USDe Risk Audit / Coverage
What this assessment covers—and what it does not
The evidence connects the system while leaving specific recovery, execution and security questions unresolved.
Known links do not close every recovery or execution gap
This assessment follows how USDe-dependent positions can lose value or access. It distinguishes the selected source and deployed-state checks from unverified recovery and execution behavior. It is not complete security, solvency or exit assurance.
The largest missing conclusion is an issuer-wide recovery and deadline-cash bound. A selected-chain assessment is now available: Maple’s pool claim/direct cash, Base JAAA shares, Mint inventory and a matched token-payment pair. A conditional asset/entity-specific cash ladder is supported. A synchronized issuer assets/liabilities/encumbrance record, current signed assurance and legally enforceable full recovery schedule are not. No current reserve percentage or liquidity-sufficiency score follows. The narrower remaining gap.
What the 20 September investigation newly establishes
| Route | Added evidence | Still not established |
|---|---|---|
| Maple Institutional | Assessor-selected wallet; on-chain pool/manager/queue binding; same-block share claim and direct USDC; later conversion getters. | Beneficial owner/agency, executed private terms, all other pool liquidity, borrower-specific recall and a full-exit deadline. |
| Tokenized JAAA | Dated materiality, attributed large-exit/sample evidence, Base token identity and holder/supply balance. | Current dollar NAV, registered redemption rights, claimable funded proceeds, current Solana cash-out or a proved onward route to issuer inventory. |
| Ethereum issuer payout | Three distinct token inventories and active-asset/global-limit readings; one standard burn/payment log pairing. | Exact Mint-event ABI match, separately fetched receipt/status, source-of-funds link to Maple/JAAA, accepted demand or total redemption capacity. |
| Cash conservation | A resource-specific conditional ladder and maximum-prefix bridge requirement; paired timing, loss and competing-payment cases. | An available credit facility, future actual receipt times, calibrated default probabilities or a reconciled issuer reserve buffer. |
Exact sources, state identities and downloadable observation table. The investigation is bounded to these two selected backing chains and the payout boundary; it is not an all-provider audit.
What was covered, and how far the evidence reaches
| Question | Evidence obtained | Material boundary |
|---|---|---|
| What does a holder own? | Published USDe/Mint User terms; staking and Silo source paths; distinctions among plain tokens, shares, queues, debt, wrappers and venue accounts. | No individual signed agreement or enforceability opinion. No completed current active pre-maturity PT case. |
| What supports value and payment? | Documented backing perimeter, dated deployment reporting, selected counterparty/RWA reviews and operational custody/settlement conditions. | Current portfolio weights, actual agreements, recovery priority, usable reserve and matched assurance remain unresolved. |
| Who can change issuance or access? | Ethereum token/controller/minter bindings; sampled roles, threshold, delay, whitelisted selectors, active assets, caps and stable-amount helper calls. | No exhaustive role history, complete Safe control graph, full Mint V2 implementation equivalence or end-to-end signed-order security test. |
| How does an integration price and transmit risk? | Direct-sUSDe Aave pricing and separate reserve/eMode settings; Base Morpho market tuple, oracle inputs, vault-adapter binding and same-batch allocation. | No all-integration coverage. The Base meta-oracle candidate mismatches an observed formula; complete fallback semantics and issuer ownership are not established. |
| Can a holder actually leave? | Size-specific quotes in one Ethereum USDe/USDT pool; Bybit generic margin/transfer rules; selected Base remote-token owner, peer and endpoint reads. | No broad executable-depth survey, filled trade, funded Base unwind, complete remote security configuration or current USDe-specific UTA tier/account verification. |
| How can risks combine? | Explicit loss-bearer and deadline paths, independent hypothetical loss/cash scenarios, a borrower unwind sequence and a qualified historical countercase. | No calibrated probabilities, measured joint-stress capacity, complete counterparty overlap or universal contagion conclusion. |
The actual case studies—not the whole ecosystem
Ethereum Aave: the installed direct-sUSDe price path was identified, including its share ratio and capped USDT/USD input. The investigation did not replace that evidence with a proposed principal-token market. Base reserve settings and eMode settings remain separate, as do their 17 September date and the 18 September price reads. Read the case.
Base Morpho and Steakhouse: one USDC/USDe market was bound to its actual oracle and supplying adapter. Concentration is measured against the selected vault’s assets, not Ethena’s reserves. The separate named Ethena-oriented vault showed dust in the tested market, not a demonstrated material circular-funding loop or proof of zero exposure elsewhere. Market and oracle; allocation and ownership boundary.
Ethereum secondary exit: one pool and four independent quote sizes. The small near-par example and weak large-size proceeds belong together. They are not a global depeg measurement and do not establish a Base liquidation route. Quotes, addresses and arguments.
What stronger evidence should resolve
The recovery investigation makes the selected chains concrete but leaves decisive joins open: who legally controls the observed holding, what exact notice or redemption conditions apply, what net proceeds are claimable, and when those proceeds reach the paying entity. Actual borrower payments, holder mandates and matched fund-to-issuer transfers would narrow these questions more than another headline portfolio percentage. Specific evidence that would change the result.
Deployed security and control semantics then need to be tied to consequential operations, particularly Mint V2 and the Base meta-oracle mismatch. Funded integration unwinds need actual debt assets, collateral realisation, bridges or remote conversion capacity, and the first party bearing residual loss. Joint stress must follow those verified dependencies rather than assume circularity from shared names.
This is a continuing investigation, not a promise of a future completion date or a fixed number of checks that would certify USDe. The foundation’s limitation section names the unresolved conclusions; the method page explains what each evidence type can support.
Historical observations keep their own dates
The scope saved with the earlier reports records eighteen discovered components. That count was not a percentage of ecosystem exposure. The research catalogue retains every report with its own dates and inspection limits.
Use the preserved earlier scope to understand those dated reports, and History to reach the surrounding context. The current assessment combines the 18 September foundation with 20 September selected-chain recovery evidence without changing older observations.