{
 "version": "v1",
 "generatedAt": "2026-10-15T21:09:14Z",
 "name": "Kinetiq HIP3StakingManager (kmHYPE)",
 "named_from": "dashboard",
 "chain": "Hyperliquid",
 "address": "0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec",
 "composite": 4,
 "band": "critical",
 "keys_to_move": 4,
 "react_hours": 0,
 "money_per_key_usd": 10576820.67211005,
 "not_assessed": [],
 "sub": {
  "adminKeyScore": 10,
  "multisigScore": 0,
  "timelockScore": 0,
  "oracleAuthorityScore": 7,
  "crossExposureScore": 80
 },
 "requirements": [
  {
   "label": "Admin power is not a bare key",
   "met": false
  },
  {
   "label": "At least a 3-of-5 multisig",
   "met": false
  },
  {
   "label": "A confirmed delay before changes apply, no bypass",
   "met": false
  },
  {
   "label": "Bypass paths of the delay checked and ruled out",
   "met": false
  },
  {
   "label": "Price feed not under one hand",
   "met": false
  },
  {
   "label": "No key shared with another tracked protocol",
   "met": false
  }
 ],
 "exit_window": "none: a change applies at once",
 "tvl_usd": 42307282.6884402,
 "category": "Liquid Staking",
 "at_risk_usd": 40614991.380902596,
 "narrative": {
  "summary": "This is kmHYPE's staking manager, not kHYPE's. The admin and treasury Safes have no module or guard, but OPERATOR_ROLE is a bare EOA that can call withdrawFromSpot and processL1Operations, and it binds the score.",
  "tag": "this is kmHYPE, not kHYPE",
  "detail": "kmHYPE is Kinetiq's liquid staking token for HIP-3 markets (Markets by Kinetiq). Roles read live: DEFAULT_ADMIN_ROLE and MANAGER_ROLE sit with a 4-of-8 Safe, TREASURY_ROLE with a separate 4-of-7 Safe, and SENTINEL_ROLE has no holder. A first version checked only DEFAULT_ADMIN_ROLE and rated the target far higher; checking every role found the bare EOA. The same EOA can push a reward or slash report once per validator per 24 h, and there is no sanity checker (address zero), so the size of each push is unbounded. Same 4-of-8 root Safe as kHYPE and mkts. DefiLlama TVL about $48.3M at the 2026-09-17 scouting read."
 },
 "score_account": null,
 "paused": null,
 "side_roles": null,
 "side_pending": null,
 "safe_activity": [
  {
   "safe": "hyperliquid:0x18a8\u2026f8f1",
   "nonce": 75,
   "idle_since": "2026-10-14T01:06:08Z",
   "last_moved": "2026-10-14T01:06:08Z",
   "never_executed": false
  }
 ],
 "admin_probe": null,
 "held": null,
 "dispute": null,
 "independent_read_reproduce": {
  "rpc": "https://rpc.hyperliquid.xyz/evm",
  "steps": [
   {
    "what": "the admin slot of the proxy (EIP-1967): the word is the admin address",
    "method": "eth_getStorageAt",
    "params": [
     "0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec",
     "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
     "latest"
    ]
   },
   {
    "what": "owner() on the address the slot returned (a ProxyAdmin): the holder",
    "method": "eth_call",
    "params": [
     {
      "to": "<address from the slot>",
      "data": "0x8da5cb5b"
     },
     "latest"
    ]
   },
   {
    "what": "getThreshold() on the holder (a Safe)",
    "method": "eth_call",
    "params": [
     {
      "to": "<holder>",
      "data": "0xe75235b8"
     },
     "latest"
    ]
   },
   {
    "what": "getOwners() on the holder: the signer set (word 2 is the count)",
    "method": "eth_call",
    "params": [
     {
      "to": "<holder>",
      "data": "0xa0e67e2b"
     },
     "latest"
    ]
   },
   {
    "what": "getModulesPaginated(0x1, 50) on the holder: the modules (a module executes without the signatures)",
    "method": "eth_call",
    "params": [
     {
      "to": "<holder>",
      "data": "0xcc2f845200000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000032"
     },
     "latest"
    ]
   },
   {
    "what": "the guard slot of the holder (keccak of guard_manager.guard.address)",
    "method": "eth_getStorageAt",
    "params": [
     "<holder>",
     "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
     "latest"
    ]
   },
   {
    "what": "the implementation slot of the proxy (EIP-1967): the code behind it, an upgrade changes this word",
    "method": "eth_getStorageAt",
    "params": [
     "0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec",
     "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
     "latest"
    ]
   }
  ],
