[ARFC] Deploy Aave Protocol v3.7 on Monad

[LlamaRisk]

Introduction

This analysis covers the proposed assets for the initial listing on Monad, specifically cross-chain assets already listed on Aave instances. This review provides an overview of key aspects, including chain-specific characteristics, bridging infrastructure, contract implementations, access control, liquidity, and other risk-related factors.

Comparative table

Asset	Issuance	Bridge / DVN setup	Rate Limits	Token Upgradeable	Critical Control	Timelock	Key Flag
USDT0	Bridged (lock-and-mint vs ETH)	LayerZero OFT, 3 DVNs (USDT0, LZ Labs, Canary)	None	Proxy admin renounced	Safe 3/5 (owner, both sides)	No	No bridge rate limits
USDC	Native Mint & bridgeable via CCTP	CCTP (burn/mint); bridge contracts EOA-owned	10M per message(burn cap)	Yes (FiatTokenProxy via EOA)	Owner, pauser, master minter, local minter, blacklister	No	Critical roles on EOAs, upgrade path EOA-owned
mUSD	Bridged (Wormhole NTT infra, hub-and-spoke)	SpokePortal → HyperlaneBridgeAdapter	None	Yes, ProxyAdmin → TimelockController 2	Timelock 1 → 3/5 Safe (admin, upgrades); freeze/forced-transfer roles on EOAs	Yes 72h, (admin + upgrades)	Seizure roles on EOAs, outside timelocks
AUSD	Bridged (LZ OFT mint/burn)	LayerZero OFT, 5 DVNs (DT, Horizen, Frax, Canary, Nethermind)	5M / 4h both directions	Yes, ProxyAdmin → EOA	All roles (admin, minter, burner, freezer, upgrade) on EOAs	No	Entire stack EOA-controlled incl. upgrades
WETH	Bridged (Wormhole MultiTokenNTT, hub-and-spoke)	Wormhole NTT, 2/2 transceiver threshold	None (limits set to 0, uncapped)	Non-upgradeable (ERC1967 proxy with empty admin slot; no upgrade function exposed)	Wormhole Governance contract	N/A	No rate limits; immutable token is a plus
cbBTC	Bridged (CCIP burn/mint, locked on Base)	Chainlink CCIP, OCR DON + RMN	25 in / 27.5 out per 24h	Yes, ProxyAdmin → RBACTimelock	RBACTimelock throughout (token, pool, router, ramps)	3h	Different impl. than Base/Core listings (Chainlink ERC20, not FiatToken)
wstETH	Bridged (CCIP lock/release ↔ burn/mint)	Chainlink CCIP	~2,200 in / 2,000 out per 24h	Yes, ProxyAdmin → RBACTimelock	RBACTimelock throughout	3h	Minimal liquidity
weETH	Bridged (LZ OFT, locked on mainnet)	LayerZero OFT, 4 DVNs (LZ Labs, Canary, Nethermind, Horizen)	Peer-specific limits	Yes, ProxyAdmin → EtherFiTimelock	EtherFiTimelock; mainnet adapter behind 4/8 Safe	3d	Minimal liquidity
syrupUSDC	Bridged (CCIP lock/release ↔ burn/mint)	Chainlink CCIP (same infra as wstETH)	~9.48M in / 8.62M out per 24h	Non-upgradeable	GovernorTimelock (token), RBACTimelock (CCIP)	24h	No supply, no liquidity
USDe / sUSDe	Bridged (LZ OFT mint/burn)	LayerZero OFT, 4 DVNs (Horizen, LayerZero Labs, Canary, and Nethermind)	Peer-specific limits	Non-upgradeable	Ethena 5/10 Multisig	No	No supply, no liquidity

Assets

USDT0

USDT0 is a cross-chain version of Tether’s standard USDT stablecoin, deployed as an OpenZeppelin TransparentUpgradeableProxy contract that uses the TetherTokenOFTExtension. The implementation contract extends the TetherTokenV2 contract, adding cross-chain functionality. To mint and burn bridged USDT0, the OFT contract uses LayerZero to send and receive cross-chain messages.

The asset is bridged via a lock-and-mint model, in which the underlying USDT is backed by locked supply on the Ethereum network. At the time of writing, 87M USDT0 has been bridged to Monad, with bridging enabled from all OFT-enabled chains.

The asset is already listed on other Aave instances, following the exact implementation on other chains, such as Plasma and Mantle. The implementation does not introduce any additional risks relative to the asset’s existing listings on Aave.

Bridge Configuration

USDT0 on Monad uses only the native bridge 3 DVNs setup, which consists of USDT0, LayerZero Labs, and Canary (as opposed to a dual design that includes the legacy mesh bridge). USDT0 doesn’t implement any rate limits for bridge transfers.

