USDe Risk Audit / Current assessment
USDe: backing, control and the ability to exit
A token can keep moving while an exit stops. The useful question is what claim you hold, who must deliver the next asset, and whether it can arrive in time.
The central judgement: USDe’s risks are not captured by whether its token trades near one dollar. A managed backing portfolio, privileged issuance and redemption, and the routes through which a holder can leave must all work together. A holder can suffer a delay or forced-sale loss even without a demonstrated backing shortfall.
The evidence supports a whole-system assessment, but does not establish current reserve coverage, complete contract security or an available par exit for every holder. Read the judgement and its evidence.
USDe is a synthetic dollar token supported by a managed asset and hedging arrangement. Holding it is different from holding a bank deposit, earning through staked USDe, or being admitted to the issuer’s redemption service. Those differences determine who owes what, which asset arrives, and who must act before a deadline. The published terms distinguish ordinary holders from eligible Mint Users; a wallet balance alone does not grant the latter route. Claims and published terms.
“Current assessment” synthesizes dated research; it is not a live reserve or permission statement. The 17 October examination of historical conversion records explains more of the USDT that arrived during the 7 October partial refinancing. It does not refresh the last account endpoint on 16 October. Read the conversion, payer and expense boundaries.
The asset must cross more than one boundary
Explore the system by the decision you face
Claims and exits
What you hold, the next asset owed, and the conditions between a wallet balance, a staking queue and a usable payment.
Backing and custody
Separate reported investments from current reserves, and legal recovery from assets available before a deadline.
Control and contracts
Separate committee policy, contract authority and external asset release; retain the dated Safe/controller evidence and unresolved deployment questions.
Lending and integrations
Compare the actual Aave and Base valuation paths, concentrated lending claims, remote access and the additional venue layer.
Connected stress
Follow income compression, interrupted margin, asset impairment and valuation failure through their loss bearers and stabilisers.
All current and earlier research reportsRead the full dated assessment
Start with the claim you actually hold
| Position | What must happen next | Where delay or loss first reaches you |
|---|---|---|
| USDe in a wallet | Find a funded market buyer, or use issuer redemption only with the required eligibility and service access. | A market discount, unavailable route or impaired reserve-based entitlement. Token transferability is not a cash guarantee. |
| Free sUSDe shares | Sell the shares, or convert them into a queued USDe amount and later claim it. | The share’s sale price and the later USDe exit remain distinct. Starting cooldown stops rewards on the burned shares. |
| USDe already in a staking queue | Reach the stored release condition, claim USDe, then separately sell or redeem it. | You no longer hold the burned sUSDe shares to sell. A queue endpoint is not a bank-payment deadline. |
| Collateral with debt | Meet the lender’s health rules; obtain the debt asset to repay and release collateral. | A liquidation deadline can arrive before unstaking, bridging or issuer redemption finishes. Borrower equity is exposed first. |
| USDC supplied to a USDe-backed market or vault | Borrowers must repay, or liquidators must realise enough collateral; withdrawal also requires available liquidity. | You hold a lending claim, not simply USDe. Residual bad debt can reach suppliers in the affected market and through a vault’s allocation. |
| USDe in a venue account or a wrapper | Satisfy the actual account, transfer, maturity and output rules before reaching a usable asset. | Venue restrictions and wrapper-specific claims add conditions. A principal-token label does not itself promise cash at maturity. |
Four risks deserve the most attention
1. Recoverable backing and timely cash remain the critical dependency
The backing perimeter extends beyond the original crypto basis trade. The 20 September investigation follows one material lending chain and one distinct fund chain, chosen using an assessor’s 14 September positions published on 18 September, then checked with separate on-chain observations. A share claim, fund NAV, pool cash and issuer inventory cannot be substituted for one another. Current whole-issuer backing, liabilities, encumbrances and enforceable recovery priority remain unreconciled. Selection and dates · Legal and payment boundaries.
Why serious: a permanent asset loss beyond usable buffers can impair principal; an asset that cannot be released in time can instead cause a payment gap, discount or forced sale. Counterweight: working hedges, independent liquid assets, enforceable senior claims and available reserves can absorb losses or bridge waits. Their names alone do not establish size, access or timely payment.
2. Issuance and exit authority are consequential, not merely administrative
The token owner can replace the minter. The dated Mint V2 observations establish measured limits and sampled authorisations, while the 18 September record identifies selected customer-whitelist and role-revocation actions that qualified for the controller’s separate immediate path. A one-day controller delay is therefore not a universal warning window. The measured control paths.
Why serious: misuse of issuance authority could create obligations without corresponding assets; withdrawal of service access can change who can redeem without freezing all wallet transfers. Counterweight: the inherited controller, multisignature, cap and emergency evidence supports constraints on particular paths, not complete current verification. Defensive restrictions can also prevent damage. No compromise or unbacked issuance was observed.
