Theo Trust Center

Governance overview

Governance & Admin Controls.

Overview of admin multisig configuration and on-chain governance activity.

Admin multisig

4 of 6 Safe

All admin actions are gated by a 4-of-6 multisig and a Timelock with a 2 day minimum delay.

Address: 0x9487…1295Etherscan
Custody: 6 hardware wallets
Geo: Geographically distributed across the globe
Composition: Theo principals · 2 external operators

Multisig pending

Idle

Transactions awaiting signatures on the Safe operator multisig.

No transactions currently queued.

Threshold 4-of-6Open in Safe

Timelock pending

None queued

Operations scheduled on the Timelock contract awaiting to be executed.

No actions currently queued.

Source: TimelockController logsEtherscan

Timelock executed

Operations successfully executed on the Timelock contract, ordered by most recent first.

0x79ba5097

Block 25094186

thUSD

0x79ba5097

Block 25094186

sthUSD

revokeRole

Block 25094186

Mint & Redeem

Source: TimelockController logsEtherscan

Smart contract security

Contracts & Security.

Every contract that touches user funds has been reviewed by at least two independent auditors. All deployed contracts are verified and bytecode checks have been done to ensure live code matches the audited versions.

Contract and Roles

Contract
Ethereum
thUSD1 role0xa3fE…85b3
Role	Holder	Delay	Notes
Ownable.owner()	Timelock	2 days	Single-owner contract. All admin calls flow through the Timelock above.
Verify these roles yourself These commands hit Ethereum directly via a public RPC. Paste into a terminal with Foundry installed. thUSD verification # thUSD · independent verification (Foundry's cast) # Returns the current owner — should be Timelock. cast call 0xa3fE5c7596024E6811E14F029937D5bd8Ae485b3 'owner()(address)' \ --rpc-url https://ethereum-rpc.publicnode.com # Expect: 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02
sthUSD1 role0xA808…0326
Role	Holder	Delay	Notes
Ownable.owner()	Timelock	2 days	Single-owner contract. All admin calls flow through the Timelock above.
Verify these roles yourself These commands hit Ethereum directly via a public RPC. Paste into a terminal with Foundry installed. sthUSD verification # sthUSD · independent verification (Foundry's cast) # Returns the current owner — should be Timelock. cast call 0xA808Bc9775cb41c52C7842f8b50427fE7A770326 'owner()(address)' \ --rpc-url https://ethereum-rpc.publicnode.com # Expect: 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02
Mint & Redeem3 roles0x2D99…696e
Role	Holder	Delay	Notes
DEFAULT_ADMIN_ROLE	Timelock	2 days	Upgrade, role grants/revokes
EMERGENCY_ROLE	Guardian EOA (Fordefi MPC)	Instant	Pause issuance / redemptions in an incident
MINTER_ROLE	Minter EOA (Fordefi MPC)	Instant	Authorize mints; cannot move user funds or change roles
Verify these roles yourself These commands hit Ethereum directly via a public RPC. Paste into a terminal with Foundry installed. Mint & Redeem verification # Mint & Redeem · independent verification (Foundry's cast) RPC=https://ethereum-rpc.publicnode.com ADDR=0x2D99aC801DC0edadD53f5688FeF2317932E8696e # 1. Per-(role, holder) membership check — each call returns true. # DEFAULT_ADMIN_ROLE → Timelock cast call $ADDR 'hasRole(bytes32,address)(bool)' \ 0x0000000000000000000000000000000000000000000000000000000000000000 \ 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02 \ --rpc-url $RPC # EMERGENCY_ROLE → Guardian EOA (Fordefi MPC) cast call $ADDR 'hasRole(bytes32,address)(bool)' \ 0xbf233dd2aafeb4d50879c4aa5c81e96d92f6e6945c906a58f9f2d1c1631b4b26 \ 0xf936df06d35a2f82f26083f32ff2ab72f3ebdd8f \ --rpc-url $RPC # MINTER_ROLE → Minter EOA (Fordefi MPC) cast call $ADDR 'hasRole(bytes32,address)(bool)' \ 0x9f2df0fed2c77648de5860a4cc508cd0818c85b8b8a1ab4ceeef8d981c8956a6 \ 0x09ec7c2d4955525237b843f5338dd7982b5553b6 \ --rpc-url $RPC # 2. Enumerate the complete holder set by replaying all role events # from the deploy block. Holder set = grants minus revokes, # applied in (block, logIndex) order. cast logs --address $ADDR --from-block 24837116 \ 'RoleGranted(bytes32,address,address)' --rpc-url $RPC cast logs --address $ADDR --from-block 24837116 \ 'RoleRevoked(bytes32,address,address)' --rpc-url $RPC
thUSD OFT Adapter1 role0x9AA9…b065
Role	Holder	Delay	Notes
Ownable.owner()	Timelock	2 days	Wraps the thUSD ERC20 for cross-chain transfers. Owner configures DVN stack and peer adapters; no on-chain rate limit on this adapter.
Verify these roles yourself These commands hit Ethereum directly via a public RPC. Paste into a terminal with Foundry installed. thUSD OFT Adapter verification # thUSD OFT Adapter · independent verification (Foundry's cast) # Returns the current owner — should be Timelock. cast call 0x9AA9Aa0530a6AF70EE7BC47cF1240100f514b065 'owner()(address)' \ --rpc-url https://ethereum-rpc.publicnode.com # Expect: 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02
sthUSD OFT Adapter1 role0xd1db…d540
Role	Holder	Delay	Notes
Ownable.owner()	Timelock	2 days	Wraps the sthUSD ERC20 for cross-chain transfers. Owner configures DVN stack, peer adapters, and rate limits (2M sthUSD/hr per outbound lane).
