Notes / Findings

Finding (2026-09-20): an unscored-role sweep of every EVM ecosystem, and a second Aave committee on five chains

Findings2026-09-20Chain: not statedLinked: Ethena EthenaMinting (USDe live minter), GMX V2 (Synthetics) RoleStore, USDtb (Ethena Labs), Yuzu Money yzUSD, Euler V2 AccessControlEmergencyGovernor, Ramses CL V2 (0x8334…cecf), Arcus pToken factory + pBTC + pBTC3x (0x9c36…a0bb), Telos Consilium TelosC Surge

Source: data/finding_2026-09-20-unscored-role-sweep.md in the repository, rendered here without changes. Source file

Why this sweep exists#

On 2026-09-19 an independent verification pass found that the Euler V2 eVaultFactory Governor's PAUSE_GUARDIAN_ROLE was held by two bare EOAs and that no scorer or note in the repo had ever seen it, because the scorers checked the role NAMES they knew to look for and never enumerated what had actually been granted. That is a general bug class, so this pass hunts for other instances everywhere: for every AccessControl-shaped authority contract each scorer touches, replay the RoleGranted/RoleRevoked history, resolve the role names by keccak256, read the current holders, classify each (bare EOA / Safe k-of-n / timelock / other), and keep every role held by a bare EOA or a Safe that the scorer and its notes never mention. Then a SECOND, independent agent per ecosystem tried to refute each candidate with fresh on-chain reads and eth_call simulations (a holder versus a random control address; no transaction was ever sent).

Result: 104 candidates went through refutation; 42 CONFIRMED, 48 PARTLY_CONFIRMED, 14 REFUTED (the refuters overturned or downgraded a real share of the first reviewers' claims, e.g. a MINTER_ROLE on Ethena that turned out to be on a retired contract). The full backlog is at the bottom. Most entries are availability/freeze or config-only seats; the four below are the ones that matter for scores or for cross-chain overlap. Items marked [by hand] were re-read by me directly on-chain after the reviewers reported them; the rest are reviewer-reported and verifier-checked, not individually re-derived.

1. [by hand] Aave's PROTOCOL_GUARDIAN is a second cross-chain committee, on FIVE chains#

The repo (scripts/lib/cross_ecosystem_overlap.py, data/finding_2026-09-17-cross-ecosystem-aave-guardian-overlap.md) described Ethereum L1's PROTOCOL_GUARDIAN (4-of-7) as "a genuinely separate, older, mainnet-only governance body". It is not mainnet-only. Read live, one call per chain: the Safe that holds isEmergencyAdmin on each chain's Aave ACLManager is a 4-of-7 Safe with the identical 7 owners, at a different Safe address per chain:

Owners (same set everywhere): 0x3fa960f8..., 0xe6838d83..., 0xc2674c1a..., 0xd4af2e86... (bare EOAs) and 0xa2dcdd6e..., 0xb291232f..., 0x4ab2bed1... (nested 1-of-3 Safes). Zero overlap with the 9-signer GOVERNANCE_GUARDIAN committee. What the seat can do: EMERGENCY_ADMIN pauses/freezes the pool instantly, an availability power (no fund movement, no risk-parameter change). None of the five chains' Aave scorers mentions it; crossExposureScore reflects only the 9-signer committee.

Monad is worse. That Safe ALSO holds POOL_ADMIN there (isPoolAdmin true, next to the DAO Executor). By eth_call simulation with a state override (verifier, no transaction) it can swap any reserve's aToken / variableDebtToken implementation immediately, a path the 1-day Executor delay does not gate. The scorer models Monad's admin path as Executor + delay only (adminKeyScore 65, timelockScore 50). The Executor holds DEFAULT_ADMIN and could revoke the seat, and the Safe cannot grant roles. On Ethereum L1 the same Safe has isPoolAdmin false; Base and Plasma were read for EMERGENCY_ADMIN only.

Changed in this pass (no score moves): aave_protocol_guardian groups added to the Arbitrum, Base, Plasma and Monad registries, so the overlap sweep now reports each of the 7 owners on 5 chains and the containment rows; the wrong "mainnet-only" comment is corrected; score_aave_v3_monad now notes the seat and the POOL_ADMIN path (4 tests).

2. [by hand] The Ethena scorer scores a retired minter#

score_ethena_minting scores 0x2CC440b7... as "USDe minting authority", concluding "a direct Safe controls minting ... with no delay". Read live: USDe.minter() is 0xe3490297a08d6fC8Da46Edb7B6142E4F461b62D3, NOT 0x2CC440b7.... The scored contract's owner() is still the 5-of-10 Safe, but the LIVE minter's owner() is the EthenaTimelockController 0xE8Dc0Fab... (getMinDelay() = 86400s), a contract the same file already scores for USDtb PSM and the OFTAdapters. The verifier's log replay: USDe has had exactly two MinterUpdated events (2023-11-15 sets 0x2CC440b7...; 2024-07-08 sets 0xe3490297..., sent through the 5-of-10 Safe), the old contract has had no Mint/Redeem since, and the last 11 USDe mints (2026-09-19) were all to 0xe3490297.... The old contract's roles the sweep listed (20 MINTER EOAs, 4 GATEKEEPER EOAs) therefore have no live power. The LIVE minter has its own, different sets (20 bare-EOA MINTER holders with zero overlap with the old 20, 20 REDEEMER, 4 GATEKEEPER EOAs, two shared with the old set, COLLATERAL_MANAGER = a Safe); those holder COUNTS were read but nothing on it was simulated or scored. Decision for the maintainer, NOT made here: replace or add the live minter as a target (changes the tracked set and needs an on-chain push).

