USDe Risk Audit / Coverage
What this assessment covers—and what it does not
The evidence connects the system while leaving specific recovery, execution and security questions unresolved.
Known links do not close every recovery or execution gap
This assessment follows how USDe-dependent positions can lose value or access. It distinguishes the selected source and deployed-state checks from unverified recovery and execution behavior. It is not complete security, solvency or exit assurance.
The largest missing conclusion is an issuer-wide recovery and deadline-cash bound. A selected-chain assessment is now available: Maple’s pool claim/direct cash, Base JAAA shares, Mint inventory and a matched token-payment pair. A conditional asset/entity-specific cash ladder is supported. A synchronized issuer assets/liabilities/encumbrance record, current signed assurance and legally enforceable full recovery schedule are not. No current reserve percentage or liquidity-sufficiency score follows. The narrower remaining gap.
17 October: more historical conversion evidence, not a new account endpoint
The new evidence narrows the internal conversion gap in the 7 October partial refinancing. Eleven selected historical logs and four historical asset bindings join the previously recorded USDT receipt. The common transaction identity and exact quantities strengthen that payment-to-resource explanation. They do not establish a full receipt, trace or lifetime wallet history.
Better evidence today can describe an older payment
| Proposition | Disposition after the historical examination |
|---|---|
| DAI → USDS → USDT passage | Selected transfers and interpretable financial events now support the conversion. It is not wholly unobserved. |
| All upstream funding and payers | Initial USDC transfers and the source of the extra 0.000000180475496719 DAI remain incomplete. |
| Expense attribution | One event-specific DAI fee amount and a swap-rate field are known. Itemized gas, payer, sponsor and complete net expense are not. |
| Indexed history | No returned rows across the requested 60,586-block range; independent completeness is expressly unestablished. The earlier 54,378-block gap and 6,208-block ordinary-role window keep their separate scope. |
| Persistent creditors and other cases | No October 17 account endpoint or final payoff. USDT and USDC debts, historical Base/PT/shareholder findings and conditional matching-claim alternatives remain dated. |
The missing full receipt does not negate the matched historical events or make the transaction currently pending. Failed history categories remain unknown, not zero. Favorable accepted-value headroom and the actual partial funding remain supported at their existing dates. Read the precise evidence boundaries.
16 October: a covered ordinary window, not complete gross history
The new payment-window and matching-claim chapter adds current selected-account evidence. It does not reopen the established USDT-account identity, the historical partial refinance or positive October 2 ordinary shareholder admission as missing findings. It also does not refresh the earlier reserve cash, Base ownership or PT exit records.
One covered window does not fill every history gap
| Proposition | Now supported | Still unestablished |
|---|---|---|
| Ordinary payments after October 15 | Two exact Pool role filters over one 6,208-block range returned no matching records. | Complete liquidation, debt-token and underlying-token history; the older 54,378-block gap. |
| Matching claim entitlement | Direct aUSDT and aUSDC balances are zero at the selected address, with underlying identity checked. | Claims elsewhere, a purchase/gift, admission and sufficient final funding. |
| Settlement effect on suppliers | The conditional ledger distinguishes cash arrival from cancellation of offsetting claims. | Executed full cash or claim settlement, deployed-route certification and current reserve ratio change. |
| The continuing obligation | Both accumulated debts remain positive; accepted health factor remains above one. | Default is not established. Complete final receipts, net expenses and realized return remain unknown. |
A zero returned match count is different from a failed query, and both are different from a zero flow. Cash service is different from claim cancellation. The study remains partial because complete funding, recovery and attributable expense are not established—not because the favorable findings are ignored. Full scope and limitations.
