USDe Risk Audit / Foundation chapter
USDe’s whole-system risk: from backing to usable funds
Why backing, legal claims, privileged actions, collateral pricing and exit liquidity must be assessed together—and why the person facing the deadline matters.
This investigation asks how USDe-dependent positions can lose money or access to it, and how one failure can reach other participants. It follows the asset claim through backing, control, lending and the final exit. Ethereum and Base observations are dated separately; they are not one simultaneous system balance sheet.
A connected assessment, not complete assurance. The evidence supports a connected assessment and selected deployed bindings. It does not establish September portfolio weights, a recoverable reserve ratio, complete implementation security, or funded exits for every integration. An unread attestation is not an adverse opinion; it also cannot support a positive reserve conclusion.
Prefer a subject guide? Read claims and exits, backing and custody, control and contracts, lending and integrations or connected stress. This dated chapter retains the full argument and source trail.
1. The judgement: value has to survive the route to its holder
USDe is a managed economic system, not a dollar guarantee enforced by its token contract. The familiar spot-asset/short-derivative hedge reduces directional price exposure, but it does not remove funding costs, margin calls, counterparty obligations, settlement delay or control risk. The documented backing perimeter also includes lending and real-world assets whose risks are not explained by that hedge. Backing and derivatives sources.
The most important unresolved question is whether the assets needed to meet a claim are recoverable, unencumbered and available in the right form before payment is due. A solvent-looking accounting position can run short of cash. Conversely, lower carry or a temporary local discount need not imply a permanent shortfall. Treating all three as “depeg risk” loses the distinction a holder needs.
The control and integration evidence makes several pathways concrete. The Ethereum token’s owner can replace its authorised minter. The controller has both a delayed route and selected immediate permissions. Aave’s installed sUSDe valuation does not use an executable USDe sale price. A selected Base lending market uses a par primary oracle, while one candidate meta-oracle source fails a direct numerical comparison. A vault’s concentration in that market is measured, but its ultimate investors and any issuer ownership are not established. Controls; integration cases.
| Risk path | First exposure and seriousness | What could stop or contain it |
|---|---|---|
| Backing loss or unavailable assets | Issuer liquidity or the reserve-based claim is exposed; permanent impairment beyond buffers can reach holders. Critical dependency, with current size unresolved. | Independent usable reserves, enforceable recoveries, working settlement and asset sales that finish before obligations fall due. |
| Misused authority or interrupted service | Issuance integrity or the eligible redeemer’s access is exposed. Potentially critical principal loss or delay, conditional on the action. | Controller approval, binding caps and role checks, monitoring, defensive revocation and recovery of the affected service. |
| Collateral valuation and lending | Borrower equity faces liquidation first; affected suppliers can bear residual bad debt. High and potentially severe at a concentrated allocation. | Repayment from external funds, adequate collateral margins, correct valuation, funded liquidators and sufficient sale proceeds. |
| Time-sensitive secondary or venue exit | The seller, margin user or party with an obligation due is exposed before eventual recovery is known. High for the constrained route. | Available alternative buyers, eligible arbitrage, working transfers and funds already on the required chain or account. |
These paths overlap. A delayed counterparty payment can consume liquid assets, obstruct redemption, widen a local discount and make a leveraged position harder to unwind. That is a conditional sequence, not four independent losses or proof of an inevitable cascade. Each arrow needs an actual dependency, sufficient exposure and the relevant deadline.
2. What is the claim—and what asset comes next?
The asset must cross more than one boundary
Ordinary USDe is not automatic access to the issuer
The published terms distinguish Holding Users from eligible, onboarded Mint Users. Possession of USDe alone does not establish eligibility, service admission or a private customer agreement. The published redemption commitment is reserve-based, capped at one-dollar notional per USDe and subject to conditions and fees. A ceiling on the commitment is not a guaranteed dollar floor for every holder. The agreement names Ethena BVI Limited and places legal title to reserves with the company, rather than giving every holder a segregated custody deposit. Published terms and Mint User Agreement.
An ordinary holder can seek a market buyer. An eligible Mint User has a different route involving a permitted asset, quote, signed order, authorised operator and actual settlement. Neither route ends in bank dollars simply because it returns a stablecoin. The issuer of USDC or USDT, an exchange account or a banking route may add another conversion, restriction or delay. No individual’s enforceable rights or processing guarantee was established here.
sUSDe is a share, and cooldown changes the kind of claim
sUSDe represents shares in a vault holding USDe. Funded rewards can increase the amount of USDe represented by a share; this is separate from the market’s dollar price for those units. Holding plain USDe does not itself give the same staking claim. The inspected staking source and documentation do not promise a fixed future yield. Staking source and design.
On the positive-cooldown route, the requested shares burn when cooldown is started. The converted USDe is moved to the Silo and the account records a fixed USDe amount. Later rewards to the staking vault do not continue accruing to those burned shares. At release, the asset returned is USDe. The holder must still find a sale or eligible primary redemption to reach another asset.
- Hold free sUSDe
Unpledged shares may be sold into an available market or submitted to the cooldown route.
- Convert and start cooldown
The requested shares burn; the account’s resulting USDe amount is fixed in the Silo.
- Meet the release condition
The holder claims the queued USDe. That is not a delivery of external reserves or bank cash.
- Complete a separate exit
Sell the returned USDe, or use primary redemption with eligibility, an operator and usable inventory.
Source-level sequence, not an executed holder transaction. The cooldown getter returned 86,400 seconds at Ethereum block 26,005,156, 18 September 2026 at 15:02:59 UTC. That one-day setting is not an end-to-end cash deadline. Core observations; staking evidence.
A new cooldown request by the same direct account aggregates the queued amount and can reset the common endpoint using the then-current duration. Changing a positive global duration does not itself rewrite every stored queue timestamp. The inspected custom route is not a generic transferable or cancellable queue receipt. A wrapper may manage claims differently and requires its own review. These distinctions matter because selling already-burned sUSDe is no longer an available response.
Debt can set an earlier deadline than the asset’s exit
Collateral pledged to a lender is not free inventory to sell or unstake. The borrower needs enough of the debt asset to repay and release collateral, or sufficient spare collateral to remain within the lender’s rules. Waiting for an unstake cannot automatically fund the debt payment that is needed before the unstake can begin. Interest and liquidation conditions continue meanwhile. Aave and Morpho illustrate different valuation and loss-transfer choices.
