# \[ARFC\] Deploy Aave V3 to MegaETH **URL:** \ **Category:** New Market\ **Created:** [December 8, 2025, 8:22pm UTC](https://governance.aave.com/t/arfc-deploy-aave-v3-to-megaeth/23517 "2025-12-08T20:22:49Z")\ **Posts on this page:** 1\ **Showing post:** 25
**Author:** ![bgdlabs](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/bgdlabs/32/1829_2.png) [@bgdlabs](https://governance.aave.com/u/bgdlabs)\ **Post date:** [January 26, 2026, 5:57pm UTC](https://governance.aave.com/t/arfc-deploy-aave-v3-to-megaeth/23517/25 "2026-01-26T17:57:40Z")
# Aave v3 megaETH. Initial asset listings technical analysis - USDm # Summary This is a technical analysis of all the smart contracts of the USDm asset and its main dependencies. _Disclosure_: This is not an exhaustive security review of the asset like the ones done by the USDm team, but an analysis from an Aave technical service provider on different aspects we consider critical to review before a new type of listing. Consequently, like with any security review, this is not an absolute statement that the asset is flawless, only that, in our opinion, we don’t see significant problems with its integration with Aave, apart from different trust points. # Analysis USDm is the MegaETH stablecoin, issued through Ethena’s Whitelabel stablecoin infrastructure. Reserves are to be primarily invested in BlackRock’s tokenized U.S. Treasury fund (BUIDL) via Securitize, with on-chain stablecoins held for redemptions. Authorized accounts can mint USDm by depositing USDtb or other supported stablecoins, such as USDC, and redeem USDm for the same stablecoins. ![usdm1](https://europe1.discourse-cdn.com/flex013/uploads/aave/original/2X/4/4185909606c2c8e159d9dbe3f2915f1e5bc5d0f5.png) For the context of this analysis, our focus has been on the following aspects, critical for the correct and secure integration with Aave: - A recommendation of pricing strategy to be used in the integration asset \<\> Aave. - Any miscellaneous aspect of the code that can be considered important. - Analysis of the access control (ownerships, admin roles) and the nature of the entities involved in the system. Regarding the table permissions’ holders and their criticality/risk, it is done following these guidelines: | **Criticality** | **Description** | | --- | --- | | **CRITICAL** | Usually super-admin functionality: it can compromise the system by completely changing its fundamentals, leading to loss of funds if misused or exploited. E.g. proxy admin, default admin | | **HIGH** | It can control several parts of the system with some risk of losing funds. E.g., general owners or admin roles involved in the flow of funds | | **MEDIUM** | It can cause malfunction and/or minor financial losses if misused or exploited. E.g., fee setter, fee recipient addresses | | **LOW** | It can cause system malfunctions but on non-critical parts without meaningful/direct financial losses. E.g., updating descriptions or certain non-critical parameters. | | **Risk** | **Description** | | --- | --- | | 🟢 | The role is controlled via a mechanism we consider safe, such as on-chain governance, a timelock contract, or setups involving multi-sigs under certain circumstances. | | 🟡 | The role is controlled in a way that could expose the system and users to some risk depending on the actions it can control. | | 🔴 | The role is controlled via a clearly non-secure method, representing risks for the system and users. | ## General points - The USDm system relies on two contracts: most dependencies are from LayerZero’s OFT token for cross-chain transfers, blacklist controls, and rate-limited bridging, and from OZ for access control, tokenization, upgradability, and security. - The upgradable and general admin is controlled by a [Safe 4-of-9](https://etherscan.io/address/0x141C03abC062a9d5d4238E1666B849c929E53cb2). - For proxies, it uses the UUPS proxy pattern. ## Contracts The following is a non-exhaustive overview of the main smart contracts involved with