Notes / Findings

Finding (2026-09-19): two real cross-chain signer/address overlaps, found by wiring Monad into check_cross_ecosystem_overlap.py

Findings2026-09-19Chain: Monad, Robinhood ChainLinked: Curve Finance StableSwap Factory, Curve DEX

Source: data/finding_2026-09-19-monad-cross-ecosystem-overlap.md in the repository, rendered here without changes. Source file

Depth work, not new-ecosystem work: after Monad shipped, the standing directive shifted from adding more chains to strengthening what's already built (see [[feedback_oracle_depth_over_breadth]] in this pass's own memory). The most concrete, well-scoped piece of unfinished depth sitting in the codebase was Monad's own disclosed gap -- every one of its 7 scorers' docstrings said crossExposureScore was "not computed this pass" because Monad wasn't yet wired into 1. Wiring it in (MONAD_GROUPS, added to 3) surfaced two real, independently-verified findings that neither Monad's own scorers nor Robinhood Chain's own scorers could have found alone, since each only ever reads its own chain.

Finding 1: Robinhood Chain's own Curve target is the literal same contract, controlled by the literal same key, as Monad's#

scripts/lib/signer_overlap.py's GROUPS["curve"] (Robinhood Chain) and chains/monad/scorers.py::score_curve_monad()'s target are BOTH:

Independently re-confirmed live against both chains (eth_call admin() on Robinhood Chain mainnet and Monad mainnet, both returning the identical address; eth_getCode on the admin address returns empty on both -- confirmed a bare EOA on both chains, not a Safe on either). This is Curve Lite's own CREATE2-based cross-chain deployment pattern (the same salt + deployer produces the same factory address on every chain Curve Lite is deployed to) combined with Curve's own documented "deployer as admin until DAO ownership transfer" placeholder state -- confirmed still in that placeholder state on both chains as of this pass, per Curve's own curve-core repo (monad.yaml, cross-checked against sonic.yaml/ ink.yaml/taiko.yaml, which already show a DAO-transferred admin, unlike Monad).

Why this is worse than an ordinary shared-signer finding: this project's own module docstring for cross_ecosystem_overlap.py already names the general pattern ("the same Safe redeployed via CREATE2 on N chains... one compromised key set controls every chain's deployment simultaneously") but every prior instance found (Pendle's Safe on Plasma/Robinhood Chain) was at least a Safe -- some multisig threshold, however weak. Here there is no multisig at all on either chain: a single compromised private key controls the identical Curve deployment on two separate ecosystems this oracle tracks, simultaneously, right now.

Action taken: score_curve_monad()'s crossExposureScore now computes this live (was hardcoded 100/"not applicable"), reads 80 when both the factory address and the admin EOA match the known Robinhood value. Robinhood Chain's own curve scorer was NOT modified -- it's pipeline-managed with a weekly auto-push cron, out of scope for a direct edit here; this finding is the flag for that side to pick up in its own pass.

Finding 2: Monad's largest Morpho vault shares its entire curator AND owner committee with Robinhood Chain's "Steakhouse" family of vaults#

chains/monad/scorers.py::score_morpho_vault_monad()'s target (Grove x Steakhouse High Yield AUSD) has:

Both Safe owner sets were independently re-fetched live (getOwners()/ getThreshold() against both Robinhood Chain mainnet and Monad mainnet, same session, not reused from an earlier pass) before concluding this is a real subset relationship, not a coincidental partial match.

Read carefully: this is very likely Steakhouse Financial (a real, named professional Morpho curator firm) operating the same core team across multiple chains -- a legitimate, common operating pattern for a curator business, not evidence of anything improper. But "legitimate pattern" and "real concentration risk" aren't mutually exclusive: it means the same ~6-8 individuals are the actual, exploitable choke point behind Monad's largest Morpho vault AND at least 3 separate Robinhood Chain Morpho vaults this oracle already tracks. A compromise of that team threatens deposits across two ecosystems at once, which is exactly the class of risk crossExposureScore exists to surface.

Action taken: score_morpho_vault_monad()'s crossExposureScore now computes this live (was hardcoded 100), reads 80 when either the curator or owner Safe's live-fetched owner set is a subset of the known Robinhood committee snapshot.

What this does NOT do#

Not an audit, not investment advice. All notes · Back to the dashboard.