Superstate

Superstate is an asset-tokenization / tokenized-funds platform rather than a native-yield DeFi protocol. Its documentation describes tokenized funds and tokenized equities, with shares issued on Ethereum, Solana, and Plume; for this question’s scope, the relevant chain is Ethereum. The project website is superstate.com and the docs are hosted at docs.superstate.com.

I did not find a clearly stated public protocol launch date in the gathered sources, so launch date is Not verifiable as of 2026-09-03. I also did not find a native governance token; the exposed products are fund-share tokens such as USTB and USCC, so native token: none verifiable. For Ethereum contracts, the docs list USTB Token Proxy: 0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e and AllowlistV3 Proxy: 0x02f1fa8b196d21c7b733eb2700b825611d8a38e5.

The docs also state these contracts are audited by ChainSecurity and 0xMacro (multiple reports). However, because Dune/on-chain cross-checking was unavailable in this run, explorer verification status and ≥2-source on-chain cross-check: Not verifiable as of 2026-09-03. Fork lineage: I found no evidence that Superstate’s Ethereum contracts are a fork of a known upstream DeFi protocol.

The available material points to proprietary tokenization/fund contracts with audit coverage, not a forked lending/AMM codebase. Therefore, fork status: not identified / not verifiable. Consequently, “changes vs upstream” is Not verifiable as of 2026-09-03.

I also found no evidence of malicious-modification history in similar forks from the gathered sources; that specific risk pattern is Not verifiable as of 2026-09-03.

Superstate looks like a real product portal, not a thin landing page: the site exposes an investor portal, sign-in flow, platform pages for transactions and documents, and a documented API surface with authenticated endpoints and Swagger access. The docs also describe onboarding, fund access, and dynamic documentation queries, which is a sign of a mature support/docs stack rather than a template site. Live user functionality is present for account actions and fund operations, including mint/burn via protocol contracts, viewing pending and historical purchases/redemptions/transfers/mints, and accessing fund/account documents.

The documentation indicates investors can register, choose payout destinations, and view redemption instructions in the portal, but live on-chain deposit/withdrawal execution is Not verifiable as of 2026-09-03 because on-chain checks are unavailable in this run. I did not find obvious template signs or fake-metric-style placeholders in the surfaced pages; the content is specific to funds, investor workflows, and API endpoints rather than generic SaaS marketing. No broken-link survey was performed, so broad link health is Not verifiable as of 2026-09-03. Open API: Yes.

Superstate documents public and authenticated APIs, including a Swagger spec at api.superstate.com, JWT-authenticated endpoints, and API-key endpoints for fund/token data such as NAV, AUM, shares, pricing, and yield.

Superstate appears to have an active responsible-disclosure bug bounty/security program, but its public policy does not show a formal reward table or a clearly named third-party platform. The current security page says there is no formal reward policy, that researchers should not expect compensation, and that disclosures should be emailed to security@superstate.co; it also promises safe-harbor protection, timely acknowledgment, remediation efforts, and recognition for the first unique report that triggers a code or configuration change. A second Superstate security page, last updated in 2025, states the program can pay $5,000 to $500,000 for unique responsibly reported discoveries and that it is intended to cover vulnerabilities that could prevent asset loss, freezing, or material harm.

The public sources gathered do not provide verifiable program results (for example, number of reports paid, total paid, or disclosed fixes), so those results are Not verifiable as of 2026-09-03.

Assessment (as of September 5, 2026): No active dependency failure was identified in the reviewed sources; however, on-chain verification is unavailable in this run. Not verifiable as of September 5, 2026. USTB (Ethereum): The principal risks are legal/operational rather than DeFi composability: Delaware statutory-trust structure, investment manager, transfer agent, NAV agent, custodian, and USDC/USD settlement. The latest Superstate asset page identifies The Bank of New York Mellon as custodian, Invesco Advisers as investment manager, Superstate Services as transfer agent, and NAV Fund Services as NAV agent. The fund holds short-duration U.S.

Treasury bills. Oracle/manipulation risk: Ethereum pricing uses a Superstate continuous-price oracle updated from NAV calculations, with linear extrapolation between checkpoints; a separate Chainlink feed publishes daily NAV. This creates issuer/NAV-agent update, stale-price, extrapolation, and oracle-admin risks. Bridge risk: Superstate documents token burning on the source chain and issuance on supported destination chains. The bridge implementation/counterparty and independent reserve reconciliation were not established from independent sources. Not verifiable as of September 5, 2026. USCC spillover: Although the requested chain is Ethereum, Superstate’s broader product set includes USCC, which introduces materially higher counterparty risk.

