[ARFC] Onboard mWIN (Midas / Wellington Management) to Aave Horizon

[ARFC] Onboard mWIN (Midas / Wellington Management) to Aave Horizon

Summary

This ARFC proposes onboarding mWIN, a tokenised multi-sector actively managed fixed income portfolio managed by Wellington Management and issued by Midas, as collateral on the Aave Horizon instance.

mWIN provides institutional-grade exposure to an actively managed, fixed income portfolio optimized for yield, liquidity and low volatility. Borrowers on Horizon can utilize mWIN as highly liquid, yield-bearing collateral to execute leveraged carry (looping) strategies, supported by a multi-tiered redemption architecture. mWIN is already live on mainnet with $15M in TVL just a few days after launch, showing strong demand from borrowers and LPs.


Motivation

Horizon exists to give holders of tokenised real-world assets instant, 24/7 liquidity against those holdings while respecting issuer compliance requirements. mWIN extends Horizon’s collateral set into actively managed securitised credit, alongside the existing tokenised treasury and fund exposures.

Why mWIN fits Horizon

  • Institutional Manager: Wellington Management is one of the largest investment management firms in the world. Founded in Boston in 1928, Wellington manages over USD 1.3 trillion in assets across fixed income, equities, multi-asset, and alternative strategies, on behalf of thousands of institutional clients globally, including pension funds, sovereign wealth funds, insurers, and endowments.

  • Liquid & Low Risk Strategy: The portfolio is an investment-grade, diversified credit portfolio designed to balance yield generation, capital preservation, and structural liquidity. With an optimized duration profile to dampen volatility and low spread duration, it offers institutional-grade stability, minimizing mark-to-market drawdown risk in credit sell-off scenarios, while maintaining an average credit rating of A+.

  • Atomic Onchain Liquidity: Midas provides up to $30m of atomic onchain liquidity via MSL, of which $10m are dedicated to mWIN, enabling atomic redemption into USDC across market conditions. This is directly relevant to liquidation feasibility.

  • Institutional Legal Structuring: The strategy is issued through a legally segregated compartment of a Luxembourg securitisation fund. This statutory bankruptcy-remote structure isolates assets and liabilities, providing institutional-grade protection and legal clarity for tokenholders and lending markets.

There is significant demand from onchain funds across multiple parties for the looping use case. Depending on Horizon borrow rates being 150-200 bps lower than the strategy’s YTM, borrowers are targeting double-digit returns when looped 4x. In addition, due to the high organic liquidity provided, this strategy is also suited for unlooped yield optimization for treasury management purposes.

The strategy targets a resilient yield profile adaptable across the cycle, driven by dynamic allocation to asset classes depending on prevailing market conditions. The model portfolio generates a gross market yield of 5.23%, achieving a spread of c107 bps over the equivalent US treasury curve.


About the Manager: Wellington Management

Founded in 1928 and independently owned, Wellington Management is a leading global institutional asset manager with over $1.3 trillion in assets under management. Wellington’s dedicated Financial Reserves Management (FRM Team) manages over $200 billion in AUM, combining experienced portfolio managers, deep credit research, and proprietary risk analytics infrastructure. Wellington has decades of experience with this type of strategy, maintaining a long-standing track record focused on portfolios that appropriately balance risk and return. Notably, the mWIN strategy is run by the same institutional franchise that oversees portfolios for major insurance companies.

About the Issuer: Midas

Midas is a platform for composable onchain investment products and is the issuer behind mWIN, with over $4B in cumulative onchain asset issuance and $600M+ in current TVL, backed by a $50M Series A led by RRE and Creandum.

Midas’ mToken suite is already proven across leading venues, serving as an onchain issuer for institutional-grade strategies from managers such as Wellington Management and Fasanara Capital. Aave Horizon itself is direct proof of this track record: Midas’ mGLOBAL, tracking Fasanara’s alternative credit strategy, launched as collateral on Aave Horizon in June 2026, and its $30M supply cap filled almost immediately, showing strong, real institutional demand for Midas-issued RWA collateral within Aave ecosystem.

mWIN extends that same infrastructure, custody, and compliance framework to Wellington’s actively managed multi-sector fixed income strategy, giving Aave Horizon a natural path to onboard a second Midas-issued institutional credit product with an already-proven distribution and liquidity track record.


Strategy and Portfolio

The strategy is an institutional-grade actively managed fixed income strategy. Managed by Wellington Management’s Financial Reserved Management (FRM) team, the portfolio is designed to balance yield generation, capital preservation, and structural liquidity.

The strategy utilizes an active, multi-sector approach to deliver a resilient portfolio optimized for market conditions. The strategy invests into a diversified portfolio spanning some of the most liquid asset classes within public fixed income. The underlying assets include collateralised loan obligations (CLOs), commercial mortgage-backed securities (CMBS), agency and non-agency residential mortgage-backed securities (RMBS), asset-backed securities (ABS), and investment-grade corporate bonds.

By prioritizing dynamic risk management and broad diversification over static, single-sector concentration, it provides several distinct structural advantages:

  • Active risk management and dynamic sector rotation: Portfolio exposures are adjusted continuously based on macroeconomic data, liquidity constraints, and security fundamentals. During periods of market stress, the management team can tactically reallocate capital from deteriorating sectors into defensive positions.

  • Broad diversification: Drawdowns can originate from a wide spectrum of catalysts, including macro-driven liquidity shocks, structural regulatory shifts, or sector-specific credit events. Allocating across multiple fixed-income sectors mitigates single-asset concentration risk, dampens overall volatility, and ensures independent sources of liquidity during localized stress.

  • Optimized spread duration profile: The actively managed portfolio is structured to maintain a highly optimized spread duration profile. Single-sector portfolios are inherently more sensitive to spread widening events, experiencing meaningfully higher mark-to-market losses. The strategy’s structurally contained spread exposure makes it highly resilient for mandates where drawdown sensitivity is a primary concern.

Wellington Portfolio Parameters & Mandate

Item Detail
Strategy Multi-sector actively managed fixed income
Manager Wellington Management (FRM team)
Largest position / concentration limits Single issuer or issuing trust exposure for structured securities is capped at 5% of portfolio market value (excluding government or government agency guaranteed debt)
Leverage The portfolio does not allow for leverage
Portfolio risk limits Effective Duration: Limited to between 0 and 2 years at the portfolio level. Credit Rating & Quality: Maintained at an investment-grade weighted average credit rating; BBB/Baa capped at 50%, below-investment-grade capped at 10%, unrated capped at 10%. Currency Exposure: Non-USD denominated securities capped at 10% and must be 100% hedged back to USD
Fund size / AUM Current: $25M; expected: >$100M
Track record This custom strategy does not have a realised track record. Backtested annualised return: 5.66% over one year; 6.76% over 3 years; 3.75% from December 2016 to April 2026. The backtested returns assume a static allocation which does not reflect the dynamic portfolio optimisation depending on prevailing market conditions
Fees 40bps per annum management fee. No performance fee

Model Portfolio

Item Detail
Average credit rating A+
Effective duration ~1 year
Spread duration <2 years
Sector allocation CLOs: 40%; IG Corporates: 25%; ABS: 15%; Agency MBS: 10%; Non-Agency RMBS: 5%; CMBS: 5%
Rating distribution AAA: 5%; AA: 26%; A: 47%; BBB: 22%

Stress Behaviour

The drawdown analysis below covers the strategy managed by Wellington and the data is based on a simulated backtest. It excludes the 5% liquidity sleeve, which softens the impact shown in all the tables and metrics below. It should be noted that the analysis rests on a static allocation across asset classes based on the model portfolio and thus is not representative of the dynamic and active portfolio management underpinning the strategy.

The max one-day drawdown is limited to 2.7%. This is relevant given the daily liquidity of the underlying portfolio.

The largest drawdowns over the last 5 years based on the simulated backtest are shown below. This exercise is conservative as it suggests no active management on Wellington’s part to soften the impact of market moves:

Peak Trough Recovery Drawdown Days
2021-09-14 2022-10-20 2023-08-08 -7.79% 693
2025-04-03 2025-04-11 2025-04-28 -1.08% 25
2018-12-10 2018-12-20 2019-01-11 -1.01% 32
2026-02-27 2026-03-20 2026-04-14 -0.84% 46

In addition to the simulated backtest, Wellington has performed a forward-looking scenario analysis to evaluate the model portfolio’s resilience across a range of hypothetical macroeconomic, rate, and volatility shocks.

While severe shock scenarios may induce temporary price drawdowns, the portfolio’s starting carry ensures a projected recovery time of less than six months across all modelled events.

It should be noted that in a credit sell-off scenario, where spreads widen and the flows favour high quality assets, the Wellington portfolio is expected to outperform a pure CLO product.

Liquidity and Redemption

Item Detail
Atomic onchain liquidity 5% of the mWIN TVL sits in onchain tokenised treasuries redeemable atomically for USDC. Additionally, Midas provides instant liquidity redeemable in USDC via MSL (Midas staked liquidity pool), with $10M dedicated to mWIN. As mWIN TVL grows, Midas will also expand instantly redeemable capacity as well as introduce holdbacks, currently set at 0
Standard subscription flow Whitelisted investors can submit a subscription request at any time. The minting process is atomic, meaning investors instantly receive their mWIN tokens upon deposit at the latest available NAV onchain corresponding to the total subscription amount less any holdback. Assets are invested in the underlying portfolio as soon as practicable. If a holdback is applied, the investor receives the remaining tokens after the next NAV update such that the subscription price per token of the total subscription amount averages the token price after the NAV update. Currently the holdback is zero
Standard redemption flow The Fund processes standard redemptions on a daily basis for 100% of the NAV, with settlement of 1 business day if the request is made before the daily cut-off time of 1pm CET, subject to underlying asset liquidations having successfully settled
Redemption assets Redemptions are processed in USDC, PYUSD, RLUSD and other stablecoins if made available on the Midas website
Behaviour under stress The portfolio has been designed to allow for standard redemptions up to 100% of TVL in both normal and stressed market conditions. Similarly, atomic redemptions are expected to be available in both normal and stressed market conditions. However, in case of market disruption events, Midas may pause instant redemptions. Regarding standard redemption in extreme scenarios, Wellington optimizes the sale of assets to balance time, slippage, and costs. Backed by a wide network of counterparties, Wellington is well-positioned to liquidate positions efficiently across various market conditions
Historical redemption performance To date, no redemptions have been rejected or experienced delayed settlements

Technical Specification — Token

Item Detail
Token name / symbol mWIN
Contract address 0x4E72025984424E52838cf8953E2863eFf036B67A
Chain Ethereum mainnet
Decimals 18
Token standard Standard ERC-20 token
Supply mechanics mWIN has an issuer-controlled mint/burn mechanism. There is a minting cap of $20M per day enforced at the Minter vault smart contract level
Transfer restrictions mWIN requires both the sender and recipient of any transfer to be included on the mWIN greenlist. In addition, after the transfer, each party must hold either zero tokens or at least one token. This model is compatible with Horizon’s non-transferable aToken model
Proxy / upgradeability Proxy Type: Standard OpenZeppelin upgradeable proxy pattern. Upgrade Authority: The ProxyAdmin contract (0xbf25b58cB8DfaD688F7BcB2b87D71C23A6600AaC) is owned by the TimelockController (0xE3EEe3e0D2398799C884a47FC40C029C8e241852), which is ultimately governed by the Midas Proxy & ACL Admin Safe (0xB60842E9DaBCd1C52e354ac30E82a97661cB7E89). While the top-level Safe threshold is nominally 1-of-3 for infrastructure redundancy, every signer is an independent, nested quorum-protected system requiring an effective minimum of at least 3 distinct individuals to execute any action. This includes a Fordefi MPC (4-of-7), a Fireblocks MPC (4-of-7), and the Team Signer Safe (0x82B30194bEae06D991Bc71850F949ec8cB7E0CB7, 3-of-7). Safe wallets are being migrated to an elevated 4-signer minimum threshold in Q3 2026, supported by new hardware from diversified vendors. Timelock Delay: A mandatory 48-hour delay is hardcoded and enforced for all contract upgrades
Verified source Token: Address: 0x4E720259...Ff036B67A | Etherscan — Aggregator: Address: 0x1725A66D...71dA19517 | Etherscan — Data Feed: Address: 0xa27c1658...6A0ea4077 | Etherscan — Deposit Vault: Address: 0xF7F1b944...2eB667db4 | Etherscan — Redemption Vault Swapper: Address: 0x605704d7...5523c7924 | Etherscan — Redemption Vault mToken: Address: 0x14fECa41...706709fca | Etherscan

Oracle and NAV

Item Detail
NAV source The gross value of the Wellington Strategy is calculated by Northern Trust. When computing a new price for the token, the NAV is calculated by Midas aggregating: the independent NAV as provided by Northern Trust in the daily report (notarised onchain by the Attestation Engine); the onchain verifiable tokenised T-bills; in-flight assets and any idle assets held within the portfolio, such as USDC recently received; and applicable fees
NAV publication frequency Every business day
Onchain feed Chainlink Data Feed delivering LlamaGuard-validated NAV
Feed address Aggregator: Address: 0x1725A66D...71dA19517 | Etherscan — Data Feed: Address: 0xa27c1658...6A0ea4077 | Etherscan — Chainlink oracle currently in development
Heartbeat and deviation threshold healthyDiff: 2,592,000 (30d); maxExpectedAnswer: 150,000; minExpectedAnswer: 129,000
LlamaGuard bounds To be configured by LlamaRisk; Parameter Registry updated via the Horizon operational multisig
Proof of Reserve / attestation The Midas Attestation Engine runs a daily Chainlink CRE workflow to confirm the overcollateralization of mWIN. The attestation is verified independently by Canary. See midas.app/mwin

Privileged Roles

Role Detail
DEFAULT_ADMIN_ROLE 0xB60842E9DaBCd1C52e354ac30E82a97661cB7E89 — Midas Proxy & ACL Admin Safe. The top-level Safe has a nominal 1-of-3 threshold for infrastructure redundancy; however, each of its three signers is itself an independently quorum-protected system, requiring an effective minimum of at least three distinct individuals: Fordefi MPC (4-of-7 quorum), Fireblocks MPC (4-of-7 quorum), Team Signer Safe 0x82B30194bEae06D991Bc71850F949ec8cB7E0CB7 (3-of-7 quorum). Also 0xd4195CF4df289a4748C1A7B6dDBE770e27bA1227 — Access Control Admin, secured by a Fordefi MPC policy requiring a 4-of-7 signer quorum. No timelock currently applied; a new contract iteration introducing timelock functionality is undergoing audit
M_WIN_MINT_OPERATOR_ROLE 0x20D4CeD0EFac28517C1b0a06F98B1180F28f5125 — mWIN Management Vault, 4-of-7 Fordefi MPC policy, used for manual and OTC mints via the backoffice interface; transactions presented as plain-text summaries, cross-checked against independent portfolio spreadsheets, verified via private Slack channels prior to execution. Also 0xF7F1b944FCDe7805F6Ef3088817145d2eB667db4 — mWIN depositVault. No timelock currently applied; new iteration undergoing audit
M_WIN_BURN_OPERATOR_ROLE 0x76e350c5a674db787918e5f728466c7356d4d361 — mWIN Management Vault, 4-of-7 Fordefi MPC policy, used for manual and OTC burn/redemption operations via the backoffice interface, same verification process as above. Also 0x605704d7b36d1677a8d242ded68eD505523c7924 — mWIN redemptionVaultSwapper; 0x14fECa41FB9541Fd8f61a6bA6304c5b706709fca — mWIN redemptionVaultMToken. No timelock currently applied; new iteration undergoing audit
M_WIN_PAUSE_OPERATOR_ROLE 0x20D4CeD0EFac28517C1b0a06F98B1180F28f5125 — mWIN Management Vault. Emergency pause functionality includes a single-signer fast path, accessible through either the backoffice interface or a block explorer, enabling immediate protocol containment when required. Unpausing requires a manual quorum of 3 core signers. No timelock currently applied; new iteration undergoing audit
M_WIN_CUSTOM_AGGREGATOR_FEED_ADMIN_ROLE 0x532FEDcF5837f411646c230CF9b743dFdD0692d3 — mWIN Oracle Admin Vault. Differentiated quorum requirements: setRoundDataSafe requires 2 signers (includes a maximum deviation guardrail and a 1-hour cooldown), while setRoundData requires the standard 4-signer quorum. No timelock currently applied; new iteration undergoing audit
Greenlist/Blacklist Governed by the DEFAULT_ADMIN_ROLE and operationally executed through the Fordefi MPC policy. Greenlisting an address requires a 2-signer quorum; blacklisting requires the standard 4-signer quorum. No timelock currently applied; new iteration undergoing audit

Audits and Security

Item Detail
Audits Midas runs constant audits for releases performed by external auditors. Last audit: 6/7/2026. Reports: docs.midas.app/resources/audits
Outstanding findings Neither critical nor high findings were found in the current codebase
Bug bounty Midas maintains dual active bug bounty programs hosted via Cantina and Sherlock with max rewards up to 500,000 USDC
Incident history Due to Midas’s in-depth defence and layered security architecture, no major incidents have happened in the past
Change notification Midas confirms its commitment to pre-notify Aave and LlamaRisk of material contract or structural changes

Dependencies

The only hard external dependencies for mWIN are Wellington Management (Portfolio Manager) and Northern Trust (Custodian). Additionally, the Issuer relies on Midas Software GmbH as the provider of the technical and smart contract infrastructure, vLayer & Chainlink for the onchain oracle infrastructure, as well as off- and on-ramping providers for fiat conversions. A failure in these latter operational layers could temporarily disrupt onchain price feeds, minting, or instant redemptions, but the underlying assets would remain fully insulated within the statutory bankruptcy-remote vehicle. Ernst & Young acts as the external auditor of the Securitisation Fund.

