Fractal Neurons · Pacta Institutional Control-Plane Index

Block-pinned counterparty & timelock snapshots across production DeFi.

Pacta publishes block-pinned archive observations of sampled EIP-1967 proxy admins, TimelockController delays, RolesAuthority bitmasks, and Gnosis Safe quorums compared against cited protocol documentation—separating reproducible read-only state checks from policy interpretation.

Explore Live Index Machine-Readable JSON API Base Registry (pacta.base.eth) Base EAS Attestations

12 Sprints · 32 Records

Pinned to Ethereum Mainnet hashes & attested on Base (pacta.base.eth)

Dual-RPC + Static Review

Scanner archive replay (tenderly & mevblocker) + offline static ABI/slot audit

$0 Security Quarantine

Sensitive findings & Safe batches delivered gratis via private advisories

01 / Public Control-Plane & Timelock Truth Index (Sprints 1–12)

Verified on-chain parameters across collateral & lending infrastructure.

All entries below reflect public, non-exploitable architectural state replayed at the cited Ethereum Mainnet block height. Security-sensitive findings are strictly excluded from public tables and routed privately at zero cost to official protocol security contacts.

Protocol / Collateral	Pinned Block	Surface Checked	Classification	Observed On-Chain State vs. Documentation
Stader Labs `ETHx`	`#26,403,676` Sprint 12	`Manager` Safe Quorum & `7d` Timelock	Parameter Delta	`Manager` Safe (`0xAAfb...07AF`) is live `3-of-6` vs. `3-of-5` in `staderlabs.gitbook.io`; `ETHx` (`0xA35b...A15b`) `ProxyAdmin` (`0x67B1...C86e`) & `DEFAULT_ADMIN_ROLE` resolve to `7d` `TimelockController` (`0x1112...68B9`, `604,800s`, `6-of-9` proposer) across `58,434.16 ETHx`.
Curve Finance `crvUSD` / `ControllerFactory`	`#26,403,523` Sprint 11	`ControllerFactory.admin()` & `EmergencyDAO`	Parameter Delta	`ControllerFactory` (`0xC933...38BC`) `admin()` is `LendingOwnerProxy` (`0xeDA0...80d1`, routing `dao()` to `CurveOwnershipAgent` & ceiling reductions to `5-of-9` `EmergencyDAO`) vs. direct `CurveOwnershipAgent` in `factory.md`; `2.135B crvUSD` supply.
Gearbox V3 / V3.1 `LegacyTimelock` & `InstanceManager`	`#26,403,523` Sprint 11	Timelock Delay & Safe Quorum	Parameter Delta	`LegacyTimelock` (`0xa133...f23b`) `delay() = 129,600s` (`36h`, GIP-104) vs. `2d` in docs, and `InstanceManager` (`0x7777...CB2e`) `owner()` is live `4-of-21` Safe (`0x1E9e...53D3`) vs. `4-of-12` in docs; Guard Safes aligned.
Ondo Finance `OUSG` / `Flux Finance`	`#26,403,121` Sprint 10	`RateLimiter` & `FluxTimelock`	Parameter Delta	`RateLimiter` (`0x98Db...003c`) `globalSubscriptionLimits(OUSG)` word `[2] = $100M / 24h` vs. `$50M` in `instant-limits.md`; `Flux` `Comptroller.admin()` is `1d` `FluxTimelock` (`0x2c58...8d9c`, `86,400s`).
Maple Finance V2 / Syrup `syrupUSDC`	`#26,401,540` Sprint 6	EIP-1967 Proxy Admin vs. Timelock	Parameter Delta	`PoolPermissionManager` (`0xBe10...D8b3`) EIP-1967 admin slot holds `4-of-7` DAO Safe (`0xd6d4...a196`), while `Globals.governor()` points to 3-day `GovernorTimelock` (`259,200s`) across `898.55M` `syrupUSDC` units.
Ethena `USDe` / `sUSDe`	`#26,401,638` Sprint 7	Timelock Delay & Dev Safe Quorum	Parameter Delta	`EthenaTimelockController` (`0xE8Dc...7c94`) `getMinDelay() = 86,400s` (1d, forum topic 810) vs. `7d` in `key-trust-assumptions.md`; Dev Safe (`0x3B0A...1862`) is live `5-of-10` vs. `5/11` / `7` sigs in docs.
Usual Money `USD0` / `USD0++`	`#26,401,725` Sprint 8	`RegistryAccess` Admin Delay	Parameter Delta	`RegistryAccess` (`0x0D37...bb56`) `defaultAdminDelay() = 1s` (`8-of-15` Safe `0x6e9d...7FB7`, `pendingDefaultAdminDelay = (0,0)`) vs. 3-day (`259,200s`) role-grant delay in docs.
Fluid / Instadapp Vaults 76, 110, 111, 144	`#26,401,405` Sprint 5	`VaultFactory.isVaultAuth` Scope	Parameter Delta	`isVaultAuth(vault, 0x4F6F...D49e)` returns `true` on Vaults 76, 110, 111, and 144 per `IGP-98`/`IGP-126` migration configuration vs. narrow fee/reward scope in permissions doc.
MetaMorpho Curated `Re7 WETH` vs. `Re7 USDT`	`#26,401,405` Sprint 5	Guardian Parity & 3d Timelock	Parameter Delta	`Re7 WETH` (`0x78Fc...94d0`) enforces `timelock() = 259,200s` (3d) and `2-of-4` Safe owner, with `guardian() = 0x0` vs. Aragon Guardian (`0x2F80...BDd4`) on peer `Re7 USDT`.
