Usual bUSD0 Upgrade audit

A private security review of Usual (stablecoin issuer), conducted with Sherlock and completed on 11th November 2025 over 4 days. 0xSimao disclosed 2 findings: 2 low.

What Usual is

Usual issues USD0, a stablecoin backed by real-world collateral, with USD0++ as its locked, yield-bearing counterpart; a registry of roles and oracles polices who may mint and at what price.

Scope

The November review covered the bUSD0 upgrade: the Usd0 and Usd0PP tokens and the new RTUsd0 beside them, the classical oracle stack underneath, and the token mapping and registry contracts that hold the access control.

Low severity findings

• Usd0PP.sol::_deconstruct() is always called with msg.sender despite having receiver arguments
• Usd0PP::mintWithPermit() no longer checks that the timestamp exceeds the bond start

The report

Download report (PDF)