UPDATE 2026-09-20 (resolved and pushed on-chain): the Ethena item is decided and done. The decision this section left for the maintainer was made the same day: the live minter 0xe3490297a08d6fC8Da46Edb7B6142E4F461b62D3 is scored instead of the retired 0x2CC440b7.... It was traced and adversarially re-verified on two RPCs (timelock 24h, 5-of-10 Safe with an EthenaSafeGuard, the six redirect-class selectors and USDe.setMinter delayed, three instant lanes, seven STABLE collateral assets), scored 65/100/55/100/20, composite 73, and pushed as a new Ethereum L1 target, index 14 (tx 0x14b0466ab52a7bf6cab54253cda92c73d52ca1b88957632911d79136b99b7a98, block 11,740,952; read back exactly). The old target, index 3 (55/100/0/100/20/52), is retired: it is no longer refreshed, and because the oracle has no removal function it stays as a historical reading until it turns stale nine days after its last update (the 2026-09-19 push). Ethereum L1 now tracks 15 targets, 14 of them actively refreshed. This section's own text above is left as written; it only counted the live minter's role holders, and the later trace added what it did not have (the full authority path, seven STABLE collateral assets, about 93M USD held). Full record, score reasoning and open points: data/finding_2026-09-20-ethena-live-minter.md.

3. Radiant (Arbitrum): a 4-of-11 Safe upgrades tokens outside the timelock the scorer credits#

agent-reported, verifier-checked, not re-derived by hand. score_radiant_lendingpool scores provider.owner(), an OZ TimelockController with a 72h delay. But getPoolAdmin() on the same provider is 0x111CEEee...F2177, a 4-of-11 Safe, and the LendingPoolConfigurator's onlyPoolAdmin functions (updateAToken, updateStableDebtToken, updateVariableDebtToken, freeze, caps, rate strategy) call upgradeToAndCall / act immediately: simulated from that Safe they pass, from the timelock and a random address they revert CALLER_NOT_POOL_ADMIN. The pool-admin Safe also holds PROPOSER and CANCELLER on that timelock, and a separate 1-of-5 emergencyAdmin Safe (all five owners are also owners of the 4-of-11) can pause the pool alone. Exposure is small (about $72k of underlying), but the 72h timelock does not bind these functions. The repo already discloses the 2024-10-16 signer-compromise incident.

UPDATE 2026-09-20 (decided, implemented and pushed on-chain): Radiant, Monad Aave and the convention question. Everything this section and section 1 left for the maintainer on Radiant and on Monad's Aave is now decided and coded, and the crossExposureScore convention question that data/finding_2026-09-19-aave-guardian-ethereum-l1-fifth-chain-and-verifier-corrections.md section 1 left open is decided too (cross-ecosystem overlaps are folded, on every EVM ecosystem). All of it was pushed on-chain the same day (six transactions, all status 1, read back with 0 differences; table in data/finding_2026-09-20-cross-exposure-convention-and-score-adjustments.md section 9). This section's own text above is left as written on the day of the sweep.

• Radiant. Re-read live on 2026-09-20: getPoolAdmin() is the 4-of-11 Safe 0x111CEEee...F2177, different from provider.owner() (the 72h timelock 0x27fC8f3B...Aff92); the pool-admin Safe holds PROPOSER and CANCELLER on the timelock and 6 of its 11 owners hold EXECUTOR, but the timelock does not bind the pool-admin path. score_radiant_lendingpool now scores it as a Safe with no timelock: 55/100/55/100/100/69 became 65/95/0/100/100/55 (admin 65, multisig min(100, 4*15+7*5) = 95, timelock 0). The 1-of-5 emergency-admin Safe (owners all among the 11) can only pause, disclosed and not scored. crossExposureScore stays 100 (compared with 70 root-signer groups on 7 ecosystems, none matched, "found none" not proof of none).
• Monad Aave (section 1's "Monad is worse"). The PROTOCOL_GUARDIAN Safe 0xc887455536...e74 (4-of-7, live) holds POOL_ADMIN (isPoolAdmin true), so score_aave_v3_monad now scores the Safe-no-timelock path: 65/100/50/100/80/71 became 65/75/0/100/80/49 (multisig min(100, 4*15+3*5) = 75). If isPoolAdmin reads false it keeps 65/100/50; unread it degrades to 20/20/0.
• Convention. The Aave 9-signer committee and the Morpho Association committee that were 80 on some chains and 100 on others now read 80 everywhere; nine other targets moved by that alone. The full before/after table, the exact rule, how each was verified and the residual gaps are in data/finding_2026-09-20-cross-exposure-convention-and-score-adjustments.md.
• Pushed. The values above are on-chain since 2026-09-20 (Radiant on Arbitrum: tx 0x308ad2c8fa527a0e5c30139b6b154ff48462cd046df9840a17f25775c21fbd23, block 310,697,409; Monad Aave: tx 0xa93596300b689383572880cd4de76ee2fc7bce68ac5791db38501b07b987a019, block 64,022,942). Still not done: Radiant's two Safes are not yet in the cross_ecosystem_overlap.py sweep registry. Section 2 (Ethena) has its own update above; section 4 (GMX) is not covered by any update.

