, but whether exits remain executable under current admin actions is Not verifiable as of September 5, 2026. If the 4/6 Safe or mint key were compromised, worst case is malicious implementation upgrade, arbitrary role reassignment, unbounded USDf issuance, arbitrary-holder burns, oracle manipulation, or user exits being frozen/delayed.

Audit reports for USDf/sUSDf reported zero critical/high code findings, but they do not validate current privileged deployment state.

Upgradeable
Yes
Unresolved critical
1
Unresolved high
1
Evidence (4)

audit

two sources

Falcon Finance — Security Review. Pashov performed a time-boxed review of falcon-contracts-evm under the Basis Trading category.

Auditor
Pashov Audit Group
Report date
2025-02-17
Scope
falcon-contracts-evm repository; EVM/Basis Trading scope. Exact contracts and reviewed commit are specified in the published PDF.
Findings
0 High, 2 Medium, 10 Low, 0 Informational.
Fix status
A secondary risk assessment reports findings were acknowledged or fixed in GitHub commits. Exact per-finding remediation status is Not verifiable as of September 5, 2026.
Report url
https://github.com/pashov/audits/blob/master/team/pdf/Falcon-security-review_2025-02-17.pdf
Report id
doc:0ea71a34a5df3a66
Unresolved critical
0
Unresolved high
0
Evidence (2)

audit

one source

Falcon Finance FF — Smart Contract Security Assessment. Zellic reviewed Falcon Finance FF token contracts in repository falcon-token at commit a04fa81d.

Auditor
Zellic
Report date
2025-09-19
Scope
Falcon Finance FF token contracts; Solidity/EVM-compatible; repository falcon-token, commit a04fa81d; one-day review on September 18, 2025.
Findings
0 Critical, 0 High, 0 Medium, 0 Low, 0 Informational. Zellic reported no security vulnerabilities in scope.
Fix status
No remediation required. Front end, infrastructure, and key custody were excluded.
Report url
https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmRfqjzWAD6asMoqA8yG5%2Fuploads%2FEYu99VNf3cmaMs2u0yR2%2FFalcon%20Finance%20FF%20-%20Zellic%20Audit%20Report.pdf?alt=media&token=c02e405d-f5b8-4730-bb0e-7a4f87b54e99
Report id
doc:854310adea34d3e1
Unresolved critical
0
Unresolved high
0
Evidence (1)

audit

one source

Falcon Finance — Smart Contract Security Assessment. Zellic assessed USDf minting, staking, rewards, positions, bundling, and silo components in falcon-contracts-evm at commit d082d360. The report states the reviewed code was deployed on Ethereum Mainnet at assessment time.

Auditor
Zellic
Report date
2025-03-07
Scope
Ethereum-deployed EVM contracts: USDf minting, staking, rewards, positions, bundling, and silo components; repository commit d082d360.
Findings
0 Critical, 0 High, 1 Medium, 1 Low, 4 Informational. Medium: incorrect maturityFeeGrowthX128 may miscalculate rewards. Low: _cleanupMaturedBuckets may run out of gas.
Fix status
Medium fixed in commit 9c34a242. Low acknowledged without a code fix. Informational findings were a mixture of acknowledged and fixed items.
Report url
https://reports.zellic.io/publications/falcon-finance/
Report id
doc:b00922e79174c87b
Covers deployed code
Yes
Unresolved critical
0
Unresolved high
0
Evidence (1)

audit

one source

Falcon Finance / USDf — Live Infrastructure Audit (LIA-2026-001). This is an unsolicited review of live roles, signers, upgrades, oracles, and CCIP configuration across Ethereum, XDC, and an unverified BNB deployment; it is not a source-code audit.