15 October: an open obligation, not a reconstructed payment history
The new chapter incorporates the later 7 October, 16:21:23 UTC cutoff and the 15 October, 06:13:35 UTC Ethereum endpoint. It updates a named account and two reserve screens, not every USDe-related position. Full coverage and remaining questions.
| Question | Now established | Still unestablished |
|---|---|---|
| Token debt and dollar marks | Both persistent debts remain positive. The later October 7 and October 15 quantity/price decompositions explain differing dollar-book changes. | Repayment, full return or net expenses from a favorable display change. |
| Current indices and scaled units | October 15 accumulated balances reconcile to unchanged scaled endpoint units and current normalized indices. | Zero gross actions, a complete accrual-only history or an all-path implementation conclusion. |
| Event coverage | 3,170 October 7 blocks have successful scoped ordinary-account queries with no matches. | Successful history coverage of the subsequent 54,378 blocks through October 15; an unavailable history is not an empty history. |
| Reserve stocks | Same-block token balances, supplier claims and variable-debt totals, separately in USDT and USDC. | Borrower ownership, admitted full credit, reconciled reserve equity or guaranteed simultaneous withdrawal. |
| Other integrations | Earlier Base/PT/shareholder findings and the positive October 2 admission remain preserved. | New local funding, funded PT wait, full final receipt or selected-holder net costs. |
The account remains above its accepted-value threshold and the named sUSDe endpoint holds more than its nominal claim. Those favorable facts coexist with incomplete final-funding evidence; neither default nor complete recovery follows. Protections and sensitivity.
7 October: a partial refinance is observed; final recovery remains incomplete
The new dated evidence advances the funding proposition without completing the full-position investigation. It also narrows route measurement and shareholder event coverage. The prior actual USDT-account identity and positive ordinary admission are retained at their original dates. Read the new chapter.
| Question | Now supported | Not established |
|---|---|---|
| Named-account funding | Actual temporary USDC arrival, USDT payment, replacement USDC borrowing and temporary principal return at 05:44:35 UTC. | Full collateral recovery, standing capacity, complete receipt/cost record or final repayment of both persistent debts. |
| Later account debt | At 14:04:11 UTC, 5,866,650.101604 USDT plus 10,000.460197 USDC remain. | Older USDT-only readings are not rewritten; later balance changes are not all attributed to passive interest. |
| Wider PT route | Exact PT/sUSDe/sDAI/DAI/USDC quantities at one block; 342,677.470045 USDC final quote. | Executed or funded exit. Gap is 557,322.529955 before extra costs against hypothetical 900,000-USDC principal, for this route only. |
| Base resources | Direct/free/same-market resources inspected as zero; stored-share debt remeasured with a 34-second accrual lag. | Complete wealth, absent facilities, or future payoff invoice. |
| Selected shareholder | Preview increases; a successful owner-indexed standard-withdrawal query returns zero matches in 2,000 blocks. | A failed withdrawal, lifetime history, actual net payout or attributable complete expenses. |
A zero observation and an unavailable record answer different questions
The exceptional oracle, authority, bridge and PSM branches are not certified by these financial observations. Full Aave and Base funding, a sufficient PT final route over an actual funded interval, and shareholder-specific net receipts remain open. Completion boundary.
5 October: credit, combined routes and cost applicability—not fresh state
The new dated analysis adds primary documentary evidence and financial deductions using preserved October 4 records. It does not acquire new chain observations, successful quotes, financing commitments or transaction receipts. Complete funded-recovery coverage remains partial.
| Supported advance | Boundary preserved |
|---|---|
| Additional credit versus refinancing | Frozen collateral-based slack is not an executable allowance. Reallocation does not donate cash; a separately admitted full refinance remains possible with a replacement obligation. |
| Two-corridor cash envelope | Two selected corridors only; October 4 inputs; no replenishment; favorable all-stock relaxation; at most one owed-token unit per intermediate token. PT’s principal is hypothetical; Aave is an independent alternative use. |
| Borrowing versus liquidation headroom | The actual Aave USDT account and its favorable headroom remain dated findings. The 90% borrowing LTV is distinct from the 92% liquidation threshold. |
| Product and fee applicability | Another linked vault, a MORPHO reward-conversion spread and an event-specific fee-share ratio do not establish the selected holder’s principal or execution cost. |
The earlier fixed-block PT quantities, actual owed-token identity, available underlying quantity and positive ordinary shareholder admission remain supported at their original dates. The combined bound does not make the older route quotations a completed recovery. Complete selected Base resources, actual PT financing and adequate final cash, full Aave repayment resources and selected-holder net expenses remain unestablished. Complete disposition and alternatives.
