{ "version": "v1", "generatedAt": "2026-10-15T21:09:14Z", "name": "Kinetiq kHYPE StakingManager (HyperEVM)", "named_from": "dashboard", "chain": "Hyperliquid", "address": "0x393d0b87ed38fc779fd9611144ae649ba6082109", "composite": 4, "band": "critical", "keys_to_move": 4, "react_hours": 0, "money_per_key_usd": 219110499.68483663, "not_assessed": [], "sub": { "adminKeyScore": 10, "multisigScore": 0, "timelockScore": 0, "oracleAuthorityScore": 15, "crossExposureScore": 80 }, "requirements": [ { "label": "Admin power is not a bare key", "met": false }, { "label": "At least a 3-of-5 multisig", "met": false }, { "label": "A confirmed delay before changes apply, no bypass", "met": false }, { "label": "Bypass paths of the delay checked and ruled out", "met": false }, { "label": "Price feed not under one hand", "met": false }, { "label": "No key shared with another tracked protocol", "met": false } ], "exit_window": "none: a change applies at once", "tvl_usd": 876441998.7393465, "category": "Liquid Staking", "at_risk_usd": 841384318.7897726, "narrative": { "summary": "Kinetiq's flagship staking manager, about $1.05B of DefiLlama TVL at the 2026-09-17 read. Admin roles sit with a 4-of-8 Safe, but a bare EOA holds OPERATOR_ROLE and binds the score. Its oracle push is size-capped.", "tag": "same root Safe as kmHYPE and mkts, not in the score", "detail": "DEFAULT_ADMIN_ROLE and MANAGER_ROLE are held by a 4-of-8 Safe with no module, no guard and no delay; TREASURY_ROLE and SENTINEL_ROLE have no holder. The bare-EOA operator can push a report once per validator per 24 h, but a sanity checker caps each push at 3 bps of reward and 1 bp of slash and rejects a balance more than 300 bps from the L1 read. The Safe can loosen or remove the checker with no delay. The same Safe roots kmHYPE and mkts, a real concentration not counted in the score. OPERATOR_ROLE's gated functions were inferred from kmHYPE, not read line by line." }, "score_account": null, "paused": null, "side_roles": null, "side_pending": null, "safe_activity": [ { "safe": "hyperliquid:0x18a8\u2026f8f1", "nonce": 75, "idle_since": "2026-10-14T01:06:08Z", "last_moved": "2026-10-14T01:06:08Z", "never_executed": false } ], "admin_probe": null, "held": null, "dispute": null, "independent_read_reproduce": { "rpc": "https://rpc.hyperliquid.xyz/evm", "steps": [ { "what": "the admin slot of the proxy (EIP-1967): the word is the admin address", "method": "eth_getStorageAt", "params": [ "0x393d0b87ed38fc779fd9611144ae649ba6082109", "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103", "latest" ] }, { "what": "owner() on the address the slot returned (a ProxyAdmin): the holder", "method": "eth_call", "params": [ { "to": "
", "data": "0x8da5cb5b" }, "latest" ] }, { "what": "getThreshold() on the holder (a Safe)", "method": "eth_call", "params": [ { "to": "", "data": "0xe75235b8" }, "latest" ] }, { "what": "getOwners() on the holder: the signer set (word 2 is the count)", "method": "eth_call", "params": [ { "to": "", "data": "0xa0e67e2b" }, "latest" ] }, { "what": "getModulesPaginated(0x1, 50) on the holder: the modules (a module executes without the signatures)", "method": "eth_call", "params": [ { "to": "", "data": "0xcc2f845200000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000032" }, "latest" ] }, { "what": "the guard slot of the holder (keccak of guard_manager.guard.address)", "method": "eth_getStorageAt", "params": [ "", "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8", "latest" ] }, { "what": "the implementation slot of the proxy (EIP-1967): the code behind it, an upgrade changes this word", "method": "eth_getStorageAt", "params": [ "0x393d0b87ed38fc779fd9611144ae649ba6082109", "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc", "latest" ] } ], "curl": "# the admin slot of the proxy (EIP-1967): the word is the admin address\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getStorageAt\",\"params\":[\"0x393d0b87ed38fc779fd9611144ae649ba6082109\",\"0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103\",\"latest\"]}'\n# owner() on the address the slot returned (a ProxyAdmin): the holder\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"