Verify these roles yourself These commands hit Ethereum directly via a public RPC. Paste into a terminal with Foundry installed. sthUSD OFT Adapter verification # sthUSD OFT Adapter · independent verification (Foundry's cast) # Returns the current owner — should be Timelock. cast call 0xd1db209087516883ec705cfeb99e80bb6032d540 'owner()(address)' \ --rpc-url https://ethereum-rpc.publicnode.com # Expect: 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02
Timelock4 roles0x2bB4…CA02
Role	Holder	Delay	Notes
DEFAULT_ADMIN_ROLE	Timelock (self)	2 days	Grant/revoke any role on the timelock. Held only by the timelock itself — every change must flow through a delayed proposal.
CANCELLER_ROLE	Canceller EOA (Fordefi MPC)Operator multisig (4-of-6)	0	Veto a queued operation pre-execution
EXECUTOR_ROLE	Operator multisig (4-of-6)	0	Manually executes once the timer elapses
PROPOSER_ROLE	Operator multisig (4-of-6)	0	Schedules ops; delay enforced downstream
Verify these roles yourself These commands hit Ethereum directly via a public RPC. Paste into a terminal with Foundry installed. Timelock verification # Timelock · independent verification (Foundry's cast) RPC=https://ethereum-rpc.publicnode.com ADDR=0x2bB4b7E6E83FA6b77d0143dad631843cB73DCA02 # 1. Per-(role, holder) membership check — each call returns true. # DEFAULT_ADMIN_ROLE → Timelock (self) cast call $ADDR 'hasRole(bytes32,address)(bool)' \ 0x0000000000000000000000000000000000000000000000000000000000000000 \ 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02 \ --rpc-url $RPC # CANCELLER_ROLE → Canceller EOA (Fordefi MPC) cast call $ADDR 'hasRole(bytes32,address)(bool)' \ 0xfd643c72710c63c0180259aba6b2d05451e3591a24e58b62239378085726f783 \ 0x7afb1d3308d22639f1ce698a2985cbf22f96d94a \ --rpc-url $RPC # CANCELLER_ROLE → Operator multisig (4-of-6) cast call $ADDR 'hasRole(bytes32,address)(bool)' \ 0xfd643c72710c63c0180259aba6b2d05451e3591a24e58b62239378085726f783 \ 0x94877640dd9e6f1e3cb56bf7b5665b7152601295 \ --rpc-url $RPC # EXECUTOR_ROLE → Operator multisig (4-of-6) cast call $ADDR 'hasRole(bytes32,address)(bool)' \ 0xd8aa0f3194971a2a116679f7c2090f6939c8d4e01a2a8d7e41d55e5351469e63 \ 0x94877640dd9e6f1e3cb56bf7b5665b7152601295 \ --rpc-url $RPC # PROPOSER_ROLE → Operator multisig (4-of-6) cast call $ADDR 'hasRole(bytes32,address)(bool)' \ 0xb09aa5aeb3702cfd50b6b62bc4532604938f21248a27a1d5ca736082b6819cc1 \ 0x94877640dd9e6f1e3cb56bf7b5665b7152601295 \ --rpc-url $RPC # 2. Enumerate the complete holder set by replaying all role events # from the deploy block. Holder set = grants minus revokes, # applied in (block, logIndex) order. cast logs --address $ADDR --from-block 25046194 \ 'RoleGranted(bytes32,address,address)' --rpc-url $RPC cast logs --address $ADDR --from-block 25046194 \ 'RoleRevoked(bytes32,address,address)' --rpc-url $RPC
Arbitrum
thUSD OFT1 role0x9AA9…b065
Role	Holder	Delay	Notes
Ownable.owner()	Timelock	18 hours	Native OFT on the destination chain. Owner is the chain-local TimelockController — peer, send-library, and rate-limit changes are gated by the delay shown above.
Verify these roles yourself These commands hit Arbitrum directly via a public RPC. Paste into a terminal with Foundry installed. thUSD OFT verification # thUSD OFT · independent verification (Foundry's cast) # Returns the current owner — should be Timelock. cast call 0x9AA9Aa0530a6AF70EE7BC47cF1240100f514b065 'owner()(address)' \ --rpc-url https://arbitrum-rpc.publicnode.com # Expect: 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02
sthUSD OFT1 role0xd1db…d540
Role	Holder	Delay	Notes
Ownable.owner()	Timelock	18 hours	Native OFT on the destination chain. Owner is the chain-local TimelockController — peer, send-library, and rate-limit changes are gated by the delay shown above.
Verify these roles yourself These commands hit Arbitrum directly via a public RPC. Paste into a terminal with Foundry installed. sthUSD OFT verification # sthUSD OFT · independent verification (Foundry's cast) # Returns the current owner — should be Timelock. cast call 0xd1db209087516883ec705cfeb99e80bb6032d540 'owner()(address)' \ --rpc-url https://arbitrum-rpc.publicnode.com # Expect: 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02
Stable
thUSD OFT1 role0x9AA9…b065
Role	Holder	Delay	Notes
Ownable.owner()	Timelock	18 hours	Native OFT on the destination chain. Owner is the chain-local TimelockController — peer, send-library, and rate-limit changes are gated by the delay shown above.
Verify these roles yourself These commands hit Stable directly via a public RPC. Paste into a terminal with Foundry installed. thUSD OFT verification # thUSD OFT · independent verification (Foundry's cast) # Returns the current owner — should be Timelock. cast call 0x9AA9Aa0530a6AF70EE7BC47cF1240100f514b065 'owner()(address)' \ --rpc-url https://rpc.stable.xyz # Expect: 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02
sthUSD OFT1 role0xd1db…d540
Role	Holder	Delay	Notes
Ownable.owner()	Timelock	18 hours	Native OFT on the destination chain. Owner is the chain-local TimelockController — peer, send-library, and rate-limit changes are gated by the delay shown above.
Verify these roles yourself These commands hit Stable directly via a public RPC. Paste into a terminal with Foundry installed. sthUSD OFT verification # sthUSD OFT · independent verification (Foundry's cast) # Returns the current owner — should be Timelock. cast call 0xd1db209087516883ec705cfeb99e80bb6032d540 'owner()(address)' \ --rpc-url https://rpc.stable.xyz # Expect: 0x2bb4b7e6e83fa6b77d0143dad631843cb73dca02

