[ARFC] Onboard eUSDe to Aave v3 Core Instance

[ARFC] Onboard eUSDe to Aave v3 Core Instance

Author: ACI

Date: 2025-04-11


2025-04-22 Risk Parameters have been updated by Risk Service Providers and ARFC has been updated accordingly.

Simple Summary:

The proposal aims to onboard eUSDe to Aave V3 on the Core Instance, after successful [TEMP CHECK] Onboard eUSDe to Aave v3 Core Instance and TEMP CHECK Snapshot.

Motivation/Background:

eUSDe represents deposits in Ethereal, the upcoming Ethena backed perpetual futures exchange. eUSDe earns Ethereal points and 30x Ethena points, providing an attractive opportunity for point farming which has been a driver of considerable demand for borrow on Aave in recent times.

Benefits of listing eUSDe PT tokens:

  • Significant new opportunity, with potential for large TVL growth.

There is no expected market impact caused by listing these tokens outside of increased borrow demand which should not be destabilising.

Chain to be deployed/listed:

eUSDe will be listed on Aave V3 Core Instance.

Proof of Liquidity (POL) and Deposit Commitments:

The same amount of Ethena points will be rewarded to eUSDe deposits as are rewarded to USDe deposits.

Specification

2025-04-22 Risk Parameters have been updated by Risk Service Providers and ARFC has been updated accordingly.

Parameter Value
Asset eUSDe
Isolation Mode No
Borrowable No
Collateral Enabled Yes
Supply Cap 150,000,000
Borrow Cap -
Debt Ceiling -
LTV 0.05%
LT 0.1%
Liquidation Penalty 7.50%
Liquidation Protocol Fee 10.00%
E-Mode Category eUSDe Stablecoins

eUSDe/Stablecoin E-Mode

Asset eUSDe USDC USDT USDS
Collateral Yes No No No
Borrowable No Yes Yes Yes
LTV 90% - - -
LT 93% - - -
Liquidation Bonus 2% - - -

Useful Links:

Disclaimer:

The Aave Chan Initiative is independent and has not received any form of compensation from related parties for the drafting of this proposal. Some ACI team members may hold tokens from the Ethena ecosystem.

Next Steps:

  1. Publication of a standard ARFC, collect community and service provider feedback before escalating the proposal to the ARFC Snapshot stage.
  2. If the ARFC Snapshot outcome is positive, publish an AIP vote for final confirmation and enforcement of the proposal.

Copyright:

Copyright and related rights waived under CC0.

Summary

LlamaRisk supports onboarding eUSDe to Aave v3 Core Instance. Ethereal is a decentralized exchange tailored for spot and perpetual trading built on the Ethena Network that employs USDe as collateral. Currently, the platform remains in a pre-deposit phase where eUSDe is a receipt token for idle USDe deposited in an ERC4626-compliant vault with instant 1:1 redemption capability. Numerous protocol features—particularly trading functionalities—are either inactive or only theoretically described, with limited documentation and unverified implementations. The main use case for Aave is allowing users to farm Ethereal Points, especially given higher capital efficiency under stablecoin emode.

Since its mid-February 2025 launch, eUSDe has seen substantial growth, with total deposit volume exceeding $1.60B and approximately $930M in TVL as of April 2025. Although secondary market liquidity is limited to a few Uniswap pools with minimal TVL, this presents less concern due to the instant redemption feature for USDe. Token distribution shows high centralization, with the top ten holders controlling over 88% of the supply—Pendle alone holds nearly 82%.

Guardian’s security assessment found only one low-severity issue in the contract, which leverages standard OpenZeppelin libraries. A bug bounty program is not yet active but is confirmed to be on the roadmap. Given that Ethena maintains a $3M bounty, we expect Ethereal to take security equally seriously. Additional audits are currently underway beyond the initial assessment. Counterparty risk exists through the vault’s SafeProxy ownership structure with a 2-of-3 signer threshold that controls deposit and withdrawal functions. It is important to note that the risk profile will definitively change once additional protocol functionalities are enabled, necessitating continuous monitoring, reassessment, and prompt actions as Ethereal implements future development stages.

