Sky (formerly Maker) savings

Effective control: hybrid. Savings USDS. Inherits the USDS reserve mix.

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

Sky is Maker renamed. Deposit USDS, receive sUSDS; the token count never changes and the redemption ratio rises with the Sky Savings Rate, a governance-set parameter, not a market rate. Three streams pay it: T-bill exposure held through allocator vehicles (Monetalis, BlockTower, Coinbase, Grove), borrow fees from SparkLend and other Sky-run lending, and stability fees on crypto vaults. Backing is roughly 40% tokenised T-bills, 38% USDC in the peg stability module, and 22% crypto collateral; split. Protocol TVL is $5.53B, down from a $7.52B March 2026 peak. The record is why an Ethereum read at block 25,760,405 pinned 4,175,526,048.552116 USDC in LitePSM pocket `0x37305B1cD40574E4C5Ce33f8e8306Be057fD7341`, with LitePSM tin and tout both zero and buf exactly 800,000,000 DAI. Protocol TVL is $5.53B, down from a $7.52B March 2026 peak. The record is why split. Protocol TVL is $5.53B, down from a $7.52B March 2026 peak. The record is why we hold it at all: over eight years of the same accounting engine with no core-contract exploit. Black Thursday (March 2020) left roughly $4-4.5M of bad debt that MKR auctions recapitalised, and during the March 2023 SVB weekend DAI traded broadly in lockstep with USDC through the PSM; the Fed’s hourly series bottoms near $0.90 and records an approximately $0.86 intraday USDC trough before both recovered. A $10M Immunefi bounty guards roughly $5.5B. This memo approves only Ethereum USDS/sUSDS; Base and Arbitrum routes require separate chain-specific decisions. The exit is the strongest in the category: sUSDS redeems to USDS instantly at the contract ratio with no queue and no fee, the converter swaps USDS to DAI 1:1 without cap, and the LitePSM swaps to USDC at par with fees at zero against that $4.2B pocket. Three findings from this review cut the cap from 15% to 10%. First, the emergency shutdown module was disabled in May 2025: the May 15 executive set its trigger threshold to infinity, per the governance record. That module was a holder’s last-resort pro-rata claim on collateral without governance’s cooperation; the original memo never mentioned it, and it is gone. Second, the savings rate ran genuinely subsidised: Sky’s own reporting shows a $13.51M net loss in Q1 2025, the buffer paying savers more than the portfolio earned, before governance cut the rate from 4.75% to 3.60%; Q1 2026 is back to a $46.04M surplus. The cut supports the approval, but the rate is a policy, and the policy can pay from reserves. Third, USDS remains upgradeable, but the Ethereum proxy `0xdC035D45d973E3EC169d2276DDab16f1e407384F` pointed at implementation `0x1923dfee706a8e78157416c29cbccfde7cdf4102` at block 25,760,405; the verified implementation exposes transfers, mint, burn and authorized UUPS upgrades but no holder freeze or blocklist function. Governance can still add one by upgrade. A savings token that can gain a freeze switch, with its final backstop removed, stays a yield leg, never a sovereignty one, and it carries a smaller sleeve.

Kill criteria: the events that revoke this verdict
• USDS freeze or blocklist function activated on-chain: exit immediately
• Savings rate cut by more than 200bps in a single governance cycle
• Savings rate paid above portfolio yield for two consecutive quarters, a repeat of the Q1 2025 net loss
• LitePSM pocket USDC below $1B, tin/tout fees moved off zero, or any redemption gate or delay introduced
• USDC share of USDS backing rising above 50%
• Structured-credit (CLO) exposure entering USDS backing directly
• Failure or default of a named RWA allocator counterparty
• An emergency or founder-driven executive spell that removes another holder protection, as the May 2025 spell removed emergency shutdown

The research file

The mechanism

sUSDS is a non-rebasing savings token: deposit USDS, the contract mints sUSDS at the current redemption ratio, and the ratio rises as the Sky Savings Rate accrues per second. The holder’s token count never changes; the price of each sUSDS in USDS rises. sDAI does the same against the older Dai Savings Rate. Docs and third parties agree, and it is how the on-chain contracts behave. The rate is a governance-set parameter, not a market-clearing rate.

