PACTAby Fractal Neurons
Pacta / Onboarding briefs / efix-efixdi-base
Onboarding verification briefEuler forum #1850

efixDI+ (EFIX): control-plane state at Base Mainnet block 57,050,397

Read-only verification of who can change efixDI+ (EFIX) and the Euler (Base) · efixDI/USDC market (governedPerspective request) it is proposed for, pinned to a canonical block and reproducible on any archive node. Forum thread: efixDI/USDC on Base — tokenized Brazilian DI fund, D+0 NAV redemption (governedPerspective whitelist) ↗.

Asset
efixDI+ (EFIX)
Venue
Euler (Base) · efixDI/USDC market (governedPerspective request)
Pinned block
Base Mainnet #57,050,397 · 2026-11-13 20:07:35 UTC Canonical (EIP-1898)
Block hash
0xd6d02efb…eb88a7
Data
/api/v1/onboarding.json · slug efix-efixdi-base
Governor
2-of-3 Safe
Vault + router + token admin
Timelock
none
0s to oracle / LTV / caps
LTV (borrow / liq.)
70% / 77%
Custom NAV oracle
Utilization
90.1%
3,480.37 USDC supplied

1. Findings

  • One 2-of-3 Safe, 0x9040…EeD4 (getThreshold() = 2), is governorAdmin() of the USDC vault, governor() of the EulerRouter (= 0x9040…EeD4) and holds DEFAULT_ADMIN_ROLE on efixDI+. No TimelockController sits between that Safe and these contracts, so the router's oracle configuration, LTVs and caps can be changed by one executed 2-of-3 Safe transaction, with no enforced on-chain delay.
  • The router prices efixDI+ through the custom adapter 0x9CD2…7788 (name() = “efixDI/USDC par x ChainlinkBRLUSD”). Borrow / liquidation LTV 70% / 77%, interest fee 15%.
  • Supply cap 3,440.00 USDC, borrow cap 23,000.00 USDC; total assets 3,480.37 USDC, borrows 3,135.58 USDC (90.1% utilization).
  • MINTER_ROLE on efixDI+ is held directly by 0x8f8C…CCb1, an account with no contract code (0 bytes) and 1,159 transactions sent, which is also one of the three signers of the governor Safe. Calls gated only by MINTER_ROLE need no second signature and no delay.
  • efixDI+ AccessControl role history (19 events, blocks 41,724,585–57,050,397): DEFAULT_ADMIN_ROLE → 0x9040…EeD4 (2-of-3 Safe); PAUSER_ROLE → 0x9040…EeD4 (2-of-3 Safe); MINTER_ROLE → 0x8f8C…CCb1 (EOA, 1,159 txs, signer of 0x9040…EeD4).
  • EFIX.owner() = 0x7C54…7537: an EOA carrying an EIP-7702 delegation designator to 0xdf02…8792, 156 transactions sent. It is not a Safe or a timelock.

2. Observed state at block 57,050,397

Block hash 0xd6d02efb…eb88a7; every read below used EIP-1898 {blockHash, requireCanonical: true} and returned byte-identical results on 3 independent RPC endpoints.