Collateral Risk Assessment

1. Asset Fundamental Characteristics

1.1 Asset

Ethereal is a decentralized exchange for spot and perpetual trading, built on the Ethena Network and employing USDe as collateral. It is not live yet. Ethereal USDe (eUSDe) is a receipt token provided in return for pre-deposited USDe into Ethereal, where deposits can be made on Ethereum L1. It can be redeemed on a 1:1 basis for USDe at any point. Holding eUSDe grants users the ability to earn Ethereal points, which grow in proportion to the amount deposited and the length of the deposit, while enabling a 30x multiplier on Ethena Rewards and granting early access to the testnet.

1.2 Architecture

Architectural details of Ethereal (v1), as revealed in the available documentation, remain sparse. By design, Ethereal combines on-chain and off-chain components to deliver performance levels comparable to centralized exchanges while preserving a non-custodial framework characteristic of DeFi. The disclosed benchmarks suggest sub-20ms latency with the ability to handle over a million orders per second.

Both perpetual markets (planned for v1.0) and spot markets (slated for v1.1–1.2) will rely on an off-chain order book system. A dedicated sequencer will aggregate transactions off-chain and regularly batch-commit them on-chain. The settlement will occur on the Ethena network, which oversees its block space to ensure reliable transaction finality and throughput, even during heavy trading.

It is worth noting that this remains a theoretical design, with no publicly available performance metrics or additional technical documentation to substantiate its capabilities.

The eUSDe architecture is straightforward - it operates as a tokenized vault built on the ERC4626 standard, managing deposits and withdrawals for a single, predefined ERC20 asset, i.e. USDe. When users deposit USDe, they receive vault shares representing their proportional ownership of the pooled assets, with the exchange rate determined by the ERC4626 conversion rules. These deposited tokens remain in the vault, providing the backing for the share tokens and undergoing no additional processing. Users can initiate withdrawals at any point, redeeming their share tokens for USDe on demand for free.

1.3 Tokenomics

Tokenomics of the network have not yet been disclosed. The only live feature is Season Zero, a pre-deposit campaign designed to strengthen liquidity and reward early supporters.

By holding eUSDe, users accumulate Ethereal Points, granting them priority access to the testnet and other upcoming initiatives, as well as a 30x multiplier on Ethena Rewards. Both Ethereal Points and the Ethena multiplier can be further maximized through eUSDe integrations. The one with Pendle has the highest tier of benefits.

Source: Ethereal Points, April 7th, 2025

Because each eUSDe is fully backed by an equivalent amount of USDe and supports immediate redemption, its risk profile effectively mirrors that of USDe. Accordingly, the main considerations highlighted in the USDe risk analysis apply here.

1.3.1 Token Holder Concentration

The token holder concentration for eUSDe is highly centralized, with the top 10 holders collectively owning approximately 88.47% of the token supply. Pendle SY-eUSDE contract alone holds nearly 82% of the total supply. The second-largest holder is Morpho, with 2.00%, and the third place is for Euler eUSDe vault.

Source: Etherscan, April 14th, 2025

2. Market Risk

2.1 Liquidity

2.1.1 Liquidity Venue Concentration

The liquidity pool landscape for eUSDe is limited in depth:

2.1.2 DEX LP Concentration

2.2 Volatility

Limited data is available due to limited liquidity, instant deposit, and redeemability.

Source: Geckoterminal, April 15th, 2025

2.3 Exchanges

Aside from the limited Uniswap v3 and v4 pools, eUSDe currently has no established presence on other DEXs or CEXs.

2.4 Growth

eUSDe has experienced rapid adoption since its pre-deposit program launched in mid-February 2025. As of early April, the total value locked reached approximately $930M, supported by cumulative deposits of $1.60B and withdrawals of $672M.

During the same period, the number of unique depositors grew in a near-linear fashion to 22,857, reflecting consistent onboarding momentum.

Source: Dune - @etherealdex, April 14th, 2025

3. Technological Risk

3.1 Smart Contract Risk

Ethereal engaged Guardian to conduct a security assessment of their pre-deposit vault. The report documents 1 low severity finding that was acknowledged by the Ethereal team. The team also confirmed that other audits are underway for the other contracts necessary for the next phase of the protocol deployment.

