Ethereum, Arbitrum.

https://tech.usual.money/smart-contracts/contract-deployments

No.

No.

We not consider compliance to EIP's relevant unless they pose an attack vector.

N/A

https://tech.usual.money/security-and-audits/audits
Previous Sherlock audit Euler EVK & UsualUSDtB reports, plus two additional audit reports to be added until finalization ( latest 26/02/2025)

Gitbook: https://tech.usual.money/
Architecture Diagram: https://tech.usual.money/overview/architecture ( to be updated with usualM)
Whitepaper: https://docs.usual.money/resources-and-ecosystem/whitepaper

If there is no Proof of Concept or equivalent proof added, findings are not accepted.

RWA Tokenizer Risk ( oracles etc.) out of scope (including min/maxAnswer checks on Chainlink).

Malicious bridges (layerzero/chainlink) out of scope.

Curve Protocol is out of scope.

Multisignature wallet hacks.

No natspec/comments/harness/mocks/outdated documentation files in code repository count as findings.

Economical attacks only if they are at minimum symmetric (e.g. I spend $1 to gain at least $1).

Bugs or incorrect behavior in third party code like RWA token implementations or other protocols are out of scope.

Incorrect data supplied by third party oracles.

Issues related to deploy scripts or tests.

Any vulnerability acknowledged or not acknowledged and not fixed by the protocol team (previous audit&competition reports) is invalid.

Attacks which include calls to permissioned smart contract functions or requires the attacker to hold a specific role in the Usual protocol are out of scope.

Design choices related to the protocol are out of scope.

Extreme market turmoil vulnerability are out of scope.

Brute force attacks are out of scope.

Tokens/Tokentypes that are not not actually used by the Usual Protocol yet are out of scope.

Any type of user errors, like transfers to address(0), that can be easily prevented in the frontend
issues based on Sybil attacks out of scope.

Issues related to centralization risks are out of scope.

Issues related to SwapperEngine if the underlying isn't USDC / Circle is compromised are out of scope.

Contracts without initializers: If you find a contract without an initializer that appears to need one, please note that:

• The initializer was likely intentionally removed to avoid bloating contracts
  • These contracts are typically in the mock directory
  • Their usage can be verified in the test files

Contracts with unexecuted initializers: For contracts that still have initializers that haven't been executed:

Please verify the default values to ensure they're appropriate

• Only in these cases should you flag an issue

In a nutshell, the absence of an initializer is generally not an issue worth reporting unless it is present and there is issue in it

------- Regarding Findings/Severity ( TVL is assumed at ONE BILLION USD ) -------

Severity Matrix for Core Stablecoin Protocol + RWA Token Wrapper Contracts ( UsualUSDtB, UsualM)

Contracts + imported files
USD0
USD0PP
DaoCollateral
RegistryAccess
RegistryContract
ClassicalOracle minus UsualOracle
SwapperEngine
UsualUSDtB
UsualM

High
An issue that results in the loss, theft, waste, or permanent freezing of 5%-100% of the total TVL.

Medium
An issue that results in the loss, theft, waste, or permanent freezing of 0.5%-5% of the total TVL.
An issue that results in the theft of 0.01%-5% of the total TVL.

Out of Scope:
Issues that can be remedied by RWA Token Governance / Usual Token Governance burning and minting (e.g. frozen assets after an attack) are out of scope.

Severity Matrix for Usual Token & Distribution Module, UsualX, Usual*, Airdrop ( everything outside of the files above)

High findings here aren't considered in unlocking the high pot. 50% of the finding value of Core Protocol/Wrapper

High
An issue that results in the theft of 10%-100% of the current Usual supply.

Medium
An issue that results in the theft of 5%-10% of the current Usual supply.

----- REGARDING FINDINGS ON DEPLOYED CONTRACTS -----

Any vulnerability involving already deployed core contracts must not be disclosed publicly or to any other person, entity or email address before Usual Labs has been notified, has fixed the issue, and has granted permission for disclosure in the competition. In addition, disclosure must be made within 24 hours following discovery of the vulnerability. Additional compensation outside of the competition prize pool can also be granted optionally by Usual Labs.