  "curl": "# the admin slot of the proxy (EIP-1967): the word is the admin address\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getStorageAt\",\"params\":[\"0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec\",\"0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103\",\"latest\"]}'\n# owner() on the address the slot returned (a ProxyAdmin): the holder\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"<address from the slot>\",\"data\":\"0x8da5cb5b\"},\"latest\"]}'\n# getThreshold() on the holder (a Safe)\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"<holder>\",\"data\":\"0xe75235b8\"},\"latest\"]}'\n# getOwners() on the holder: the signer set (word 2 is the count)\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"<holder>\",\"data\":\"0xa0e67e2b\"},\"latest\"]}'\n# getModulesPaginated(0x1, 50) on the holder: the modules (a module executes without the signatures)\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"<holder>\",\"data\":\"0xcc2f845200000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000032\"},\"latest\"]}'\n# the guard slot of the holder (keccak of guard_manager.guard.address)\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getStorageAt\",\"params\":[\"<holder>\",\"0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8\",\"latest\"]}'\n# the implementation slot of the proxy (EIP-1967): the code behind it, an upgrade changes this word\ncurl -s -X POST https://rpc.hyperliquid.xyz/evm -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getStorageAt\",\"params\":[\"0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec\",\"0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc\",\"latest\"]}'",
  "block": "latest",
  "note": null
 },
 "history": [
  {
   "t": "2026-10-12T05:46:08Z",
   "composite": 4,
   "from": "push"
  }
 ],
 "feed": "https://raw.githubusercontent.com/RealSpap/authority-risk-oracle-showcase/watch-data/feed/hyperliquid-hyperevm/0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec.xml",
 "reproduce": {
  "rpc": "https://998.rpc.thirdweb.com",
  "to": "0x50840a7667baEa9D05ad4ae3dCeb384724b58720",
  "data": "0xd47875d000000000000000000000000071f0019cc7fa79e4f42587fb7b9a817d8d2429ec",
  "block": "latest",
  "composite_word": 6,
  "block_honoured": false,
  "note": "this RPC cannot replay the block of the build (it ignores the block tag, or no longer serves old state): the call reproduces the current value, not the one of the build; compare the composite and lastUpdated with this page",
  "curl": "curl -s -X POST https://998.rpc.thirdweb.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x50840a7667baEa9D05ad4ae3dCeb384724b58720\",\"data\":\"0xd47875d000000000000000000000000071f0019cc7fa79e4f42587fb7b9a817d8d2429ec\"},\"latest\"]}'"
 },
 "consumer_example": {
  "verdict": "zero",
  "collateral_factor_bps": 0,
  "text": "collateral factor 0 (score 4 is under MIN_SAFE_SCORE 60)"
 },
 "cheapest_fix": {
  "band": "weak",
  "next": 20,
  "axis": "admin key",
  "from": 10,
  "to": 49,
  "what": "a stronger admin setup (admin power spread beyond one key, or checked by others)"
 },
 "main_gap": {
  "requirement": "Admin power is not a bare key",
  "reason": "One key, or a tiny group, can change it"
 },
 "independent_read": {
  "path": "EIP-1967 admin -&gt; ProxyAdmin owner()",
  "holder": "0x18a8\u2026f8f1",
  "pending_admin": null,
  "pending_via": null,
  "self_delay_seconds": null,
  "threshold": 4,
  "owners": 8,
  "keys_to_act": 4,
  "keys_lost_to_freeze": 5,
  "kind": "safe",
  "since": "2026-10-10T06:54:09Z",
  "disagree": "the score says one key does everything (10), the live read finds a Safe 4-of-8 via EIP-1967 admin -&gt; ProxyAdmin owner(); the multisig score says no real multisig (0), the live read finds a Safe 4-of-8 via EIP-1967 admin -&gt; ProxyAdmin owner()",
  "owners_kinds": {
   "unread": 3,
   "eoa": 5
  },
  "posture": "admin: Safe 4-of-8 of 5 plain keys, 3 not read; delay: none",
  "shares_admin_with": [
   {
    "chain": "hyperliquid",
    "target": "0x393d0b87ed38fc779fd9611144ae649ba6082109"
   }
  ],
  "cluster_tvl_usd": 918749281.4277867,
  "exposure": {
   "keys_to_move": 4,
   "react_hours": 0,
   "tvl_usd": 42307282.6884402,
   "money_per_key_usd": 10576820.67211005,
   "money_source": "protocol_tvl",
   "held_symbol": null,
   "held_amount": null
  }
 },
 "score_cluster": null,
 "last_pushed": 1791783968,
 "stale": false,
 "methodology_hash": "0x36452ea42a84016f691a665855cc3482c3e8bb4d87155901b491b293457a4004",
 "block": 66993098,
 "live": "https://realspap.github.io/oracle/#chain=all&q=0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec",
 "page": "https://realspap.github.io/oracle/p/hyperliquid-0x71f0019cc7fa79e4f42587fb7b9a817d8d2429ec.html",
 "license": "CC BY 4.0, attribution: Authority Risk Oracle, realspap.github.io/oracle"
}