Spark XLayer and Ethereum spUSDC PAU Deployment Security Review

Report Date: 2026-09-17

Scope:

Roles

[Ethereum] Core PAU

SPARK_BEACON = 0xd47230358AB6c52A0a988150Ac4Ab888FE8B7786

  • DEFAULT_ADMIN_ROLE: SPARK_PROXY

SPARK_PAU_FACTORY = 0x60eB26db57bD058B6D742a1f6350A7FFeAb0681E

  • No roles (no access control)
  • immutable beacon: SPARK_BEACON

SPARK_ADMINISTERED_AGENT_FACTORY = 0x74C35B0990ea530926d2656003Cb3E3Bf286cA69

  • No roles (factory)

SPARK_DEFAULT_PAU_ASSEMBLER = 0xb2468FCc87E3BE45Bfa521e567731375887BF8e2

  • No roles (assembler)
  • immutable administeredAgentFactory: SPARK_ADMINISTERED_AGENT_FACTORY
  • immutable pauFactory: SPARK_PAU_FACTORY

[Ethereum] SPUSDC Segregated PAU

SPUSDC_PAU_ACCESS_CONTROLS = 0x36F61446638BE126a189689552f38159d30f95ef

  • DEFAULT_ADMIN_ROLE: SPARK_PROXY
  • ALLOCATOR_ROLE: SPUSDC_PAU_ADMINISTERED_AGENT

SPUSDC_PAU_ADMINISTERED_AGENT = 0xD30faA074D023af8525750561beC2Aa181562866

  • Admin: SPARK_PROXY
  • Actor: ALM_RELAYER_MULTISIG
  • Grantor: PAU_GRANTOR_MULTISIG
  • Revoker: ALM_FREEZER_MULTISIG

SPUSDC_PAU_ALM_PROXY = 0x8D719A830b00e5571db00D173505CD56c0Ec224a

  • DEFAULT_ADMIN_ROLE: SPARK_PROXY
  • CONTROLLER_ROLE: SPUSDC_PAU_CONTROLLER

SPUSDC_PAU_CONTROLLER = 0x4623cdEf0FB92499fd20f710318Cf17B8a7EB6bC

  • No own roles (authorization delegated to SPUSDC_PAU_ACCESS_CONTROLS)
  • Wiring:
    • accessControls: SPUSDC_PAU_ACCESS_CONTROLS,
    • beacon: SPARK_BEACON,
    • proxy: SPUSDC_PAU_ALM_PROXY,
    • rateLimits: SPUSDC_PAU_RATELIMITS

SPUSDC_PAU_RATELIMITS = 0x222712581c3631DDF938f98Dab29a6D098ec6829

  • DEFAULT_ADMIN_ROLE: SPARK_PROXY
  • CONTROLLER_ROLE: SPUSDC_PAU_CONTROLLER

[Xlayer] Core PAU

SPARK_BEACON = 0x5612697F3F8c393A860ac0C9cf5b315c248cB0a0

  • DEFAULT_ADMIN_ROLE: SPARK_EXECUTOR

SPARK_PAU_FACTORY = 0x0B33b8974eDe2985ac9E41931314337C01543fFE

  • No roles (no access control)
  • immutable beacon: SPARK_BEACON

SPARK_ADMINISTERED_AGENT_FACTORY = 0x039bC8CAe7A5b2B981E5ED98B840C76c7FBacDAc

  • No roles (factory)

SPARK_DEFAULT_PAU_ASSEMBLER = 0xaCae58f96C959A792FaeaEc72CA870c2E36B3C80

  • No roles (assembler)
  • immutable administeredAgentFactory: SPARK_ADMINISTERED_AGENT_FACTORY
  • immutable pauFactory: SPARK_PAU_FACTORY

[XLayer] SPUSDC Segregated PAU

SPUSDC_PAU_ACCESS_CONTROLS = 0x30271Ae5d90B34f0f8BAA840AaE63a7DBF347e84

  • DEFAULT_ADMIN_ROLE: SPARK_EXECUTOR
  • ALLOCATOR_ROLE: SPUSDC_PAU_ADMINISTERED_AGENT

SPUSDC_PAU_ADMINISTERED_AGENT = 0x79b4055Eda153f739B5EA63C9B647c1a095059f5

  • Admin: SPARK_EXECUTOR
  • Actor: ALM_RELAYER_MULTISIG
  • Grantor: PAU_GRANTOR_MULTISIG
  • Revoker: ALM_FREEZER_MULTISIG

