Sky stUSDS

## Protocol identification

• Name: Sky stUSDS (Staked USDS); a yield-bearing ERC-4626 vault / “Expert” risk-capital token. Deposits fund SKY-collateralized borrowing and accrue a variable stUSDS rate.
• Website / docs: sky.money/stusds; Sky developer documentation.
• Category: DeFi lending / yield vault / tokenized risk capital.
• Launch: Ethereum deployment on August 25, 2025 (block 23,219,535), according to an independent Yearn Curation report.
• Chains: Ethereum only for the identified canonical stUSDS vault.
• Native/governance token: SKY; stUSDS itself is the vault receipt token, not the protocol governance token. ### Main addresses and verification | Component | Ethereum address | Cross-check / explorer status | |---|---|---| | stUSDS proxy/vault | 0x99CD4Ec3f88A45940936F469E4bB72A2A701EEB9 | Confirmed by Sky docs, Yearn Curation, Aavescan, and Etherscan; source verified on Etherscan. | | stUSDS implementation | 0x7A61B7adCFD493f7CF0F86dFCECB94b72c227F22 | Reported by Yearn Curation; Etherscan verification reported. | | StUsdsRateSetter | 0x30784615252B13E1DbE2bDf598627eaC297Bf4C5 | Independent report cross-check; explorer verification status: Not verifiable as of October 25, 2026. | | StUsdsMom | 0x99159d0b885CC6633daC7CD4d82e4247A834b89A | Independent report cross-check; explorer verification status: Not verifiable as of October 25, 2026. | Dune requirement: Dune MCP was unavailable; therefore no address has a Dune cross-check, and on-chain verification is Not verifiable as of October 25, 2026. ## Fork lineage Yes—derivative lineage, not a simple copy. The repository states that its original code came from hexonaut’s SavingsDai and MakerDAO’s Pot code. stUSDS materially changes the design into a USDS/SKY risk-capital module: segregated capital, SKY-backed borrowing, dynamic debt-ceiling logic, a dedicated rate setter, referral-enabled deposits, and UUPS upgradeability. The stUSDS code was reviewed by Cantina (August 18, 2025) and ChainSecurity (August 12, 2025; April 10, 2026); the Sky repository also contains Certora material. Malicious-modification history in similar forks: Not verifiable as of October 25, 2026.

stUSDS is not a mere landing page: the current portal at sky.money/stusds presents an active product page, and Sky’s app routes users to stUSDS functionality in-app on sky.money/app. The docs show a live ERC-4626 vault design with deposit and withdraw functions, which strongly indicates real product mechanics rather than a template-only marketing site. The protocol also has dedicated developer documentation and GitHub code for stUSDS, including deployment and interface details.

I do not see evidence in the gathered sources of broken links, fake TVL metrics, or template-site signs. However, those claims are not verifiable as of 2026-10-25 because no direct live site crawl or on-chain check was available in this run. Open API: partially verifiable.

The docs and repository expose contract-level interfaces, and a third-party rates page explicitly notes an API for hourly data on stUSDS, but a public, officially documented general-purpose API endpoint is not clearly confirmed in the gathered material. Bottom line: stUSDS appears to be a real, functioning product with documented deposit/withdraw mechanics and an active app flow, but the existence of a broadly supported open API remains Not verifiable as of 2026-10-25.

Sky/stUSDS has an active bug bounty program on Immunefi. The program page shows a maximum bounty of USD 10,000,000, requires PoC submissions, is triaged by Immunefi, and pays 10% of the funds directly affected for critical smart-contract bugs, subject to the USD 10,000,000 cap and a minimum reward of USD 150,000. The program page indicates the program date as 10 February 2022; Sky’s own announcement says the bug bounty program started on 27 January 2022.

Publicly visible materials do not provide a reliable published results summary for the stUSDS-specific program; notable payout/result details are not verifiable as of 2026-10-25.