Auditor
Stabilytics
Report date
2026-06-02
Scope
Live deployed configuration: 17 contracts across Ethereum, XDC Network, and BNB Smart Chain; privileged roles, signer structures, proxy administration, oracle ownership, and CCIP integration configuration. BNB was not verified.
Findings
1 Critical, 2 High, 2 Medium, 1 Low, 1 Informational. Critical: single-EOA Ethereum mint authority. High: single-EOA arbitrary burn authority and absent CCIP rate limits. Medium: no timelocks for upgrades/role changes and oracle changes. All listed findings were marked Open or Accepted in the report.
Fix status
Open/accepted at report issuance; remediation roadmap recommended key migration, CCIP rate limits, and timelocks. Subsequent remediation is Not verifiable as of September 5, 2026.
Report url
https://stabilytics.fi/reports/falcon-finance-usdf.html
Report id
doc:dd81c0292c5a66f2
Covers deployed code
No
Unresolved critical
1
Unresolved high
2
Evidence (1)

audit

unverified

Independent quarterly assurance report on USDf reserves (proof-of-reserves style engagement), not a smart-contract security audit.

Auditor
Harris and Trotter LLP
Report date
2025-12-17
Scope
As of 2025-10-31; reserve assets backing USDf issuance, controls around reserve wallets/custodians, transactional approvals, and reserve valuation
Evidence (2)

Team & Reputation

founders

two sources

Falcon Finance appears to be a founder-led, semi-public DeFi protocol with a real corporate wrapper, but most of the wider team remains opaque and offshore. Founders & key people

  • Multiple independent sources identify Andrei Grachev (founding partner/managing partner at DWF Labs) as the founder / managing partner of Falcon Finance.
  • A detailed research note highlights additional visible contributors: Fiona Claire Ma (Protocol Strategy Lead, ex‑Goldman Sachs, DWF Ventures) and Alessia Baumgar (VP Ecosystems at DWF Labs).
  • Falcon’s own transparency announcement lists Andrei Grachev, Dubai, UAE and gives him the title “Managing Partner, Falcon Finance,” with a direct contact email.
  • Bitget’s profile states that Falcon is “founded in early 2025 by Andrei Grachev” and backed by World Liberty Financial funding. Public vs anonymous; prior track record
  • Grachev and the named strategy/eco‑system leads are fully public personalities with long‑standing roles at DWF Labs, a known market‑maker/investor in Web3.
  • DWF Labs has been involved in many token markets; it has a mixed reputation in trading circles (aggressive market‑making, some controversies), but there is no direct evidence of protocol hacks or rug pulls associated with Falcon Finance itself in the retrieved data.
  • A Bitget research piece explicitly notes that Falcon “presents itself as a DeFi protocol collective rather than a personality‑driven startup” and that *core developers and governance contributors have not been formally disclosed*. This is a transparency gap on the engineering side. Corporate reality: office, jurisdiction, business substance
  • An independent assurance report states: USDf is issued by Falcon Digital Limited (trading as Falcon Finance), incorporated in the British Virgin Islands, with a registered address in Road Town, Tortola. This indicates an offshore issuing entity, not an onshore financial institution.
  • Falcon’s transparency-page article ties the project to Dubai, UAE via Grachev’s listed location, suggesting an operational presence there but not necessarily a regulated office.
  • Falcon collaborates with ht.digital, a London‑ and Cayman‑based assurance firm, for Proof‑of‑Reserves attestations and quarterly reports, which adds some institutional process but does not substitute formal prudential regulation. Team credibility & reality check (risk analyst view)
  • Positives: named founder with a significant Web3 track record; visible strategy/BD personnel; multiple independent audit and PoR relationships; formal corporate issuer in BVI.
  • Negatives/unknowns: core dev team and governance participants are not disclosed; no clear indication of regulated status in any major jurisdiction; offshore BVI structure and Dubai‑centric leadership are typical of crypto‑native businesses rather than traditional financial institutions.
  • Net view: real business with identifiable founder and legal entity, but still high reliance on offshore structures and an opaque technical/governance team. On‑chain verification of ownership, treasury and operational flows: Not verifiable as of 2026‑09‑03.
Evidence (14)

general reputation

two sources

Falcon Finance appears to have a mixed but still early-stage reputation: it is publicly associated with Andrei Grachev of DWF Labs, has disclosed outside backing from World Liberty Financial and other investors, and says it publishes third-party reserve audits and transparency reports. Public-facing materials also describe audits by firms such as Zellic, Pashov Audit Group, Harris & Trotter LLP, and ht.digital, which supports a transparency-focused posture rather than an obviously closed or anonymous project. The main reputational strengths are its visible founder identity, named institutional-style backers, and repeated references to audits/Proof of Reserves.