Access Control

While deployed behind a TransparentUpgradeableProxy, the contract’s proxy admin has been set to a 0x000 address, indicating that admin privileges have been renounced. The zero address cannot call the upgradeTo function nor reassign the proxy admin.

The owner of the oftContract and USDT0 contract on Monad is set to a 3/5 Multisig via OpenZeppelin Ownable.

Sensitive functions exposed by the contracts include:

• setOFTContract: Sets the address that can mint/burn cross-chain in TetherTokenOFTExtension. Owner only.
• updateNameAndSymbol: Changes token name and symbol in TetherTokenOFTExtension. Owner only.
• crosschainMint/Burn: OFT Contract Only.
• transferOwnership: Transfers ownership to a new address. Owner access only.
• renounceOwnershipRenounces ownership, leaving the contract without an owner. Owner access only.

Upgradable	Access Control	Minter and Burner	Locked funds on mainnet	Upgradable Locked funds	Locked funds access Control
Proxy admin Renounced	ownable: Safe 3/5	OFT Contract	OFTAdapterUpgradable	Proxy Admin → Safe 3/5	Ownable: Safe 3/5

Liquidity

USDT0 liquidity on Monad is currently concentrated in a Curve 3pool, with the top 5 pools representing a total TVL of less than $5M.

DEX	Pool	TVL
Curve	AUSD/USDC/USDT0	$3.2M
LFJ V2.2	AUSD / USDT0	$115.23K
LFJ V2.2	USDT0 / USDC	$146.84K
Uniswap	WBTC / USDT0	$30.83K
Uniswap	AUSD / USDT0	$18.4K

Price Feed Recommendation

For USDT0 pricing, we recommend using the USDT/USD Chainlink price feed with the CAPO stable adapter, consistent with other USDT0 onboardings such as Plasma.

CAPO Configuration

The stable cap adapter is recommended to bound the upward price deviation at 4% ($1.04). This is in line with stablecoins on other markets.

USDC

Circle’s USDC on Monad is deployed as an upgradable ERC20 FiatTokenProxy contract that uses the FiatTokenV2_2 implementation contract. Version 2.2 inherits from FiatTokenV2_1, FiatTokenV2, and FiatTokenV1. USDC is natively minted on Monad, with Circle Mint enabling minting and bridging via CCTP on Monad. Redemptions through Circle Mint are accessible only to qualified persons/businesses. The token’s design is consistent with other chains where USDC is listed on Aave.

At the time of writing, ~228M USDC has been minted on Monad. The implementation does not introduce any additional risks compared to the asset’s existing listings on Aave.

Bridge Configuration

USDC is bridgeable to and from Monad via CCTP. The bridge contractTokenMessengerV2is deployed behind AdminUpgradableProxy. TokenMessengerV2 utilizes a burn and mint mechanism.

Access Control

The contract uses an ownable pattern, which allows the owner to set the master minter, pauser, blacklister, and rescuer addresses. The FiatTokenV2_2 itself declares no new roles, inheriting them from the Ownable, Pausable, and Blacklistable contracts and the FiatTokenV1 contract.

USDC exposes the following roles and sensitive functions:

• Owner: The only role that can assign and reassign other admin roles. Inherited from Ownable. Set to EOA __(__26e0).
  • Can call updateRole and transferOwnership of the owner role.
• Pauser: Contract pausing role, inherited from Pausable. Set to EOA (e8Ea).
  • Can pause / unpause transfers and approvals.
• MasterMinter: Controls the minter registry and allowances, inherited from the FiatTokenV1.
  • Can call configureMinter to add/update minters and removeMinter.
• Minters: Minter-assigned addresses inherited from FiatTokenV1. Current minters include TokenMinterV2, EOA (4826), EOA (597a), EOA (0A8e), EOA (A794), EOA (04A7), and EOA (677c).
  • Can call mint up to the addresses’ minting allowance and burn against their own balance.
• Blacklister: Address that can black list accounts from receiving/transferring USDC. Inherited from. Set to EOA (D6cd).

MasterMinter roles:

• Owner: Authority to trigger configurations of controllers and allowances. Assigned to EOA (a0E6).
• Controllers: Per-minter allowance managers.
• The MasterMinter contract is owned by EOA __(__a0E6)

The bridge contract exposes the following roles (TokenMessengerV2):

• Rescuer: Can retrieve sent USDC. Assigned to EOA (91a1).
• Denylister: Blocks bridge entry per address. Assigned to EOA (5b66).
• FeeRecipient: Receives fees. Assigned to EOA (6379).
• MinFeeController: Adjusts the min fee. Assigned to EOA (9AE2).
• LocalMinter: The bridge’s mint authority is assigned to TokenMinterV2.
• Owner: can call upgradeTo, addRemoteTokenMessenger, removeRemoteTokenMessenger, setLocalMinter, setFeeRecipient. Assigned to EOA (4a47).