Three internal streams fund the rate, per Sky’s own material and third-party summaries: real-world-asset collateral, mostly US T-bill exposure, the largest single revenue source; borrow rates paid on SparkLend and other Sky-ecosystem lending; and stability fees on the crypto-collateral vaults of the original CDP system. When the streams earn more than the rate costs, the excess flows to the surplus buffer; when they earn less, the buffer pays the gap until governance cuts the rate. Both directions have happened.

Current rates from DefiLlama at 2026-08-14: sUSDS 3.52% APY on $4.73B; sDAI 1.25% on $206M; the separate stUSDS risk-capital product 5.68% on $204M. Third parties report governance cut the savings rate from 4.75% to 3.60% to rebuild the surplus buffer, framed as a shift from competing on yield to balance-sheet strength.

Who controls it

The 1:24,000 MKR-to-SKY conversion became canonical on 2025-09-18, with a Delayed Upgrade Penalty starting the same day: unmigrated MKR loses 1% of its SKY per conversion, rising 1% every three months. Third parties reported 75 to 81% of MKR migrated by late 2025, with roughly 176,070 MKR, over $316M, still unconverted at that count. SKY is the live voting token on vote.sky.money.

Emergency shutdown is disabled. The May 15, 2025 executive, MKR-to-SKY Upgrade Phase One, set the MKR threshold required to trigger the Emergency Shutdown Module to infinity and added Protego, a tool for dropping malicious queued spells, to the chainlog. Emergency shutdown was the mechanism that let any holder redeem pro-rata against collateral if governance failed or turned hostile; it no longer has a reachable trigger. Executive spells act only after the GSM Pause Delay, currently 48 hours per the governance portal material, the window Protego and emergency spells exist to use.

On concentration: Blockworks reported a 2025 emergency proposal, described as a strategic voting manoeuvre by founder Rune Christensen, that rewrote USDS borrowing rules for MKR holders and set off a governance debate. Whatever the merits, an emergency spell driven by the founder is evidence that a single actor can move the protocol quickly.

On the freeze function: in August 2024 the Sky rebrand drew fire over a planned freeze function in USDS. The verified facts are that Christensen stated DAI stays immutable and only USDS would get the function, that it was not live at launch, and that LlamaRisk’s September 2024 review states USDS will not have it integrated at launch but is designed with upgradeability allowing implementation through a governance vote. USDS is therefore an upgradeable token whose issuer has publicly planned a freeze and blocklist capability, in contrast to DAI. Third parties, including Adam Cochran as quoted in coverage, framed the freeze as the price of T-bill backing and TradFi integration. The current Ethereum state is now pinned: EIP-1967 storage for USDS proxy `0xdC035D45d973E3EC169d2276DDab16f1e407384F` resolved to Usds implementation `0x1923dfee706a8e78157416c29cbccfde7cdf4102` at block 25,760,405. Its verified source has authorized UUPS upgrades but no freeze, blacklist or blocklist method. That proves current absence, not immutability: governance can replace the implementation.

On oracles: the savings rate needs no external oracle, since the sUSDS/USDS exchange rate is an internal accumulator. Price oracles matter for the crypto-collateral vaults, which use Maker-lineage oracle modules with delayed feeds. Cross-chain sUSDS uses an SSR rate oracle, but those representations are outside this Ethereum-only approval. The depth of the current oracle operator set was not re-verified.

The backing

The memo’s split, roughly 40% tokenised T-bills, 38% USDC in the Peg Stability Module, and 22% crypto collateral, matches what third parties report for 2026: roughly 40% RWA via allocators, 35 to 38% USDC in the PSM, and the balance in ETH, staked ETH, WBTC and other crypto vaults. The current contract-level observation is exact: at Ethereum block 25,760,405 the USDC `balanceOf` for LitePSM pocket `0x37305B1cD40574E4C5Ce33f8e8306Be057fD7341` returned 4,175,526,048.552116 USDC. Sky’s own position-level breakdown at financial.skyeco.com is a JS app that could not be read programmatically for this pass, so the broader percentages remain estimates rather than an exact primary balance-sheet reconciliation.