Falcon also states that USDf is issued by Falcon Digital Limited, a BVI company, which gives at least some legal entity clarity. I did not find strong evidence in the gathered material of confirmed fraud, rug-pull, insolvency, sanctions, or regulator action. However, several claims about backing, reserves, and regulatory readiness are sourced from the protocol itself or secondary media republishing those claims, so they should be treated as *unverified marketing claims* unless independently corroborated.

Unresolved concerns remain: the protocol’s own materials emphasize synthetic-dollar issuance, reserve attestation, and cross-chain expansion, which are exactly the areas where hidden leverage, reserve quality, and redemption mechanics matter most; without on-chain verification here, the robustness of those claims is not verifiable as of 2026-09-03. I also did not find independent reporting, in the collected sources, of a major scandal or enforcement action, so the current sentiment is better described as cautiously neutral-to-positive with diligence gaps rather than clearly adverse.

Evidence (10)

Economy

TVL: $1.2B

model

one source

As of September 5, 2026. Dune MCP was unavailable; therefore on-chain verification, query IDs, execution IDs, block height, product-level balances, and APY time series are unavailable. Not verifiable as of September 5, 2026. Economic model. Users deposit stablecoins (USDC, USDT, FDUSD) or volatile collateral (BTC, ETH, stETH, SOL and selected altcoins) to mint USDf. Stablecoins are described as 1:1 collateral; non-stablecoins require dynamic overcollateralization. USDf can be staked into ERC-4626 sUSDf vaults, then optionally restaked into fixed-term Boosted Yield NFT positions. Yield source / risk posture. Falcon describes funding-rate and basis arbitrage, cross-exchange/statistical arbitrage, liquidity-pool and options strategies, negative-funding trades, and native/altcoin staking.

The intended posture is delta-/market-neutral, but it is not risk-free or asset-neutral: it involves volatile collateral, derivatives, exchange/custodian counterparty exposure, execution risk and potential basis/funding reversals. These strategy descriptions are unverified marketing claims; Dune validation was unavailable. Organic vs subsidized. DeFiLlama reports zero incentives and zero protocol revenue, while displaying fees generated by staking/NFT products. This suggests reported yield is not FF-token-emission subsidized, but the organic-yield percentage is not calculable from available evidence. Not verifiable as of September 5, 2026. Leverage / looping / external exposure. No user looping mechanism was identified.

Internal “restaking” is a fixed-term sUSDf lock, not external EigenLayer-style restaking. Strategy-level derivatives may create gross exposure, but leverage ratio is not verifiable. External exchange, derivatives, options and custody exposure are material model risks. Withdrawals, gates and fees. Mint/redeem requires KYC; redemption has a 7-day cooldown. sUSDf unstaking is described as immediate, while Boosted Yield positions are locked—commonly 3 or 6 months—until NFT maturity.

Staking Vaults may use 180-day locks plus a 3-day unwind cooldown. Users bear gas and execution costs; a separate protocol fee schedule was not found. TVL / revenue / APY snapshot. DeFiLlama reports Ethereum-only TVL of $1.176B, down 6.2% over 30 days; tracked average supply APY is 2.46%–2.47%, and the sUSDf pool is shown at 4.84% APY. Fees are $245,216 over 30 days, cumulative $5.51M, with $0 protocol revenue.

Product-level TVL, Dune-vs-Llama variance, APY history, volatility and sustainability are not verifiable as of September 5, 2026. Contradiction / key finding: Falcon markets sustainable market-neutral yield, but available data show zero protocol revenue and no independently verified strategy P&L; reported fees represent distributed product yield, not retained protocol earnings.

