# \[ARFC\] Add MetaMask USD (mUSD) to Aave v3 Core Instance on Ethereum and Linea
**URL:** https://governance.aave.com/t/arfc-add-metamask-usd-musd-to-aave-v3-core-instance-on-ethereum-and-linea/23097
**Category:** Governance
**Created:** [September 9, 2025, 5:57pm UTC](https://governance.aave.com/t/arfc-add-metamask-usd-musd-to-aave-v3-core-instance-on-ethereum-and-linea/23097 "2025-09-09T17:57:33Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@TokenLogic](https://governance.aave.com/u/TokenLogic)
#### Post date: [September 9, 2025, 5:57pm UTC](https://governance.aave.com/t/arfc-add-metamask-usd-musd-to-aave-v3-core-instance-on-ethereum-and-linea/23097/1 "2025-09-09T17:57:33Z")
* * *
title: [ARFC] Add MetaMask USD (mUSD) to Aave v3 Core Instance on Ethereum and Linea
author: @TokenLogic
created: 2025-09-09
* * *
# Summary
This publication proposes onboarding MetaMask’s mUSD stablecoin to the Core instance of Aave v3 on Ethereum and Linea.
# Motivation
MetaMask USD (mUSD) is a dollar-denominated stablecoin natively integrated into MetaMask. mUSD is issued by [Bridge](https://www.bridge.xyz/), a [Stripe](https://stripe.com/en-es?ad_content=681953773378&utm_matchtype=e&utm_adposition=&gad_campaignid=20802553174) company, and stablecoin issuance and orchestration platform. On-chain MetaMask USD is powered by [M0](https://www.m0.org/), a decentralized stablecoin infrastructure and liquidity platform. mUSD will be deeply integrated into MetaMask’s wallet, offering users a seamless, dollar-denominated stablecoin experience for holding, spending, and transacting in web3.
#### Key properties
- **Wallet-native:** deeply integrated across MetaMask UX and supported dapps.
- **Multi-chain at launch:** Ethereum Mainnet and Linea and will play a foundational role in the growing Linea DeFi ecosystem and network expansion.
- **Interoperable:** designed for cross-chain liquidity via the M0 network.
- **Transparency-first:** reserve management by Bridge with [real-time reporting](https://dashboard.m0.org/stablecoins/musd).
**mUSD** is fully backed 1:1 by high-quality, liquid dollar-equivalent assets. Bridge provides real-time transparency reporting, with independent attestations to follow. The launch aligns with new U.S. regulatory clarity under the **GENIUS Act**.
### Payments & MetaMask Card
**mUSD** supports on-ramps, swaps, bridging, and will soon be spendable via the MetaMask Card at millions of Mastercard merchants.
# Specification
Ticker: **mUSD**
Contract address Ethereum: `0xacA92E438df0B2401fF60dA7E4337B687a2435DA`
Contract address Linea: `0xacA92E438df0B2401fF60dA7E4337B687a2435DA`
Chainlink oracle: `soon`
Audits: [mUSD/audits at main · m0-foundation/mUSD · GitHub](https://github.com/m0-foundation/mUSD/tree/main/audits)
Project: [https://metamask.io](https://metamask.io)
Docs: [mUSD/README.md at main · m0-foundation/mUSD · GitHub](https://github.com/m0-foundation/mUSD/blob/main/README.md)
Twitter: [https://x.com/MetaMask](https://x.com/MetaMask)
| Parameters | Value | Value |
| --- | --- | --- |
| Network | Ethereum | Linea |
| Isolation mode | No | No |
| Borrowable | Yes | Yes |
| Collateral enabled | No | No |
| Supply Cap | 10,000,000 | 70,000,000 |
| Borrow Cap | 8,000,000 | 60,000,000 |
| Debt Ceiling | - | - |
| LTV | - | - |
| LT | - | - |
| Liquidation Penalty | - | - |
| Liquidation Protocol Fee | - | - |
| Variable Base | 0% | 0% |
| Variable Slope1 | 6.50% | 6.50% |
| Variable Slope2 | 60% | 60% |
| Uoptimal | 80% | 80% |
| Reserve Factor | 20% | 20% |
| Stable Borrowing | Disabled | Disabled |
| Flashloanable | Yes | Yes |
| Siloed Borrowing | No | No |
| Borrowed in Isolation | No | No |
Risk Parameters will be provided by Risk Services Providers at the earliest possible and ARFC will be updated with that feedback.
DEX liquidity is to be provided in the coming days to aid Risk Service providers in providing their analysis.
# Disclosure
TokenLogic does not receive any payment for this proposal.
# Next Steps
1. Gather feedback from the community.
2. If consensus is reached on this ARFC, escalate this proposal to the Snapshot stage.
3. If Snapshot outcome is YAE, an AIP will implement proposal.
# Copyright
Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain/zero/1.0/).
---
### Author:  [@LlamaRisk](https://governance.aave.com/u/LlamaRisk)
#### Post date: [September 18, 2025, 5:31pm UTC](https://governance.aave.com/t/arfc-add-metamask-usd-musd-to-aave-v3-core-instance-on-ethereum-and-linea/23097/2 "2025-09-18T17:31:22Z")
## Summary
LlamaRisk supports onboarding mUSD to Aave V3 on Ethereum Core and Linea. The primary risks identified include indirect exposure to [Superstate’s USTB RWA](https://dashboard.m0.org/) on Core and Linea, as it backs approximately 20% of $M reserves and, by extension, mUSD. Additionally, the layered collateral structure of mUSD means it inherits its security from the $M token, which underpins multiple other stablecoins through the M0 Extension model; however, contagion risks are mitigated by the permissioned nature of $M↔mUSD swaps. Another concern is the limited sell-side liquidity for mUSD on Ethereum (~$180K) compared to Linea (roughly $30M).
On the security front, both the mUSD and M0 smart contracts have undergone extensive audits. The mUSD contract implements a role-based access control system, and both MetaMask and M0 have the authority to pause the contract in case of emergencies. Following discussions with the team, they have committed to listing mUSD in the MetaMask HackerOne bug bounty program ($50k max coverage), which is expected to happen imminently. However, it is important to note that no timelock mechanism currently exists for contract upgrades. The team is actively working on a long-term security strategy, and while these concerns may be addressed in the future, they have assured that any upgrades will be thoroughly audited and communicated to the public well in advance, even without a timelock in place. Also, Bridge maintains an OFAC sanctions-based freeze list sourced via OpenSanctions, and to date has [frozen 146 addresses](https://dune.com/jaivardhan4842/metamask-usd#musd-frozen-addresses) across Ethereum and Linea from using mUSD.
> **Full asset review below**
>
> ## 1. Asset Fundamental Characteristics
>
> ### 1.1 Asset
>
> MetaMask USD (mUSD) is a fiat-pegged, reserve-backed stablecoin. Each mUSD is backed 1:1 by $M tokens, which themselves are collateralized by U.S. Treasury Bills. Licensing and reserve management are handled by Bridge, a Stripe subsidiary, while the M0 Protocol provides the smart contract infrastructure for deployment on Ethereum and Linea.
>
> mUSD was deployed at the address `0xacA92E438df0B2401fF60dA7E4337B687a2435DA` to both [Ethereum](https://etherscan.io/token/0xacA92E438df0B2401fF60dA7E4337B687a2435DA) and [Linea](https://lineascan.build/token/0xacA92E438df0B2401fF60dA7E4337B687a2435DA) on August 12, 2025.
>
> ### 1.2 Architecture
>
> mUSD is a [custom stablecoin issued via Bridge](https://apidocs.bridge.xyz/platform/issuance/custom), a Stripe company that provides a platform for compliant stablecoin orchestration. Underlying mUSD’s issuance is the M0 protocol, which has also been used by [other stablecoin projects](https://dashboard.m0.org/stablecoins) such as USDai, Usual, Noble Dollar, and USDhl, collectively powering $475M in market capitalization.
>
> **M0 Protocol**
>
> The M0 platform enables developers to design and issue customized digital dollars. At its core, M0 is a decentralized and immutable protocol that manages the supply of the rebasing $M token, which can then be converted into non-rebasing variants.
>
> mUSD was built using [M0 Extensions](https://docs.m0.org/home/technical-documentations/extensions/), wrapping their foundational $M tokens, inheriting its security and yield properties given to Earners. The wrapping and unwrapping between mUSD and $M token is facilitated by [SwapFacility](https://etherscan.io/address/0xB6807116b3B1B321a390594e31ECD6e0076f6278), which enables 1:1 atomic conversion by creating implicit liquidity between mUSD and $M without needing separate trading pairs. The `M_SWAPPER_ROLE` within SwapFacility is assigned to the [HubPortal](https://etherscan.io/address/0x36f586a30502ae3afb555b8aa4dcc05d233c2ece) contract on Ethereum, which also facilitates the transfer of $M tokens between the Hub (Ethereum) and Spoke (Linea) chains. Since yield distribution is involved, mUSD leverages the `MYieldToOne` extension, which routes all yield to a MetaMask-controlled [treasury address](https://etherscan.io/address/0x13d75d23d619DaB020048B6FdE7c6F1301553166) while providing users with a non-rebasing stablecoin pegged to the dollar.
>
> 
>
> _Source: M^0 Protocol Key Actors, [Dune](https://dune.com/jaivardhan4842/metamask-usd#m0-protocol-key-actors), September 16, 2025_
>
> The [key actors](https://governance.m0.org/actors) in the M0 ecosystem are:
>
> - **Minters** - Permissioned institutions authorized to mint new $M tokens or redeem them for the underlying collateral, playing a central role in managing $M’s supply and serving as the primary on/off-ramps between $M and fiat. Currently, three minter addresses were added to the MINTERS\_LIST by M0, with only two being activated: [Minter One Generator SPV](https://etherscan.io/address/0x7F7489582b64ABe46c074A45d758d701c2CA5446) ([addr1](https://etherscan.io/address/0x7F7489582b64ABe46c074A45d758d701c2CA5446) (active), [addr2](https://etherscan.io/address/0xcd1394d24e1e404f9eb3609f872b0736becb9d74)) ([mxon.co](https://www.mxon.co/home)) and [Bridge](https://etherscan.io/address/0xaf9bc09d0515d311a10ed6dac282d133db37969d) (active) ([bridge.xyz](https://www.bridge.xyz/)), both operating via EOAs (MPC usage unverified), though approval requires compliance with [M0’s general adopted Guidance](https://docs.m0.org/home/getting-started/whitepaper/offchain-ecosystem/#vi-guidance) for off-chain systems.
>
> - **Validators** - Independent, trusted entities responsible for verifying Minters’ collateral on a regular basis, ensuring that $M remains fully backed. Their attestations are critical to protocol security. M0 has approved two validators to date, which are: [Validator One GmbH](https://etherscan.io/address/0xef1d05e206af8103619df7cb576068e11fd07270) ([validator-one.com](https://www.validator-one.com/)) and [Chronicle Labs](https://etherscan.io/address/0xEe4d4938296E3BD4cD166b9b35EE1B8FeD2F93C1) ([chroniclelabs.org](https://chroniclelabs.org/)), both of which operate via EOAs (MPC usage unverified). A single validator signature is required to update collateral, and Chronicle does that for mUSD.
