Live risk surface.
Every wired risk threshold in the protocol, side by side with its current on-chain value and the exact Solidity identifier you can grep yourself. Refreshed every 15 minutes from /api/risk-status. If a value here disagrees with what is on-chain, the on-chain value wins and this page is wrong.
Loading risk surface from /api/risk-status...
A safety gate that is switched off, and why.
solvencyCheckDisabled returns true on both mint Peg Stability Modules. With it set, the PSM does not ask the vault whether the vault is solvent before minting or redeeming. We are publishing this because nobody had found it, and a protocol whose whole claim is that its numbers survive being checked does not get to hold back the state of a safety gate on the contract that takes deposits.
It was set deliberately, as transaction 7 of the 13-step July 10, 2026 deploy ceremony, while the vault it reads was being remediated. The contract's own documentation says to flip it back once that vault returns a meaningful number. The window opened on July 10 and has not closed. Nothing tracked the flag back to zero and nothing published it, so nothing forced the question. That is the real failure here, and it is a process one.
Two reasons it is off, and the second is the uncomfortable one. The gate couples two books that do not fund each other: kUSD minted through the PSM is backed 1:1 by the USDC sitting in that same PSM, while the vault is the delta-neutral WETH book, so a vault reading can block a mint whose backing it says nothing about. And if we cleared the flag today the gate would measure nothing anyway: getSolvencyRatio() returns a hardcoded 200% sentinel whenever the vault has zero liabilities, which it does, so the check would pass on a constant. We would rather publish the flag as true than publish a green light that means nothing.
What still protects a minter, all of it live and readable: the depeg gate IS enforced, with the Chainlink USDC/USD feed wired and a fail-closed posture on an unset oracle; backing is published hourly and signature-bound as psm_solvency_ratio at /api/por/signed; the retired PSM had its mint authority revoked on July 10, 2026, so its copy of the flag cannot mint anything; the concentration and mint caps still revert; and the flag is DEFAULT_ADMIN only, which since 2026-08-06 means it is behind a 48 hour timelock rather than two instant signatures, and emits an event, so its full history is reconstructable from logs by anyone.
A delay is only a control if somebody is watching it. Since 2026-08-09 a daemon polls that timelock every 60 seconds, decodes anything scheduled against it and pages the operator channel, and the live queue plus that daemon's own heartbeat are public at /timelock and /api/timelock, which answers 503 rather than an empty queue when the chain cannot be read. It pages us, not you, and it does not create anybody independent who can cancel.
The full writeup, including what would have to change for the flag to be worth clearing and why clearing it is not itself the fix, is in the security notes as KRN-26-PSM-SOLVENCY-GATE-DISCLOSURE. It stays true, and stays published, until it changes.
Two contracts we cannot prove the source of.
Everything else on this site is built so you do not have to take our word for it. On two contracts there is one thing you cannot check: that the bytecode running on Base was compiled from the source we publish. We cannot reproduce it either. They are named here, in words, because a reader who finds this on their own reads it as something we hid, and because "check it yourself" is worth less if the exceptions are only ever a cell in a table.
KerneStaking 0x032Af163 was deployed before a January 7, 2026 repository reset wiped the history that contained its source. The contract was built from a working tree that was never committed, so the exact source no longer exists anywhere. The closest surviving commit compiles to within four characters of the deployed size and then diverges at character 142. We tried again on June 11, 2026 and the current source still compiles to a different code body. Verifying it would require migrating every stake to a fresh contract. Nothing is staked: totalStaked() returns zero and the contract holds no ether, so the migration would move nothing and we have not spent the deploy on it.
KerneFlashArbBot 0x57e73919 is a different failure. It was deployed on January 15, 2026 at 22:22 UTC, four hours and fourteen minutes after the last commit that touched it, and the working tree changed in between. The deployed bytecode diverges from that commit at character 87, in the function dispatch table. One known difference: current source carries a Maverick router the deployed contract does not have. This one is fixable by redeploying from source, and that redeploy is written and waiting rather than done.
What bounds the second one today. The bot executes triangular arbitrage and can flash borrow from the vault, so an unverifiable version of it is worth being specific about. Its two operational roles were revoked from the old operational key on April 17, 2026, and neither the 2-of-3 Safe nor the current operations signer holds EXECUTOR_ROLE today, so no Kerne key can drive it. Granting that role back is a Safe transaction that lands on chain in public. It holds no ether. Neither contract holds user deposits, and neither sits in the mint or redeem path: kUSD, the live mint PSM, and skUSD are all source-verified, and those are the three that stand between a holder and their dollar.
Per-contract verification status for the whole registry, including these two, is on the audit and verification page. Places where deployed bytecode differs from a source we do still hold are a separate list, on deployed versus source. These two stay here until a redeploy makes them checkable.
Verify yourself.
This page is a rendering of the JSON at /api/risk-status. Four commands against Base mainnet reproduce the most load-bearing claims independently:
These are read on every request by /api/risk-status, which is what the panel above and the homepage banner render. They are checked when someone asks, not on a schedule.