Evidence (5)

reserves

one source

Status — as of September 5, 2026: Dune/on-chain verification was unavailable in this run. Therefore: Not verifiable as of September 5, 2026 for current Ethereum reserve balances, wallet addresses, custody splits, or independently calculated liquid reserves. Web evidence and composition

  • Falcon’s dashboard reported $708M+ reserves and $660M USDf supply in July 2025, including approximately $431M BTC, $96M stablecoins, and $190M altcoins/non-crypto assets, with smaller ETH, SOL and tokenized-T-bill positions. Custody was described as Ceffu, Fireblocks and on-chain holdings. This is an unverified marketing claim.
  • A Harris & Trotter independent assurance report dated July 28, 2025 stated $1.1976B reserves against 1.07185B USDf, composed of $282.9M stablecoins, $671.0M BTC/WBTC/ETH, and $243.7M other assets. The report states reserves were held in segregated accounts and that ownership/control of custodial and non-custodial addresses was tested for that specific date.
  • A later HT Digital letter dated September 8, 2025 listed approximately $1.644B collateral against $1.5489B USDf, including BTC, M-BTC, ETH, stablecoins, DOGE, Fireblocks, Ceffu, Binance and Near. It expressly states that HT Digital did not test encumbrances and relied partly on management representations.
  • Falcon later claimed $1.68B reserves in September 2025 and $1.59B reserves as of June 1, 2026; both are protocol-published figures, not Dune-verified. Custody/control/policy: Public materials describe MPC custody through Fireblocks and Ceffu, limited exchange allocation, and on-chain liquidity/staking deployment. The reserve policy is overcollateralization with segregated accounts; USDf eligible collateral is determined by Falcon. Contradiction / limitation: Reported reserves range from $708M to $1.68B across different dates and methodologies. The dashboard is currently only a shell in accessible web retrieval, so the latest figure and address-level evidence cannot be independently reconciled. Attestations: HT Digital daily/weekly reserve checks and quarterly reporting are advertised; Harris & Trotter issued a point-in-time reasonable-assurance report, not continuous assurance. liquid_reserves_usd: null liabilities_usd: null
Evidence (4)

tokenomics

unverified

Falcon Finance does have a native token: FF on Ethereum, with contract 0xfa1c09fc8b491b6a4d3ff53a10cad29381b3f949 (as surfaced by market data and third-party token pages). Reported total/max supply is 10.0B FF and reported circulating supply is ~3.13–3.14B FF, implying an FDV around $1.0B and market cap around $320M at current market prices; these figures vary slightly across aggregators and are therefore market-data, not on-chain, verified facts. Falcon’s own tokenomics page states FF is the governance token and that supply is fixed at 10B; docs also indicate sFF is the staked version of FF, used for governance participation, with voting through the governance forum.

I did not find verifiable evidence in the gathered sources for revenue share, buybacks, burns, or protocol fee-switch mechanics; treat those as Not verifiable as of 2026-09-03. The available tokenomics breakdown from Falcon’s announcement gives allocations of 35% ecosystem, 24% foundation, 20% core team & early contributors, with the remaining portion not fully shown in the snippet; third-party token pages also surface allocations for investors, treasury, team, and ecosystem, but these are aggregator interpretations rather than raw-chain proofs. Because Dune/on-chain verification is unavailable in this run, unlock completion, actual on-chain vesting releases, holder concentration, insider wallets, and controller privileges (mint/blacklist/admin/fee-switch) are Not verifiable as of 2026-09-03.

For liquidity, the gathered sources confirm FF is listed on major market-data venues and tracked on Ethereum, but DEX liquidity depth and main listings are Not verifiable as of 2026-09-03 from the material retrieved here.

Evidence (7)

Stress scenarios

stress scenario - bitcoin price falls below $10000

unverified

Falcon Finance publicly states that in extreme market stress it keeps near-zero net delta across spot and perpetual strategies, maintains an at least 20% liquidity buffer of spot holdings on exchanges for immediate sale, and can remove staking / unwind positions quickly to reduce exposure. For a Bitcoin move below $10,000, the likely implication is that Falcon would prioritize rapid de-risking: closing or resizing BTC perpetuals first, selling exchange-held spot, and pulling any staked BTC back into liquid inventory as soon as possible. Falcon’s own materials also indicate that its framework is designed for overcollateralized buffers and price-sensitive redemption logic, which suggests stress handling depends on preserving collateral coverage rather than assuming a fixed BTC floor.