SPUSDC_PAU_ALM_PROXY = 0xe6D5d041Fc5e7fDD0A53C13e78a1cc7e4ffCb667

  • DEFAULT_ADMIN_ROLE: SPARK_EXECUTOR
  • CONTROLLER_ROLE: SPUSDC_PAU_CONTROLLER

SPUSDC_PAU_CONTROLLER = 0x8d19d306cA6075f74B26B150383379aedB0250f6

  • No own roles (authorization delegated to SPUSDC_PAU_ACCESS_CONTROLS)
  • Wiring:
    • accessControls: SPUSDC_PAU_ACCESS_CONTROLS,
    • beacon: SPARK_BEACON,
    • proxy: SPUSDC_PAU_ALM_PROXY,
    • rateLimits: SPUSDC_PAU_RATELIMITS

SPUSDC_PAU_RATELIMITS = 0xBC3Ea763532aA0dec71449414b85ca66c6dD63e2

  • DEFAULT_ADMIN_ROLE: SPARK_EXECUTOR
  • CONTROLLER_ROLE: SPUSDC_PAU_CONTROLLER

SPARK_VAULT_V2_SPUSDC = 0xf90E63079D97a0A1f479b2b168457F420CAFf6ba

  • DEFAULT_ADMIN_ROLE: SPARK_EXECUTOR
  • SETTER_ROLE: SPUSDC_PAU_ADMINISTERED_AGENT
  • TAKER_ROLE: SPUSDC_PAU_ALM_PROXY

Wires

[Xlayer] Wire tables

AAVE_FACET

  • aave_setMaxSlippage(address,uint256) → setMaxSlippage(address,uint256)
  • aave_getMaxSlippage(address) → getMaxSlippage(address)
  • aave_deposit(address,uint256) → deposit(address,uint256)
  • aave_withdraw(address,uint256) → withdraw(address,uint256)
  • aave_getDepositRateLimitKey(address,address,address) → getDepositRateLimitKey(address,address,address)
  • aave_getWithdrawRateLimitKey(address,address) → getWithdrawRateLimitKey(address,address)
  • aave_VERSION() → VERSION()

CCTP_FACET

  • cctp_setDomainParameters(uint32,bytes32,uint32,uint32) → setDomainParameters(uint32,bytes32,uint32,uint32)
  • cctp_transfer(uint256,uint32,uint64) → transfer(uint256,uint32,uint64)
  • cctp_toCCTPRateLimitKey() → toCCTPRateLimitKey()
  • cctp_getDomainParameters(uint32) → getDomainParameters(uint32)
  • cctp_getToDomainRateLimitKey(uint32) → getToDomainRateLimitKey(uint32)
  • cctp_VERSION() → VERSION()
  • cctp_DESTINATION_CALLER() → DESTINATION_CALLER()
  • cctp_MIN_FINALITY_THRESHOLD() → MIN_FINALITY_THRESHOLD()
  • cctp_cctp() → cctp()
  • cctp_usdc() → usdc()

ERC4626_FACET

  • erc4626_setMaxExchangeRate(address,uint256,uint256) → setMaxExchangeRate(address,uint256,uint256)
  • erc4626_deposit(address,uint256,uint256) → deposit(address,uint256,uint256)
  • erc4626_withdraw(address,uint256,uint256) → withdraw(address,uint256,uint256)
  • erc4626_redeem(address,uint256,uint256) → redeem(address,uint256,uint256)
  • erc4626_EXCHANGE_RATE_PRECISION() → EXCHANGE_RATE_PRECISION()
  • erc4626_getMaxExchangeRate(address) → getMaxExchangeRate(address)
  • erc4626_getDepositRateLimitKey(address,address) → getDepositRateLimitKey(address,address)
  • erc4626_getWithdrawRateLimitKey(address) → getWithdrawRateLimitKey(address)
  • erc4626_VERSION() → VERSION()