The PSM is the peg, and it transmitted the SVB shock. In March 2023 Circle disclosed $3.3B of USDC reserves stuck at Silicon Valley Bank. The Federal Reserve’s granular study records an approximately $0.86 intraday USDC trough; its hourly-open chart bottoms around $0.90. Because Maker held billions of USDC in the PSM, roughly $1B of USDC entered the module on each of March 10 and 11 as traders exchanged stressed USDC for newly minted DAI. The Fed finds DAI and USDC then traded broadly in lockstep while the PSM remained available, directly transmitting the discount. Arbitrageurs also drained the USDP and GUSD PSMs at par, spreading the discount. Maker passed an emergency parameter spell on March 13, and after the depeg governance voted to keep USDC as the primary reserve. The lesson stands: whatever the T-bill share, the PSM makes the USDS peg a levered claim on Circle in a stress week.

The T-bill exposure runs through allocator vehicles, not direct protocol custody. Named counterparties across the lineage and present: Monetalis Clydesdale, which grew to about $1.25B of T-bill exposure; BlockTower’s Andromeda; Coinbase, through a $500M Treasury arrangement, with the LitePSM pocket USDC sitting with Coinbase Web3 custody arrangements per the LitePSM design docs; and since 2025 the Star and agent allocator system, including Grove. Verifying the off-chain T-bills exist means trusting each allocator’s attestations; there is no single custodian and no consolidated third-party audit of the RWA stack that this pass could locate. Newer coverage says Sky routes PSM USDC into T-bills through Sky Agents, so the USDC and T-bill buckets are operationally linked.

Structured credit sits one step away. Grove launched June 2025 with a $1B allocation from the Sky ecosystem into the Janus Henderson Anemoy AAA CLO strategy (JAAA) on Centrifuge, the first fully on-chain CLO strategy. Whether JAAA exposure is inside USDS backing proper or held one step removed in a Star balance sheet could not be pinned down.

The record

Single-collateral DAI shipped December 2017; multi-collateral DAI November 2019; the Sky rebrand and USDS/sUSDS August to September 2024; the MKR-to-SKY finalisation September 2025. That is over eight years of the same core accounting engine in production, and no exploit of the core Maker or Sky contracts is on record in any source this pass touched. The failures were economic, not contract bugs.

Black Thursday, March 12 to 13, 2020: ETH fell over 40% in hours, Ethereum congestion froze keeper bots, and liquidation auctions cleared at zero bids. One bot took $8.32M of ETH for free. Vault owners lost collateral outright, and the system was left with roughly $4 to 4.5M in bad debt; sources vary within that range. Maker recapitalised by minting and auctioning MKR on March 19, 2020, the mechanism working as designed. A class action over the liquidations settled for $1.16M in 2022, and governance voted not to compensate vault owners directly.

During the March 2023 SVB depeg, the Fed’s hourly series for affected stablecoins bottoms near $0.90, while it records an approximately $0.86 intraday trough for USDC. DAI moved broadly in lockstep with USDC through the PSM and recovered when USDC redemption operations and confidence returned.

DefiLlama on 2026-08-14: Sky protocol TVL $5.53B, of which the sUSDS savings pool is $4.73B; USDS supply $6.66B and DAI $4.78B. Third parties reported a March 2026 local high of $7.52B TVL, so the current figure is off about 26% from that peak. USDS is the number-three stablecoin by market cap per multiple trackers.

Third parties report the USDS and sUSDS token contracts were audited by ChainSecurity and Cantina in 2024; the Maker MCD core carries audit history from its 2019 launch era. Sky runs an Immunefi bug bounty paying up to $10M, one of the largest live bounties in DeFi, against roughly $5.5B of TVL. The bounty-to-TVL ratio is strong; contrast StakeWise’s $200k against $700M.

