Kerne Protocol: Diligence Dossier

Live backing, stated as two PSMs plus legacy collateral

Outstanding kUSD is backed 1:1 by USDC held in the reserve PSM. New mints flow through the v3 mint PSM at a published on-chain fee. The legacy v1 vault and the Hyperliquid hedge equity sit above that stable backing as additional collateral. All rows below are live reads from /api/por at Base block 48602696.

Why two PSMs: the v1 contract holds the accumulated USDC reserve and remains the redemption surface; the v3 contract is the hardened mint path with tiered fees and a cap, deployed 2026-06-17. Both are verified on chain and both appear in the contract registry below. The solvency status string in the raw feed says this plainly: the PSM is solvent and the legacy v1 vault degradation is a known, labeled issue, not a hidden one.

Redemption capacity, stated before you have to derive it

The first question any six figure check asks is: if I mint at size, how do I get out? Here is the honest answer, including the part that reads worse when a counterparty derives it themselves.

• Today, the reserve covers today's holders and nothing more. The PSM holds $1,115.85 of USDC against 1,114.74 kUSD outstanding, so every current holder can exit at par at the published fee. Exit capacity at six or seven figures does not exist yet, because nothing at that size has ever been minted.
• The mechanism: a mint at size creates its own exit capacity. The PSM is fully reserved and does not deploy its backing. USDC that enters at mint stays in the contract until it leaves through a redemption; the only other outflow in the deployed v3 contract is a fee skim strictly bounded to fee surplus above 1:1 backing, restricted to the admin Safe and the published treasury address, and emitted on chain when it happens. So a $100k mint adds $100k of USDC to the reserve, and that same USDC is what funds the exit, both directions at the published tiered fee.
• The circularity, named plainly. For the first large minter, the reserve that funds your exit is overwhelmingly the reserve you brought. There is no fractional trick hiding in either direction: you can always get out because the system cannot lend, stake, or spend what backs you, and the hourly signed attestation plus the live backing table above let you watch that stay true. What you cannot do is exit into a reserve someone else built, because at this scale nobody else has built one yet.
• Raised capital follows the same rule, plus a cap. If a raise is parked in the PSM as protocol-owned float, it adds reserve exactly 1:1 with the kUSD it mints and is labeled under the float disclosure below, and the pre-audit prudence cap in that section commits the majority of any raise to stay out of protocol contracts entirely until the external audit report is published.

Proof of reserves, signed hourly, verifiable in three lines

Every hour the protocol publishes a signed attestation of reserves at kerne.fi/api/por/signed. The signature is EIP-191 personal_sign over the attestation hash by the named strategist key 0x09a2780ac8Be6D5d2d1F85A8D92b09D40C9CA37e. Recovering the signer and rehashing the payload takes about three lines in ethers, eth_account, or foundry cast; the recipes ship inside the response under _meta.verify and in the browser at kerne.fi/verify.

Latest attestation at render time: generated 2026-07-14T01:17:58.427833+00:00, solvent true, delta neutral true, PSM backing ratio 1.001001, Hyperliquid venue equity $26.24.

The attestation stack itself is published as an open standard (signed-por) and the same machinery is sold as a service; the protocol eats its own cooking hourly.

The same strategist key also signs a dated commitment the protocol made to itself. The Opal Genesis Season 1 fragment standings were recorded and committed to the repository on the exact date published in advance, 2026-07-10, machine-signed over the canonical standings by that key (attestation hash 0x908e187f385326b17a6b16d92c9e6a5831d42d5ab4c326c8834a28da6f4b79db). The underlying fragment count is monotonic, so a recorded standing can only be equal to or higher than the value at the exact instant, never lower, and the signed artifact states its own read timing. The promised date was met and the record verifies against the signer, not asserted.