>
> - **Earners** - Addresses approved by M0 governance or the delegated admin of the M0 Extension (mUSD in this case) who are eligible to earn yield in $M tokens. There are currently 61 active Earners approved by M0, including the mUSD extension, which [received approval on May 27, 2025](https://etherscan.io/tx/0x1b67e8729372336560d37e0d63208295e4aab7d89c5880a06cd82f4874c4d0c8), several months prior to its launch. For mUSD, the relevant address is the [yield recipient](https://etherscan.io/address/0x13d75d23d619DaB020048B6FdE7c6F1301553166) approved by MetaMask, which can accrue its rewards.
>
> **Reserves**
>
> \*
> Source: mUSD Collateral, [M0](https://dashboard.m0.org/stablecoins/musd), September 16, 2025\*
>
> Currently, mUSD is 100% backed by United States Treasury Bills (USTB), with reserves held by Bridge, the licensed issuer, via a layered structure in which mUSD is backed by $M, which in turn is backed by USTB. These reserves are independently verified at least every 30 hours by an M0 Protocol validator (Chronicle), which signs collateral attestations on-chain after conducting its own verification. Bridge updates its collateral proof on-chain via the `updateCollateral` function, and each update is validated and signed to ensure compliance with [M0’s eligibility parameters](https://governance.m0.org/config/protocol). Chronicle also provides a [public dashboard](https://chroniclelabs.org/dashboard/vao/m-by-m0) for easier monitoring, though these attestations can be independently observed directly on-chain. M0 Protocol has also set a collateral eligibility criterion, which includes:
>
> 1. USTB with remaining time to maturity of 180 days or less
>
> 2. USTB wrappers in tokenized form, Superstate Short Duration US Government Securities Fund ($USTB) is the only one currently approved
>
> 3. In-transit cash and securities, defined as unsettled buy/sell orders for eligible assets not yet recorded in the SPV’s custody or deposit
>
> The valuation of USTBs would be recognized by their daily market value published on [treasurydirect.gov](http://treasurydirect.gov), and for approved wrappers, it is the most recent NAV calculated by a third-party agent and published by the fund administrator. As of now, only one SPV operator has been approved, namely [CrossLend GmbH](https://crosslend.com/) ([crosslend.com](http://www.crosslend.com/)), and they’re expected to enter a Minter-SPV Operator Agreement with every Minter they provide service to.
>
> **$M Collateral**
>
> 
>
> _Source: [M0](https://dashboard.m0.org/), September 16, 2025_
>
> Since mUSD relies on a layered collateral structure, with its backing ultimately derived from the $M token (current supply ~475M), which also underpins other M0 Extensions, it is important to evaluate potential contagion risks. Each extension is economically fungible through the SwapFacility, which unwraps extension tokens into $M and rewraps them into other approved extensions. While this design preserves 1:1 backing at all times, it also means all extensions draw from the same $M collateral pool.
>
> From a technical perspective, the failure of one extension does not directly compromise the peg of others, as the SwapFacility enforces [permissioned access](https://docs.m0.org/home/technical-documentations/extensions/swap-facility/#permission-system) on extension-to-$M swaps via the `swapOutM` function, restricted by the `M_SWAPPER_ROLE`. In the case of mUSD, this risk is further mitigated because it is a _permissioned extension_: only Bridge’s authorized address can perform `swapInM` into mUSD, eliminating the possibility of systemic contagion between extensions. At the bridging (Portal) level, mUSD can also only be bridged into itself, unlike other extensions that may bridge across one another, further containing any potential contamination.
>
> Regarding dependency risk, while $M reserves include [Superstate’s USTB](https://superstate.com/ustb#holdings) (~20% of the collateral), it is important to note that USTB tokens are simply on-chain representations of a Reg D fund, strictly operated under a whitelist model. This significantly reduces risks from wallet compromises, and in the event of a blockchain-level failure, Superstate can reinstate investor portfolios based on off-chain fund records. Additionally, through mUSD, Aave Core and Linea would have indirect exposure to Superstate’s USTB RWA.
>
> **Cross-chain Bridging**
>
> The underlying $M tokens held by mUSD are made available cross-chain by M0 using a Hub and Spoke model. Ethereum is the Hub where native $M tokens are minted and they’re made available to spokes (like Linea) from the Hub using a lock-and-release mechanism.
>
> M Portals are the set of smart contracts ([HubPortal](https://etherscan.io/address/0x36f586a30502ae3afb555b8aa4dcc05d233c2ece) on Ethereum and [SpokePortal](https://lineascan.build/address/0x36f586A30502AE3afb555b8aA4dCc05d233c2ecE) on Linea) that facilitate the cross-chain functionality and propagate essential system information like the yield index and governance parameters between Ethereum and connected Spoke chains like Linea. At its core, M Portal is supported by Wormhole for its Standard version and Hyperlane for its Lite version, which is an EVM-only version and is more gas efficient.
>
> **Yield** **Accrual**
>
> 
>
> _Source: [M0 Docs](https://docs.m0.org/home/technical-documentations/rate-models/#rates-models--yield)_
>
> Minters pay interest on their minted $M to the M0 protocol, reflecting the risk-free rate generated by the underlying U.S. Treasury Bills. This interest accrues to the M0 protocol and can be distributed to approved Earners, and the mUSD ERC20 contract is one of them. mUSD uses the `MYieldToOne` extension, under which all $M token yield is further directed to a single, configurable yield recipient, in this case, a MetaMask-controlled [3/5 Safe multisig](https://etherscan.io/address/0x13d75d23d619DaB020048B6FdE7c6F1301553166), meaning all revenue accrued by the supply of mUSD is distributed to Consensys. The yield rate is dynamic and determined by the following rate models:
>
> - [MinterRateModel](https://etherscan.io/address/0xcA144B0Ebf6B8d1dDB5dDB730a8d530fe7f70d62#code): Defines the interest rate paid by Minters on borrowed $M. It is a simple model that sources rates directly from the [TTG Registrar](https://etherscan.io/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c), capped at 400% APR for system safety, and controlled by governance. The [current annualized minter rate is 4.08%](https://etherscan.io/address/0xcA144B0Ebf6B8d1dDB5dDB730a8d530fe7f70d62#readContract#F2).
>
> - [EarnerRateModel](https://etherscan.io/address/0x6b198067E22d3A4e5aB8CeCda41a6Da56DBf5F59#code): Determines the interest rate distributed to $M holders who opt in to earning. The [current annualized rate is 4.08%](https://etherscan.io/address/0x26d01a2c91f6529ad72d2c27a03d963cab90dffd#readContract#F9), directed to the designated yield recipient, with a cap of 4.08% APR to ensure that earner yield never exceeds minter obligations.
>
> Any residual yield (zero currently) not distributed to Earners accrues to M0’s [DistributionVault](https://etherscan.io/address/0xd7298f620B0F752Cf41BD818a16C756d9dCAA34f), which has accumulated 639K $M tokens in rewards to date across all stablecoins utilizing the M0 infrastructure.
>
> ### 1.3 Tokenomics
>
> As of September 16, 2025, mUSD has a total on-chain supply of $26.32M, distributed between Ethereum ($4.96M) and Linea ($21.36M).
>
> #### 1.3.1 Token Holder Concentration
>
> The top holders of [mUSD on Linea](https://lineascan.build/token/tokenholderchart/0xaca92e438df0b2401ff60da7e4337b687a2435da) are:
>
> - [Etherex mUSD/USDC Pool](https://www.etherex.finance/liquidity/0x09666eaf650dc52cece84b1bcd2dd78997d239c7): 43% of the total supply.
>
> - [Etherex mUSD/WETH Pool](https://www.etherex.finance/liquidity/0x6667f117b936f17aa62d0fd3228ad0db046985e6): 20.3% of the total supply.
>
> - [EOA 1](https://lineascan.build/address/0x795facaa76aed7c5f44a053155407199f4075139): 17.9% of the total supply.
>
> - [Etherex mUSD/USDT Pool](https://www.etherex.finance/liquidity/0x5dc74003c0a9d08eb750b10ed5b02fa7d58d4d1e): 9.63% of the total supply.
>
> - [Multisig 1](https://lineascan.build/address/0x6cb5094cfe45Ee97938702637478fe7146A8FA0f): 5.4% of the total supply.
>
> The top holders of [mUSD on Ethereum](https://etherscan.io/token/tokenholderchart/0xaca92e438df0b2401ff60da7e4337b687a2435da) are:
>
> - [Uniswap mUSD/USDC Pool](https://app.uniswap.org/explore/pools/ethereum/0x72daf39b278fab80f18ad2adf73cc8b1ae63de1e508d36aa033285fff506f169): 70.4% of the total supply.
>
> - [Multisig 1](https://https://0x6cb5094cfe45Ee97938702637478fe7146A8FA0f): 14.6% of the total supply.
>
> - [EOA 2](https://etherscan.io/address/0xb3792dddc5398a31fa3deb319bf3c76e324cca5f): 13.1% of the total supply.
>
> mUSD supply on Ethereum and Linea is highly concentrated among just a few entities, who collectively hold the majority of the token supply. While a significant share has been deposited into DEXs, this extreme concentration indicates that retail participation has yet to meaningfully begin.
>
> ## 2. Market Risk
>
> ### 2.1 Liquidity
>
> 
>
> _Source: mUSD/USDC Swap Liquidity, [Odos](https://app.odos.xyz/market), September 16, 2025_
>
> On Ethereum, users can only swap $185K mUSD for USDC within a price impact of 7.5%, which is low compared with the asset’s supply on Ethereum. On Linea, a swap of $29.2M mUSD for USDC can be made within a price impact of 7.5%.
>
> #### 2.1.1 Liquidity Venue Concentration
>
> 
>
> _Source: mUSD Liquidity Pools, [GeckoTerminal](https://www.geckoterminal.com/linea/pools/0x09666eaf650dc52cece84b1bcd2dd78997d239c7), September 16, 2025_
>
> On Ethereum, the biggest mUSD liquidity pool is [Uniswap V4 mUSD/USDC](https://app.uniswap.org/explore/pools/ethereum/0x72daf39b278fab80f18ad2adf73cc8b1ae63de1e508d36aa033285fff506f169), which holds $5M in TVL. However, the available mUSD sell-side liquidity is just $170K.
>
> On Linea, the DEX liquidity is much higher with the major pools being [Etherex mUSD/USDC](https://www.etherex.finance/liquidity/0x09666eaf650dc52cece84b1bcd2dd78997d239c7) ($18.89M), [Etherex mUSD/USDT](https://www.etherex.finance/liquidity/0x5dc74003c0a9d08eb750b10ed5b02fa7d58d4d1e) ($14.42M TVL), [Etherex mUSD/WETH](https://www.etherex.finance/liquidity/0x04888b262e39163e3109aa36e805f0ce73d1f04a) ($10.33M), and [Etherex mUSD/LINEA](https://www.etherex.finance/liquidity/0x76e5d2033268f053cbe8b65abbd00db66fa6d39b) pool ($1.23M). Across all pools, combined mUSD sell-side liquidity on Linea is $23.53M.
>
> #### 2.1.2 DEX LP Concentration
>
> On Ethereum DEXs, mUSD liquidity is highly concentrated with a single entity, whereas on Linea it is more evenly distributed, reducing the immediate risk of a liquidity crunch. However, most of this liquidity has only been bootstrapped in the past few weeks, raising concerns about its long-term stickiness. Below is the breakdown (as of September 16, 2025):
>
> - Ethereum:
>
> - Linea:
>
> ### 2.2 Volatility
>
> 
>
> _Source: mUSD Secondary Market Rate, [GeckoTerminal](https://www.geckoterminal.com/linea/pools/0x09666eaf650dc52cece84b1bcd2dd78997d239c7), September 16, 2025_
>
> Since launch, mUSD pools on Ethereum and Linea have consistently traded within a 1% premium. The largest deviation recorded was only 0.24 bps in the Etherex (Linea) pool. However, both pools have been live for less than a month, so the available data is limited and does not yet allow for high-confidence conclusions.