CheckContractValue
eUSDC vault governorAdmin()0xe276…39560x9040b4E9e1F8C96dC6dEF1a2d6f4105D8535EeD4
eUSDC vault oracle()0xe276…39560x5F655525A46B968CF388865CeBC0c0B79A8F8a2b
eUSDC vault caps() (supplyCap, borrowCap)0xe276…395622025, 14730
eUSDC LTVBorrow(escrow)0xe276…39567000
eUSDC LTVLiquidation(escrow)0xe276…39567700
eUSDC interestFee()0xe276…39561500
eUSDC totalAssets()0xe276…39563480371831
eUSDC totalBorrows()0xe276…39563135578407
escrow governorAdmin()0x008a…02e90x0000000000000000000000000000000000000000
escrow asset()0x008a…02e90xF5cA55f3ea5Bcd180aEa6dF9E05a0E63A66f5608
EulerRouter governor()0x5F65…8a2b0x9040b4E9e1F8C96dC6dEF1a2d6f4105D8535EeD4
EulerRouter getConfiguredOracle(efixDI+, USDC)0x5F65…8a2b0x9CD219A773d94BBECdD1bb0ae413c45f72737788
NAV oracle name()0x9CD2…7788efixDI/USDC par x ChainlinkBRLUSD
Governor Safe getThreshold()0x9040…EeD42
Governor Safe getOwners()0x9040…EeD4[3] 0x8f8CD5cC7131BF24fE9BF674D58de6dC624dCCb1, 0x0AFE6E08d8e7Ebac1e6663174a2F2c663f07f589, 0xa09d5E0001d1FdD2b59072E96c91aa79ed3e40D6
efixDI+ totalSupply()0xF5cA…5608143995590934599912958167
efixDI+ paused()0xF5cA…5608false
efixDI+ hasRole(DEFAULT_ADMIN_ROLE, Governor Safe)0xF5cA…5608true
efixDI+ hasRole(MINTER_ROLE, Safe signer account)0xF5cA…5608true
Safe signer account transaction count0x8f8C…CCb11159
Safe signer account eth_getCode0x8f8C…CCb10 bytes
EFIX owner()0x400a…B9a30x7C54Dccd6fC5DB73b34f32aCA4d1631E054c7537
EFIX owner eth_getCode (EIP-7702 designator = 0xef0100 || delegate)0x7C54…753723 bytes · EIP-7702 → 0xdf02e0aa8a707f2b190b355f320CE7d3Bc698792
EFIX owner transaction count0x7C54…7537156

3. Role maps (replayed from events)

efixDI+ AccessControl role history · 0xF5cA…5608 · 19 events, blocks 41,724,585–57,050,397

RoleHolders at the pinned blockCapability (target · function)
DEFAULT_ADMIN_ROLE0x9040…EeD4 (2-of-3 Safe)—
PAUSER_ROLE0x9040…EeD4 (2-of-3 Safe)—
MINTER_ROLE0x8f8C…CCb1 (EOA, 1,159 txs, signer of 0x9040…EeD4)—

4. Reproduce

Reproduce every value on any archive node
# Base Mainnet block 57050397
cast block 57050397 --field hash --rpc-url "$BASE_RPC_URL"
# expect 0xd6d02efb420f81b3f0e095d78453362c4488afb9adc0f8e1c411bb265beb88a7