Mellow / Lido Earn `earnETH` / `earnUSD`	`#26,401,312` Sprint 4	Curator Quorum & Admin Overlap	Parameter Delta	Curator Safe (`0xe5ab...769d`) is live `3-of-5` vs. `3/6` in Lido docs; all 5 Curator signers are also owners on the `5-of-8` Lazy Vault Admin Safe (`0x0Dd7...076E`, `0s` Timelock).
Renzo Protocol `ezETH`	`#26,401,725` Sprint 8	`DepositQueue` Fee Basis Points	Parameter Delta	`DepositQueue` (`0xf2F3...0d60`) `feeBasisPoints() = 1500` (`15%`) vs. `10%` in `ezeth` staking documentation; `3-of-5` Admin Safe across `39,495.32 ezETH`.
f(x) Protocol v2 `ProtocolTreasury` (4 Pools)	`#26,400,152` Sprint 2	`DEFAULT_ADMIN_ROLE` Holders	Parameter Delta	All 4 sampled v2 `ProtocolTreasury` proxies (`0x3235...CdA6`, etc.) return `hasRole = true` for `6-of-9` OpsSafe (`0x26B2...7BbF`) and `3-of-4` EmergencySafe (`0x28c9...eF62`), whereas sampled `Timelock` (`0x6886...E61a`) returns `false` at block `26400152`.
Inverse Finance `FiRM` / `GovernorMills`	`#26,399,876` Sprint 1	Policy Committee Safe Quorum	Parameter Delta	`GovernorMills` guardian wrapper (`0x941c...259D`) references Policy Committee Safe (`0x4b6c...F1B7`), live `4-of-7` on-chain vs. `5-of-9` in working-groups docs; Timelock delay is `48h`.
Mantle Liquid Staking `mETH` / `cmETH`	`#26,403,121` Sprint 10	3-Day `UpgradeTimelock`	Protective Delta	`mETH` (`0xd5F7...ADfa`) & `Staking` EIP-1967 admin slots point to 3-day `UpgradeTimelock` (`0xc260...aCE2`, `259,200s`, `6-of-14` Security Council proposer), stricter than legacy `0`-delay doc note.
Yearn V3 `RoleManager`	`#26,401,725` Sprint 8	7-Day Governance Timelock	Protective Delta	`RoleManager` (`0xb3bd...9a41`) `governance()` is wired to 7-day `TimelockController` (`0x88Ba...BF73`, `604,800s`), stricter than legacy devdocs note; `Daddy` Safe is `6-of-9`.
ether.fi Core & Liquid `eETH` / `BoringVault`	`#26,401,638` (S7) `#26,401,070` (S3)	Sampled 10d / 2d / 1d Timelocks	Aligned Baseline	Core Upgrade Timelock (`0x9f26...0761`) `864,000s` (10d) & Operating Timelock (`0xcD42...5d7a`) `172,800s` (2d) at S7; Liquid `RolesAuthority` (`0x485B...8122`) owned by 1d Timelock (`0xD829...2C89`) at S3.
Liquity V2 `BOLD`	`#26,401,540` Sprint 6	Sampled Owner & EIP-1967 Slot	Aligned Baseline	Sampled `BOLD` (`0x6440...b01D`) `owner() = 0x0`, `Governance` `owner() = 0x0`, and `CollateralRegistry` EIP-1967 implementation slot `= 0x00...00`.
StakeWise V3, Swell & Superstate `osETH`, `swETH`/`rswETH` & `USTB`/`USCC`	`#26,403,676` Sprint 12	Sampled Oracle Quorum, `7d` Timelock & `0`-Fee RWA	Aligned Baseline	StakeWise `Keeper` (`0x6B58...87b5`) enforces `6-of-11` oracles, `5%` fee & `90%/92%` LTV; Swell `swETH`/`rswETH` `ProxyAdmin`s & `PLATFORM_ADMIN` resolve to `7d` `SwellTimelock` (`0xbA82...073b`, `604,800s`); Superstate `USTB` (`0x4341...1C4e`) supports `USDC` at `0` fee across `39.46M USTB`.
Lombard & Resolv `LBTC` Core & `USR` Admin Rules	`#26,403,523` Sprint 11	Sampled 24h Proxy Timelock & Admin Delay	Aligned Baseline	Lombard core `LBTC` (`0x8236...4494`) `ProxyAdmin`s resolve to `24h` `TimelockController` (`0x055E...7e59`, `86,400s`, `3-of-5` Safe executor); Resolv sampled `USR` (`0x66a1...e110`) `defaultAdminDelay() = 86,400s` under `4-of-6` Safe (`0xD688...f547`).
Lido & Symbiotic Core `DualGovernance` & Core Registries	`#26,403,121` Sprint 10	Sampled 3d+1d Timelock & Zero Slots	Aligned Baseline	Lido `EmergencyProtectedTimelock` (`0xCE04...2316`) enforces `259,200s + 86,400s` delays & `4/7`–`5/7` emergency Safes; Symbiotic core registries hold zero EIP-1967 slots & `2-of-3` / `3-of-5` Safe owners.
Aave V3 / GHO, Compound V3, EigenLayer & Kelp Sampled Blue-Chip Core	`#26,402,160` Sprint 9	Sampled Timelocks, ACL & ProxyAdmins	Aligned Baseline	Compound V3 Comets -> `48h` Timelock (`0x6d90...3925`); Aave V3 `ACLManager` -> Level 1 Executor (`86,400s`) & `4-of-7` Guardian; Kelp `rsETH` & EigenLayer Core `ProxyAdmin`s -> `10d` (`864,000s`) Timelock paths.
Spark / Sky, Morpho & Convex Sampled Core Contracts	`#26,401,638` (S7) `#26,401,070` (S3) · `#26,401,312` (S4)	Sampled GSM Delay & Owners	Aligned Baseline	Sky `GSM_PAUSE_PROXY` (`0xbE28...38f3`) `delay() = 172,800s` (48h) & Spark `owner() = SPARK_PROXY` (S7); Morpho Blue `owner()` (S3) & Convex `Booster` chain (S4) aligned.

