★ Single admin EOA

Circle USYC's assessment for RD-F-027 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

[CRITICAL] EOA 0x13FF8Cabb86eDf94a2dF4f98773bda4005182dD6 executed both recent Ethereum USYC upgrades (Dec 2025 tx 0x3a1fae1d, Jul 2025 tx 0xe6604cdd) directly. BSC proxy admin is Hashnote Deployer EOA 0xb2b98e86. No multisig intermediary on any chain. Address 0x13FF8Ca was funded by deployer EOA and has only 2 txs total - confirmed EOA not contract.

Sources #

Etherscan
USYC upgrade tx #8 Jul 2025 - from EOAUpgrade tx 0xe6604cdd2277bb59df3da7be272ac975219833c35a899b51fe3f5782839d3da1 from EOA 0x13FF8Caretrieved 2026-05-16
Etherscan
Upgrade executor address - EOA confirmed0x13FF8Cabb86eDf94a2dF4f98773bda4005182dD6 - 2 total txs, funded by Hashnote Deployer, confirmed EOAretrieved 2026-05-16
Etherscan
USYC upgrade tx #9 Dec 2025 - from EOAUpgrade tx 0x3a1fae1d446d0ee2b4e6b35038f9214694228a7c530745b90eed8ac3baa2b53c from EOA 0x13FF8Caretrieved 2026-05-16

Methodology #

Determine whether the effective upgrade/owner/rescue role is held by a single EOA (not a multisig) with no timelock on sensitive operations.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol circle-usyc factor RD-F-027 score red collected_at 2026-05-15 21:56:43