Smart Contracts

Contract Addresses & Overview

Contract Addresses

Ethereum Mainnet

• AllowlistV2 Proxy - https://etherscan.io/address/0x02f1fa8b196d21c7b733eb2700b825611d8a38e5

• USTB Token Proxy - https://etherscan.io/address/0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e

• USCC Token Proxy - https://etherscan.io/address/0x14d60e7fdc0d71d8611742720e4c50e7a974020c

• USTB RedemptionIdle Proxy - https://etherscan.io/address/0x4c21b7577c8fe8b0b0669165ee7c8f67fa1454cf

• Superstate USTB Continuous Price Oracle - https://etherscan.io/address/0xe4fa682f94610ccd170680cc3b045d77d9e528a8

• Chainlink USTB Oracle - https://etherscan.io/address/0x289B5036cd942e619E1Ee48670F98d214E745AAC

• Chainlink USCC Oracle - https://etherscan.io/address/0xAfFd8F5578E8590665de561bdE9E7BAdb99300d9

Sepolia Testnet

• AllowlistV2 Proxy - https://sepolia.etherscan.io/address/0x4b056c23abf9a4c94ec10821b731ced73601a845

• USTB Token Proxy -https://sepolia.etherscan.io/address/0x03891c84c877d68da8d3e4189b74c3e44a1c2b63

• USCC Token Proxy - https://sepolia.etherscan.io/address/0x862776CC41B728c43D9375Abc65c9CEda6547E2

• USTB RedemptionIdle Proxy - https://sepolia.etherscan.io/address/0xd33d340cdbef8e879c827199bd7d9705b21e18c9

• Superstate USTB Continuous Price Oracle - https://sepolia.etherscan.io/address/0xba595155585b3572f17ee1050d8c6fb9653fcb93

• Chainlink USTB Oracle - https://sepolia.etherscan.io/address/0x732d3C7515356eAB22E3F3DcA183c5c65102d518

• Chainlink USCC Oracle - https://sepolia.etherscan.io/address/0xE38b0917888d0d5d8d03B7371d5214A1aF8e1892

Our smart contracts are upgradable and various functions are gated behind the Superstate Admin Address calling them. This includes all minting, adding or removing users from the allowlist, and forcibly burning an investor’s tokens (if required by exogenous legal circumstances, for example).

Code Repositories

• Github - USTB

• Github - on-chain redemptions

Audits

• https://chainsecurity.com/security-audit/compound-suptb/

• https://0xmacro.com/library/audits/superstate-1

• https://0xmacro.com/library/audits/superstate-2

• https://0xmacro.com/library/audits/superstate-3

• https://0xmacro.com/library/audits/superstate-4

USTB and USCC Shared Functionality Overview

A standard Upgradable OpenZeppelin ERC-20 implementation with a few changes:

1. USTB/USCC check that all holders are on the Superstate controlled Allowlist contract and are authorized for that token.

2. Encumber functionality (see below)

3. Burn - Investors can call the burn function or transfer their USTB/USCC to the contract address to kick off a redemption

4. Mint - Superstate can call the mint function to mint new shares of USTB/USCC when investors subscribe to the fund

Transfers

USTB/USCC is freely transferrable between Ethereum addresses that are on the Allowlist via transfer or transferFrom. Each function checks that the sender and receiver are both on the Allowlist and authorized for that specific token.

Allowlist

Adds/Removes Ethereum addresses to/from the allowlist with certain permissions. Right now, only the first two booleans in the Permission struct are used. Permission.isAllowed means the entity is onboarded to USTB. Permission.state1 means the entity is onboarded to USCC. Ethereum addresses are also grouped by their Entity Id. Entity Ids are how Superstate identifies investors. The USTB/USCC token contract calls isAddressAllowedForFund on the Allowlist contract to see if the sender and receiver of USTB are allowed to hold it. Only the Superstate Admin Address can make any changes to the allowlist, using the following functions setEntityAllowedForFund, setProtocolAddressPermission, setProtocolAddressPermissions, setEntityIdForAddress, setEntityIdForMultipleAddresses, setEntityPermissionsAndAddresses.