3. Oracle choices and concentrated lending can transfer loss between participants
Aave’s selected sUSDe valuation follows a share ratio and a capped USDT/USD input, not an executable USDe sale. The selected Base Morpho market used a par primary oracle, with a USDe/USD backup and an unresolved source mismatch in the selecting meta-oracle. The observed vault allocation was concentrated in that market. Installed pricing, concentration and the source mismatch.
Why serious: a responsive price can liquidate a borrower during a temporary discount; a less responsive price can postpone recognition of impaired collateral or weak sale proceeds and expose suppliers. Counterweight: collateral margins, borrower repayments, funded liquidators and a recoverable underlying claim can stop the chain. Neither valuation design is universally safer without the actual exit and loss case.
4. Secondary and venue exits are highly sensitive to size and time
A small near-par quote does not establish a large exit. Venue margin rules can obstruct transfers before liquidation, and an Ethereum exit does not prove that the necessary funds are available on Base. Sized quotes and venue conditions.
Why serious: a sound eventual claim can still be sold at a loss when debt or operational obligations cannot wait. Counterweight: eligible arbitrage, independent venues, spare debt-asset funding and functioning settlement can reconnect prices. Their capacity has to be established on the route the holder can actually use.
These are conditional seriousness judgements, not estimated failure probabilities or four independent losses to add together. The same funding problem can travel through several of these paths.
A clearer payment trail does not settle the last creditor
Event: 7 October 2026, 05:44:35 UTC. Evidence examined: 17 October. Newly matched historical records connect PSM delivery of 10,000 DAI, conversion of 10,000.000000180475496719 DAI into the same quantity of USDS, and 10,001.640594 USDT reaching the routing address and then the borrower. The original reserve’s payment was already supported; these records explain more of its conversion, not another payment.
| Question | Supported result | Limit |
|---|---|---|
| Cash delivered | 10,001.640594 USDT reaches the borrower and joins 10,006.329226 USDT of recorded debt service. | The 4.688632-USDT own contribution is debt service, not a fee; principal/interest allocation remains unestablished. |
| Payer and expense | A PSM event reports zero DAI fee; the swap event reports a 6-parts-per-million rate. | Recipient fields do not identify all funders. The small extra DAI input and complete execution costs remain unattributed. |
| Remaining creditors | The temporary 10,000-USDC principal returned after a new persistent USDC borrowing. | Return to the temporary provider did not extinguish the replacement debt or settle the whole original USDT loan. |
| Last account state | 16 October, 02:58:59 UTC: 5,872,570.456250 USDT and 10,012.220363 USDC owed; health factor above one. | Inherited endpoint, not October 17 state. An open loan is not default; complete history and final funding remain unestablished. |
Follow the historical conversion · Separate recipient, payer and expense.
The earlier ordinary-payment window and matching-claim analysis retains its precise scope. Empty indexed rows do not close missing liquidation/token histories. Documented matching-claim cancellation remains a conditional alternative, not acquired funding. Backing, Base, PT and shareholder cases retain their earlier dates and limitations.
More credit and more routes still need a final payer
The following 5 October analysis retains its 4 October inputs. The 7 October observed partial refinance is a specific advance beyond an assumed funding step, not a replacement for these bounded full-position comparisons.
5 October analysis on preserved 4 October inputs; no new chain observations or successful quotations. The new credit and route-limits chapter tests two explanations of the remaining gap: unused protocol liquidity and combining the inspected corridors. The whole-system judgement still depends on backing, rights, control and timely settlement—not only these selected cases.
| Question | Supported conclusion | Boundary |
|---|---|---|
| More credit | Most accepted collateral-based capacity is already used. Borrowing more against the same position and repaying the proceeds leaves original debt plus any financed fee. | An admitted full refinance remains possible, but creates or preserves a replacement creditor’s claim. |
| Two conversion corridors | A favorable combination can be bounded without counting two full sales of the same holding. | Only two selected corridors; October 4 stock; no replenishment; all first-hop cash generously credited; at most one owed-token unit per intermediate token. PT and Aave are independent alternative cases. |
| Shareholder costs | A reward-conversion spread, a fee-share claim and actual cash/gas expenses have different bases. | Neither another vault’s help page nor another holder’s event establishes the selected holder’s net expense. |
The measured USDT-account identity and positive ordinary shareholder admission remain supported at their original dates. The 4 October chapter preserves matching quote quantities and the natural other-holder payment. The 3 October chapter preserves its earlier repay-all-first, maturity and in-kind comparisons; none is redated by the new analysis.
What the recovery investigation adds
The largest unresolved risk is now more precisely located. A selected Maple Institutional wallet has a large accounting claim on a lending pool, but payment depends on the pool turning other assets into USDC and releasing it. The selected tokenized JAAA holding must cross a different set of investor, fund-processing and network-settlement gates before it can fund an issuer payout. Maple evidence · JAAA evidence.