Scope: stUSDS is an Ethereum ERC-4626 vault whose underlying asset is USDS. No Dune/on-chain verification was available in this run; numeric exposure percentages are therefore not established. Critical dependencies and failure modes

• USDS / Sky core: stUSDS depends on USDS, Sky accounting, governance, and rate-setting contracts. A USDS depeg, smart-contract failure, governance action, or inability to redeem USDS would impair stUSDS. USDS itself has material dependence on USDC and other collateral, including RWA structures and external managers/custodians.
• SKY-backed Lockstake lending: stUSDS funds borrowing against staked SKY and absorbs bad debt or liquidation shortfalls. A rapid SKY drawdown, oracle overvaluation, delayed liquidation, or auction failure can reduce the vault’s redeemable assets. The stUSDS code documentation explicitly identifies oracle manipulation, governance slashing, and non-withdrawable borrowed liquidity as risks.
• Oracle risk: SKY collateral pricing uses a capped/time-delayed oracle with manual override characteristics. Manipulated, stale, or unavailable prices could permit under-collateralized borrowing or delay liquidation.
• Liquidity and counterparty concentration: withdrawals depend on unutilized liquidity; high utilization can create a temporary redemption gate. Independent Aave risk analysis also identified concentration of loans with a single entity and manual liquidation dependence.
• Morpho: optional composability creates secondary contagion/liquidation risk for users using stUSDS as collateral, but Morpho is not required for the core vault.
• Bridges: official deployment information identifies Ethereum as the stUSDS deployment. No bridge dependency for the core vault was verified. Cross-chain Sky/USDS infrastructure may create indirect ecosystem risk, but stUSDS-specific exposure is Not verifiable as of October 25, 2026.
• Custodians, RWA issuers/SPVs, CEXs and market makers: these are indirect through USDS collateral, not direct stUSDS counterparties. Specific issuer, custodian, CEX/MM and allocation exposure is Not verifiable as of October 25, 2026. Contradiction / qualification: Sky markets stUSDS as structurally isolated, but independent risk analysis finds that depositors directly bear SKY-backed lending, oracle and liquidation risk; “isolated” does not mean principal-protected. Failure scenarios: SKY crash → bad debt/slashing; USDS or USDC depeg → NAV impairment; oracle/auction failure → unrecognized losses; governance compromise → adverse parameter or upgrade changes; utilization spike → redemption delays. Data gap: Maximum dependency exposure is Not verifiable as of October 25, 2026.

Not verifiable as of 2026-10-25. The available results only explain general crypto custody models (third-party custodians, qualified custodians, multisig, segregation of client assets) and do not identify how the specific protocol "sky-stusds" organizes custody. Because no protocol-specific source confirms the custody setup, I cannot determine whether assets are held by the protocol itself, a third-party custodian, or a segregated structure.

Withdrawal pause status is also not verifiable from the provided results.

Key-management organization for Sky stUSDS (Ethereum)

• Ultimate authority: Sky governance. stUSDS is not controlled by the Sky.money frontend. Privileged authority is exercised through Sky’s on-chain governance system: SKY holders approve an executive spell, which is scheduled through the Governance Security Module (GSM) and executed by the Pause Proxy after the governance delay. The Pause Proxy can configure privileged contracts and upgrade the stUSDS implementation.
• Operational parameter key. Rate, supply-cap, and maximum-debt-ceiling updates are delegated to the StUsdsRateSetter. Governance appoints one or more authorized operators (“buds”) that can call the setter, but the contract applies governance-configured bounds and security restrictions. The repository explicitly states that operators can potentially set rates so that funds become fully borrowed; therefore, operator-key compromise or misuse is a material depositor risk.
• Keeper/multisig arrangement. Available secondary documentation identifies the operational RateSetter authority as a 2-of-3 Safe. This provides signer redundancy, but it is not the ultimate governance authority and reportedly cannot upgrade contracts or change its own permissions; those powers remain with governance and the GSM. The October 8, 2026 executive proposal also refers to launching an stUSDS Keeper and updating RateSetter parameters.
• Emergency controls. A dedicated StUsdsMom emergency module can halt the RateSetter or disable parameter operation. Its ownership is attributed to the Pause Proxy, while its authority is tied to the governance Chief, preserving governance control over emergency intervention.
• Upgrade risk. stUSDS uses a UUPS/EIP-1967 upgradeable proxy. The project documentation warns that governance can upgrade the contract, so users must trust Sky governance, not merely the operational Safe. Assessment: key management is layered—governance-controlled upgrade/emergency authority, a bounded operator Safe for routine rate and risk-parameter updates, and a separate emergency stop path. Exact current Safe signer identities and live key rotation status: Not verifiable as of October 25, 2026.