A stablecoin supplier has another claim again: repayment of the loan asset, directly or through vault shares. The supplier does not own the borrower’s collateral free of the loan structure. A borrower’s exhausted collateral and remaining debt can reduce the affected market’s supply assets. A vault transmits that exposure through its actual allocation; it does not make the underlying loan risk disappear. Morpho mechanics and source scope.
A wrapper, maturity or venue label adds conditions rather than removing them
Pendle’s standardized-yield wrapper, principal token and yield token separate claims around a particular underlying asset and maturity. A principal unit at maturity need not be an sUSDe unit or a dollar in a bank. The exact market, chain, adapter, output and redemption conditions determine the next asset. This investigation did not complete a current active pre-maturity principal-token case. Historical adapter work remains historical, not newly verified current coverage. Wrapper design source.
A venue balance is subject to an account’s crediting, transfer and margin rules. It is not the same legal or operational relationship as Ethena’s backing custodian. When a user owes margin or cannot transfer collateral out, eventual issuer recovery may be too slow to protect that account. The venue case deliberately stops short of assuming an unobserved USDe-specific collateral ratio.
3. Backing: what is owned, what is owed, and what can be paid?
The portfolio perimeter is wider than the crypto basis trade
A crypto basis position combines assets with offsetting derivatives. A well-sized hedge can cushion a directional price change. Funding can nevertheless turn adverse; the instruments can diverge; collateral can lose value; and a profitable hedge can be an unsettled receivable rather than usable funds. Gross asset holdings and derivative claims must be reconciled without adding mirrored trading balances as extra assets. Backing overview, crypto basis and derivatives.
Ethena’s documented perimeter also includes liquid stablecoins, DeFi lending, institutional lending and real-world assets. A stablecoin adds another issuer and its redemption conditions. A loan adds a borrower, collateral or security, recall rights and repayment timing. A tokenized asset adds the vehicle and its realisation process, not just the name of an underlying security. The same dollar of backing cannot be counted again as both a free buffer and an already-committed asset.
| Evidence and date | What it supports | What it does not support |
|---|---|---|
| 10 March 2026 proposal; 28 May update | Maple/Anchorage lending was proposed, and the later issuer update reports first deployments at the end of April. | The proposal alone is not deployment evidence; neither source establishes current balances or complete executed terms. |
| 17 July 2026 update, reporting June | Approximately $310 million of institutional lending and $501 million of total real-world assets were reported. | These are June issuer-reported amounts, not September weights. The $501 million is not all JAAA or STAC. |
| Non-crypto framework; 28 August equity-basis proposal | The published strategy perimeter is wider than crypto derivatives. | A framework, including gold or equity-basis discussion, is not proof of a funded allocation. |
| August 2026 attestation listed in the index | A report is listed by the issuer. | The actual body was not read. Its signatory, procedures, exclusions and opinion cannot be inferred from the index. |
Lending proposal and deployment update; June report and strategy frameworks; attestation boundary.
The legal entity matters more than the brand
The Maple/Anchorage discussion identifies A1, Ltd. in the Anchorage arrangement and Protocol Pool Operations Alpha LLC in the Maple arrangement. It does not turn the brand of a regulated institution or a lending platform into a blanket parent guarantee. The relevant obligation is the one against the actual entity under the applicable agreement. Private executed agreements and jurisdiction-specific enforceability were not established. Counterparty discussion and legal reading.
The later public legal reviews distinguish Payward Trading Limited from a general “Kraken” exposure, and FalconX International Lending Opportunities SPC acting for SP1 from an undifferentiated FalconX group promise. Descriptions of secured or senior arrangements and receivables are evidence about proposed legal structure, not proof of a positive current drawdown or a complete recovery waterfall. The investigation did not establish current funding of those arrangements.
JAAA and STAC also require vehicle-specific treatment. The reviewed tokenized JAAA exposure is not interchangeable with the public JAAA ETF, and STAC is a separate tokenized fund structure. Adviser-described senior AAA floating-rate CLO assets may mitigate some credit risks; they do not remove asset-sale, market-price, vehicle, legal or settlement risk. The described JAAA T+1–T+3 and STAC T+4–T+5 processes depend on realisation conditions. They are not measured performance or unconditional cash deadlines. RWA evaluation and its limits.
Off-exchange custody separates risks; it does not abolish settlement
Keeping original assets with a custodian rather than at a trading venue can reduce exposure to ordinary exchange custody. The exchange can still owe a settlement payment, and the custodian can still require a release or transfer process. A virtual trading balance is not a second backing asset. A hedge profit and an idle stablecoin balance are different kinds of resources even when a dashboard gives both dollar values. Issuer and Copper operational documents.
Copper’s ClearLoop documentation provides a concrete adverse condition: settlement can remain pending when exchange collateral is insufficient and a top-up is needed. Its delegated-balance documentation distinguishes total delegated value from the amount available to undelegate. A nominal gain may therefore arrive after a margin or redemption obligation. This is a documented service condition, not a finding that an Ethena settlement failed.
The issuer’s custody and settlement pages name different provider sets and roles. They cannot be merged into a verified present-day roster or allocation. Likewise, the June reporting of named hedge venues is not evidence of unchanged September concentrations. Multiple custodians also do not make a common exchange’s settlement obligation independent. Current account records, encumbrances, applicable agreements and completed settlement receipts remain missing.
Income, reserve protection and principal loss are different
Lower or negative carry can first reduce revenue and the resources available for rewards. That is not proof that sUSDe’s USDe-per-share accounting falls immediately, or that USDe principal has been impaired. Principal loss requires a loss or unrecoverable obligation that available resources do not cover. A temporary cash gap can occur sooner, even with positive eventual asset value. Revenue and reserve policy; separate numerical examples.
A reserve policy is a potential stabiliser. Its usefulness depends on ownership, liquidity, asset denomination and whether it can be spent on the relevant obligation in time. A statement that no ongoing revenue is being allocated to the reserve is not evidence of a zero reserve balance. Nor does ENA or an affiliated product create an automatic guarantee to a USDe holder. An asset tied up behind the same failed provider is not an independent immediate buffer merely because it has a reserve label.