>
> ### 2.3 Exchanges
>
> mUSD is exclusively traded on DEXs and is not currently listed on any centralized exchange.
>
> ### 2.4 Growth 
>
> _Source: mUSD Total Supply, [Dune](https://dune.com/queries/5763333/9350112), September 16, 2025_
>
> mUSD has been launched in partnership with Bridge and M0, with planned integration into the MetaMask Card to enable global Mastercard payment access, positioning it for rapid growth. The current total supply stands at 26.32M, split between Linea (21.36M) and Ethereum (4.96M). Notably, nearly the entire supply has been minted this month.
>
> ## 3. Technological Risk
>
> ### 3.1 Smart Contract Risk
>
> The M0 Protocol smart contracts used by mUSD underwent the following audits:
>
> - M0 mUSD
>
> - M0 Protocol and TTG
>
> - EVM M0 Extensions
>
> - M Portal Lite
>
> All of these issues were either acknowledged or resolved.
>
> ### 3.2 Bug Bounty Program
>
> Following our discussions, the team has confirmed that mUSD will be listed on MetaMask’s [$50K HackerOne](https://hackerone.com/metamask/policy_scopes) bug bounty program imminently. While the M0 Protocol does not yet have its own separate live bug bounty, the team reports that MetaMask and M0 are jointly developing a long-term security strategy. In the event of an emergency, the mUSD contract can still be swiftly paused by both MetaMask and M0.
>
> ### 3.3 Price Feed Risk
>
> Although mUSD is designed to maintain a 1:1 peg with the U.S. dollar, its backing structure is layered and introduces complexity. Each mUSD is backed by the $M token, which in turn is collateralized by U.S. Treasury Bills (USTB). While the M0 protocol supports distributing the risk-free rate to users, mUSD diverts yield to a MetaMask-controlled treasury through the non-rebasing `MYieldToOne` extension, so end-users do not directly accrue yield.
>
> From a pricing perspective, this structure introduces uncertainty. At present, Chronicle, operating as a validator for M0 Protocol, provides a [proof-of-reserves dashboard](https://chroniclelabs.org/dashboard/vao/m-by-m0) for the $M token. In principle, a similar PoR-based price feed could be constructed by tracking `updateCollateral` function calls executed by Bridge via the [MinterGateway](https://etherscan.io/address/0xf7f9638cb444D65e5A40bF5ff98ebE4ff319F04E). Since the [SwapFacility](https://etherscan.io/address/0xB6807116b3B1B321a390594e31ECD6e0076f6278) guarantees atomic 1:1 permissioned swaps between $M and its extensions, Chainlink’s mUSD/USD feed ([Ethereum](https://etherscan.io/address/0xc90E3460424fb8ea79775089E9053113FEE34Ed0), [Linea](https://lineascan.build/address/0xc834a55fb78dEa866E9cd86047Df0F584B9da339)) can be used to price mUSD without depending on $M/USD as a proxy. An additional 1.04 upside cap can be applied to prevent oracle deviations or anomalous price spikes.
>
> ### 3.4 Dependency Risk
>
> **Bridge**
>
> MetaMask USD (mUSD) is fundamentally dependent on Bridge, a Stripe-owned stablecoin issuance platform, for its compliant licensing, reserve management, and orchestration. Bridge ensures that mUSD remains fully backed 1:1 by U.S. Treasury Bills and adheres to strict regulatory and operational standards. It also handles real-time monitoring and transparency of reserves by periodically getting its reserves attested by M0 Validators. While the M0 Protocol powers the smart contract infrastructure on Ethereum and Linea, it is Bridge that enables mUSD’s secure issuance and regulatory compliance, making it a critical backbone of the stablecoin’s architecture and trust model.
>
> **M0 Protocol**
>
> MetaMask USD (mUSD) is inherently reliant on the M0 Protocol for its issuance and operational framework, introducing several critical dependency risks. Built on top of M0 Extensions, mUSD inherits both the regulatory posture and technical architecture of the protocol. Consequently, any changes to M0 governance, particularly those affecting the $M token, which underpins mUSD’s base liquidity and collateral structure, can directly impact mUSD’s stability and functionality. M0-approved Minters (Bridge) and Validators (Chronicle) are trusted to operate cohesively, minting $M only with approved collateral, which directly affects mUSD’s backing.
>
> Additionally, mUSD can only be deployed on chains supported by M0, limiting its cross-chain scalability. Proper functioning of mUSD depends on careful management of the broader M0 ecosystem. For example, the `SwapFacility` contract must maintain appropriate lags and approved swappers, while M0 Extension tokens like mUSD interact with the underlying $M token, which generates the yield.
>
> **Superstate’s USTB**
>
> 
>
> _Source: [M0](https://dashboard.m0.org/), September 17, 2025_
>
> A key dependency risk arises from Superstate’s USTB, which currently comprises around 20% of the $M reserves, with its share having grown over time to become one of the largest single collateral exposures. This concentration means the health of $M, and by extension mUSD and other M0 Extensions, relies heavily on the operational and regulatory soundness of Superstate’s product. While the permissioned structure of USTB ([restricted to whitelisted investors](https://docs.superstate.com/tokenized-shares/investors)) and Superstate’s ability to reinstate portfolios from off-chain fund records mitigate risks of wallet compromise or on-chain technical failures, reliance on USTB still introduces correlated dependency. In the event of broader issues such as regulatory actions or severe liquidity constraints, these would flow through $M’s collateral base and indirectly affect mUSD via the layered architecture.
>
> ## 4. Counterparty Risk
>
> ### 4.1 Governance and Regulatory Risk
>
> The governance of the M0 protocol, which underpins the mUSD architecture, is managed through the [Two Token Governance (TTG) system](https://governance.m0.org/history). TTG is a multi-layered framework inspired by constitutional checks and balances, separating operational control from meta-governance authority. Governance responsibilities are divided between two tokens:
>
> - [Power token (POWER)](https://etherscan.io/token/0x5983B89FA184f14917013B9C3062afD9434C5b03) **:** Used for operational governance proposals and emergency actions via the [StandardGovernor](https://etherscan.io/address/0xB024aC5a7c6bC92fbACc8C3387E628a07e1Da016) and [EmergencyGovernor](https://etherscan.io/address/0x886d405949F709bC3f4451491bDd07ff51Cdf90A).
>
> - [Zero token (ZERO)](https://etherscan.io/token/0x988567FE094570cCE1FFdA29D1f2d842B70492be) **:** The meta-governance token controlling the governance framework through the [ZeroGovernor](https://etherscan.io/address/0xa0DAFaEEA4A1d44534e1b9227e19CAE6358b80FE) and enabling holders to claim a share of protocol revenue via the [DistributionVault](https://etherscan.io/address/0xd7298f620B0F752Cf41BD818a16C756d9dCAA34f).
>
> **Legal Commentary**
>
> mUSD is presented under the MetaMask brand; however, the legal and operational substance—issuance, redemption, reserve management, and related program controls—resides with Bridge (a Stripe company), leveraging the M^0 infrastructure. In practice, mUSD slots into Bridge’s “Bridge Stablecoins” framework, so any rights and obligations attaching to holders flow primarily from Bridge’s [Stablecoin Terms](https://www.bridge.xyz/legal/bridge-stablecoin-terms/bridge-building-inc) read together with the Bridge [Terms](https://www.bridge.xyz/legal/overview). The analysis below proceeds on that basis, treating MetaMask as the distribution interface and Bridge as the contractual counterparty for mint and redeem.
>
> mUSD is issued by Bridge Building Inc. (“BBI”), a U.S.-registered Money Services Business (FinCEN MSB No. 2450917). The token is dollar-denominated and designed for payments and value preservation, targeting a 1:1 relationship to the U.S. dollar through reserves held in highly liquid, low-risk instruments such as U.S. Treasury bills, government money market funds, and bank deposits. Bridge holds legal title to the reserve assets, which are maintained in accounts titled ‘for the benefit of’ mUSD tokenholders. These reserves are segregated on Bridge’s balance sheet from operating funds. The instrument is expressly not legal tender, is not a bank deposit or brokerage product, and is not covered by FDIC or SIPC insurance. As offered, mUSD is treated as “stored value” under applicable payments law rather than as a security or investment product; it is neither intended nor structured to appreciate or generate income for holders.
>
> Based on the mUSD issuance agreement between Bridge and Consensys that we reviewed under NDA (with confidential specifics omitted), Bridge undertakes to issue, sell, repurchase, and redeem its proprietary stablecoins and to use commercially reasonable efforts to enter into arrangements with market makers to support sales, repurchases, and redemptions of the custom instrument. Under that agreement, mUSD constitutes a ‘Custom Stablecoin’—a U.S. dollar–backed token branded and structured by mutual agreement of the parties. Rather, following minting, Bridge or its applicable affiliates effect sales and repurchases of mUSD, with Consensys permitted to facilitate pre-minting on terms agreed by the parties. Bridge manages the reserves in accordance with prudent industry practice and applicable law, including periodic monitoring of mUSD reserves and outstanding supply. For holders, these inter-party commitments clarify the operational allocation of duties without altering the consumer-facing claim profile, which remains governed by the public Stablecoin Terms and applicable [User Terms](https://www.bridge.xyz/legal/overview).
>
> Acquisition occurs by submitting properly funded orders via authorized partners and platforms integrated with Bridge’s services. Self-custodial wallets are supported, but onboarding and transaction monitoring can trigger enhanced review, creating a higher likelihood of additional screening or processing delays. Orders and settlements remain subject to Bridge’s acceptance, program limits, and compliance checks at the time of each transaction.
>
> Each mUSD is redeemable, subject to KYC/AML and programmatic constraints, with BBI or its affiliates for U.S. dollars at par value, net of any applicable fees. Once a redemption request is deemed compliant, processing is ordinarily completed within two business days, although suspension rights remain available under the terms. On-chain, mUSD is transferable across supported networks; however, BBI may restrict transfers (including freezing or blacklisting specific addresses) to satisfy legal obligations or internal compliance policies. The redemption entitlement “runs with” the token, but it is exercisable only by a holder who becomes, and remains, an eligible “User” under Bridge’s [User Terms](https://www.bridge.xyz/legal/overview), including completion of identity verification and satisfaction of sanctions and jurisdictional requirements. As a consequence, secondary purchasers can realize par value directly only after successful onboarding.
>
> Holders have no direct or indirect property interest in the reserve assets. No trust, security interest, or other proprietary claim in favor of tokenholders is created by holding mUSD. In an issuer default or insolvency scenario, holder recourse is contractual: a general unsecured claim for redemption at par, subject to insolvency priorities and applicable law, rather than any segregated claim to specific reserve instruments or proceeds.
>
> Price stability is not guaranteed on secondary markets. The 1:1 outcome is ensured only through compliant redemption with the issuer or its affiliates. Trading on centralized or decentralized venues may clear above or below par, and program terms disclaim responsibility for secondary-market pricing or liquidity conditions beyond the redemption mechanism.