4 October: quantities and payment evidence advance; complete recovery remains partial
New Ethereum financial comparisons share block 26,117,487, 07:26:23 UTC. The Base snapshot is 52,154,691, 07:25:29 UTC; a matched natural payment precedes it at 52,154,675, 07:24:57 UTC. These are new specified financial records, not a refresh of every earlier claim or verification of exceptional protections. Full disposition and remaining conditions.
| Question | Advance | Remaining boundary |
|---|---|---|
| PT final cash | Two exact-quantity final-USDC alternatives at one Ethereum block | Named million-PT paths fail the hypothetical 900,000-USDC principal comparison; adequate alternative funding and the actual wait remain unestablished |
| Actual Aave account | Whole sUSDe collateral, USDT debt, positive accepted-value headroom and combined cash enquiry | Conditional terminal gap is not bad debt or every unwind’s minimum advance; full cash recovery is unestablished |
| Vault payment and costs | Another holder’s withdrawal, burn and USDC transfer matched; performance-fee shares separately identified | No selected-holder net payout, all-in fees, exact fee burden or priority; payment already precedes snapshot |
| Selected Base funding | Current stored-share debt and negative owned-resource screen for named balances/position | 32-second accrual lag; core inventory not assigned credit; failed full-size request unknown rather than zero |
| Portfolio cash screen | New seven-market count and selected-market aggregate | No complete seven-market claim/cash reconciliation; older five- and eight-market tables retain their dates |
The actual USDT-account identity and positive ordinary shareholder checks from October 2 remain supported findings. October 3’s documentary and conditional calculations remain analysis of older inputs. The broader funded-recovery and exceptional-control assessments are not completed by the number of pages, successful quotations or an observed payment to someone else.
3 October: a fuller obligation comparison, not a new liquidity snapshot
The actual Aave USDT account and tested normal shareholder admission remain established at their 2 October snapshots. This continuation adds documentary comparison and conditional calculations. It supplies no new EVM observation, market quote, financing commitment or transaction-cost record. Full supported and unestablished boundary.
| Area | New supported distinction | Still not established |
|---|---|---|
| Actual Aave account | Repay-all-first prior funding versus terminal repayment; the free-USDe sale spends the same selected pool stock. | Full-position accessible cash or committed advance. The non-replenished single-pool bound is not a universal minimum outside loan. |
| PT alternatives | Historical carry, matched PT/YT resources and maturity versus hypothetical financing cost. | A matching YT acquisition, current final price, sufficiently sized final route and a funded cash-arrival interval. |
| Shareholder | A cash exit versus a direct-claim exit; penalty value versus actual cash and external expenses. | Current all-in net payment and intervening competing use; admission for an untested alternative. Ordinary October 2 findings remain positive. |
| Base | The earlier named-pool bound survives; examined public issuer terms and unrelated allocation caps do not supply fixed-deadline account funding. | Complete admitted Base-USDC funding, broader sufficient sale proceeds or absence of all alternatives. |
The 3 October historical source comparison uses 25 August rate data published 31 August. The financing illustration instead uses October 2 quantities and an explicitly assumed common final price. Their dates and economic meanings remain separate. No completed financed-recovery or exceptional-security conclusion follows from either.
2 October: actual accounts and normal access are measured; full financing is still partial
This continuation obtained new permitted financial observations from 09:15:43–09:45:49 UTC. It is not another relabelling of September balances. The 1 October chapter remains a distinct frozen-input analysis with no new chain reads. New findings and their remaining conditions.
| Question | Now established at the stated boundary | Still unestablished |
|---|---|---|
| Actual Aave cross-token account | Direct sUSDe collateral, USDT debt, eMode and reserve-ID join; outside-Aave USDe and its same-batch sized USDT quote. An explicit partial principal budget before costs. | Full-position repayment, unrestricted inventory use, execution costs and actual completion. The old USDC example remains hypothetical; a USDT case now supplies the intended alternative. |
| Specific shareholder | Exact shares, redemption preview and positive tested sender/receivers. The claim fits ordinary cash before competitors without a forced penalty. | Actual after-cost payout, later admission and priority. Zero bundle allowance and native ETH are separate from positive cash and gate results. |
| Base full-position route | The complete input budget is queried; same-batch recorded debt exceeds the non-replenished stock of three named direct pools. | Consumed input, residual realization, adequate full-position final cash and prior funding beyond that finite set. No Base-wide or issuer loss follows. |
| PT final token | A quantity-matched indicative path now reaches USDC through separately clocked observations. | Compatible-time funded waiting and adequately sized final proceeds. The observed timer does not preserve current quotes for future disposal. |
The five currently listed vault markets are a new October 2 enumeration, not a replacement of the September 28 eight-market record. All historical report bytes, source cutoffs and exact reader downloads remain preserved. Normal financial evidence does not resolve exceptional oracle, authority, bridge or PSM protection.