TokenMinter roles:

• TokenController: owner equivalent that can callsetMaxBurnAmountPerMessage, addLocalTokenMessenger, and pause/unpause the contract. Assigned to EOA (e69C).
• Pauser: Independent pause from TokenMessengerV2. Assigned to EOA (1fBb).
• LocalTokenMessenger: authorized to call mint/burn on TokenMinter. Assigned to TokenMessengerV2.

A per-transaction burn cap is applied with maxBurnAmountPerMessage on TokenMinterV2. This sets the maximum a single burn operation can process - currently set to 10M USDC.

Upgradable	Access Control	Minter and Burner	Locked funds on mainnet	Upgradable Locked funds	Locked funds access Control
EOA (c619)	owner: EOA (26e0)	native bridge:TokenMessengerV2 whitelister: MasterMinter	-	-	-

Liquidity

DEX	Pool	TVL
Uniswap	AUSD / USDC	$3.88M
Curve	AUSD/USDC/USDT0	$3.2M
LFJ V2.2	AUSD / USDC	$2.43M
Uniswap V4	WMON / USDC	$2.15M
Uniswap V3	WMON/USDC	$1.3M
Uniswap	USDC / WETH	$1.24M

Price Feed Recommendation

For USDC pricing, we recommend using the USDC/USD Chainlink price feed with the CAPO stable adapter, consistent with other USDC onboardings such as Mantle.

CAPO Configuration

The stable cap adapter is recommended to bound the upward price deviation at 4% ($1.04). This is in line with stablecoins on other markets.

USDe & sUSDe

USDe and sUSDe on Monad are deployed as non-upgradeable OFT contracts and use the standard OFT ERC20 token implementation. Both contracts have no proxy pattern and no upgrade functions exposed. StakedUSDeOFT extends USDeOFT , adding a blacklist mechanism on top of the inherited OFT and rate limit logic. The token and OApp are the same contract for both assets. This implementation is similar to that of other instances, such as Plasma. At the time of writing, neither asset had a circulating supply on Monad.

Bridge Configuration

Both assets bridge via LayerZero OFT. The OApp configuration uses a 4/0 DVN setup with required DVNs including: Horizen, LayerZero Labs, Canary, and Nethermind.

Access Control

USDeOFT and StakedUSDeOFT share the same role structure inherited from OFTOwnable2Step:

• OWNER: Controls all sensitive functions, including setPeer, setDelegate, setRateLimiter, setRateLimits, and setBlackLister (sUSDe only). Two-step ownership transfer pattern. Assigned to 5/10 Safe.
• RATE_LIMITER: Can call setRateLimits to adjust per chain outbound caps. Owner-controlled

StakedUSDeOFT adds:

• BLACKLISTER: Can call updateBlackList to blacklist/unblacklist addresses. Blacklisted recipients on inbound transfers have funds redirected to the owner. Owner-controlled.

Upgradable	Access Control	Minter and Burner	Locked funds on mainnet	Upgradable Locked funds	Locked funds access Control
-	owner: 5/10 Safe	StakedUSDeOFT & USDeOFT	USDeOFTAdapter & StakedUSDeOFTAdapter	-	owner: Ethena 5/10 Safe

Liquidity

Uniswap USDe/USDT and sUSDe/USDe pools are planned to be introduced. Onboarding for this asset should be contingent on the necessary liquidity being deployed to these pools.

Price Feed Recommendation

For USDe, we recommend pricing USDe using the Chainlink USDT/USD feed, covered via a stable cap adapter.

For sUSDe, we recommend using the Chainlink sUSDe/USDe exchange rate with a CAPO adapter, and using the USDe CAPO stable adapter as the base price.

These implementations are consistent with the approach adopted across all Aave instances for USDe-denominated assets.

CAPO Configuration

The stable cap adapter is recommended to bound the upward price deviation at 4% ($1.04). This is in line with stablecoins on other markets.

sUSDe’s yield has been compressing recently, operating within a 2-10% band since June 2025. We recommend setting Snapshot Delay at 7 days, providing sufficient smoothing against short-term volatility, with maxYearlyGrowthRatio at 11.17%.

Source: sUSDe Historical APY, Dune, June 24, 2026

maxYearlyRatioGrowthPercent	MINIMUM_SNAPSHOT_DELAY
11.17%	7 days

mUSD

mUSD is MetaMask’s USD stablecoin, deployed as an OpenZeppelin TransparentUpgradeableProxy contract that uses the MUSD implementation contract. The token is bridged using a hub and spoke, with the implementation contract inheriting from the base MExtension contract, which wraps and unwraps the underlying $M tokens backing mUSD (via the SwapFacility contract). The implementation contract adds governance and compliance features, such as pausing, role-based access control, and the ability to seize tokens from frozen accounts.