>
> Program control rights are extensive and should be treated as integral to holder risk. Bridge’s Stablecoin Terms authorize freezing, blacklisting, burning, and—where appropriate—burn-and-remint to a different address, including in response to legal process or internal compliance determinations. The terms emphasize that blacklisting can result in the permanent loss of access to tokens and reiterate that neither tokens nor reserves benefit from deposit insurance. Chain-level events such as forks, as well as third-party wrappers or copies, are borne at the holder’s risk; Bridge may decline to recognize or support non-canonical versions and can require migration if support for a given chain ceases.
>
> For distribution outside the United States, Bridge publishes separate terms. In the EEA, the relevant entity is Bridge Building sp. z o.o. (registered in Poland in the Register of Virtual Currency Activities under RDWW-794), And for the Rest of the World, Bridge Building Limited is referenced.
>
> 
>
> Source: [Register of Virtual Currency Activities](https://www.slaskie.kas.gov.pl/c/document_library/get_file?uuid=73ffde9b-0123-4594-8a94-a4d458218386&groupId=3559133), September 17, 2025
>
> For EEA distribution, MetaMask has indicated that mUSD is initially routed to resident market makers through the Polish VASP, i.e., Bridge Building sp. z o.o., with onward distribution to proceed via a licensed crypto-asset service provider once authorization is granted and operations commence, currently targeted for Q1 2026.
>
> A further transparency gap is present at the product site level: the mUSD [documentation hub](https://musd.to/docs#) presently indicates placeholders for “Legal docs,” “Attestations,” and a “Reserve dashboard.” Pending publication of mUSD-specific legal terms, independent reserve attestations, and live reserve transparency, the working assumption is that the generic Bridge Stablecoin Terms govern.
>
> ### 4.2 Access Control Risk
>
> #### 4.2.1 Contract Modification Options
>
> The mUSD access control setup is identical on Ethereum and Linea. Here are the controlling wallets:
>
> - [Multisig A](https://etherscan.io/address/0x74dbd45b505fb3b9f94c31e5f15c41b8e9883b04#readProxyContract#F9) - 3/5 threshold Safe, admin of mUSD contract.
>
> - [Multisig B](https://https://0x21739aa3fead674f31928a806d640689fc34c8f3) - 3/5 threshold Safe with identical owner setup as Multisig A, handles mUSD pauser role.
>
> - [Multisig C](https://etherscan.io/address/0xb0e4e7e869d2d338ebcb19b6919e8a9dcb3b4e6c#readProxyContract#F9) - 3/7 threshold Safe, handles mUSD yield receipt manager role.
>
> - [Multisig D](https://etherscan.io/address/0xdcf79c332cb3fe9d39a830a5f8de7ce6b1bd6fd1#readProxyContract#F9) - 2/3 threshold Safe, admin of SwapFacility and owner of HubPortal contract.
>
> - [EOA A](https://https://0x251d2711ebeb0a09fdb8992f5506f3d949175246) - Assigned mUSD forced transfer and freeze manager roles.
>
> - [M^0 Deployer](https://etherscan.io/address/0xF2f1ACbe0BA726fEE8d75f3E32900526874740BB) - An EOA, handles the mUSD pauser role.
>
> The following contracts power the mUSD architecture on Ethereum:
>
> - [mUSD](https://etherscan.io/address/0xacA92E438df0B2401fF60dA7E4337B687a2435DA): ERC20 contract for the mUSD token. Deployed behind an _ERC1967 Proxy_ controlled by the Multisig A.
>
> - [MinterGateway](https://etherscan.io/address/0xf7f9638cb444D65e5A40bF5ff98ebE4ff319F04E): Oversees all minter-related activities like activation and eligibility of deposited collateral, relying on verification from Validators, and is controlled by Two-Token Governance (TTG).
>
> - [SwapFacility](https://etherscan.io/address/0xB6807116b3B1B321a390594e31ECD6e0076f6278): Exclusive router for all wrapping and swapping operations involving $M and mUSD, and is controlled by [Multisig D](https://etherscan.io/address/0xdcf79c332cb3fe9d39a830a5f8de7ce6b1bd6fd1#readProxyContract#F9).
>
> - [TTGRegistrar](https://etherscan.io/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c): Holds approved addresses for roles and key protocol parameters used for minter and earner rate, and is managed by TTG.
>
> - [HubPortal](https://etherscan.io/address/0x36f586a30502ae3afb555b8aa4dcc05d233c2ece): Responsible for swapping M/mUSD and propagating $M token between hub and spoke chain, and is owned by [Multisig D](https://etherscan.io/address/0xdcf79c332cb3fe9d39a830a5f8de7ce6b1bd6fd1#readProxyContract#F9).
>
> The following contracts power mUSD architecture on Linea:
>
> - [mUSD](https://lineascan.build/token/0xacA92E438df0B2401fF60dA7E4337B687a2435DA): ERC20 contract for the mUSD token. Deployed behind an _ERC1967 Proxy_ controlled by the [Multisig A](https://lineascan.build/address/0x74dbd45b505fb3b9f94c31e5f15c41b8e9883b04#readProxyContract#F9).
>
> - [SwapFacility](https://lineascan.build/address/0xB6807116b3B1B321a390594e31ECD6e0076f6278): Exclusive router for all wrapping and swapping operations involving $M and mUSD, and is controlled by [Multisig D](https://lineascan.build/address/0xdcf79c332cb3fe9d39a830a5f8de7ce6b1bd6fd1#readProxyContract#F9).
>
> - [TTG Registrar](https://lineascan.build/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c): Holds approved addresses for roles and key protocol parameters used for minter and earner rate, and is managed by TTG.
>
> - [SpokePortal](https://lineascan.build/address/0x36f586A30502AE3afb555b8aA4dCc05d233c2ecE): Hosts representation of $M token on spoke chain (Linea) and is controlled by [Multisig D](https://lineascan.build/address/0xdcf79c332cb3fe9d39a830a5f8de7ce6b1bd6fd1#readProxyContract#F9).
>
> mUSD employs OpenZeppelin’s role-based access control framework to manage sensitive functions, with the Ethereum setup mirrored identically on Linea:
>
> 
>
> Since launch, [146 addresses](https://dune.com/jaivardhan4842/metamask-usd#musd-frozen-addresses) have been frozen across Ethereum and Linea. Bridge maintains the frozen wallets list, using [OpenSanctions](https://www.opensanctions.org/) as the vendor to source OFAC designations, and will also freeze addresses in response to direct requests from law enforcement.
>
> #### 4.2.2 Timelock Duration and Function
>
> No timelock is deployed on mUSD Ethereum and Linea contract upgrades. The team noted that while timelocks are not deployed, they are evaluating this as part of their joint security strategy, weighing trade-offs such as slower upgrades, and assured that any future upgrades will be publicly communicated and thoroughly audited in advance.
>
> #### 4.2.3 Multisig Threshold / Signer Identity
>
> [Multisigs A](https://etherscan.io/address/0x74dbd45b505fb3b9f94c31e5f15c41b8e9883b04#readProxyContract#F9) and B, which share an identical signer set, are controlled by MetaMask. The signers are:
>
> - 0x1e50BefBdb9480fBaB01d8c3D74b990B070ED002
>
> - 0xA75739D08DaE3c5ce18951776aC3642035bBE0A3
>
> - 0xCAd56Fae244546D0A53E8aFe285ACD37a49e2760
>
> - 0x912167042A81806BB037EF12B07acadFa5aFa50F
>
> - 0xE221e9444B08D9b31b12E323dE5486B850B53F9E
>
> **Note** : This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and [available here](https://github.com/llama-risk/aave-research/blob/main/frameworks/aave_v3_framework.md).
## Aave V3 Specific Parameters
Will be presented jointly with Chaos Labs.
## Price feed Recommendation
We recommend using a Chainlink mUSD/USD price feed ([Ethereum](https://etherscan.io/address/0xc90E3460424fb8ea79775089E9053113FEE34Ed0), [Linea](https://lineascan.build/address/0xc834a55fb78dEa866E9cd86047Df0F584B9da339)), with an upper bound applied to safeguard against anomalous price deviations.
### Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
---
### Author:  [@ChaosLabs](https://governance.aave.com/u/ChaosLabs)
#### Post date: [September 19, 2025, 2:25pm UTC](https://governance.aave.com/t/arfc-add-metamask-usd-musd-to-aave-v3-core-instance-on-ethereum-and-linea/23097/3 "2025-09-19T14:25:57Z")
# Overview
Chaos Labs supports listing mUSD on Aave’s v3 Ethereum Core and Linea instances. Below is our analysis and initial risk parameter recommendations.
# Metamask (Wallet Layer & Brand)
MetaMask is one of the most widely adopted self-custodial crypto wallets, developed by Consensys, a leading Ethereum software company. Since its launch in 2016, MetaMask has played a central role in enabling access to the Ethereum ecosystem and broader Web3 landscape, offering tools for interacting with dApps, managing assets across multiple chains, and signing on-chain transactions.
Consensys, founded by Ethereum co-founder Joseph Lubin, is behind a suite of infrastructure and developer tools including Infura, Linea, Truffle, and Ethereum clients Teku and Besu. It remains one of the most active software firms building atop Ethereum.
In 2025, MetaMask introduced MetaMask USD (mUSD), a non-rebasing stablecoin native to its wallet ecosystem. The launch follows increased regulatory clarity brought by the Genius Act, allowing Consensys to move forward with a compliant, wallet-native stablecoin offering.
While MetaMask does not directly issue mUSD, it acts as the front-facing distribution and utility layer. This integration allows users to hold and transact with mUSD directly inside the MetaMask wallet. Additionally, on- and off-ramp functionality is available through MetaMask’s integration with Transak, enabling users to seamlessly convert between fiat and mUSD. The actual issuance and redemption of mUSD is handled by Bridge, a regulated stablecoin platform that operates behind the scenes to ensure full collateral backing and compliance.
# Bridge (Issuer – Stripe Subsidiary)
Bridge is the official issuer of mUSD. It operates as a regulated stablecoin orchestration platform, offering licensing, compliance, reserve management, and monitoring infrastructure to support the issuance and redemption of fiat-backed stablecoins.
Bridge abstracts away the complexity of blockchain infrastructure, enabling trusted brands like MetaMask to offer stablecoins without directly managing custody or compliance. While MetaMask serves as the wallet and distribution layer.
In February 2025, Bridge was acquired by Stripe, a global payments company, signaling a broader convergence between fintech and stablecoin infrastructure. Post-acquisition, Bridge continues to operate independently but benefits from Stripe’s regulatory reach and institutional credibility, especially relevant in light of the Genius Act, which established a regulatory framework for stablecoin issuance in the U.S.
Bridge utilizes the M0 protocol as the backend infrastructure for mUSD issuance, enabling programmability and cross-chain operability while maintaining full compliance and transparency.
# M0 Protocol (Infrastructure Layer)
M0 is a stablecoin infrastructure platform purpose built for issuing application specific stablecoins. At its core, M0 manages the issuance and redemption of $M, a fully collateralized digital dollar that acts as the foundation for custom stablecoin implementations known as M0 Extensions.
The protocol breaks down the concept of a stablecoin into two modular layers:
- A value layer: represented by the $M token, backed 1:1 by eligible collateral (primarily short-duration U.S. Treasuries).
- An application layer: represented by Extension tokens, which wrap $M to inherit its collateral and yield properties, while adding custom logic, branding and functionality.
M0 operates as an open and federated system, where Minters, Validators, and Governance participants interact to ensure the security, transparency, and compliance of the system. M0 is designed to be cross-chain interoperable, with Ethereum as the canonical hub for minting and governance and extensions like mUSD operable across L2s such as Linea.