Superstate-reported holdings dated August 26, 2026—stale under the seven-day rule—show exposure to weETH, staked Solana, Coinbase futures, CME futures, Anchorage custody, and trading venues. These are protocol-reported figures, not on-chain verified. Stablecoin/LST/restaking: USTB redemptions/subscriptions depend on USDC rails; no USTB LST/restaking exposure was identified. USCC has reported weETH and staked-SOL exposure, creating depeg, validator, slashing, liquidity, and venue-default scenarios. Contradiction / change: Prior evidence listed UMB Bank as USTB custodian; the latest asset page lists BNY Mellon.

The latest source wins, but the transition date and reconciliation are Not verifiable as of September 5, 2026. Maximum single-counterparty exposure: Not verifiable as of September 5, 2026.

Superstate’s crypto custody is organized as a qualified-custodian model, not protocol self-custody: for USCC, the fund’s digital assets and cash are held at Anchorage Digital Bank N.A., while futures positions and margin are kept at the trading venues. Superstate says fund assets are stored offchain with qualified custodians and ownership is tracked in overlapping records at the fund calculation agent, internally, and on-chain; the USCC product page also shows book-entry shares alongside Anchorage custody, indicating custody of assets is separated from the token/book-entry representation of ownership. For investors using USDC, cash and USDC are temporarily custodied at Circle.

Segregation appears to be in place at the custodian level, but the protocol itself does not publish enough independently verifiable detail here to confirm asset segregation beyond that model; withdrawals paused: Not verifiable as of 2026-09-05.

Superstate says its private key management is facilitated by Turnkey, an institutional key-management and signing infrastructure provider. The available documentation does not disclose the exact signer set, threshold policy, or operational separation details, so those specifics are Not verifiable as of 2026-09-03. The clearest documented takeaway is that Superstate relies on an external institutional custody/signing layer rather than exposing private-key handling as a user-managed process.

Because the source material here is limited to Superstate documentation excerpts, I cannot independently verify whether the same arrangement applies identically across all Superstate products on Ethereum; that broader implementation detail is Not verifiable as of 2026-09-03.

As of September 5, 2026 — Ethereum mainnet. No material address change was identified versus the September 4, 2026 record in the fetched official contract list. Current published Ethereum addresses include AllowlistV3 proxy 0x02f1fa8b196d21c7b733eb2700b825611d8a38e5, USTB proxy 0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e, USCC proxy 0x14d60e7fdc0d71d8611742720e4c50e7a974020c, USTB RedemptionIdle proxy 0x4c21b7577c8fe8b0b0669165ee7c8f67fa1454cf, Superstate continuous-price oracle 0xe4fa682f94610ccd170680cc3b045d77d9e528a8, and Chainlink USTB oracle 0x289B5036cd942e619E1Ee48670F98d214E745AAC. Architecture ``text Users/Protocols │ ├─ USTB/USCC proxy ──> upgradeable implementation │ │ │ ├─ AllowlistV3 proxy │ ├─ Oracle contracts │ └─ RedemptionIdle proxy └─ Admin-controlled mint/burn/pause/allowlist/upgrade paths `` Upgradeability/admin risk: Upgradeability is explicitly documented and confirmed in the public repository; the audit also states that token and permission-list contracts are deployed through proxies. Proxy-admin address/type, implementation slots, admin ownership, role holders, emergency authorities, and any timelock delay are Not verifiable as of September 5, 2026 because Dune/on-chain inspection was unavailable.

The documented Superstate Admin can mint to allowlisted addresses, forcibly burn investor tokens, pause/unpause transfers and accounting, modify allowlist permissions, and—through the upgrade mechanism—replace implementation logic. A compromised key could therefore freeze transfers, censor holders, destroy balances, inflate supply, alter redemption/oracle/fee behavior, or install arbitrary logic. Whether admin can directly withdraw underlying reserves, and whether users can exit without an admin-dependent redemption path, is Not verifiable as of September 5, 2026. Audit status: ChainSecurity’s 2023 SUPTB review reported zero unresolved critical/high findings at final review; later 0xMacro reviews report addressed critical/high findings for their specific code scopes.