Legal and Structural

Item Detail
Issuing entity and jurisdiction The issuer is the Compartment mWIN of the Aureum Securitisation Fund in Luxembourg
Fund structure The Aureum Securitisation Fund operates through legally segregated compartments, each of which constitutes a separate estate by law. Assets and liabilities of a given compartment are fully ring-fenced from all other compartments, the management company, the originator or sponsor, and any other related parties. Tokenholders therefore have exclusive and limited recourse to the assets of the specific compartment backing their notes, and are insulated from any insolvency or distress elsewhere in the structure. The issuance is therefore statutory bankruptcy-remote
Regulatory status The Aureum Securitisation Fund is an unregulated securitisation fund (fonds de titrisation non réglementé), registered with the Luxembourg companies and business register under number O136, subject to the Luxembourg act dated 22 March 2004 on securitisation, as amended (the Securitisation Act 2004)
Investor eligibility mWIN is a fully permissioned token available to whitelisted institutional and eligible investors. The initial subscription requires a minimum of 1 token bearing an Authorised Denomination and initial value of $130k. Beyond 1 token, fractional holdings are permitted. Investors must complete Midas’s identity verification (KYC/KYB) and compliance checks to have their wallet address whitelisted
Insolvency treatment The statutory bankruptcy-remote structure on which tokenholders have sole claims is supported by a legal opinion from Allen & Overy confirming that investors are protected from the insolvency of the issuer and other Midas entities
Allowlist administration The allowlist (whitelist) is legally administered by the Issuer (the Aureum Securitisation Fund acting on behalf of Compartment mWIN). Operationally, the KYC/KYB and compliance onboarding process is facilitated by Midas Software GmbH. Once an investor is approved by the Issuer, their wallet addresses are added to the onchain whitelist via the Midas Proxy & ACL Admin Safe, utilizing a Fordefi MPC policy

Liquidations

Liquidators must be allowlisted at the token level to receive mWIN collateral. Horizon does not select or whitelist liquidators; eligibility is controlled by the issuer.

Item Detail
Eligible liquidators Eligible onboarded liquidators that Midas can publicly disclose include Keyrock, Dialectic, Vault Street, Metalayer, Fission, and Midas. Midas itself, through MSL, is also a liquidator with $10M of dedicated capacity
Liquidation facility The onboarded liquidators have a capacity of more than $100M per week. Midas liquidity capacity of $10M per day is visible onchain, as it would be cycled using T+1 standard redemptions to process more liquidations if needed
Onboarding path for new liquidators Any party interested in being a liquidator can reach out to Midas through the mWIN page “Get Access” button and will be invited to fill out onboarding forms; onboarding can occur within a few days. Midas is actively engaged with more liquidators and can share that new liquidators are currently being onboarded. Midas is also integrating mWIN into the Symbiotic RFO system for increased onchain liquidity
Expected liquidation route The expected liquidation route is for liquidators to use standard redemptions, as indicated by liquidators themselves. Economically, this is the best route to capture the full upside of a liquidation while taking limited risk due to the low volatility of the asset, its max daily drawdown risk, and high liquidity. Instant redemption is also possible for liquidators wishing to redeem instantaneously following liquidation

Risk Assessment

LlamaRisk is conducting the independent risk review of mWIN, covering the legal structure and the market/portfolio analysis. Their report, including the recommended risk parameters, will be published in this thread ahead of any Snapshot vote.


Specification

Risk parameters for mWIN will be specified by LlamaRisk in their published risk report and reflected here prior to escalation.


Useful Links


Disclaimer

This proposal is presented by Midas Software GmbH (“Midas”), on behalf of Aureum Securitisation Fund, acting in respect of Compartment mWIN. Midas confirms that it has no commercial relationship with Aave Labs.

This proposal, together with any related marketing, technical, or explanatory materials, is provided for informational purposes only. Nothing herein constitutes an offer to sell, or a solicitation of an offer to buy, securities or other financial instruments in any jurisdiction, nor does it constitute investment, legal, tax or financial advice.


Next Steps

  1. Gather community and delegate feedback on this ARFC.

  2. Publication of the LlamaRisk risk report and recommended parameters.

  3. Technical review of the listing payload.

  4. Escalation to Snapshot, and if passed, to AIP for onchain execution.


Copyright

Copyright and related rights waived under CC0.

2 Likes

Posting this before the risk report rather than after it, because the parameters aren’t set yet and these are the questions I’d want answered as a supplier on the other side of them.

Disclosure first: no commercial relationship with Midas, Wellington, Aave Labs or LlamaRisk. I spend my time marking illiquid private positions and I read this proposal as someone who has had to defend an NAV rather than just consume one.

The structure here is genuinely well documented – Luxembourg compartment, ring-fenced, Northern Trust computing the strategy NAV, EY auditing, daily redemption at 100% of NAV, an attestation verified by an independent party. My questions are narrower than the structure: they’re about what the market does on the days the NAV can’t be trusted to be current.

1. Staleness tolerance versus publication frequency. The feed publishes every business day, and the oracle’s healthyDiff is set to 30 days. What is the intended behaviour between day one and day thirty of a missed update – does borrowing and liquidation continue against a NAV that may be up to a month old? And on day thirty-one, when the tolerance is exhausted, what is the intended state of the market? The Technical Asset Listing Framework requires a feed to remain within its expected heartbeat and deviation threshold, or that any deviation from expected parameters be explicitly justified. What is the justification for a thirty-day tolerance on a feed that publishes daily?

2. The bounds, and what happens when one is hit. minExpectedAnswer is 129,000 and maxExpectedAnswer is 150,000, against an Authorised Denomination of $130,000 per token – 0.8% of headroom below the issue value and 15.4% above, asymmetric by a factor of twenty. That is conventional on one side and very tight on the other for a sanity bound, and two consequences follow at different times. On the downside, an NAV print 0.8% below issue value is already at the edge of the band, which is well inside the ordinary variation of a portfolio with roughly one year of effective duration and 22% BBB. On the upside, an income fund compounding at anything near its target reaches 150,000 within a few years, after which every update is outside the band. Is there a review trigger attached to these values, or a rule that moves them as NAV accrues?

The consequence of a breach then depends on which layer catches it, and the two behave in opposite directions. Horizon’s documentation describes bounds configured per RWA feed at the DON level, where a reported NAV outside them means the DON rejects the update and the oracle continues to report the last known valid price, with the emergency multisig preventing new originations. The Midas data feed contract at 0x1D0CB5685791F6E9ABc1B876E3b9017F8aa1807c reverts with “DF: feed is unhealthy”. Rejecting an update leaves the market open against a stale price; reverting closes it. Which governs here, and which is intended?

3. Discount, or no discount. The feed is described as delivering validated NAV. Is the collateral price the raw NAV, or NAV less a haircut? For context, when another Midas mToken was onboarded elsewhere as collateral, the curator applied a 7.7% discount to the NAV feed and set the liquidation threshold so that NAV could fall about 6% before lenders faced bad debt. If the intended buffer here sits entirely in the LLTV rather than partly in the oracle, it would be useful to see that stated, because the two are not equivalent in a fast move.

4. Liquidation under permissioned exit. Liquidators must be allowlisted at token level by the issuer, and the named set is six parties. Their exit is daily redemption at NAV, 1pm CET cutoff, T+1 settlement, with instant redemption capped at $10m plus roughly 5% of TVL in treasuries – and the proposal states instant redemptions may be paused in market disruption events. So a liquidator is taking overnight NAV risk on a token they cannot freely sell, in exactly the conditions where the pause is most likely to happen. What liquidation bonus is that assumed to compensate, and what is the assumed liquidator capacity when instant redemption is paused?

5. Continuity of the mark. The proposal names Wellington and Northern Trust as the only hard external dependencies. What happens if one of them gives notice? Specifically: is there a notice period, a fallback valuation source, and does the market wind down in an orderly way or simply stop updating? This is the question I’d press hardest, because this year already produced an onchain yield token that lost its peg after its verification provider ended the agreement, leaving a fully drawn market with no exit. The assets being bankruptcy-remote protects the assets; it doesn’t protect a lender whose collateral has stopped having a price.

Two smaller notes, neither of them a question about risk. The proposal cites $15m TVL for mWIN; current Ethereum supply is 195.82 tokens across five holders, which at the Authorised Denomination is roughly $25.5m before any NAV accretion – is the $15m figure a different measure, or has it moved since drafting? And on scope rather than criticism: Midas publishes fourteen audit reports, the closest to this surface being Sherlock’s Growth Oracle review of August 2025 and the vault strategy integration review of March 2026, so the values above are deployment configuration rather than audited code and no published report speaks to them.

None of these are objections to onboarding. These are the five things I would want the risk report to answer explicitly, and the last of them is the lesson this market was taught the hard way earlier this year.

2 Likes

I think the risk case is using the wrong number. The proposal highlights a 2.7% maximum one-day drawdown and scenarios that recover within six months. But its own backtest shows a 7.79% drawdown from 14 September 2021 to 8 August 2023: 693 days to recover. That is the period a 4x looped position would actually have needed to survive.

For me, that points to the supply cap. The dedicated MSL liquidity starts at $10m and may grow with mWIN TVL, but that growth is not guaranteed. Holdbacks are currently zero, and instant redemptions can be paused during market disruption. Aave therefore should not assume redemption capacity beyond the liquidity that is firmly committed.

I would set the initial cap at roughly $10m plus the 5% treasury allocation. Any increase could come in the same AIP as an increase in dedicated MSL liquidity. With only 195.82 tokens currently supplied on mainnet, that would not constrain existing demand.

An automatic cap reduction if holdbacks rise or redemptions are paused could also work. Lowering LLTV enough to discourage 4x looping would address the risk too, but it would also undermine much of the demand case for the asset.

The simplest principle is that Aave’s exposure should grow only when the committed liquidity behind it grows.

4 Likes

Agreed on the number, and I think it reaches further than the cap.

If a 7.79% drawdown over 693 days is the scenario the risk case has to survive, this oracle cannot currently represent it. minExpectedAnswer is 129,000 against an Authorised Denomination of $130,000, so the floor sits 0.8% below issue value, and a fall of that size prints far outside the band. The market does not liquidate into that drawdown; depending on which layer catches it, it either runs on the last valid price or stops. I set out the arithmetic on the hINC thread, where the same question arrived from the other direction: the band can only express its own worst disclosed drawdown once NAV has accrued about 7.6% above issue, and only until it reaches the 150,000 ceiling.

So I would put the two asks together. A supply cap tied to committed liquidity is right. I would add that the oracle band has to be able to represent the drawdown the cap is being sized against, or the cap governs a scenario the feed cannot report.

The 693 days is the part I would carry into the continuity question as well. healthyDiff is 30 days. If the position that has to survive is measured in hundreds of days, the binding question is not just whether the liquidity is committed for that long, but whether the mark is still being published for that long, and what the market does on the thirty-first day if it is not.

Hi @aksenovd10, thank you for the detailed feedback and analysis on our proposal. We have gone through each of your points, and wanted to provide clarity and context on our side:

  1. The 30-day healthyDiff is the default tolerance used across Midas feeds. While it is configured in production, it should not be interpreted as an acceptable operating staleness for the NAV. If Midas had any concern around the freshness or validity of the price, minting and redemptions would be paused to prevent investors from entering or exiting at an outdated price.
    For Aave specifically, the market will rely on a Chainlink oracle, with the relevant staleness parameters defined by LlamaRisk as part of the Aave risk configuration. The 30-day healthyDiff on the Midas feed therefore does not represent the effective staleness tolerance of the Aave market.

  2. These are baseline bounds and can be adjusted over time as the NAV evolves. The downside bound is intentionally tighter given the quality and expected volatility of the underlying portfolio, while the upside bound was set with more headroom to avoid having to update it too frequently, with the expectation that it would typically be reviewed roughly every two years.
    The bounds of the Midas data feed can be updated through a function in the smart contract. If the reported price falls outside of the configured bounds, the Midas datafeed reverts and is considered unhealthy. This would temporarily pause the primary market until we readjust the bounds via admin functions.
    For Aave specifically, the behaviour of the Chainlink oracle when these conditions are triggered will depend on the implementation and parameters defined by LlamaRisk.

  3. We believe it will be clarified by Llamarisk in the Risk Report shortly.

  4. The liquidators that we have onboarded understand the overnight NAV risk and are willing to accept it in compensation of the liquidation bonus. The liquidators are therefore assumed to submit a standard redemption request, even if they can theoretically also use the instant redemption path if available.

  5. Both Northern Trust and Wellington are regulated, licensed institutions (Northern Trust as a Luxembourg credit institution, Wellington as an FCA-authorised investment manager). The IMA with Wellington requires 30 days’ prior written notice to terminate, and our custody agreement with Northern Trust requires 90 days’ prior written notice. Beyond the contractual notice period, regulated financial institutions of this size are expected to facilitate an orderly handover for reputational and regulatory reasons. If contrary to expectations, we ever have to replace either counterparty, investors would be notified as soon as practically possible.
    Moreover, the assets in the portfolio are public fixed income securities, meaning that there are public prices for these assets. We currently have two sources of pricing: Wellington and Northern Trust. We use Northern Trust data as the main input for our NAV due to Northern Trust’s independence from the investment manager. However, fallback solutions are there and in particular, we can use Wellington’s data as well.