\",\"data\":\"0x8da5cb5b\"},\"latest\"]}'\n# getThreshold() on the holder (a Safe)\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"\",\"data\":\"0xe75235b8\"},\"latest\"]}'\n# getOwners() on the holder: the signer set (word 2 is the count)\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"\",\"data\":\"0xa0e67e2b\"},\"latest\"]}'\n# getModulesPaginated(0x1, 50) on the holder: the modules (a module executes without the signatures)\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"\",\"data\":\"0xcc2f845200000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000032\"},\"latest\"]}'\n# the guard slot of the holder (keccak of guard_manager.guard.address)\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getStorageAt\",\"params\":[\"\",\"0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8\",\"latest\"]}'\n# the implementation slot of the proxy (EIP-1967): the code behind it, an upgrade changes this word\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getStorageAt\",\"params\":[\"0x393d0b87ed38fc779fd9611144ae649ba6082109\",\"0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc\",\"latest\"]}'", "block": "latest", "note": null }, "history": [ { "t": "2026-10-12T05:46:08Z", "composite": 4, "from": "push" } ], "feed": "https://raw.githubusercontent.com/RealSpap/authority-risk-oracle-showcase/watch-data/feed/hyperliquid-hyperevm/0x393d0b87ed38fc779fd9611144ae649ba6082109.xml", "reproduce": { "rpc": "https://998.rpc.thirdweb.com", "to": "0x50840a7667baEa9D05ad4ae3dCeb384724b58720", "data": "0xd47875d0000000000000000000000000393d0b87ed38fc779fd9611144ae649ba6082109", "block": "latest", "composite_word": 6, "block_honoured": false, "note": "this RPC cannot replay the block of the build (it ignores the block tag, or no longer serves old state): the call reproduces the current value, not the one of the build; compare the composite and lastUpdated with this page", "curl": "curl -s -X POST https://998.rpc.thirdweb.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x50840a7667baEa9D05ad4ae3dCeb384724b58720\",\"data\":\"0xd47875d0000000000000000000000000393d0b87ed38fc779fd9611144ae649ba6082109\"},\"latest\"]}'" }, "consumer_example": { "verdict": "zero", "collateral_factor_bps": 0, "text": "collateral factor 0 (score 4 is under MIN_SAFE_SCORE 60)" }, "cheapest_fix": { "band": "weak", "next": 20, "axis": "admin key", "from": 10, "to": 49, "what": "a stronger admin setup (admin power spread beyond one key, or checked by others)" }, "main_gap": { "requirement": "Admin power is not a bare key", "reason": "One key, or a tiny group, can change it" }, "independent_read": { "path": "EIP-1967 admin -> ProxyAdmin owner()", "holder": "0x18a8\u2026f8f1", "pending_admin": null, "pending_via": null, "self_delay_seconds": null, "threshold": 4, "owners": 8, "keys_to_act": 4, "keys_lost_to_freeze": 5, "kind": "safe", "since": "2026-10-13T18:46:07Z", "disagree": "the score says one key does everything (10), the live read finds a Safe 4-of-8 via EIP-1967 admin -> ProxyAdmin owner(); the multisig score says no real multisig (0), the live read finds a Safe 4-of-8 via EIP-1967 admin -> ProxyAdmin owner()", "owners_kinds": { "eoa": 4, "unread": 4 }, "posture": "admin: Safe 4-of-8 of 4 plain keys, 4 not read; delay: none", "shares_admin_with": [ { "chain": "hyperliquid", "target": "0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec" } ], "cluster_tvl_usd": 918749281.4277867, "exposure": { "keys_to_move": 4, "react_hours": 0, "tvl_usd": 876441998.7393465, "money_per_key_usd": 219110499.68483663, "money_source": "protocol_tvl", "held_symbol": null, "held_amount": null } }, "score_cluster": null, "last_pushed": 1791783968, "stale": false, "methodology_hash": "0x36452ea42a84016f691a665855cc3482c3e8bb4d87155901b491b293457a4004", "block": 66993098, "live": "https://realspap.github.io/oracle/#chain=all&q=0x393d0b87ed38fc779fd9611144ae649ba6082109", "page": "https://realspap.github.io/oracle/p/hyperliquid-0x393d0b87ed38fc779fd9611144ae649ba6082109.html", "license": "CC BY 4.0, attribution: Authority Risk Oracle, realspap.github.io/oracle" }