These do not prove the current deployed implementation is identical. Risk conclusion: High administrative centralization and freeze/upgrade risk; low confidence in current key-management and timelock controls due to missing on-chain verification.

0xMacro A-1 — Publication: July 1, 2024. Scope: Superstate Solidity redemption contracts. Covers deployed code: Not verifiable as of September 4, 2026.

0xMacro A-2 — Publication: July 10, 2024. Scope: AllowList.sol, SuperstateToken.sol, USCC.sol, USTB.sol. Covers deployed code: Not verifiable as of September 4, 2026.

0xMacro A-3 — Publication: November 4, 2024. Scope: Superstate Solidity contracts. Covers deployed code: Not verifiable as of September 4, 2026.

0xMacro A-4 — Publication: November 18, 2024. Scope: Superstate Solidity contracts. Covers deployed code: Not verifiable as of September 4, 2026.

0xMacro A-5 — Publication: January 30, 2025. Scope: Superstate Solidity contracts. Covers deployed code: Not verifiable as of September 4, 2026.

0xMacro A-6 — Publication: April 15, 2025. Scope: Superstate Solidity contracts. Covers deployed code: Not verifiable as of September 4, 2026.

0xMacro A-7 — Publication: May 5, 2025. Scope: Superstate Solidity contracts. Covers deployed code: Not verifiable as of September 4, 2026.

Superstate A-8 was performed by Macro from May 17–19, 2025 and published May 21, 2025. It covered the source code stated in the report, and Macro’s summary shows 1 High issue, 1 Code Quality issue, and 1 Gas Optimization issue; all were addressed. The excerpt explicitly says the audit applied only to the Solidity contracts listed in the source-code section and did not audit deployment scripts.

A Bytecode-match note is not present in the provided search results, so deployed-code coverage cannot be confirmed from the available evidence.

ChainSecurity — Code Assessment of SUPTB Smart Contracts. Publication: November 6, 2023. Scope: IERC7246.sol, PermissionList.sol, SUPTB.sol; final commit 96de27d. Covers deployed code: Not verifiable as of September 4, 2026.

New report: Superstate A-10, published November 11, 2025. The audit reviewed the DIP/equity-token issuance system with Pyth-based oracle pricing.

New report: Superstate A-11, published February 25, 2026. The report found no issues within its defined scope.

New report: Superstate A-9, published July 31, 2025. The engagement covered the refactored AllowlistV3 implementation at a single reviewed commit.

Superstate is a public, U.S.-based, real-world asset tokenization firm, not an anonymous DeFi web front, and it is founded and led by well-known, doxxed industry figures with prior major DeFi and TradFi experience. Founders & key team

• Robert Leshner – Co‑founder & CEO. Previously founder of Compound Finance/Compound Labs, one of the earliest and largest DeFi lending protocols with multi‑billion TVL at peak.
• Jim Hiltner – Co‑founder, Head of Business Development. CFA charterholder, long‑only and digital asset BD background.
• Dean Swennumson – Co‑founder, Head of Operations. Operations lead for Superstate’s fund/tokenization stack.
• Additional senior staff include Jon Walch (Head of Engineering, ex‑Frax & smart‑contract auditor), Emily Coleman (Head of Marketing), Alex Zozos (General Counsel, ex‑Coinbase & SEC), Matt Storus (Head of Design, ex‑Coinbase), plus several engineers and client-relations staff. All named personnel are fully public, with prior roles at major U.S. crypto and finance firms (Coinbase, SEC, JP Morgan, Frax), indicating no anonymity and a high reputational stake. Prior projects, outcomes, and incident history
• Leshner’s prior project Compound Finance is widely regarded as a blue‑chip DeFi protocol; despite typical DeFi risk events in the sector, there is no mainstream record of catastrophic protocol‑level hacks or rug pulls attributed to Leshner personally.
• Superstate itself appears in institutional RWA and DeFi media coverage, funding news, and SEC filings, with no reported security breaches or investor-loss scandals as of the latest articles. Regulatory posture & corporate reality check
• Superstate is consistently described as a tokenized asset management / financial technology firm operating SEC‑registered products (e.g., USTB short‑duration U.S. government securities fund).
• A partnership release with Invesco, a large NYSE‑listed asset manager, states that Invesco Advisers, Inc. is the investment manager of the USTB fund, further validating institutional oversight and regulatory engagement.
• Corporate intelligence sources list headquarters at 205 West 28th Street, Suite 6B, New York, NY 10001, USA, with phone and email contacts, supporting the presence of a real onshore U.S. office rather than an offshore shell.
• Superstate markets itself (and is described by third parties) as modernizing public capital markets with platforms like FundOS, Opening Bell, USTB, USCC—these are primarily regulated tokenized funds and compliant onchain equity issuance, not pure permissionless DeFi. Reality check vs. “DeFi protocol” label
• Functionally, Superstate is closer to a regulated RWA/tokenized fund platform than a traditional anonymous DeFi yield farm. Its products run on Ethereum but are deeply tied to U.S. securities law, SEC registration, and partnerships with large asset managers.
• Given the public team, U.S. headquarters, SEC‑registered products, and major institutional partners, Superstate qualifies as a real operating business with onshore regulatory exposure, not a web‑only protocol front. On-chain verification of contracts, governance, and balances is Not verifiable as of 2026-09-03 due to lack of direct on-chain tooling in this run.

