feat(vip-663): Pendle PT adapter handover, THE oracle update, TRX & lisUSD deprecation

[vancegpt-bot]

VIP-663 [BNB Chain] Pendle PT Adapter Governance Handover, THE Oracle Update and TRX & lisUSD Deprecation

This VIP has three parts on BNB Chain:

1. Completes the governance handover of the second PendlePTVaultAdapter proxy (0x179bD219c2a20a49406C9AdA39634eDac1C7F656) and restores the access-control checks on it.
2. Removes the RedStone fallback oracle from THE, whose feed RedStone is discontinuing.
3. Moves the TRX and lisUSD Core Pool markets to the next deprecation stage.

Part 1: Pendle PT adapter governance handover

Two PendlePTVaultAdapter proxies exist on BNB Chain mainnet. The first (0x60Db419d8ea13C5827072Cf693D13cA1Ec6E0B4a) was activated by VIP-606, is recorded in the venus-periphery deployment artifacts, and is owned by the Normal Timelock under the shared ProxyAdmin 0x6beb6D2695B67FEb73ad4f172E8E2975497187e4. The second (0x179bD219c2a20a49406C9AdA39634eDac1C7F656) was deployed on 2026-03-23 and never went through the same handover: it and its own ProxyAdmin (0xaE560a5e368Ea72D4090533B245bF163c9Dc6dc2) remained owned by the deployer address 0x24c30C9C84b8a3C71A521ad30007ED47372331b3, and its implementation 0x79276267b23B611ee9Aa8D8D50CB134334e876fA was never recorded in a deployment artifact.

The two implementations are byte-identical in source except for three lines: the _checkAccessAllowed call is absent from addMarket(address,address), pause() and unpause() on 0x79276267b23B611ee9Aa8D8D50CB134334e876fA. As a result those three functions are callable by any address on this proxy today, while the equivalent calls on the VIP-606 adapter revert with the ACM Unauthorized error. Because withdraw and redeemAtMaturity carry the whenNotPaused modifier, any address can suspend this adapter's deposit and exit paths — and any address can lift the pause again, since unpause() is equally open.

Users hold their vTokens directly, but existing delegate approvals remain effective until revoked. This VIP places the legacy adapter under governance and repairs its access checks; it does not revoke those approvals or disable user redemption. Users can also authorize the VIP-606 adapter or redeem directly through the vToken, subject to normal market liquidity, collateral and pause restrictions.

Prerequisites

The deployer address 0x24c30C9C84b8a3C71A521ad30007ED47372331b3 has completed the two prerequisite transactions:

1. PendlePTVaultAdapter(0x179bD219c2a20a49406C9AdA39634eDac1C7F656).transferOwnership(NORMAL_TIMELOCK) — mined at block 123125269. The adapter is Ownable2Step, so this only sets the pending owner and must be completed by the acceptOwnership() command below.
2. ProxyAdmin(0xaE560a5e368Ea72D4090533B245bF163c9Dc6dc2).transferOwnership(NORMAL_TIMELOCK) — mined at block 123125372. This ProxyAdmin is single-step Ownable, so ownership transfers immediately and needs no command in this VIP.

Execution requires the Normal Timelock to remain the adapter’s pending owner and the ProxyAdmin’s owner.

Changes

1. Accept ownership of the adapter

• Contract: PendlePTVaultAdapter (0x179bD219c2a20a49406C9AdA39634eDac1C7F656)
• Function: acceptOwnership()
• Effect: Completes the two-step ownership handoff, placing the adapter under Normal Timelock control.

---

2. Restore the guarded implementation

• Contract: ProxyAdmin (0xaE560a5e368Ea72D4090533B245bF163c9Dc6dc2)
• Function: upgrade(address proxy, address implementation)
• Parameters: proxy 0x179bD219c2a20a49406C9AdA39634eDac1C7F656, implementation 0x70B093Df30B62105e1aCb91Feeb1E9a916d7d899
• Effect: Points the proxy at the implementation already in use by the VIP-606 adapter, which restores the _checkAccessAllowed checks on addMarket, pause and unpause. The two implementations share an ABI and storage layout, so no state migration is involved and no initializer is re-run.

---

Legacy adapter permissions

No ACM permissions are granted: the production integration uses the VIP-606 adapter, so this legacy adapter does not need ongoing market or pause administration. After the upgrade, addMarket, pause and unpause require ACM authorization, which has not been granted on this adapter to the timelocks or guardians. Ownership alone does not authorize these functions. Governance retains the ability to upgrade the contract or grant permissions later if necessary.

The upgrade preserves the existing pause state. If the legacy adapter is paused before execution, it remains paused and cannot be unpaused without a subsequent permission grant or other governance action. Users can instead authorize and redeem through the VIP-606 adapter; the two adapters have independent pause states.

Part 2: THE oracle update

RedStone is discontinuing its THE price feed (0xFB1267A29C0aa19daae4a483ea895862A69e4AA5). On Venus the feed is read through the RedStoneOracle (0x8455EFA4D7Ff63b8BFD96AdD889483Ea7d39B70a), which sits in the FALLBACK slot of THE's ResilientOracle configuration. The current configuration is:

• MAIN: ChainlinkOracle (0x1B2103441A0A108daD8848D8F5d790e4D402921F)
• PIVOT: AtlasOracle (0x9E6928Ec418948ceb9f1cd9872fD312b13D841D0)
• FALLBACK: RedStoneOracle (0x8455EFA4D7Ff63b8BFD96AdD889483Ea7d39B70a)

3. Clear THE's fallback oracle

• Contract: ResilientOracle (0x6592b5DE802159F3E74B2486b091D11a8256ab8A)
• Function: setTokenConfig((address,address[3],bool[3],bool))
• Parameters: asset 0xF4C8E32EaDEC4BFe97E0F595AdD0f4450a863a11, oracles [ChainlinkOracle, AtlasOracle, zero address], enable flags [true, true, false], caching disabled
• Effect: THE is priced by Chainlink, validated against Atlas. The MAIN and PIVOT oracles and the caching flag are unchanged. The unused THE configuration remains on the RedStoneOracle adapter. With no fallback, THE pricing reverts if Chainlink or Atlas is unavailable or their prices fail validation.