4. GMX (Arbitrum): a bare EOA holds PROPOSER, EXECUTOR and CANCELLER on the DAO timelock#

agent-reported, verifier-checked, not re-derived by hand. The GMX GovTimelockController (0x4bd1cdAa..., 24h delay): one bare EOA holds all three roles, so it can queue and execute an operation itself after 24h, without a Governor vote, and cancel Governor-queued operations. Not named in the repo.

What was NOT changed#

No score, no scorer logic and no on-chain state changed in this pass beyond the notes and registry groups named above. Sections 2 to 4 each change a score or the tracked target set and so need a maintainer decision and a real push. The 90-row backlog below is a review list, not a list of confirmed vulnerabilities: most rows are "role X held by EOA/Safe Y is not mentioned", and a large share are availability-only or already dominated by a root authority the scorer already scores.

UPDATE 2026-09-20: the Radiant item (section 3), the Monad Aave path (section 1) and the Ethena item (section 2) are no longer pending: they are decided, coded and pushed on-chain the same day, see the updates at the end of sections 2 and 3. The GMX item (section 4) and the rest of the backlog are unchanged. The "not changed" statement above described the sweep pass itself and was true of it.

Backlog (every candidate that survived refutation)#

UPDATE 2026-09-20 (later): GMX decided, Radiant in the registry, Aave POOL_ADMIN checked on the other four chains#

• GMX (section 4), re-derived by hand. The sweep did not name the holder; it is the bare EOA 0xE7BfFf2aB721264887230037940490351700a068 (2,870 transactions, about 2 ETH), next to the Governor contract 0x03e8f708e9C85EDCEaa6AD7Cd06824CeB82A7E68, on the DAO timelock 0x4bd1cdAa... (24h delay). Confirmed with hasRole on two RPCs; the RoleStore's 5-of-8 Safe holds none of PROPOSER, EXECUTOR or CANCELLER there; eth_call simulation: schedule(RoleStore, grantRole(x, ROLE_ADMIN)) passes from the EOA, reverts from a random address and from the Safe. Consequence: a single-key path to a ROLE_ADMIN grant with no Governor vote and no Safe veto. adminKey (10) and multisig (0) were already at the bare-EOA floor, so the scorer now only drops the Safe-veto credit: timelock 60 to 50, composite 22 to 19 (score_gmx_v2_rolestore, 8 new tests). Pushed on-chain the same day (Arbitrum Sepolia, tx 0xd0437c358c6eb0a6e1b21ad13c433172ec4ccf9acd08d9e106bbb1ca66ecfafe, block 310,866,307; the oracle reads 10/0/50/100/100/19, and all 9 Arbitrum targets read back identical to the scorer).
• Radiant's two Safes are now the registry group radiant_pool_admin; the live sweep (71 groups on 7 ecosystems) finds no overlap involving them, so the by-hand "none matched" is now a tool result.
• Aave POOL_ADMIN on the other chains. Section 1 found the PROTOCOL_GUARDIAN Safe holding POOL_ADMIN on Monad and read Base and Plasma for EMERGENCY_ADMIN only. Read live on 2026-09-20 with isPoolAdmin / isRiskAdmin / isAssetListingAdmin on each ACLManager: the PROTOCOL_GUARDIAN Safe holds POOL_ADMIN on Monad only; on Ethereum L1, Arbitrum, Base and Plasma it holds EMERGENCY_ADMIN and nothing else, and POOL_ADMIN there is the DAO Executor (the ACL admin). The ACLManager is not enumerable, so this checks the known guardian and admin addresses, not every possible holder. No other Aave score changes.

UPDATE 2026-09-20 (Yuzu, plasma rows above): the Yuzu rows (12h timelock PROPOSER / CANCELLER, syzUSD DISTRIBUTOR, yzPP POOL_MANAGER) are resolved by a full live trace and an adversarial re-verification, see data/finding_2026-09-20-yuzu-authority-trace.md. The placeholder score (adminKey 20) was a false negative from an OpenZeppelin-4 role hash tested on OpenZeppelin-5 timelocks; the real chain scores 65/55/0, composite 43 (was 55), because the 3-of-5 Safe holds an instant pool-valuation seat on yzPP. Pushed on-chain the same day (Plasma testnet, tx 0x490f5bb8ec6c6a436bfde4aee358928e24b8ac5597e74b72cd2f0c5f01adbb1a, block 34,083,939; read back identical).

Not an audit, not investment advice. All notes · Back to the dashboard.