Superstate’s reputation is generally strong among crypto-native and institutional investors, but it is still best characterized as an early-stage, regulated tokenization/RWA platform rather than a battle-tested DeFi protocol. The company was founded by Robert Leshner (Compound founder), with co-founders Jim Hiltner and Dean Swennumson; its backers include Bain Capital Crypto, Distributed Global, Haun Ventures, Brevan Howard Digital, Galaxy Digital, CoinFund, Breyer Capital, Arrington Capital, ParaFi, 1kx, CMT Digital, Folius Ventures, Nascent, Hack VC, Modular Capital, Road Capital, Sentinel Global, Bullish, Hypersphere, Flowdesk, and others. On regulation, Superstate has positioned itself as an SEC-registered / SEC-facing firm focused on compliant tokenized products, and SEC materials show it has engaged the regulator directly on tokenization and securities-market integration.

That is a positive signal for legitimacy, but it also means the business is highly dependent on the regulatory perimeter and ongoing compliance. I found no credible allegations of fraud, rug pulls, insolvency, or sanctions tied to Superstate itself in the sources reviewed. I also did not find any widely reported auditor controversy; however, the web results only support a limited conclusion: Not verifiable as of 2026-09-03 whether its audit arrangements are comprehensive or whether any unresolved control weaknesses exist.

Known criticisms are mainly structural, not scandal-based: tokenized securities and on-chain treasury products still face regulatory, custody, transfer-agent, and market-structure risk, and the project’s own framing emphasizes permissioning and compliance rather than permissionless DeFi. The biggest unresolved concern is therefore not alleged misconduct, but whether the model scales cleanly across jurisdictions while preserving on-chain utility.

Economic model (as of September 5, 2026). Superstate is primarily a tokenized-fund platform, not a conventional permissionless yield protocol. Capital enters regulated/off-chain fund vehicles; Ethereum tokens represent fund shares. Dune is unavailable in this run, so smart-contract balances and protocol-level flow metrics are Not verifiable as of 2026-09-05. Products and assets. USTB invests mainly in short-duration U.S.

Treasury bills and seeks liquidity/stability of principal; its reported 30-day net yield is 3.54%, with a 0.15% management fee. USCC combines crypto cash-and-carry positions (spot plus short futures), possible ETH staking, and U.S. Treasuries.

It is economically market-neutral in design, but not risk-free: basis widening, mark-to-market losses, staking, exchange/derivatives, custody and counterparty risks remain. Its management fee is 0.75%; there is no performance fee. Organic vs subsidized yield. USTB yield is organic interest from Treasury holdings. USCC yield is primarily basis carry, staking and Treasury income—not an identified token-emission subsidy.

The former USCC expense waiver applied only until AUM exceeded $50 million; current reported AUM is above that threshold, so the waiver appears no longer applicable (inference). Leverage/external exposure. No verified protocol-level looping, restaking, or leverage ratio. USCC’s futures positions create derivatives and collateral exposure, but leverage_ratio: null because the ratio is Not verifiable as of 2026-09-05. USTB has no identified crypto leverage.