## M Token
The $M token is the core collateral-backed asset of the M0 Protocol. It is an immutable, ERC-20 compliant token, fully backed 1:1 by eligible collateral such as short-duration U.S. Treasuries or on-chain options like USTB, a tokenized short-duration U.S. government securities fund.
While not designed for end users, $M serves as the foundation for all M0 Extension tokens, like mUSD, which wrap $M to inherit its composability, compliance and yield properties.
Minting and burning of $M is exclusively controlled by the protocol’s `MinterGateway` contract, with supply changes initiated by governance approved Minters and validated by governance approved Validators, ensuring all operations are fully collateral-backed and compliant with protocol rules.
$M token can be wrapped into any M0 Extension token or unwrapped back to $M at a fixed 1:1 rate, with no slippage or fees. This mechanism ensures seamless interoperability between custom stablecoins and the underlying collateral layer.
## Extension Tokens
Extension Tokens represent the application layer of the M0 Protocol. Built on top of the foundational $M token, they enable developers to issue custom ERC-20 stablecoins with their own branding, logic and distribution mechanics, while inheriting the full collateral backing, compliance guarantees and infrastructure of $M.
```json
Your Custom Stablecoin e.g mUSD (Extension)
↓ wraps/unwraps
$M Token (Foundation)
↓ backed by
US Treasury Collateral
```
These tokens inherit the cross-chain interoperability features of the M0 Protocol, allowing them to exist across ecosystems via Portals built on protocols like Wormhole and Hyperlane. This enables native functionality on chains like Linea, while maintaining Ethereum as the canonical source of truth.
Wrapping and unwrapping between an Extension token and $M occurs at a fixed 1:1 rate and can be performed by permissioned users as defined by each Extension’s governance or configuration.
In addition, the M0 architecture supports Extension-to-Extension swaps, enabling users to directly convert one Extension token into another. These swaps require both Extension contracts to grant permission to approved entities to facilitate the operation and by default this functionality is also permissioned for security and control.
## Mint and Redemption of M Token
The minting and redemption of $M tokens are governed by a permissioned and highly controlled process designed to ensure full collateralization and compliance at all times. These operations are facilitated by a set of trusted roles: Minters, Validators, SPV Operators, and underlying custody structures.
The M0 Protocol operates under a hub-and-spoke architecture, where Ethereum serves as the canonical hub, the only chain where $M can be natively minted and redeemed. Spoke chains include Ethereum Layer 2s (e.g., Linea, Arbitrum) and other EVM or non-EVM L1s.
While users can freely access and use $M on spoke chains via bridging mechanisms, minting and redemption of the underlying collateral is strictly restricted to the Ethereum hub. Both hub-to-spoke and spoke-to-spoke bridging are supported, enabling interoperability across the multichain M0 ecosystem while preserving central control over issuance and collateral flows.
### Mint
To mint $M, a governance approved Minter deposits eligible collateral (e.g., short-duration U.S. Treasuries or tokenized equivalents like USTB) into an SPV controlled custody account. The Minter then submits a `proposeMint()` request through the protocol’s `MinterGateway` contract.
This request is subject to a Mint Delay period, during which any Validator may cancel the transaction if the collateral conditions are not met. Once the delay has passed and all Core Operating Conditions are validated, the Minter can execute the mint and $M is issued to the designated address.
### **Redemption**
To redeem the underlying collateral, the Minter initiates a `proposeRetrieval()` request. If the request passes validation, a RetrievalID is generated and the protocol subtracts the corresponding amount from the Minter’s on-chain collateral balance.
An SPV Operator then facilitates the liquidation of the collateral held in custody and transfers the funds to the Minter. Once confirmed, a Validator signs off on the removal of the RetrievalID, and the collateral is officially released from the system.
### Trusted Entities Involved in Mint and Redemption
- Minters: Permissioned institutions authorized to mint and redeem $M against real-world collateral.
- Validators: Independent parties who verify collateral backing, enforce protocol rules, and approve or cancel mint/redeem operations.
- SPV (Special Purpose Vehicle): A legally isolated entity that holds custody of the collateral, designed to be insolvency remote and compliant with regulatory standards.
- SPV Operators: Entities authorized to access custody accounts.
- Custody Accounts: Regulated accounts where collateral is stored, segregated, and independently audited to meet the protocol’s collateral eligibility criteria.
## M Token Backing
Each $M token is fully backed by eligible collateral, with all collateral types and requirements approved by M0 Governance. Currently, the backing consists of:
- Off-chain short-duration U.S. Treasuries, held via regulated custodians in insolvency-remote structures (via SPVs), and
- On-chain tokenized equivalents, such as UST, a tokenized U.S. Treasury fund.
The protocol maintains a 102% collateralization ratio. This buffer provides additional security in the event of operational delays or yield volatility in the bond market.
As of now, the total value of collateral backing the system is approaching $500 million, which supports approximately 487 million $M tokens currently issued onchain. These $M tokens are wrapped into various M0 Extension tokens, including mUSD, USDai and other application specific stablecoins launched by third-party developers and institutions.
## Collateral Storage
The collateral backing $M tokens is held in carefully designed custody structures to ensure security, transparency and legal separation. All assets must be stored in entities and accounts that meet the standards defined by M0 Governance and must be verifiable by approved Validators.
Collateral is held by SPVs. These SPVs:
- Are orphaned legal entities with no direct control or affiliation with Minters or Validators,
- Do not conduct any other business beyond the storage of collateral for Minters and the issuance of notes representing that collateral,
- Are restricted in purpose, with no ability to incur liabilities outside of collateral management.
To interact with the on-chain protocol, each SPV works with an authorized SPV Operator responsible for executing real-world asset transfers during redemption flows. All asset movements are subject to verification by Validators and must comply with the protocol’s collateral rules.
Additionally, SPV-held collateral must meet strict criteria, including:
- Full asset segregation: not just between Minters, but also at the level of each individual wallet address,
- Limited recourse: Minter claims are strictly limited to their own pledged collateral.
# mUSD
mUSD is a non-rebasing ERC-20 stablecoin issued by Bridge and distributed through the MetaMask. It is live on both Ethereum and Linea, with deployments completed in mid-August 2025.
mUSD is built as an M0 Extension and inherits its core infrastructure, collateral backing, and cross-chain interoperability from the M0 Protocol. Specifically, mUSD is a `MYieldToOne`-type Extension, meaning it wraps $M tokens 1:1 but does not distribute yield to users. Instead, all rewards accrued from the underlying collateral are directed to a single designated address. This makes mUSD functionally similar to a zero-yield, US treasury backed stablecoin.
To ensure security, mUSD underwent a 4-audit process in August 2025, covering both the Extension contract and underlying issuance mechanics.
## Market Capitalization
As of mid-September 2025, mUSD has reached a total supply of over 30 million, with most of the growth occurring since the beginning of the month. The supply is split across two chains:
- Linea: ~23.3 million
- Ethereum Mainnet: ~6.8 million
The majority of mUSD growth is currently concentrated on Linea, where it benefits from deep liquidity and active ecosystem incentives. Over 77% of mUSD supply on Linea is deployed in various Etherex DEX pools, primarily paired against USDC, ETH and USDT making it a highly liquid stablecoin relative to its current size.
## Liquidity
mUSD has over $45 million in total liquidity on Linea, primarily paired against USDC, USDT and ETH across various Etherex DEX pools. This makes mUSD one of the most liquid stablecoins on Linea relative to its circulating supply.
This rapid growth in liquidity has been driven in part by the Linea Ignition program, which began on September 15th and is scheduled to run until October 27th. The program incentivizes liquidity provisioning and has significantly deepened liquidity for mUSD. The duration and reward allocation of the program may be extended or adjusted.
Importantly, over $27 million of the $45 million in liquidity is on the buy side, held in USDC, USDT and WETH. This allows:
- Up to $24 million in mUSD to be swapped into stablecoins with \<5% price impact
- Up to $21 million into ETH with \<5% price impact
This depth supports both trading and lending protocol integrations, positioning mUSD as a highly liquid token on Linea, especially when viewed relative to its 24 million circulating supply on the chain.
However, this liquidity profile is currently incentive driven and should be re-evaluated once the Linea Ignition program ends, as a portion of the capital may be yield seeking.
On Ethereum Mainnet, token supply concentration patterns are similar to Linea, with a large portion of the mUSD circulating supply deployed into a DEX pool on Uniswap v4. Out of the current ~6.8 million mUSD circulating on Ethereum, approximately 4.8 million mUSD (over 70%) is deposited into a USDC/mUSD pool.
Unlike on Linea, this does not necessarily make mUSD a liquid token on Ethereum, as the buy-side depth is significantly limited. Only around $359,000 in USDC liquidity is available on the buy side, meaning that large-scale mUSD liquidations would likely incur substantial slippage if mUSD were to be listed as collateral.
This low buy-side liquidity poses challenges for atomic liquidations and large trades. However, it is reasonable to expect that the peg of mUSD on Ethereum will remain stable, as arbitrageurs can bridge between Ethereum and Linea to take advantage of price discrepancies, facilitated by M0’s native cross-chain interoperability design.
## Mint and Redemption
While the minting and redemption of $M tokens have been detailed in the M0 Protocol section, the process for mUSD builds on that flow by introducing an additional wrapping layer through the SwapFacility, a core interoperability contract within the M0 ecosystem.
### **Mint Flow**
The issuance of mUSD follows a permissioned, multi-step process involving collateralization, token minting, and wrapping.
First, a governance approved Minter deposits eligible collateral into an SPV controlled custody account. Once the collateral is validated by Validators, the Minter mints $M through the protocol’s `MinterGateway` contract.
To convert $M into mUSD, the Minter interacts with the mUSD Extension contract, first calling the `wrap` function on the MYieldToOne `MUSD` contract, which then triggers the `swapInM` function on the `SwapFacility` contract. This flow results in the issuance of non-rebasing mUSD tokens atomically, fully backed by overcollateralized reserves via the M0 Protocol.
### **Redemption Flow**
The redemption of mUSD similarly follows a permissioned, structured process in reverse.
A whitelisted Minter first calls the `unwrap` function on the MYieldToOne `MUSD` contract to convert mUSD back into its underlying $M tokens. This triggers a call to the `swapOutM` function on the `SwapFacility`, executing a atomic 1:1 transaction, fee-free conversion from mUSD to $M.
Once the Minter holds the unwrapped $M, they initiate a `proposeRetrieval()` through the `MinterGateway`, signaling intent to redeem the underlying collateral. After passing validation and final checks by Validators, the associated SPV Operator liquidates the collateral held in custody and transfers the proceeds to the Minter.
### **SwapFacility**
The SwapFacility is the central hub that powers 1:1 atomic conversions between $M and any M0 Extension, including mUSD. It ensures value preservation across the M0 ecosystem and serves as the exclusive gateway for wrapping and unwrapping operations.
Because all Extensions wrap $M, the SwapFacility also enables Extension-to-Extension swaps without the need for separate AMM pools. For example, a user could technically convert mUSD to USDai through atomic process (e.g mUSD ⇄ $M ⇄ USDai), maintaining full parity throughout. However, this feature is disabled by default and requires explicit permission from both Extension contracts to be activated. The ability to use SwapFacility is currently not enabled within mUSD.
This design concentrates liquidity, simplifying liquidity provisioning and enabling composable interoperability between all M0-based stablecoins.