USDm. ![usdm2](https://europe1.discourse-cdn.com/flex013/uploads/aave/original/2X/3/37ab12ce46d92f02bc232de974f345f0f23d7f8f.png) ### USDm [Ethereum](https://etherscan.io/address/0xec2af1c8b110a61fd9c3fa6a554a031ca9943926#code) / [MegaETH](https://megaeth.blockscout.com/address/0xFAfDdbb3FC7688494971a79cc65DCa3EF82079E7) (xUSDOFTUpgradeable) The USDm token is the main system’s contract; xUSDOFTUpgradeable is the upgradeable ERC20 OFT token for USDm with LayerZero cross-chain support, blacklist controls, and a rescue mechanism. It uses UUPS upgradability and ownable access control to manage minters, blacklisters, and cross-chain rate limits. | **Role** | **Holder(s) (Ethereum)** | **Holder(s) (MegaETH)** | **Function** | **Criticality** | **Risk** | | --- | --- | --- | --- | --- | --- | | upgradable admin (UUPS owner) | [Safe 4-of-9](https://etherscan.io/address/0x141C03abC062a9d5d4238E1666B849c929E53cb2) | [Safe 4-of-9](https://megaeth.blockscout.com/address/0x141C03abC062a9d5d4238E1666B849c929E53cb2?tab=read_write_proxy) | upgradeToAndCall | **CRITICAL** | 🟡 | | owner | [Safe 4-of-9](https://etherscan.io/address/0x141C03abC062a9d5d4238E1666B849c929E53cb2) | [Safe 4-of-9](https://megaeth.blockscout.com/address/0x141C03abC062a9d5d4238E1666B849c929E53cb2?tab=read_write_proxy) | addMinter, removeMinter, addBlacklister, removeBlacklister, setRescueRecipient, setRateLimits, rescueBlacklistedTokens | **HIGH** | 🟡 | | minter | [USDmMinting](https://etherscan.io/address/0xE0406beE6D58bCd7C1cA78191b6fde9CA060F6f2), [LZ endpoint](https://etherscan.io/address/0x1a44076050125825900e736c501f859c50fE728c) | [LZ endpoint](https://megaeth.blockscout.com/address/0x6F475642a6e85809B1c36Fa62763669b1b48DD5B?tab=contract) | mint, burnFrom | **HIGH** | 🟢 | | blacklister | [Safe 4-of-9](https://etherscan.io/address/0x141C03abC062a9d5d4238E1666B849c929E53cb2) | not set | addToBlacklist, removeFromBlacklist | **HIGH** | 🟢 | - **Access Control** - **Mint and Burn** - **Bridging** ### [USDmMinting](https://etherscan.io/address/0xE0406beE6D58bCd7C1cA78191b6fde9CA060F6f2) The USDmMinting contract is the primary entry point for minting and redeeming USDm. It is a non-upgradable contract that implements role-based access control, allowing authorized operators to execute mints and redemptions on behalf of users via signed orders. The contract enforces global and per-asset caps per block, restricts participation through a benefactor whitelist and per-benefactor beneficiary approvals, and includes an emergency gatekeeper mechanism that can hard-disable minting and redemption. | **Role** | **Holder(s)** | **Function** | **Criticality** | **Risk** | | --- | --- | --- | --- | --- | | owner / `DEFAULT_ADMIN_ROLE` | [Safe 4-of-9](https://etherscan.io/address/0x141C03abC062a9d5d4238E1666B849c929E53cb2) | setGlobalMaxMintPerBlock, setGlobalMaxRedeemPerBlock, addSupportedAsset, removeSupportedAsset, addCustodianAddress, removeCustodianAddress, addWhitelistedBenefactor, removeWhitelistedBenefactor, setMaxMintPerBlock, setMaxRedeemPerBlock, setTokenType, setStablesDeltaLimit, grantRole, revokeRole | **HIGH** | 🟡 | | `GATEKEEPER_ROLE` | (not set) | disableMintRedeem, removeMinterRole, removeRedeemerRole, removeCollateralManagerRole | **HIGH** | 🟢 | | `MINTER_ROLE` | [EOA (0x31cF…4d23)](https://etherscan.io/address/0x31cF91C38C01e1ACfB7E89A34f47516FE5454d23), [EOA (0x14Ef…490A)](https://etherscan.io/address/0x14Ef18f0b11c0B52f71A2079e686E3D2ecB1490A), [EOA (0x254C…6d17)](https://etherscan.io/address/0x254C8afF4559Da3ee52F76A7503BD620777b6d17), [EOA (0x0405…61ca)](https://etherscan.io/address/0x04053a8f50651832F042eD8938bF427B580061ca), [EOA (0x5DEe…4b2C)](https://etherscan.io/address/0x5DEe2B7BFeEed6c18E6B4c50E32aa890D3844b2C), [EOA (0x4569…5A5C)](https://etherscan.io/address/0x4569a33362D2356979c6e2d31421b9d8f0215A5C), [EOA (0xc3a0…dfA3)](https://etherscan.io/address/0xc3a0A22901A7b018b423d4D5425E1f8dB1AddfA3), [EOA (0xD316…6e82)](https://etherscan.io/address/0xD316704B9783Fdde38839e4A69aA2db4e2606e82), [EOA (0xe28f…683d)](https://etherscan.io/address/0xe28f1D45A5A6b436d13C0756AF572f245338683d), [EOA (0x29f1…f1E6)](https://etherscan.io/address/0x29f1f862aaed5F77ce23cbf4969269B4E69af1E6) | mint, mintWETH | **HIGH** | 🟡 | | `REDEEMER_ROLE` | [EOA (0x31cF…4d23)](https://etherscan.io/address/0x31cF91C38C01e1ACfB7E89A34f47516FE5454d23), [EOA (0x14Ef…490A)](https://etherscan.io/address/0x14Ef18f0b11c0B52f71A2079e686E3D2ecB1490A), [EOA (0x254C…6d17)](https://etherscan.io/address/0x254C8afF4559Da3ee52F76A7503BD620777b6d17), [EOA (0x0405…61ca)](https://etherscan.io/address/0x04053a8f50651832F042eD8938bF427B580061ca), [EOA (0x5DEe…4b2C)](https://etherscan.io/address/0x5DEe2B7BFeEed6c18E6B4c50E32aa890D3844b2C), [EOA (0x4569…5A5C)](https://etherscan.io/address/0x4569a33362D2356979c6e2d31421b9d8f0215A5C), [EOA (0xc3a0…dfA3)](https://etherscan.io/address/0xc3a0A22901A7b018b423d4D5425E1f8dB1AddfA3), [EOA (0xD316…6e82)](https://etherscan.io/address/0xD316704B9783Fdde38839e4A69aA2db4e2606e82), [EOA (0xe28f…683d)](https://etherscan.io/address/0xe28f1D45A5A6b436d13C0756AF572f245338683d), [EOA (0x29f1…f1E6)](https://etherscan.io/address/0x29f1f862aaed5F77ce23cbf4969269B4E69af1E6) | redeem | **HIGH** | 🟡 | | `COLLATERAL_MANAGER_ROLE` | (not set) | transferToCustody | **HIGH** | 🟢 | - **Access Control** - `DEFAULT_ADMIN_ROLE`: - `GATEKEEPER_ROLE`: - `MINTER_ROLE`: - `REDEEMER_ROLE`: - `COLLATERAL_MANAGER_ROLE`: - **Mint and Burn** - Whitelisted minters (address assigned with `MINTER_ROLE`) can mint USDm by calling the `mint(Order, Route, Signature)` function. Internally, it validates the `Order.OrderType` is a `MINT` and the benefactor’s `Signature`, if the collateral asset is a `STABLE`, and the custody `Route` ratio sum is 100%. It finalizes by consuming the amount from the global per-block mint limit, transferring the collateral from the `Order.benefactor` to the custodian wallets (currently the [EOA](https://etherscan.io/address/0x343c18b0f1710b65ce33a7ce720b5d540215d343) is the only custodian), and minting USDm to the `Order.beneficiary`. - Whitelisted redeemers (addresses granted the `REDEEMER_ROLE`) can redeem USDm by calling the `redeem(Order, Signature)` function. Internally, it validates that the `Order.OrderType` is `REDEEM` and that the benefactor’s `Signature` is valid. If everything is correct, it consumes the amount from the global per-block redeem limit, burns the USDm from the `Order.benefactor`, and transfers the `Order.amount` of the `Order.asset` to the `Order.beneficiary` address. - The system also features minting with native ETH through the `mintWETH(Order, Route, Signature)` function; however, it is currently disabled. # Pricing strategy Given the only-borrowable intended configuration and the nature of the asset, we recommend pricing USDm using a fixed 1 USD price feed, a strategy consistent with others similar. # Miscellaneous - The security reviews were performed by Quantstamp, Zellic, Spearbit and Pashov. They can be found [here](https://docs.ethena.fi/resources/audits#reports). - We confirmed with Ethena that the EOAs with MINTER\_ROLE are protected via HSM (Hardware Security Modules) and must pass an internal KYB process before being assigned, following the same process as USDe. - We confirmed with Ethena that the only Custodian address is a Coinbase Prime custodial wallet, which requires 3 signatures (with no external signers) to operate the policy engine. # Conclusion We think USDm doesn’t have any issues with integration with Aave, and there are no major technical blockers to listing. Also, it is important to note that after an internal discussion with Ethena regarding access-control security, they have confirmed that the upgradable admin and master admin for USDm will be transferred to a Timelock, which provides an additional security layer for the most critical actions on USDm. --- _[View the full topic](https://governance.aave.com/t/arfc-deploy-aave-v3-to-megaeth/23517)._