Can the contract change?
Yes. This is the question that matters most, so here is exactly how. USDh runs behind an upgradeable proxy. In plain terms: the token address you hold is permanent, but the code behind that address can be replaced. No single person can do that. A change has to be scheduled on the blockchain 48 hours before it can run. Anyone watching sees the pending change two days before it takes effect, and can read the new code. Many large stablecoins use this pattern. It lets a flaw be fixed, or a new rule be met, without asking every holder and app to move to a new address. The 48-hour public wait is what makes a silent change impossible. Every upgrade so far is listed on Contracts.Contract security
- Little custom code. The contract is a thin layer over OpenZeppelin building blocks for tokens, access control and pausing. That code is among the most widely reviewed on Ethereum.
- Protection against re-entry attacks on every mint and redeem path.
- Capped wire minting. USDh created against a wire is capped per 24-hour window by the contract. USDh created with USDC needs the USDC to arrive in the same transaction.
Who holds which power
Every admin power belongs to a timelock contract, with a 48-hour minimum delay. That covers new code, accepted stablecoins, the treasury address, redemption settings and the daily wire limit. A few powers act immediately, because waiting two days in an incident would do more harm than good. Each sits in its own multisig: a Safe wallet that needs several people to sign.
No single key controls the system. The account that deployed the contract kept no powers at all, and the deployment script checks this. The wallet addresses are on Verify on-chain.
Emergency powers can only stop things. No wallet, including Hamilton’s own, can take or move your balance. There is no code for it. A frozen address keeps everything it holds.
Audits
- Independent audit: planned. The firm, scope, date and full report will be added to the table above, and every report will stay listed here. No audit has been completed, and Hamilton does not claim the contract has been audited.
- Bug bounty: planned. The scope and rewards will be announced here.
- Read the code yourself. The source is published on Etherscan.