Deployed contracts

The deployed Base mainnet addresses, ownership, oracle configuration, canary evidence, and external dependencies, for third-party review.

Contracts

The account implementation is cloned for each user strategy. Everything else is a shared protocol component, deployed once.

Ownership and roles

Administrative power is split deliberately. The timelock holds everything that could affect where money goes, and the guardian holds only the things that are useless if delayed.

The guardian Safe also holds the timelock's proposer, executor, and canceller roles. That lets it queue and later execute a change; it does not let it shorten the two-day delay.

The deploying address holds no privilege. The same deployment transaction batch that handed ownership to the timelock also revoked the deployer's proposer, executor, and canceller roles, and the deployment reverts unless that handover is complete.

User strategy accounts are not owned by the protocol. Each account stores its own user owner, and only that user can withdraw from it.

Canary evidence

Before opening to users, the lifecycle was exercised once on mainnet, end to end, and the figures below were read back from chain rather than taken from a run log. Anyone can verify them against the transactions.

Execution

Because the fee is taken in USDC up front, the entire swap output belongs to the accounts that paid for it. There is no second transfer of the purchased asset to the treasury to look for.

Withdrawal and closure

Withdrawal is a full exit and it is terminal. The closed strategy left the active registry and can never be redeposited into.

Supported assets

The protocol launched with the two assets that have an approved direct Uniswap route and a direct Chainlink USD feed. Governance can add more, each behind the two-day timelock, and never an asset without oracle coverage.

An asset with no oracle coverage is never whitelisted, so it is not possible for a batch to execute against an asset that has no price floor.

Oracle configuration

The executor submits a minimum output for each batch, and the contract independently computes its own floor. The swap must clear the stricter of the two, so the executor can only ever make slippage tighter, never looser.

On mainnet that floor comes from Chainlink direct USD feeds for WETH and cbBTC, each with its own staleness window, a conservative slippage haircut, and an L2 sequencer-uptime check with a grace period after recovery. The ComposedPriceOracle is deployed for future market-feed assets but carries no active route at launch. The full design is on the Price oracle page.

Idle yield

USDC waiting between buys can earn Aave V3 yield, chosen per strategy at creation against the approved adapter implementation above. Yield is optional: a strategy can hold idle USDC without lending it. The yield fee applies only to positive yield and only at withdrawal.

External dependencies

Fees and controls

Fees are stored in DCAFactory and apply protocol-wide. A fee change applies to existing strategies going forward, and is bounded by a hard on-chain cap that no owner can exceed.

There is nothing else. No subscription, no management fee, no performance cut, and no referral share: no contract computes, stores, or pays one.

Example: a batch collecting 1000 USDC pays 1.50 USDC to the treasury and swaps the remaining 998.50 USDC. Every unit of the asset bought with that 998.50 is distributed to the users who funded it.

The owner can change supported assets, the swap router, the oracle, the treasury, the approved yield implementations, and fees within caps, each after the two-day delay. Pausing, unpausing, and switching the executor belong to the guardian and are instant. Neither can withdraw from a user strategy account.

Execution and monitoring

Execution is scheduled automation from the executor address. What it does when it runs: it reads the factory's active registry for accounts that are both due and able to fund an execution, groups them by target asset, reads the live on-chain swap route, takes a quote, and submits a batch with a quote-derived minimum output. A failed or zero quote skips the batch rather than submitting it with a weak minimum. Each batch is simulated with a zero-gas eth_call first, so a batch that would revert deterministically is skipped without spending gas, while one that lost a transient in-block price race is retried with a fresh quote and escalating tolerance up to a cap. The contract's own oracle floor applies on every attempt and cannot be bypassed by any of this.

Monitoring covers executor gas balance, a scheduling heartbeat, oracle health and per-feed staleness, treasury-fee reconciliation, pending-withdrawal events, repeatedly skipped accounts, empty batches, and the timelock queue, each labelled by the stack it belongs to.

If execution is unavailable for any reason, scheduled buys are delayed. Withdrawals are unaffected: they do not depend on the executor, and no pause can block them.

Reviewer checklist

• Confirm the verified source for each address above on Basescan for Base mainnet.
• Read owner() on DCAFactory, BatchExecutor, SwapRouter, and the oracle. Each should be the TimelockController, not a Safe and not an individual key.
• Read getMinDelay() on the timelock. It should be 172800 seconds (two days).
• Confirm the deploying address holds no timelock role: check hasRole for proposer, executor, and canceller.
• Read guardian() on DCAFactory and BatchExecutor, and confirm the guardian's reach is limited to pause, unpause, setExecutor, and fee flushing.
• Read treasury(), executionFeeBps(), and yieldFeeBps() on DCAFactory. There is no referrer-share getter to read.
• Read executor(), priceOracle(), and the whitelisted assets on BatchExecutor.
• Check the SwapRouter adapter mapping and the Uniswap adapter route for WETH and cbBTC.
• Verify the canary transactions above: the caller, the selector, the fee split, and that the whole swap output reached the user.
• Review the withdrawal path in UserStrategyAccount. Withdrawal is owner-only, remains available while the protocol is paused, and is terminal.