1 October: financing constraints advanced without new state
The table records what was established on 1 October. The actual-account and normal-admission gaps advanced on 2 October as explained above; this is not the current unresolved-work list.
No new on-chain observations were made in the 1 October continuation. Public documentary acquisitions and offline analysis use the earlier 27–28 September inputs. That dated analysis is not a fresh borrower, pool or shareholder snapshot, and financed-recovery coverage remains partial.
| Area | What is better specified | What remains unestablished |
|---|---|---|
| Base | Terminal debt-token cash bound for four frozen sampled outlets, without guessing input consumption. | Current complete-position prior finance, final proceeds and independent additional resources. |
| PT | Final quantity/price/duration condition based on the old sUSDe-output quote. | A sized final USDC route and credit commitment; the modeled debt and APR are illustrative. |
| Aave | Measured USDe-debt accounts preserved as their own case. | The intended actual direct-sUSDe account owing USDC or USDT and its repayment resources. |
| Shareholder | Specific published Base bundle, gross/net amounts, receiver-admission and competition conditions. | Actual shares, authorization, compatible route, admitted receiver and timely after-cost cash. |
Normal financial quotes still do not resolve exceptional oracle, remote-supply, authority or PSM protections. The October script is additive to the earlier arithmetic companion, not a replacement or a fresh-state reader. Full completion boundary · Dates and calculation basis.
September 28: specific financial gaps narrowed, complete financing still partial
This table records the 28 September disposition, not the current list of unknowns. The 2 October investigation advances the full-budget enquiry, actual USDT account, specific shareholder checks and final-token quote while retaining their remaining financing conditions.
The September 27 financial chapter remains available at its original date. Its 28 September UTC continuation advances each of the previously specific financial gaps. Complete-position financing remains partial; that status is not inferred merely from the unresolved control study. The substantive continuation.
| Question | Newly established | Still missing |
|---|---|---|
| Selected Base borrower and local sale | Same-call debt, collateral, local quote sizes and prior-paydown comparison. | Full-position financing and sufficient proceeds. The million-unit quote reaches a price boundary with consumed input unknown; the full-position quote failed. |
| Measured Aave account | Two activity-selected sUSDe/USDe accounts, eMode 32, actual debt and headroom. | The intended sUSDe/USDC or sUSDe/USDT measured/funded account. The original USDC example remains hypothetical. |
| Active PT pre-maturity exit | Matched AMM and four sized net sUSDe-output quotations. | Final USDC route and the financing or collateral release needed before repayment. |
| Other vault resources | Eight expected claims reconcile; seven other markets’ cash screen is quantified. | A shareholder’s admitted, timed withdrawal, cost and priority across those resources. |
| Controls and external recovery | No new security or private-rights verification from these financial views. | Exceptional oracle behaviour, bridge/authority/PSM protection and applicable external release rights. |
The boundary-limited quote does not prove a realized loss; the Aave debt is not relabelled USDC; the PT’s accounting equivalent is not another cash quote; and the cash screen is not an executable withdrawal maximum. Proposition-level changes and remaining finance questions.