1 Like

Hey @cedricbrown, it’s a fair point to raise, so wanted to clarify the distinction here:

The 693 days period is the time the actual max drawdown took to materialize, not the recovery period. Given the daily liquidity of the portfolio, we complemented this metric by the highest one-day drawdown of the portfolio from the static backtest. The key caveats of this analysis are that the model portfolio allocation is assumed to remain stagnant over time, meaning we are not taking into account the benefits of active management.

In contrast, the recovery periods refer to a forward-looking shock analysis performed by Wellington using its internal risk engine under several hypothetical market shocks, including scenarios created by the investment team. We believe this type of forward-looking shock analysis is a relevant additional lens for evaluating portfolio risk than historical back-testing, better allowing us to assess how the portfolio may respond to a range of plausible macroeconomic, rate, spread, and volatility scenarios from today’s starting point. From this analysis, we derive that despite periods where the model portfolio could experience negative price returns due to drawdowns, thanks to the portfolio’s starting level of carry, the recovery time from these drawdowns is less than 6 months across all scenarios.

Thank you – that answers most of it, and the continuity detail on notice periods and the Northern Trust / Wellington fallback is exactly what belongs in the final AIP.

Points 1, 3 and 5 are closed for me. 4 makes sense as well. On 2, one thing to carry into the LlamaRisk report rather than back to you: if the bounds are adjustable by contract function, then a print outside the band is resolved by a decision – whose, and on what trigger – rather than by the feed. That is the assurance question in one line, and it matters most on the downside, where the current floor sits 0.8% below issue value against the proposal’s own 7.79% backtest drawdown. The risk report is the right place for both, and I’ll happily read it when it lands.

Appreciate the point-by-point response. :saluting_face:

Summary

LlamaRisk supports onboarding mWIN onto the Aave Horizon market at the parameters recommended in this review. mWIN is a debt note issued out of a Luxembourg securitisation compartment. Luxembourg law keeps the compartment’s assets separate from the rest of the vehicle, and the management company is held by the Midas Purpose Trust in Jersey, so there is no corporate parent. The note tracks a Wellington-managed multi-sector securitized-credit portfolio whose asset-backed line is held entirely in collateralized loan obligation tranches, alongside agency and non-agency mortgage paper and investment-grade corporates. One token is one note at the USD 130,000 Authorised Denomination. Northern Trust strikes net asset value daily as official pricing agent.

The most probable way the book loses value is through widening credit spreads. Collateralized loan obligations made up 56.0% of the live book on August 26, 2026, the book loses roughly 2.6% of value for every 100 basis points of spread widening, and in response to LlamaRisk’s suggestion Wellington has agreed a 4-year cap on that sensitivity. Also worth noting is that the largest investor holds roughly 31.2% of supply, the two largest 54.2% and the three largest 72.7%, so redemption pressure and any liquidation event concentrate on a few positions in the early bootstrapping phase of the asset.

We recommend a 67% maximum loan-to-value ratio, a 72% liquidation threshold, an 8% liquidation bonus, and an initial 80 mWIN supply cap worth roughly $10.5 million at the live net asset value.

I. Legal Risk

The legal analysis in this section draws on offering and structuring materials that Midas and Wellington shared with LlamaRisk under a non-disclosure agreement and that LlamaRisk reviewed without concern, including the mWIN Information Memorandum, the Aureum tokenization overview and structure chart, and the mWIN subscription and redemption note.

1.1 Jurisdictional Compliance

The issuer, the notes, the subscription agreement and the constitutional documents are all Luxembourg-law governed with exclusive jurisdiction in the courts of Luxembourg-City (mWIN T&Cs, §19 p. 24; Subscription Agreement §11 p. 4; GMR §18 p. 18). The Investment Management Agreement is English-law governed, which is market-standard for a UK manager and does not disturb the Luxembourg situs of the issuer.

The regulatory-perimeter strategy is to remain an unregulated securitisation fund by avoiding a public, continuous offering. Under the Securitisation Act 2004, a securitisation undertaking that issues financial instruments to the public on a continuous basis — more than three times per financial year across all compartments — falls under CSSF authorisation and supervision (A&O Memorandum §5.1(d) p. 7). An issuance is not “to the public” where it is directed at professional clients only, or where the denomination is at least EUR 100,000, or where it is a private placement — read cumulatively (A&O Memorandum §5.1(d) p. 7). mWIN is designed to satisfy the professional-client and high-denomination limbs simultaneously: subscription is restricted to professional clients within the meaning of the Banking Act 1993, the Authorised Denomination is USD 130,000, and the notes are placed privately(mWIN T&Cs, Definitions p. 6, and Subscription Agreement §5(c) p. 2). The same features keep the notes outside the Prospectus Regulation via the EUR 100,000-per-investor exemption of Article 1(4)(d), and outside PRIIPs, which is triggered by offers to retail investors (A&O Memorandum §5.3 pp. 9–10).

The notes are characterised as profit-participating, pass-through, limited-recourse debt instruments and as transferable securities within the meaning of MiFID II (Annex I, Section C), not as equity, partnership interests or fund shares (mWIN T&Cs, §2.2(d) p. 12; LlamaRisk DDQ Q8; Midas Technology Agreement, Recital (A) p. 1). This is a defensible characterisation for a Luxembourg securitisation note and is consistent with the tokenisation being treated as a mere form of the register rather than a distinct instrument. Because the offering is a professional-only private placement, no EU securities-prospectus classification issue arises on the primary distribution. The tokenisation itself is legally feasible in registered form: Luxembourg’s DLT laws of 2019–2024 address dematerialised/book-entry securities, but for registered securities the statutory register regime (Articles 470-1 to 470-19 of the Companies Act 1915) may be, and here is, contractually waived under Article 100-14, leaving the register to be maintained on a DLT ledger with transfers made effective against the issuer through an issuer-controlled validation function consistent with Article 1690 of the Civil Code (A&O Memorandum §5.4 pp. 11–13; mWIN T&Cs, §2.2(b) p. 12).

The active-management characterisation should be verified against Article 61-1 of the Securitisation Act 2004. The A&O memorandum states that “the Midas SF will… not actively manage the assets in its portfolio” and that active management occurs “at the level of the issuer of the Underlying Securities” (A&O Memorandum §5.1(e) p. 7). The executed structure is different: Wellington actively manages the compartment’s own portfolio directly, as agent of the management company (SMR §§3.2, 4.1–4.2 p. 6). Article 61-1 does permit a securitisation undertaking to hold an actively-managed pool of debt securities, provided the financial instruments financing that pool are not offered to the public — which is the very reason the professional-only, private-placement posture is load-bearing here. The legal conclusion is therefore likely unchanged, but the memorandum’s factual premise is not the executed one, and a confirmatory view on Article 61-1 as applied to the actual mandate would be prudent.

On inquiry, Midas confirmed its treatment of this point. It relies on Article 61-1, which permits a securitisation undertaking to securitise an actively-managed pool of risks — including a pool managed by a third party — provided the pool consists of debt securities, debt financial instruments or claims and the financial instruments financing it are not offered to the public. Midas explains that the memorandum’s wording is imprecise rather than indicative of a different structure. The passage addresses two questions: the active management of the CLO notes themselves, and the active management of the allocation across CLO notes. Both are permitted, whether carried out by the vehicle or by a third party such as Wellington (Midas comments, September 2026). The operative provision is the one the memorandum itself sets out: “For further information, in accordance with article 61-1 of the Securitisation Act 2004, the Midas SF remains able to securitise a pool of risks, consisting of debt securities, debt financial instruments or claims, which is actively managed by the securitisation undertaking itself or by a third party, provided that the financial instruments issued in order to finance the acquisition of this pool of risks are not offered to the public” (A&O Memorandum §5.1(e) p. 7). Applied to the executed structure, each element is satisfied. The pool consists of debt securities. Wellington’s third-party active management is within the forms of management the provision contemplates. The financing instruments are not offered to the public, because subscription is restricted to professional clients at the USD 130,000 Authorised Denomination — the posture this section already identified as load-bearing. The active-management characterisation therefore resolves in the structure’s favour on the provision’s own terms.

1.2 Bankruptcy Remoteness

A Luxembourg securitisation fund is a co-ownership of assets without legal personality; ordinary corporate insolvency proceedings and their associated suspect-period (“période suspecte”) claw-back rules do not apply to the fund or its compartments, which are instead subject to the special liquidation regime of the Securitisation Act 2004 (A&O Memorandum §5.1(c) pp. 5–6). Each compartment forms “a distinct and independent part of the SF’s estate,” is segregated from other compartments and from the fund’s general estate, may be liquidated separately, and investors have recourse only to the assets of the compartment to which their instruments were issued (A&O Memorandum §5.1(a) pp. 4–5; GMR §§3.3–3.7 pp. 5–6; SMR §§2.2, 5.1 pp. 6–7). These features are not merely contractual: the memorandum confirms that ring-fencing, priority of payments, subordination, non-seizure and non-petition are “expressly recognised by the Securitisation Act 2004,” and that proceedings brought in breach of them will, in principle, be declared inadmissible by a Luxembourg court (A&O Memorandum §5.1(c) p. 6).

The limited-recourse and non-petition covenants are embedded consistently across the documents. Each investor acknowledges recourse only to compartment assets “remaining after satisfaction in full of the claims of the Unitholders,” accepts that its claim is extinguished once those assets are realised, and agrees not to seize compartment assets or petition for winding-up (mWIN T&Cs, §8.2 p. 20; Subscription Agreement §9 p. 4; SMR §§9.1–9.3 pp. 6–7; GMR §17 p. 18). Because the management company is held by the Midas Purpose Trust, an entity with no economic interest in the underlying assets, the memorandum concludes that the fund’s bankruptcy remoteness is “further reinforced,” minimising the risk that the fund could be affected by the financial condition of, or shareholder decisions within, the wider Midas group. The reliance on the A&O opinion for the bankruptcy-remoteness and regulatory conclusions carries two caveats beyond the Article 61-1 active-management point in §1.1. First, the opinion is a non-reliance instrument. It is dated March 31, 2026 is given “for the sole benefit of Midas,” and states expressly that it “may not be relied upon, referred to, quoted” by any other person, so any party disclosed a copy receives it “on a non-reliance basis” and “shall not be entitled to rely on” it (A&O Memorandum, date and reliance clauses). Neither Aave, noteholders nor a collateral-taker is an addressee. Second, its factual basis is not the executed deployment. The opinion assumes the notes are “deployed on the Solana blockchain network” following “the Token-2022 standard,” at an authorised denomination of “1.00 US Dollar each,” linked to “certain, triple AAA-rated, collateralised loan obligations” (A&O Memorandum, factual-assumptions section). The live mWIN is deployed on Ethereum as an mTokenPermissioned ERC-20 (§3.1), carries a USD 130,000 Authorised Denomination (§1.1), and is backed by a multi-sector Wellington investment-grade book that is 40% collateralised loan obligation rather than a single triple-AAA CLO tranche (§2.10). The bankruptcy-remoteness and regulatory-perimeter conclusions turn on Luxembourg securitisation law rather than on the chain or the exact underlying, so the mismatch is unlikely to change the substantive result. It does mean the opinion in hand does not opine on the facts as executed. LlamaRisk recommends a confirmatory opinion on the live Ethereum deployment, the USD 130,000 denomination, and the multi-sector underlying, addressed on a basis a Horizon participant can rely on, before the legal-wrapper condition (condition 8, §3.9) is treated as cleared (A&O Memorandum §5.1(c) p. 6).

Midas has responded to each of the three mismatches between the opinion’s assumptions and the live deployment. On chain selection, it states that substance governs form: any blockchain may be used. The conclusions depend on the notes being registered on a DLT ledger rather than on which ledger (Midas comments, September 2026). On the USD 130,000 Authorised Denomination, Midas explains that the figure is the standard device under the Securitisation Act 2004 and the Prospectus Regulation, set above the EUR 100,000 threshold so that the offer is not a public offer requiring a prospectus — the same perimeter mechanism described in §1.1. On the multi-sector underlying, Midas states that sector composition is not legally material. What matters is the character of the underlying assets as debt securities and the Article 61-1 active-management condition addressed in §1.1.

The ranking of the notes within the compartment should be taken into consideration. On capital, the notes are senior to the units: Article 64(1) of the Securitisation Act 2004 and the General Management Regulations subordinate units to instruments and loans, and the SMR provides that “the Units shall in no event be redeemed as long as the Notes are outstanding” (GMR §§6.10, 11 pp. 9, 15; SMR §7.5 p. 10). But on the ongoing income waterfall the position reverses in a limited way: the T&Cs state that the notes “rank subordinate to the Units in the Priority of Payments,” and the Priority of Payments pays, in order, all Costs, then a fixed Unit Distribution Amount, then (in the T&Cs) portfolio rebalancing, and only then the notes (mWIN T&Cs, §3 p. 13, and Definitions “Priority of Payments” pp. 8–9; SMR §5 p. 6). The Unit Distribution Amount is a fixed USD 42 per Distribution Date payable to the orphan (SMR, Definitions “Unit Distribution Amount” p. 6), so the economic leakage ahead of the notes is de minimis in cash terms. The more meaningful subordination is to “Costs,” a broadly defined waterfall item that captures the management fee, Wellington’s investment-management fee (which combined amount to 0.6% management fee), custody costs, liquidity-facility interest and general operational costs — all of which rank ahead of any payment to noteholders (mWIN T&Cs, Definitions “Costs” pp. 5–6). The notes are, in substance, the residual income claim of the compartment.

Article 3.4 General Management Regulations permits the management company, in its sole discretion, to allocate the claims of “Non Compartment-Specific Claims Creditors” , including holders of fund units and general fund creditors , pro rata across compartments on a half-yearly basis, where the relevant compartment documentation expressly authorises such recourse (GMR §3.4 p. 6). Nothing reviewed in the mWIN T&Cs or SMR appears to grant such authorisation, so mWIN should be insulated from general fund-level liabilities. Midas has since confirmed that there is no provision allowing cross-compartment recourse (Midas follow-up responses, July 2026).

Although the memorandum observes that the structure needs no pledge over the underlying assets (A&O Memorandum §5.1(c) p. 6), the custodian has in fact taken one. Under the Master Custody Agreement, the fund pledges “all Assets held now or in the future with the Custodian” as first-ranking security for all obligations owed to Northern Trust, enforceable on the custodian’s own conclusive determination of an event of default, without prior notice, by self-valuation and appropriation, and even where the value of the pledged assets exceeds the secured obligations (Northern Trust Custody Agreement, §§15.1, 15.10–15.12). A parallel continuing pledge secures unpaid custody fees (Northern Trust Custody Agreement, §23.7). This is a claim that ranks structurally ahead of the noteholders on the compartment’s principal asset. In ordinary course the secured obligations are modest (custody fees and the like), but the pledge is a live senior encumbrance that should be sized, monitored and disclosed.

1.3 Title and Ownership Structure

Legal title to the underlying portfolio does not sit with noteholders. Investors hold a contractual, limited-recourse claim against the issuer and “no direct right in respect of the Underlying Assets”; the legal owners of the compartment’s assets are the holders of the fund units, i.e. the orphan trust (mWIN T&Cs, §8.1 p. 20; A&O Memorandum §5.2(a) p. 8). The token is the register entry: notes are issued in registered form represented by tokens, may not be converted to bearer form, are not deposited with a depositary or admitted to any clearing system, and the holder recorded in the on-chain register is recognised by the issuer as absolute owner (mWIN T&Cs, §§2.2(a), (b), (e) p. 12). Importantly for a lending market, the T&Cs already contemplate custody by a smart contract: where notes are held by a smart-contract address “including without limitation in connection with any collateralised lending arrangement,” the beneficial owner for the purpose of exercising rights (including redemption) is the person who deposited the notes or who has the contractual right to withdraw them, provided that person is greenlisted (mWIN T&Cs, §2.2(e) p. 12).