The dominant uncertainty remains unresolved: the research did not reconcile current backing, USDe obligations, reserves, encumbrance and available cash at a common reporting time. The current transparency portfolio could not be inspected and the latest listed attestation body was unread. There is no supported current reserve-coverage percentage or stressed recovery rate to place beside the USDe name.
4. Controls: identify the action, not just the headline delay
The token does not independently enforce the whole backing policy
The inspected USDe custom source restricts minting to the selected minter and allows the token owner to replace that minter. A future authorised minter need not use every rule in the present Mint V2 route. This is intended privileged authority, not an observed exploit. It explains why checking a token’s small source file cannot certify reserve adequacy or permanently fix issuance policy. No arbitrary blacklist, upgrade or confiscation power over ordinary USDe is inferred from a different contract’s permissions. Token and controller source scope.
The sampled chain state connects USDe, Mint V2, sUSDe and the owner-controller. It strengthens the authority map, but it is not a complete reconstruction of every role, upstream Safe dependency or possible exception.
The dated core observations
| Read and target | Recorded value | Meaning and limit |
|---|---|---|
| USDe owner and minter | Owner: 0xe8dc0fab349ea169283c48ccfd09d797e6db7c94Minter: 0xe3490297a08d6fc8da46edb7b6142e4f461b62d3 | The selected owner-controller and current mint route, not a reserve audit. |
| Mint V2 owner / administration | Owner returned the same controller at block 26,005,133; timestamp not returned. Controller default-admin membership was true at 26,005,156. | Separate observations; not an exhaustive administrator enumeration. |
| Mint V2 globalConfig | Mint ceiling: 200,000,000 USDe per block. Redeem ceiling: 10,000,000 USDe per block. | Raw integers are scaled by 10¹⁸. These are ceilings, not inventory, guaranteed throughput or available user capacity. |
| Sampled supported assets | USDT, USDC and USDtb active, each with the same sampled cap pair. | A bounded sample, not a complete asset registry or portfolio composition. |
| Controller getMinDelay | 86,400 seconds | Ordinary scheduling delay; separate whitelisted execution must be examined. |
| Development Safe getThreshold | 5 required signatures | Does not establish independent people, a refreshed full owner roster, modules, guard or all authority paths. |
| sUSDe owner / cooldownDuration | Owner: the same controller. Cooldown: 86,400 seconds. | A direct staking setting, not an issuer-payment guarantee or universal governance warning window. |
USDe: 0x4c9edd5852cd905f086c759e8383e09bff1e68b3; sUSDe: 0x9d39a5de30e57443bff2a8307a4256c8797a3497; Safe: 0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862. Source and identity locators; Mint ABI and deployment limitations.
A one-day ordinary delay has selected immediate exceptions
The controller source separates ordinarily scheduled execution from a privileged whitelisted path. At Ethereum block 26,005,198, 18 September 2026 at 15:11:23 UTC, the sampled Safe held proposer, executor and whitelisted-executor roles. Calls to the controller’s isWhitelisted(address,bytes4) returned true for Mint V2’s role revocation and benefactor addition/removal selectors. They returned false for the sampled cap changes, stable-delta and token-type changes, supported-asset additions/removals, role grant, custodian changes and admin transfer. Controller source; target function identities.
The consequence is selective immediate power, not “everything can bypass the delay.” A target/function permission does not separately bind every argument. Role revocation can be a useful emergency measure, but customer removal or loss of an operator can obstruct service. A holder cannot infer a usable one-day escape window from the headline delay while cooldown, debt release, transfers and the final sale still take time.
The Safe was a sampled collateral manager; the controller was not. Both sampled addresses returned false for the gatekeeper role. That does not prove there are no gatekeepers. A bounded recent event window identified seven mint operators and four redeem operators whose current roles were checked, not a complete historical enumeration. These facts establish particular edges in the authority chain rather than the absence of every unseen edge.
The stable-amount guard is not a dollar-value guarantee
Mint V2’s stablesDeltaLimit returned zero. A read-only comparison tested verifyStablesLimit(uint128,uint128,address,uint8) using USDC, with amounts normalized below to whole-token units. It separates a specific amount guard from the complete order route.
| Direction | Collateral amount / USDe amount | Returned result |
|---|---|---|
| Mint | 100 / 100 | true |
| Mint | 100 / 101 | false |
| Mint | 100 / 99 | true |
| Redeem | 100 / 100 | true |
| Redeem | 101 / 100 | false |
| Redeem | 99 / 100 | true |
These are quantity comparisons after decimal normalization, not market prices. Passing such a helper cannot establish the received token’s dollar value, an operator’s admission, remaining caps, inventory, signatures, nonces or the complete transaction’s behavior. The present investigation did not execute a full mint/redeem order or independently demonstrate its rollback invariants. Older detailed order and rollback work remains separately accessible in History.
Source association, audit scope and deployed behavior remain distinct
The token, staking and controller custom source bodies were inspected in bounded scope. Not every inherited dependency was independently re-audited, and no local compiler build established full equivalence to the deployed system. For Mint V2, runtime and exact-match metadata plus the official client ABI do not substitute for a complete inspected deployment-matched implementation. Successful getters settle their returned values, not every path behind the contract.
The historical Pashov review concerns identified reviewed and fix commits. A historical nonce finding and fixes review are not evidence of a current exploit; an inaccessible fix-source request is not proof that no fix exists. Equally, an audit index or minting questionnaire is not a completed security review of today’s entire configuration. Audit identity and inspection limit.
Staking has distinct restriction and redistribution surfaces affecting shares. Those must not be described as arbitrary confiscation of ordinary USDe. The stage of an exit matters: shares, an already-converted queue and the eventual token payout are not the same asset or permission boundary. A correct control assessment therefore names the contract, function, caller, state and consequence instead of reducing everything to a signature count.
5. Exits: access, size and the asset that actually arrives
Primary redemption is a service and settlement route
Eligibility, a quote, a signature, authorised submission and successful asset delivery are distinct stages. A customer needs continuing access; the operator needs permission and the route needs available payout assets. A cap states an upper bound on one check, not an undertaking to process at that rate. A helper result, order identifier or transaction hash is not the same as confirmed receipt of the expected asset. Terms; Mint V2 documentation and ABI.
Functioning primary redemption can support arbitrage and reduce a secondary discount when eligible participants have funds, inventory, working transfers and time. It is not automatically available to every retail holder or venue account. Conversely, a blocked or expensive market route does not by itself prove the issuer’s primary route has stopped. Those are different propositions requiring different evidence.