What the 26 September continuation newly supports
The new work reads relevant controller and candidate-oracle source, compares exact file identities and follows specific PSM/auditor publications. It does not refresh contract settings or complete deployment assurance. The earlier documentary and recovery tables below retain their dates. Read the full source-based continuation.
| Area | Newly supported | Still partial |
|---|---|---|
| Issuer control and restoration | Relevant custom/inherited controller bodies distinguish scheduling, immediate use, cancellation, administration and call handling; notice is compared with the complete exit. | Deployment-matched Mint target, complete present actor/admin paths, installed Safe alternatives and target-transfer constraints. |
| Selected Base oracle | Two linked revisions share the same candidate blob. A more precise conditional policy distinguishes fallback reads from persistent selection changes. | Actual instance/implementation/initialization lineage, resolved discrepancy and installed transition, exception and change-control evidence. |
| Remote and local PSM | 28 July reviewer claim of fresh timelocked deployment; auditor artifact discovery; separate local-swap and restocking dependencies. | Relevant production identity, original audit bodies, condition closure, effective source–Base authority/supply path and usable payout inventory. |
Partial does not mean every control failed. Examined source restrictions and the later deployment statement are meaningful evidence. Missing correspondence prevents stronger deployed conclusions. The September 22 control register is unchanged, not a newly enumerated permission set. Proposition-level changes and missing evidence.
Documentary governance advances; deployed-control verification remains partial
The 22 September governance and control assessment adds later appointment evidence, conflicting control-clock disclosures, order-acceptance and terms-precedence analysis, liquidity/revenue-policy distinctions, conditional PSM safeguards and scoped audit reading. It links those decisions to the existing Maple/JAAA and issuer-payment chains. It adds no current contract query or security test. Read the substantial documentary chapter.
| Established at the stated evidence level | What remains unverified |
|---|---|
| 21 August appointment announcement, subject to signing; Foundation screening boundary. | Agreement execution, full mandates and key-holder independence. |
| Served control-clock conflict and the earlier action-specific observations. | Deployment-specific disclosure reconciliation and complete present Mint/controller control graph. |
| March cooldown framework; August proposal and September fee-switch result statement. | Autonomous operation, compliance, milestone satisfaction and actual revenue transfers. |
| July PSM test review and explicit conditions. | Original Guardian audit, production condition closure, supply treatment and funded local capacity. |
| Complete Pashov Markdown and selected Code4rena scope/dispositions. | Current audit-to-build correspondence and whole-system assurance. |
| New factory README locator alongside the inherited Base source discrepancy. | Resolved instance build, transition/fallback/freshness behaviour and oracle authority. |
The original foundation inspection diagram below remains dated to its evidence. The recovery table likewise describes its own 20 September observations. Neither is a percentage-of-risk coverage measure. The broader investigation of deployed behaviour remains incomplete.
What the 20 September investigation newly establishes
| Route | Added evidence | Still not established |
|---|---|---|
| Maple Institutional | Assessor-selected wallet; on-chain pool/manager/queue binding; same-block share claim and direct USDC; later conversion getters. | Beneficial owner/agency, executed private terms, all other pool liquidity, borrower-specific recall and a full-exit deadline. |
| Tokenized JAAA | Dated materiality, attributed large-exit/sample evidence, Base token identity and holder/supply balance. | Current dollar NAV, registered redemption rights, claimable funded proceeds, current Solana cash-out or a proved onward route to issuer inventory. |
| Ethereum issuer payout | Three distinct token inventories and active-asset/global-limit readings; one standard burn/payment log pairing. | Exact Mint-event ABI match, separately fetched receipt/status, source-of-funds link to Maple/JAAA, accepted demand or total redemption capacity. |
| Cash conservation | A resource-specific conditional ladder and maximum-prefix bridge requirement; paired timing, loss and competing-payment cases. | An available credit facility, future actual receipt times, calibrated default probabilities or a reconciled issuer reserve buffer. |
Exact sources, state identities and downloadable observation table. The investigation is bounded to these two selected backing chains and the payout boundary; it is not an all-provider audit.
