1. Purpose

This document serves as an on-chain attestation that every yTBill share minted by the YieldGuard AggregatorVault is always backed 1:1 (≥ 100 %) by tokenised U.S. Treasury Bill wrappers held in custody.

The attestation relies exclusively on Chainlink Proof-of-Reserve (PoR) oracle feeds that verify, on-chain, that (a) each wrapper issuer’s reserves equal or exceed their liabilities and (b) the total wrapper supply held by the AggregatorVault matches the quantity represented by yTBill.

2. Scope of Coverage

Wrapper token	Issuer	Wrapper contract (Arbitrum)	Token decimals	PoR feed address	Feed decimals	Target / min update interval	Divergence limit
TBILL	OpenEden	`0x1a2b…TBill`	18	`0xa1b2…PorTBILL`	8	15 min / 60 min	0.30 %
wSTBT	Matrixdock	`0x3c4d…wSTBT`	18	`0xc3d4…PorWSTBT`	8	15 min / 60 min	0.30 %
T-TBill (queued)	Ondo Finance	`TBD`	18	`TBD`	8	30 min / 90 min	0.30 %

Note 1 – Contract and feed addresses will be populated once the respective collateral is onboarded and audited.

Note 2 – New wrappers may only be added after a successful security review and 3-of-5 Safe multisig approval (see § 5).

3. Methodology

Reserve snapshot – Each issuer’s regulated custodian (e.g., regulated trust company or bank) publishes the face value of underlying T-Bills (ISIN-level) to a quorum (> 2/3) of Chainlink PoR nodes.
Oracle aggregation – Nodes submit signed values to their aggregator contract; on-chain median is stored at `latestAnswer` with heartbeat enforcement (`≤ 60 min`).
On-chain computation – The YieldGuard StrategyRouter executes:
RCR = PoR balance (USD) / (wrapper totalSupply() × wrapper price per share (USD))
The equation is evaluated per wrapper and aggregated using market weights.
Attestation condition – PASS if (i) each wrapper’s `RCR ≥ 1.000` and (ii) each PoR feed’s `updatedAt` timestamp ≤ 60 minutes old. Failure auto-pauses deposits via the Guard contract while permitting withdrawals.
Fallback path – If a PoR feed is stale but a secondary heartbeat (and off-chain API proof) is fresh, the Guard emits `StalenessGracePeriod` and grants a 120-minute grace window before pausing.

4. Monitoring & Controls

Control	Mechanism	Owner	Alert channel
Feed freshness	Cron job checks `updatedAt` every 5 min; txs revert if stale.	Dev Ops	PagerDuty, Discord (#alerts-por)
Coverage divergence	Contract emits `CoverageAlert` when `RCR < 0.997`; Guard pauses deposits.	Solidity Guard	PagerDuty
Dashboard transparency	All PoR values, RCRs and pause events indexed to TheGraph and surfaced in public Dune & Grafana dashboards.	Data Eng	Web
SLA	Each PoR feed must meet ≥ 99.5 % 30-day uptime; failing nodes rotated out by multisig vote.	Risk & Ops	GitHub issues
External audit	Semi-annual audit of PoR integration (latest: Quantstamp #QS-2307-POR).	Security Lead	GitHub releases
Bug bounty	Immunefi programme tier 2 (high severity → USD 50 k).	Security Lead	immunefi.com

5. Governance & Security

Signer quorum – Critical parameter changes require 3-of-5 Safe signatures plus 48-hour timelock.
Immutable logic – `StrategyRouter` bytecode is immutable; only PoR feed addresses are upgradable via `setFeed()` gated by the Guard.
Audit trail – Every parameter change diff is auto-published to GitHub under /audits/upgrade-report-{txHash}.md.
Emergency pause – Any signer or designated sentinel may trigger `pauseAll()` if oracle corruption is suspected; unpause requires quorum.

6. Statement of Attestation (example snapshot)

As of block #14,123,456 on Arbitrum (27 July 2025 14:02 UTC):

Wrapper	PoR balance (USD)	Supply × PPS (USD)	RCR
TBILL	102,001,123.12	101,750,223.05	1.0025
wSTBT	52,450,776.88	52,310,100.00	1.0027
Aggregate	154,451,900.00	154,060,323.05	1.0025

Because each wrapper’s RCR ≥ 1.000 and all PoR feeds were updated within the last 32 minutes, YieldGuard attests that yTBill is fully collateralised at the time of this statement.

Name	Role	Safe signer address
Founder A	CEO	`0x…1A`
Founder B	CTO	`0x…2B`
AIFM Rep	FundRock	`0x…3C`

7. Limitations & Risk Factors

PoR feeds attest existence of collateral, not its liquidity; U-S T-Bills are generally liquid but market stress may impair settlement.
There is inherent latency (≤ 60 min) between reserve changes and on-chain publication.
If U.S. Treasury auctions fail or are delayed, wrappers may roll maturing bills into cash temporarily; this is still counted as collateral.
Smart-contract risk remains despite external audits; users should review audits and inspect bytecode.

8. Revision History

Version	Date	Author	Change summary
0.1	2025-07-27	@assistant	Initial draft.
0.2	2025-07-27	@assistant	Added token / feed decimals, fallback path, emergency pause, risk factors, and revision history; populated example addresses & RCR snapshot.