📔Contracts and Security

Deployed contract addresses, token standards, and audit reports

Contract addresses

The latest version of @secured-finance/stablecoin-contracts is deployed at the addresses below. Always verify addresses against this page before interacting with the contracts directly.

USDFC token

Network	Address
Filecoin Mainnet	0x80B98d3aa09ffff255c3ba4A241111Ff1262F045
Filecoin Calibration Testnet	0xb3042734b608a1B16e9e86B374A3f3e389B4cDf0

Past upgrades are recorded in Contract Upgrade History.

Protocol contracts (Filecoin Mainnet)

Contract	Role	Address
BorrowerOperations	Opening, adjusting, and closing Troves	0x1dE3c2e21DD5AF7e5109D2502D0d570D57A1abb0
TroveManager	Liquidations, redemptions, Trove state	0x5aB87c2398454125Dd424425e39c8909bBE16022
StabilityPool	Stability Pool deposits and gains	0x791Ad78bBc58324089D3E0A8689E7D045B9592b5
PriceFeed	FIL/USD price with fallback logic	0x80e651c9739C1ed15A267c11b85361780164A368
RedStone FIL/USD feed	Primary oracle (Chainlink-compatible aggregator operated by RedStone)	0x434F8D17c0301cfEa143dba912972E24B827C968
TellorCaller	Fallback oracle adapter	0x3eA890431C85F40405BBF5BE74D03802672aFe3b
ActivePool	Collateral and debt of active Troves	0x8637Ac7FdBB4c763B72e26504aFb659df71c7803
DefaultPool	Redistributed collateral and debt	0xAda716f497da8EC9F766F9a94779E1b6e73d29fF
CollSurplusPool	Claimable collateral surpluses from liquidations	0x212799bEA5c2ed87D84b9Ae3C1Fb0fdc1bFC7AE9
GasPool	Holds Liquidation Reserves	0xbd73175383ac35b2BfdD89377D9D8BDC11dA1bF8
SortedTroves	Troves ordered by collateral ratio	0x2C32e48e358d5b893C46906b69044D342d8DDd5F
HintHelpers	Gas-efficient operation hints	0xf06A4eBa3B9e45533566a31DA2F213bc44E89E60
MultiTroveGetter	Batch Trove queries	0x5065b1F44fEF55Df7FD91275Fcc2D7567F8bf98F
ProtocolTokenStaking	Fee Reserve — receives protocol fees; unallocated fees are withdrawable by the contract owner (see Protocol Fees)	0xc8707b3d426E7D7A0706C48dcd1A4b83bc220dB3

Testnet addresses for every contract are in the repository's deployments/outputs.

Token standards

USDFC implements:

• ERC-20 — the standard token interface.

• EIP-2612 (permit) — signature-based allowances, so granting an approval doesn't require its own transaction (a transferFrom still moves the tokens).

• EIP-3009 (transferWithAuthorization / receiveWithAuthorization) — signature-authorized transfers. transferWithAuthorization can be submitted by anyone (who pays the gas); receiveWithAuthorization must be submitted by the recipient. Together they enable gasless transfers and x402 payment flows.

EIP-2612 and EIP-3009 support was added by a contract upgrade in September 2025 (the token address did not change) and audited by Hexens in August 2025 — the third report below.

Audit reports

Auditor	Date	Scope	Report
Hexens	2024/12/30 – 2025/1/20	Core protocol	2025-1-Hexens.pdf
Decurity	2025/2/19 – 2025/3/5	Core protocol	2025-3-Decurity.pdf
Hexens	2025/8/20 – 2025/8/28	EIP-3009 / EIP-2612 token upgrade	2025-8-Hexens.pdf

Stress test

Stress-Testing Simulation and Risk Assessment by the CryptoEconLab team:

Secure_Finance_Report.pdf

PDF · 13MB

Open

Audits reduce risk but never eliminate it. The price feed's Tellor fallback also currently depends on an update job operated by Secured Finance (the primary RedStone feed does not) — see Price Oracle for the trust assumptions.