# Bridging
The M0 Protocol uses a Hub-and-Spoke architecture to support secure and consistent multichain deployment of the $M token and its Extensions. This model preserves Ethereum as the canonical source of truth while enabling fast and composable access to $M across Layer 2s and other chains.
Ethereum acts as hub for the native $M token. All $M minting, burning and governance operations (including collateral verification, validator attestations and yield index propagation) originate from this hub.
The HubPortal contract on Ethereum manages the core bridging logic using a lock and release mechanism. When bridging from Ethereum to a spoke chain, $M tokens are locked in the HubPortal, when bridging back, the corresponding amount is unlocked and released to the user. The HubPortal also propagates global system variables such as the $M earning index to all connected chains, ensuring consistency across the ecosystem. HubPortal additionally tracks the principal amount of $M bridged to each spoke, ensuring that no spoke can release more tokens than were originally locked on Ethereum.
Spoke chains host representations of the $M token and its Extensions, allowing users to interact with M0-based assets in fast, low-cost environments.
Spoke chains host SpokePortal contracts and operate using a mint and burn mechanism. When bridging to a spoke chain, a representation of $M is minted on the destination chain. Conversely, when bridging back to Ethereum, the representation is burned on the spoke chain before the underlying $M is released from the HubPortal. Additionally, spoke chains receive and apply updates to the $M earning index propagated from the Ethereum hub, ensuring consistent protocol logic and state across all supported networks.
This bridging system is built on top of Wormhole’s cross-chain messaging infrastructure, leveraging its Native Token Transfers (NTT) and general message passing framework to ensure security and protocol wide synchronization.
Overall, this architecture enables hub-to-spoke, spoke-to-hub and even spoke-to-spoke bridging, while maintaining full supply integrity across the M0 ecosystem.
# Oracle/Pricing
We recommend using Chainlink USD price feeds for mUSD on both Ethereum and Linea:
- Ethereum: `0xc90E3460424fb8ea79775089E9053113FEE34Ed0`
- Linea: `0xc834a55fb78dEa866E9cd86047Df0F584B9da339`
In line with Aave’s approach for stablecoins, we recommend applying a 1.04 USD price cap to guard against oracle anomalies or low-liquidity price spikes.
# LT, LTV and Liquidation Bonus
We do not recommend enabling mUSD as collateral on Aave at this time.
mUSD is a newly launched stablecoin (12 August 2025) with a relatively short track record and permissioned mint/redeem flows.
As such, we recommend listing mUSD as a borrowable asset only, without collateral usage, to avoid introducing liquidation risk.
# Specification
| **Parameter** | **Value** | **Value** |
| --- | --- | --- |
| Asset | mUSD | mUSD |
| Chain | Ethereum | Linea |
| Isolation Mode | No | No |
| Borrowable | Yes | Yes |
| Collateral Enabled | No | No |
| Supply Cap | 10,000,000 | 70,000,000 |
| Borrow Cap | 8,000,000 | 60,000,000 |
| Debt Ceiling | - | - |
| LTV | N/A | N/A |
| LT | N/A | N/A |
| Liquidation Penalty | N/A | N/A |
| Liquidation Protocol Fee | N/A | N/A |
| Variable Base | 0% | 0% |
| Variable Slope1 | 6.5% | 6.5% |
| Variable Slope2 | 60% | 60% |
| Uoptimal | 80% | 80% |
| Reserve Factor | 20% | 20% |
| Stable Borrowing | Disabled | Disabled |
| Flashloanable | Yes | Yes |
| Siloed Borrowing | No | No |
| Borrowable in Isolation | No | No |
# **Disclaimer**
Chaos Labs has not been compensated by any third party for publishing this recommendation.
# **Copyright**
Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain)
---
### Author:  [@system](https://governance.aave.com/u/system)
#### Post date: [October 19, 2025, 2:26pm UTC](https://governance.aave.com/t/arfc-add-metamask-usd-musd-to-aave-v3-core-instance-on-ethereum-and-linea/23097/4 "2025-10-19T14:26:41Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
---
### Author:  [@bgdlabs](https://governance.aave.com/u/bgdlabs)
#### Post date: [November 21, 2025, 1:55pm UTC](https://governance.aave.com/t/arfc-add-metamask-usd-musd-to-aave-v3-core-instance-on-ethereum-and-linea/23097/5 "2025-11-21T13:55:34Z")
_Given the mUSD asset is using the M0 stablecoin infrastructure under the hood, it was required for us to perform an analysis of the M0 system, before/in combination with mUSD_
# M (M0) technical analysis
# Summary
This is a technical analysis of all the smart contracts of the M asset and its main dependencies.
_Disclosure_: This is not an exhaustive security review of the asset like the ones done by [M^0 Labs](https://www.m0.org/), but an analysis from an Aave technical service provider on different aspects we consider critical to review before a new type of listing. Consequently, like with any security review, this is not an absolute statement that the asset is flawless, only that, in our opinion, we don’t see significant problems with its integration with Aave, apart from different trust points.
# Analysis
The M Token serves as a base infrastructure for creating stablecoins, known as “M extensions”. The M Token indicates the collateral composition, while the M Extensions specify the customizations made by their owners. M Extensions can either wrap M into them or unwrap it back into M. Approved minters by M Governance can request to mint M with [eligible collateral](https://docs.m0.org/home/getting-started/adopted-guidance/eligible-collateral/) (for example, U.S. T-Bills), and validators verify the existence of these collaterals backing the M token and ensure transparency for the system.
For the context of this analysis, our focus has been on the following aspects, critical for the correct and secure integration with Aave:
- A recommendation of pricing strategy to be used in the integration asset \<\> Aave.
- Any miscellaneous aspect of the code that can be considered important.
- Analysis of the access control (ownerships, admin roles) and the nature of the entities involved in the system. Regarding the table permissions’ holders and their criticality/risk, it is done following these guidelines:
| **Criticality** | **Description** |
| --- | --- |
| **CRITICAL** | Usually super-admin functionality: it can compromise the system by completely changing its fundamentals, leading to loss of funds if misused or exploited. E.g. proxy admin, default admin |
| **HIGH** | It can control several parts of the system with some risk of losing funds. E.g., general owners or admin roles involved in the flow of funds |
| **MEDIUM** | It can cause malfunction and/or minor financial losses if misused or exploited. E.g., fee setter, fee recipient addresses |
| **LOW** | It can cause system malfunctions, but on non-critical parts without meaningful/direct financial losses. E.g., updating descriptions or certain non-critical parameters. |
| **Risk** | **Description** |
| --- | --- |
| 🟢 | The role is controlled via a mechanism we consider safe, such as on-chain governance, a timelock contract, or setups involving multi-sigs under certain circumstances. |
| 🟡 | The role is controlled in a way that could expose the system and users to some risk depending on the actions it can control. |
| 🔴 | The role is controlled via a clearly non-secure method, representing risks for the system and users. |
## General points
- M0 system relies on a set of non-upgradable contracts with extensions for access control, tokenization, and security, and a minimal OZ interface for the Governor.
- The system uses a governance-based access control pattern.
## Contracts
The following is a non-exhaustive overview of the main smart contracts involved with M.
### [M](https://etherscan.io/address/0x866a2bf4e572cbcf37d5071a7a58503bfb36be1b#readContract)^0
The M contract is an ERC-20 token representing the M stablecoin. It features minting and burning via a Minter Gateway contract, and a rebasing balance for approved earners (via governance). It’s a non-upgradable contract.
| **Permission Owner** | **functions** | **Criticality** | **Risk** |
| --- | --- | --- | --- |
| [MinterGateway](https://etherscan.io/address/0xf7f9638cb444D65e5A40bF5ff98ebE4ff319F04E#readContract) | mint, burn | **HIGH** | 🟢 |
| Approved Earners on [TTGRegistrar](https://etherscan.io/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c#code) | startEarning | **HIGH** | 🟢 |
- **Access Control**
- The [MinterGateway](https://etherscan.io/address/0xf7f9638cb444D65e5A40bF5ff98ebE4ff319F04E#readContract) can issue new M tokens via the `mint(to, amount)` function, and burn M tokens via the `burn(from, amount)` function.
- Approved earners can start accruing yield by calling the `startEarning()` function. This function enables the rebasing balance feature for the caller.
### [MinterGateway](https://etherscan.io/address/0xf7f9638cb444D65e5A40bF5ff98ebE4ff319F04E#readContract)
The MinterGateway contract serves as the entry point for minters to mint and burn M Token.
After governance approval via proposals, minters can propose a mint of M tokens by having off-chain T-bills collateral held by Special Purpose Vehicles (SPVs). Validators periodically assess the collateral and provide signatures attesting to its value. The contract manages the accounting of the debt and charges interest on the minters’ debt. It’s a non-upgradable contract.
| **Permission Owner** | **functions** | **Criticality** | **Risk** |
| --- | --- | --- | --- |
| Approved Minters on [TTGRegistrar](https://etherscan.io/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c#code) | activateMinter | **HIGH** | 🟢 |
| Active Minters on [TTGRegistrar](https://etherscan.io/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c#code) | updateCollateral, proposeRetrieval, proposeMint, mintM | **HIGH** | 🟢 |
| Validators on [TTGRegistrar](https://etherscan.io/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c#code) | cancelMint, freezeMinter | **HIGH** | 🟢 |
- **Minting and Burning**
- Once a minter is registered in the TTG Registrar, anyone can call the `activateMinter(address minter)` function, which enables the minter to propose and mint M tokens.
- After being activated, the minter must set its collateral via the `updateCollateral(uint collateral, uint[] retrievalIds, address[] validators, uint256[] timestamps, bytes[] signatures)` function, and it must be signed by at least the validators threshold (_1 validator required_). Internally, it validates the `validators` addresses and their `signatures`, and imposes a penalty if the minter misses collateral updates within the minimum period (_1 day + 6 hours)_. If they fail to do so, they will be considered undercollateralized, and their collateral value will be deemed zero.
- After setting up the off-chain collateral to SPVs, the minter can propose minting M tokens by calling the `proposeMint(uint256 amount, address destination)` function. It creates a `mintId` and enforces a minimum delay (_15 minutes_) and maximum mint period (_3 hours_) for the minter to mint the m tokens via the `mintM(mintId)` function, which mints the `amount` to the `destination` address if it falls within the `98%` collateralization ratio (`mintRatio()`).
- Validators can cancel a minter’s proposal via the `cancelMint(address minter, uint mintId)` function. They can also temporarily freeze (_for 6 hours_) a minter’s ability to mint M tokens by calling the `freezeMinter(address minter)` function.
- Minters can retrieve excess collateral from their backing SPV by calling the `proposeRetrieval(amount)` function. Internally, it verifies if the minter will not be undercollateralized after retrieving the `amount`, and if not, it creates a `retrievalId`. To finalizes it, the minter must send a `updateCollateral()` with the `retrievalId` signed by the validators.
### [TTG Registrar](https://etherscan.io/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c#code)
The TTG Registrar is a singleton contract that stores the parameters that configure the M system in key-value pairs. It stores the addresses of minters, validators, and earners, as well as rate models, freeze, and collateral interval periods. The parameters can be updated by the most recent Standard or Emergency Governor through proposals. It’s a non-upgradable contract.
| **Permission Owner** | **functions** | **Criticality** | **Risk** |
| --- | --- | --- | --- |
| standardGovernor, | | | |
| emergencyGovernor (checked via their Deployer contracts) | addToList, removeFromList, setKey | **CRITICAL** | 🟢 |
- **Access Control**
- Addresses of minters, validators, and earners are enabled/disabled through the governance via the `addToList(bytes32 list, address account)` and `removeToList(bytes32 list, address account)` functions.
