thBILL Risk Report

Independent risk assessment of Theo's Short Duration US Treasury Fund

Independent third-party review — not operated by Theo Network

Last updated: -

Executive Summary

thBILL is Theo Network's on-chain wrapper over a Standard Chartered Libeara tokenized US T-bill fund (Wellington-managed, FundBridge MAS-regulated). ~$135M TVL on Ethereum, Arbitrum, and Solana. NAV accrues T-bill yield (~3% APY), no rebase.

  • Non-KYC? Peg and liquidity are what matters. KYC'd holders redeem at NAV (T+4 business days, $50K min); everyone else exits only via DEX at the prevailing peg discount, subject to pool depth. Watch the Peg Discount card and the Peg Performance + Secondary Market Liquidity sections.
  • The on-chain wrappers (thBILL, tULTRA) are synthetic ERC-4626s that hold zero of the asset they declare. Backing is reconciled against Theo's treasury custody + Libeara's settlement pipeline, not enforced by the contracts. The ratio dips ~10–15pp during periodic Libeara settlement windows (1–7 days, tracked in Reconciliation Activity) — this is a visible cycle, not undercollateralization.

For the full risk narrative — audit status, counterparty stack, issuer governance, and sizing guidance — see the retail risk report at tidresearch.com →

Overall Risk Assessment

★★★★★
Collateral Quality
US T-Bills
☆☆☆☆☆
Liquidity & Peg
Loading…
★★☆☆☆
Issuer / Governance
Centralized
★★★☆☆
Operational
Standard RWA
★★★☆☆
Transparency
NAV on-chain (strong); custody attested (medium)

Live Metrics

Total Value Locked
-
USD Backing Ratio
-
Economic backing: Theo custody + in-flight queue + USDC + any pending Libeara receivable ÷ thBILL liability. On-chain-only and floor views in detail panel.
Peg Discount
-
Current DEX exit cost vs NAV — the number retail should watch
Days Since Last User Redemption
-

Backing Chain — thBILL ↔ thUSD

thBILL is the reserve asset for Theo's stablecoin product thUSD. As of the most recent snapshot, ~66% of thBILL outstanding is held at the thUSD reserve address (verified on-chain and on Theo's transparency dashboard at app.theo.xyz/transparency).

Implication: thBILL liabilities can grow without any retail thBILL demand — they grow automatically as thUSD's user base grows. Each new dollar deposited into thUSD triggers a primary thBILL mint allocated to the thUSD reserve, with the corresponding ULTRA backing arriving from Libeara at T+1 to T+7. That's why short-lived backing-ratio dips during a thUSD inflow window are the expected pattern, not undercollateralization.

For retail sizing, the relevant float is the External float line in the Holder Attribution panel above, not the total supply. The retail-accessible portion is materially smaller than the headline TVL implies, and most of it lives on L2s mirrored against the Ethereum OFT-adapter lockbox rather than directly on Ethereum.

See also: full risk frame at tidresearch.com/reports/thbill and the thUSD-side analysis at tidresearch.com/reports/thusd.

Peg Performance

NAV Per Share
-
ERC-4626 convertToAssets()
Market Price (VWAP)
-
Volume-weighted across DEX pools
Premium / Discount
-
Market price vs NAV
7-Day Premium / Discount History
User redemption (size = thBILL amount)
Last 10 user redemptions (thBILL → Theo's redemption operator; the live user-side pulse, not the operator's downstream batch burn)
Time (UTC) thBILL From Tx
Chain Price Volume vs NAV
Loading...

Secondary Market Liquidity

Total TVL
-
24h Volume
-
Active Pools
-
Chain Market TVL 2% Depth 24h Volume
Loading...

Collateral & Backing

Wrapper Integrity

The tULTRA wrapper contract holds 0 ULTRA — synthetic ERC-4626, tultra_wrapper_backing_mode = synthetic_attested. tULTRA.totalAssets() is an admin-attested accounting value, not a contract balance. thBILL holds 100% of tULTRA supply, but the real backing for both layers sits in Theo's TREASURY wallet across Ethereum, Arbitrum, and Solana — listed below. This row would flip to custodial if Theo started locking ULTRA in the wrapper directly (material event).

Real backing for thBILL is Theo's treasury ULTRA across chains, plus USDC cushion and any in-flight Libeara USDC receivable during settlement windows. ULTRA values use Libeara's on-chain NAV (UltraManager.lastSetMintExchangeRate, signed daily by Libeara's admin key); USDC is dollar-equivalent. All percentages are USD/USD against thBILL liability — they sum to the headline backing ratio.

Asset Amount Unit USD Value % of Liability
Loading...
Treasury custody (Ethereum + Arbitrum, same EOA): 0xAECCa546…509d8F. Solana custody is documented in Theo's reserve disclosures. Trust assumption: coverage relies on (a) the disclosed TREASURY address being the complete set of Theo-held ULTRA, and (b) Theo's off-chain accounting faithfully matching on-chain totalAssets — neither is enforceable from the tULTRA contract alone. Per Theo's own docs, tULTRA is "backed 1:1 by ULTRA shares or USDC reserved to mint ULTRA shares."