The custody arrangements are institutional but contain several investor-adverse features that qualify the quality of the asset backing. Securities are held in accounts opened in the name of the fund and are segregated from Northern Trust’s own assets, but they may be held “in an omnibus account together with Securities belonging to other clients,” with the client consenting to a risk of use of those securities and bearing any shortfall on a pro-rata basis (Northern Trust Custody Agreement, §§2.7(a), (c)–(d) pp. 6–7, and Appendix Part 2 §5). Cash is not segregated at all: it is held “as banker and not as trustee,” may be commingled, and the fund “will rank as a general creditor of the Custodian” (Northern Trust Custody Agreement, §3.1 p. 7). The custodian may appoint sub-custodians “in any part of the world,” including affiliates and non-EEA entities, and its liability is fault-based with broad exclusions, force-majeure relief that expressly includes “suspension of dealing on relevant exchanges,” and no monetary liability cap stated in the body of the agreement (the fee/liability Schedule A is blank in the copy provided) (Northern Trust Custody Agreement, §§5.1, 27.1, 28.1–28.2, 22, and Schedule A). The custodian may also delay, block or refuse payments on AML or sanctions grounds with no liability. None of this is unusual for institutional custody.

The smart-contract and operational layer is the least-documented part of the structure and the area of greatest control-transparency risk. The Technology and Operational Services Agreement casts Midas Software GmbH as an execution-only provider acting “at the direction of the Client” with “no independent discretion” (Midas Technology Agreement, §3.1 p. 2), and it is careful to state that minting occurs automatically on interaction between a whitelisted wallet and the contract “without any intervention by the Service Provider” (§3.5 p. 3). Operationally, however, Midas holds the ability to execute privileged on-chain functions: it administers the on-chain access-control whitelist, executes registration, suspension, removal and de-registration of wallet addresses on the client’s instruction, adjusts minting parameters, and has “the ability to pause Smart Contract operations where technically feasible” during a critical incident (Midas Technology Agreement, §§3.4, 3.5, 13.3 pp. 3–4, 9).

1.4 Issuer’s Structure Evaluation

The Aureum Securitisation Fund is an unincorporated contractual co-ownership (copropriété) with no legal personality, created for an unlimited duration and governed by its Amended and Restated Management Regulations dated 28 January 2026 (which superseded the initial regulations of 21 November 2025) (General Management Regulations (“GMR”) §2.2 p. 5, and cover page). The fund operates through legally segregated compartments; the mWIN compartment was created by its own Specific Management Regulations and constitutes “a separate co-ownership (copropriété) within the Fund” for an unlimited period (SMR §2.1 p. 6). The fund is deliberately kept outside CSSF supervision: it “is not a regulated Securitisation Fund authorised by the CSSF” and, in consequence, undertakes not to issue financial instruments to the public on a continuous basis (GMR §2.5 p. 5).

The issuer is the management company acting for the mWIN compartment; there is no separate corporate issuer. Aureum Manco S.à r.l. (RCS B301171) is a Luxembourg société à responsabilité limitée with a EUR 12,000 share capital, incorporated on 20 October 2025 for the sole corporate object of managing Luxembourg securitisation funds, held entirely by the Midas Purpose Trust (Articles, Arts. 1, 3, 5; Structure Chart p. 1). The management company is “vested with the broadest powers to administer and manage the assets… of the Fund and of each Compartment,” may delegate those powers, and must act “in the exclusive interest of the relevant Unitholders, the relevant Instrumentholders… and the relevant Lenders” (GMR §§4.2, 4.4 p. 7). Its duties cease only on replacement or on its own insolvency (GMR §4.5 p. 7).

The sole shareholder is the Midas Purpose Trust, a Jersey purpose trust with no economic beneficiaries; Hawksford Trustees Jersey Limited acts as trustee, Hawksford Trust Company Jersey Limited as settlor and Hawksford Fiduciaries Jersey Limited as enforcer (Aureum Structure Chart, p. 1; Articles, appearance clause). The same trust subscribed the two mWIN units at USD 1 each on 15 June 2026 (SMR §7.1–7.3 p. 9). United International Management S.A., a CSSF-regulated Specialised PFS, certified the structure chart and is the corporate-services provider at the management company’s original registered address (Aureum Structure Chart, p. 1).

The governance of the noteholder relationship is contractual rather than fiduciary, and this is stated candidly by the issuer: the relationship of the investor with the issuer is “contractual rather than fiduciary,” and the issuer and its agents are bound only to act “in good faith and in a commercially reasonable manner” when making determinations, calculating costs and determining NAV (LlamaRisk DDQ, Q10). The issuer is expressly not responsible for the performance of the investment manager, and the investors are not party to the Investment Management Agreement (LlamaRisk DDQ, Q10). Wellington in turn disclaims any oversight of the Midas wrapper: “Wellington does not oversee Midas and is not responsible for the accuracy of the information… regarding Midas’s specific structures or wrappers,” and “Midas acts solely as the structuring and administrative interface” (Wellington Investment Guidelines, “Manager Designation” p. 4). The result is a chain in which no single party owes investors a fiduciary duty over the whole: Wellington owes contractual duties to the issuer under the (unproduced) Investment Management Agreement; the custodian owes fault-based custody duties to the fund; and the management company owes a good-faith/commercially-reasonable contractual standard to noteholders.

Management-company replacement is controlled through the units, which the orphan trust holds. Replacement requires consent of unitholders holding more than 80% of units plus instrumentholder resolutions, and the management company can be dismissed for cause (material breach uncured for 30 days, serious criminal/regulatory conviction, fraud or gross negligence, or bankruptcy); if not replaced within six months the fund is dissolved (GMR §§13.1–13.3 pp. 16–17). Because the trust holds 100% of the units, the 80% unit threshold is, in practice, controlled by the orphan. The Articles reinforce this: managers are appointed and removable ad nutum by the sole shareholder (Articles, Art. 11). The reviewed structure chart and subscription agreement identify no independent director of the management company. The two named managers, a Class A and a Class B manager, are both Midas principals, and the due-diligence response records that the management company may have a single manager (Aureum Structure Chart p. 1; LlamaRisk DDQ). Board-level independence therefore does not sit between the sole shareholder and the noteholders in the evidenced governance chain.

The service providers are established institutions: Northern Trust (custody and pricing agent), Wellington Management (investment management), Ernst & Young Luxembourg (audit) and Hawksford (trustee of the orphan trust). The issuer states in its due-diligence response that every key service provider is replaceable by the Issuer (LlamaRisk DDQ, Q11). What the reviewed documents evidence about replaceability differs by provider. Management-company replacement is fully documented and runs through the units under GMR §§13.1–13.3, with the orphan-trust control of the 80% threshold and the six-month dissolution backstop described above. Custodian replacement is documented in the custody agreement, which either party may terminate on ninety days’ written notice, after which the custodian delivers assets as instructed but only net of outstanding fees and, absent a successor, drops to a safekeeping-only role with no successor-appointment obligation and no fund-level dissolution trigger (Northern Trust Custody Agreement, §§30.1–30.3). Two frictions qualify that swap. The custodian is also the official pricing agent, so replacing it breaks the pricing chain the daily NAV depends on (§1.6, §2.2), and its fund-wide first-ranking pledge over all assets under clause 15 secures every obligation owed to it ahead of noteholders (§1.2). For the remaining providers the position is thinner. Wellington’s replaceability rests on the assertion alone because the Investment Management Agreement is not in the reviewed materials, so notice terms, transition obligations and any lock-in cannot be checked. Ernst & Young is replaceable in principle under the General Management Regulations’ auditor definition, though no engagement terms were supplied, and no document evidences replacement terms for Hawksford as trustee. On the documents reviewed, the issuer’s statement is verified for the management company and the custodian, subject to the pricing-chain and pledge frictions, and remains an unverified assertion for Wellington, the auditor and the trustee.

1.5 Subscriptions, Withdrawals, and Redemption Mechanics

Subscription

Subscription is professional-client only and gated by KYC/AML greenlisting: an investor must complete KYC/AML and have its wallet greenlisted before any subscription request is processed, must subscribe for at least one note of USD 130,000 (with fractional amounts permitted above that), and pays in USD or a permitted stablecoin (USDC) (mWIN T&Cs, §2.1(c) pp. 11–12; Subscription Agreement §§2–3 p. 1). The issue price equals the NAV per note at receipt of cleared funds; notes are credited within three business days; a subscription fee of up to 0.10% applies (mWIN T&Cs, §2.1(c)(iv) p. 11, and Definitions “Subscription Fee” p. 6). Subscriptions carry a 60-day long-stop after which an un-closed subscription agreement terminates automatically (Subscription Agreement §10 p. 4).

Midas states that the subscription fee is permanently waived for all stablecoins currently accepted, that the up-to-0.10% fee is retained only for more volatile stablecoins that might be added later, and that minting is intended to be instant, the three-business-day crediting period being a legal buffer.

Redemption architecture

The notes have a 40-year scheduled maturity, so in practice all investor liquidity runs through the early-redemption machinery (mWIN T&Cs, §6.1(a) p. 13). There are three investor-elected routes. An Instant Redemption transfers notes to the redemption smart contract and pays the last-published NAV per note (less a fee of up to 0.50%) within two business days — but it is “subject to the availability of an External Liquidity Facility and/or the Internal Liquidity Sleeve,” and “the Issuer may reject, defer or partially process” it if liquidity is insufficient (mWIN T&Cs, §6.3(b) pp. 14–15). A Standard Redemption is priced at the next business day’s NAV, but payment occurs only “as soon as reasonably practicable following receipt by the Issuer of the relevant Underlying Asset Receipt” — that is, after Wellington has actually sold portfolio assets and the proceeds have arrived (mWIN T&Cs, §6.3(c)(iv) p. 15). An Accelerated Redemption is a hybrid: priced at the Standard Valuation Day NAV but, like Instant Redemption, “subject to the availability of an External Liquidity Facility and/or the Internal Liquidity Sleeve” (mWIN T&Cs, §6.3(d)(v) p. 16). The overarching pass-through rule confirms the pattern: the issuer is obliged to pay “if, and only to the extent that, the Issuer has received Underlying Asset Receipt,” except where it chooses to make an Instant or Accelerated Redemption available (mWIN T&Cs, §7.1(a) p. 17). In other words, the only redemption that does not depend on the issuer first liquidating the portfolio is the one that depends instead on a discretionary, capacity-limited liquidity facility.

As per Midas’ clarification every asset class Wellington can invest in settles at T+1, while redemptions submitted before the daily cut-off at 1pm CET are intended to be processed at T+1.

Liquidity support for that facility is real but modest and largely intra-group. The DDQ describes a dedicated USD 10m credit line, potential access to a further USD 30m of shared Midas capacity “composed solely from Midas funds,” and an OTC liquidator network (LlamaRisk DDQ, Q12). The unaudited comfort letter evidences roughly USD 42m of Midas group liquid assets (about USD 20m tokenised T-bills, USD 13m liquid crypto, USD 9m fiat) as at end-April 2026 (Midas Protocol Letter of Comfort). Against a programme sized at up to USD 2bn, this facility is a smoothing mechanism for ordinary-course redemptions, not a backstop for stressed or correlated outflows, and it is contractual and discretionary rather than a committed, ring-fenced guarantee. The comfort letter is expressly unaudited and, being a letter of comfort, is not a binding financial support undertaking. The documents do not establish the USD 30m shared pool, the USD 42m of Midas group liquid assets, and Midas’s own participation in the OTC liquidator network as distinct, additive capacities. All three describe Midas-sourced resources and are consistent with the same funds counted more than once. No document evidences the Internal Liquidity Sleeve or the dedicated USD 10m line as funded and available to mWIN at launch.

Redemption-suspension

The instrument does not use the word “suspension” for the notes, but it achieves the same effects through several overlapping powers. First, redemption pricing at the note level is deferred on a Pricing Disruption Event — where the issuer cannot determine NAV, or the custodian cannot generate or deliver pricing data, or reliable pricing data for the underlying assets is unavailable — in which case NAV publication “shall be deferred” until the event is resolved, with no outer time limit (mWIN T&Cs, §15 pp. 22–23). Second, at the compartment level, a Market Disruption Event postpones NAV determination to the next unaffected business day and, if it continues “for more than [10] consecutive Business Days,” hands NAV determination to the management company’s discretion. Third, and most broadly, Article 8 of the General Management Regulations empowers the management company to “at any time and from time to time suspend the determination of the Net Asset Value… and/or the… redemption” of compartment units on six grounds, including where disposal of assets “is not reasonably or normally practicable without being seriously detrimental to the interests of the Unitholders” or where, in the management company’s opinion, circumstances beyond the fund’s control make it “impracticable or unfair” to continue (GMR §8.1 pp. 13). Although Article 8 is drafted around compartment units, the note NAV is a function of the compartment NAV, so a suspension of NAV determination cascades to the notes; none of these powers carries a hard duration cap. Fourth, a Depeg Event — a deviation of more than 2% from the 1:1 stablecoin peg — lets the issuer, “in its sole discretion,” postpone payment until the peg is restored (or pay in USD) (mWIN T&Cs, §7.4 p. 19). Fifth, and importantly, delay in paying any redemption amount is repeatedly and expressly stated not to constitute an event of default, and the investor is entitled to no interest or compensation for delay absent the issuer’s wilful misconduct or gross negligence (mWIN T&Cs, §§6.1(c), 6.2(c), 6.3(e), 6.4(e), 10.2 pp. 13–21). The practical consequence is that a noteholder facing a deferred redemption has no acceleration remedy for the delay itself.

Forced and issuer-initiated redemptions

Two compulsory mechanisms exist. The issuer may, “at its option and in its sole discretion,” call the notes for early redemption on five business days’ notice at NAV (mWIN T&Cs, §6.2 p. 14). And the mandatory squeeze-out under Condition 6.4 applies only where both limbs are met: the holder does not qualify as a professional client within the meaning of point (5) of Article 1 of the Luxembourg act of April 5, 1993, and holds notes in an aggregate amount worth less than one note’s NAV, roughly USD 130,000 at the launch value. On the meeting of those limbs the issuer gives at least five business days’ notice and redeems the position at the “Squeeze-Out Redemption Amount,” defined as the redemption amount “less a deduction of thirty per cent (30%) thereof… as a penalty” (mWIN T&Cs, §6.4 pp. 16–17, and Definitions “Squeeze-Out Redemption Amount” p. 8). Because mWIN is a professional-investor-only instrument and a collateral position in whole notes at or above the Authorised Denomination fails both limbs, a Horizon collateral position sits outside the scope of the 30% deduction on the documents as written. The compulsory mechanism that reaches a Horizon position is therefore the issuer call under Condition 6.2, at full NAV. Physical (in-kind) delivery is available, but only at the issuer’s election: the issuer may satisfy any redemption by delivering underlying assets rather than cash, and no investor has any right to demand a specific underlying asset (mWIN T&Cs, §§7.3(a), (i) pp. 18). Events of default are narrow — non-performance uncured for 30 business days, unstayed liquidation proceedings, or a payment stoppage/insolvency — require holders of at least 50% of the notes to accelerate, and even then the redemption amount remains subject to limited recourse and may be paid up to 60 business days after determination (mWIN T&Cs, §10 p. 21).

Midas explains that the squeeze-out is a legal requirement, agreed with the Luxembourg regulator as the standard for restricting the offering to professional investors. It states that the mechanism cannot be triggered under the current setup: the smart contracts for OTC transactions require both wallets to hold either zero or at least one full token after the transaction, so sub-denomination residual holdings of the kind Condition 6.4 reaches cannot arise.

