Done. Redcell was paid.

What Redcell delivered

{
  "address": "0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409",
  "symbol": "FDUSD",
  "isContract": true,
  "codeSize": 2104,
  "proxy": {
    "isProxy": true,
    "implementation": "0xa6b2c3d2910246fb0adb02e5f6b39e29026e6d50",
    "beacon": null,
    "admin": "0xbb812b978e41929e86ad9ea8c1025710fee85957"
  },
  "owner": "0xfa771871d3d5c85e156D3d379E2FF7699C4d6a66",
  "paused": false,
  "approval": null,
  "findings": [
    {
      "severity": "high",
      "category": "upgradeability",
      "title": "This contract is a proxy and its logic can be replaced",
      "summary": "An EIP-1967 implementation pointer is set to 0xa6b2c3d2910246fb0adb02e5f6b39e29026e6d50. The code that runs is stored elsewhere and can be changed.",
      "exploitScenario": "Any conclusion about what this contract does is valid only until the upgrade key is used. A review performed today does not constrain behaviour tomorrow, and the upgrade needs no cooperation from you.",
      "recommendedFix": "Find out who holds the upgrade key and whether it is a timelock or a multisig. A proxy behind a 48-hour timelock is a different risk from one behind a single hot key.",
      "confidence": 0.99,
      "dedupeKey": "a117ed13a7ad2d91",
      "source": "onchain"
    },
    {
      "severity": "high",
      "category": "upgradeability",
      "title": "The contract logic can be replaced.",
      "summary": "The deployed bytecode dispatches upgradeTo(address).",
      "exploitScenario": "Whatever this contract does today is not what it must do tomorrow. Any review of its current behaviour has a shelf life measured by the upgrade key.",
      "recommendedFix": "Establish who may call upgradeTo(address) and under what delay. The function existing is not the problem; an unaccountable caller is.",
      "confidence": 0.85,
      "dedupeKey": "315bd581343898a3",
      "source": "onchain"
    },
    {
      "severity": "high",
      "category": "upgradeability",
      "title": "The contract logic can be replaced and called atomically.",
      "summary": "The deployed bytecode dispatches upgradeToAndCall(address,bytes).",
      "exploitScenario": "Logic can be swapped and immediately invoked in one transaction, leaving no window in which to react.",
      "recommendedFix": "Establish who may call upgradeToAndCall(address,bytes) and under what delay. The function existing is not the problem; an unaccountable caller is.",
      "confidence": 0.85,
      "dedupeKey": "2abb9ca5a25b80d8",
      "source": "onchain"
    },
    {
      "severity": "medium",
      "category": "privilege",
      "title": "A single owner address holds privileged control",
      "summary": "owner() returns 0xfa771871d3d5c85e156D3d379E2FF7699C4d6a66.",
      "exploitScenario": "Every owner-gated function below is one compromised key away from being called. The concentration is the risk, not any individual function.",
      "recommendedFix": "Check whether that address is an externally owned account, a multisig or a timelock. An EOA owner is the weakest of the three by a wide margin.",
      "confidence": 0.95,
      "dedupeKey": "c554fb2429935e47",
      "source": "onchain"
    },
    {
      "severity": "medium",
      "category": "privilege",
      "title": "A proxy admin is set",
      "summary": "The EIP-1967 admin slot holds 0xbb812b978e41929e86ad9ea8c1025710fee85957. That address can change the implementation.",
      "exploitScenario": "Whoever controls the admin address controls what this contract does, at any moment, with no notice.",
      "recommendedFix": "Verify the admin is a timelock or multisig rather than a single key.",
      "confidence": 0.99,
      "dedupeKey": "8a935eab737c49fe",
      "source": "onchain"
    }
  ],
  "severityCounts": {
    "critical": 0,
    "high": 3,
    "medium": 2,
    "low": 0,
    "info": 0
  },
  "verdict": "0 critical, 3 high, 2 medium",
  "method": "deployed bytecode selector scan plus EIP-1967/1822 storage slots and view calls, read on-chain",
  "limitations": [
    "Selector presence is read from the deployed dispatcher. A function reachable only through a proxy, a fallback router or an unusual optimiser layout can be missed.",
    "No source code is read, so logic bugs, reentrancy and accounting errors are entirely out of scope.",
    "A clean result means nothing was found by this method. It never means the contract is safe."
  ],
  "blockNumber": "125266438",
  "readAt": "2026-10-02T09:13:25.996Z"
}