Sources: BTG Pactual fund factsheet (May 2026) and annual return history (Yahoo Finance), reconciled to the published since-inception figure; USD borrow leg built from the Fed funds effective rate (FRED series FEDFUNDS, Board of Governors), annual averages, 2026 through May. Returns net of fees, gross of Brazilian tax. Past performance is not indicative of future results.

Methodology note on the borrow leg. The debt is USDC, priced off US rates, not CDI. Across the historical replay the model holds the spread over US policy constant at the level implied by today's borrow input, and lets the base rate follow Fed funds year by year. An earlier version of this page held a single borrow rate fixed across the whole series, which charged the 2009–2021 years a cost of funds that did not exist while policy sat near zero. The correction raises the simulated leveraged track record and is disclosed here for that reason. It changes no forward-looking figure: the projection uses the borrow rate you set.

Driven by the scenario inputs above. Labels show nominal BRL at start, today, and the end of the horizon. The efixDI+ path is an idealized upper bound (leverage held with no liquidation); see the scenario note.

Scope note. The OpenZeppelin engagement covered a single file, EfixDIToken.sol, at one commit, deployed on Polygon. The Base collateral token, EfixDITokenBase, is a different contract and was not audited. It has a smaller privileged surface than the audited contract (no emergencyWithdraw, no adjustable max supply, no treasury address, no global transfer pause) and adds bridge mint and burn functions. The LayerZero bridge was permanently discontinued in May 2026; the exposed operator EOA, the compromised deployer and the MinterBurner contract hold no roles on the Base token, which anyone can verify with hasRole on Basescan. The audit report also states that integrations, including the collateral vault, were not reviewed.

Token provenance. The Base token's own history, stated with the same explicitness as the bridge's, all timestamps UTC and every step verifiable from RoleGranted/RoleRevoked events since the deployment block. 2026-02-04 20:55: EfixDITokenBase deployed by the deployer EOA 0x7C54…7537, later classified as compromised; the constructor granted it DEFAULT_ADMIN, MINTER, PAUSER and BRIDGE (tx 0x98c6…e437 ↗). 2026-03-07: DEFAULT_ADMIN granted to the operator EOA 0x9eFc…9e12 (tx 0x9c18…f150 ↗), which self-granted MINTER the same hour (tx 0xfb42…2a19 ↗); the deployer's ADMIN and MINTER were revoked minutes later. 2026-05-15 22:54: DEFAULT_ADMIN granted to the Safe multisig 0x9040…EeD4 (tx 0x461f…3cf2 ↗), and a cleanup batch at 23:08 revoked every remaining role except the operator EOA's MINTER: BRIDGE and PAUSER from the deployer, MINTER and BRIDGE from the MinterBurner, DEFAULT_ADMIN from the operator EOA (tx 0x8f37…da96 ↗). 2026-05-27: MINTER granted to the successor signer 0x8f8C…CCb1, an MPC-custodied address (tx 0xb2fd…249b ↗); it received 0.01 ETH of gas from the operator EOA about an hour earlier as part of the same migration (tx 0x0a88…33fb ↗); gas funding confers no authority. 2026-05-28 15:43: MINTER revoked from the operator EOA (tx 0xb001…e729 ↗). Since then the sole MINTER is 0x8f8C…CCb1; the only other active roles are the Safe's DEFAULT_ADMIN and PAUSER, and BRIDGE_ROLE has zero holders, which anyone can verify with hasRole on Basescan.