LAYER_ZERO_FACET

  • layerZero_setRecipient(uint32,bytes32) → setRecipient(uint32,bytes32)
  • layerZero_transfer(address,uint256,uint32) → transfer(address,uint256,uint32)
  • layerZero_getRecipient(uint32) → getRecipient(uint32)
  • layerZero_getTransferRateLimitKey(address,bytes32,uint32,address) → getTransferRateLimitKey(address,bytes32,uint32,address)
  • layerZero_quoteTransfer(address,uint256,uint32) → quoteTransfer(address,uint256,uint32)
  • layerZero_VERSION() → VERSION()

SPARK_VAULT_FACET

  • sparkVault_take(address,uint256) → take(address,uint256)
  • sparkVault_getTakeRateLimitKey(address) → getTakeRateLimitKey(address)
  • sparkVault_VERSION() → VERSION()

TRANSFER_ASSET_FACET

  • transferAsset_transfer(address,address,uint256) → transfer(address,address,uint256)
  • transferAsset_getTransferRateLimitKey(address,address) → getTransferRateLimitKey(address,address)
  • transferAsset_VERSION() → VERSION()

UNISWAP_V4_FACET

  • uniswapV4_setMaxSlippage(bytes32,uint256) → setMaxSlippage(bytes32,uint256)
  • uniswapV4_setTickLimits(bytes32,int24,int24,uint24) → setTickLimits(bytes32,int24,int24,uint24)
  • uniswapV4_mintPosition(bytes32,int24,int24,uint128,uint128,uint128) → mintPosition(bytes32,int24,int24,uint128,uint128,uint128)
  • uniswapV4_increasePosition(bytes32,uint256,uint128,uint128,uint128) → increasePosition(bytes32,uint256,uint128,uint128,uint128)
  • uniswapV4_decreasePosition(bytes32,uint256,uint128,uint128,uint128) → decreasePosition(bytes32,uint256,uint128,uint128,uint128)
  • uniswapV4_swap((address,address,uint24,int24,address),address,uint128,uint128) → NOT IN FACET
  • uniswapV4_getAggregateDepositRateLimitKey(bytes32) → getAggregateDepositRateLimitKey(bytes32)
  • uniswapV4_getAssetDepositRateLimitKey(bytes32,address) → getAssetDepositRateLimitKey(bytes32,address)
  • uniswapV4_getMaxSlippage(bytes32) → getMaxSlippage(bytes32)
  • uniswapV4_getSwapRateLimitKey(bytes32,address) → getSwapRateLimitKey(bytes32,address)
  • uniswapV4_getTickLimits(bytes32) → getTickLimits(bytes32)
  • uniswapV4_getAggregateWithdrawRateLimitKey(bytes32) → getAggregateWithdrawRateLimitKey(bytes32)
  • uniswapV4_getAssetWithdrawRateLimitKey(bytes32,address) → getAssetWithdrawRateLimitKey(bytes32,address)
  • uniswapV4_VERSION() → VERSION()
  • uniswapV4_permit2() → permit2()
  • uniswapV4_positionManager() → positionManager()
  • uniswapV4_router() → router()

[Ethereum] Wire tables

CCTP_FACET

  • cctp_setDomainParameters(uint32,bytes32,uint32,uint32) → setDomainParameters(uint32,bytes32,uint32,uint32)
  • cctp_transfer(uint256,uint32,uint64) → transfer(uint256,uint32,uint64)
  • cctp_toCCTPRateLimitKey() → toCCTPRateLimitKey()
  • cctp_getDomainParameters(uint32) → getDomainParameters(uint32)
  • cctp_getToDomainRateLimitKey(uint32) → getToDomainRateLimitKey(uint32)
  • cctp_VERSION() → VERSION()
  • cctp_DESTINATION_CALLER() → DESTINATION_CALLER()
  • cctp_MIN_FINALITY_THRESHOLD() → MIN_FINALITY_THRESHOLD()
  • cctp_cctp() → cctp()
  • cctp_usdc() → usdc()