However, the exact loss rate, liquidation threshold, and P&L impact for this specific scenario are Not verifiable as of 2026-09-03 because no on-chain Ethereum position, collateral, or exposure data was available in this run. In practical risk terms, a sub-$10,000 BTC regime would be a high-severity stress test for any BTC-backed yield product, but Falcon’s stated controls imply the protocol is designed to reduce directional exposure and keep a meaningful share of assets immediately liquid. The main unresolved question is how much BTC exposure remains live on Ethereum at the time of stress; that is Not verifiable as of 2026-09-03.

Evidence (4)

stress scenario - largest collateral depegs 20%,

one source

For a 20% depeg of the largest collateral, the immediate impact on Falcon Finance’s solvency cannot be calculated from the provided sources because the current Ethereum collateral mix, largest-collateral share, and on-chain reserve composition are Not verifiable as of 2026-09-03. The protocol itself says USDf is backed by eligible liquid assets and uses overcollateralization plus an insurance fund, but that is an unverified protocol claim unless independently reconciled against on-chain data. What can be stated from the sources is that Falcon has previously described collateral as being concentrated in stablecoins and BTC, with only a minority in altcoins, and that it markets an overcollateralized structure with an insurance backstop.

A reported external assessment also flagged that collateral quality and transparency are key risks, and that past depeg events were linked to liquidity stress and confidence loss rather than a single disclosed on-chain reserve snapshot. Under a stress scenario, a 20% drop in the largest collateral would create loss equal to 20% of that asset’s collateral value; whether that is absorbed by excess collateral, hedging gains, or the insurance fund depends on the unverified reserve composition and hedge effectiveness. If the largest collateral is a large share of backing, the peg risk becomes material; if it is a small share, the impact is likely contained.

Because those shares are not independently verifiable here, the precise gap-to-insolvency outcome is Not verifiable as of 2026-09-03. The most defensible risk conclusion is qualitative: Falcon’s model appears exposed to collateral-quality risk, liquidity risk, and confidence-driven depegs, and a 20% drop in the dominant collateral would likely pressure redemption capacity and secondary-market pricing before any formal insolvency can be assessed.

Evidence (8)

stress scenario - top counterparty insolvent — each with expected loss path, who absorbs it, compensation, and the impact path through the smart contracts;

unverified

Stress scenario — largest counterparty becomes insolvent (Ethereum) Counterparty identification: Not verifiable as of September 5, 2026. Falcon publicly names BitGo, Fireblocks, Ceffu, and ChainUp as custody partners, and describes centralized exchanges and market-neutral trading venues, but the reviewed sources do not provide a current, independently verified exposure ranking. The available disclosures are stale (>7 days).

Expected loss path 1. Custodian/CEX default: Falcon may lose access to assets, collateral claims, or trading proceeds. The immediate loss is the unrecovered portion after bankruptcy recovery, liquidation value, and hedge close-out. Off-chain insolvency is not automatically detected by Ethereum contracts; it first appears as a reserve shortfall, delayed redemption, or inability to deliver the requested collateral.

2. Strategy/hedging venue default: A failed hedge, frozen account, or counterparty receivable can create a delta or cash shortfall. Remaining collateral and the protocol’s overcollateralization buffer absorb losses first. Falcon’s stated strategy is to maintain market-neutral exposure, but this does not eliminate counterparty credit risk.

Who absorbs it / compensation waterfall

  • First: excess collateral/OCR buffer and realized liquidation proceeds.
  • Second: Falcon’s on-chain Insurance Fund, funded from protocol allocations; it may purchase USDf or be supplemented by Falcon during exceptional stress. This is discretionary, not an automatic contractual payout.
  • Residual loss: USDf and sUSDf holders through delayed, pro-rata, reduced, or suspended redemptions and potentially lower sUSDf yield. Falcon’s terms provide no government-sponsored insurance and disclaim broad liability; compensation is therefore not guaranteed. Smart-contract impact path Admin/multisig operators would need to pause or restrict redemptions, alter available collateral, liquidate positions, or deploy the Insurance Fund. USDf redemption normally targets stablecoins or original collateral with a seven-day cooldown; Innovative Mint collateral may be liquidated, leaving users with USDf. The contracts cannot recover an insolvent off-chain counterparty automatically. Bottom line: the principal tail risk is an off-chain reserve deficit transmitted on-chain as redemption impairment; insurance is a discretionary buffer, not proof of full recovery.
Evidence (5)