One Ethereum pool: a near-par small quote, poor large-sale capacity
The investigation identified the Ethereum Uniswap V3 USDe/USDT pool and queried the official QuoterV2 using fee tier 100, equivalent to 0.01%. The input was USDe and the output USDT. The quotes below are independent read-only simulations: they are not a sequence of executed sales and must not be added together as cumulative capacity. Deployment locator and quote scope.
| USDe input | USDT output | Ethereum block / on-chain UTC time |
|---|---|---|
| 100 | 100.026581 | 26,005,291 / 15:29:59 |
| 100,000 | 10,062.463842 | 26,005,285 / 15:28:47 |
| 1,000,000 | 10,076.081591 | 26,005,285 / 15:28:47 |
| 10,000,000 | 10,077.338815 | 26,005,285 / 15:28:47 |
The narrow conclusion is a size problem on this route at these observations. The 100-USDe example is a useful countercase to describing the entire pool as uniformly far below par. The larger examples show that the small quote did not establish near-par capacity for 100,000 USDe or more. They do not demonstrate a 90% global depeg, total DEX capacity, a future executable quote or a funded liquidation route on Base.
All calls used sqrtPriceLimitX96 = 0, without a protective price limit supplied in that parameter. The large quotes traversed 21 initialized ticks. Neither the pool’s token balances nor its V3 liquidity integer can be treated as uniform depth at the current price. Gas, routing, later state, slippage protection and the final conversion of USDT into another asset remain outside this comparison.
Exact route and read-only call
Pool: 0x435664008f38b0650fbc1c9fc971d0a3bc2f1e47. Factory: 0x1f98431c8ad98523631ae4a59f267346ea31f984. QuoterV2: 0x61ffe014ba17989e743c5f6cb21bf9697530b21e.
Method: quoteExactInputSingle((address,address,uint256,uint24,uint160)). Tuple fields are tokenIn = Ethereum USDe, tokenOut = Ethereum USDT, amountIn = the displayed input multiplied by 10¹⁸, fee = 100, and sqrtPriceLimitX96 = 0. The displayed output is the first returned integer divided by 10⁶. Factory getPool(USDe,USDT,100) returned the same pool at block 26,005,285.
Opening an explorer today will not replay this state. The original observations were current-only; reproduction of a past block requires a separately available archival provider. No trade was submitted by the investigation.
A venue can restrict transfers before it liquidates
Bybit’s Unified Trading Account documentation distinguishes initial-margin and maintenance-margin ratios. Its FAQ describes a transfer-out boundary at an initial-margin ratio of 100%, and restrictions involving unrealised profit; the introduction describes liquidation at a maintenance-margin ratio of 100%. A change in the collateral value recognised by the venue can therefore affect usable funds before the liquidation boundary. These are published product rules, not a test of a particular account. Dated venue documents.
The investigation did not obtain the actual current USDe-specific Unified Trading Account tier table or substantive account legal terms. A separate Institutional Loans collateral announcement dated 1 September 2026, effective 2 September at 08:00 UTC, concerns a different product. It cannot supply the missing Unified Trading Account ratio, account eligibility or withdrawal rights. No current executable venue order book was obtained.
This boundary prevents a tempting but unsupported conclusion: “USDe is accepted as collateral, therefore this USDe balance is transferable at par.” The collateral factor, asset valuation, account obligations, product, network and withdrawal condition all matter. A platform’s processing description also is not a measured service guarantee for a particular holder.
A historical dislocation is evidence of separation, not a universal backstop
In a 17 November 2025 retrospective/proposal about the 10 October 2025 dislocation, the issuer reported a Binance USDe/USDT low of 0.6567, a shallower Curve dislocation, and more than $2 billion of primary redemptions over 24 hours. These are attributed issuer claims, not an independent price replay or a summed transaction reconciliation by this investigation. They cannot establish that every venue user could leave, or that the same capacity exists now. Event account and governance debate.
The counterevidence is still useful: a severe local price can coexist with reported primary processing. The Aave discussion also contains opposing concerns about market-responsive pricing—earlier recognition of impairment versus forced liquidation during a recoverable discount. Neither a proposed support facility nor an oracle proposal is proof of installed or funded protection. The lesson is to inspect the loss and exit mechanism rather than always ignoring spot prices or always treating them as reserve value.
6. Integrations: the accepted value can differ from the realised value
The installed inputs—not the token label—set liquidation value
The two measured lending cases are direct sUSDe on Ethereum Aave and a USDe-collateralized USDC market on Base Morpho with a supplying vault adapter. They are not a completed active principal-token case, a review of all Spark exposure or an ecosystem-wide inventory. The relevant chain, asset, oracle and adapter have to be joined before a risk can be assigned.
Aave: a share ratio multiplied by capped USDT/USD
Aave’s Ethereum oracle returned the installed sUSDe source 0x42bc86f2f08419280a99d8fbea4672e7c30a86ec. At block 26,005,206 on 18 September 2026 at 15:12:59 UTC, getAssetPrice(sUSDe) returned 124779287, or $1.24779287 per sUSDe at eight decimals. The source’s ratio provider was sUSDe itself. Its ratio agreed with the same-batch convertToAssets(10^18) result: 1.248747741329377471 USDe per sUSDe. Source family and contract locators.
The source description was “Capped sUSDe / USDT / USD.” Its base input was the capped USDT/USD contract 0xc26d4a1c46d884cff6de9800b6ae7a8cf48b4ff8, later read at 0.99923534 USD per USDT. The recorded inputs reproduce the accepted sUSDe answer at integer precision:
floor(1248747741329377471 × 99923534 / 10^18) = 124779287
The output has eight decimals. This combines a USDe-per-share ratio with a USDT/USD input; it is not an executable USDe/USD sale quote.
This choice matters in both directions. It can avoid transmitting a temporary USDe market discount directly into borrower liquidation. It can also fail to recognise USDe-specific backing impairment or poor local liquidation realisation when the share ratio and USDT input have not reflected it. A rising share ratio is denominated in USDe units; it is not independent evidence that each unit is recoverable at one dollar.