3.2 Bug Bounty Program

None at the moment. The bug bounty program is on the roadmap.

3.3 Price Feed Risk

The vault does not currently implement any price feed or Oracle functionality.

3.4 Dependency Risk

EtherealPreDepositVault inherits from OpenZeppelin contracts:

  • Ownable function to provide a basic access control mechanism;
  • ERC20 token standard and its interface, allowing the vault to issue share tokens that represent a claim on the underlying assets;
  • ERC4626 pattern for tokenized vaults;

The vault contract relies on OpenZeppelin standards and does not appear to introduce significant risks.

4. Counterparty Risk

4.1 Governance and Regulatory Risk

References to an Ethereal governance token have appeared in some publications, but no official announcement or concrete details have been released as of this review. No legal issues have been identified that would hinder asset onboarding.

The Terms of Service function as the binding agreement between users and Ethereal Ltd, together with its affiliated entities, and oversee any interaction with, or use of, the website located at www.ethereal.trade (referred to hereafter as the “Platform”) and all associated services, products, and applications.

Ethereal enforces geographic limitations by prohibiting any individual in, or under the authority of a party in, the United States from utilizing its services. In addition, users located in, residing in, or under the control of jurisdictions subjected to comprehensive sanctions by the United States, United Nations, or the United Kingdom are restricted from accessing the services. This includes Cuba, North Korea, Iran, Syria, and specified areas within Russia and Ukraine, notably Crimea, Donetsk, Luhansk, and Zaporizhzhia.

Individuals subject to export restrictions, anti-terrorism statutes, anti-money laundering laws, economic or financial sanctions, or trade embargoes are also disallowed from using the services. These include sanctions enforced by agencies such as the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC), the U.S. Department of State, the U.S. Department of Commerce, and the United Nations Security Council.

Ethereal reserves the right to implement geo-blocking measures to restrict access from prohibited regions. Users are barred from using virtual private networks or similar methods to mask or modify their IP addresses to circumvent these prohibitions.

The Terms likewise clarify that Ethereal does not possess, run, or govern the underlying protocol, and any activity executed on the protocol does not equate to a transaction with Ethereal. Ethereal does not administer trade execution or manage liquidity pools on the protocol. Instead, the platform constitutes one avenue among many for interacting with the protocol, and Ethereal does not intervene in smart contracts or transaction validation.

Ethereal may occasionally offer incentives, prizes, or rewards to users who engage in particular activities, though there is no assurance that participants will actually receive such rewards. Ethereal holds the discretion to adjust, discontinue, or revoke these offers at any point without notice. Ethereal disclaims any warranties or guarantees regarding reward amounts or percentages, continuous availability of rewards, error-free functionality, or specific digital assets linked to rewards. Certain or all rewards may be partially or entirely nullified if a “Slashing Penalty” is enforced by the underlying blockchain network, and Ethereal assumes no responsibility for any resulting losses.

Users might be required to submit personal or identifying information directly to Ethereal or through a third party frequently to verify their identity and deter unlawful activity. By providing these details, users grant Ethereal the authority to perform whatever inquiries are necessary to confirm user identity and safeguard against misuse of the services.

4.2 Access Control Risk

4.2.1 Contract Modification Options

The contract allows modifications through two toggle functions that change its operational state. The vault owner has the exclusive authority to toggle the deposit and withdrawal functionalities via setDepositsEnabled and setWithdrawalsEnabled. The owner can transfer or renounce ownership using functions inherited from OpenZeppelin’s Ownable.

4.2.2 Timelock Duration and Function

No timelock implemented.

4.2.3 Multisig Threshold / Signer identity

Vault Owner is a SafeProxy with 2/3 signing threshold and the following signatories:

  • 0x4320A9290720462F0cd5dfB0F0B9bD4D4A74A8D3
  • 0xF3D11F9829Fdb9F61a7d987CCAa858054E80Eb33
  • 0xb6349012024331A6989cdc4cfDf480C40cfAE058

Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.

Aave V3 Specific Parameters

Parameters will be conjointly presented with @ChaosLabs.