stress scenario - committed fraud by the DAO or owners

two sources

For Falcon Finance on Ethereum, a stress scenario involving fraud by the DAO or owners is not verifiable as of 2026-09-03 from the available evidence. I did not find a credible regulatory action, court case, governance record, or independent investigation alleging that Falcon Finance’s DAO or owners committed fraud. Falcon’s own materials emphasize security, transparency, contract verification, and audited contracts, but those are unverified marketing claims unless independently corroborated.

What is verifiable is that Falcon Finance is being discussed in the context of general DeFi and DAO fraud risk, including phishing/scam pages impersonating the protocol and generic governance-attack patterns seen across DAOs. Those sources do not show that Falcon Finance itself has committed fraud; they only show the *type* of abuse that could occur in a stress scenario. So the appropriate risk assessment is:

  • Fraud by DAO/owners: Not verifiable as of 2026-09-03.
  • Related operational risk: impersonation, governance abuse, or custodial misuse are plausible stress scenarios in DeFi generally, but no source provided confirms they occurred at Falcon Finance. If you need, I can next assess Falcon Finance’s fraud risk by reviewing governance control structure, admin-key exposure, audit scope, and any off-platform allegations.
Evidence (8)

stress scenario - primary yield source negative 30d,

one source

Falcon Finance’s published materials indicate that its yield engine depends on market-neutral strategies such as funding-rate arbitrage, cross-exchange arbitrage, staking, and options-based trading, so a negative 30-day primary yield source would mainly pressure the yield token’s return stream rather than the base synthetic dollar itself. In that stress case, the most important immediate effect is lower or potentially negative sUSDf performance if the dominant strategy set loses money or funding conditions turn adverse; Falcon’s own materials explicitly acknowledge that strategy disruption can cause returns to drop to zero or become temporarily negative. Falcon also says it maintains an on-chain insurance fund intended to help protect users during stress, which would be a partial mitigant rather than a guarantee against losses.

Because Dune/on-chain verification is unavailable in this run, the exact 30-day contribution of each yield source, the chain-level exposure on Ethereum, and whether the primary source is currently negative are Not verifiable as of 2026-09-03. Falcon’s marketing also claims diversified APY bands and resilience in softer markets, but those are unverified marketing claims unless corroborated by independent on-chain data or third-party records.

Evidence (5)

Governance & Legal

governance

two sources

Governance assessment — Ethereum (review date: September 13, 2026). Effective control remains primarily with Falcon/Falcon Digital Limited, not a contract-governing DAO. Falcon documentation says governance rights are still “Coming Soon”; FIP-1 was nevertheless approved via Snapshot and introduced 10× voting weight for sFF-Prime, creating concentration/weighting risk. Contract/funds control. The latest independent infrastructure review (verified June 2, 2026) reports one Ethereum 4-of-6 Safe controlling DEFAULT_ADMIN for USDf, sUSDf, the pre-collateralized minter and rewards distributor; it also controls USDf/sUSDf upgrades and CCIP pools. A separate 4-of-9 Safe controls oracle ownership.

No timelock was observed, so upgrades, role changes and oracle changes execute immediately. Ethereum also has a single-EOA MINTER_ROLE executor and single-EOA arbitrary burn authority; the admin Safe can re-grant roles. This means admin-controlled user-fund risk is material. Proposal process / DAO reality. Snapshot is the visible proposal venue, but the documentation simultaneously states governance is not yet released. Contradiction: Falcon markets FIP-1 as active governance, while its governance documentation says governance rights are still forthcoming.

