[ARFC] Deploy Aave V3 to MegaETH

Governance New Market
33

MegaETH USDm Asset Review

Summary

LlamaRisk supports the onboarding of USDm to the MegaETH instance, acknowledging its unique structure as a whitelabel stablecoin powered by Ethena’s infrastructure. USDm functions as a bridged stablecoin (via LayerZero OFT) backed primarily by off-chain real-world assets (BlackRock’s BUIDL). While the asset benefits from Ethena’s established operational stack and multiple security audits (Quantstamp, Zellic, Spearbit, Pashov), we highlight the layers of infrastructural dependency. Ultimately, we believe that the asset structure is fit to become the main stablecoin of Aave’s MegaETH market.

Collateral Risk Assessment

1. Asset Fundamental Characteristics

1.1 Asset

USDm is the native stablecoin of the MegaETH network, issued through Ethena’s whitelabel stablecoin infrastructure. The asset is designed to be fully backed, with reserves primarily invested in BlackRock’s tokenized U.S. Treasury fund (BUIDL) via Securitize, alongside a portion of on-chain stablecoins (USDC) held to facilitate immediate redemptions.

1.2 Architecture

USDm may be minted and redeemed against both fiat and stablecoins. For fiat minting and redemption, USDm is first converted into USDtb. On that basis, onboarding with Anchorage Digital Bank (ADB) is required in order to become an eligible Client under the applicable Terms.

USDm’s backing is primarily provided through USDtb, with a portion of the backing held in USDC to service redemptions. USDtb, in turn, is backed by BUIDL and USD.

Reserve commitments are reflected in the Anchorage Terms, which state that all Covered Stablecoins issued by ADB, i.e., USDtb, are backed by assets with an aggregate market value, as of the end of each business day, at least equal to the aggregate number of outstanding Covered Stablecoins. ADB publishes information regarding the composition of the Covered Stablecoin Reserve as required by applicable U.S. federal law.

The team represents that all USDm reserves are held by qualified custodians, including Anchorage Digital Bank and Coinbase Custody. Given that the USDtb transparency page identifies Anchorage Digital Bank as the sole custodian, it may be assumed that the remaining portion of USDm backing held in USDC is maintained with Coinbase Custody.

2. Market Risk

2.1 Liquidity

As USDm is to be launched at the mainnet deployment of MegaETH, liquidity data is not yet available. Liquidity is expected to be bootstrapped via internal efforts and commitments from external parties. USDm is provisioned to be paired with ETH-correlated assets, BTC, and USDT0. The exact confirmed commitments are as follows:

Pairs Committed Liquidity TVL DEX Venue
WETH / USDm $16.6M Kumbaya
USDT0 / USDm $16.6M Kumbaya
BTC.b/USDm up to $3.00M TBD

We expect that targeted incentive programs as well as DEX launches will immediately grow the liquidity TVL at the time of deployment, especially as USDm is viewed as the main stablecoin for the MegaETH network.

2.2 Exchanges

Given the primary chain stablecoin label. USDm is expected to be deployed on all native DEXs, as well as the more established and mature DEXs that will be deployed on MegaETH immediately or shortly after the mainnet launch.

3. Technological Risk

3.1 Smart Contract Risk

The USDm system is built on two primary components: the token contract (xUSDOFTUpgradeable) and the minting entry point (USDmMinting).

  • Token Contract: Utilizing the LayerZero OFT standard, the token is an upgradable OpenZeppelin Proxy contract. This standard facilitates cross-chain transfers, blacklist controls, and rate-limited bridging.
  • Minting Contract: A non-upgradable contract governing the mint/redeem flow. It utilizes role-based access control where authorized operators execute orders signed by users. It enforces global and per-asset caps per block and includes an emergency gatekeeper mechanism to halt operations.

The underlying codebase and infrastructure of the Ethena issuance layer have been audited by multiple firms, including Quantstamp, Zellic, Spearbit, and Pashov. We will confirm whether the audits have also been carried out for the extending USDmMinting contract or any peripheral contracts.

3.2 Bug Bounty Program

While specific details for a standalone USDm bounty were not provided, MegaETH currently does not have an active bug bounty program or plans to have one in the near future, as confirmed by the MegaETH team. Therefore, we can expect that this applies to USDm as well.

3.3 Price Feed Risk

We agree on the approach of initially pricing USDm using a fixed 1 USD price feed. Given the asset’s design as a permissioned, reserve-backed stablecoin and the borrowable-only configuration on Aave, this standardizes the peg assumptions while relying on the underlying collateral quality (USDtb and BUIDL dependencies) to be maintained. Nonetheless, as the liquidity and TVL of USDm scale, it may be rational to move towards a stable USDm/USD market price feed of Chainlink.

3.4 Dependency Risk

USDm introduces several dependencies:

  • LayerZero: The asset relies on LayerZero’s OFT standard and endpoints for all cross-chain bridging and message passing.
  • Custodial Risk: The value of USDm is dependent USDtb (directly), BUIDL (indirectly), and USDC held in custody.
  • Operational Dependencies: The MINTER_ROLE is operated by EOAs (protected by HSMs) performing mints based on off-chain policy engines. Failure or compromise of these off-chain coordination layers could impact mint/redeem functionality.

