Clearstar
Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.
REJECTED — CLEARSTAR’S OWN PUBLISHED DUE-DILIGENCE STANDARD DESCRIBES ITS OWN VAULT STRUCTURE AS A DISQUALIFIER. Clearstar runs curated Morpho vaults, plus positions on Euler, Flare, Upshift, IPOR, OpenEden, and Spectra, across eleven chains, holding roughly $183M. Every Clearstar Morpho vault checked in this review shares one owner address and one curator address, and a direct on-chain code check on Base confirms both are plain externally-owned accounts, not multisigs — single-key control over risk parameters and admin functions across an eleven-chain, $183M curator. Clearstar’s own published due-diligence framework, used to score third-party protocols it reviews, explicitly lists ”unclear admin rights — unverified multisigs, unknown signers, EOA admin keys” as a red flag; that description matches its own vaults’ control structure, which is not among the protocols it has published a report on. Separately, its own legal disclosures are internally inconsistent: marketing describes Clearstar as ”a Swiss risk curation firm” founded in 2022, but its Terms of Service name the actual website operator as NovaFusion S.A., a Panamanian company, licensing IP from a separately referenced ”Clearstar Labs AG” this review could not independently verify as a registered Swiss entity, and its Legal Notice page states plainly it ”will be refined… as the company legal framework evolves.”
- Vault admin authority moves to a disclosed multisig with named signers and a threshold, replacing the single EOA control confirmed in this review
- A consistent, complete legal-entity disclosure is published, resolving the Swiss-branding-versus-Panama-operator inconsistency
- The cause of the October 2025 to February 2026 TVL swings is identified and confirmed
- Clearstar publishes a due-diligence report on its own curated vaults using its own stated methodology
The research file
Mechanism and TVL composition
A depositor holds an ERC-4626 Morpho-style vault share representing a claim on whatever underlying lending markets Clearstar allocates into. Querying Morpho’s own API directly surfaces 28 Clearstar-branded vaults, but only five hold meaningful balances, combining to roughly $7M — a small fraction of the roughly $183M DefiLlama tracks under the Clearstar curator entity. The bulk of tracked value, concentrated on Base (roughly $77M) and Flare (roughly $59M), sits outside what this review could directly verify through Morpho’s API, on venues (Flare, Upshift, IPOR, OpenEden, Spectra) this review could not independently audit for the same control questions. Redemption on the Morpho vaults follows standard liquidity-gated exit mechanics with no Clearstar-specific lockup disclosed; redemption terms on the non-Morpho venues were not verified.
Single-key control, confirmed on-chain
Every Clearstar Morpho vault checked shares one owner address and one curator address across every chain (a separate vault pair uses a different but similarly single-EOA address pair). A direct `eth_getCode` call against both addresses on Base returned empty bytecode, confirming plain externally-owned accounts rather than a Gnosis Safe or any other multisig contract — a single private key controls risk parameters and admin functions for the vaults this review could verify. Clearstar’s own due-diligence methodology, published on its own site and used to score other protocols’ admin structures, explicitly flags exactly this pattern — unverified multisigs, unknown signers, EOA admin keys — as disqualifying.
Legal structure inconsistency
Clearstar’s About page markets a Swiss origin story and a 2022 founding, but its Terms of Service name the operating entity as NovaFusion S.A., incorporated in the Republic of Panama and registered in the Panamanian mercantile registry, with Panama as the exclusive governing law and jurisdiction. The same Terms reference a separate entity, ”Clearstar Labs AG,” as IP owner licensing the platform to NovaFusion — no independent confirmation of that Swiss entity’s registration was found. The Legal Notice page itself, last updated June 2026, states it ”is a general disclosure for operational use and will be refined with jurisdiction-specific language as the company legal framework evolves” — an admission the disclosure is provisional, not a completed one.
Track record and unexplained TVL swings
DefiLlama began tracking Clearstar in May 2025, roughly three years after the claimed 2022 founding, with no tracked activity or TVL evident before that. DefiLlama lists zero audits and no recorded hacks or funding rounds for Clearstar. TVL on Base and Ethereum each fell roughly 57% between October 2025 and early 2026 before recovering, a swing this review could not attribute to a specific cause — flagged as an open, unexplained data point rather than a confirmed incident, consistent with how this registry has treated similar unexplained swings elsewhere in this batch.
Comparison and decision
Against K3 Capital, already rejected in this batch on total entity opacity, Clearstar discloses more — an operator name and a claimed jurisdiction — but that disclosure is internally contradictory and self-admittedly incomplete, which is its own form of opacity rather than a resolution of it. Clearstar has published four genuinely rigorous due-diligence reports on third-party protocols, each candidly flagging serious structural issues in what it reviewed — real evidence of research capability — but none of those reports cover Clearstar’s own curated vaults, so there is no public self-audit of the firm’s own book to weigh against the on-chain control findings above.
Sources
The claims above trace to these. Where a number could not be independently verified, the thesis says so.
- DefiLlama — Clearstar protocol data · secondary · accessed 2026-08-19
Supports: TVL by chain and history, zero audits and zero hacks fields - Clearstar — Terms of Service · primary · accessed 2026-08-19
Supports: NovaFusion S.A. Panama operating entity, Clearstar Labs AG IP licensing reference, Panama governing law - Clearstar — Legal Notice · primary · accessed 2026-08-19
Supports: admission that legal disclosure is provisional and incomplete - Clearstar — due diligence framework · primary · accessed 2026-08-19
Supports: published red-flag criteria including EOA admin keys and unverified multisigs - Morpho — GraphQL vault query for Clearstar-curated vaults · primary · accessed 2026-08-19
Supports: shared owner and curator addresses across vaults, vault-level balances
Inherited controls
The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.
| Chain | Verdict | Grade | Control constraint |
|---|---|---|---|
| Base | Approved · limits | hybrid | Coinbase — one regulated US company — operates the only sequencer, and admin keys can upgrade bridge contracts within ~7 days. |
| Flare | Approved · limits | crypto-backed | consensus entry is permissionless, but the Foundation monopolizes governance proposals and manually executes some approved changes. |
| Ethereum | Approved | sovereign | No sequencer, no upgrade key, no operator who can be compelled — rule changes require social consensus. |
| Monad | Approved · limits | crypto-backed | the L1 has a public validator path, but its short production record, single initial client lineage, and Foundation-directed delegation keep stake and operations concentrated. |
| Hyperliquid / HyperEVM | Rejected | freezable | a 21-validator permissioned set operates both the chain and its bridge — one compromise reaches both. |
| Starknet | Approved · limits | hybrid | validity proofs and a regular exit window constrain control, but permissioned proposers and an instant emergency Security Council remain live dependencies. |
| Arbitrum One | Approved · limits | hybrid | a single sequencer orders >99% of transactions and admin keys can upgrade bridge contracts on a ~7-day timelock. |
| Polygon PoS | Rejected | hybrid | a public validator set orders transactions, but a 5-of-9 multisig can instantly upgrade staking and canonical bridge contracts, while a 5-of-8 controls custom child tokens. |