Scope: Ethereum stUSDS deployment. Dune MCP was unavailable; therefore on-chain event/state checks are omitted. Addresses / architecture

• stUSDS proxy: 0x99CD4Ec3f88A45940936F469E4bB72A2A701EEB9 (ERC-4626, UUPS/ERC-1967).
• Reported implementation: 0x7A61B7adCFD493f7CF0F86dFCECB94b72c227F22.
• RateSetter: 0x30784615252B13E1DbE2bDf598627eaC297Bf4C5.
• Emergency Mom: 0x99159d0b885CC6633daC7CD4d82e4247A834b89A.
• Governance path: Chief 0x929d…a6f9 → Pause 0xbE28…38f3 → PauseProxy 0xBE8E…98FB → stUSDS / RateSetter / Mom.
• Reported RateSetter operator: 2-of-3 Safe 0xBB865F94B8A92E57f79fCc89Dfd4dcf0D3fDEA16. ``text SKY voters/Chief │ executive spell / GSM ▼ MCD Pause ──► PauseProxy ──► UUPS upgrade + privileged stUSDS calls │ Users USDS ─► stUSDS ERC-4626 ─► LSEV2 / LockStake borrowers ▲ │ └─ withdraw/redeem (only idle liquidity) RateSetter Safe ─► rate / line / cap settings Mom ─► halt RateSetter, zero cap/line `` Admin and user-fund risk
• Upgradeable: yes. Governance can replace implementation; the codebase explicitly states suppliers trust Sky governance.
• Privileged functions include implementation upgrade, file() parameter changes, cut() (slashing/accounting adjustment), cap/line controls, RateSetter configuration, and emergency halts.
• Users can call withdraw()/redeem() without administrator approval, but exits are liquidity-constrained; withdrawals may be unavailable while funds are borrowed or auctions are active.
• Compromised governance could upgrade the proxy to freeze, confiscate, or redirect assets. Compromised RateSetter operators could set parameters that drive utilization toward full borrowing, but are not reported as having an arbitrary token-transfer function.
• admin_can_drain: false under the stated definition (no verified single-key/unilateral arbitrary transfer role); governance-upgrade risk remains severe.
• Timelock: a 48-hour GSM delay is reported, but Not verifiable as of October 25, 2026 from Dune. Proxy-admin type via decoded Dune events: Not verifiable as of October 25, 2026. Audit status: ChainSecurity and Cantina reviews are publicly listed; audit findings/remediation for this exact deployment were not independently verified. Formal verification artifacts are also reported. No unresolved Critical/High count could be verified. Bottom line: upgrade, slashing, liquidity-lock, oracle/borrow-utilization, and governance-compromise risks are material; this is not an admin-free vault.

Cantina — stUSDS Mom audit.

ChainSecurity — initial stUSDS audit.

Cantina — Sky stUSDS review.

ChainSecurity — second Sky stUSDS audit.

Sky/stUSDS is not an anonymous project at the top level: public materials consistently identify Rune Christensen as Sky’s co-founder/founder, and multiple recent articles quote him discussing stUSDS as part of Sky’s expansion beyond its MakerDAO origins. The most credible public-team signal is that Sky’s current leadership is traceable rather than pseudonymous, with independently cited names including Rune Christensen and legal/operations personnel referenced by third-party summaries; however, the full team roster and governance structure are not fully verifiable from the available sources alone. For prior projects, the clearest verifiable outcome is Christensen’s role in founding MakerDAO, the precursor to Sky; the protocol’s own lineage also points to a long-running stablecoin business dating back to 2017, but that specific history is only confirmed here by the protocol’s own materials and should be treated as an unverified marketing claim absent independent corroboration.

I found no reliable evidence in the available sources of a major founder-linked hack, criminal case, or failure event tied to Rune Christensen himself; that said, absence of evidence is not proof of absence, and this point is not verifiable as of 2026-10-25. On “real business vs web front,” the strongest independent indicator is that stUSDS has an external audit report from ChainSecurity and a public code repository, which is more consistent with a real operating protocol than a mere front-end shell. Still, I could not independently verify a physical office, onshore/offshore corporate footprint, or definitive headquarters structure from the available sources, so those items are not verifiable as of 2026-10-25.