4. Counterparty Risk

4.1 Governance and Regulatory Risk

Our initial focus for the legal analysis has been MegaETH’s Terms, which are drafted as a broad website/platform agreement but expressly sweep in “the pre-deposit bridge flow interface, USDm minting functionality, [and] vault services” within the defined “Services.” The Terms state that the contract is between the user and “MegaETH Foundation (including all its affiliates and subsidiaries)” (defined as the “Company”), and they hardwire Cayman Islands governing law.

The Terms frame USDm minting access as restricted: they require KYC for the “pre-deposit bridge flow,” require AML checks and whitelisting, and they expressly state that “United States-based users are not eligible to participate in the pre-deposit bridge flow or USDm minting services powered by Ethena.” In practice, this means the only clearly documented “rights” around USDm in this agreement are not holder-rights in the asset; rather, they are conditional “platform access” rights to participate in MegaETH’s gated minting/bridging workflow, which are revocable at will (including for compliance reasons).

The Terms describe an operational sequence: users deposit USDC; MegaETH integrates with the Ethena protocol for USDm minting; and USDm is then bridged to MegaETH mainnet via LayerZero. Critically, in the Third-Party Services section, the Terms go further and describe “limited operational roles,” including (i) “a Vault Contract on Ethereum mainnet that receives and holds USDC deposits with multi-signature governance controls hosted by the Company,” and (ii) MegaETH maintaining “whitelisted addresses authorized to call” Ethena “Minter Contracts,” thereby triggering Ethena to release USDm 1:1 against deposited USDC, plus (iii) OFT bridging via LayerZero.

However, none of the foregoing constitutes a legal characterization of USDm itself. The Terms do not state whether USDm is (for example) a claim on an issuer, a claim on specific reserves, a contractual redemption right against any person, a settlement token with no issuer obligations, or something else. While the Terms contemplate a “pre-deposit bridge flow” and USDm “minting functionality,” they do not provide a clean set of mint/redeem terms on which a holder could reasonably rely (eligibility aside). They do not clearly state who owes redemption, at what price, within what time, with what fees, subject to what suspensions, or what happens in the event of downtime or insolvency.

On the issuance perimeter, Ethena’s USDtb documentation states that, as of the current documents, only customers of Anchorage Digital Bank can mint and redeem USDtb, and the legal terms position Anchorage Digital Bank as sole issuer/obligor for its “Covered Stablecoins,” with Non-Clients having no contractual rights against the bank except as may arise under applicable law. Hence, USDm could be viewed as an Ethena-mediated minted-and-bridged token that is operationally backed by a reserve rail but does not itself confer a direct contractual redemption right for most holders, with redemption effectively limited to participants who pass KYC/AML and are permitted to access the minting workflow.

Because USDm’s legal nature (issuer, obligor, and the holder’s claim) is not defined in the Terms—despite explicitly marketing “USDm minting functionality” as part of the Services and disclaiming liability for depeg/redemption/liquidity failures—we sought further clarification from the MegaETH team on this issue of significant importance. As of the date of this write-up, a special purpose vehicle has been incorporated in the BVI to support the minting flow of USDm, namely MegaUSD (BVI) Ltd. USDm is issued by MegaUSD (BVI) Ltd, which is wholly owned by MegaUSD Foundation, a vehicle stated to be independent of both Mega and Ethena, with Ethena Labs acting as a service provider to MegaUSD (BVI) Ltd.

4.2 Access Control Risk

4.2.1 Contract Modification Options

The USDm token (xUSDOFTUpgradeable) utilizes the upgradable proxy pattern. Currently, the ownership and admin role is held by a 4/9 Safe Multisig (the same multisig setup as USDe and USDtb). The signers list is as follows:

4.2.2 Timelock Duration and Function

There is currently no on-chain Timelock enforcing a delay on administrative actions. However, Ethena and MegaETH teams have confirmed that both the upgradable admin and master admin roles for USDm will be transferred to a Timelock contract.

4.2.3 Main Contract Roles

The system is governed by the above-mentioned 4/9 Safe Multisig, which controls the Owner and Admin roles. This multisig has high-level privileges, including managing minters, blacklisters, and rescue recipients.

  • Minter Roles: The MINTER_ROLE and REDEEMER_ROLE are assigned to 10 specific EOAs at the time of writing. Ethena has confirmed these EOAs are protected via Hardware Security Modules (HSM) and subject to internal KYB processes.
  • Collateral Custody: The COLLATERAL_MANAGER_ROLE can transfer held collateral to approved custodians. The sole approved custodian is a Coinbase Prime wallet, which requires a 3-signature threshold (internal signers only) to operate.

Parameter Recommendations

Parameters have been agreed jointly with @ChaosLabs.

Disclaimer

This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk serves as a member of Ethena’s Risk Committee and an independent attester of Ethena’s PoR solution. LlamaRisk did not receive compensation from the protocol(s) or their affiliated entities for this work. The information should not be construed as legal, financial, tax, or professional advice.

LlamaRisk - Monthly Community Update