Price feed Recommendation

We recommend using eUSDe’s vault exchange rate with a CAPO adapter coupled with the USDe feed used on Aave’s Core Instance (USDT/USD).

Disclaimer

This review was independently prepared by LlamaRisk, a community-led decentralized organization funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.

eUSDe (Ethereum) technical analysis


Summary


This is a technical analysis of all the smart contracts of the asset and its main dependencies.

Disclosure: This is not an exhaustive security review of the asset like the ones done by the Etheral Team, but an analysis from an Aave technical service provider on different aspects we consider critical to review before a new type of listing. Consequently, like with any security review, this is not an absolute statement that the asset is flawless, only that, in our opinion, we don’t see significant problems with its integration with Aave, apart from different trust points.



Analysis

eUSDe represents the pre-deposit for the initial stage of Ethereal, a decentralized spot and perpetual exchange built on the Ethena Network and powered by native USDe collateral. Users can deposit USDe and receive eUSDe to earn Ethereal and Ethena points.


For the context of this analysis, our focus has been on the following aspects, critical for the correct and secure integration with Aave:

  • Mechanism to update the exchange rate of the asset for the underlying.
  • A recommendation of pricing strategy to be used in the integration asset <> Aave.
  • Any miscellaneous aspect of the code can be considered important.
  • Analysis of the access control (ownerships, admin roles) and the nature of the entities involved in the system. Regarding the table permissions’ holders and their criticality/risk, it is done following these guidelines:
Criticality Description
CRITICAL Usually super-admin functionality: it can compromise the system by completely changing its fundamentals, leading to loss of funds if misused or exploited. E.g. proxy admin, default admin
HIGH It can control several parts of the system with some risk of losing funds. E.g., general owners or admin roles involved in the flow of funds
MEDIUM It can cause malfunction and/or minor financial losses if misused or exploited. E.g., fee setter, fee recipient addresses
LOW It can cause system malfunctions but on non-critical parts without meaningful/direct financial losses. E.g., updating descriptions or certain non-critical parameters.
Risk Description
:green_circle: The role is controlled via a mechanism we consider safe, such as on-chain governance, a timelock contract, or setups involving multi-sigs under certain circumstances.
:yellow_circle: The role is controlled in a way that could expose the system and users to some risk depending on the actions it can control.
:red_circle: The role is controlled via a clearly non-secure method, representing risks for the system and users.


General points

  • eUSDe relies on a single contract with dependencies from OZ for access control and tokenization.
  • The system’s owner is a 2-of-3 Safe wallet (to be changed, more later).

Contracts

The following is a non-exhaustive overview of the main smart contracts involved with eUSDe.


eUSDe

eUSDe is the only contract of the system, which is an OZ ERC4626 Vault using OZ Ownable for access control. Users can mint eUSDe by depositing USDe, and they can withdraw USDe at any time. eUSDe is paired 1:1 with USDe and allows users to earn Ethereal Points. It is a non-upgradable contract.

Permission Owner functions Criticality Risk
owner: 2-of-3 Safe wallet. setDepositsEnabled, setWithdrawalsEnabled, transferOwnership HIGH :yellow_circle:
  • Access Control
    • The owner can pause/unpause deposits and withdrawals via the setDepositsEnabled(bool) and setWithdrawalsEnabled (bool) functions, respectively.
  • Deposit and Withdrawals
    • Users can deposit USDe via the deposit(assetsAmount) function, which internally checks whether deposits are enabled and mints 1:1 shares of eUSDe for the user.
    • Users can redeem eUSDe for USDe via the redeem(sharesAmount) function. If withdrawals are not paused, the contract will burn the sharesAmount and send the equivalent amount of USDe to the user.
  • Exchange Rate
    • As an ERC4626 Vault standard, the exchange rate of eUSDe can be obtained using the convertToAssets(shares) function, which calculates it based on totalAssets() and total supply().
    • It is important to highlight that totalAssets() does not use proper internal accounting and relies on the asset.BalanceOf(), which means that it CAN suffer donation attacks.