Overall, Sky appears to be a credible, publicly led DeFi protocol with a long founder pedigree, but the exact legal entity map and any real-world office presence remain unclear from the evidence available here.

Sky stUSDS appears to have a generally positive but cautious reputation. On the security side, ChainSecurity’s audit says the codebase provides a high level of security, and Sky’s own docs / GitHub note additional audits and explicit trust assumptions, including that users trust Sky governance and that contract upgrades could affect withdrawals during the governance delay. For protocol/founders/investors, the protocol is backed by the broader Sky ecosystem rather than a clearly identified single-founder structure in the materials reviewed.

The strongest external validation is institutional: Moody’s assigned Sky Protocol a B3 issuer rating with a stable outlook, while S&P had earlier assigned a B- rating; both ratings highlight risks around weak capital buffers, depositor concentration, centralized governance, and lack of audited financials/formal incorporation. Criticism is therefore concentrated less on fraud allegations and more on structural risk: governance centralization, dependency on Sky governance, and junior-tranche risk for stUSDS holders who are effectively taking on system risk in exchange for higher yield. The GitHub documentation explicitly states that stUSDS suppliers should know they trust Sky governance completely and may face withdrawal constraints during upgrade windows.

I found no credible fraud, rug-pull, insolvency, or sanctions allegation specific to stUSDS in the provided results. I also found no regulatory enforcement action or sanctions listing tied to the protocol; however, that absence is only *not verifiable as of 2026-10-25* from the materials reviewed. Unresolved concerns remain: the protocol’s risk model is intentionally more complex than plain stablecoin savings products, and public ratings themselves flag thin capital buffers and governance risk rather than robust standalone credit strength.

Economic model — stUSDS (Sky Lending, Ethereum)

• Strategy / assets in: Users deposit USDS and receive ERC-4626 stUSDS. Capital funds borrowing against staked SKY collateral; unutilized USDS earns the Sky Savings Rate.
• Yield source: Utilized capital earns the variable SKY Borrow Rate; idle capital earns the governance-set Sky Savings Rate. No reward-token component is reported by DeFiLlama, so the mechanism appears fee/revenue-based rather than emissions-subsidized. The exact organic-versus-subsidized percentage is not verifiable as of October 25, 2026.
• Risk profile: Not market-neutral. Depositors have credit and liquidation exposure to SKY-backed borrowers and the value/liquidity of the segregated stUSDS pool. The product itself does not require looping, restaking, or external protocols, although stUSDS is composable elsewhere.
• Leverage / collateral: Collateral is staked SKY. Borrower leverage limits, aggregate leverage, and any effective leverage embedded in the collateralized positions are not verifiable as of October 25, 2026.
• Withdrawals / lock-ups: No fixed lock-up is documented. Redemptions are constrained by pool liquidity: at high utilization, users may need to wait for borrower repayment or new deposits; borrowers are not liquidated solely to fund withdrawals. Standard Ethereum gas applies; no separate interface fee is reported.
• Caps / gates: The codebase documents a global supply cap and governance-controlled debt ceiling/rate parameters. Exact current limits are not verifiable as of October 25, 2026.
• TVL / APY: DeFiLlama reports approximately $188.19m supplied, 680 holders, 5.07% supply APY, Ethereum, and stable 30-day APY behavior. Sky’s interface reports $188.88m supply and 5.11% APY. > Contradiction: DeFiLlama and Sky’s interface differ by about $0.69m in supply and 4 bp in APY. The discrepancy is likely timing/indexing; it is unresolved without raw on-chain verification.
• Dune vs. DeFiLlama: Dune verification is unavailable in this run; therefore Dune TVL, chain split, product split, trend, APY history/volatility, and reconciliation are Not verifiable as of October 25, 2026. Only Ethereum is documented for this deployment.
• Protocol revenue: Primarily borrower interest/fees, with idle-capital yield linked to the Sky Savings Rate; exact net revenue retained by Sky is not verifiable as of October 25, 2026.

