★ Admin has mint() with unlimited max

Cap (cUSD / stcUSD)'s assessment for RD-F-042 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

cUSD mint() is user-facing (no admin-only restriction, only whenNotPaused), subject to per-asset deposit caps. CAP governance token has no admin mint function in ABI. stcUSD is user-facing ERC4626 vault. Per-asset deposit caps are admin-adjustable via setDepositCap() without confirmed timelock requirement on the cap-setting itself.

Sources #

Etherscan
CAP token implementation — no mint functionCAP token impl (0x9c85...): no mint ABI function visible. Supply initialized at deploy.retrieved 2026-05-17
GitHub
Vault.sol — mint and setDepositCapVault.sol: mint() function has whenNotPaused but no admin-role gating — user-facing. setDepositCap() uses checkAccess() — admin-controlled cap.retrieved 2026-05-17

Methodology #

Determine whether an admin-callable `mint` on a protocol token has no supply cap or an unlimited maximum supply.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol cap factor RD-F-042 score yellow collected_at 2026-05-17 10:56:24