02 / Machine-Readable Snapshot JSON & Reference Foundry Suite

Ingest static snapshot records or run offline unit & archive-fork checks.

Risk curators can query our block-pinned JSON snapshot directly, while protocol engineering teams can adapt our open-source PactaGovernanceInvariants.t.sol reference suite (deterministic offline unit tests in GitHub Actions plus optional archive-fork smoke tests when ETH_RPC_URL is configured).

# 1. Query the block-pinned Counterparty Control-Plane Snapshot JSON
curl -s https://pacta.wtf/api/v1/index.json | jq '.entries[] | {protocol, block_number, classification, observed_delay_seconds}'

# 2. Run deterministic unit tests + Mainnet archive smoke tests in Foundry
forge test --no-match-test "testFork" -vv
ETH_RPC_URL="https://gateway.tenderly.co/public/mainnet" forge test -vv

03 / Institutional Feeds & Gratis Security Policy

Aligned incentives for curators, allocators, and CISOs.

Security Quarantine $0 Gratis

Private Advisory + Remediation

All disclosure_only findings (unrevoked legacy EOA roles, unguarded mutation paths, module hygiene) are excluded from public feeds and delivered free of charge with fork-simulated Safe Transaction Builder remediation engineering to official security contacts.

Security Contact

Curators & Underwriters $2k–$5k / mo

Counterparty Event Alerting

Scoped subscription monitoring of emitted CallScheduled, Upgraded, RoleGranted, MinDelayChange, and Safe ChangedThreshold / EnabledModule events across your vault collateral stack (USDe, syrupUSDC, weETH, ezETH, USD0).

Request Curator Feed

Protocol Engineering $3k–$10k / yr

Commitment CI & Proposal Gate

Tailored PactaGovernanceInvariants.t.sol suite integrated into GitHub Actions CI plus pre-execution fork simulation of queued Timelock / Governor payloads against your documented security model.

Request CI Guardrail

04 / Verification & Quarantine Standards

Deterministic archive proofs & zero-leakage ethics.

How does Pacta separate public counterparty metrics from private security disclosures?

Any finding involving callable privilege escalation, unrevoked legacy EOA authority, or freeze/liveness exposure is quarantined under 0600 local storage as disclosure_only. Zero exploit paths, private EOA labels, or sensitive selectors appear in this index; they are transmitted strictly via GitHub Private Security Advisories, Immunefi/Cantina, or official security@ channels at $0 cost.

How can risk curators reproduce an index entry independently?

Every entry in /api/v1/index.json and audits/sprint-1..12 includes the exact contract address, function selector or EIP-1967 storage slot, and canonical Ethereum Mainnet block height + block hash, reproducible with a single cast call or cast storage against any archive node.

How are Sprints 1–12 anchored on-chain on Base Mainnet?

Each public sprint summary SHA-256 digest and canonical Ethereum Mainnet block hash is recorded on Base Mainnet (Chain ID 8453) by our dedicated attester pacta.base.eth (0xcA4E...da09) in PactaCommitmentRegistry (0x35D2...d872) and attested under Base EAS Schema 0x7ff4...df83. All 12 Base EAS attestation UIDs are included in /api/v1/index.json.