LlamaRisk supports onboarding ggAVAX to Aave V3 Avalanche. Our assessment indicates that ggAVAX can add value to the protocol through an AVAX-correlated E-mode, enabling leveraged staking opportunities like other network tokens.
The asset demonstrates several positive characteristics: strong liquidity supporting $13M trades with acceptable price impact, stable price correlation with AVAX, and growing protocol adoption with approximately 1.1M AVAX staked. As a liquid staking token, its architecture is similar to established protocols like RocketPool, with a dual token system for validation.
However, significant risks exist. The most concerning is smart contract risk, with several contracts deployed without a formal audit. This risk is amplified by an insufficient bug bounty program of only $50k for a protocol securing approximately $60m in TVL. A notable concern is the pricing mechanism, which relies on a ratio feed from a fully upgradeable contract, introducing additional risk vectors. Centralization risk is also substantial, as Multisig Labs, an entity with limited transparency, controls all protocol functions. Concentration risk is evident, with three holders controlling 60% of the supply.
Given this risk profile, we recommend a “soft onboarding” with ggAVAX siloed exclusively to one E-mode. This approach isolates the risks while enabling the leveraged staking use case that would benefit Aave users. We propose an internal exchange rate in conjunction with the CAPO adapter, given that historical data shows no significant depegs were observed. Specific parameters will be discussed with @ChaosLabs and presented shortly.
Collateral Risk Assessment
1. Asset Fundamental Characteristics
1.1 Asset
GoGoPool Staked AVAX (ggAVAX) is a liquid staking token on the Avalanche network. It was developed by Multisig Labs and was launched in April 2023. Some 777K AVAX are currently staked through this solution.
This asset is designed to accelerate blockchains launching within Avalanche’s Subnet ecosystem. Multisig Labs works to achieve this goal by facilitating liquid staking with ggAVAX, Minipool deployment (validator setup acceleration), and subnet integration.
While liquid staking tokens are a familiar concept to Aave DAO, ggAVAX’s asset architecture has some nuances.
1.2 Architecture
This asset is a liquid staking token. Despite being conceptually similar to protocols such as RocketPool ETH, differences exist stemming from ggAVAX’s incentive system.
Users send their AVAX to a vault, for which they receive ggAVAX to use elsewhere in DeFi. The ratio of ggAVAX to AVAX is ever-increasing thanks to the increasing number of AVAX held in the vault (generated from staking rewards).
The users’ AVAX is then staked 1:1 with a minipool operator’s AVAX in the Minipool Manager, which is then migrated to Avalanche’s P Chain for staking. Staking rewards are programmatically returned to the GogoPool’s vault, which increases the value of the ggAVAX receipt token.
Source: Past Minipools, Panopticon, January 11th 2025
To operate a minipool, an operator must stake at least 100 AVAX and 100 GGP, which may be slashed should the operator not act in the interest of those delegating to them (for example, by failing to meet consensus on the network). Minipools have rolling maturities, with examples of ended minipools being displayed above. ggAVAX users do not need to repeatedly delegate their AVAX as this is handled through protocol contracts. Should they wish to do so, they may through Panopitcon.
1.3 Tokenomics
Each ggAVAX is backed 1:1 with an AVAX token. This is identical to other liquid staking tokens. ggAVAX is non-rebasing, meaning it does not increase in number but instead represents a share of an underlying vault.
GGP, the protocol token, is used to both operate minipools and to participate in GoGoPool DAO governance. It is an incentive mechanism for pool operators to perform at a high level. It may also be slashed if the validator results in low runtime. Their slashed GGP will be auctioned to other GGP holders at a discount, with funds generated passed to ggAVAX stakers.
The GGP token serves two DAOs: the protocol DAO and the oracle DAO. The Oracle DAO is focused on fundamental protocol operations such as staking rewards distribution. The Protocol DAO is more concerned with longer-term strategic initiatives such as liquidity approaches or treasury management. Neither of these DAOs exists at this time.
1.3.1 Token Holder Concentration
Source: GoGoPool Liquid Staking Token Top 100 Holders, Snowtrace, January 10 2025
ggAVAX holder distribution is relatively centralized, with 3 holders holding more than 60% of the supply. The two largest holders hold few other tokens. The third largest holder is a farmer.
Source: GGP Token Top 100 Holders, Snowtrace, January 10 2025
The GGP token is owned 79% by one address , a 2/4 Multisig. 10% of the supply is owned by a second Safe of the same configuration with the third largest holder being a Vault.
2. Market Risk
2.1 Liquidity
Source: Odos Router ggAVAX to WAVAX, 9th January 2025
Liquidity for ggAVAX is good, with a $13M trade being handled with ~7% slippage.
2.1.1 Liquidity Venue Concentration
This liquidity is spread between a LFJ pool with $8M liquidity and a Pharoah V2 pool with $5M liquidity.
2.1.2 DEX LP Concentration
DEX LP concentration is not available. The LFJ pool is more active than the Pharaoh pool in terms of the frequency of ERC20s being sent and withdrawn, indicating potentially higher DEX LP fragmentation - though this may be a consequence of having a higher overall TVL. The usefulness of this indicator is reduced further with the consideration that Avalanche is a network with relatively low transaction fees, meaning rotating pools have little cost.