At Ethereum block 26,019,059, 20 September 2026, 13:35:23 UTC, the assessment-labelled Maple wallet’s calculated claim was 303,218,574.812566 USDC; the pool held 694,920.022526 USDC directly. This is not a loss estimate, a measure of all pool liquidity or proof of a missed repayment. Wallet attribution does not establish the complete legal ownership chain. The measured claim, cash and precise limits.
A separately observed Mint inventory and one matched USDe-burn/USDC-payment pair make the downstream route more concrete. They do not show that Maple or JAAA funded that payment, establish a future accepted redemption amount, or close the issuer-wide reserve and recovery gap. Follow the complete claim-to-payment chapter.
What the governance investigation adds
Permission and usable cash are separate dependencies. Committee approval, contract administration, customer admission and an external custodian or fund’s asset release govern different stages. The later documentary findings add the actors and conditions that can stop a valuable claim from becoming a timely payment. Who decides and who executes; who must release the backing.
The served trust page’s seven-signature/seven-day description conflicts with the five-signature/one-day Ethereum observations recorded on 18 September, which also identified selected immediate routes. Committee deliberation is yet another clock. This is an unresolved disclosure/version issue—not a freshly verified control change or a universal exit window. The four clocks and their sources.
The 21 August committee announcement is more specific than the served roster, but agreement execution is not verified. The 22 July local-PSM review gives conditional support, not production capacity. The 8 September fee-switch result reply reports a passed vote, not actual activation or transfers. These distinctions affect access, independent buffers and income incentives without establishing an observed loss. Conditional local-conversion safeguards; staking and revenue policy.
Current deployed-behaviour verification remains incomplete. Mint/controller correspondence, the Base candidate-source mismatch and remote controls remain open. The published audit record is meaningful, but version-scoped; it does not certify every link through legal recovery, asset release and customer payment. What the audits establish.
What the control continuation changes
Stopping, restoring and completing an exit are different milestones. The 26 September reading of the controller’s custom and inherited source distinguishes a scheduled instruction, continuing immediate permission, cancellation and role administration. It strengthens the explanation of how an affected route may be stopped without proving an equally fast restoration or a maximum service-recovery time. Current complete actors, Mint target constraints and Safe alternatives remain unverified. Authority and source scope; stop/restore asymmetry.
One day of notice is not automatically time to reach cash. In the 18 September configuration, the controller minimum and staking cooldown were each 86,400 seconds. Those equal durations leave no positive margin by themselves for detection, debt repayment and collateral release, transaction inclusion, claiming and final conversion. Free USDe, an existing cooldown or a longer operation delay can change the route. This is a necessary-condition comparison, not a new setting or universal failed-exit finding. Notice versus complete exit.
The Base evidence also becomes more discriminating. Two linked source revisions contain the same candidate MetaOracle file, so the commit-pointer difference alone cannot explain the recorded mismatch; the conditional policy now separates view-only fallback from a stored provider change. Separately, a 28 July reviewer statement reports a fresh timelocked PSM deployment, but no matched production identity, fulfilled seed conditions or usable payout stock was established. What the source comparison excludes; the revised documentary PSM status.
The common constraint remains funded completion. An authorized action does not compel a fund, borrower or custodian to release an asset; a local swap can avoid a bridge for one customer while restocking still depends on network movement. The wider deployment/security assessment remains partial, without negating these narrower source-supported findings. Read the substantial continuation.
Keep five different questions separate
- Backing value
- What can the assets ultimately realise, after liabilities, costs and enforceable priorities?
- Income
- What does the strategy earn or lose over time? Lower rewards do not automatically mean lost principal.
- Market price
- What will a buyer pay on a particular market? A local discount alone does not establish insolvency.
- Oracle value
- What value does the lender accept for its rules? It may deliberately differ from spot price.
- Executable exit
- What asset and amount can this holder obtain, at this size, before this deadline?
For an unleveraged holder who can wait, eventual recovery and access may dominate. For a borrower or treasury with a fixed payment deadline, ready funding can dominate before eventual recovery is settled. For a stablecoin supplier, liquidation realisation and concentration can dominate even though the supplied asset is not USDe. The time-ordered stress examples show how the same event reaches those positions differently.
What would materially strengthen this assessment? For the recovery chains, the missing links are creditor/holder mandates, borrower-specific recall and actual repayment data, fund claimable assets and a timestamp-matched transfer into usable issuer inventory. The remaining system-wide needs include a reconciled assets/liabilities record, deployment-matched Mint V2 and Base meta-oracle semantics, and funded exits for the actual integrations. The selected-chain evidence does not establish those broader conclusions. What remains unproved.
Read the 18 September whole-system foundation, 20 September recovery chapter, 22 September documentary chapter and 26 September control continuation for the earlier arguments. The 27 September collateral-and-repayment chapter adds financial observations and conditional funding analysis. Every dated report and continuation remain accessible, with History preserving the earlier context.