The asset is already listed on Aave’s Core and Linea markets, using the same MUSD implementation contract. At the time of writing, ~503K mUSD are currently circulating on Monad.

Bridge Configuration

mUSD on Monad uses M0’s native hub and spoke bridging architecture, leveraging Wormhole’s cross-chain messaging infrastructure, Native Token Transfers (NTT). Ethereum acts as the hub, with $M being bridged via a lock/release mechanism. Monad as the spoke chain operates $M minting and burning via a SpokePortal contract, which is then wrapped to originate mUSD. Cross-spoke transfers are gated behind a crossSpokeTokenTransferEnabled parameter, while hub-spoke bypasses this check.

There are no rate-limiting parameters in the Portal base contract. No inbound or outbound transfer limits are defined or enforced, and transfer volume is bounded only by the crossSpokeTokenTransferEnabled flag and supported bridging path configuration. Message delivery is handled by the bridge adapter - HyperlaneBridgeAdapter.

Access Control

mUSD employs OpenZeppelin’s role-based access control framework to manage sensitive functions, with the Monad setup mirroring the existing Ethereum and Linea setups.

The mUSD contract exposes the following roles:

• DEFAULT_ADMIN_ROLE: can grant and revoke all other roles (superadmin). Assigned to TimelockController 1.
  • TimelockController is assigned the TL DEFAULT_ADMIN_ROLE
  • 3/5 Multisig (3b04) is assigned the TL CANCELLER_ROLE, EXECUTOR_ROLE, and PROPOSER_ROLE
• PAUSER_ROLE: Pauses/unpauses all wraps, unwraps, and mUSD transfers. Assigned to 2/3 Multisig (c8f3) and M0: Deployer.
• FREEZE_MANAGER_ROLE: Freeze/unfreeze accounts. Assigned to EOA (A464) and EOA (5246).
• FORCED_TRANSFER_MANAGER_ROLE: Seizes tokens from frozen accounts. Assigned to EOA (5246).
• YIELD_RECEIPT_MANAGER_ROLE: Can trigger yield claims and set the recipient address. Assigned to 3/7 Multisig (4E6c) and EOA (5fbf)

The SpokePortal is deployed as an ERC1967 proxy, with the contract following a UUPS upgrade pattern. Upgrades are executed via upgradeToAndCall. Three roles are defined:

• DEFAULT_ADMIN_ROLE: Can grant/revoke roles, and call upgrades. Assigned to a 3/5 Safe.
• PAUSER: Can pause the portal’s inbound and outbound transfers of $M token transfers. Assigned to EOA (40BB).
• OPERATOR_ROLE: Controls bridge configuration. Can call enableCrossSpokeTokenTransfer to open $M flows between spoke chains. Assigned to EOA (40BB).

The SwapFacility contract, which is critical for the underlying $M backing, exposes the following roles and sensitive functions:

• DEFAULT_ADMIN_ROLE: sets Extensions and M Swapper contracts. Assigned to 3/5 Multisig (9d19).
• PAUSER_ROLE: Can pause/unpause swap paths. Assigned to M0: Deployer.
• M_SWAPPER_ROLE: wraps M into any extension (non-rebasing ERC20) or unwraps back to M. Assigned to SpokePortal.

Upgradable	Access Control	Minter and Burner	Locked funds on mainnet	Upgradable Locked funds	Locked funds access Control
ProxyAdmin → TimelockController 2	TimelockController 1 → 3/5 Multisig (3b04)	__SpokePortal __→ HyperlaneBridgeAdapter	HubPortal	Timelock	owner: Timelock

Timelocks employ a 3-day minimum delay.

Liquidity

DEX	Pool	TVL
Uniswap	mUSD / USDC	$1.5K

Price Feed Recommendation

We recommend using a fixed feed for mUSD pegged at $1.

AUSD

Agora USD on Monad is issued behind AgoraDollarErc1967Proxy, an upgradeable proxy contract that uses the OpenZeppelin transparent proxy pattern. The implementation contract references the AgoraDollar contract, which inherits from the AgoraDollarCore contract functionalities. AUSD is bridged using LayerZero’s OFT Adapter and supports ERC3009 for gasless token transfers and ERC2612 for approvals via signatures.

The asset is already listed on Aave’s Avalanche instance, but it is the natively issued implementation. The bridging mechanism adheres to LayerZero’s OFT standards. The implementation and bridging architecture does not introduce any additional risks. At the time of writing, 32.8M AUSD is currently circulating on Monad.

Bridge Configuration

The AgoraMintBurnOFTAdapter contract uses the OFT standard to bridge AUSD, using a burn and mint mechanism. Its functionality includes standard cross-chain messaging and rate-limit capabilities. The OApp configuration uses a 5/0 DVN setup comprising Deutsche Telekom, Horizen, Frax, Canary, and Nethermind.