Scope: Sky stUSDS is an Ethereum-mainnet ERC-4626 risk-capital vault, not a fiat-reserve product. Deposited USDS funds SKY-collateralized borrowing; stUSDS depositors bear first-loss/withdrawal-liquidity risk, including potential haircuts after liquidation shortfalls. Reported size and liabilities: Sky’s balance sheet reports USDS Staking (stUSDS) liabilities of $176.14M, as of Ethereum block 26,267,347 (October 25, 2026, 04:38 UTC). This is an analytics-dashboard figure, not a Dune-verified result. Reserves/composition: The vault’s economic backing is USDS liquidity plus SKY collateral posted by LockStake Engine borrowers.

A September 27, 2026 independent review reported approximately 206.99M USDS held by the stUSDS contract, approximately $159.66M LSEV2-SKY-A debt, and approximately $47.33M withdrawable liquidity; these figures are stale relative to October 25 and are not independently reproduced here. On-chain/Dune status: Not verifiable as of October 25, 2026. Dune MCP was unavailable for this run; therefore no Dune query ID, execution ID, block-level balance, reserve composition, or chain-by-chain exposure is asserted. Addresses and custody: stUSDS proxy: 0x99CD4Ec3f88A45940936F469E4bB72A2A701EEB9; USDS: 0xdC035D45d973E3EC169d2276DDab16f1e407384F; VAT: 0x35D1b3F3D7966A1DFe207aa4514C12a259A0492B; Vow: 0xA950524441892A31ebddF91d3cEEFa04Bf454466. Assets are held by protocol contracts, not by Sky.money or an off-chain custodian. Control: Governance controls upgrades and parameters through the Pause Proxy/Chief; a governance-configured RateSetter controls supply cap, debt ceiling and rates. Emergency halt capability exists through stUSDS Mom. Reserve policy and attestations: The policy is segregated risk capital with caps, debt ceilings and liquidity constraints—not a 1:1 immediately liquid reserve guarantee.

Security audits exist, including ChainSecurity and Cantina reviews, but no independent reserve attestation was identified; code audits do not attest to asset sufficiency. Contradiction: Sky’s product page showed total stUSDS supply of 188.88M, while the balance sheet showed $176.14M; the pages use different snapshots/measurement timestamps. The dated balance-sheet figure is preferred, but neither replaces Dune verification.

Tokenomics — Sky stUSDS (Ethereum)

• Token identity: stUSDS is not Sky’s native governance token; it is an ERC-4626 vault/share token received for depositing USDS. Contract: 0x99CD4Ec3f88A45940936F469E4bB72A2A701EEB9. Sky’s native token is SKY, contract 0x56072C95FAA701256059aa122697B133aDEd9279.
• Supply/valuation: For SKY, the latest aggregator snapshot reports approximately 23.43B circulating, 23.452B total, market cap ~$1.69B, and FDV ~$1.69B. These are off-chain aggregator figures, not on-chain verified. For stUSDS, a stale Sky dashboard snapshot reported 194.47M tokens / ~$208.5M; market cap and FDV are not economically meaningful because stUSDS is a redeemable vault share, not a freely issued governance asset.
• Utility/governance: SKY governs risk parameters, rates, debt ceilings, collateral and upgrades; staking SKY activates voting, permits USDS borrowing against staked SKY, and can receive revenue-funded rewards. stUSDS supplies liquidity for SKY-backed borrowing and earns a variable utilization-based rate; it has no governance rights.
• Revenue, buybacks, burns: Protocol surplus funds open-market SKY buybacks. Repurchased SKY is either distributed to stakers or accumulated for burning; no transaction-tax burn exists. A filing reported ~2.86M SKY burned by October 2, 2026.
• Emissions/unlocks: New inflationary SKY emissions are stated to be disabled; maximum supply is ~23.46B. No SKY lockup/unlock schedule is reported beyond voluntary, unlocked staking. On-chain confirmation that announced burns, conversions or any unlocks occurred: Not verifiable as of October 25, 2026.
• Allocations: Current team/investor/treasury/community allocation percentages and vesting wallets: Not verifiable as of October 25, 2026. SKY derives from legacy MKR conversion rather than a new conventional token sale.
• Controls/concentration: stUSDS deposits mint shares permissionlessly against USDS, while governance-controlled contracts can change rates, caps and implementation. Exact mint/blacklist/fee-switch permissions, top-holder concentration and insider-wallet attribution: Not verifiable as of October 25, 2026.
• Liquidity/listings: DEX liquidity is fragmented across Uniswap SKY-USDC, SKY-WETH, SKY-USDS and related pools; the largest identified pool was approximately $2.53M, but depth is aggregator-reported and volatile. Main centralized listings include major venues such as Coinbase, OKX and Bybit; exact current depth: Not verifiable as of October 25, 2026.