The redemption architecture is, in sum, internally coherent for a securitisation note but heavily weighted toward issuer and portfolio protection. On-chain, the token is liquid and transferable; off-chain, the ability actually to convert a note into cash at NAV is conditioned on portfolio liquidity, discretionary liquidity-facility capacity, NAV-suspension regimes, a stablecoin-peg postponement power and for non-professional sub-denomination positions, a punitive squeeze-out.

1.6 Investment Program, Yield Accrual, and Distribution

The investment programme is a short-duration, investment-grade-average credit strategy with a broad eligible universe. Wellington’s “Income Opportunities Portfolio” targets total return and realised income while aiming to preserve capital, with no benchmark (Wellington Investment Guidelines, “Investment Objective” p. 1). The binding constraints are what make the strategy conservative in practice: the portfolio must carry an investment-grade weighted-average credit rating, BBB/Baa exposure is capped at 50%, below-investment-grade at 10%, and unrated at 10%; single-issuer exposure is capped at 5% of market value for every issuer other than governments and their agencies: “Exposure to any single issuer or issuing trust of structured securities such as ABS, CMBS, or MBS, other than securities issued or guaranteed by governments or government agencies will not represent more than 5% of the Portfolio’s market value” (Specific Management Regulations Art. 3.3). No general diversification obligation otherwise applies to the portfolio; portfolio effective duration is limited to 0–2 years; the portfolio is USD-denominated with foreign-currency exposure 100% hedged; and “the Portfolio will not employ leverage” (Wellington Investment Guidelines, “Credit Quality,” “Credit Exposure,” “Interest Rate Exposure,” “Non-US,” “Leverage,” pp. 2–3). At the token level a separate internal liquidity sleeve of up to 5% (cash, USDC and tokenised US T-bills) is held for redemption funding (mWIN T&Cs, Definitions “Internal Liquidity Sleeve” p. 6; Annex 2 p. 26).

Yield accrues economically rather than by coupon: no periodic interest is payable, and returns are reflected in NAV and in the redemption amount (mWIN T&Cs, §5(a) p. 13). NAV per note is struck each business day on a fair-value basis and published on-chain within two business days of the issuer receiving pricing data (mWIN T&Cs, §14 p. 22; SMR §6.9 p. 9). The management company retains ultimate responsibility for NAV and must assess in good faith whether the custodian’s pricing is a reasonable representation of fair value (SMR §§6.3–6.4 p. 8). This separation of pricing from portfolio management is a genuine control strength. It is qualified, however, by the custody agreement itself, under which Northern Trust characterises its pricing as “unaudited prices for indicative valuation purposes,” disclaims responsibility for reliance on that data, and excludes liability for mispricing (Northern Trust Custody Agreement, §§17.1, 17.4, 28.2(c)). The pricing chain is therefore: an independent institutional custodian provides indicative prices on a no-liability basis; the management company applies good-faith judgement and may, on a Market Disruption Event or unreliable data, substitute broker quotations or third-party pricing services (SMR §§6.5, 6.7 pp. 8–9). The note NAV itself is not an on-chain oracle output but an off-chain determination published on-chain (mWIN T&Cs, Definitions “Chainlink Oracle” and “Exchange Rate” p. 5).

Midas adds a few points on pricing (Midas comments, September 2026). The underlying assets are priced mark-to-market and trade in deep, publicly traded markets, so a price should practically always exist. Northern Trust was chosen as pricing agent for its independence, and its prices are compared for consistency against pricing received directly from Wellington. The Midas Attestation Engine notarizes the Northern Trust pricing on-chain at source, with no ability for Aureum or Midas to alter the data before publication.

1.7 Transfer Restriction Enforcement

The T&Cs declare the notes “freely transferable” and capable of being “offered, sold, assigned, novated, transferred, delivered or otherwise disposed of… to any person, subject to applicable law and these Conditions” (mWIN T&Cs, §13.2 p. 22). On the other, the operative controls are permissioned: no redemption is processed unless the redeeming holder is greenlisted; where notes are held through a smart contract, the beneficial owner must be greenlisted to exercise rights; and the issuer’s DDQ confirms that “secondary transfers are fully permissioned,” that a transfer to a non-greenlisted address “will fail at the smart contract level or be deemed legally invalid,” and that a minimum holding of one token is enforced at the smart-contract level (mWIN T&Cs, §§6.3(f), 2.2(e) pp. 12, 16; LlamaRisk DDQ, Q9). The reconciliation is that “freely transferable… to any person” operates only within the greenlisted universe: legally the notes are freely assignable, but technically and for the purpose of exercising rights they are confined to whitelisted wallets.

The issuer is candid that a fully permissionless secondary market is not yet available: “Wellington is currently not comfortable for the token to be permissionless on secondary markets,” and the parties are working toward lightening the restriction to greenlisted addresses only “once they get comfortable” (LlamaRisk DDQ, Q9). Until that evolution occurs, every transfer — including a liquidation transfer — is contingent on the transferee’s greenlist status.

Pre-transfer controls are robust and institutionally administered: KYC/AML onboarding, wallet greenlisting, entity- and smart-contract-level sanctions screening, and geoblocking of high-risk jurisdictions, all handled by the management company or its affiliates rather than a third-party transfer agent (LlamaRisk DDQ, Q4 and Q11; mWIN T&Cs, Definitions “Greenlisted” and “KYC/AML Requirements” p. 6). Post-transfer enforcement rests on the same whitelist: a wallet can be suspended or de-registered on the client’s instruction, including on “a breach of applicable access conditions, or a requirement of a competent authority,” and the contracts can be paused during a critical incident (Midas Technology Agreement, §§3.4(b)–(c), 13.3 pp. 3, 9).

Midas elaborated that secondary transfers are fully permissioned: a recipient must have completed the issuer’s KYC/AML onboarding, and any attempt to transfer a token to a non-greenlisted address “will fail at the smart contract level and be deemed legally invalid” (Midas follow-up responses, July 2026). This confirms the preventive control — an ineligible wallet cannot acquire the notes in the first place. Survival of issuer enforcement powers post-transfer is partially addressed — the greenlisting condition and the securitisation-act acknowledgements bind any subsequent permitted transferee, since “Investor” includes any person acquiring notes through a subsequent permitted transfer (mWIN T&Cs, Preamble (B) p. 4).

For mWIN the identity-based restriction stack operates at the token layer rather than through a fund register. Because a holder owns a note issued directly by the Aureum compartment rather than a share in a separate fund (§1.3), there is no share register of well-informed investors and no board acting on that register. The contractual restriction apparatus that a conventional fund prospectus carries, namely a Prohibited Person definition with United States-person tests, register-level refusal of transfer, and board powers to compel disposal or to redeem an ineligible holder compulsorily, lives in the mWIN Compartment Terms and Conditions: the notes are professional-investor instruments with a USD 130,000 minimum denomination, the issuer holds the at-will series call at full NAV and the sub-denomination squeeze-out described in §1.5, and Condition 2.2(e) recognises smart-contract-held notes with the depositor as beneficial owner provided the depositor is greenlisted. What the materials do evidence is the operative gate. Subscription requires Know Your Customer onboarding with Midas and on-chain whitelisting before USDC can be deposited and mWIN minted, per the subscription and redemption note reviewed under the non-disclosure agreement, and the deployed deposit and redemption vaults have sanctions screening enabled (on-chain deploy configuration). The restriction is therefore documented at both the contractual and the token layer.

Token Layer

The on-chain issuance vehicle is the Aureum compartment itself. This differs from an external-fund wrapper, in which the Aureum compartment would be the sole subscriber to registered shares in an external Luxembourg SICAV-RAIF sub-fund and the token would represent economic exposure to those shares. For mWIN the compartment holds the Wellington-managed assets directly and the token is the compartment’s natively issued note (§1.3), so there is no intermediate fund register satisfied by a single subscriber. The securitisation-law authorization threshold still governs the issuance: under the amended Luxembourg Securitisation Law an unregulated securitisation vehicle requires authorization by the Commission de Surveillance du Secteur Financier only where it issues financial instruments to the public on a continuous basis.

Once tokens are issued, compliance shifts from a one-time gatekeeping check to ongoing monitoring, enforced on-chain across three gates:

  • Primary issuance is permissioned: KYC, anti-money-laundering screening, and on-chain whitelisting precede any mint.
  • Secondary transfers are permissioned: mWIN is mTokenPermissioned, so a transfer succeeds only between whitelisted wallets, with the option to enable permissionless transfers later (on-chain configuration). The Ethereum blockchain is the operative ownership register for the mWIN token.
  • Redemption is permissioned: only a whitelisted wallet can redeem, and the vaults re-screen against the sanctions list at the point of redemption (deploy config, “sanctions enabled”).

mWIN is deployed on the mTokenPermissioned base. The verified source confirms contract mWIN is mTokenPermissioned, MWinMidasAccessControlRoles, so the transfer hook that enforces a positive whitelist check on the recipient, the single-transaction blacklist freeze, and the global pause are present. These are read on the deployed contracts and assessed in §3.4 and §3.6. The enforcement primitives exist. Their final on-chain wiring is confirmed in §3.4.

Due Diligence Questions

Three questions arise from this design:

  1. If on-chain monitoring detects that a sanctioned wallet has received mWIN, can Aureum or Midas freeze or claw back the affected tokens?
  2. A non-United States, non-sanctioned person could acquire mWIN on a secondary market and supply it to an open lending market, after which a liquidator could obtain mWIN through liquidation. That liquidator would hold mWIN without having completed KYC or AML with Midas, would have no contractual relationship with Aureum or Midas, could not redeem without first being whitelisted, and would hold an asset with no practical means of realizing its value except by selling it to a party able to redeem. What are the legal consequences?
  3. Is post-transfer monitoring designed to detect a sanctioned entity obtaining mWIN through a liquidation, and what enforcement tooling is available to address it?

No mWIN-specific written response to these questions has been provided. The relevant positions, namely the technical freeze stack, whether the on-chain register is the legally binding record, any transferee-deemed-acceptance term, a beneficial-ownership carve-out treating the depositor (not the lending contract) as the holder for redemption purposes, and the routing of liquidations to a greenlisted liquidator vehicle, are contractual and operational matters that live in the token Terms and Conditions and a dedicated due-diligence response, and they cannot be assumed to hold for mWIN until the mWIN documents and a response are provided. The enforcement primitives, a whitelist gate, a single-transaction blacklist freeze, and sanctions-enabled vaults, are present in mWIN’s base, so the capability to immobilise a non-compliant holder exists at the token layer (verified in §3.4).

For the Aave Horizon listing the Aave Pool contract must hold mWIN’s transfer-level whitelist role (M_WIN_GREENLISTED_ROLE) or deposits and withdrawals revert, and a liquidation transfer to a non-whitelisted wallet reverts, so the configuration must route seized collateral to a known whitelisted destination.

II. Market Risk

The fund and credit analysis in this section is built on the limited on-chain data together with the offering materials shared under the non-disclosure agreement, principally the mWIN Information Memorandum, the Wellington investment guidelines, and the model portfolio overview.

2.1 Assets Under Management

mWIN is live on Ethereum mainnet, launched August 5, 2026. One token is one note at the USD 130,000 Authorised Denomination. The token supply is roughly 275.0 tokens at a net asset value of $130,966 per token, an assets-under-management (AUM) figure near $36.0 million. Inflow expectations target above $100 million within two to three months.

Measure Value
mWIN outstanding ~275 tokens
NAV per token $130,966
Token AUM ~$36 million
Wellington firm-wide AUM ~$1.2 trillion
Wellington securitized-credit AUM $56.6 billion
Wellington collateralized-loan-obligation (CLO) AUM ~$12 billion

Source: LlamaRisk, September 17, 2026

Wellington’s firm-wide AUM near $1.2 trillion and its $56.6 billion securitized-credit and roughly $12 billion CLO franchises describe the platform the strategy draws on, and they are distinct from the mWIN note’s own on-chain supply near $36.0 million. Twelve beneficial owners hold at least one whole note. The largest investor holds 31.2% of the tokens outstanding, the two largest 54.2% and the three largest 72.7%, and the remainder is spread across the nine other greenlisted holders. One investor can greenlist several wallets, so the wallet count understates entity-level concentration. Redemption pressure and any concentration measure therefore track a few large positions.

2.2 Historical Performance

mWIN has weeks of history too short to carry a performance record. The performance rests on two proxies, each carrying a stated gap: a model portfolio the issuer backtested to the mWIN mandate, and Wellington’s live record on the strategy’s largest sleeve. The performance figures below are drawn from the model portfolio overview and the Information Memorandum shared under the non-disclosure agreement.

The model portfolio characteristics are shown below.

Metric Value
Market yield 5.23%
Option-adjusted spread (over US treasury) 107 bps
Annualized volatility 2.56%
Sharpe ratio (RF = 0) 1.41
Effective duration 0.79 years
Spread duration 2.04 years
Average credit quality A+

Source: Documents shared under NDA, June 11, 2026

Wellington’s CLO debt representative account, which maps to the modeled 40% CLO sleeve that is the single largest allocation in the model book, carries the longest live record available. The live book’s asset-backed line is held entirely in collateralized loan obligations. Performance measured to December 31, 2025 since the account’s inception on June 30, 2016 shows a maximum drawdown of 7.99%. CLOs are 40% of the model book and the remaining 60% spans agency and non-agency mortgage paper, asset-backed securities, and investment-grade corporates.

Drawdown and Impairment History

The book is marketable multi-sector fixed income, so losses arrive principally as price declines when spreads or rates move. The model portfolio’s 10-year backtest is positive in 9 of 10 calendar years, the single negative year being 2022 at −1.57% during the rate-hiking cycle. The same backtest shows a peak-to-trough drawdown of −13.32% during the March 2020 liquidity event, with the calendar year nonetheless closing at +4.98% as spreads retraced.

The model portfolio’s 0.79-year effective duration implies that a 100 basis-point parallel rise in rates maps to roughly a 0.8% first-order price decline, and its 2.04-year spread duration implies that a 100 basis-point broad spread widening maps to roughly a 2.0% decline before carry. The live book’s effective duration of 0.6 years and spread duration of 2.6 years, the issuer’s figures as of September 15, 2026, put the same effects at roughly 0.6% and 2.6% respectively. Both are consistent with the worst modeled macro shock, a credit sell-off of −2.54% recovering inside six months. On the impairment side, Moody’s data for 1993 to 2023 show close to 0% five-year impairment on AAA, AA, and A CLO tranches, the band where the modeled book is positioned. However, the guidelines require an investment-grade weighted average and permit up to 50% BBB and up to 10% below investment grade.

NAV Methodology

mWIN’s net asset value is determined daily by the Management Company by reference to pricing data from Northern Trust as official pricing agent. Wellington, as investment book of record, is contractually bound only to provide reasonable valuation assistance on request under Article 6.4 of the Specific Management Regulations. The issuer states that in practice Wellington values the same holdings independently as a regular cross-reference and that a significant divergence triggers a reconciliation. The Management Company retains ultimate responsibility and assesses in good faith whether the custodian’s data is fair value, under the contractual framework set out in the annex. The on-chain price is total net asset value divided by token supply, where net asset value is the custodian-priced valuation plus in-flight assets, idle USDC, and accrued fees.