- Other parameters like minters and earner rate model address, minters freeze time, update collateral intervals, and collateral thresholds are configured through the governance via the `setKey(bytes32 key, bytes32 value)` function.
### Governance: [StandardGovernor](https://etherscan.io/address/0xB024aC5a7c6bC92fbACc8C3387E628a07e1Da016), [EmergencyGovernor](https://etherscan.io/address/0x886d405949F709bC3f4451491bDd07ff51Cdf90A#readContract), [ZeroGovernor](https://etherscan.io/address/0xa0DAFaEEA4A1d44534e1b9227e19CAE6358b80FE)
The governance is responsible for updating the system’s parameters in the Registrar via proposals created in the Standard Governor, Emergency Governor, and Zero Governor contracts. Holders of the PowerToken can vote in the Standard and Emergency Governor proposals and earn ZeroTokens for voting. ZeroToken holders can vote in the ZeroGovernor proposals. The Governor contracts are non-upgradable.
**Access Control**
- **Standard Governor**
| **Permission Owner** | **functions** | **Criticality** | **Risk** |
| --- | --- | --- | --- |
| [StandardGovernor](https://etherscan.io/address/0xB024aC5a7c6bC92fbACc8C3387E628a07e1Da016) (self) or [EmergencyGovernor](https://etherscan.io/address/0x886d405949F709bC3f4451491bDd07ff51Cdf90A#readContract) | setProposalFee | **HIGH** | 🟢 |
| [ZeroGovernor](https://etherscan.io/address/0xa0DAFaEEA4A1d44534e1b9227e19CAE6358b80FE) | setCashToken | **HIGH** | 🟢 |
- **Emergency Governor**
| **Permission Owner** | **functions** | **Criticality** | **Risk** |
| --- | --- | --- | --- |
| [EmergencyGovernor](https://etherscan.io/address/0x886d405949F709bC3f4451491bDd07ff51Cdf90A#readContract) (self) | setStandardProposalFee | **HIGH** | 🟢 |
| [ZeroGovernor](https://etherscan.io/address/0xa0DAFaEEA4A1d44534e1b9227e19CAE6358b80FE) | setThresholdRatio | **HIGH** | 🟢 |
- **Zero Governor**
| **Permission Owner** | **functions** | **Criticality** | **Risk** |
| --- | --- | --- | --- |
| [ZeroGovernor](https://etherscan.io/address/0xa0DAFaEEA4A1d44534e1b9227e19CAE6358b80FE) (self) | setEmergencyProposalThresholdRatio, setZeroProposalThresholdRatio, setCashToken, resetToPowerHolders, resetToZeroHolders | **HIGH** | 🟢 |
**Proposals Mechanism and lifecycle**
- **Standard Governor**
- The Standard proposals can add/remove addresses from lists and set key-value pairs in the Registrar, and set a new proposal fee.
- Proposals can be created permissionlessly via the `propose(address[] targets, uint256[] values, bytes[] callDatas, string description)` function by paying the proposalFee in the form of cashToken (currently `0.2 WETH`).
- The proposals’ system operates in 15-day epochs, with voting starting and ending at epoch + 1, giving holders and delegatees one epoch to cast their votes.
- Power Token Holders/Delegatees can participate in the governance proposals by calling the `castVote(uint proposalId, uint8 support)`.
- During the voting period, the Power token disables minting, transfers, and delegations, and it takes a snapshot of the total supply, balances, and voting powers. By participating in active proposals, Holders/Delegatees are rewarded with Power and Zero tokens.
- Proposals that has passed (_yes votes \> no votes_) can be executed at epoch + 2 via the `execute(address[] targets,uint256[] values,bytes[] callDatas,bytes32)` method.
- **Emergency and Zero Governors**
- The Emergency and Zero proposals enable the redeployment of the Standard and Emergency governance systems, utilizing the current PowerToken or ZeroToken as the new vote token. Additionally, they facilitate the setup of a new cashToken and the update of the threshold ratio for proposal acceptance within the ZeroGovernor or EmergencyGovernor.
- Proposals can be created permissionlessly via the `propose(address[] targets, uint256[] values, bytes[] callDatas, string description)` function without the proposal fee cost.
- The votes start at the same epoch and are active until the epoch + 1. They can be executed at any moment when the quorum of yes votes (`65%` of the total Supply) is reached.
- Power Token Holders/Delegatees can participate in the emergency proposals, while the Zero Token Holders/Delegatees can vote in the zero proposals by calling the `castVote(uint proposalId, uint support)` method.
- Proposals that reach the quorum can be executed via the `execute(address[] targets,uint256[] values,bytes[] callDatas,bytes32)` method.
- Whether a redeployment proposal reaches the quorum, the Zero Governor calls the respective deployer contract via the methods:
## Pricing strategy
Since U.S. Treasury bills back M Token’s reserves and it serves as a base token for creating “extensions” stablecoins on top of it, we recommend pricing the M Token with a Stable CAPO adapter using its M CL Price feed that uses the secondary market as a data source.
While the M token is not intended to be listed on Aave, it’s important to provide our recommendation due to its role as an infrastructure layer for other tokens currently under review for listing.
## Miscellaneous
- Security audits were conducted by Quantstamp, Certora, ChainSecurity, OpenZeppelin, and others. They are available in the M0 Protocol docs [here](https://docs.m0.org/get-started/resources/audits/#m0-protocol-and-ttg-smart-contracts).
- A Proof of Reserves dashboard from Chronicle Protocol, a M0 validator, can be found [here](https://chroniclelabs.org/dashboard/vao/m-by-m0).
## Conclusion
We believe that the M0 token, as an infrastructural and underlying asset for other stablecoin systems, does not pose risks for Aave.
---
### Author:  [@bgdlabs](https://governance.aave.com/u/bgdlabs)
#### Post date: [November 21, 2025, 1:58pm UTC](https://governance.aave.com/t/arfc-add-metamask-usd-musd-to-aave-v3-core-instance-on-ethereum-and-linea/23097/6 "2025-11-21T13:58:39Z")
# mUSD (Metamask) technical analysis
# Summary
This is a technical analysis of all the smart contracts of the MUSD asset and its main dependencies.
_Disclosure_: This is not an exhaustive security review of the asset like the ones done by [Metamask](https://metamask.io/price/metamask-usd) and [M^0 Labs](https://www.m0.org/), but an analysis from an Aave technical service provider on different aspects we consider critical to review before a new type of listing. Consequently, like with any security review, this is not an absolute statement that the asset is flawless, only that, in our opinion, we don’t see significant problems with its integration with Aave, apart from different trust points.
# Analysis
mUSD is the first wallet-native stablecoin by MetaMask, backed by tokenized U.S. Treasury bills using the [M0 Protocol](https://www.m0.org/) as the base infrastructure. Permissioned users can mint MUSD by swapping M0 and withdraw at any time.
For the context of this analysis, our focus has been on the following aspects, critical for the correct and secure integration with Aave:
- A recommendation of pricing strategy to be used in the integration asset \<\> Aave.
- Any miscellaneous aspect of the code that can be considered important.
- Analysis of the access control (ownerships, admin roles) and the nature of the entities involved in the system. Regarding the table permissions’ holders and their criticality/risk, it is done following these guidelines:
| **Criticality** | **Description** |
| --- | --- |
| **CRITICAL** | Usually super-admin functionality: it can compromise the system by completely changing its fundamentals, leading to loss of funds if misused or exploited. E.g. proxy admin, default admin |
| **HIGH** | It can control several parts of the system with some risk of losing funds. E.g., general owners or admin roles involved in the flow of funds |
| **MEDIUM** | It can cause malfunction and/or minor financial losses if misused or exploited. E.g., fee setter, fee recipient addresses |
| **LOW** | It can cause system malfunctions but on non-critical parts without meaningful/direct financial losses. E.g., updating descriptions or certain non-critical parameters. |
| **Risk** | **Description** |
| --- | --- |
| 🟢 | The role is controlled via a mechanism we consider safe, such as on-chain governance, a timelock contract, or setups involving multi-sigs under certain circumstances. |
| 🟡 | The role is controlled in a way that could expose the system and users to some risk depending on the actions it can control. |
| 🔴 | The role is controlled via a clearly non-secure method, representing risks for the system and users. |
## General points
- mUSD can be considered a “M Token extension” because it’s built on top of M0 infrastructure, with the token M backing it.
- mUSD system relies on three contracts with most dependencies from OZ for access control, tokenization, upgradability, and security. It uses the OZ Transparent Proxy pattern and UUPS Proxy for the bridge system.
- The system uses the role-based access control pattern.
- The system’s upgradable admin mUSD is a [3-day Timelock](https://etherscan.io/address/0x7701F4fA4592f59A6Cd0E3aC1c182B3c3173c280#readContract).
## Contracts
The following is a non-exhaustive overview of the main smart contracts involved with mUSD.
### [mUSD](https://etherscan.io/address/0xaca92e438df0b2401ff60da7e4337b687a2435da)
The mUSD contract serves as the primary contract for the mUSD system. It is an upgradable OZ ERC20 token that features role-based access control, allowing for pausability, freezing accounts, seizing frozen tokens, and a yield manager that sets the recipient address to receive the underlying yield generated by the m0 token. It utilizes an external swap facility contract that manages the minting and burning of mUSD by permissioned addresses.