The yield number, stated the way we would want it stated to us

• The published APY is a modeled, live formula output, currently 12.92%. It is computed from public Lido staking and Hyperliquid funding data with the full methodology in the response itself at /api/apy, and it moves with the market. It is an output to verify, not a promise.
• Realized distributions have only just begun. The first genesis-scale skUSD distribution landed on July 8, 2026, and it is small; the staking receipt (skUSD) has appreciated only marginally since. Realized protocol carry history is short, and realized-cost telemetry accumulates daily so the realized story is reported from data, not asserted. Institutional-scale staking is gated behind the published external audit, and the anchor terms encode that gate explicitly.
• Our own analysis caps the sustainable number well below the modeled print. The published feasibility work concludes that a peg-safe, through-cycle rate for this design at current market funding sits around 8 to 9.4 percent, and that the higher modeled figure reflects leverage the deployed engine does not currently run. We publish that ceiling ourselves rather than waiting for a diligent analyst to derive it. Yield methodology: /docs/yield-methodology.
• Sector context: the whole category prints mid single digits right now on realized terms. The difference at Kerne is not a bigger number, it is that the formula, its inputs, and its known decay are published, so the number can be checked rather than believed.

Scale and holder concentration, led with rather than buried

Kerne is at genesis scale. kUSD outstanding is 1,114.74 kUSD and the holder count is single digits: 5 addresses at the July 2, 2026 read, of which four are the protocol's own surfaces (the founder-seeded liquidity pool, the staking wrapper, a founder wallet, and the operational wallet) and one is an external third-party buyer. The list is public on BaseScan, with one caveat we found the hard way: explorer holder tables can lag the chain, so we count by summing live per-address balance reads, which reconcile to total supply exactly. The majority of circulating supply sits in a founder-seeded liquidity position. We state this because it is true and checkable, and because the first millions of every synthetic dollar in this category have come from anchor capital rather than organic retail. The protocol is structured for that sequence, and the protocol-owned float disclosure below exists so that when anchor capital arrives, the displayed TVL it creates is labeled for what it is.

What is already real at this scale: the mint-redeem loop is live on Base mainnet, the hedging engine runs against real positions, reserves are attested hourly with a recoverable signature, and the protocol publishes its own failures with the same cadence as its wins.

Protocol-owned float: the disclosure, in advance

This section is a standing commitment about how Kerne will report its own capital, published before that capital arrives.

• What protocol-owned float is. If Kerne raises operating capital (for example through a SAFE) or receives founder or treasury capital, some of it may be parked in the PSM as USDC, minting kUSD held by the protocol or its founders. That capital is real, fully reserved, and redeemable like any other kUSD; what it is not is third-party demand.
• The commitment. Any kUSD position that is protocol-owned, founder-owned, or raised-capital float will be disclosed as such: identified in the public seed policy, distinguishable from external deposits, and never cited by us as organic traction. TVL that comes from our own balance sheet will always be labeled as coming from our own balance sheet.
• Why we publish this in advance. The synthetic-dollar category has a wash-TVL problem, and Kerne sells verifiability. A protocol that markets signed proof of reserves cannot carry an asterisk on its own headline number. Publishing the labeling rule before the capital exists means no reader ever has to wonder which regime a given dollar arrived under.
• The pre-audit prudence cap (added in v1.1). Until the first external audit report is published, no more than 25 percent of the proceeds of any raise will be parked in protocol contracts, the PSM float included. The remainder is held as USDC in the disclosed 2-of-3 treasury Safe, where it is visible on chain and counted as treasury, not as TVL. An unaudited system should not hold the bulk of investor proceeds, and our displayed TVL must never be a function of how much of our own raise we chose to park. This is a self-imposed policy; amending it requires a dated, disclosed edit to this page.
• The mechanics already exist. The public seed policy at SEED_TVL_POLICY.md governs seed capital labeling today, the hourly signed PoR shows the reserve composition, and the holder list is public on chain. This disclosure extends the same rule to any future raised capital parked in the PSM.