Both products depend on custodians, transfer agents, NAV providers and Circle for USDC redemptions. Withdrawals, gates and fees. No fixed lock-up is documented. USTB redemptions are same-day for USDC subject to available liquidity and limits; USD requests before 1 p.m. ET are same-day.

USCC uses closing NAV with T+1/T+2 settlement. Investors pay token transfer/burn gas; redemptions can face dynamic limits or liquidity constraints. TVL/revenue/APY. DeFiLlama’s current rendered snapshot reports $698.03M combined TVL, $654.81M on Ethereum (93.8%), and 5.1% average supply APY; it reports a 14.3% 30-day TVL decline and $124,738 30-day protocol revenue. However, another cached DeFiLlama snapshot shows $503.1M total and $465.08M Ethereum TVL, so trend data is contradictory and not independently verified.

Product-level TVL history and APY volatility are Not verifiable as of 2026-09-05.

As of September 5, 2026, no consolidated Superstate corporate treasury or reserve account is disclosed. The available figures are fund-level assets/outstanding shares, not Superstate-owned liquidity. Current disclosed fund exposure

• USTB: approximately $1.00B AUM. Ethereum holds 77,334,574.20 USTB valued at $857.1M (~85.66%), at token contract 0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e. The fund invests primarily in short-duration U.S. government securities.
• USCC: $139.6M AUM. Ethereum holds 4,807,274.71 USCC valued at $56.3M (~40.30%), at token contract 0x14d60e7fdc0d71d8611742720e4c50e7a974020c. Holdings dated August 26, 2026 include USD collateral, USTB, BTC/ETH/SOL/XRP, staked SOL, weETH, and offsetting futures/options. Custody and control
• USTB custodian: UMB Bank, N.A.
• USCC digital assets and cash: Anchorage Digital Bank, N.A.; futures and margin remain at trading venues. USDC used for subscriptions/redemptions may be temporarily held at Circle.
• Superstate controls the allowlist and can mint fund tokens after subscription; token holders are permissioned. Reserve policy / attestations
• USTB policy: short-duration U.S. Treasury/government securities.
• USCC policy: crypto basis trades, staking, and Treasury securities.
• The March 31, 2026 USDH accountant report merely records USDH’s own holdings of USTB; it is not a Superstate reserve attestation. A current independent attestation of Superstate’s consolidated reserves, liabilities, or custody balances was not located: Not verifiable as of September 5, 2026. On-chain Dune verification: Not verifiable as of September 5, 2026. No Dune query or execution ID is available in this run. Contradiction with prior findings: Prior USTB (~$830.1M) is superseded by the current displayed ~$1.00B; prior USCC (~$141.6M) is slightly above the current $139.6M. These are website AUM figures, not audited treasury balances. Structured fields
• liquid_reserves_usd: null
• liabilities_usd: null

Superstate, as described in the gathered sources, does not appear to have a separate native governance / utility token; instead, its Ethereum product is USTB, a permissioned ERC-20 representation of a regulated short-duration U.S. Treasury fund share. The sources do not provide a verifiable native token ticker/contract for a standalone Superstate protocol token, so the tokenomics question is best answered at the USTB product level.

On the gathered evidence, USTB has no fixed supply, no emissions schedule, no staking rewards, no buybacks, no burns program, and no tokenholder governance process; supply expands and contracts with subscriptions/redemptions. The contract is described as upgradeable, with Superstate admin-gated control over minting, allowlist management, and forcible burns under legal circumstances. The Ethereum token proxy address cited in Superstate’s docs is 0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e.

The gathered sources do not provide a verifiable total-vs-circulating split, market cap/FDV, allocations to team/investors/treasury/community, top-holder concentration, insider wallets, DEX liquidity depth, or major DEX listings. Those items are Not verifiable as of 2026-09-03 from the available web evidence. Likewise, announced unlock schedules and whether they happened on-chain are Not verifiable as of 2026-09-03.

One source reports Ethereum-side USTB holdings of roughly 55,977,412.61 USTB and $626,966,725.28 in value, but that is a product-position snapshot rather than a protocol native-token market cap/FDV figure. Superstate’s own materials also describe allowlist-based transfer restrictions and admin control, which means this is a permissioned fund token rather than a typical DeFi token with public, permissionless tokenomics.