Reconciliation Activity

Stage B cycles: Theo periodically moves ULTRA into Libeara's UltraManagerFiat queue to settle batches of user redemptions. ULTRA burns within 5–27 hours; USDC returns to Theo's treasury at T+1 to T+7 days. Backing ratio dips during settlement pending are expected and time-bounded. (Stage A — the upstream USDC→ULTRA mint cycle for new thBILL — appears as a separate widget above when in flight.)

Cycle ULTRA burned Burn date USDC arrived T+Days Sender
Loading…

Redemption Mechanics

Two exit paths exist for thBILL holders. The choice determines whether you capture NAV or absorb the peg discount.

Primary redemption (NAV, gated)

thBILL → tULTRA → ULTRA → USDC. All three conversion layers charge 0% in fees. Gates: KYC with Theo and with Libeara/FundBridge, ≥$50K minimum at the Libeara redemption layer (≥$200K for new unitholders per the fund's offering memorandum), and T+4 business day settlement before USDC arrives. Theo's on-chain redeem() function is permissionless but returns tULTRA (no secondary market) — the off-chain path is what actually produces USDC.

Secondary sale (DEX, instant)

Sell thBILL into a Uniswap / Project X / Pancake pool for USDC-equivalent, typically at a discount to NAV. Current secondary exit cost is the headline "Premium / Discount" figure below (~0.6% at last snapshot). No KYC, no minimum, any size — but depth is thin (2% sell depth on the largest pool is ~$211K), so larger sells incur additional slippage.

The peg discount is effectively the liquidity-access premium — the cost a holder pays for instant permissionless exit vs the KYC-and-wait primary path. It can drift whenever the eligible-for-primary-redemption set chooses not to arbitrage it (see "Days Since Last Redemption" in Live Metrics).

Risk Analysis

Issuer Risk

Theo Network is the issuer of thBILL. The protocol is relatively new and operates with centralized control over minting and redemption. Users must trust Theo to maintain proper backing and honor redemptions. There is no on-chain governance mechanism. Theo Protocol Corporation is domiciled in Panama and is not a licensed financial institution anywhere. Token holders' legal claim in worst case is against a Panama entity, not direct ownership of fund shares.

Decentralization

thBILL is highly centralized. Key functions (minting, redemption, treasury management) are controlled by Theo. The underlying ULTRA tokens are issued by Libeara, adding another centralized dependency. Smart contracts are upgradeable. Both thBILL and tULTRA are UUPS-upgradeable with no timelock; admin actions take effect immediately.

Technical Risk

The thBILL vault follows the ERC-4626 standard. Both thBILL and tULTRA are UUPS-upgradeable (the UPGRADER_ROLE can swap the implementation with no timelock). tULTRA is specifically a synthetic ERC-4626: it declares ULTRA as its asset() but holds zero ULTRA — totalAssets() is an admin-attested accounting value, mints flow through MINTER_ROLE-gated depositOptimistic (not the public deposit()), and redemption pays USDC. An integrator reading the 4626 interface alone would not infer these properties; see the Wrapper Integrity disclosure and the synthetic · attested badge in the USD Backing Summary above for live values. Multi-chain deployment adds bridge risk (DVN config audited 2026-04-21; bridge adapter code likely post-audit).

Minting & Redemption

Minting and redemption are processed through Theo's system, not permissionlessly on-chain. There may be delays during high-volume periods. KYC is required for all primary redemption regardless of size (Libeara's ≥$50K minimum applies on top for institutional redemption). Non-KYC users can only exit via DEX, at the discount shown in Peg Performance.

Operational Risk

Standard RWA operational risks apply: custodian failure (StanChart Singapore), fund administrator failure (Vistra), regulatory action, banking issues, oracle failures. Treasury USDC is held as spot + DeFi supply positions (auto-detected via DeBank, primarily Aave V3 Ethereum when present). Backing ratio reflects only Theo-custodied ULTRA across ETH/ARB/SOL priced at Libeara's on-chain NAV — Avalanche ULTRA is excluded because it's held by FundBridge launch partners, not in Theo's custody.

Disclaimer & Methodology Limits

This dashboard reports on-chain-verifiable data plus issuer-published claims — not every external dependency or novel attack class.

Cannot fully verify: LayerZero Endpoint upgrades (continuously evolving), MPC operator threshold and signer identities (publicly "MPC", no detail), T-bill custody at Standard Chartered, Wellington's portfolio composition, the Zenith audit report (acknowledged but not publicly linked).

Methodology is retrospective. Novel attack classes typically get enumerated only after they manifest. The rsETH OFT exploit (April 2026, single-DVN bridge configuration) is a recent example — DVN-config audits became part of thBILL's analysis post-incident, not pre-emptively. Future attack classes may produce similar gaps.

Informational only; not financial advice. Full methodology in the retail risk report at tidresearch.com.