The observed adapter was not currently capped. The recorded maximum annual ratio-growth parameter was 11.17%, not a yield promise, and the minimum snapshot delay was fourteen days. The capped USDT input’s 1.04 ceiling was inferred from its runtime path and a storage read without a returned numeric block, rather than a successful matching cap getter. These upward-growth/cap mechanisms are not a general detector of losses in off-chain backing. No complete local build-equivalence claim follows.
The downstream USDT/USD feed’s update time was 17 September at 19:38:11 UTC; at the 18 September 15:27:35 observation it was 71,364 seconds old. That age is not itself proof of a heartbeat violation: the relevant update policy and full operational controls were not established.
| Configuration | Recorded parameters | Do not substitute it for |
|---|---|---|
| Base sUSDe reserve | Base LTV 0%; liquidation threshold 75%; liquidation bonus factor 108.5%; supply cap 250 million sUSDe shares. | The separate eMode settings. A base LTV of zero does not describe every permitted eMode position. |
| eMode category 2: sUSDe Stablecoins | LTV 90%; liquidation threshold 92%; bonus factor 104%; collateral reserve IDs 30 and 32; borrowable IDs 3 and 8 (USDC and USDT). | All accounts or all collateral. The account’s category, assets and debt determine applicability. |
At an illustrative starting LTV of 90% within that 92% threshold, fixed debt gives 1 − 0.90 / 0.92 = 2.173913% of accepted collateral-value decline before the threshold. This is a sensitivity calculation using the observed category settings, not a statement that a 2.17% USDe spot discount automatically triggers liquidation. The oracle’s actual transmission and the account state matter.
Morpho on Base: join the market to its actual pricing and supply path
The selected market ID is 0x54cf9be57fdfa6457a660991907434ff9d295c465a603a50126ff647d50b7354. At Base block 51,477,448, 18 September 2026 at 15:10:43 UTC, Morpho’s idToMarketParams returned USDC as the loan asset, remote USDe as collateral, the F4 meta-oracle, the recorded interest-rate model and a liquidation loan-to-value limit of 91.5%. The tuple also agrees with the published market identifier’s hash. Hash agreement alone would not have established live balances or oracle behavior; the state read supplies the deployed binding. Market, core and identifier source.
Exact Base market tuple
Core: 0xbbbbbbbbbb9cc5e90e3b3af64bdaf62c37eeffcb.
Loan USDC: 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913.
Collateral USDe: 0x5d3a1ff2b6bab83b63cd9ad0787074081a52ef34.
Oracle: 0xf4b17c79492d68775e22e8dd0a2bb22854a39a47.
Interest-rate model: 0x46415998764c29ab2a25cbea6254146d50d22687.
Raw LLTV: 915000000000000000 (10¹⁸ scale).
The loan-token address is the Base USDC identity in the recorded tuple; it must not be confused with Ethereum USDC. Identity sources.
At this LLTV, the documented liquidation incentive formula yields a factor of approximately 1.026167, or a 2.6167% bonus—not the 8.5 percentage-point collateral gap. A liquidator still needs the debt asset and a profitable, accessible way to realise the collateral. If collateral is exhausted with debt remaining, the affected market’s suppliers bear the resulting bad-debt reduction under the inspected mechanism. No funded liquidation was executed in this investigation.
The par primary is observed; complete fallback semantics are not
The F4 oracle is a minimal proxy targeting 0x846e726a1bf5fd5cbe08c179ee491b085b1cac3e. Its selected primary was 0xf243538bc89634b0abb5686a5b72e21282a54695; its backup was 0x995aed0fa3dbe02fa1efa50f65ea57dc0b3dcf6a. The primary and effective prices returned 10²⁴, representing one USDC per USDe under the market’s differing token decimals. The later input reads showed zero feed and vault inputs for the primary, with that fixed normalization scale. Oracle family, candidate source and inspection limits.
The backup used one USDe/USD feed and no USDC/USD denominator. It returned 0.99961923 in human-price terms under a USDC-at-dollar assumption. That is a consequential assumption for a USDC-denominated loan; the backup cannot be described as a complete measured USDe/USDC relative-price feed merely because the app rounds the displayed exchange rate to one.
| Getter | Recorded setting or value | Reading boundary |
|---|---|---|
| currentOracle / price | Primary selected; price 10²⁴. | Observed normal-state choice, not future price behavior. |
| deviationThreshold | 5 × 10¹⁵ at 10¹⁸ scale = 0.5%. | A threshold parameter, not proof of the full trigger logic. |
| challengeTimelockDuration | 57,600 seconds = 16 hours. | Not a verified automatic switch after any 16-hour depeg. |
| healingTimelockDuration | 86,400 seconds = 24 hours. | Not proof of complete restoration conditions or liveness. |
| challengeExpiresAt / healingExpiresAt | Both zero. | The sampled values do not establish every possible state transition. |
A candidate source fails a direct comparison. Using the recorded primary and backup values, the proposed meta-oracle source’s average-denominator deviation formula gives 380842506700638. The deployed getDeviation() returned 380915041020169. The source must not be promoted to complete deployed semantics.
The observed result is approximately 0.0380915%, below the 0.5% parameter at that sample. The mismatch is evidence of source/version uncertainty, not a demonstrated exploit or a finding that the protection necessarily fails.
The comparison used primary P = 1000000000000000000000000 and backup B = 999619230000000000000000. The candidate computes floor(abs(P−B) × 10^18 / ((P+B)/2)). Using B as denominator instead matches the one observed result, but one numerical match does not establish initialization, exceptional cases, role control, challenge continuity, switch timing or every other function. Safe automatic fallback and healing remain unverified.
The backup’s USDe/USD feed was 0x790181e93e9f4eedb5b864860c12e4d2cfffe73b. At Base block 51,477,892, its reported update was 18 September at 14:12:17 UTC, 4,394 seconds before the 15:25:31 block time. A successful price read and its age do not prove the feed’s full heartbeat, governance or stressed reliability.