Superstate is not a Bitcoin-lending or BTC-collateral protocol; the available public descriptions characterize it as tokenization infrastructure for securities, with onchain equity issuance, tokenized funds, and a crypto carry fund product. That means a Bitcoin drop below $10,000 is not, by itself, a direct solvency trigger for Superstate in the way it could be for a BTC-collateralized lender or treasury vehicle. For the named Ethereum deployment, no on-chain exposure, collateral stack, or protocol-owned BTC position is verifiable from the available sources, so the impact of a BTC < $10,000 scenario is Not verifiable as of 2026-09-03.

The only directly relevant public product clue is the Crypto Carry Fund / USCC, which references Bitcoin and Ethereum futures-spot basis trading rather than protocol balance-sheet leverage, but the live risk mechanics, asset composition, and unwind behavior are not disclosed in the provided sources. Most likely stress outcome: a BTC crash to below $10,000 would primarily be a market-demand and liquidity shock for Superstate’s products, not an obvious protocol failure event. Potential effects would include lower investor demand for crypto-linked tokenized products, wider spreads, and possible NAV pressure on any BTC/ETH basis strategy if the fund is exposed to basis dislocations; however, the size of that exposure is not verifiable from the sources here. Key gap: there is no verifiable evidence in the provided material of leverage, borrowing, or automated liquidation risk tied to BTC price levels for Superstate itself. Any stronger claim would be speculation and is Not verifiable as of 2026-09-03.

For Superstate on Ethereum, a 20% depeg in the largest collateral asset would be a severe stress event because Superstate’s onchain collateral use is tied to tokenized securities/funds such as USTB and USCC, which are explicitly marketed as DeFi collateral on Superstate’s own newsroom and social posts. However, the exact Ethereum collateral stack, collateral weights, and concentration by asset are Not verifiable as of 2026-09-03 from the provided sources, so the precise loss impact cannot be computed here. What can be said with confidence is the direction of risk: if the largest accepted collateral falls 20%, any lending market using it would likely face an immediate increase in liquidations, borrower undercollateralization, and forced deleveraging, especially if that asset was treated as “stable” or near-stable collateral.

For tokenized Treasury/fund collateral like USTB, the stress is less about an onchain reserve collapse and more about secondary-market mark-to-market losses, redemption latency, and the possibility that the liquidation engine cannot sell fast enough at par under stress. The key uncertainty is exposure size. Superstate materials indicate that its assets are used as collateral across DeFi venues, but the available sources do not provide a verified Ethereum-only breakdown, nor a verified list of all collateral vaults and their parameters.

Therefore, the correct risk statement is: a 20% depeg of the largest collateral would materially impair any Superstate-linked lending market on Ethereum, but the loss magnitude is Not verifiable as of 2026-09-03 without onchain collateral data.

For Superstate on Ethereum, a top-counterparty insolvency stress scenario is only *partly* verifiable from the sources gathered. Superstate publishes multiple smart-contract audits and a bug-bounty/security disclosure process, but I could not verify an explicit, protocol-level insolvency waterfall or third-party recovery contract; the missing pieces are Not verifiable as of 2026-09-03 from the available sources. Expected loss path: if a counterparty that holds or services underlying assets becomes insolvent, the loss would first arise at the *off-chain asset layer* (custodian/issuer/servicer default, delayed redemption, impaired NAV realization). The on-chain token contracts themselves do not appear, from the sources reviewed, to contain a built-in mechanism that can make investors whole in a counterparty default. Who absorbs it: absent a documented guarantee, the economic loss would normally be borne by token holders / fund investors via a lower redeemable value or delayed access, while any contractual claim would sit with the fund structure and its service providers.

That allocation is Not verifiable as of 2026-09-03 because no source reviewed states a formal indemnity, insurance, or sponsor backstop for insolvency. Compensation: the only verified compensation mechanism in the sources is the bug bounty / responsible disclosure program for security defects, not insolvency losses. Superstate says it may pay rewards for vulnerabilities that could prevent loss of assets or material harm, but that is a security-remediation program, not investor compensation for counterparty failure. Impact path through smart contracts: the likely on-chain effect is indirect: the token contract can enforce transfers, allowlisting, pausing/accounting controls, and upgradeable/modular behavior, but it cannot itself restore lost reserves if the external counterparty is insolvent. In a severe event, the practical on-chain outcomes are usually paused transfers/redemptions, stale pricing or delayed redemptions, and governance/admin intervention if those controls exist; the specific incident response path is Not verifiable as of 2026-09-03. Sources: Superstate docs on smart contracts / audits Macro audit pages for Superstate contracts Superstate security / bug bounty page 0xMacro audit library entry for Superstate

