USDe Risk Audit / Connected stress
When one missed deadline reaches the rest of the system
Trace the first loss bearer, the competing claims on cash and the conditions that can interrupt the chain.
Follow a failure through its funding deadline, not just its final asset value. Lower income, lost backing, unavailable backing and a bad collateral price affect different parties first. They can interact, but they are not interchangeable—or independent losses to sum. The illustrations here reuse the supplied calculations; they do not estimate current reserves, failure probabilities or a particular account’s expected loss. Stress basis and assumptions.
Positive eventual value can coexist with a payment gap
Four conditional paths—and where each can stop
| Trigger | First consequence and propagation | What can interrupt the path |
|---|---|---|
| Income compression | Weaker funding or lending income reduces rewards. Leveraged carry becomes less attractive, encouraging unwinds and redemption demand. Principal impairment requires losses beyond usable resources. | Reduced distributions, working hedge income elsewhere, available reserves and orderly repayments can absorb costs or restore lender cash. |
| Volatility plus interruption | Margin is due while a hedge gain, custody release or venue settlement is unavailable. Emergency cash competes with redemptions; forced closure can then create a separate value loss. | Pre-positioned margin, available independent funding and an executable replacement hedge. Custody segregation alone does not meet the deadline. |
| Backing loss or unavailability | A freeze or fund gate delays payment; a credit default or forced sale can reduce value. Early exits can leave slower or more concentrated assets behind. | Enforceable senior claims, adequate collateral, diversified liquid assets and sufficient time to realise recovery. |
| Authority or valuation failure | Misused issuance can increase obligations; service revocation can stop access. A bad lender price can cause borrower liquidation or leave suppliers with deficient proceeds. | Binding approvals and limits, defensive revocation, correct input behavior, collateral headroom and funded liquidation / redemption routes. |
Seriousness and counterevidence · Observed control boundary · Actual valuation paths.
The same return can be sufficient—and still arrive too late
The 20 September investigation adds a threshold based on observed Mint USDC inventory, with demand explicitly assumed. Hold 30,934,109.172 USDC at Ethereum block 26,019,040 fixed. Assume four separately accepted orders, each for ten million USDe and each paying one USDC per USDe at successive permissible deadlines. Assume no other uses, pre-consumed limits or conversions. These are not observed orders, a queue, a price promise or a four-block throughput forecast. Inputs and conditional model.
The same recovery can be sufficient in amount and late in time
| Case | Needed independent initial USDC | Meaning |
|---|---|---|
| No arrival before the fourth deadline | 9,065,890.828 | The assumed forty-million-USDC demand exceeds this opening inventory. |
| The same amount arrives before that deadline | 0 | A qualifying independent receipt closes this timing gap, subject to the other assumptions. |
| The same amount arrives only after that deadline | 9,065,890.828 | Later recovery does not pay an earlier bill retroactively. |
| One additional USDC reserved for margin | 9,065,891.828 | A reservation consumes free cash without necessarily causing a permanent loss. |
Here, a funding bridge means temporary financing, not a blockchain bridge. No Maple or JAAA receipt date is assumed. The amount is the largest cumulative deficit before any deadline, not a sum of repeated deficits or a claim that a lender will advance it. An initially funded bridge brings a matching debt or assigns an existing recovery claim. It cannot repair a permanent principal loss without genuinely loss-absorbing capital. The cash ledger and separate impairment test.
For a claim with principal P and net recoverable principal R, a positive P − R is a value shortfall even with unlimited waiting. A full recovery after an earlier deadline instead leaves a timing problem. Both can affect a forced seller, but they must not be counted as independent losses without tracing the same resource. Recovery costs and impairment · Unreconciled issuer-wide buffers.
The same invented balance sheet can answer different questions
The following normalized balance sheet belongs to the 18 September foundation. It is a separate hypothetical example, not a portfolio calibrated to the newly observed Maple, JAAA or Mint amounts. Do not add its scenarios to the funding example above.
