Status

Honest state as of 2026-09-17.

Deployed and working

Not done

No external audit. This is the gate for mainnet, and it has not happened. A separate internal review produced a package of findings that an auditor will start from; several of those findings are real and not yet fixed.

Ownership is an EOA. Every admin role sits with a single externally-owned account. No multisig, no timelock. Moving to a Safe is planned and is more involved than it sounds — upgrade rights over each market and each Position are granted at construction time, so transferring ownership of the factory does not move them.

Freshness windows are testnet-loose. 30 days in-session and 60 days hard, because the testnet feeds are mocks nobody updates on a schedule. Mainnet values have not been set.

No caps. Supply and borrow caps are zero, meaning uncapped.

The DEX is a mock. Repay-with-collateral works mechanically on testnet against a mock router with a fixed, unauthenticated rate table that mints its output. There is no real DEX behind it.

Reserve factor is zero. Lenders currently receive the full borrow rate.

Known issues being tracked

• A surplus produced by the swap-repay path is transferred to the pool but credited to no account — not to supply, not to reserves, not back to the borrower.
• accrueInterest() is permissionless and truncates without carry.
• Borrow fees have no ceiling.
• renounceOwnership() is reachable and would permanently brick every market and Position created afterwards.

These are published rather than held back because anyone evaluating the protocol should be able to see them without asking.

What testnet numbers mean

Nothing, economically. The assets are mocks and the prices are set by whoever last called the mock feed. Testnet exists to prove the mechanism runs, not to price anything.