Security posture and process

• Source verification: 14 of 17 deployed contracts are source-verified on both BaseScan and Sourcify, with the pending rows disclosed with reasons at /security/audits. Where deployed bytecode differs from current source, the divergence and its operating rule are published at /security/deployed-vs-source.
• Internal corpus: over two hundred self-found findings, classified and published with live statuses and closing commits at /security/findings-tracker. Inbound researcher disclosures are triaged and acknowledged; a standing bug bounty runs at /security.
• External audit: no external audit has been completed, stated plainly. Hexens is engaged for the first external smart-contract audit; the MSA is executed with the founder signing as a self-employed individual (no entity or novation), and fieldwork has been underway since July 13, 2026. The auditor-facing scope is already public at audits/SCOPE.md. Institutional-scale staking is sequenced behind the published report.
• Governance: protocol administration sits with a 2-of-3 Gnosis Safe on Base, 0x52d3E450bA6c299B1B07298F1E87DD74732D4877, with the first signer hardware-backed. Day-to-day automation runs on a separate operational key that holds no admin roles.

Entity and instrument status, as of July 10, 2026

• Entity: Kerne operates pre-incorporation, by decision. On July 2, 2026 the founders paused the BVI formation this page previously described as under way: company names were approved with a corporate services agent, no company was formed, and no filing is in progress. Execution moved to personal signature instead. The audit engagement above is executed by the founder as a self-employed individual with no entity and no novation (a plain service contract, countersigned July 7, 2026). The SAFE below is the instrument that carries a contractual commitment to novate to the Kerne entity on incorporation. The entity plan itself (an operating company plus a Cayman foundation for token issuance at TGE, with UAE as the alternative) is unchanged as that novation target.
• Instrument: a post-money SAFE with a token side letter remains drafted for counsel review, and following the July 2 decision it is being adapted from a BVI issuer to personal execution: the founder signs individually as promoter, with a mandatory novation of the instrument to the incorporated entity and the investor's advance consent to that novation in the instrument itself. A committed investor is therefore waiting on counsel finalization and signatures, not on an incorporation. Terms are discussed directly: kerne.systems@protonmail.com.
• Regulatory positioning: kUSD is a protocol-issued synthetic dollar, not a fiat-backed payment stablecoin, and kUSD itself pays no yield for holding it; yield exists only through the separate staking receipt. This is the structure the category has converged on under the US GENIUS Act framework and analogous perimeters elsewhere, with sUSDe and sUSDS as the worked public examples. Not legal advice; stated so a reviewer can test the reasoning.

Anchor terms

Documented terms exist for anchor mints of $1M to $5M: tranche-structured, with tranche 1 as mint-and-hold (PSM-only risk surface, fully reserved, no yield promised and none needed), staking tranches gated on the published external audit, a guaranteed points multiplier, a fee-share rider on staked tranches, a named transparency page, and full exit symmetry through the PSM at the published tiered fee (0.10% base, 0.05% at $1M or more per swap, both directions, set on chain where anyone can read it). The terms document is available on request to qualified counterparties: kerne.systems@protonmail.com.

The kill questions, answered by us first

• Is the TVL real? It is small, fully reserved, and verifiable hourly; the holder list is public; and the float disclosure above commits to labeling any protocol-owned portion forever. Judge the machinery, not the odometer.
• Is the yield real? The published number is a modeled formula output and this page says so; only a first, small genesis-scale distribution has landed (July 8, 2026); our own published ceiling for the sustainable rate is roughly 8 to 9.4 percent; staking at scale waits for the audit.
• Where is the audit? Not completed. Firm selected, scope public, engagement being papered on a personal-execution basis so it does not wait on entity formation. Until the report is published, the verification story rests on the verified source, the internal corpus, and the signed PoR.
• If I mint six figures, how do I get out? Through the same PSM your mint fills: the redemption capacity section above states this plainly, including the fact that today's reserve is only about a hundred dollars and that the first large minter exits into the reserve they brought.
• What about the alarming legacy vault numbers? The v1 vault is in a documented degraded state, holds no user funds, is excluded from headline TVL, and its raw figures are published under a labeled known-issue block in the signed feed rather than hidden.
• Venue concentration? The funding leg currently runs on a single venue (Hyperliquid). Multi-venue routing exists in the engine and arms as venues are added; until then this is a real, disclosed concentration.
• Who are you? Three co-founders, pseudonymous publicly at this stage, with identity disclosure happening directly in counterparty conversations (anchor, auditor, accelerator). The system is deliberately structured so nothing on this page requires trusting an identity.