USDe Risk Audit / Current assessment
USDe: backing, control and the ability to exit
A token can keep moving while an exit stops. The useful question is what claim you hold, who must deliver the next asset, and whether it can arrive in time.
The central judgement: USDe’s risks are not captured by whether its token trades near one dollar. A managed backing portfolio, privileged issuance and redemption, and the routes through which a holder can leave must all work together. A holder can suffer a delay or forced-sale loss even without a demonstrated backing shortfall.
The evidence supports a whole-system assessment, but does not establish current reserve coverage, complete contract security or an available par exit for every holder. Read the judgement and its evidence.
USDe is a synthetic dollar token supported by a managed asset and hedging arrangement. Holding it is different from holding a bank deposit, earning through staked USDe, or being admitted to the issuer’s redemption service. Those differences determine who owes what, which asset arrives, and who must act before a deadline. The published terms distinguish ordinary holders from eligible Mint Users; a wallet balance alone does not grant the latter route. Claims and published terms.
“Current assessment” means this pool’s latest synthesis of the 18 September whole-system foundation and the 20 September backing-recovery investigation. It is not a live statement of balances, prices, permissions or portfolio weights.
The asset must cross more than one boundary
Explore the system by the decision you face
Claims and exits
What you hold, the next asset owed, and the conditions between a wallet balance, a staking queue and a usable payment.
Backing and custody
Separate reported investments from current reserves, and legal recovery from assets available before a deadline.
Control and contracts
Follow the Safe, controller, minter and selected immediate permissions; distinguish quantity checks from a reserve guarantee.
Lending and integrations
Compare the actual Aave and Base valuation paths, concentrated lending claims, remote access and the additional venue layer.
Connected stress
Follow income compression, interrupted margin, asset impairment and valuation failure through their loss bearers and stabilisers.
All current and earlier research reportsRead the full dated assessment
Start with the claim you actually hold
| Position | What must happen next | Where delay or loss first reaches you |
|---|---|---|
| USDe in a wallet | Find a funded market buyer, or use issuer redemption only with the required eligibility and service access. | A market discount, unavailable route or impaired reserve-based entitlement. Token transferability is not a cash guarantee. |
| Free sUSDe shares | Sell the shares, or convert them into a queued USDe amount and later claim it. | The share’s sale price and the later USDe exit remain distinct. Starting cooldown stops rewards on the burned shares. |
| USDe already in a staking queue | Reach the stored release condition, claim USDe, then separately sell or redeem it. | You no longer hold the burned sUSDe shares to sell. A queue endpoint is not a bank-payment deadline. |
| Collateral with debt | Meet the lender’s health rules; obtain the debt asset to repay and release collateral. | A liquidation deadline can arrive before unstaking, bridging or issuer redemption finishes. Borrower equity is exposed first. |
| USDC supplied to a USDe-backed market or vault | Borrowers must repay, or liquidators must realise enough collateral; withdrawal also requires available liquidity. | You hold a lending claim, not simply USDe. Residual bad debt can reach suppliers in the affected market and through a vault’s allocation. |
| USDe in a venue account or a wrapper | Satisfy the actual account, transfer, maturity and output rules before reaching a usable asset. | Venue restrictions and wrapper-specific claims add conditions. A principal-token label does not itself promise cash at maturity. |
Four risks deserve the most attention
1. Recoverable backing and timely cash remain the critical dependency
The backing perimeter extends beyond the original crypto basis trade. The 20 September investigation follows one material lending chain and one distinct fund chain, chosen using an assessor’s 14 September positions published on 18 September, then checked with separate on-chain observations. A share claim, fund NAV, pool cash and issuer inventory cannot be substituted for one another. Current whole-issuer backing, liabilities, encumbrances and enforceable recovery priority remain unreconciled. Selection and dates · Legal and payment boundaries.
Why serious: a permanent asset loss beyond usable buffers can impair principal; an asset that cannot be released in time can instead cause a payment gap, discount or forced sale. Counterweight: working hedges, independent liquid assets, enforceable senior claims and available reserves can absorb losses or bridge waits. Their names alone do not establish size, access or timely payment.
2. Issuance and exit authority are consequential, not merely administrative
The token owner can replace the minter. The current Mint V2 route has measured limits and sampled authorisations, while selected customer-whitelist and role-revocation actions qualify for the controller’s separate immediate path. A one-day controller delay is therefore not a universal warning window. The measured control paths.
Why serious: misuse of issuance authority could create obligations without corresponding assets; withdrawal of service access can change who can redeem without freezing all wallet transfers. Counterweight: the observed controller, multisignature approval, caps and emergency permissions are real constraints on particular paths. Defensive restrictions can also prevent damage. No compromise or unbacked issuance was observed.
3. Oracle choices and concentrated lending can transfer loss between participants
Aave’s selected sUSDe valuation follows a share ratio and a capped USDT/USD input, not an executable USDe sale. The selected Base Morpho market used a par primary oracle, with a USDe/USD backup and an unresolved source mismatch in the selecting meta-oracle. The observed vault allocation was concentrated in that market. Installed pricing, concentration and the source mismatch.