For sky-stusds, a Bitcoin drop below $10,000 is not verifiable as of 2026-10-25 from the available sources. The materials provided only support a generic macro-stress narrative for Bitcoin, not protocol-specific evidence about how this stablecoin/yield protocol would behave under that shock. What can be said with confidence is that the cited market commentary frames a sub-$10,000 Bitcoin outcome as an extreme tail scenario requiring multiple stressors at once: a global liquidity shock, forced deleveraging, institutional outflows, tighter monetary policy, and/or a severe equity selloff.

Some analysts explicitly describe it as needing a broader systemic event rather than a normal market correction. For risk analysis of sky-stusds, the key implication is indirect: if the protocol has exposure to BTC-correlated collateral, BTC-denominated reserves, leveraged looped positions, or LP positions with embedded BTC beta, a collapse below $10,000 would likely raise liquidation and redemption pressure. However, the protocol’s actual exposure, safeguards, and loss-absorption capacity are Not verifiable as of 2026-10-25 from the evidence provided.

The most useful stress-test framing is therefore:

• Market shock: BTC < $10,000 with concurrent widening credit spreads and equity drawdown.
• Protocol impact: potential collateral devaluation, liquidation cascades, fee/reward compression, and increased redemption demand, depending on exact vault design.
• Unresolved item: whether sky-stusds has direct BTC exposure, indirect BTC-linked liquidity exposure, or no material BTC sensitivity is Not verifiable as of 2026-10-25. If you want, I can next turn this into a protocol-specific stress matrix for sky-stusds once you provide the chain/contract addresses or a docs link.

For sky-stusds, a 20% depeg in the largest collateral is not verifiable as of 2026-10-25 because the provided sources do not identify the protocol’s on-chain collateral basket, the largest collateral asset, or its liquidation parameters. The only directly relevant evidence here is generic stress-testing guidance showing that a 10-20% instantaneous depeg can trigger liquidation spirals in DeFi lending markets, with risk concentrated where the depegging asset is a dominant collateral type. From a risk-analyst perspective, the scenario outcome depends on three missing inputs: the protocol’s exposure to the affected collateral, the liquidation threshold/loan-to-value settings, and whether liquidators can absorb the sell pressure without bad debt.

If the largest collateral is also the dominant collateral in the system, a 20% shock can breach health factors, force liquidations, and create reflexive downward pressure on the collateral price. Because those protocol-specific inputs are unavailable in the provided material, the correct stress result is: Not verifiable as of 2026-10-25.

Stress scenario — largest stUSDS-funded SKY borrower becomes insolvent

• Exposure and loss path: stUSDS funds USDS borrowing against staked SKY through Sky’s LockStake Engine. If the borrower defaults, the LockstakeClipper liquidates the SKY collateral through an auction. Expected loss is the residual debt after auction proceeds, liquidation penalties, and any recoveries. The largest borrower/counterparty and its exposure are Not verifiable as of October 25, 2026 because Dune/on-chain verification is unavailable in this run.
• Who absorbs the loss: stUSDS depositors are the designated junior/risk-capital tranche. If liquidation proceeds do not cover the borrower’s debt, the LockstakeClipper calls stUSDS.cut(), reducing the vault’s aggregate value and therefore the redemption value of stUSDS pro rata. This is a direct haircut to suppliers, not a loss first absorbed by ordinary USDS holders.
• Compensation: There is no identified contractual insurance fund, external guarantor, or automatic make-whole mechanism for stUSDS holders. Potential future yield does not compensate an immediate principal haircut; recovery depends on subsequent vault earnings and governance decisions. Any claim that Sky governance will reimburse suppliers is Not verifiable as of October 25, 2026.
• Smart-contract impact: The bad-debt accounting lowers stUSDS’ internal conversion value (chi/share value), while existing debt and in-auction collateral reduce the immediately withdrawable amount. Withdrawals can therefore become constrained, and secondary-market stUSDS may depeg or trade at a discount. Governance can respond by halting the Rate Setter, wiping the stUSDS debt line/cap, or stopping liquidations, but these are containment actions—not compensation. System boundary: Sky’s published balance-sheet description states that this loss is isolated to stUSDS and does not directly impair USDS. Contagion can still arise indirectly through stUSDS liquidity, integrations, and market confidence.