What was covered, and how far the evidence reaches
| Question | Evidence obtained | Material boundary |
|---|---|---|
| What does a holder own? | Published USDe/Mint User terms; staking and Silo source paths; distinctions among plain tokens, shares, queues, debt, wrappers and venue accounts. | At the foundation’s date: no individual executed agreement or enforceability opinion; no complete active PT case. The September 27 work adds the active maturity/output comparison; September 28 adds a sized native sUSDe sale, not a complete USDC repayment route. |
| What supports value and payment? | Documented backing perimeter, dated deployment reporting, selected counterparty/RWA reviews and operational custody/settlement conditions. | Current portfolio weights, actual agreements, recovery priority, usable reserve and matched assurance remain unresolved. |
| Who can change issuance or access? | Ethereum token/controller/minter bindings; sampled roles, threshold, delay, whitelisted selectors, active assets, caps and stable-amount helper calls. | No exhaustive role history, complete Safe control graph, full Mint V2 implementation equivalence or end-to-end signed-order security test. |
| How does an integration price and transmit risk? | Direct-sUSDe Aave pricing and separate reserve/eMode settings; Base Morpho market tuple, oracle inputs, vault-adapter binding and same-batch allocation. | No all-integration coverage. The Base meta-oracle candidate mismatches an observed formula; complete fallback semantics and issuer ownership are not established. |
| Can a holder actually leave? | Size-specific quotes in one Ethereum USDe/USDT pool; Bybit generic margin/transfer rules; selected Base remote-token owner, peer and endpoint reads. | No broad executable-depth survey, filled trade, funded Base unwind, complete remote security configuration or current USDe-specific UTA tier/account verification. |
| How can risks combine? | Explicit loss-bearer and deadline paths, independent hypothetical loss/cash scenarios, a borrower unwind sequence and a qualified historical countercase. | No calibrated probabilities, measured joint-stress capacity, complete counterparty overlap or universal contagion conclusion. |
The actual case studies—not the whole ecosystem
The descriptions below preserve the foundation’s earlier scope. The 27 September financial comparison adds current selected Aave/Base inputs and an Ethereum PT/Morpho maturity—not a completed Aave PT listing or all-wrapper review.
Ethereum Aave: the installed direct-sUSDe price path was identified, including its share ratio and capped USDT/USD input. The investigation did not replace that evidence with a proposed principal-token market. Base reserve settings and eMode settings remain separate, as do their 17 September date and the 18 September price reads. Read the case.
Base Morpho and Steakhouse: one USDC/USDe market was bound to its actual oracle and supplying adapter. Concentration is measured against the selected vault’s assets, not Ethena’s reserves. The separate named Ethena-oriented vault showed dust in the tested market, not a demonstrated material circular-funding loop or proof of zero exposure elsewhere. Market and oracle; allocation and ownership boundary.
Ethereum secondary exit: one pool and four independent quote sizes. The small near-par example and weak large-size proceeds belong together. They are not a global depeg measurement and do not establish a Base liquidation route. Quotes, addresses and arguments.
What stronger evidence should resolve
The principal remaining financial questions are complete Base funding and sufficient final proceeds; the PT’s compatible-time final route and funded waiting interval; full-position Aave recovery; and actual shareholder net costs and intervening competing use. A direct-sUSDe USDT account, exact shareholder claim and tested normal receivers are now measured; repeating those older discovery gaps would understate the new evidence. Current boundary and decision-changing evidence.
The recovery investigation makes the selected chains concrete but leaves decisive joins open: who legally controls the observed holding, what exact notice or redemption conditions apply, what net proceeds are claimable, and when those proceeds reach the paying entity. Actual borrower payments, holder mandates and matched fund-to-issuer transfers would narrow these questions more than another headline portfolio percentage. Specific evidence that would change the result.
Deployed security and control semantics then need to be tied to consequential operations, particularly Mint V2 and the Base meta-oracle mismatch. Funded integration unwinds need actual debt assets, collateral realisation, bridges or remote conversion capacity, and the first party bearing residual loss. Joint stress must follow those verified dependencies rather than assume circularity from shared names.
This is a continuing investigation, not a promise of a future completion date or a fixed number of checks that would certify USDe. The foundation’s limitation section names the unresolved conclusions; the method page explains what each evidence type can support.
Historical observations keep their own dates
The scope saved with the earlier reports records eighteen discovered components. That count was not a percentage of ecosystem exposure. The research catalogue retains every report with its own dates and inspection limits.
Use the preserved earlier scope and History for those dated reports. The current synthesis also includes the separately dated 20 September recovery, 22/26 September control and 27/28 September financial findings. A later chapter does not refresh every earlier observation.