| **Permission Owner (Ethereum)** | **Permission Owner (Linea)** | **functions** | **Criticality** | **Risk (Ethereum)** | **Risk (Linea)** |
| --- | --- | --- | --- | --- | --- |
| **upgradable admin** : [proxyAdmin](https://etherscan.io/address/0x685E7F8C9414bfa716b254b349153e2317929ac9) → [3-day Timelock](https://etherscan.io/address/0x7701F4fA4592f59A6Cd0E3aC1c182B3c3173c280#readContract) | **upgradable admin** : [proxyAdmin](https://lineascan.build/address/0x685E7F8C9414bfa716b254b349153e2317929ac9#code) → [3-day Timelock](https://lineascan.build/address/0x7701F4fA4592f59A6Cd0E3aC1c182B3c3173c280#readContract) | upgrade, upgradeAndCall | **CRITICAL** | 🟢 | 🟢 |
| `DEFAULT_ADMIN_ROLE`: [3-day Timelock](https://etherscan.io/address/0xE37C9Fc2Da25fAa8A8D591b1166317c042eEf093#readContract) | `DEFAULT_ADMIN_ROLE`: [3-day Timelock](https://lineascan.build/address/0xe37c9fc2da25faa8a8d591b1166317c042eef093#readContract) | grantRole, revokeRole | **HIGH** | 🟢 | 🟢 |
| Minter/Burner: [SwapFacility](https://etherscan.io/address/0xb6807116b3b1b321a390594e31ecd6e0076f6278#readProxyContract) | Minter/Burner: [SwapFacility](https://lineascan.build/address/0xB6807116b3B1B321a390594e31ECD6e0076f6278) | wrap, unwrap | **HIGH** | 🟢 | 🟢 |
| `FREEZE_MANAGER_ROLE`: [EOA](https://etherscan.io/address/0x251d2711ebeB0a09fdB8992F5506f3D949175246)\* | `FREEZE_MANAGER_ROLE`: [EOA](https://lineascan.build/address/0x251d2711ebeB0a09fdB8992F5506f3D949175246#code)\* | freeze, freezeAccounts, unfreeze, unfreezeAccounts | **HIGH** | 🟢 | 🟢 |
| `FORCED_TRANSFER_MANAGER_ROLE`: [EOA](https://etherscan.io/address/0x251d2711ebeB0a09fdB8992F5506f3D949175246)\* | `FORCED_TRANSFER_MANAGER_ROLE`: [EOA](https://lineascan.build/address/0x251d2711ebeB0a09fdB8992F5506f3D949175246#code)\* | forceTransfer, forceTransfers | **HIGH** | 🟢 | 🟢 |
| `YIELD_RECIPIENT_MANAGER_ROLE`: [Safe 3-of-7](https://etherscan.io/address/0xB0E4e7e869d2D338eBCB19B6919E8A9DCb3b4E6c#readProxyContract) | `YIELD_RECIPIENT_MANAGER_ROLE`: [Safe 3-of-7](https://lineascan.build/address/0xB0E4e7e869d2D338eBCB19B6919E8A9DCb3b4E6c#code) | setYieldRecipient | **MEDIUM** | 🟢 | 🟢 |
| `PAUSER_ROLE`: [Safe 3-of-5](https://etherscan.io/address/0x21739aa3Fead674F31928a806d640689Fc34C8f3#readProxyContract), [EOA](https://etherscan.io/address/0xF2f1ACbe0BA726fEE8d75f3E32900526874740BB)\* | `PAUSER_ROLE`: [Safe 3-of-5](https://lineascan.build/address/0x21739aa3Fead674F31928a806d640689Fc34C8f3#readProxyContract), [EOA](https://lineascan.build/address/0xF2f1ACbe0BA726fEE8d75f3E32900526874740BB)\* | pause, unpause | **HIGH** | 🟢 | 🟢 |
\*_The EOAs refer to MPC wallets using [Fireblocks](https://fireblocks.com/) infrastructure to secure private keys._
- **Access Control**
- **Deposits and Withdrawals**
### [SwapFacility](https://etherscan.io/address/0xb6807116b3b1b321a390594e31ecd6e0076f6278#readProxyContract)
The SwapFacility contract is the main contract that manages the minting and burning of mUSD by wrapping the M token. It also supports swaps between other “m-token extensions” at a 1:1 ratio. The contract utilizes OZ granular access control to enable M extensions and authorized addresses to access the swap feature. Additionally, it includes a [registrar contract](https://etherscan.io/address/0x119FbeeDD4F4f4298Fb59B720d5654442b81ae2c#readContract) (_covered in the M0 analysis_) to verify extension yield earnings. It is an upgradable OZ Transparent Proxy.
| **Permission Owner (mainnet)** | **Permission Owner (Linea)** | **functions** | **Criticality** | **Risk (Ethereum)** | **Risk (Linea)** |
| --- | --- | --- | --- | --- | --- |
| upgradable admin: [Proxy Admin](https://etherscan.io/address/0x0f38D8A5583f9316084E9c40737244870c565924#code) → [3-day Timelock](https://etherscan.io/address/0x23CA665c8a73292Fc7AC2cC4493d2cE883BBA468#readContract) | upgradable admin: [Proxy Admin](https://lineascan.build/address/0x0f38D8A5583f9316084E9c40737244870c565924) → [3-day Timelock](https://lineascan.build/address/0xa7BDf17aF97D06d674D03086e90A18C2D90732b6#readContract) | upgrade, upgradeAndCall | **CRITICAL** | 🟢 | 🟢 |
| `DEFAULT_ADMIN`: [Safe 2-of-3](https://etherscan.io/address/0xdcf79C332cB3Fe9d39A830a5f8de7cE6b1BD6fD1#readProxyContract) | `DEFAULT_ADMIN`: [Safe 2-of-3](https://lineascan.build/address/0xdcf79C332cB3Fe9d39A830a5f8de7cE6b1BD6fD1#readProxyContract) | setPermissionedExtension,setPermissionedMSwapper, setTrustedRouter | **HIGH** | 🟢 | 🟢 |
| Swappers: [EOA](https://etherscan.io/address/0xdfd3723a63c889f512cf6e460d79fcfe50ad6cdb)_, [EOA](https://etherscan.io/address/0xcd1394d24e1e404f9eb3609f872b0736becb9d74)_, [EOA](https://etherscan.io/address/0x98f2b37a1f5e6db22c4eba7de0398fb9be2af03f)\*, [Hub Portal](https://etherscan.io/address/0x36f586a30502ae3afb555b8aa4dcc05d233c2ece), [HyperLane Bridge](https://etherscan.io/address/0x51dce104e5ba88fabc19a2c519f955bb834b0dc3) | Swappers: [Spoke Portal](https://lineascan.build/address/0x36f586a30502ae3afb555b8aa4dcc05d233c2ece#code) | swapInM, swapOutM, swap | **HIGH** | 🟢 | 🟢 |
\*_The EOAs refer to MPC wallets using [Fireblocks](https://fireblocks.com/) infrastructure to secure private keys._
- **Access Control**
- The `DEFAULT_ADMIN` can add or remove tokens that can mint mUSD via the `setPermissionedExtension(address token, bool allowed)` function. It’s important to note that, at present, no other M-extensions are enabled within the contract except for the mUSD.
- The `DEFAULT_ADMIN` can add or remove minters of enabled tokens through the `setPermissionedMSwapper(address token, address minter, bool allowed)` function.
- **Deposit, Withdrawals, Swaps**
- Swappers can mint mUSD by depositing M Token using the `swapInM(address extension, uint256 amount, address recipient)` function, where the extension address is the mUSD token. Internally, this calls the `mUSD.wrap(address, amount)`, which deposits the M token into the mUSD contract and mints the corresponding `amount` to the swapper.
- Swappers withdraw M Token using the `swapOutM(address extension, uint256 amount, address recipient)` function, where the extension address is the mUSD token. Internally, this calls the `mUSD.unwrap(address, amount)`, which burns the mUSD and transfers the the corresponding `amount` in M tokens to the swapper.
### Bridges (Hub Portal - Spoke Portal)
The Hub Portal and Spoke Portal smart contracts enable cross-chain functionality between Ethereum (Hub) and destination chains (Spokes). They are responsible for bridging the M token and M-Extensions, as well as sending M system information, such as the yield index and governance parameters, between Ethereum and connected Spoke chains. The Hub and Spoke Portal contracts are upgradable UUPS Proxies.
**[HubPortal](https://etherscan.io/address/0x36f586a30502ae3afb555b8aa4dcc05d233c2ece) (Ethereum)**
| **Permission Owner** | **functions** | **Criticality** | **Risk** |
| --- | --- | --- | --- |
| upgradable admin: [3-day Timelock](https://etherscan.io/address/0x23CA665c8a73292Fc7AC2cC4493d2cE883BBA468#readContract) | migrate | **CRITICAL** | 🟢 |
| owner: [3-day Timelock](https://etherscan.io/address/0x23CA665c8a73292Fc7AC2cC4493d2cE883BBA468#readContract) | setBridge, setDestinationMToken, setSupportedBridgingPath, setPayloadGasLimit, transferPauserRole | **HIGH** | 🟢 |
| owner([3-day Timelock](https://etherscan.io/address/0x23CA665c8a73292Fc7AC2cC4493d2cE883BBA468#readContract)) or pauser([EOA](https://etherscan.io/address/0xF2f1ACbe0BA726fEE8d75f3E32900526874740BB)) | pause, unpause | **HIGH** | 🟢 |
**[SpokePortal](https://lineascan.build/address/0x36f586a30502ae3afb555b8aa4dcc05d233c2ece#writeProxyContract) (Linea)**
| **Permission Owner** | **functions** | **Criticality** | **Risk** |
| --- | --- | --- | --- |
| upgradable admin: [3-day Timelock](https://lineascan.build/address/0xa7BDf17aF97D06d674D03086e90A18C2D90732b6#readContract) | migrate | **CRITICAL** | 🟢 |
| owner: [3-day Timelock](https://lineascan.build/address/0xa7BDf17aF97D06d674D03086e90A18C2D90732b6#readContract) | setBridge, setDestinationMToken, setSupportedBridgingPath, setPayloadGasLimit, transferPauserRole | **HIGH** | 🟢 |
| owner([3-day Timelock](https://lineascan.build/address/0xa7BDf17aF97D06d674D03086e90A18C2D90732b6#readContract)) or pauser([EOA](https://lineascan.build/address/0xF2f1ACbe0BA726fEE8d75f3E32900526874740BB)) | pause, unpause | **HIGH** | 🟢 |
- **Access Control**
- The owner can configure cross-chain parameters such as the M token on the destination chain, the paths between M/M-Extensions → M/M-Extensions and the payload gas limit via the `setDestinationMToken(uint dstChainId, address mToken)`, `setSupportedBridgingPath(address srcToken, uint dstChainId, address dstToken, bool enabled)`, and `setPayloadGasLimit(uint dstChainId, payloadType, uint gasLimit)`.
- The owner can set the pauser via the `transferPauser(address pauser)` method. Cross-chain transfers can be paused and unpaused via the `pause()` and `unpause()` functions.
- **Bridge mechanism**
- Users can cross-chain their mUSD by calling the `transferMLikeToken(uint amount, srcToken, uint dstChainId, address dstToken, address recipient, address refundAddr)` function, either through the Hub Portal if moving from _ **L1 → L2** _ or the Spoke Portal if transferring from _ **L2 → L1** _. It verifies that the path `srcToken` → `dstChainId` → `dstToken` is enabled, creates the message payload, and invokes the [HyperLane Bridge](https://etherscan.io/address/0x51dce104e5ba88fabc19a2c519f955bb834b0dc3) contract, which forwards the cross-chain message via the [Mailbox](https://etherscan.io/address/0xc005dc82818d67AF737725bD4bf75435d065D239). On the destination chain, the [HyperLaneBridge](https://lineascan.build/address/0x51DcE104E5ba88fabC19A2C519f955bb834b0DC3#code) contract receives the message through the Mailbox and calls the `receiveMessage(uint srcChainId, bytes payload)` function in the Hub or Spoke Pool contract. It then decodes the message and either unlocks (on Ethereum) or mints (on Linea) the M token, wrapping it in the mUSD token and transferring to the user.
## Pricing strategy
Although mUSD can be classified as an M extension, its risks are isolated from other M Extensions and M0 itself, as it can be redeemed directly into U.S. Treasury bills in the event of an M0 exploit. The final mUSD price will be defined at the AIP stage after discussions with risk providers, but given the isolated risk mentioned, we believe it should lean towards the secondary market using a Stable CAPO adapter and the mUSD CL Price Feed.
## Miscellaneous
- The security audits can be found in the M0 Protocol docs (M-Extensions) [here](https://docs.m0.org/get-started/resources/audits/#evm-m-extensions).
- We recommended that the Metamask team introduce a timelock to the upgrade admin roles of the Proxy contracts as an additional safeguard against instant upgrades, ensuring we have time to respond should any upgrade prove malicious or incorrect. The same approach was applied to other admin roles that do not require time-sensitive execution.
## Conclusion
We think mUSD doesn’t have any problem in terms of integration with Aave, and there is no major technical blocker for listing.
The MetaMask and M0 teams implemented access control changes proactively, aligning with our recommendations, which helped ensure a high security standard ahead of their listing on Aave.