AUSD implements rate limits for bridge transfers. The current rate limit is set to 5 M AUSD for both inbound and outbound within a 4-hour window.

Access Control

AUSD uses a 2-layered role-based access control system that delegates role management. The Monad roles consist of the access control manager, pauser, and rate limit manager. These roles enable holders to:

• ACCESS_CONTROL_MANAGER: can grant and revoke every other role and controls contract upgrade logic functions, which include access to setIsTransferUpgraded, setIsTransferFromUpgraded, setIsTransferWithAuthorizationUpgraded, and setIsReceiveWithAuthorizationUpgraded. Assigned to EOA (30e2)
• PAUSER: can pause/unpause the token operations. Assigned to EOA (2a25)
• MINTER: can mint AUSD. Assigned to EOA (d7ff)
• BURNER: Can unilateral burn tokens. Assigned to EOA (dC1D)
• RATE_LIMIT_MANAGER: controls the mintable limits on Monad. Assigned to EOA (d6dc)
• FREEZER: can freeze accounts, blocking any transfers. Assigned to EOA (4681)
• BRIDGE_MINTER: Bridge permitted to mint on the Monad. Assigned to AgoraMintBurnOFTAdapter.
• BRIDGE_BURNER_ROLE: Bridge permitted to burn tokens on Monad. Assigned to AgoraMintBurnOFTAdapter.

The OFT adapter follows the same access-control pattern, with roles including: access-control manager, pauser, and rate-limiter manager.

• ACCESS_CONTROL_MANAGER: Grants and revokes all other roles. Assigned to EOA (7570).
• PAUSER: Pauses all inbound and outbound bridging activity EOA (6498).
• RATE_LIMIT_MANAGER: Set max allowance per time window for inbound/outbound transfers. Assigned to EOA (3391).
• OWNER: Ownable permission that is separate from the role system. It controls who can configure the OApp endpoint level; these addresses have access to critically sensitive functions such as setDelegate, setPeer, and can call upgradeToAndCall (via the proxy admin). Assigned to EOA (7570)

Upgradable	Access Control	Minter and Burner	Funds on source chain	Upgradable Locked funds	Locked funds access Control
__ProxyAdmin __→ EOA (2528)	Role assigned: EOA (30e2)	AgoraMintBurnOFTAdapter owned by EOA (7570)	AgoraMintBurnOFTAdapter	-	-

Liquidity

DEX	Pool	TVL
Uniswap	AUSD / USDC	$3.88M
Curve	AUSD/USDC/USDT0	$3.2M
LFJ V2.2	AUSD / USDC	$2.43M
Uniswap	WMON / AUSD	$1.5M

Price Feed Recommendation

For pricing, we recommend using Chainlink’s AUSD/USD price feed.

CAPO

The stable cap adapter is recommended to bound the upward price deviation at 4% ($1.04).

WETH

WETH is deployed behind an ERC1967 proxy; however, the proxy is effectively immutable. The contract exposes no external upgrade function, no proxy admin contract is recorded in the admin slot, and the only role present on the contract is minter. The implementation address, therefore, cannot be changed through any on-chain mechanism. The implementation itself is a Wormhole Token contract.

As with other bridged WETH instances onboarded, Wrapped ETH on Monad follows the same immutable pattern. At the time of writing, 7,759 WETH are currently circulating on Monad.

Bridge Configuration

Monad WETH uses Wormhole’s MultiTokenNTT (Native Token Transfers) mechanism, a custom multi-token manager that enables bridging multiple assets within a single contract. For WETH, the NTT uses a hub-and-spoke design that locks tokens on the source ‘hub’ chain and mints the equivalent on ‘spoke’ chains, maintaining the total supply on the hub. ETH is wrapped and locked on mainnet before being transferred to Monad via the wrapAndTransferGasToken and IWETH.withdraw functions.

Cross-chain message routing and threshold attestations are handled by a GmpManager contract, which performs transfers using NttManagerMessage payloads and dispatches them to enabled transceivers. A 2/2 transceiver threshold is required for message attestations before execution.

WETH rate limits for bridge transfers in both directions are currently set to 0, meaning there is currently no inbound or outbound rate limit set for WETH in the bridging contract.

Access Control

WETH exposes no upgradeTo, upgradeToAndCall, or any admin-controlled upgrade functions. A single privileged role is exposed in the contract, minter, which is assigned to the bridge address (MultiTokenNTT).

• MINTER: Can mint WETH to any address and transfer minter authority to any new address via setMinter.