Part 3: TRX and lisUSD deprecation

The next deprecation stage for two BNB Chain Core Pool markets, vTRX (0xC5D3466aA484B040eE977073fcF337f2c00071c1) and vlisUSD (0x689E0daB47Ab16bcae87Ec18491692BF621Dc6Ab):

vTRX

• Supply cap: 3,000,000 TRX → 0
• Borrow cap: 1,000,000 TRX → 0
• Collateral factor: 0 (unchanged)
• Liquidation threshold: 52.5% (unchanged)
• Reserve factor: 25% → 100%
• Paused actions: MINT (already paused), BORROW and ENTER_MARKET

vlisUSD

• Supply cap: 2,100,000 lisUSD → 0
• Borrow cap: 4,000,000 lisUSD → 0
• Collateral factor: 50% → 0
• Liquidation threshold: 55% (unchanged)
• Reserve factor: 10% → 100%
• Paused actions: BORROW (already paused), MINT and ENTER_MARKET

Both markets move to the deprecation interest rate model 0xc255352947ef3594C45b0Fe8bcB690e51C3D744A, the one already used by the deprecated Core Pool markets: a 300% base rate, rising to about 500% APR at full utilisation.

4. Pause actions

• Contract: Comptroller (0xfD36E2c2a6789Db23113685031d7F16329158384)
• Function: _setActionsPaused(address[],uint8[],bool)
• Parameters: vTRX — BORROW, ENTER_MARKET; vlisUSD — MINT, ENTER_MARKET
• Effect: No new supply, borrow or collateral enablement on either market. Redeem, repay, liquidation and exitMarket remain unpaused, subject to the existing market checks.

5. Set supply and borrow caps to zero

• Contract: Comptroller (0xfD36E2c2a6789Db23113685031d7F16329158384)
• Functions: _setMarketSupplyCaps(address[],uint256[]), _setMarketBorrowCaps(address[],uint256[])

6. Set the vlisUSD collateral factor to zero

• Contract: Comptroller (0xfD36E2c2a6789Db23113685031d7F16329158384)
• Function: setCollateralFactor(address,uint256,uint256)
• Parameters: vlisUSD, collateral factor 0, liquidation threshold 55% (unchanged)
• Effect: lisUSD no longer adds borrowing power. The liquidation threshold is kept, so this collateral-factor change does not itself change liquidation eligibility. The higher borrow rate still increases debt over time.

7. Set the reserve factor to 100% on vTRX and vlisUSD via _setReserveFactor(uint256).

8. Switch to the deprecation interest rate model on vTRX and vlisUSD via _setInterestRateModel(address).

Summary

If approved, this VIP will:

• Accept ownership of PendlePTVaultAdapter 0x179bD219c2a20a49406C9AdA39634eDac1C7F656 into the Normal Timelock
• Upgrade that proxy to the guarded implementation 0x70B093Df30B62105e1aCb91Feeb1E9a916d7d899, closing the permissionless pause(), unpause() and addMarket() entry points
• Remove the RedStone fallback oracle from THE
• Zero the caps of vTRX and vlisUSD, zero the vlisUSD collateral factor, pause new activity on both, and move both to a 100% reserve factor and the deprecation interest rate model

After execution, both Pendle PT adapters on BNB Chain are owned by the Normal Timelock, but this legacy adapter receives no ACM permission grants.

Validation

• Prettier and ESLint passed for both changed mainnet files.
• Mainnet simulation: npx hardhat test simulations/vip-663/bscmainnet.ts --fork bscmainnet — 55 passing, fork block 123494000.
• All 12 commands and parameters are unchanged from the reviewed PR head.
• Generated propose calldata matches the governance payload exactly; both votes encode castVote(663, 1).

Safe transactions

• propose — VIP Proposal (1.67M), nonce 223.
• vote1 — VIP Proposal (1.67M), nonce 224.
• vote2 — VIP Proposal (1M), nonce 60.

Execute propose first. Before executing either vote, verify that the proposer’s latest proposal ID is 663 and its state is Active.

[greptile-apps]

Confidence Score: 4/5

The proposal appears safe to merge, with a non-blocking recommendation to strengthen the fork simulation around upgrade configuration and effective governance access.

Summary

This PR introduces VIP-672 to transfer the second BNB Chain Pendle PT adapter into governance, upgrade it to the guarded VIP-606 implementation, and install the corresponding ACM permissions.

• Accepts adapter ownership through the Normal Timelock.
• Upgrades the adapter proxy to restore access checks on addMarket, pause, and unpause.
• Grants configuration and emergency permissions to the intended governance accounts.
• Adds fork coverage for prerequisite ownership, implementation replacement, permission records, and retained proxy state.

_{Reviews (1) · Last reviewed commit: "fix(vip-672): correct address checksums ..."}

[fred-venus]

lgtm

[Debugger022]

LGTM

[GitGuru7]

lgtm