For sky-stusds, I cannot verify any case of committed fraud by the DAO or its owners from the provided sources alone. The search results mostly discuss general DAO fraud patterns and unrelated DAO incidents such as The DAO hack and other governance attacks, not this specific protocol. Under this stress scenario, the correct risk verdict is Not verifiable as of 2026-10-25.

I do not have sufficient independent evidence that sky-stusds’ DAO or owners committed fraud, and the provided results do not establish protocol-specific misconduct. Relevant context: DAO fraud in general can include malicious governance proposals, treasury-draining attacks, exit scams, and smart-contract exploits, but those examples are only analogues unless tied to the exact protocol and its controlling parties. If you want, I can next assess whether sky-stusds has any public allegations, enforcement actions, or governance incidents specifically tied to its owners or DAO structure.

For sky-stusds, a stress scenario with the primary yield source negative over 30 days is not verifiable as of 2026-10-25 from the provided web results. The results only establish general stress-testing conventions for yield-shock scenarios and do not provide protocol-specific data for sky-stusds or its yield composition. The closest relevant references show that stress frameworks can model yield decrease or negative short-term rates, but they are generic market-stress documents rather than evidence about this protocol’s primary yield source.

Because no protocol-specific documentation, analytics, or on-chain evidence for sky-stusds was provided, I cannot confirm whether the primary yield source would remain negative for 30 days, how large the negative yield would be, or whether that would impair the protocol’s solvency, share price, or redemption mechanics. Under the evidence standard for this run, the correct status is simply: Not verifiable as of 2026-10-25.

Governance assessment — Sky stUSDS Sky governance is operational rather than purely symbolic: SKY holders lock/delegate voting power through the Chief, approve executive “spell” proposals, and governance-controlled contracts can modify stUSDS parameters and upgrade its implementation. stUSDS documentation states that governance can directly call privileged functions, while the RateSetter’s appointed operators can change rates, caps, and debt ceilings within bounds. Proposal process/timelock: Continuous-approval SKY voting → executive spell → Pause Proxy/Governance Security Module delay → execution. The stUSDS risk review reports a 48-hour delay for upgrades, plus a 16-hour RateSetter cooldown. Instant-access/Mom-style modules can bypass the normal delay for certain emergency parameter actions. Control and concentration: Protocol contracts are governed through Sky governance; the sky.money frontend is operated separately by Skybase International and claims no custody or control over protocol contracts, parameters, or governance.

Voting is materially concentrated: an SEC-filed disclosure reports that, as of September 13, 2026, the six ranked delegates held approximately 97.4% of delegated voting power and the two largest approximately 73.2%. Top stUSDS/SKY holders via Dune: Not verifiable as of October 25, 2026 (Dune unavailable). Multisig/admin: The stUSDS RateSetter is reported as a 2-of-3 Safe, but signer identities are not publicly attributed in the reviewed source. Its authority is bounded; governance retains broader upgrade and privileged-contract powers.

A direct, non-governance user-fund drain is not established from reviewed sources. Emergency bypass exists for defined parameter controls, not proven unrestricted asset withdrawal. Company/frontend: Terms identify Skybase International as the interface provider and impose binding arbitration, unilateral access termination, and broad disclaimers. A Hong Kong registry lists “SkyBase International Company Limited,” registration no. 3135398, incorporated March 16, 2022; linkage to the current operating entity and current directors is Not verifiable as of October 25, 2026. Finding: Real token governance exists, but effective control is highly concentrated and emergency/operator powers reduce the practical protection provided by the timelock.

