On-chain security analysis — is it a scam or legit?
The StakedUSDai protocol is a complex ERC-4626 vault implementation integrated with a loan router system.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Oct 22, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x1f33…0843The verified source code was reviewed and no issue rising to Informational severity or above was identified. This is a statement about the code that was read, not a guarantee: the review covers the published source only. Fact-layer checks (mint capability, holder concentration) were applied separately and feed the risk score.
Re-check after any contract upgrade or ownership change, both of which can alter behaviour without changing this page.
Acknowledged
The ten largest holders own 86.7% of supply. What remains: 43.2% in wallets, 43.5% in other contracts. 3,782 holders in total. For a verified reference asset the largest holders are custodians, exchanges and bridges; concentration is reported, not scored.
Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.
Acknowledged
Listed on CoinGecko as Staked USDai (SUSDAI), market cap $450M. 3,782 holders. Verified by: CoinGecko.
Match the contract address against the project's official channels before trading.
Acknowledged
Liquidity $268K (DexScreener, all pools). 24h trading volume $2.0M (CoinGecko, all markets, daily snapshot). 24h trading volume $1.3M (DexScreener, all pools).
Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.
Acknowledged
The contract lets its controller — an owner that could not be resolved — mint new supply; pause all transfers. These are the issuer's controls by design; for a verified issuer they are counterparty risk — the issuer can act on any holder, including you.
Check who holds these powers and whether a timelock or multisig stands between them and holders.
Acknowledged
A receipt for staked native tokens that keeps earning staking rewards. Its value depends on the staking protocol and its validators. Scored as an established reference asset: its identity is verified, so the issuer's or protocol's controls (listed as findings) are real and are priced once as counterparty risk, and LP locks and holder concentration are not scored — its pools belong to market makers and its largest holders are exchanges, bridges and custody. Its name presents it as a stable-value coin, yet it trades at $1.11 — it does not hold a peg. Basis: CoinGecko category: Liquid Staking Tokens. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $268K of DEX liquidity across 1 pools. Launch: 365 days of market history.
Check the staking protocol's validator set, withdrawal queue and governance.
Acknowledged
The StakedUSDai protocol is a complex ERC-4626 vault implementation integrated with a loan router system. The architecture relies on a robust role-based access control system and utilizes standard OpenZeppelin upgradeable patterns. No critical or high-severity vulnerabilities were identified during the static analysis of the provided codebase.
The architecture follows standard ERC-4626 patterns with additional hooks for loan management. 7.1 Architecture is modular, separating state storage from logic. 7.2 Code Security is high, utilizing ReentrancyGuardUpgradeable across all state-changing functions. 7.3 Access Control is strictly enforced via AccessControlUpgradeable roles.
7.4 Economic and 7.5 Governance aspects are managed through a Timelock-controlled ProxyAdmin. 7.6 External dependencies are limited to trusted loan routers and standard ERC-20 interfaces. The system design ensures that yield harvesting and fee distribution are restricted to authorized roles.
7.7 Upgrades are handled via a Transparent Proxy pattern with a 48-hour Timelock delay. 7.8 Operations are supported by a robust pause mechanism for emergency scenarios. The upgrade process is transparent and follows industry best practices for security.
The protocol demonstrates a strong security posture. It is recommended to maintain the current practice of using multi-signature wallets or timelocks for all administrative roles to prevent single points of failure.
Continue monitoring the integration with external loan routers, as these represent the primary external attack surface. Ensure that any future changes to the STRATEGY_ADMIN_ROLE are audited thoroughly due to the high level of control this role exerts over fund movements.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