A measured vault concentration, not an issuer ownership conclusion
The supplying vault is Steakhouse High Yield USDC Edition, 0xbeeff2490feffa212fac2f6553682c219e6a8845. Its single listed adapter, 0x4a70dc70cef79f51cc7f79c08f863b2841311165, returned the matching parent vault, Morpho core and USDC asset. The adapter’s position connects the vault to the selected market. This is stronger than assigning exposure from a product name. Vault, adapter and source scope.
| Quantity | Recorded amount or derived ratio | Denominator / limit |
|---|---|---|
| Market supply assets | 366,863,389.158842 USDC | One identified USDe/USDC market. |
| Market borrow assets | 330,473,666.507889 USDC | One market; not ecosystem borrowing. |
| Nominal unborrowed assets | 36,389,722.650953 USDC | Supply minus borrow. Not measured maxWithdraw, exclusive vault cash or stressed availability. |
| Utilisation | 90.080852% | Market borrow assets divided by market supply assets. |
| Adapter share of market supply shares | 99.992236% | 362907134309833032917 adapter shares / 362935312191245281180 total market shares. |
| Adapter expected supply assets | 366,834,911.410783 USDC | The selected market allocation, not a bank balance. |
| Vault total assets | 413,281,974.346382 USDC | This vault’s accounting denominator. |
| Selected allocation / vault total | 88.761411% | Expected supply assets divided by vault total assets. Not a USDe-reserve or ecosystem percentage. |
The market’s stored update time was twelve seconds earlier than the batch. The adapter’s booked allocation and expected assets differed by about 5.104745 USDC, consistent with their different accrual treatment; it is not treated as theft or a loss. Earlier app-rendered percentages were rounded and non-atomic. They are not blended into this same-batch concentration calculation.
The four sampled vault gate addresses were zero at an earlier Base batch, which removes those particular gate contracts from that observation; it does not guarantee cash for withdrawal. The curator Safe’s threshold was later read as two required signatures, without a fresh complete signer roster. Later allocation caps likewise do not turn a cap into liquidity or make all vault governance and pending changes fully reviewed.
The concentration is real for this measured adapter and market; beneficial ownership is a different question. The named Ethena x Steakhouse USDC vault was separately followed through its own adapter. At Base block 51,478,251, 18 September 2026 at 15:37:29 UTC, that adapter had 39,158 raw supply shares in the selected market, with expected assets rounding down to zero USDC base units. That is dust, not literal zero shares and not evidence of material funding through this vehicle. It does not establish zero issuer exposure elsewhere, the identity of every investor, or a circular backing loop. Separate named-vault locator.
Reciprocal exposure is a question worth testing, not a conclusion from shared branding. Funded borrower repayment could release USDC to suppliers and be stabilising. A withdrawal run and borrower unwind could instead compete for the same assets. Which effect dominates requires actual ownership, timing, repayment resources and executable collateral exits.
Base USDe adds a cross-chain authority and delivery boundary
The remote USDe token in this market returned controller 0xd896f26f76ed089a1711284a00af497b19d65171 as its direct owner. The relevant sampled batch’s included block was 51,478,213; the reader’s outer block label was 51,478,214, so the included block identifies the observation. A later batch at 51,478,251 returned an 86,400-second minimum delay and verified proposer/executor roles for Safe 0xbc89d10eb486b6591583f218acb9545087dbf293. The Safe was not the direct token owner. This is not evidence of an ownership change over time. Remote-token design and identity scope.
The endpoint, shared decimals and peer getter were also read. An identical hexadecimal peer address in a different chain namespace does not establish a self-loop. The rejected paused() subcall does not establish that the token was unpaused or lacked all pause mechanisms.
The investigation did not establish the complete send/receive verification configuration, executors, limits, delegates, emergency paths, source-chain supply reconciliation or funded remote conversion inventory. A described remote peg-stability route is not proof that a Base borrower can obtain USDC at the required size and time. Invalid remote issuance and a protective transfer halt are different risks: one can affect claim integrity; the other can obstruct an otherwise recoverable exit.
7. Stress: separate an economic loss from a missed deadline
Positive eventual value can coexist with a payment gap
A useful stress path names the initiating event, the claim affected first, the party with the deadline, and the resource that can interrupt the path. It does not assume every connected protocol fails merely because they share a token.
| Trigger | How it can reach holders or lenders | Stabilising condition |
|---|---|---|
| Persistent adverse carry | Revenue weakens; a reserve may absorb costs; reduced reward appeal can increase exit demand. A crowded route may become costly before principal is demonstrably impaired. | Other income, independent available reserves, orderly strategy reduction and adequate exit capacity. |
| Volatility and delayed custody settlement | One side of a hedge gains value but its settlement is late; margin or redemption needs use liquid assets first. The same cash cannot fund both simultaneously. | A settled gain or spare, unencumbered funds in the required denomination arriving before the obligation. |
| Credit loss or unavailable backing | A borrower fails, an asset sale disappoints or a release is blocked. Recovery uncertainty or delayed payment can widen a local discount; lending outcomes depend on oracle transmission and liquidation realisation. | Enforceable senior recovery, liquid assets, borrower repayment, spare collateral and enough realised proceeds. |
| Privileged misuse or oracle/control failure | Unbacked obligations or a blocked route can affect claim integrity or access. A valuation that does not track realisation can shift loss from borrower equity toward affected suppliers. | Binding permissions, defensive restrictions, repaired service, trustworthy valuation and funded liquidation or repayment. |
A small normalized book keeps the accounting honest
The following is entirely hypothetical. It is the supplied research’s illustrative book, not Ethena’s portfolio, reserve requirement or estimated loss. Begin with liabilities of 1,000 and assets of 1,015: liquid stablecoins 300, DeFi lending 350, Treasury assets 150, CLO assets 100, net hedged crypto 100 and reserve assets 15. The reserve is already included in assets. Each row below is a separate scenario unless explicitly stated otherwise.
| Scenario | Supplied result | What it isolates |
|---|---|---|
| Adverse carry on the 100-unit hedged position: 10% annualized for 90/365 of a year | Loss 2.465753; remaining assets 1,012.534247; asset/liability ratio 101.253425%. | Lower income or reserve consumption does not automatically mean principal loss. |
| 5% DeFi loss, 3% CLO loss, 2% hedged-position loss, 0.5% liquid-stable loss and 1 unit of execution cost | Total loss 25; assets 990 against liabilities 1,000. | A 10-unit shortfall after the original 15-unit excess is exhausted; do not add the reserve a second time. |
| 100 liquid-stable units unavailable; other assets not immediately realisable; 400 of redemptions due | Available cash 215, including the 15 reserve units; payment gap 185, even with book assets still 1,015. | Availability and timing can fail before book value does. |
| The preceding availability case also requires 50 units of margin | Cash left for redemption 165; payment gap 235. | The same funds cannot be counted as both margin and redemption cash. |
| 50 new unbacked liability units | Assets 1,015 / liabilities 1,050 = 96.666667%. | Issuance integrity matters independently of asset-market loss. No such mint was observed. |
The loss case combines 17.5 units from DeFi, 3 from CLOs, 2 from the hedged position, 1.5 from stablecoins and 1 execution-cost unit. It is a transparent chosen haircut example, not an estimate of those assets’ actual risk. The cash-gap cases do not assert that unavailable assets are worthless. They ask whether the required payment can happen before those assets become usable.