As of October 25, 2026, stUSDS appears to be an Ethereum-based, governance-controlled smart-contract module of the Sky Protocol, not a separately incorporated issuer. The accessible legal counterparty is Skybase International, which states that it operates only the non-custodial Sky.money interface and is independent from Sky Protocol, SkyDAO, and Sky Frontier Foundation. Sky Protocol itself is described by independent analysis as lacking a specific headquarters or conventional legal domicile. Terms and restrictions: Skybase’s terms apply to its interface, not directly to the autonomous contracts.

They prohibit illegal use, AML/terrorist-financing violations, sanctioned persons, and prohibited jurisdictions; permit wallet sanctions screening and geo-blocking; and allow suspension or termination. Certain features may be unavailable by location, including features restricted for U.S. users. Disputes are generally subject to Cayman Islands law, Cayman arbitration/courts, and contractual limitations of liability. KYC/AML and data protection: No conventional protocol-level KYC onboarding requirement was verified.

The interface claims a risk-based compliance program, including wallet screening and geo-blocking, and may collect IP addresses, wallet data, device/usage data, and transaction-monitoring information. The privacy policy describes GDPR rights for EEA users and limited U.S.-state disclosures, while noting that public blockchain records cannot be erased. Classification and warnings: The terms disclaim that the interface constitutes an offer or sale of a security, financial instrument, or investment contract; this is a contractual position, not a binding regulatory classification. stUSDS documentation characterizes it as risk capital funding SKY-backed borrowing. Principal risks include governance/upgrade control, potential slashing or bad debt, limited withdrawals, variable yield, smart-contract failure, depeg, and possible total loss. Enforcement, litigation, sanctions: No protocol- or Skybase-specific regulator enforcement action, court case, or sanctions designation was identified in the sources reviewed.

This does not establish legal clearance; regulatory classification remains uncertain, particularly in the U.S. Legal structure vs. actual risk: Cayman contractual recourse against Skybase is structurally separate from—and likely does not provide direct recourse against—the decentralized governance, smart contracts, or stUSDS reserves. The primary exposure is therefore protocol, governance, liquidity, and code risk rather than ordinary issuer-credit risk.

No exact GLEIF LEI record for 'Skybase International', 'Sky Protocol', 'stUSDS has no verified incorporated issuer', 'Sky stUSDS'. OFAC SDN screening of 'Skybase International', 'Sky Protocol', 'stUSDS has no verified incorporated issuer', 'Sky stUSDS': no match. SEC litigation and administrative release feeds: no mention.

Sky Protocol’s stUSDS is not the protocol’s own stablecoin; it is a yield-bearing expert token minted when users supply USDS to the stUSDS module, while USDS is Sky’s stablecoin. A depeg history for the stablecoin used by this protocol cannot be verified from the available web evidence alone, so the depeg count, last depeg date, and maximum depeg percentage are Not verifiable as of 2026-10-25. The protocol should therefore be treated as stablecoin-related but not as issuing stUSDS itself as a stablecoin.

stUSDS is explicitly designed as risk capital for SKY-backed borrowing, so losses from collateral liquidation and stake-engine bad debt are borne by depositors rather than diversified across the broader Sky product set. The main residual risks are withdrawal impairment under high utilization, governance and privileged-operator control, oracle/debt-ceiling dynamics, and smart-contract or accounting failure; no current on-chain exposure metrics were verified because Dune was unavailable.

Sky Protocol’s top strengths are its segmented risk design, non-custodial user control, modular architecture, dynamic yield mechanism, and governance-driven transparency. The strongest, best-supported points are: stUSDS is explicitly designed as a higher-risk “expert” lane that separates risk capital from the core savings product, which helps avoid treating all yield as identical. The system is non-custodial, letting users interact through Sky.money while keeping wallet control rather than relying on exchange custody.

Its modular structure lets governance tune different economic levers independently, which can reduce the chance that one parameter change breaks the whole system. stUSDS yield is variable and derived from SKY-backed lending utilization, which aligns returns with real protocol demand rather than fixed promises. Finally, Sky emphasizes onchain governance and transparent parameter control, with upgrades, risk settings, and allocations governed by SKY-holder votes.