NAV recognition of deterioration is therefore relatively fast. An adverse market move is reflected at the next daily strike, so the lag the oracle inherits is at most one business day plus the attestation and on-chain publication delay. The residual lag sits in the least-liquid allocations. The CLO tranches and the non-agency mortgage and asset-backed positions are not continuously exchange-traded and are typically marked with third-party evaluated or matrix pricing, which can trail a fast-moving market by hours to a day and can understate a dislocation until evaluated marks catch up. In a March 2020-style event this is the window in which the printed NAV could briefly lead reality on the way down and lag it on the recovery, and it is the dampening problem the pricing setup addresses.

mWIN carries no grace period, provisioning schedule, or write-off trigger, because its holdings are priced, not accrued. This means a default in an asset-backed, mortgage-backed, or collateralized loan obligation position therefore reaches the net asset value as a price move. A position going bad loses value gradually in the daily marks, so most of the loss is in the net asset value before the default ever happens. The default itself simply shows up in the next day’s strike at that already-reduced price.

Every holding is fair-valued daily, with no book-value or amortized-cost carrying. Northern Trust strikes evaluated prices from independent pricing services at 4:00 p.m. Eastern. The quality of those prices varies by sleeve. Corporate bonds are priced off actual trades and quotes in the same or similar issues. Mortgage paper and collateralized loan obligation tranches are marked by vendor evaluations. Prepayment-driven models for mortgages and per-tranche cash-flow models for CLOs, informed by dealer quotes and auction colour where the vendor receives them. Northern Trust’s guidelines state that CLO evaluations are only as accurate as the vendor’s knowledge of the underlying loan terms. Roughly three quarters of the book is evaluated on that basis, one quarter off trades and quotes in the issue itself.

Northern Trust’s pricing guidelines document a multi-vendor hierarchy, day-over-day movement checks, and a daily stale-price review. The daily strike itself is standard custodian practice rather than a contracted duty, since the Master Custody Agreement obliges only quarterly statements for indicative purposes.

2.3 Liquidity and Redemption Mechanics

mWIN documents four exit paths, each trading speed against capacity and cost. Three are contractual redemption options under Condition 6.3 of the Terms and Conditions, and the fourth, the over-the-counter (OTC) network, is not a redemption but a secondary purchase backstop of pre-approved liquidators.

Layer Route Capacity Fee Settlement
L1 Instant redemption, atomic on-chain 8 mWIN a day across the two vaults, ~$1.05M, inside the $10M dedicated MSL line 50 bps Immediate
L2 OTC liquidator network Up to $50M 50 bps T+4h
L3 Accelerated redemption, not offered at launch Not stated Up to 50 bps Within 2 BD of next NAV
L4 Standard portfolio redemption Whole portfolio None ~1 to 2 BD in practice

Source: Documents shared under NDA, June 2026

Three separate pools stand behind these exits: the 5% sleeve inside the product, Midas Staked Liquidity outside it, and the liquidators. MSL includes Midas capital, so MSL and the comfort-letter group assets are not additive, the same Midas balance sheet stands behind both. The issuer plans to open MSL to external liquidity providers in the fourth quarter of 2026. One liquidator has signed a letter of intent, and it binds no one to a size, an obligation to bid, or a price.

Two contractual features qualify the stack:

  • The 0.5% instant fee sits at the documented ceiling.
  • The issuer holds a Condition 7.3 election to satisfy any redemption in kind, so a liquidator’s exit is not contractually guaranteed to be USDC. The issuer confirmed to LlamaRisk that it cannot settle redemptions in kind and that Aave liquidators are redeemed in stablecoins like any other investor.

A dedicated repay-and-redeem process unwinds a levered position: a redemption request with a deposit of up to 2%, reserved liquidity, then cycles of redemption, debt repayment, and collateral release on standard timelines. The documentation calls the pathway fee-free, but the matching contractual route, Condition 6.3(c)(i) limb (B), charges a USD 4,000 Redemption Processing Fee even on a completed exit and forfeits the full deposit on a lapsed one. The issuer waives the fee until further notice, a discretionary waiver that can be withdrawn.

Suspension and deferral powers at the fund, note, and stablecoin-peg levels reach every route below and carry no duration cap.

Instant Redemption (L1)

The instant layer (L1) redeems on-chain at the prevailing oracle price, single-phase in one transaction, with no holdback, escrow, or two-phase logic in the deployed redemption code. Two redemption vaults serve it, the sleeve vault and the swapper, and both raise their USDC by redeeming mTBILL.

Two limits cap the instant path:

  • The Midas Staked Liquidity tranche dedicated to mWIN, roughly $9.9 million of mTBILL held at the disclosed provider wallet with a matching approval to the swapper
  • Each vault’s on-chain daily limit of 4 mWIN.

At the live total value locked of $36.0 million the daily limits bind, roughly $1.05 million a day. The MSL pool is roughly $30 million across Midas products, per the issuer, of which the mWIN tranche is the roughly $9.9 million above. The tranche is committed until further notice with no binding contract, and mWIN’s access to the shared remainder is not stated. The pool’s balance and the vault’s approval to draw on it are adjustable at any time. Because the payout is full value at the standing price, a redeemer keeps the benefit of a stale published value, and the daily strike bounds that window at about one business day. Who carries the decline depends on the vault. The swapper does not burn the redeemed mWIN, it passes the notes to the MSL provider in exchange for mTBILL at the oracle rate, so the provider holds them until it redeems and carries any decline in between. The sleeve vault burns the notes and pays from compartment property, so there the decline falls on remaining holders. No holdback facility is deployed on either redemption vault. The issuer plans a native holdback inside the mint and redemption vaults, which it expects to implement in October 2026.

Source: LlamaRisk, September 17, 2026

The Internal Liquidity Sleeve is the only atomic capacity independent of Midas. It is compartment property funded by the 95/5 subscription split, held in mTBILL in its own redemption vault, roughly $1.9 million at the live total value locked, capped at 5%.

OTC Liquidator Network (L2)

The onboarded and whitelisted liquidators for mWIN are Keyrock, Dialectic, Vault Street, Metalayer, and Fission. One liquidator has signed a letter of intent, dated September 8, 2026, indicating USD 5 million of aggregate capacity. The letter is expressly non-binding: participation in liquidations is at the signatory’s discretion and subject to its own risk limits and available capacity, pricing is to be agreed per transaction, and the letter states that no communication under it constitutes a firm order, bid, offer, quote or commitment to transact. The issuer states that Fission is live with $2 million of atomic liquidation capacity. No agreement binds any of the five to a size, an obligation to bid, or a price. The dedicated $10 million pool for mWIN, redeemable through Midas Staked Liquidity, is stated to cover up to $50 million of liquidation demand per week. The described liquidation capacity routes through the Midas-funded MSL pool, so the liquidator layer and the MSL capacity remain coupled.

Accelerated Redemption (L3)

The accelerated path is not offered at launch. It prices at the same next-day NAV as a standard redemption but pays within two business days of NAV publication for the sale proceeds, and its fee of up to 50 basis points is the price of that earlier payout.

Standard Redemption (L4)

Any redemption too large for the instant path exits through the standard route. It prices at the next business day’s NAV and pays only once the issuer has received the portfolio-sale proceeds, with no contractual outer bound on that receipt. The issuer states that in practice a request placed before the 1pm Luxembourg cut-off is priced at that day’s closing valuation and settles in cash the next business day or the morning of the one after. A request after the cut-off is treated as submitted on the next business day and prices one day later.

Although it is not guaranteed, liquidators are expected to use the standard fee-free route even under stress, as they have on the platform’s other products, on the reasoning that a liquidator earns more by waiting one day for a T+1 redemption than by selling at the liquidation premium.

Settlement Timeline

The request-to-cash window is short on every path.

Path Request to cash
Instant Immediate
OTC network ~4 hours
Accelerated Within 2 business days of the next published NAV
Standard, before the 1pm CET cut-off ~1 to 2 business days
Standard, after the cut-off ~2 to 3 business days

Source: Documents shared under NDA, September 2026

2.4 Redemption Buffer

The drawable buffer is the redemption vaults’ combined daily limit of 8 mWIN, about $1.05 million a day at the live net asset value, inside the $10 million dedicated MSL line. It is shared first-come-first-served with every holder, nothing is reserved for Aave-specific positions, and the daily limit can be raised or lowered.

2.5 Fee Structure and Cost Transparency

mWIN carries fees at three levels: the management and investment-management layer, the Midas tokenization and redemption layer, and the fiat on-ramp.

The management fee is contractually 0.60% per annum of net asset value, with 20 basis points waived until further notice. The waiver is revocable, so the yield analysis in this review is struck on 0.60% and the effective 0.40% holds only while the waiver stands. The fee bundles Wellington’s investment-management fee, whose own rate no supplied document states, and Operational Costs above the fee can be charged back to the compartment, so 0.60% is a floor on holder costs.

The 0.5% instant redemption fee compensates the liquidity providers on the MSL path. If the redemption is financed from the Internal Liquidity Sleeve, the fee benefits the remaining holders. Fee terms cannot be changed unilaterally, though the Specific Management Regulations amend through the management-company side under the General Regulations.

2.6 Multi-Chain Availability

mWIN is deployed on Ethereum mainnet only. Further deployments on EVM chains could be planned in the future.

2.7 Issuer Maturity

The mWIN structure pairs a long-established asset manager with a younger tokenization platform, while mWIN itself carries only weeks of live history.

Wellington Management was founded in 1928, is independently owned, and has firm-wide assets under management near $1.2 trillion and a $56.6 billion securitized-credit franchise. It is a registered investment adviser with the United States Securities and Exchange Commission and operates a Financial Conduct Authority-authorized affiliate in the United Kingdom, with the registry identifiers recorded in the service-provider table. The strategy is run on institutional risk infrastructure, including a liquidity evaluation framework that simulates liquidation timing, an enterprise risk system, and a pre-trade compliance tool, under a multi-layer oversight structure on an 18-month review cycle. The supporting detail was provided under NDA and is assessed further in the stress testing below.

Against that firm-level maturity, mWIN’s own live record spans only weeks, too short to be a fund-level operating history or a realized return series, and the available performance evidence is the modeled portfolio and the representative-account proxy described above. The A+ figure in the materials is the model portfolio’s weighted average of its holdings’ issue ratings and the manager’s near-term expectation for the live book after ramping, while the binding guideline floor is an investment-grade weighted average with up to 50% BBB and up to 10% below investment grade. This is a weaker maturity profile than an established fund carrying a multi-year track record and an assigned fund-level rating.

The service providers that bear on market risk are set out below.

Role Entity Jurisdiction
Investment Manager (portfolio) Wellington Management Company LLP United States (Boston)
Securitisation issuer Aureum Securitisation Fund (dedicated compartment) Luxembourg
Management company of the fund Aureum Manco S.à r.l Luxembourg
Custodian and official pricing agent Northern Trust Luxembourg
Tokenization platform Midas (Midas Software GmbH) Germany

Source: Documents shared under NDA, June 2026

Midas is a real-world-asset tokenization platform responsible for token issuance, the redemption infrastructure, and oracle maintenance, and reports approximately $3.5 billion of tokenized assets minted across its products. The most architecturally comparable sibling product on the platform is mGLOBAL. mWIN shares the permissioned base contract layer and, on-chain, the same ProxyAdmin, TimelockController, and access-control singletons.

2.8 Yield Integrations

mWIN carries no protocol-native yield mechanism. Return comes through the note’s net asset value and not through any staking, wrapper, or reward contract, and the token-level greenlist means any address holding mWIN has passed the issuer’s screening first.

The documented return target is an option-adjusted spread of at least 100 basis points over the United States treasury curve. Wellington’s model portfolio, an all-investment-grade book at an average credit quality of A+ with 40% in collateralized loan obligations, carries 107 basis points.

2.9 Greenlisted Minters

Minting is gated on the recipient. A mint through the deposit vault succeeds only where the receiving wallet holds the token-level greenlist role M_WIN_GREENLISTED_ROLE, granted after KYC, AML, and sanctions screening. The token enforces that check and the vault does not. The deposit vault screens the caller against the blacklist and the sanctions list but its own greenlist check is switched off, so the wallet paying for a subscription need not itself be greenlisted where the mint is directed to a greenlisted recipient.

II. Market Risk (continued)

2.10 RWA Market Volatility

The portfolio-level drivers of mWIN’s drawdown risk are the sector mix, the credit-quality distribution, and the duration profile. The sector and rating tables below are the modeled target.

Portfolio Characteristics

The model portfolio is short-duration and investment-grade: effective duration 0.79 years, spread duration 2.04 years, average credit quality A+. To first order, a 100 basis-point rate move costs roughly 0.8% of value and a 100 basis-point spread widening roughly 2%. The live book, as reported by the issuer as of September 15, 2026, carries an effective duration of 0.6 years, a spread duration of 2.6 years, and a market yield of 5.52%. On that spread duration the same widening costs roughly 2.6%. The issuer states that the portfolio ramp-up is complete and the book sits close to the model portfolio.

On August 26, 2026, the live book held 94 positions worth USD 24.7 million, an average position of roughly USD 263,000, spread across 16 collateralized loan obligation managers with 26 deals and 44 corporate bonds from 44 issuers. Minimum lot sizes of USD 100,000 to 250,000 keep the position count low while the fund is small, with positions expected at 0% to 2% each as the fund grows. Two guardrails bind in advance: a 5% cap on any single issuer or issuing trust of structured securities, government paper excepted, and a 0-to-2-year band on portfolio effective duration. Neither rule limits how sensitive the book can be to widening credit spreads. That exposure is set by the manager’s day-to-day positioning choices rather than by any mandate limit. The mandate also permits instruments the model book does not hold, repo transactions, to-be-announced forwards, and interest-only, principal-only, and inverse-floater mortgage tranches, so the mandate allows more rate sensitivity than the model shows.

Sector Exposure

The modeled sector allocation is built from three sleeves: a 55% Structured Finance and Floating-Rate Income sleeve, a 25% High-Quality Institutional Credit sleeve, and a 20% Liquidity and Defensive Anchors sleeve. The investment guidelines cap no sector, so the weights below are the modeled composition.

Source: Documents shared under NDA, June 2026

The single largest modeled sector is CLOs at 40%, almost entirely A-rated. Structured and securitized product taken together is roughly 75% of the model book and 75.1% of the live book, so the dominant risk factor is securitized-credit spread, not corporate or sovereign risk. The forward-looking stress analysis credits a United States rates and agency-RMBS allocation as a flight-to-quality offset.

The live book is positioned more heavily in collateralized loan obligations than the model which is confirmed by the issuer to be an active-management choice: Wellington’s strategic targets have moved since the model portfolio was struck. The asset-backed securities are 56.0% of market value, all of them collateralized loan obligations backed by broadly syndicated bank loans, mortgage paper 19.1% across passthroughs and collateralized mortgage obligations, corporates 20.1%, and a single Treasury position 4.8%. It is expected that the asset-backed sleeve broadens over time into traditional and esoteric consumer and commercial deals such as autos, credit cards, and equipment.

The leverage prohibition is settlement-based, the account counts as levered only if overdrawn on a settlement basis, while the permitted futures, swaps, options, and repo can carry economic leverage without one. And compliance is checked only at purchase. A limit exceeded through market moves, cash flows, or rating changes is not a breach, Wellington may continue to hold, must notify within 30 days, and no cure obligation or forced sale follows. This has two consequences. The book is never forced to sell below fundamental value to cure a passive breach, and nothing forces it back inside its limits.

Sector Stress Behaviour

No daily return series exists for the book, so each sleeve’s stress behaviour is read from a daily-priced fund over the same paper. The figures are exchange prices.

In the model book, asset-backed securities and non-agency residential mortgage paper, roughly 20% of market value, have no public proxy. On the live book the asset-backed line is held entirely in collateralized loan obligations, so the CLO proxies reach it and the uncovered residual is the non-agency mortgage paper alone. The corporate and mortgage proxies carry ten years of history including March 2020, while the CLO proxies list only from October 2020 and January 2022, so the reference for 56.0% of the live book has never traded through a liquidity event of that kind. The chart carries the episodes, with each proxy’s worst one-day and five-day prints, the figures the parameter work uses, in the legend. Its deepest prints are −12.86% on the corporate proxy over ten trading days in March 2020, and the 2022 rate shock on the collateralized loan obligation proxies, −3.96% at AAA against −13.65% at BBB, the spread the credit-quality discussion leans on.