The access control privileges exposed by the MultiTokenNTT contract include:

• OWNER: Controls all sensitive bridge functions, including upgrade, setPeer (configures trusted remote bridge addresses per chain), setOutboundLimit / setInboundLimit, overrideLocalAsset (remaps foreign token representations), and unpause. Assigned to the Wormhole Governance contract.
• PAUSER: Can call pause all transfers and minting. Only the owner can unpause the bridge after it has been paused. Assigned to the Wormhole Governance contract.

The GmpManager follows the same Owner and Pauser pattern, with its own owner controlling the setPeer function for trusted remote GmpManager addresses per chain and transceiver/threshold configuration. The owner controls the transceiver set and threshold independently. The Owner and Pauser are assigned to the Wormhole Governance contract.

Upgradable	Access Control	Minter and Burner	Locked funds on mainnet	Upgradable Locked funds	Locked funds access Control
-	-	MultiTokenNTT	ETHMultiTokenNtt	-	Ownable: Governance

Liquidity

DEX	Pool	TVL
Uniswap	WMON / WETH	$1.44M
Uniswap	USDC / WETH	$1.29M

Price Feed Recommendation

We recommend using the Chainlink ETH / USD Price Feed.

cbBTC

Coinbase BTC (cbBTC) on Monad is issued behind a TransparentUpgradeableProxy, the implementation points to BurnMintERC20PausableFreezableTransparent, which inherits from BurnMintERC20PausableTransparent.

The asset is already listed on Aave’s Base and Core instances, but doesn’t follow the same FiatToken implementation. The implementation introduces no additional risks beyond the asset’s existing listings on Aave, as it uses a standard Chainlink burn-mint ERC20 with pause and account-freeze capabilities. At the time of writing, the circulating supply on Monad is approximately ~161 cbBTC.

Bridge Configuration

cbBTC uses Chainlink’s canonical cross-chain token standard. The proxy and token pool architecture is standard Chainlink infrastructure components, consisting of four primary contracts: a Router (entry point), a OnRamp contract at source, an OffRamp receiver, and a BurnMintTokenPool for mint/burn. On the Base chain source, the pool locks tokens, while the Monad pool mints. Inbound and outbound messages are routed using registered OnRamp and OffRamp contracts. The Monad BurnMintTokenPool contract uses a burn and mint mechanism when transferring cbBTC, acting as a middle layer between the onramp and offramp messages.

Message finality on the OffRamp is enforced via Merkle root commits signed by Chainlink’s OCR DON and optionally verified by RMN (Risk Management Network). The cbBTC rate limits for bridge transfers are currently set to 25.0 cbBTC for inbound transfers and 27.5 cbBTC for outbound transfers. Caps refill continuously at 0.00031828 cbBTC per second inbound and 0.00028935 cbBTC per second outbound, up to their respective capacities.

Access Control

The token uses OpenZeppelin’s role-based access control pattern. cbBTC’s roles and associated sensitive functions are as follows:

• DEFAULT_ADMIN_ROLE: Can grant and revoke all other roles. Assigned to RBACTimelock.
• MINTER_ROLE: Can mint cbBTC on Monad. Assigned to the BurnMintTokenPool contract.
• BURNER_ROLE: Can burn cbBTC. Assigned to the BurnMintTokenPool contract.
• PAUSER_ROLE: Can pause all token transfers, mints, and burns. Assigned to RBACTimelock.
• FREEZER_ROLE: Can freeze individual accounts, blocking transfers, mints, and burns to/from the frozen address. Freeze actions take effect even when the contract is paused. Assigned to RBACTimelock.

A separateccipAdmin role allows the holder to register/deregister the token from the CCIP TokenAdminRegistry. Role has no minting or governance powers. Assigned to RBACTimelock.

The token pool contract uses an owner control system. The Monad pool is owned by RBACTimelock, allowing it to:

• applyChainUpdates / applyRampUpdates: add or remove supported chains and their associated on/off ramps.
• Rate limit configuration, including capacity and refill rates per chain direction.
• setRouter: update the local CCIP router reference.
• Manage the pool’s allowlist, if whitelisting mode is enabled.

The Router uses a single-owner model. The owner assigned to RBACTimelock has controls over:

• controls applyRampUpdates (add/remove on-ramps and off-ramps) and
• setWrappedNative. The whenHealthy modifier gates ccipSend and routeMessage on the ARM proxy not being in a cursed state.

The OnRamp/OffRamp uses a single owner control system (assigned to RBACTimelock).

• Update feeQuoter, messageInterceptor, and permissionLessExecutionThresholdSeconds(via setDynamicConfig)
• applySourceChainConfigUpdates: enable/disable source chains and update associated OnRamp addresses.
• OCR configuration (transmitter set, signer set, threshold) via setOCR3Configs.

The Timelock applies a 3-hour minimum delay.