For Superstate, I found no verifiable evidence in the provided sources that the DAO or its owners have committed fraud. The available material is either general DAO-risk commentary or a protocol/site statement that Superstate uses token-level permissioning and programmatic transaction restrictions, but that does not establish fraud, and the protocol-site claim is unverified marketing unless corroborated independently. In a fraud-stress scenario, the relevant risk is that a DAO or controlling owners could misuse governance, treasury access, or admin controls to divert assets, approve deceptive proposals, or misstate ownership/asset allocation; those are recognized DAO failure modes in the literature.

However, for Superstate specifically, Not verifiable as of 2026-09-03 whether such misconduct exists, because the provided sources do not include on-chain evidence, a regulator action, a court finding, or an independent investigative report tied to this protocol. If you want a stricter institutional-risk view, the correct conclusion is: fraud by the DAO/owners is a plausible stress scenario for any DAO-like structure, but there is no sourced proof here that Superstate has actually committed it. The only protocol-specific source provided is Superstate’s own website, which should be treated as unverified absent independent confirmation.

For Superstate on Ethereum, the clearly documented primary yield-bearing product is USTB, which reports a 30-day yield of 3.54% on Superstate’s assets page and describes yield as net income from short-duration U.S. Treasury bills reflected in NAV per share. In a stress scenario where the primary yield source turns negative over 30 days, the direct implication is that the product’s NAV would stop compounding upward and could decline, because USTB’s return is described as accruing through NAV rather than distributions.

For USCC, Superstate explicitly states that the fund’s 30-day yield reflects NAV change from basis accrual, staking rewards, and mark-to-market effects, and that losses can be unrealized mark-to-market movements when basis trades move against the fund. That makes USCC the product most plausibly exposed to a negative 30-day yield shock among Superstate’s Ethereum offerings, because its yield source is structurally more variable than Treasury-bill carry. The most conservative reading is:

• USTB: negative 30-day yield would indicate Treasury-income shortfall or fee drag exceeding interest income, which is inconsistent with the fund’s normal stated structure but conceptually possible under stress.
• USCC: negative 30-day yield is already acknowledged as possible via adverse basis moves and mark-to-market losses.
• CUSHY: Superstate’s assets page shows yield as unavailable (“-”), so a 30-day negative yield cannot be verified from the provided sources. If you want a protocol-risk takeaway, the main risk signal is yield-source fragility: Treasury-bill NAV accretion is relatively stable, while crypto basis carry is materially more exposed to negative carry and mark-to-market drawdowns.

Assessment as of September 13, 2026: company-controlled, not DAO-governed. Superstate’s materials identify a corporate tokenization/asset-management platform and do not document token-holder governance, a DAO, proposal voting, or a public upgrade process. The frontend and investor portal are operated under Superstate-controlled terms; Superstate may suspend access and block or disable third-party protocol access.

Contract control: Ethereum contracts are upgradeable. The Superstate Admin Address controls minting, allowlist additions/removals, and forced burns; the allowlist is also upgradeable. This is a material centralized control surface.

The documentation does not disclose whether the admin is an EOA, multisig, or timelocked controller. Funds: the available evidence confirms privileged minting and forced-burn powers, but does not establish that the admin can directly transfer user-held assets to itself. Therefore admin_can_drain is not assigned true without on-chain verification.

Admin control could nevertheless materially impair balances, transferability, and redemption access. Voting concentration/top holders: Not verifiable as of September 13, 2026. Dune MCP was unavailable for this run; no on-chain holder or voting-concentration claim is made.

Timelock, delay, multisig threshold/owners, signer independence, emergency bypass, and the exact proposal process: Not verifiable as of September 13, 2026. Company/legal control: Superstate Inc. is a Delaware corporation, incorporated in 2023; SEC CIK 1981398. A 2026 Form D identifies Robert Leshner and James Hiltner as executive officers/directors/promoters, Reid Cuming as director/promoter, and Alexander Zozos as executive officer.

