chore(reports): add Superstate USCC risk assessment (May 2026)

[spalen0]

Summary

Closes #226. Adds a new risk assessment for Superstate USCC (the Superstate Crypto Carry Fund) at reports/report/superstate-uscc.md.

USCC reuses the USTB V5 contract family and shared AllowList, but the fund itself is materially different:

• Strategy: crypto cash-and-carry (BTC + ETH basis) plus U.S. Treasuries
• Custody: Anchorage Digital + futures venues (identities not publicly disclosed)
• Sub-advisor: Superstate Inc. today, Bitwise effective June 1, 2026

Key onchain findings (verified May 31, 2026)

• USCC token: 0x14d60E7FDC0D71d8611742720E4C50E7a974020c
• USCC implementation: 0x9b7282Cb… (SuperstateTokenV5, VERSION "5")
• ProxyAdmin: 0x2Bb7B8B4…
• Single EOA 0x8abC89D9… owns BOTH the token and its ProxyAdmin — strictly more concentrated than USTB.
• redemptionContract() = 0x0 — no atomic onchain redemption.
• subscribe() reverts with OnchainSubscriptionsDisabled() (selector 0xdbf0cc51) — onchain subscriptions disabled.
• superstateOracle() = 0x0 — only the Chainlink OCR feed exists as an onchain NAV source.
• Onchain supply 12.55M × NAV $11.604523 = **$145.66M onchain** (matches DeFiLlama).

Final tier

Medium Risk (3.06/5.0) — higher than USTB (Low Risk, 2.33) due to:

1. Single-EOA concentration on token + ProxyAdmin.
2. Mark-to-market NAV (basis-trade P&L can produce real share-price drawdowns).
3. No atomic onchain subscribe or redeem.
4. Undisclosed futures-venue counterparty exposure.

Items left as TODO (verifiable claims I couldn't confirm this session)

• 0xMacro audits 10 and 11 — dates/scope not loaded from PDFs.
• Futures venues used by USCC (CME-only? offshore?).
• ETH staking provider identity.
• Top-10 holder concentration on Ethereum.
• Chronicle Labs PoR liveness (dashboard rate-limited during assessment).
• AUM divergence between superstate.com ($258.78M) and rwa.xyz ($197.8M).

Test plan

• Reviewer to spot-check onchain values (totalSupply, owner, redemptionContract, superstateOracle) against the report.
• Reviewer to confirm the Bitwise sub-advisor transition date (Jun 1, 2026).
• Reviewer to gut-check the Medium-Risk tier given the basis-trade exposure.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
risk-score	Ready	Preview, Comment	May 31, 2026 1:07pm