Token-holder voting has not been shown to control contract upgrades or core parameters; DAO governance is therefore assessed as false/symbolic. Voting concentration / holders. Dune MCP was unavailable in this run. Top-holder concentration, voting power, and holder independence: Not verifiable as of September 13, 2026. Company control. Terms identify Falcon Digital Limited as the contracting entity and apply British Virgin Islands law/time conventions. Public company-search data lists BVI registration number 2160020 and incorporation date October 14, 2024; directors were not publicly displayed without purchasing a registry report: Not verifiable as of September 13, 2026.

Terms reserve unilateral discretion to amend terms, suspend services and impose fees. Contradiction / independence caveat: Falcon announced an FF Foundation with an independent director and token-control mandate, but this is a protocol statement and does not establish independent control of contracts or funds.

Timelock
No
Timelock delay hours
0
Multisig threshold
4
Multisig owners
6
Admin can drain
Yes
Emergency bypass
Yes
Dao governance
No
Evidence (6)

legal & regulatory

two sources

Entity / jurisdiction. Falcon Finance’s contracting and issuing entity is Falcon Digital Limited, incorporated in the British Virgin Islands (BVI); the published registered address is Asia Leading Chambers, Road Town, Tortola. The BVI company record identifies registration no. 2160020 and incorporation on October 14, 2024.

Terms, restrictions and compliance. The Terms select BVI law/courts and state that Falcon Digital Limited is not currently licensed by any regulatory authority. USDf/sUSDf are described as non-legal-tender, non-government-backed assets, with no deposit or government insurance. Users must be at least 18, pass KYC/KYB and AML checks, and provide identity, beneficial-owner, financial and transaction information.

U.S. persons and residents of listed restricted or sanctioned jurisdictions—including the United States, China, Russia, Iran, North Korea, Cuba and others—are excluded; accounts may be suspended or terminated. Classification / actual regulatory risk. Falcon characterizes USDf as a crypto-collateralized synthetic dollar, not legal tender. A Falcon-funded external assessment reports a BVI-law memorandum concluding that USDf is not an “investment” under SIBA and that issuance alone may not constitute a VASP activity; this is an issuer-sponsored legal position, not a regulator determination.

The same assessment notes no EU MiCA opinion and no confirmed license. Operational features—minting, redemption, staking, custody arrangements and yield strategies—could nevertheless create securities, payments, custody, derivatives or virtual-asset-service exposure depending on jurisdiction and actual conduct. Warnings, enforcement, litigation and sanctions. No public regulator action against Falcon Digital Limited was identified in the reviewed sources.

The Alberta warning for “Coin Falcon Digital Limited” concerns different websites/entities and should not be attributed to Falcon Finance. Court-case status: Not verifiable as of September 4, 2026. Sanctions-list status: no public designation identified; definitive status is Not verifiable as of September 4, 2026. Data protection. The Privacy Policy invokes GDPR concepts, permits KYC/AML, blockchain, IP and financial-data collection, third-party screening/analytics, law-enforcement disclosure and retention for legal obligations. Blockchain data cannot be deleted. Risk conclusion: legal-form separation and BVI governing law reduce clarity of user remedies; the central risk is an openly unlicensed issuer operating across jurisdictions with potentially broader regulated activities than its stated “issuer-only” classification.

Note: fUSD is a separate product issued by Anchorage Digital Bank, not Falcon Digital Limited.

Active enforcement
No
Sanctioned
No
Entity
Falcon Digital Limited
Jurisdiction
British Virgin Islands
Evidence (5)

legal registries

two sources

Legal entity per GLEIF: Falcon Finance Limited (LEI 549300E8QGMCDILFUF29; jurisdiction KY; registration ACTIVE). OFAC SDN screening of 'Falcon Digital Limited', 'Falcon Finance': no match. SEC litigation and administrative release feeds: no mention.

Screened names
  • Falcon Digital Limited
  • Falcon Finance
Entity
Falcon Finance Limited
LEI
549300E8QGMCDILFUF29
Jurisdiction
KY
Entity status
ACTIVE
Sanctioned
No
Evidence (4)

Stability

stability

two sources

Falcon Finance issues its own stablecoin, USDf. A depeg did happen: the gathered web evidence shows one clear incident in July 2025, when USDf fell to about $0.9783, and a smaller dip in January 2026 to about $0.9871. That makes the observed depeg count 2, with the last observed depeg in January 2026 and the maximum observed depeg about 2.17% below peg; however, exact on-chain verification is not available in this run, so these values are web-verified rather than on-chain verified.