The borrower cannot use the same collateral twice
- Obtain the debt asset
A repayment deadline requires funds on the lender’s chain or venue. Pledged sUSDe is not already free cash.
- Repay and release collateral
The lender’s rules determine the amount released. Interest and accepted-value changes can alter the requirement.
- Choose sale or cooldown
A free-share sale requires depth; cooldown instead fixes a USDe amount and introduces its release condition.
- Finish the final conversion
Claimed USDe still needs a funded sale or eligible issuer route. A different chain, stablecoin or bank payment adds another step.
An initial health factor of 1.05 falls to 0.9975 after a 5% decline in accepted oracle collateral value, holding debt and the other inputs fixed. This supplied sensitivity does not say that a 5% USDe spot move is transmitted by either measured oracle. The particular valuation, position and deadline determine whether a liquidation can occur.
Why margin transfer restrictions can bind first: an illustration
This is not a measured Bybit USDe tier. Take a hypothetical account with 100 gross collateral units, 90 initial-margin units and 80 maintenance-margin units. If the venue recognises 95 units of collateral value, the illustrative initial-margin ratio is 94.7368% and the maintenance-margin ratio 84.2105%. At 90 recognised units, the first reaches 100% while the second is still 88.8889%. A transfer restriction can therefore precede liquidation. At a hypothetical factor of 79%, both ratios cross their respective 100% boundaries.
The actual account rules and USDe-specific ratio must still be obtained. The example isolates two different gates; it does not supply a current venue setting, price target or trading recommendation. The measured evidence boundary.
The reassuring countercase is operational, not rhetorical. A borrower with independently funded debt repayment can release collateral without waiting for a distressed buyer. An issuer with truly usable assets can continue primary redemptions while a local venue is dislocated. A lender with sufficient collateral realisation need not suffer bad debt after borrower liquidation. Each countercase needs the resource to exist, belong to the relevant party and arrive in time.
8. What remains unresolved—and would change the judgement
Recoverable backing comes first. A dated reconciliation must connect assets and liabilities to title, encumbrance, claims, usable reserves and a realistic asset-specific liquidity ladder. The current study does not establish the latest attestation’s contents, private contractual priorities, present credit drawdowns or September portfolio weights. Without that, neither a current recovery percentage nor a reserve-sufficiency conclusion is supported.
Implementation and control completeness come next. A deployment-matched Mint V2 source and the actual F4 meta-oracle implementation are needed for stronger semantic conclusions. The candidate deviation mismatch must be resolved rather than explained away. Complete authority paths require more than selected memberships: Safe implementation and optional controls, history, arguments, live exception policy and consequential inherited paths remain relevant.
Funded routes and ownership joins are missing. Measured vault concentration does not establish beneficial ownership or issuer circularity. Nominal liquidity is not a stressed withdrawal test. The investigation did not complete a funded Base liquidation/bridge/peg-stability exit or broad alternative-route depth measurement. It did not complete a current active pre-maturity PT case, verify every Spark connection or obtain actual USDe-specific Unified Trading Account tiers and account rights.
These are limits on assurance, not reasons to discard the established bindings. The current result does identify the selected Ethereum minter and controller relationships, sampled permissions and cap settings; Aave’s actual pricing inputs; Base’s market, oracle and supplying adapter; a same-batch concentration measure; and size-specific single-pool quotes. The evidence has become more concrete without becoming exhaustive.
A new observation can narrow or overturn a claim. A successful getter is not proof of complete semantics; an indexing or transport failure is not proof of an absent deployment or empty role. The report does not estimate failure probabilities, certify security, claim portfolio-wide coverage or conclude that all adverse paths are presently active. Coverage by question; how to read the evidence.
9. Evidence trail and observation discipline
The source trail below is selected for the claims on this page. It is not a claim to have audited every linked organisation, contract or asset. The investigation’s source retrievals and readbacks are dated 17–18 September 2026; original document, event and configuration dates remain separate. Research attribution: GPT-6 Pro.
The observation tables reproduce the investigation’s readbacks, not a live dashboard. Ethereum and Base calls were provider-mediated current-state reads. Where a batch included its own block number and timestamp, that identifies the batch. Separate batches, chains, documents and app screens are not simultaneous. Explorer links identify contracts; they generally show later state when opened and do not by themselves preserve the recorded call.
Runtime metadata, an ABI, a source association and a complete local build are different evidence. This investigation did not perform an independent full compiler rebuild or complete exploit audit. The published arithmetic is the research’s supplied calculation and stress work, with units and assumptions retained. The page makes no network calls and runs no live model or trading widget.
Claims and published legal conditions
USDe terms and conditions and Mint User Agreement. Published terms displayed an August 2025 update. Eligibility, reserve-based redemption, title and processing conditions were read. These are not a private customer agreement or a jurisdiction-specific enforceability opinion.
Backing perimeter, strategy and dated reporting
Ethena’s backing overview, crypto basis description, derivatives explanation, liquid stablecoins and DeFi lending describe mechanisms, not a verified current allocation.
The 17 July 2026 update reports June; its approximately $310 million institutional lending and $501 million total RWA figures retain that period. The non-crypto basis framework and 28 August equity-basis framework do not establish actual funded exposures.
Credit arrangements, deployment reporting and actual counterparties
10 March 2026 Maple/Anchorage proposal and reviews; 28 May update reporting first deployments at end-April. The later report supports reported deployment; the proposal alone does not.
23 July Payward legal review and 4 August FalconX legal review. Adviser analysis of named entities and agreements, not inspected private executed terms, proof of positive current drawdown or a complete recovery waterfall.