Upgradable	Access Control	Minter and Burner	Locked funds on Source	Upgradable Locked funds	Locked funds access Control
ProxyAdmin → RBACTimelock	DEFAULT_ADMIN: RBACTimelock.	BurnMintTokenPool	LockReleaseTokenPool	-	Ownable: RBACTimelock

Liquidity

DEX	Pool	TVL
Curve	cbBTC/WBTC/LBTC	$4.1M
Uniswap	USDC / cbBTC	$1.12M
Uniswap	WBTC / cbBTC	$713.44K
Uniswap	WMON / cbBTC	$130.57K

Price Feed Recommendation

We recommend using the cbBTC / USD Chainlink price Feed.

wstETH

wstETH is issued behind a TransparentUpgradeableProxy, the implementation is BurnMintERC20Transparent, a Chainlink-native contract that inherits AccessControlDefaultAdminRulesUpgradeable and ERC20BurnableUpgradeable. The asset is already listed on other Aave instances and follows the implementation as on other instances, such as MegaETH.

Bridge Configuration

wstETH uses Chainlink’s canonical cross-chain token standard. wstETH is bridged via Chainlink CCIP using a Lock/Release pool on Ethereum and a Burn/Mint pool on Monad. As described in cbBTC, the proxy and token pool architecture uses the same Chainlink infrastructure components, and the implementation introduces no novel risk surface beyond what is inherent to CCIP.

At the time of writing, the circulating wstETH supply on Monad is 21,037. Rate limits for bridge transfers use CCIP’s token-bucket model. Inbound transfers have a capacity of ~2,200 wstETH, and outbound transfers have a capacity of ~2,000 wstETH. Each cap continuously refills at approximately 0.0255 wstETH per second inbound and 0.0231 wstETH per second outbound.

Access Control

The token uses the same role-based access control pattern as cbBTC, except for an additional mandatory time delay for DEFAULT_ADMIN_ROLE transfers, a CCIP admin privilege, and the exclusion of the freezer and pauser roles. wstETH roles and their assignments:

• DEFAULT_ADMIN_ROLE: Assigned to RBACTimelock.
• MINTER_ROLE: Assigned to the BurnMintTokenPool contract.
• BURNER_ROLE: Assigned to the BurnMintTokenPool contract.

The ccipAdmin assignment allows the holder to register/deregister the token from the CCIP TokenAdminRegistry. Role has no minting or governance powers. Assigned to RBACTimelock.

The Router owner is assigned to the RBACTimelock.

The OnRamp and Offramp use a single owner control system, with the owners assigned to RBACTimelock. The timelock employs a 3-hour delay.

Upgradable	Access Control	Minter and Burner	Locked funds on mainnet	Upgradable Locked funds	Locked funds access Control
ProxyAdmin → RBACTimelock	DEFAULT_ADMIN: RBACTimelock.	BurnMintTokenPool	SiloedLockReleaseTokenPool	-	Ownable: RBACTimelock

Liquidity

DEX	Pool	TVL
Uniswap	wstETH / WETH	$8.77K
Uniswap	WMON / wstETH	$4.6K

Price Feed Recommendation

We recommend pricing wstETH with a CAPO adapter using Chainlink’s wstETH/stETH exchange rate, with the ETH/USD price feed.

CAPO Configuration

Source: wstETH Historical APY, Dune, June 24th, 2026

Lido staking yield has fluctuated between 2% and 4% over the past year. Given the observed ceiling of 4.28% seen in February 2025, applying a 2.5x safety buffer, we recommend setting the max yearly growth to 10.7%. The 7-day snapshot is consistent with recommendations made on Plasma.

maxYearlyRatioGrowthPercent	MINIMUM_SNAPSHOT_DELAY
10.7%	7 days

weETH

weETH on Monad is deployed behind a TransparentUpgradeableProxy with an EtherfiOFTUpgradeable implementation using the standard OpenZeppelin transparent proxy pattern. The implementation contract inherits from LayerZero’s OFTUpgradeable, Solady’s EnumerableRoles, OZ’s PausableUpgradeable, and a custom PairwiseRateLimiter.

On Aave V3, weETH is available on Ethereum Core, Base, Linea, Plasma, Ink, Arbitrum, and Scroll. Following the same implementation for bridged instances. The EtherfiOFTUpgradeable functions as both the token and the OApp contract on Monad.

Bridge Configuration

weETH uses LayerZero’s native OFT standard with peer-specific rate limits on bridge transfers, with the OFT logic and token logic co-located in a single upgradeable contract. The OApp configuration on Monad uses a 4/0 DVN setup: LayerZero Labs, Canary, Nethermind, and Horizen. Canonical weETH is locked on mainnet in the EtherfiOFTAdapterUpgradeable contract and currently holds 111K weETH, representing the total global bridged supply via LayerZero. At the time of writing, ~4.8 weETH are currently circulating on Monad.

