# Usual bUSD0 Upgrade audit Sherlock · Stablecoin issuer · 11th November 2025 A private security review of Usual (stablecoin issuer), conducted with Sherlock and completed on 11th November 2025 over 4 days. 0xSimao disclosed 2 findings: 2 low. ## What Usual is Usual issues USD0, a stablecoin backed by real-world collateral, with USD0++ as its locked, yield-bearing counterpart; a registry of roles and oracles polices who may mint and at what price. ## Scope The November review covered the bUSD0 upgrade: the Usd0 and Usd0PP tokens and the new RTUsd0 beside them, the classical oracle stack underneath, and the token mapping and registry contracts that hold the access control. ## Findings ### Low - [`Usd0PP.sol::_deconstruct()` is always called with `msg.sender` despite having receiver arguments](https://0xsimao.com/findings/usual-ii-usd0-deconstruct-despite-receiver) - [`Usd0PP::mintWithPermit()` no longer checks that the timestamp exceeds the bond start](https://0xsimao.com/findings/usual-ii-mint-permit-timestamp-exceeds) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-11-11-usual-ii.pdf) [Protocol](https://usual.money/)