We call these functions when onboarding or offboarding an investor. We only add Ethereum addresses for investors that have made it through our KYC / Investment Agreement processes. However, Superstate Inc. audited DeFi protocols may be added to the allowlist at our discretion.

USTB Specific Functionality

Subscribe function

Protocols can mint USTB by calling the subscribe function on the Ethereum USTB contract. This function atomically transfers the investor’s USDC to Superstate, and newly minted USTB into the investor’s wallet in one transaction. The price per share is read from the Superstate USTB Continuous Price oracle contract. There are no limits for subscriptions.

Users must call approve on the USDC contract before calling subscribe on the USTB contract.

DeFi Protocols will be interested in the calculateSuperstateTokenOut(uint256 inAmount, address stablecoin) returns (uint256 superstateTokenOutAmount, uint256 stablecoinInAmountAfterFee, uint256 feeOnStablecoinInAmount) function, also on the USTB contract. Given an inAmount of stablecoin it will give you the superstateTokenOutAmount you should expect to receive back accounting for fees.

At time of writing, fees are set to 0 and only USDC is supported. For more information, please visit superstate.co/ustb.

RedemptionIdle Contract

Redeem function

The RedemptionIdle contract holds USDC liquidity while waiting to facilitate USTB redemptions. Investors can call the redeem function on the contract to burn USTB from the investor’s wallet and receive USDC in one transaction. USDC liquidity will be replenished in this contract regularly to facilitate protocol redemptions. The redeem function will revert if there is not enough USDC in the contract to match the superstateTokenInAmount.

Users must call approve on the USDC contract before calling redeem on the RedemptionIdle contract.

DeFi Protocols will be interested in the calculateUstbIn(uint256 usdcOutAmount) returns (uint256 ustbInAmount, uint256 usdPerUstbChainlinkRaw) function. This function takes a desired amount of USDC and returns how much USTB is needed for the superstateTokenInAmount argument of the redeem function to reach the usdcOutAmount. This function always rounds up, so the user will always hit or exceed the usdcOutAmount.

At time of writing, fees are set to 0 and only USDC is supported or more information please visit superstate.co/ustb.

Superstate USTB Continuous Price Oracle

A custom onchain oracle to facilitate continuous pricing onchain, which powers Atomic Subscriptions and Redemptions. The oracle receives pricing updates from Superstate every time a new Net Asset Value per Share (NAV/S) is calculated by our NAV Calculation Agent partner. When a continuous price is requested, the Oracle does linear extrapolation using the two newest NAV/S checkpoints to calculate it.

Any smart contract can request a continuous price onchain. The Oracle contract uses the Chainlink AggregatorV3Interface, so it works out of the box with any Chainlink data feed integrations. https://docs.chain.link/data-feeds/api-reference#functions-in-aggregatorv3interface

Chainlink USTB/USCC Oracle

Chainlink puts the USTB/USCC Net Asset Value per Share price onchain once per day. The Oracle contract uses the AggregatorV3Interface.https://docs.chain.link/data-feeds/api-reference#functions-in-aggregatorv3interface

This oracle has the daily USTB/USCC NAV/S price and can be used like any other Chainlink oracle.

Bug Bounty Program

Superstate encourages the community to audit our contracts and security; we also encourage the responsible disclosure of any issues. This program is intended to recognize the value of working with the community of independent security researchers.

Rewards

Superstate offers substantial rewards for discoveries that can prevent the loss of assets, the freezing of assets, or material harm to a user, commensurate with the severity and exploitability of the vulnerability. We will pay a reward of $1,000 to $100,000 for unique discoveries that are reported responsibly.

Disclosure

Submit all bug bounty disclosures to [e-mail]. The disclosure must include clear and concise steps to reproduce the discovered vulnerability in either written or video format. We will follow up promptly with acknowledgement of the disclosure.