Tokenized CLO vehicles and realisation conditions
June 2026 STAC evaluation and comparison. The review distinguishes the relevant tokenized vehicles and describes asset-sale-dependent realisation intervals. Seniority, ratings and described T+ intervals are not guaranteed cash performance. The June total RWA amount is reported in the July update, not a verified September JAAA/STAC allocation.
Custody, settlement and release are separate
Ethena’s custody overview and settlement detail; Copper’s ClearLoop settlement conditions and delegated-balance guide. Public service descriptions support the pending-settlement and release distinctions. They do not establish current Ethena account balances, applicable signed protections or actual completed transfers.
Assurance: the body was not available
Custodian-attestation index and transparency dashboard. The index listed August 2026, but its complete report body was not read; the current portfolio view was restricted. These are locators and access boundaries, not affirmative evidence of a reserve ratio, an adverse opinion or current liquid coverage.
Revenue and reserve policy
Protocol revenue and reserve fund. Policy and mechanism descriptions, not measured current flows, reserve sufficiency or a legal insurance promise. A revenue-allocation statement is not a reserve-balance read.
sUSDe accounting and the direct cooldown route
Staking design and source associated with Ethereum sUSDe. Selected custom staking, Silo and consequential paths were read; this is not a complete fresh audit of every inherited dependency or wrapper. The one-day setting is separately identified in the core observation table.
Ethereum token, controller and identity sources
USDe custom source; owner-controller source; issuer key addresses and architecture overview. Associated source and documented identities are distinct from the recorded owner, role, threshold and selector reads. No full independent compilation or exhaustive Safe/role-history verification is claimed.
Mint V2: documentation, interface and bounded reads
Mint/redeem V2 design; API description; client ABI at commit 8aa953d9a4cd1db18bfad782c34c66163509b0fc; Sourcify metadata locator.
Metadata indicated an exact match, but a usable complete deployment source body was not recovered in this investigation. ABI and runtime metadata plus successful sampled getters and amount-helper calls do not establish all signature, nonce, route, cap or rollback invariants. The block-specific findings are set out in Controls.
Historical security review, not a live exploit finding
Pashov May review at audit-repository commit 47990bdd4ab5d4af42c0fe11ec6b0a321dac59d9. The reviewed implementation commit is b60b7193636d499ce7f89c4f5afe3b99cf31a2b6, with fix review at 9cd4ad7b46acc35f6b3340c808200279fbe75de0. Historical findings, fix scope and present deployment equivalence are separate questions. The issuer audit index is not a warranty of the whole system.
Aave’s installed source and cap family
Aave address book at commit 4e13aa197ca74e84c7e878bc752e519c260d6f30; PriceCapAdapterBase and PriceCapAdapterStable, both at f6f1a02978db539979cc0e2c3c0a917f9db369d0.
Ethereum oracle: 0x54586be62e3c3580375ae3723c145253060ca0c2; pool: 0x87870bca3f3fd6335c3f4ce8392d69350b4fa4e2. The installed source, ratio and price readbacks are in the Aave case. Public family-source correspondence is not a full bytecode-equivalence or operational feed audit; reserve/eMode settings are separately dated 17 September.
Morpho market identity and loss transfer
Selected Base USDC/USDe market; market-identifier library at commit 8e26ca6a8dbc5089edcd67fb576248810fd2870a; liquidation mechanics; risk explanation; Circle’s USDC address reference.
App displays are rounded, later-changing observations, not substitutes for the dated on-chain tuple and same-batch quantities reproduced above. The identifier hash proves consistency of inputs, not deployment or current state by itself.
Base oracle: distinguish candidate source from deployed semantics
Candidate MetaOracleDeviationTimelock at commit 5ce0e80adb69bc06f5b390032150e7ea41d30c02; MorphoChainlinkOracleV2 family at commit 9d2a0b66589d0669c52e47310af8eb804facf97e.
The deviation mismatch is a positive reason not to infer complete F4 behavior from the candidate. The clone target was identified, but its actual usable source was not recovered. Getter-confirmed inputs and timing parameters are not proof of complete fallback, healing, exception or governance semantics.
Vault-adapter binding and the separate ownership question
Steakhouse High Yield USDC Edition; separate Ethena x Steakhouse USDC vehicle; Vault V2 concepts; pinned adapter source blob.
The selected adapter source was read in bounded scope, not as a complete vault audit. On-chain parent, asset, adapter, position and expected-asset reads support the specific allocation; product descriptions do not establish beneficial ownership. Same-batch figures and the separate dust countercase remain separately identified.
Principal and yield-token design
Pendle introduction. Generic design only for this investigation. A live pre-maturity market, its exact standardized-yield output, oracle and unwind must be established independently before assigning its current risk. No historical principal-token proposal is relabelled as an installed case.
Bybit product rules and an unread USDe-specific tier
Unified Trading Account FAQ, displayed 4 August 2026; account introduction, displayed 13 January 2026; collateral-value methodology, displayed 30 March 2026.
1 September Institutional Loans announcement, effective 2 September at 08:00 UTC, is a different product. The investigation did not obtain the current USDe-specific UTA tier, actual account eligibility or a usable substantive account legal body. Published generic margin rules are not a live account test.
Uniswap route identity and independent quote samples
Official Ethereum V3 deployment reference; pool identity; QuoterV2 identity. The quote table preserves block, size, input/output units and method. Simulation is not a fill; a single pool is not the whole market, and USDT output is not assured bank dollars.
Remote representation and configuration boundary
LayerZero OFT design provides mechanism context, not proof of the selected deployment’s complete security settings. Base remote token 0x5d3a1ff2b6bab83b63cd9ad0787074081a52ef34 returned endpoint 0x1a44076050125825900e736c501f859c50fe728c, shared decimals 6, conversion factor 10¹² and the sampled peer entry for endpoint ID 30101. Owner-controller and peer-reading limits.
Historical countercase and the oracle trade-off
17 November 2025 issuer retrospective/proposal concerns the 10 October 2025 dislocation. Its prices and redemption amount are attributed reports, not this investigation’s independent replay or a present-day guarantee.
Aave risk-oracle and freeze-guardian discussion, opened 24 October 2025 with a 2 November response, contains both LlamaRisk’s protection proposal and Chaos Labs’ concern about liquidation during a recoverable discount. Proposed safeguards are not proof of installed or funded protection.
Return to the current assessment or compare the earlier historical collection. Historical report dates, test claims and source access are not silently promoted to the current investigation.