MUSD (Mezo USD)

• P1 High · Access Control Timeline: 1 month
  Untimelocked 5/9 Safe can mint (via the mint list) or upgrade to drain (A-1/A-2)
  Impact: Latent total loss if the multisig is compromised or malicious — a single transaction can add a minter or replace an implementation
  Recommendation: Add a timelock to the ProxyAdmin owner; cap and/or timelock mint-list additions
• P1 High · Code Quality Timeline: 1 month
  Deployed code post-dates the Cantina audit and bytecode is unverified (RF)
  Impact: Audited code is not provably the deployed code; the PCV V2 delta carries unknown risk
  Recommendation: Re-audit the V2 delta; verify the deployed bytecode on the Mezo explorer
• P2 Medium · Oracle Timeline: 3 months
  Single chain-native oracle with no fallback and no value-sanity bounds (C-01)
  Impact: Per-block updates (~3s) keep the 60s staleness window safe, so no normal-operation freeze; the residual risk is a single bad/zero price being trusted directly, or a chain oracle-module stall freezing the system
  Recommendation: Add a fallback (e.g. the Mezo Pyth feed at 0x2880…7B43) plus deviation/circuit-breaker bounds
• P2 Medium · Oracle Timeline: 3 months
  fetchPrice lacks a price>0 / round-completeness check (C-02)
  Impact: A zero or negative answer would mis-price collateral or disable liquidations with no guard
  Recommendation: Add value and round-completeness guards on the read path
• P2 Medium · Economic Timeline: 3 months
  Fixed redemption fee with no dynamic base-rate decay (C-03)
  Impact: Weaker peg-restoration force under a sustained depeg
  Recommendation: Restore Liquity's dynamic base-rate spike/decay mechanism
• P2 Low · Dependencies Timeline: 3 months
  MUSD transfer reverts on to==address(this) — non-standard ERC20 behavior (D-2)
  Impact: Integration and composability breakage for naive integrators
  Recommendation: Document the deviation; assess integrator impact
• P2 Low · Code Quality Timeline: 3 months
  GovernableVariables implementation missing _disableInitializers() (D-1)
  Impact: The implementation can be initialized (low impact behind a proxy)
  Recommendation: Add a constructor disable for consistency
• P2 Low · Smart Contract Timeline: 3 months
  PCV withdraw* lack nonReentrant; a malicious feeRecipient can DoS distributeMUSD (B-2/B-3)
  Impact: Griefing or limited denial-of-service against fee distribution
  Recommendation: Add reentrancy guards; validate the feeRecipient

Contract Inventory