The exit

The exit is primary redemption, not DEX depth, and today it is deep. sUSDS burns to USDS at the contract’s current ratio, instant, no queue, no fee, capacity limited only by the savings contract itself; sDAI to DAI works the same. The converter contract swaps USDS to DAI 1:1 both ways with no cap. The LitePSM swaps USDS or DAI to USDC at par. At block 25,760,405, calls to LitePSM `0xf6e72Db5454dd049d0788e411b06CfAF16853042` returned tin=0, tout=0 and buf=800,000,000 DAI, while the named pocket held 4,175,526,048.552116 USDC. A full sleeve exit for any realistic client book is a rounding error against that observed pocket, although capacity can change after the read.

Secondary DEX depth for sUSDS itself is thin relative to that; third parties note USDS has a small fraction of USDT’s exchange volume and yield-bearing pairs on Curve are shallow. But secondary depth is the wrong door here; the primary route is the exit and it has no cooldown. Two caveats: PSM capacity is exactly what drains first in a USDC or USDS stress, and March 2023 showed the PSM running one way. Base and Arbitrum exit through separate Spark PSM3 and cross-chain components and are expressly outside this approval.

The subsidy

Is the savings rate paid out of reserves rather than earnings? Today, no; in 2025, yes. Sky’s Q1 2026 results, as carried by third parties from Sky’s own reporting: $123.79M gross revenue, $46.04M net protocol surplus, 49% net margin. The same reporting states Q1 2025 ran a net loss of $13.51M, meaning for at least that quarter the savings rate plus expenses exceeded portfolio income and the surplus buffer absorbed the gap. Governance then cut the rate from 4.75% to 3.60% explicitly to rebuild the buffer.

So the mechanism is real and recently exercised in both directions: the rate can be subsidised, and governance has shown it will cut the rate rather than run the buffer down indefinitely. For a client, the yield leg can lose 100-plus basis points in a governance cycle for balance-sheet reasons unrelated to market rates, which is exactly why this is a yield sleeve with a rate-cut kill criterion and not a sovereignty position.

What the sleeve watches

The rate-cut criterion is wired to executive spells on vote.sky.money and the ssr parameter; the 2026 cut from 4.75 to 3.60 was 115 basis points and did not trip the 200-basis-point threshold, though whether it landed in one spell or in steps is open. Structured-credit entry into USDS backing is watched through the financial.skyeco.com position lines and Grove and Star allocation votes, for JAAA or any structured-credit line appearing in the USDS collateral table rather than a Star balance sheet. The surplus buffer is on-chain in the vow; a quarter of net losses per Sky’s own reporting is the signal, and Q1 2025 shows what it looks like. Redemption gates are watched as LitePSM tin or tout moving off zero, the pocket draining below roughly $1B, or any spell touching the converter.

Two watch items this review added. A freeze-function activation on USDS would arrive as an executive spell upgrading the token, a discrete, watchable event that changes the custody character of the asset advisors hold. And governance emergency actions, a founder-driven emergency spell on the 2025 precedent or any further dismantling of holder protections in the ESM’s absence, are the class of event that removed emergency shutdown in the first place; nothing was added then, a backstop was removed, so gate-watching alone does not cover it.

Comparison and approved-with-limits decision

Compared with supplying USDC to an overcollateralized lending market, sUSDS does not make the holder wait for borrower utilization to fall before redeeming: the contract converts to USDS at its internal ratio and the mainnet LitePSM provides the next USDC leg while its pocket is funded. In exchange, the holder accepts Sky governance setting the savings rate, changing token and PSM code, selecting RWA allocators and controlling the surplus buffer. Compared with BUIDL or OpenEden TBILL, sUSDS is not a fund share in identified Treasury bills and is not limited to an investor allowlist, but its backing is a mixed balance sheet that includes USDC, crypto collateral and off-chain allocator claims rather than a short-government-only mandate. Compared with holding USDC without yield, sUSDS adds Sky contract, governance and backing risk on top of Circle exposure. Those trade-offs support approved-with-limits at 10%, not equivalence to cash or a Treasury fund; the LitePSM, backing-mix and governance criteria are the conditions that keep that approval in force.