Source: NASDAQ, August 18, 2026

The sleeves don’t have high correlation and how they couple depends on the shock. In the 2022 rate shock the rate-sensitive sleeves moved together, a 0.88 daily-return correlation between the corporate and agency-mortgage proxies, while the floating-rate collateralized loan obligation proxies decoupled from both at correlations near 0.3. In the March 2020 liquidity event daily correlations were low, 0.14 to 0.66 across the three proxies with 2020 history, yet all three printed their worst days inside the same eight trading days. The low daily correlations offer no real protection as in a liquidity event all of the sleeves fall in the same week, meaning that longer horizon correlation is the driving factor.

Geographic Exposure

The reviewed materials do not break the portfolio out by country or region. The sector composition is United States-centric, built on United States agency and non-agency mortgage paper, United States CLOs and ABS, and United States investment-grade corporates, and the stress analysis references North American credit and United States rates exposures.

The portfolio is United States-dollar-denominated, non-dollar securities are capped at 10% of the book and must be hedged 100% back to the base currency within a 99%-to-101% band, and active currency management is not permitted. Currency risk is therefore bounded to a small, fully hedged residual.

Credit Quality

The modeled book is entirely investment grade. The rating distribution from the modeled snapshot is as follows.

Rating Market value %
AAA 5%
AA 26%
A 47%
BBB 22%

Source: Documents shared under NDA, June 2026

More than 75% of the modeled portfolio is rated A or higher, and there is no sub-investment-grade or unrated allocation in the snapshot. Every modeled position carries an external rating. This snapshot is more conservative than the mandate permits. The investment guidelines require only an investment-grade weighted-average rating and allow up to 50% in BBB or Baa securities, up to 10% rated below investment grade, and up to 10% unrated. A+ average is expected by the issuer for the live book once ramping completes.The live book is rated higher than the model. As reported by the issuer as of September 11, 2026, it is 55% AAA, 24% AA, 8% A and 13% BBB, so 79% sits in the two top rating bands against 31% in the modeled snapshot, and 87% is rated A or better against 78%.

What the rating mix does to volatility and tail risk is evidenced in the stress behaviour subsection, where the AAA and BBB collateralized loan obligation proxies bound the book’s blend: annualized volatility runs near 2% at pure AAA against 5.4% at pure BBB, and the worst observed episodes near −4% against −13.7%. The modeled composition, 78% rated A or better, sits between those bounds, closer to the AAA end and the live composition, with 79% in AAA and AA, sits closer still.

The Palmer Square CLO Senior Debt Index, daily since 2015 and covering AAA-senior collateralized loan obligation debt, drew down 8.33% peak-to-trough into March 24, 2020, over 19 trading days with 115 trading days underwater, with a worst single day of −1.57%. The mWIN model book, holding its CLO exposure four to five rating notches below that index alongside non-agency mortgage and asset-backed paper, backtested a 13.32% drawdown in the same window, roughly 1.6 times the senior index, and roughly 17% carried to the live book’s 2.6-year spread duration. The senior index is a floor on this composition’s stress and no exchange-traded fund exists at the model book’s A-rated centre of gravity, the AAA and BBB funds in the sector-stress table bracketing it from either side.

Originator / Issuer Concentration

Source: Wellington, August 19, 2026, shared under NDA

The book spans 16 collateralized loan obligation managers across 26 deals, 2 non-agency mortgage deals from distinct managers, and 44 corporate bonds from 44 issuers. The investment guidelines’ 5% structured-securities cap applies per deal, each deal being a distinct legal entity, and every deal sits inside it. No cap reaches manager-level exposure or the corporate sleeve.

The levels themselves are low: no manager above 7.0%, no single issuer above 3.6%, no corporate name above 1.0%. Current concentration is acceptable.

Liquidity Profile

There is no maturity-bucket distribution is available. Wellington’s simulation of the live portfolio, shared under NDA, puts 63% of the portfolio saleable in one day under normal market conditions on its expected path, 76% on its 95th-percentile path, and 100% of every sector’s market value within one week. The simulated cost of selling the whole book is 0.1% of market value, or 0.28% if the whole book is fire-sold in a day, with collateralized mortgage obligations the widest sector at 0.75% and 2.24%. Under the simulation’s stressed conditions an orderly sale reaches roughly 87% of market value in one week and 99% in one month, and a same-day fire sale of the whole book is priced at roughly 3.3%.

2.11 Peer / Sibling Case Study

mWIN’s weeks of live history contain no stress event, so the relevant precedent for how its tokenization infrastructure behaves under stress comes from the other products on the Midas platform. Its closest architectural sibling is mGLOBAL, with which it shares the mTokenPermissioned base contract and the same on-chain ProxyAdmin, TimelockController, and access-control singletons. mGLOBAL is itself a recently structured product with no observed stress event of its own, so the only Midas token that has passed through a credit-stress episode with an on-chain oracle write-down is mF-ONE, a token backed by the Fasanara F-ONE trade-receivables fund that runs on the same Midas issuance, redemption, and oracle framework mWIN inherits.

Event Timeline

mF-ONE was deployed on June 11, 2025. The stress sequence ran as follows.

Date Event
September 24-28, 2025 First Brands Group files Chapter 11 bankruptcy (factoring-fraud allegations, roughly $24M Fasanara exposure). Oracle price unchanged.
November 3-6, 2025 The Stream Finance collapse triggers rapid redemptions. TVL falls from $80.5M to $24M at 100% utilization, with 14.3M mF-ONE burned through the redemption vault.
December 3, 2025 Oracle write-down: base NAV -1.96%, discounted oracle -2.07%. First on-chain signal, roughly 66 days after the bankruptcy filing.
December 8, 2025 A second exit wave follows the write-down; TVL falls to $45.8M.
February 27, 2026 NAV recovers above the pre-write-down level; collateral declines to $15.4M with zero liquidations throughout.

Observations

The dominant feature of the episode was the lag between the credit event and its appearance in the oracle. The First Brands bankruptcy was filed in late September 2025 and the oracle wrote the loss down on December 3, 2025, a gap of about 66 days produced by the amortized-cost, monthly valuation of an illiquid private-credit book. The lag opened a stale-price redemption window: roughly $14 million of mF-ONE was redeemed about 30 days before the write-down, exiting at a net asset value that did not yet carry the loss and leaving it with the holders who remained, while new capital kept entering at the same stale price.

No forced liquidations occurred despite the write-down and a spell of 100% utilization. That outcome rested on voluntary deleveraging by a small number of sophisticated borrowers, a single address repaying 71% of the USDC, not on any structural backstop. The 1.96% write-down itself was rebuilt in roughly 90 days by the fund’s receivables yield.

Relevance to mWIN

The infrastructure carries over but the loss model does not hold for mWIN. The 66-day lag and the stale-price window were products of an amortized-cost monthly valuation that mWIN does not share, and a realized single-name write-down is not mWIN’s dominant loss channel, as the valuation review above establishes. Three facts survive the translation:

  • The manual submission step between the published net asset value and the on-chain price is the same, and this episode is the observed behaviour of that step under stress.
  • The zero-liquidation outcome was decided by the voluntary behaviour of one dominant address, and roughly 73% of mWIN’s supply sits with its three largest investors, so the precedent of a few actors deciding the stress outcome carries over.
  • mWIN publishes a single daily feed with no analogue of mF-ONE’s discounted mint-and-redeem pair, so the 11 basis-point oracle discount visible in the write-down has no counterpart in mWIN’s design.

The comparison comes down to four points. On valuation cadence mWIN is materially safer: a daily mark-to-market strike would have compressed mF-ONE’s 66-day recognition lag to about one business day, and the stale-price redemption window with it. On backing mWIN is safer again: a marketable investment-grade book, simulated as roughly two thirds saleable in one day and fully within a week, can be sold to meet exits where mF-ONE’s private receivables could not, and a diversified securitized book has no analogue of the single-name fraud that produced the write-down. One design point runs the other way: mF-ONE’s discounted oracle pair built a small buffer into exits that mWIN’s single feed does not have. The manual submission step and the concentration of supply in a few holders are common to both and favor neither. The verdict is that an analogous episode should resolve significantly more safely on mWIN, on the strength of the valuation cadence and the asset backing.

2.12 Stress Testing

mWIN’s underlying is a marketable multi-sector fixed-income book, so the loss that matters for collateral is mark-to-market drawdown, not borrower default, and the stress analysis below sizes that drawdown.

Manager’s Forward Scenario Analysis

The forward-looking analysis applies a set of macro scenarios to the model portfolio and reports a first-order price impact and a carry-driven recovery time for each.

Scenario Modeled price impact Recovery time
Credit sell-off −2.54% 5.67 months
Risk-off −0.42% within 6 months
Severe recession −0.37% within 6 months
Base −0.21% within 6 months
Recession +0.10% n/a
Bullish +0.33% n/a

Source: Documents shared under NDA, June 2026

The worst modeled outcome, the 2.54% credit sell-off, is mild. As the issuer describes it, the scenario widens investment-grade and high-yield credit spreads by roughly 190 basis points and A-rated CLO spreads by roughly 320, and offsets part of that loss with a 200 to 250 basis-point fall in front-end interest rates. The 2.54% is therefore a net figure. The blended widening of roughly 230 basis points costs the model book about 4.7% through its 2.04-year spread duration, and the rally gives back about 1.6 to 2.0 percentage points through its 0.79-year effective duration. The offset is limited by the book’s short rate duration. At the live book’s 0.6-year effective duration a 200 basis-point rally recovers roughly 1.2 percentage points, which does not neutralize a spread event of crisis size. The same scenario applied to a pure AAA CLO portfolio gives a 5.5% drawdown, while the Palmer Square CLO Senior Debt Index fell 8.33% in March 2020, so the scenario is milder than that episode. The recovery times are conservative in one specific sense, they assume carry accrual alone with no spread retracement. Applied to the crisis drawdowns this section sizes, carry at the model book’s 4.63% net-of-fee yield would need roughly three years to rebuild a 12% to 13% drawdown and nearly four years to rebuild the 17% the live book’s spread duration implies. Those multi-year figures describe the slowest possible recovery, where prices never bounce back and interest income has to earn the whole loss back on its own. Actual crisis losses have recovered far faster, because most of the loss is prices marking down and prices rebound once spreads normalize: in March 2020 the book was down 13.32% at the worst point and still finished the same year up 4.98%.

The strongest tail evidence is the model’s own backtest. In March 2020 the book would have lost 13.32%, more than five times the manager’s worst forward scenario, and on the live book’s higher spread sensitivity the same episode is roughly a 17% loss. Because the net asset value is marked to market daily, the decline reaches the price feed day by day as it happens, so a borrower is liquidated on the first daily print past the trigger.

Independent Cross-Validation

3 independent checks were run against the manager’s figures.

The first recomputes the drawdown directly from duration, at the model portfolio’s 2.04-year spread duration and at the live book’s 2.6 years, applying broad credit-spread shocks of the magnitude seen in past dislocations.

Spread shock Model book, 2.04y Live book, 2.6y
+250 bps (moderate crisis) 5.1% 6.5%
+400 bps (severe crisis) 8.2% 10.4%
+600 bps (GFC-scale investment-grade peak) 12.2% 15.6%
+600 bps with a 200 to 250 bps rates rally 10.5% 14.2%

Source: LlamaRisk, on durations shared under NDA, June and September 2026

The second replays the last decade through the sector proxies. The five proxies, covering 80% of the model book, are combined at the model’s sleeve weights, renormalized as each proxy lists, and the composite’s drawdown path is read against the manager’s loss points. On the live book the same proxies reach every sector except the non-agency mortgage paper. The replay troughs at −9.5% in March 2020 and −9.8% in the 2022 rate cycle. Both sit far below the −2.54% worst forward scenario, which the composite in fact breaches even in ordinary years, and both stay inside the −13.32% model backtest trough, which remains the deepest print on the page.

Source: LlamaRisk, August 2026

The linear extrapolation understates the securitized book, where collateralized loan obligation and non-agency mortgage spreads gapped wider than corporates in both 2008 and 2020, so the observed −13.32% stays the better crisis anchor for the model composition. Rate risk is secondary: at the model’s 0.79-year effective duration the 2022 hiking cycle produced only a −1.57% year, and the guidelines hold effective duration under two years. Combining both legs at crisis magnitude, 600 basis points of spread widening and a 200 basis-point rate rise, gives roughly 13.8% first order on the model book, in line with the −13.32% it printed, and roughly 17% on the live book’s durations. The same widening with the flight-to-quality rally Wellington’s scenario assumes, a 200 to 250 basis-point fall in rates, nets to roughly 10.5% on the model book and 14% on the live book. The rates gain stays near two points at most, because effective duration is under one year and rates can only fall so far, while the spread loss keeps growing with the widening. The 2022 cycle showed the offset can also run the other way, with rates rising as spreads widened.

A third check reads the same proxies at daily resolution, since a daily-strike collateral feed is exposed to what one publication can move.

Proxy Coverage Worst 1-day Worst 3-day Worst 5-day
VCSH, 1 to 5 year investment-grade corporates Aug 2016 to Aug 2026 −3.43% (2020-03-19) −6.37% −8.74% (2020-03-12 to 2020-03-19)
VCSH excluding 2020 −0.92% −1.90% −2.24% (June 2022)
JAAA, AAA collateralized loan obligations Oct 2020 to Aug 2026 −1.03% (2025-04-10) −1.25% −1.60%
JBBB, BBB collateralized loan obligations Jan 2022 to Aug 2026 −2.26% −3.61% −4.99% (Sep 2022)

Source: Nasdaq historical quotes, fetched August 18, 2026

The panel carries three gaps. The figures are exchange prices rather than net asset values, and in March 2020 short-duration bond fund prices traded below net asset value, so the 2020 rows overstate what an evaluated-price net asset value would have printed. VCSH carries a spread duration near 2.6 years, above the model portfolio’s 2.04 and equal to the live book’s 2.6, so the panel overstates the model book’s single-day sensitivity and matches the live book’s. The two collateralized loan obligation funds are floating-rate like the CLO sleeve, 40% of the model book and the whole of the live book’s 56.0% asset-backed line, JBBB sits one notch below the modeled sleeve’s A-rated bulk, and neither existed in March 2020.

Crisis Extrapolation and Default Overlay

Because the dominant loss channel is mark-to-market, the headline crisis figure is the drawdown extrapolation above: on the model book, on the order of 5% in a moderate crisis and 12% at a GFC-scale spread peak, roughly 6.5% and 16% on the live book’s spread duration, and the −13.32% the model book actually printed in March 2020, roughly 17% carried to the live book. Actual defaults add little even in the worst case. Take the riskiest book the mandate allows, up to 50% BBB, 10% below investment grade, and 10% unrated, and let crisis-peak default rates hit it with zero recovery: the loss is on the order of 2.5%, roughly 1% at a realistic 60% recovery, almost all of it from the below-investment-grade and unrated slices. Against crisis price drawdowns near 13% on the model book and near 17% on the live book, that is a fifth the size or less, so falling prices, not failing borrowers, remain the important loss channel.