The LEI record lists Delaware entity ID 7398331. Website terms separately identify Superstate Services LLC, a Delaware LLC and SEC transfer agent, with New York governing law and mandatory New York arbitration. Conclusion: DAO governance is absent or symbolic; effective control rests with Superstate corporate entities and their privileged admin role.

The on-chain controller architecture and holder concentration remain unverified in this run.

Superstate is a US-based asset management firm offering tokenized short-term US Treasury products (e.g., USST, USDC-backed access to a regulated fund), not a permissionless DeFi protocol in the usual sense. Its offering sits at the intersection of traditional securities regulation and blockchain-based transfer infrastructure. Entity & jurisdiction

• Entity: Superstate Inc. (and related supervised investment fund entities; marketing describes Superstate as an SEC‑registered asset manager offering tokenized Treasury exposure).
• Jurisdiction: United States; products are regulated under US securities and investment company laws (e.g., 1940 Act structures). Legal structure vs. actual risk
• Tokens represent claims on a regulated fund holding short-term US Treasuries and cash, not direct on-chain money-market activity.
• Investors face traditional fund risks: issuer credit/operational risk, custody/bank risk, and regulatory/interpretive risk about tokenization, plus smart contract and chain-specific risks from using Ethereum as a transfer ledger. These are economically distinct from typical DeFi protocol risks (AMM impermanent loss, liquidation mechanics, etc.). KYC / AML / investor eligibility
• Access is restricted to qualified or institutional investors, with onboarding through traditional KYC/AML checks handled by Superstate or its transfer agent/custodian.
• Retail self-serve DeFi users cannot freely mint/redeem; secondary trading may be limited or subject to transfer restrictions in the fund documents. Classification & disclosures
• Products are treated as securities (shares in an investment fund); marketing emphasizes compliance with SEC frameworks and use of private placement or registered fund formats.
• Terms of service and offering documents typically include restrictions by jurisdiction (e.g., US-focused, exclusion of sanctioned countries and certain non‑US persons) and standard investment risk language. Regulatory actions, court cases, sanctions
• As of 2026‑09‑03, no specific enforcement actions, warnings, or court cases targeting Superstate or its tokenized funds are verifiable in public records. Not verifiable as of 2026‑09‑03.
• No evidence that Superstate itself is a sanctioned entity in US or major international sanctions lists. Not verifiable as of 2026‑09‑03. Data protection
• Investor data is handled under US financial and privacy regulations; exact practices depend on Superstate’s privacy policy and its brokers/custodians, not directly on Ethereum.

No exact GLEIF LEI record for 'Superstate Inc'. OFAC SDN screening of 'Superstate Inc': no match. SEC litigation and administrative release feeds: no mention.

Superstate does not verifiably issue its own fiat-pegged stablecoin; the evidence shows tokenized fund/share products such as USTB and CUSHY, with USTB explicitly settled in USDC rather than being a stablecoin. No stablecoin depeg event for a Superstate-issued stablecoin is verifiable from the available sources, so depeg_count, last_depeg_date, and max_depeg_pct are not verifiable as of 2026-09-05. Accordingly, stable is false for an own-issued stablecoin, because none is verifiably present.

Superstate’s principal risks are concentrated in administrator-controlled token infrastructure, redemption liquidity, regulated-fund compliance, service-provider dependence, and smart-contract defects. Dune/on-chain verification of Ethereum balances, concentration, and exposure is unavailable: Not verifiable as of September 5, 2026.

Superstate’s top strengths, based on available sources, are: 1) Regulatory-compliant tokenization: it positions tokenized shares as the same shares traded on traditional exchanges, with built-in compliance such as token-level permissioning, allowlists, and transaction restrictions. 2) 24/7 onchain access and near-instant settlement: the platform is designed for continuous, global trading and instant settlement within a compliant framework. 3) DeFi composability: its tokenized securities are intended to integrate with DeFi use-cases like lending, collateral, DAOs, and automated investing.

4) Issuer-side capital formation and operations: Superstate supports direct issuance and onchain fund operations, including mint/redeem workflows and continuous interest accrual for funds. 5) Institutional-grade infrastructure and ecosystem access: it emphasizes bankruptcy-remote fund structures, established service providers, and an institutional network of onboarded investors plus an industry council to support adoption.