2.2 Volatility
Source: ggAVAX/wAVAX price chart, Coingecko Terminal, January 9 2025
ggAVAX has kept a tight ratio to the underlying price and has not experienced any prolonged depeg events. It has increased in price in a predictable, continuous manner (roughly 0.06% each month), reflecting its non-rebasing nature.
2.3 Exchanges
Source: ggAVAX, Coingecko, 9th January 2025
ggAVAX is available exclusively on decentralized exchanges. Four decentralized exchanges trade ggAVAX, with Pharaoh having the highest volume level.
2.4 Growth
Source: Staked AVAX, ggAVAX Stats, Flipside, January 10th, 2025
The total amount of AVAX staked in the protocol has consistently increased until a whale deposit in October 2024. Since then, the amount of AVAX staked has seen a decrease. Currently, ~1.1M AVAX are staked in the protocol.
3. Technological Risk
3.1 Smart Contract Risk
The protocol has been audited three times.
- Code4rena found 6 high vulnerability and 22 medium vulnerability issues in January 2023
- Zellic found 4 high severity and 1 medium issue in February 2023
- Kudelski found 1 high and 4 medium issues in November 2022
The fact that so many high-severity issues were detected by C4 after two audits indicates some degree of risk, as the number of problems detected should decrease with time, not increase.
This is compounded by the fact that MinipoolManager, MinipoolStreamliner, ProtocolDAO, Wrapper, and ArtifactHardwareProvider contracts use unaudited code in production. For example, Minipool Manager possesses significant differences from its last audit hash. This contract is critical coordination infrastructure for the protocol as it directly manages many minipool settings used to validate on the P chain.
Smart contract risk is, therefore, considerable.
3.2 Bug Bounty Program
GoGoPool has a $50K bug bounty program. All key contracts are in scope. The payout is in GGP. The protocol secures ~$60M TVL.
3.3 Price Feed Risk
The asset does not have a price feed from a 3rd party. Given the token is non-rebasing, the ratio of ggAVAX to underlying may be used. This may be queried using the convertToAssets() function in the ggAVAX contract.
Given this contract is upgradeable, with functions such as mint being able to be modified by the contract owners (Multisig Labs), it presents risk as a price feed.
3.4 Dependency Risk
This system introduces additional dependencies to Aave:
- Complete ownership of the asset is held with Multsig Labs (more in section 4).
- Reliance on unaudited code, which Aave is not normally tolerant of.
- High token holder concentration may result in difficulty liquidating the asset.
- The ggAVAX - Minipool staking system is complex in terms of both implementation and concept.
- Minipool operators who, while unable to access underlying AVAX, may act in a way counter to the best interests of the protocol - potentially reducing economic incentive.
Dependency risk is, therefore, moderate.
4. Counterparty Risk
4.1 Governance and Regulatory Risk
This asset possesses no governance risk stemming from a DAO. All functions are maintained exclusively by MultiSig Labs. This introduces significant centralization risk by having only one entity responsible for its operation and maintenance. Limited information is available about them online, though articles (specifically Form D) filed with the SEC are documented.
The Terms of Service lack a clear definition of the Platform, though contextual evidence suggests it refers to https://app.gogopool.com/ as the primary operational interface.
MultiSig Labs explicitly disclaims any obligations regarding buy-back mechanisms or redemption guarantees for the digital assets involved in the protocol operations.
According to the terms and provisions, the possession of ggAVAX tokens should be clearly distinguished from traditional securities or ownership instruments. Holders of such tokens do not acquire any proprietary interest, equity stake, profit-sharing rights, or other beneficial claims against MultiSig Labs. Furthermore, the token structure is not a capital contribution or investment vehicle for MultiSig Labs.
While MultiSig Labs maintains discretionary oversight authority regarding platform access and utilization, they do not assume a mandatory monitoring obligation. Nonetheless, they reserve the right to implement monitoring measures necessary for operational efficiency or regulatory compliance. The Platform’s adherence to various international and U.S. sanctions regimes is of particular significance, and it is a primary driver for their monitoring protocols.
ToS and any services provided under the Terms are governed by the laws applicable in the Cayman Islands. Under the Caymans Islands legislation, no restrictions or strict regulatory expectations are set at staking.
Counterparty risk, while unified into the hands of Multisig Labs, is significant. The lack of transparency in their organization introduces uncertainty and, therefore, risk.
4.2 Access Control Risk
ggAVAX is an EIP-1967 TransparantUpgradeableProxy, with a proxy admin contract whos owner is the Timelock contract. This Timelock contract is owned by the protocol Guardian 2/5 Safe, meaning only the Guardian can submit a transaction to the Timelock that owns the Proxy Admin Contract that owns ggAVAX.
In effect, the Guardian can submit transactions to the Timelock to upgrade ggAVAX, which must wait 24 hours. After that period, anyone can call Timelock.executeTransaction, which will complete the ggAVAX upgrade to the new implementation address. The last time the Guardian contract was used was on December 19, 2024.
4.2.1 Contract Modification Options
ggAVAX may modify any aspect of its contract by upgrading the owner or implementation.
4.2.2 Timelock Duration and Function
A 24-hour timelock is documented. It is owned by a 2/5 Safe.
4.2.3 Multisig Threshold / Signer identity
Multisig Labs entirely control the owner of this Safe.
Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.