Access Control

EtherfiOFTUpgradeable role management uses EnumerableRoles, with role assignments restricted to owner(), which is the EtherFiTimelock contract. The three defined roles and the owner privilege map are as follows:

• MINTER_ROLE**:** Set to the contract logic (unassigned).
• PAUSER_ROLE: Assigned to EOA (844D).
• UNPAUSER_ROLE: Assigned to 3/7 GnosisSafeProxy.

The contract proxy admin controls upgradeToAndCall. The timelock employs a 3-day time delay.

Upgradable	Access Control	Minter and Burner	Locked funds on mainnet	Upgradable Locked funds	Locked funds access Control
ProxyAdmin → EtherFiTimelock	owner: EtherFiTimelock	EtherfiOFTUpgradeable	OFTAdapter	ProxyAdmin → EtherFiTimelock	ownable: 4/8 Multisig

Liquidity

DEX	Pool	TVL
Uniswap	weETH / WETH	$18.28K

Price Feed Recommendation

For pricing, we suggest using Chainlink’s weETH/eETH exchange price feed with Chainlink ETH / USD as the base price, and a CAPO adapter.

CAPO Configuration

Source: weETH Historical APY, Dune, June 24, 2026

Yields have fluctuated between 2% and 4%. We recommend the same LST 2.5x buffer for weETH, based on an observed ceiling of 3.81% in April 2025, and yield stemming solely from staking rewards.

maxYearlyRatioGrowthPercent	MINIMUM_SNAPSHOT_DELAY
9.53%	7 days

syrupUSDC

Monad syrupUSDC is deployed as a non-upgradeable BurnMintERC20 contract, with a flat OpenZeppelin access control. The implementation does not introduce any additional risks compared to the asset’s existing listings on Aave.

Bridge Configuration

syrupUSDC uses Chainlink’s canonical cross-chain token standard. Tokens are bridged via Chainlink CCIP using a Lock/Release pool on Ethereum and a Burn/Mint pool on Monad. syrupUSDC shares the same CCIP infrastructure as wstETH, with the only differences being the token contract and the pool layer addresses.

At the time of writing, there is effectively no circulating supply on Monad. Rate limits for bridge transfers use a token-bucket model. Inbound transfers have a capacity of ~9,482,758 syrupUSDC, and outbound transfers have a capacity of ~8,620,689 syrupUSDC. Each bucket refills continuously at 2,633.4 syrupUSDC per second inbound and 2,394.0 syrupUSDC per second outbound, up to their respective capacities.

Access control

The contract uses flat OZ access control with no proxy delegation layer. syrupUSDC roles and their assignments:

• DEFAULT_ADMIN_ROLE: Assigned to GovernorTimelock.
• MINTER_ROLE: Assigned to the BurnMintTokenPool contract.
• BURNER_ROLE: Assigned to the BurnMintTokenPool contract.

The ccipAdmin assignment allows the holder to register/deregister the token from the CCIP TokenAdminRegistry. Assigned to RBACTimelock.

The Router owner is assigned to the RBACTimelock.

The OnRamp and Offramp use a single owner control system, with the owners assigned to RBACTimelock. The Governor timelock employs a 24-hour time delay.

Upgradable	Access Control	Minter and Burner	Locked funds on mainnet	Upgradable Locked funds	Locked funds access Control
-	DEFAULT_ADMIN: GovernorTimelock.	BurnMintTokenPool	LockReleaseTokenPool	-	Ownable: RBACTimelock

wstETH, cbBTC, and syrupUSDC share the same CCIP Admin (RBACTimelock), the role has no minting or governance powers and simply adds whitelisted assets eligible to use CCIP, thus it is likely a Chainlink-controlled contract.

Liquidity

DEX	Pool	TVL
Uniswap	USDC / syrupUSDC	-

Price Feed Recommendation

We recommend using the Chainlink syrupUSDC/USDC exchange rate defined in combination with the USDC/USD feed and CAPO adapter.

CAPO Configuration

Source: syrupUSDC Historical APY, Dune, June 24, 2026

We recommend setting the Snapshot Delay to 7 days and the maxYearlyGrowthRatio to 8.05%.

maxYearlyRatioGrowthPercent	MINIMUM_SNAPSHOT_DELAY
8.05%	7 days

Conclusion

We believe this set of initial assets poses minimal risk for onboarding to the Monad instance. We note that some of the assets presented above have minimal to no circulating supply or liquidity at the time of writing. Stakeholders have indicated that the necessary liquidity will be made available to support these onboardings.

In cases where an EOA is used for critical roles or a timelock is not implemented in upgrades, we will follow up with the relevant teams to request further clarification on whether these EOAs are MPCs or to assign these roles to more secure mechanisms.