Open questions

Freeze-function status is resolved for the observed block, not forever. USDS proxy implementation storage and verified source show no freeze or blocklist at block 25,760,405. The open risk is a future governance-authorized UUPS upgrade; an implementation change must be diffed before this finding is carried forward.

Exact current backing percentages from a primary source. financial.skyeco.com is the primary source and was not machine-readable in this pass; the split rests on third-party reports plus the exact block-25,760,405 PSM reads. Those reads settle pocket, tin, tout and buf at one block but do not reconcile the entire Sky balance sheet.

Whether JAAA CLO exposure touches USDS backing directly or sits only in Grove’s Star balance sheet, and whether the loss waterfall walls it off.

srUSDS status. The original memo called the senior layer planned; this pass found the stUSDS risk-capital token live, about $204M at 5.68%, but did not confirm srUSDS as a shipped senior tranche. The junior shipping before the senior is worth confirming against the Credora report the memo cites.

MCD engine, as opposed to the 2024 token contracts, which was not located; and whether the 4.75-to-3.60 rate cut happened in a single governance cycle or in The current oracle operator set; post-2019 audit coverage of the core MCD engine, as opposed to the 2024 token contracts, which was not located; and whether the 4.75-to-3.60 rate cut happened in a single governance cycle or in MCD engine, as opposed to the 2024 token contracts, which was not located; and whether the 4.75-to-3.60 rate cut happened in a single governance cycle or in steps, the only question that decides how close it came to the 200-basis-point kill criterion.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Sky executive vote, May 15 2025 (ESM threshold to infinity, Protego) · primary · accessed 2026-08-14
  Supports: emergency shutdown threshold set to infinity, Protego chainlog addition, executive-spell governance
• LlamaRisk USDS review, September 2024 (freeze design) · secondary · accessed 2026-08-14
  Supports: USDS upgradeability, freeze and blocklist design, DAI distinction, launch control state
• Sky Frontier Foundation — Q1 2026 ecosystem report · primary · accessed 2026-08-15
  Supports: $123.79M gross revenue, $46.04M net surplus, $13.03B collateral, $11.70B USDS supply, $6.49B sUSDS quarter-end supply
• Federal Reserve FEDS Note — SVB, stablecoin runs, and Dai PSM contagion · primary · accessed 2026-08-14
  Supports: SVB stablecoin depeg prices, USDC-to-Dai PSM contagion, March 2023 PSM flows
• Sky developer docs (converter, LitePSM) · primary · accessed 2026-08-14
  Supports: sUSDS conversion mechanism, USDS-to-DAI converter, LitePSM architecture, cross-chain SSR dependencies
• Sky Protocol Navigator — active Ethereum LitePSM deployment · primary · accessed 2026-08-15
  Supports: LitePSM address, USDC pocket address, Ethereum deployment, wrapper route
• Sky dss-lite-psm repository — deployment and read interface · primary · accessed 2026-08-15
  Supports: LitePSM and pocket addresses, tin tout and buf interface, USDC balance custody
• Ethereum Blockscout — LitePSM contract state at the cited deployment · primary · accessed 2026-08-15
  Supports: block-25760405 tin read, block-25760405 tout read, block-25760405 buf read, verified LitePSM contract
• Ethereum Blockscout — LitePSM USDC pocket · primary · accessed 2026-08-15
  Supports: block-25760405 USDC balance, pocket identity, redemption capacity observation
• Blockscout verified USDS implementation at the observed proxy slot · primary · accessed 2026-08-15
  Supports: current Usds implementation source, authorized UUPS upgrade, no freeze or blocklist method
• Immunefi Sky bug bounty ($10M) · primary · accessed 2026-08-14
  Supports: $10M maximum bounty, in-scope contracts, severity and payment terms

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.

Live positions