Pricing strategy

For eUSDe, the price strategy can be done in two different directions:

  • The first option is to use the CAPO stable adapter, which is already used for USDe. Since eUSDe’s intention is not to accrue any rewards within the contract, the exchange rate should be 1:1 with USDe.
  • The second option could be the CAPO LST adapter using the eUSDe <> USDe exchange rate with the USDe CL feed. However, the maxYearlyRatioGrowthPercent must be set to zero, as any donations of USDe to the eUSDe will directly affect the exchange rate, and the adapter would cap any price changes.

For simplicity, we recommend pricing eUSDe with the first option. This way, we can avoid any unexpected behavior regarding the eUSDe price on Aave.


Miscellaneous

  • The system has undergone one security review by Guardian Audits with no High or Critical findings. The reports can be found here.
  • Following our discussion with the Ethereal Team regarding our concerns about the super admin of eUSDe being a multisig wallet with a low number of signers and a low threshold, as highlighted by recent incidents involving Safe wallets, the team has agreed to change the owner to the zero address, as the functionality is not required.

Conclusion

We think eUSDe doesn’t have any problems in terms of integration with Aave, both for direct listing and as the underlying of assets like Pendle PTs.
The only technical prerequisite is as commented for the team to change the ownership role, but once done, we don’t see any blocker for listing.

Summary

Chaos Labs supports listing Ethereal’s eUSDe on Aave V3’s core instance. Below is our analysis and initial risk parameter recommendations.

Overview

Ethereal is a spot and perpetual DEX built on the Ethena Network. Its inaugural phase, Season Zero, invites users to pre-deposit USDe on Ethereum L1, earning Ethereal Points, as well as 30x Ethena points, based on the size and duration of their deposits. The Ethereal points unlock a suite of benefits, including Ethena rewards, early access to future product launches, and loyalty bonuses for early supporters. In return for their deposit, users receive eUSDe—a receipt token atomically redeemable 1:1 for USDe at any time. Season Zero will run until Ethereal’s mainnet launch later this year, effectively acting as a USDe wrapper contract.

Season Zero has accumulated a considerable 900M USDe since its inception, growing exponentially over the last few months.

The eUSDe pre-deposit contract is built using the ERC-4626 token standard. While it conforms to this standard, its exchange rate is not expected to appreciate over time, as it functions purely as a wrapper for USDe without yield-bearing mechanics.

At the moment, the contract admin is a 2/3 multisig that inherits functionality to pause deposits or withdrawals. However, in alignment with the principles of protocol minimization and security, this ownership is expected to be relinquished per the above analysis, transferring control to the zero address in the near future.

Importantly, the vault contract cannot be upgraded, thereby solidifying its functionality in its current state. Any additional functionality post-launch in accordance with the protocols’ evolution will thus be present at the application layer and not systemic in nature, being fully opt-in by users.

Fully inheriting all functionality associated with USDe, eUSDe thus adheres to our comprehensive risk assessments of the Ethena Protocol and parameterization of USDe, as can be seen here. Our previous recommendation earlier today for the implementation of a USDe-designated Stablecoins E-mode can be found here.

CAPO and Oracle Implementation

We recommend leveraging the eUSDe/USDe vault exchange rate with a stable CAPO adapter, with the USDT/USD price feed utilized for the underlying USDe price. The stable CAPO adapter shall be configured in accordance with USDe’s value, as the eUSDe exchange rate is not expected to grow over time.

Specification

Parameter Value
Asset eUSDe
Isolation Mode No
Borrowable No
Collateral Enabled Yes
Supply Cap 150,000,000
Borrow Cap -
Debt Ceiling -
LTV 0.05%
LT 0.1%
Liquidation Penalty 7.50%
Liquidation Protocol Fee 10.00%
E-Mode Category eUSDe Stablecoins

eUSDe/Stablecoin E-Mode

Asset eUSDe USDC USDT USDS
Collateral Yes No No No
Borrowable No Yes Yes Yes
LTV 90% - - -
LT 93% - - -
Liquidation Bonus 2% - - -

Disclaimer

Chaos Labs has not been compensated by any third party for publishing this recommendation.

Copyright

Copyright and related rights waived via CC0

1 Like

Thank you @LlamaRisk , @bgdlabs and @ChaosLabs .

We’ve escalated the proposal to ARFC Snapshot.

Vote is open, we encourage everyone to participate.

1 Like