Audit history

Auditor	Scope	Date	Findings	Status	Report
Zellic	Mint & Redeem · thUSD · sthUSD	Apr 2026	0 C0 H0 M / 1 L	Remediated	PDF
Zenith	thUSD · sthUSD	Apr 2026	0 C0 H0 M / 5 L	Remediated	PDF
Pashov Audit Group	Mint & Redeem	Mar 2026	0 C0 H0 M / 7 L	Remediated	PDF
Zenith	thBill	Jul 2025	0 C0 H8 M / 3 L	Remediated	PDF

Source & bytecode

Verified

Every deployed contract is verified on-chain and bytecode-matched to the audited commit via a reproducible build script.

Ethereum: 6 contracts
Arbitrum: 2 contracts
Stable: 2 contracts

View reproducibility script

$ git checkout v2.4.0
$ forge build --use 0.8.24 --optimizer-runs 200
$ ./scripts/verify-deployed.sh ethereum
✓ TLPVault         0xC1a3…7Bd2  bytecode match
✓ MintController   0x9E44…B102  bytecode match
✓ Timelock         0x4a1C…b39e  bytecode match

Bug bounty

Coming soon

A public bug bounty is in scoping. In the meantime, responsible disclosures go to security@theo.xyz. Please include a private git repository with a proof-of-concept or simulation that reproduces the bug.