Own stablecoin
Yes
Stable
No
Depeg count
2
Max depeg pct
2.17%
Last depeg date
2026-01-28
Stablecoin ids
  • USDf
Evidence (5)

Risks & Strengths

risks

two sources

Falcon Finance’s main risks are concentrated in stablecoin solvency, off-chain trading and custody dependencies, privileged administration, smart-contract execution, and regulatory status. The protocol reports audits, MPC custody, collateral screening, and reserve attestations, but these controls do not eliminate tail-risk or independently verify current Ethereum exposure. On-chain TVL, reserve composition, holder concentration, and current admin balances: Not verifiable as of September 5, 2026, because Dune access was unavailable.

RiskImpactSeverityProbabilityMitigation in placeResidual risk
Collateral depeg and liquidityUSDf may trade below target or become difficult to redeem if collateral prices gap, liquidity disappears, accepted assets correlate during stress, or liquidation capacity is insufficient. The protocol itself discloses depeg and market-stress risk.HighMediumProtocol-documented collateral eligibility screens, dynamic overcollateralization, liquidation controls, and reserve reporting. These are partly unverified marketing claims without current on-chain reconciliation.High-tail-loss exposure remains, especially for volatile or long-tail collateral.
Strategy and counterparty lossesYield depends on funding trades, cross-exchange arbitrage, staking, options, and liquidity positions. Exchange, custodian, execution, oracle, basis, funding, withdrawal-freeze, and operational failures can create losses despite intended hedging.HighMediumProtocol reports off-exchange settlement, Fireblocks/Ceffu MPC custody, automated monitoring, and manual trading-desk oversight.Material residual risk from off-chain venues, model failure, and imperfect hedges.
Smart-contract vulnerabilityA bug in USDf, sUSDf, vault, oracle, or upgrade-related logic could permit theft, incorrect accounting, frozen withdrawals, or loss of peg. Audits reduce but do not remove undiscovered vulnerability risk.HighLowZellic and Pashov reviews; Pashov reported no high-severity findings but identified two medium and ten low findings.Non-zero risk from fixes, deployments, integrations, and code outside audit scope.
Privileged control concentrationOwners, admins, minters, pausers, upgraders, recovery authorities, or governance executors may be compromised or act improperly, creating censorship, dilution, fund seizure, or parameter risk.HighMediumReported multisignature/MPC controls and a 2026 live role inventory. Signer-level analysis and third-party integration verification were explicitly out of scope.Potential single-point or colluding-signer failure remains unverified.
Regulatory and legal statusFalcon’s own disclosure says it is not currently licensed by a regulatory authority. Enforcement, stablecoin rules, sanctions exposure, or service restrictions could impair minting, redemption, custody, or access.HighMediumKYC/AML-related account controls and stated engagement with regulators; no verified license or safe-harbor evidence was found.High jurisdictional and enforcement uncertainty.
Evidence (5)

strengths

two sources

Falcon Finance’s top strengths are: (1) broad collateral flexibility, because it is designed as a universal collateral engine that can mint USDf against a wide range of assets, including crypto and tokenized RWAs; (2) diversified yield generation, using basis spreads, funding-rate arbitrage, cross-exchange arbitrage, and other institutional-style strategies rather than relying on a single carry trade; (3) overcollateralization and risk controls, which are positioned to protect peg stability and absorb market volatility; (4) transparency and reserve governance, including weekly reserve updates, dashboards, and independent audits; and (5) multi-chain / ecosystem scalability, with integration claims across several major ecosystems and a design aimed at scaling without requiring Falcon to launch its own chain.

Evidence (7)

Methodology & Limitations

  • On-chain metrics: not verifiable — Dune phase 2 is not enabled.
  • 0 of 25 fact categories not yet collected.
  • Fact verifiability: 17 two independent sources, 11 one source, 9 unverified.
  • Oldest fact verification date: 2026-08-29.