Why serious: a responsive price can liquidate a borrower during a temporary discount; a less responsive price can postpone recognition of impaired collateral or weak sale proceeds and expose suppliers. Counterweight: collateral margins, borrower repayments, funded liquidators and a recoverable underlying claim can stop the chain. Neither valuation design is universally safer without the actual exit and loss case.
4. Secondary and venue exits are highly sensitive to size and time
A small near-par quote does not establish a large exit. Venue margin rules can obstruct transfers before liquidation, and an Ethereum exit does not prove that the necessary funds are available on Base. Sized quotes and venue conditions.
Why serious: a sound eventual claim can still be sold at a loss when debt or operational obligations cannot wait. Counterweight: eligible arbitrage, independent venues, spare debt-asset funding and functioning settlement can reconnect prices. Their capacity has to be established on the route the holder can actually use.
These are conditional seriousness judgements, not estimated failure probabilities or four independent losses to add together. The same funding problem can travel through several of these paths.
What the concrete cases establish
A price for lending is not a sale price
The Aave case identifies the actual sUSDe valuation inputs. The Base case identifies the market, oracle and supplying adapter. Those bindings make the risk paths concrete; they do not prove that collateral can be sold at the accepted value.
A large allocation is not ready cash
In the same Base batch, the selected market represented 88.761411% of the Steakhouse High Yield USDC Edition vault’s expected assets. That denominator is this vault—not USDe reserves or the ecosystem. The market’s nominal unborrowed assets were not a measured withdrawal guarantee.
18 September 2026, 15:25:31 UTC; Base block 51,477,892. Exact amounts, identities and limits.
The Ethereum single-pool comparison is equally important. A read-only quote for 100 USDe returned 100.026581 USDT; a separate quote for 100,000 USDe returned 10,062.463842 USDT. These were independent simulations in one USDe/USDT pool, not executed trades or a market-wide price series. The small and large quotes used different blocks. They demonstrate a size problem on that sampled route, not a 90% global depeg.
18 September 2026: the 100-USDe quote at Ethereum block 26,005,291 (15:29:59 UTC); the 100,000-USDe quote at block 26,005,285 (15:28:47 UTC). Outputs are USDT, not assured USD cash. Pool, quote arguments and comparison table.
What the recovery investigation adds
The largest unresolved risk is now more precisely located. A selected Maple Institutional wallet has a large accounting claim on a lending pool, but payment depends on the pool turning other assets into USDC and releasing it. The selected tokenized JAAA holding must cross a different set of investor, fund-processing and network-settlement gates before it can fund an issuer payout. Maple evidence · JAAA evidence.
At Ethereum block 26,019,059, 20 September 2026, 13:35:23 UTC, the assessment-labelled Maple wallet’s calculated claim was 303,218,574.812566 USDC; the pool held 694,920.022526 USDC directly. This is not a loss estimate, a measure of all pool liquidity or proof of a missed repayment. Wallet attribution does not establish the complete legal ownership chain. The measured claim, cash and precise limits.
A separately observed Mint inventory and one matched USDe-burn/USDC-payment pair make the downstream route more concrete. They do not show that Maple or JAAA funded that payment, establish a future accepted redemption amount, or close the issuer-wide reserve and recovery gap. Follow the complete claim-to-payment chapter.
Keep five different questions separate
- Backing value
- What can the assets ultimately realise, after liabilities, costs and enforceable priorities?
- Income
- What does the strategy earn or lose over time? Lower rewards do not automatically mean lost principal.
- Market price
- What will a buyer pay on a particular market? A local discount alone does not establish insolvency.
- Oracle value
- What value does the lender accept for its rules? It may deliberately differ from spot price.
- Executable exit
- What asset and amount can this holder obtain, at this size, before this deadline?
For an unleveraged holder who can wait, eventual recovery and access may dominate. For a borrower or treasury with a fixed payment deadline, ready funding can dominate before eventual recovery is settled. For a stablecoin supplier, liquidation realisation and concentration can dominate even though the supplied asset is not USDe. The time-ordered stress examples show how the same event reaches those positions differently.
What would materially strengthen this assessment? For the recovery chains, the missing links are creditor/holder mandates, borrower-specific recall and actual repayment data, fund claimable assets and a timestamp-matched transfer into usable issuer inventory. The remaining system-wide needs include a reconciled assets/liabilities record, deployment-matched Mint V2 and Base meta-oracle semantics, and funded exits for the actual integrations. The selected-chain evidence does not establish those broader conclusions. What remains unproved.
Read the whole-system foundation for the connected argument and the recovery chapter for the two claim-to-payment routes. Coverage states the inspection boundary. The complete research catalogue includes all seven dated reports; History preserves the earlier reports and their surrounding pages.