The memo
REJECTED ON AN UNDISCLOSED JURISDICTION AND AN ACCESS RESTRICTION THIS REVIEW COULD NOT CHARACTERIZE. Mellow is genuinely well-architected vault infrastructure: isolated subvaults paired with verifier contracts that whitelist exactly which calls each execution path can make, a granular on-chain role system enumerable for external audit, and coverage from six independent audit firms across its history. Live since 2022 and operated by G3M Labs S.A., that entity's jurisdiction could not be confirmed because the Terms of Service document that would state it is itself blocked from automated access — and separately, the live application actively IP-restricts requests with a message pointing back to that same unreachable Terms of Service, which may indicate a US-person block or some other access policy this review could not distinguish. Redemption is a two-step, curator-dependent process — shares burn immediately on request but liquidity settlement is asynchronous, timed to the curator's ability to unwind subvault positions — a materially different and less certain exit mechanic than an atomic, on-demand redemption.
What would reopen the file
- G3M Labs S.A.'s incorporation jurisdiction and the scope of the IP-access restriction are publicly disclosed and confirmed not to reflect a US-person exclusion
- A canonical list of live vault owners and their per-vault admin, multisig, and timelock configuration is published
- Redemption settlement timing is disclosed as a specific, bounded figure per major vault rather than an open-ended curator-dependent process
- Incident history for Mellow-built vaults is independently verified with working search tooling
Facts on file
- Verdict
- Rejected
- Exposure
- other
- Chains examined
- Ethereum, Mezo, Monad, RSK
- Memo version
- v1
- Reviewed
- Next review