ERC4626_FACET

  • erc4626_setMaxExchangeRate(address,uint256,uint256) → setMaxExchangeRate(address,uint256,uint256)
  • erc4626_deposit(address,uint256,uint256) → deposit(address,uint256,uint256)
  • erc4626_withdraw(address,uint256,uint256) → withdraw(address,uint256,uint256)
  • erc4626_redeem(address,uint256,uint256) → redeem(address,uint256,uint256)
  • erc4626_EXCHANGE_RATE_PRECISION() → EXCHANGE_RATE_PRECISION()
  • erc4626_getMaxExchangeRate(address) → getMaxExchangeRate(address)
  • erc4626_getDepositRateLimitKey(address,address) → getDepositRateLimitKey(address,address)
  • erc4626_getWithdrawRateLimitKey(address) → getWithdrawRateLimitKey(address)
  • erc4626_VERSION() → VERSION()

SPARK_VAULT_FACET

  • sparkVault_take(address,uint256) → take(address,uint256)
  • sparkVault_getTakeRateLimitKey(address) → getTakeRateLimitKey(address)
  • sparkVault_VERSION() → VERSION()

TRANSFER_ASSET_FACET

  • transferAsset_transfer(address,address,uint256) → transfer(address,address,uint256)
  • transferAsset_getTransferRateLimitKey(address,address) → getTransferRateLimitKey(address,address)
  • transferAsset_VERSION() → VERSION()

Integrations

[XLayer] Integration state

CCTP_FACET

Constants / immutables

  • cctp (TokenMessenger): CCTP_TOKEN_MESSENGER
  • usdc: 0xB6CEceAB302E2E4948951eE7843FC24E92933061
  • DESTINATION_CALLER: 0x0
  • MIN_FINALITY_THRESHOLD: 2000

Domain parameters

  • domain 0 (Ethereum) mintRecipient: Ethereum.SPUSDC_PAU_ALM_PROXY, minFeeCapRate: 0, maxFeeCapRate: 0

Rate limits

  • rate limit toCCTP: UNLIMITED
  • rate limit toDomain 0: maxAmount 10,000,000 USDC, slope 2,893,518,518 per second (~250M USDC/day refill)

TRANSFER_ASSET_FACET

Rate limits

  • rate limit transfer(USDC → SPARK_VAULT_V2_SPUSDC): UNLIMITED

SPARK_VAULT_FACET

Rate limits

  • rate limit take(SPARK_VAULT_V2_SPUSDC): UNLIMITED

SPARK_VAULT_V2_SPUSDC

Baseline state

  • name: “Spark Savings USDC”
  • symbol: spUSDC
  • decimals: 6
  • asset: USDC (0xB6CEceAB302E2E4948951eE7843FC24E92933061)
  • totalSupply: 1000000
  • totalAssets: 1000000
  • assetsOutstanding: 0
  • depositCap: 500000000000000

Rate mechanics

  • vsr: 1e27
  • chi: 1e27
  • nowChi: 1e27
  • rho: 1789384341
  • minVsr: 1e27
  • maxVsr: 1000000001847694957439350563

[Ethereum] Integration state

CCTP_FACET

Constants / immutables

  • cctp (TokenMessenger): CCTP_TOKEN_MESSENGER
  • usdc: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
  • DESTINATION_CALLER: 0x0
  • MIN_FINALITY_THRESHOLD: 2000

Domain parameters

  • domain 37 (XLayer): mintRecipient = XLayer.SPUSDC_PAU_ALM_PROXY, minFeeCapRate = 0, maxFeeCapRate = 0
  • other domains: not configured

Rate limits

  • rate limit toCCTP: UNLIMITED
  • rate limit toDomain 37: maxAmount = 10,000,000 USDC, slope = 2,893,518,518 /s (~250M USDC/day refill)

ERC4626_FACET

Constants

  • EXCHANGE_RATE_PRECISION: 1e36

Configured token

  • token: Ethereum.sUSDC, maxExchangeRate = 1e25

Rate limits

  • rate limit deposit: UNLIMITED
  • rate limit withdraw: UNLIMITED