The supplied balance sheet uses liabilities of 1,000 and assets of 1,015: liquid stablecoins 300, DeFi loans 350, Treasury claims 150, CLO claims 100, net hedged-crypto backing 100 and a reserve 15. Categories are nonoverlapping by assumption; the reserve is already included in assets. These are hypothetical normalised value units, not scaled estimates of Ethena’s portfolio. Complete supplied sensitivities.
| Sensitivity | Supplied assumptions | Result and lesson |
|---|---|---|
| Revenue loss only | 10% annual adverse carry on the 100-unit crypto allocation for 90/365 years; no offsetting revenue. | Loss 2.465753; assets remain 1,012.534247. Lower income does not automatically impair principal. |
| Economic impairment | 5% DeFi loss, 3% CLO haircut, 2% hedge loss, 0.5% stablecoin haircut and one unit of execution cost. | Total loss 25; assets 990. The reserve absorbs only 15 of the loss, leaving a 10-unit liability shortfall. |
| Unavailable, not impaired | Freeze 100 liquid stable units; only remaining liquid stables plus reserve can pay now. Demand 400. | 215 available now; 185 immediate gap despite 1,015 accounting assets. A 50 margin payment widens that same gap to 235. |
| Additional unbacked supply | An authorised replacement hypothetically adds 50 liabilities without assets. | 1,015 assets against 1,050 liabilities. Governance / supply integrity addresses this branch, not favourable carry. |
Recoverable assets and accessible cash are different dimensions. A freeze need not imply final loss; a default can. A margin payment is a cash use in the timing example, not an additional assumed economic loss. Reusing the same reserve for several obligations would overstate protection.
Collateral release can require money that arrives before the exit
A borrower’s funding has to arrive before the queue can help
Take the supplied hypothetical borrower with an initial health factor of 1.05. Assume fixed short-interval debt and a 5% fall that the actual collateral oracle recognises. The resulting health factor is 0.9975, below the liquidation threshold. Liquidation or repayment funding can be needed within blocks or minutes, before released sUSDe can enter a queue and ultimately reach a separate sale or issuer redemption. Ordered health-factor example.
This is not a statement that a 5% external USDe spot discount automatically enters Aave’s ratio / USDT input or Base’s selected par primary. If backing is sound and the discount recovers, keeping the accepted value stable can protect borrowers from forced loss. Under genuine impairment or unavailable local exit, delayed recognition can instead expose suppliers to poorer recovery. The Base switch / fallback semantics are not certified. Current-design countercase and limits.
For a venue account, a haircut can obstruct a transfer before liquidation. The separate supplied illustration assumes collateral factors of 95%, 90% and 79% against initial margin 90 and maintenance margin 80. At the assumed 90% factor, the transfer threshold binds while the maintenance ratio is only 88.8889%. Those factors are not measured USDe UTA tiers or a complete venue margin engine. Published gate distinction.
Repayment is a stabiliser only when it can actually arrive
Borrowers repaying USDC can restore lender liquidity and reduce collateral exposure. But repayment may need outside funds before the pledged collateral is released. Issuer redemptions, lending withdrawals and venue margin can compete for an asset in the same location at the same time. Counting eventual proceeds before that order has been respected turns a possible counterflow into invented immediate cash. Lending and ownership evidence.
The narrow dust result in one named Ethena-oriented Base adapter weakens one proposed reciprocal-funding path. It does not supply a portfolio-wide legal-owner or shared-funds map. Therefore no current circular-funding amount or system-wide death spiral is assigned to these scenarios.
The 10 October 2025 episode supplies a bounded historical comparison, not an exact replay. The issuer’s 17 November retrospective reported a Binance USDe/USDT low of 0.6567 and more than $2bn of primary redemptions in 24 hours. Those remain attributed issuer claims, not independently reconstructed prices, summed receipts or proof every holder could exit. The Aave discussion began 24 October, with a contrasting technical response on 2 November. Historical accounts and their limits.
The useful distinction is local exit access versus primary backing—not a guarantee that any proposed support facility is funded today. No full event-block replay, current reserve reconciliation or measured cross-route stress liquidation capacity was obtained.