Saturn Credit

• P1 Medium · Access Control Timeline: 1 month
  Timelock's sole PROPOSER + CANCELLER is a single EOA (F-1)
  Impact: Delay without decentralization: key loss freezes admin (incl. unpause); key compromise can propose a malicious upgrade (5-day window) or indefinitely cancel remediation
  Recommendation: Move PROPOSER/CANCELLER to a ≥3/5 multisig with an independent canceller
• P1 Medium · Access Control Timeline: 1 month
  Non-timelocked single-key processor can move the liquid USDat balance via convertFromUsdat (F-2)
  Impact: The processor can move the entire liquid USDat balance within a ±20% tolerance, uncapped and repeatable; off-chain STRC backing (92.5% of NAV) is not on-chain-provable
  Recommendation: Add on-chain caps/rate limits to convertFromUsdat; reduce reliance on off-chain-credited STRC backing
• P1 Medium · Economic Timeline: 1 month
  ±20% toleranceBps compounds to a ~33% value-leak ceiling per processor conversion (F-7)
  Impact: toleranceBps bounds strcAmount and purchasePrice independently, compounding to roughly a 33% value-leak ceiling per conversion by the trusted processor
  Recommendation: Narrow toleranceBps to ≤5%
• P1 Medium · Operations Timeline: 1 month
  No public bug bounty program or security contact
  Impact: No incentive or channel for responsible vulnerability disclosure (counted as a red flag in the assessment)
  Recommendation: Establish an Immunefi program with a $100K+ max bounty and a public security contact
• P2 Medium · Economic Timeline: 3 months
  Withdrawal settlement allows a ≤20% haircut vs previewRedeem; minUsdatReceived can be 0 (F-8)
  Impact: A per-request minUsdatReceived of 0 still validates, allowing settlement up to 20% below previewRedeem
  Recommendation: Enforce a minimum minUsdatReceived; bound the settlement haircut vs previewRedeem
• P2 Low · Access Control Timeline: 3 months
  USDat COMPLIANCE hot key holds freeze + forceTransfer + whitelist + pause and unpause (F-3)
  Impact: Broader than the sUSDat/Queue compliance roles: a single key can freeze, force-transfer to an arbitrary recipient, manage the whitelist, and both pause and unpause
  Recommendation: Split the compliance hot key's powers; separate pause from unpause; constrain forceTransfer
• P2 Low · Smart Contract Timeline: 3 months
  Unbounded user-iterated loops (_claimAllFor over balanceOf) (F-4)
  Impact: Gas-griefing / self-DoS; funds remain escapable via per-NFT claim
  Recommendation: Bound the user-iterated loops or document per-NFT claim as the escape hatch
• P2 Low · Oracle Timeline: 3 months
  Oracle has no fallback; a stale/out-of-bounds feed reverts all sUSDat accounting (F-5)
  Impact: A feed failure reverts deposit/preview/requestRedeem — a liveness DoS (fails closed)
  Recommendation: Add an oracle fallback / circuit breaker so a feed failure does not DoS vault accounting
• P2 Low · Oracle Timeline: 3 months
  getPrice omits answeredInRound / round-completeness; loose staleness and static bounds (F-6)
  Impact: 36h staleness ceiling vs a 24h heartbeat, static $20–$150 bounds (~±50%), and no deviation breaker
  Recommendation: Add answeredInRound/round-completeness checks; tighten staleness to the 24h heartbeat; add a deviation breaker

Contract Inventory