Disclosure: security@theo.xyz · PGP key in repo
Submission: Private git repo with a POC or simulation reproducing the bug
Discretionary: Case-by-case rewards while program is in scoping
Scope: Mainnet contracts on Eth, Arb, Stable

security@theo.xyz

Continuous monitoring · live tail

We monitor all on-chain activity in real time.

Powered by Hypernative, we track all contract activity in real time.

Live · Streaming

Time

Chain

Contract

Event

Detail

Tx

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

Ethereum

—

Mint

awaiting events…

—

ScopethUSDsthUSDMint & RedeemOFTTimelockController

0 events · 0s uptime

Bridge security · LayerZero v2

Bridge Security & Configs.

thUSD bridges via LayerZero v2 with a custom DVN stack and global rate limits. Required DVNs are independent; raising caps requires a 48-hour timelock.

DVN configuration

3-of-3 required

A live pull of the most current DVN configurations, queried directly from the EndpointV2 contract.

→ ARBITRUM3-of-3 required

0x373a…AfF4REQUIRED

0x3802…F20DREQUIRED

0xa4fE…c2cdREQUIRED

15 block confirmations · 1 optional fallback

→ STABLE3-of-3 required

0x373a…AfF4REQUIRED

0x3802…F20DREQUIRED

0xa4fE…c2cdREQUIRED

15 block confirmations · 1 optional fallback

OFT Adapter: 0x9AA9…b065
Endpoint: 0x1a44…728c

Verify the live config from your terminal

These commands hit EndpointV2 directly via Foundry's cast and decode the returned UlnConfig. Paste either snippet into a terminal with Foundry installed — no auth, no API keys, no aggregator. The output is the same bytes the card above renders.

→ ARBITRUM (eid 30110)

cast abi-decode 'f()((uint64,uint8,uint8,uint8,address[],address[]))' \
  "$(cast call \
      0x1a44076050125825900e736c501f859c50fE728c \
      'getConfig(address,address,uint32,uint32)(bytes)' \
      0x9AA9Aa0530a6AF70EE7BC47cF1240100f514b065 \
      0xbB2Ea70C9E858123480642Cf96acbcCE1372dCe1 \
      30110 2 \
      --rpc-url https://ethereum-rpc.publicnode.com)"

→ STABLE (eid 30396)

cast abi-decode 'f()((uint64,uint8,uint8,uint8,address[],address[]))' \
  "$(cast call \
      0x1a44076050125825900e736c501f859c50fE728c \
      'getConfig(address,address,uint32,uint32)(bytes)' \
      0x9AA9Aa0530a6AF70EE7BC47cF1240100f514b065 \
      0xbB2Ea70C9E858123480642Cf96acbcCE1372dCe1 \
      30396 2 \
      --rpc-url https://ethereum-rpc.publicnode.com)"

Read on Etherscan

Rate limits & caps

Live

sthUSD transfers are rate-limited per destination on a rolling window enforced on-chain.

→ Arbitrum · 1H$1.09M of $2.00M used

→ Stable · 1H$285.4k of $2.00M used

SOURCE CONTRACT0xd1db…d540

RAISE DELAY48 hours

Resources & files

Resources & Files.

Every audit report and policy referenced on this page. All files download directly.

Zellic — Mint & Redeem · thUSD · sthUSD audit

Apr 2026 · 0 C / 0 H, 1 L remediated

Public0.8 MBDownload

Zenith — thUSD & sthUSD audit

Apr 2026 · 26 pages · 0 C / 0 H, 5 L remediated

Public2.5 MBDownload

Pashov Audit Group — Mint & Redeem audit

Mar 2026 · 0 C / 0 H, 7 L remediated

Public0.2 MBDownload

Zenith — thBill audit

Jul 2025 · 26 pages · 0 C / 0 H, 8 M / 3 L remediated

Public2.5 MBDownload

Vulnerability disclosure policy

Not yet published

Coming soon—Pending

Proof of auditsmade verifiable.

Governance & Admin Controls.

Contracts & Security.

We monitor all on-chain activity in real time.

Bridge Security & Configs.

Resources & Files.

Proof of audits
made verifiable.