# eUSDC vault governorAdmin()
cast call 0xe276BB91E0C63C0BC6ABdd3Dc37DF324f90e3956 "governorAdmin()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# eUSDC vault oracle()
cast call 0xe276BB91E0C63C0BC6ABdd3Dc37DF324f90e3956 "oracle()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# eUSDC vault caps() (supplyCap, borrowCap)
cast call 0xe276BB91E0C63C0BC6ABdd3Dc37DF324f90e3956 "caps()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# eUSDC LTVBorrow(escrow)
cast call 0xe276BB91E0C63C0BC6ABdd3Dc37DF324f90e3956 "LTVBorrow(address)" 0x008a506c6b6138F47B82f6a0b8Fc7FE375C102e9 --block 57050397 --rpc-url "$BASE_RPC_URL"
# eUSDC LTVLiquidation(escrow)
cast call 0xe276BB91E0C63C0BC6ABdd3Dc37DF324f90e3956 "LTVLiquidation(address)" 0x008a506c6b6138F47B82f6a0b8Fc7FE375C102e9 --block 57050397 --rpc-url "$BASE_RPC_URL"
# eUSDC interestFee()
cast call 0xe276BB91E0C63C0BC6ABdd3Dc37DF324f90e3956 "interestFee()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# eUSDC totalAssets()
cast call 0xe276BB91E0C63C0BC6ABdd3Dc37DF324f90e3956 "totalAssets()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# eUSDC totalBorrows()
cast call 0xe276BB91E0C63C0BC6ABdd3Dc37DF324f90e3956 "totalBorrows()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# escrow governorAdmin()
cast call 0x008a506c6b6138F47B82f6a0b8Fc7FE375C102e9 "governorAdmin()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# escrow asset()
cast call 0x008a506c6b6138F47B82f6a0b8Fc7FE375C102e9 "asset()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# EulerRouter governor()
cast call 0x5F655525A46B968CF388865CeBC0c0B79A8F8a2b "governor()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# EulerRouter getConfiguredOracle(efixDI+, USDC)
cast call 0x5F655525A46B968CF388865CeBC0c0B79A8F8a2b "getConfiguredOracle(address,address)" 0xF5cA55f3ea5Bcd180aEa6dF9E05a0E63A66f5608 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 --block 57050397 --rpc-url "$BASE_RPC_URL"
# NAV oracle name()
cast call 0x9CD219A773d94BBECdD1bb0ae413c45f72737788 "name()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# Governor Safe getThreshold()
cast call 0x9040b4E9e1F8C96dC6dEF1a2d6f4105D8535EeD4 "getThreshold()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# Governor Safe getOwners()
cast call 0x9040b4E9e1F8C96dC6dEF1a2d6f4105D8535EeD4 "getOwners()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# efixDI+ totalSupply()
cast call 0xF5cA55f3ea5Bcd180aEa6dF9E05a0E63A66f5608 "totalSupply()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# efixDI+ paused()
cast call 0xF5cA55f3ea5Bcd180aEa6dF9E05a0E63A66f5608 "paused()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# efixDI+ hasRole(DEFAULT_ADMIN_ROLE, Governor Safe)
cast call 0xF5cA55f3ea5Bcd180aEa6dF9E05a0E63A66f5608 "hasRole(bytes32,address)" 0x0000000000000000000000000000000000000000000000000000000000000000 0x9040b4E9e1F8C96dC6dEF1a2d6f4105D8535EeD4 --block 57050397 --rpc-url "$BASE_RPC_URL"
# efixDI+ hasRole(MINTER_ROLE, Safe signer account)
cast call 0xF5cA55f3ea5Bcd180aEa6dF9E05a0E63A66f5608 "hasRole(bytes32,address)" 0x9f2df0fed2c77648de5860a4cc508cd0818c85b8b8a1ab4ceeef8d981c8956a6 0x8f8CD5cC7131BF24fE9BF674D58de6dC624dCCb1 --block 57050397 --rpc-url "$BASE_RPC_URL"
# Safe signer account transaction count
cast nonce 0x8f8CD5cC7131BF24fE9BF674D58de6dC624dCCb1 --block 57050397 --rpc-url "$BASE_RPC_URL"
# Safe signer account eth_getCode
cast code 0x8f8CD5cC7131BF24fE9BF674D58de6dC624dCCb1 --block 57050397 --rpc-url "$BASE_RPC_URL"
# EFIX owner()
cast call 0x400a8DE2bF8fc4A63000A7E77103eDAE897CB9a3 "owner()" --block 57050397 --rpc-url "$BASE_RPC_URL"
# EFIX owner eth_getCode (EIP-7702 designator = 0xef0100 || delegate)
cast code 0x7C54Dccd6fC5DB73b34f32aCA4d1631E054c7537 --block 57050397 --rpc-url "$BASE_RPC_URL"
# EFIX owner transaction count
cast nonce 0x7C54Dccd6fC5DB73b34f32aCA4d1631E054c7537 --block 57050397 --rpc-url "$BASE_RPC_URL"

# efixDI+ AccessControl role history: replay 19 events
cast logs --from-block 41724585 --to-block 57050397 --address 0xF5cA55f3ea5Bcd180aEa6dF9E05a0E63A66f5608 --rpc-url "$BASE_RPC_URL"

5. Scope

  • Observations of on-chain state only. They do not assess code correctness, reserves, legal structure or off-chain key custody, and they are not investment advice.
  • Issuers can clear or document these findings with a 24h Collateral Onboarding & Delta Clearance Attestation ($5,000 USDC flat): block-pinned audit, docs / config reconciliation PR, Base EAS Aligned attestation and a Curator Diligence Dossier for the forum thread.
For issuers

Issuing efixDI+ (EFIX)? Reconcile & Anchor 24h Institutional Clearance

Reconcile documentation drift, verify multisig and timelock control planes across archive RPCs, prepare an upstream docs reconciliation PR, and anchor a Base EAS Aligned Attestation + Curator Diligence Dossier within 24 hours.

Read-only on-chain analysis. Not investment advice. Exploit-sensitive vulnerabilities are never published here; they go through Immunefi or Cantina bounty programmes.Clear these findings in 24h · $5,000 USDC →