Assessment

The conservatism verdict is that the manager’s scenario set understates the tail. The worst forward scenario, −2.54%, sits below the composite proxy replay’s near-10% crisis troughs and far below the portfolio’s own realized −13.32% drawdown. This is not a defect in the manager’s model, which measures a carry-driven recovery under moderate shocks and is sound for that purpose. The mitigating structural features remain real and are quantified elsewhere:

  • The effective-duration cap limits rate risk. The guidelines set it at zero to two years and the issuer states it has been tightened to one year, with the model portfolio at 0.79 years and the live book at 0.6 years inside it.
  • The mandate holds the weighted-average rating at investment grade, with up to 50% BBB and up to 10% below investment grade permitted, and the 5% single-issuer cap limits single-name risk within the structured book.
  • The daily mark-to-market NAV recognizes a drawdown within one business day, not after months of smoothing.
  • A mark-to-market loss retraces with spreads where a defaulted private-credit loss does not.

Limitations

Three limitations stand:

  • The manager supplies scenarios, not a full loss distribution, so the only tail evidence is the March 2020 backtest, and losses have no reason to stop at what one episode produced.
  • The analysis is struck on the model portfolio while the live holdings are known only through manager-provided aggregates. The live book has a spread duration of 2.6 years against the model’s 2.04, driven by a heavier collateralized loan obligation allocation. CLOs cluster at three to four years of spread duration with new issues at six to eight. The issuer states that Wellington has agreed limits of one year on interest-rate duration and four years on spread duration, with the objective of staying below both. The spread-widening losses shown in this review scale up by roughly a quarter on the live book, and by roughly 95% at the four-year limit.
  • The mandate checks its limits only when a position is bought, with no duty to sell if the book drifts past them afterwards, so the live book can move further from the analysed composition over time, and the model book is already more conservative than the mandate requires.

Therefore, as we underwrite the asset initially, the recommended parameters are set more conservatively comparing to what operational evidence would allow.

III. Technological Risk

3.1 On-chain footprint

mWIN is deployed on Ethereum mainnet only, with no bridge or remote deployment. The token is an ERC-20 built on the permissioned Midas variant (mTokenPermissionedMinBalance), carrying three on-chain gates: a permissioned-transfer greenlist enforced at the ERC-20 transfer level, a sanctions blacklist, and a global pause. Minting and redemption route through dedicated vaults that read price from a NAV feed chain anchored to a single administrator-submitted NAV source. The cluster shares its role registry, upgrade admin, and timelock with other deployments on the Midas platform.

Component Address Role
mWIN token (proxy) 0x4E72025984424E52838cf8953E2863eFf036B67A ERC-20 (mTokenPermissionedMinBalance), 18 decimals, with permissioned-transfer greenlist, sanctions blacklist, and global pause
NAV custom-aggregator feed (proxy) 0x1725A66D810C0775f6B3B0FD85646D371dA19517 Manual NAV oracle (mWIN/USD, 8 decimals), administrator-submitted
Data feed wrapper (proxy) 0xa27c1658730e4FAFb7fB8B257a64BbB6A0ea4077 Chainlink-compatible (AggregatorV3) wrapper the vaults consume
Chainlink mWIN NAV feed (proxy) 0x3EC0233530c548Ab984eb06BEE8a2E404aeA7557 MWIN NAV, 8 decimals, reported by a Chainlink oracle network through an OCR2 aggregator
Deposit vault (proxy) 0xF7F1b944FCDe7805F6Ef3088817145d2eB667db4 USDC or PYUSD to mWIN instant mint path
Redemption vault with swapper (proxy) 0x605704d7b36d1677a8d242ded68eD505523c7924 mWIN to USDC or PYUSD redemption on the MSL path, routes through the mTBILL USTB vault via an external liquidity provider
Redemption vault, Internal Liquidity Sleeve (proxy) 0x14fECa41FB9541Fd8f61a6bA6304c5b706709fca mWIN to USDC redemption funded from the sleeve, redeems its own mTBILL through the mTBILL USTB vault when short of USDC
MidasAccessControl (proxy, shared) 0x0312A9D1Ff2372DDEdCBB21e4B6389aFc919aC4B Role registry granting and revoking every M_WIN_* role
ProxyAdmin (shared) 0xbf25b58cB8DfaD688F7BcB2b87D71C23A6600AaC Upgrade admin for every mWIN proxy above
TimelockController (shared) 0xE3EEe3e0D2398799C884a47FC40C029C8e241852 Owner of the ProxyAdmin, 48-hour minimum delay
MSL liquidity provider 0xee382068364Ed944D72183CdF83DE5630DB59ccB Off-portfolio account funding instant redemptions on the swapper path only

mWIN is built on the Midas permissioned token variant, so the greenlist gate sits at the transfer level on top of the deposit and redemption gates present in earlier Midas tokens. Three features of the cluster carry through the rest of the technological and pricing analysis.

  • Two redemption vaults and no separate standard redemption vault. The swapper draws on an external MSL liquidity provider, and the sleeve vault holds the compartment’s own mTBILL. Both are built on the same Midas redemption base and both sit under the shared ProxyAdmin and its 48-hour timelock. Both burn mWIN, the swapper lists USDC and PayPal USD (PYUSD) as payout tokens, and the sleeve vault lists USDC only.
  • A single NAV feed. The deposit vault mints at NAV and the redemption vault settles at NAV less the instant fee, so the discount sits in the vault fee.
  • Instant redemption liquidity routed through the mTBILL USTB redemption vault, with no standalone credit line. The swapper’s liquidityProvider and mTbillRedemptionVault targets are non-timelocked and can change immediately, as is the sleeve vault’s redemptionVault target, which its vault admin can reset in one transaction.

3.2 Upgrade architecture

7 functional contracts are upgradeable transparent proxies.

Proxy component Implementation
mWIN token 0x3421478BdE3ce905d85fE24682FA8CafdFF3E44a
NAV custom-aggregator feed 0x7156b140AaD6999F48767Db6687F46e8Df331C4C
Data feed wrapper 0x1D0CB5685791F6E9ABc1B876E3b9017F8aa1807c
Deposit vault 0x30eA22780397d82116b905E7471cCA458aaf6053
Redemption vault with swapper 0xeb21dB42a06Dc73353C6fa2956f5D8dAdCC0879c
Redemption vault, Internal Liquidity Sleeve 0x765F5c63961325102BFcbC92a9f3fd0193dD4D90
MidasAccessControl 0xDd5a54bA2aB379A5e642c58F98aD793A183960E2

Every admin slot resolves to the ProxyAdmin, which is shared across the Midas platform deployments. Its owner() returns the TimelockController, which is therefore the only address that can authorise an upgrade or admin action on any of these proxies. The TimelockController carries a minimum delay of 48 hours and self-administers its TIMELOCK_ADMIN_ROLE, the standard OpenZeppelin pattern under which changes to the timelock’s own role membership must queue through the same 48-hour delay, with no privileged escape path.

The cluster was deployed on June 3, 2026 and first seeded the following day. The token implementation has been upgraded twice since then, on June 22, 2026 and on July 28, 2026, and the NAV custom-aggregator implementation once, on July 28, 2026. The deposit vault and the redemption vault with swapper were each upgraded once, on June 15, 2026. The Internal Liquidity Sleeve vault was deployed on July 2, 2026 and has not been upgraded. The data feed wrapper has not changed. Every upgrade ran through the ProxyAdmin-to-Timelock chain and its 48-hour delay. The code now running in the transfer path and in the priced path dates from July 28, 2026.

The 48-hour timelock does not extend to role grants and revocations, to vault parameter changes such as fees and daily limits, or to the manual NAV price submission. Those paths execute immediately under the access-control roles.

3.3 Audit history and bytecode lineage

The mWIN token contract extends mTokenPermissionedMinBalance, the shared Midas permissioned-token base.

Source: LlamaRisk, August 27, 2026

The mWIN-specific contracts (mWIN, MWinDepositVault, MWinRedemptionVaultWithSwapper, MWinDataFeed, MWinCustomAggregatorFeed, and MWinMidasAccessControlRoles) are thin product subclasses that set only names, symbols, and role identifiers over the shared base.

Four public audits cover the broader Midas codebase that the inheritance chain reuses.

Audit Date Coverage Outcome
Hacken (first) Sep 2023 Original mTBILL vaults No open findings after remediation
Hacken (second) Jan 2024 mTBILL vault, December 2023 scope 1 High and 2 Medium resolved; 1 Low (burn-from-holder without prior notice) accepted by design
Sherlock (first) May 2024 mTBILL upgraded contracts Storage-gap inconsistency fixed; pause-authority documentation added
Sherlock (second) Aug 2024 Minter / Redeemer and BUIDL variant BUIDL-path denial-of-service fixed; further storage-gap adjustments

The transfer gate itself was reviewed privately. Côme du Crest reviewed the mTokenPermissioned base at pull request 194 of midas-apps/contracts, commit ff4d994, reporting no issues, and the Information Memorandum lists them with an internal reviewer at Gnosis as the architecture’s private reviewers. Both reviews are private.

Every implementation the cluster runs postdates every attestation. The four public audits are two to three years old and cover the mTBILL-era vaults and the Minter/Redeemer family, not the mWIN contracts. The live vault implementations date from June 15 and July 2, 2026, and the token and NAV aggregator implementations from July 28, 2026. That July 28 token implementation added the minimum-balance enforcement to the transfer path, newer than even the private review.

The Midas bug bounty is live on Sherlock and Cantina, paying up to $500,000 in USDC for a critical vulnerability across smart contracts, configuration, and front-end. No unfixed critical findings are reported across the public audits or the bounty.

3.4 Access control model

Role management is centralised in MidasAccessControl, shared with other Midas deployments. The registry is OpenZeppelin’s AccessControlUpgradeable with three changes:

  • Deployer bundle. At initialisation one account received the top-level administrator, vault-admin, list-operator, and token-operator roles in a single call. The roles were then distributed to the operating wallets.
  • Re-parented list roles. The vault-level greenlist and blacklist membership roles are administered by their operator roles, so list changes do not need the default administrator. The token-level greenlist that gates ERC-20 transfers (M_WIN_GREENLISTED_ROLE) is not re-parented: every grant and revocation of it runs through the default administrator, and all 59 grants on the deployed registry were made by it.
  • No renunciation. A call to renounceRole reverts with MAC: Forbidden. A compromised signer cannot self-clear, and only the role’s administrator can move a role, by granting then revoking.

Role changes are not timelocked. The 48-hour delay covers contract upgrades only, so the only safety on a role change is the off-chain control at the role holder.

The mWIN-namespaced roles are unreachable from another Midas deployment’s admin roles. The blacklist is the exception. BLACKLISTED_ROLE and BLACKLIST_OPERATOR_ROLE are Midas-wide, the token’s transfer hook enforces them on both the sender and the recipient of every transfer, and any of the role’s 52 holders, all externally-owned accounts onboarded across the whole product line, can freeze an address’s mWIN in a single transaction.

Role Purpose Holder (on-chain)
DEFAULT_ADMIN_ROLE Grant and revoke every role in the registry, including the token-level greenlist Externally-owned account 0xd4195CF4df289a4748C1A7B6dDBE770e27bA1227 and the Midas Proxy and ACL Admin Safe 0xB60842E9DaBCd1C52e354ac30E82a97661cB7E89, a nominal 1-of-3 whose owners are two multi-party-computation systems at issuer-stated 4-of-7 quorums and a Team Signer Safe at an on-chain-verified 3-of-7
BLACKLIST_OPERATOR_ROLE Manage blacklist membership, generic Midas-wide role, not namespaced to mWIN 52 externally-owned accounts across the Midas product line, among them the token role-manager EOA 0x20D4CeD0EFac28517C1b0a06F98B1180F28f5125
GREENLIST_OPERATOR_ROLE Manage vault-level greenlist membership, the gate no vault enforces, generic Midas-wide role 52 externally-owned accounts, among them the token role-manager EOA 0x20D4CeD0EFac28517C1b0a06F98B1180F28f5125
BLACKLISTED_ROLE Revokes transfer and redemption rights, generic Midas-wide role administered by BLACKLIST_OPERATOR_ROLE (membership gate)
GREENLISTED_ROLE Vault-level gate, not enforced: the vaults read greenlistEnabled as false (membership gate)
M_WIN_GREENLISTED_ROLE Token-level gate: required for ERC-20 transfers, administered by DEFAULT_ADMIN_ROLE (membership gate)
M_WIN_MINT_OPERATOR_ROLE Mint mWIN Deposit vault and the token role-manager EOA 0x20D4CeD0EFac28517C1b0a06F98B1180F28f5125
M_WIN_BURN_OPERATOR_ROLE Burn mWIN from any holder, no allowance required Both redemption vaults and the token role-manager EOA 0x20D4CeD0EFac28517C1b0a06F98B1180F28f5125
M_WIN_PAUSE_OPERATOR_ROLE Global token pause Token role-manager EOA
M_WIN_DEPOSIT_VAULT_ADMIN_ROLE Configure and pause the deposit vault Vault role-manager EOA
M_WIN_REDEMPTION_VAULT_ADMIN_ROLE Configure and pause the redemption vault and swapper Vault role-manager EOA
M_WIN_CUSTOM_AGGREGATOR_FEED_ADMIN_ROLE Manage the NAV custom-aggregator feed Oracle role-manager EOA

Two powers matter most for a Horizon listing, because either one freezes the Aave Pool’s mWIN balance in a single transaction with no on-chain delay.

  • Blacklisting the Pool, open to 52 keys, the token role-manager wallet among them.
  • Revoking the Pool’s token-level greenlist, a default-administrator power. The default administrator can also grant or revoke the mint, burn, pause, vault-admin, feed-admin, and minimum-balance-exemption roles, none of it timelocked.

The split of the two freeze powers across different holders is not a segregation control. It places the second freeze power at the root of the registry.

Off-chain the two freeze paths carry different protection.

Holder Freeze power Off-chain control
Token role-manager Blacklist the Pool, pause the token Fordefi MPC wallet, 4-of-8 quorum, one-signer fast path for blacklist and pause, 3 signers to reverse
51 further blacklist-operator accounts Blacklist the Pool None disclosed
Default administrator, externally-owned account Revoke the Pool’s greenlist, grant or revoke every role None disclosed, a plain key
Default administrator, Safe Revoke the Pool’s greenlist, grant or revoke every role Nominal 1-of-3 whose owners are two multi-party-computation systems at issuer-stated 4-of-7 quorums and a Team Signer Safe at an on-chain-verified 3-of-7

Source: Documents shared under NDA, August 2026, and MidasAccessControl, August 17, 2026

The greenlist freeze path and the registry root therefore sit behind a weaker control than the token role-manager wallet, which itself clears a blacklisting on one signer. The blacklist freeze is additionally reachable from 51 further keys for which no control is described at all.

3.5 Pause surface

Two pause mechanisms coexist.

  • Token-level pause. Halts all ERC-20 balance state changes, which means transfers, mints, burns, and any liquidation against the token. Its authority is M_WIN_PAUSE_OPERATOR_ROLE, held on-chain by the token role-manager wallet.
  • Vault-level pause. Adds a per-selector mask, so a single entry point such as instant redemption can be paused while other paths on the same vault keep operating. Its authority is the relevant vault-admin role, held by the vault role-manager wallet.

The token is not paused at the time of this assessment. A token-level pause is the more consequential of the two for a collateral position, because while it is active a liquidation cannot transfer the seized mWIN and the position cannot be unwound on-chain until the pause is lifted. Like every role action, a pause executes immediately with no on-chain delay.

3.6 Token-level semantics

The defining behaviour of mWIN at the token level is the permissioned transfer. The _beforeTokenTransfer hook of mTokenPermissionedMinBalance requires M_WIN_GREENLISTED_ROLE on the recipient of every transfer or mint, on cross-wallet transfers on the sender as well, and enforces the blacklist on both parties on top. The combined behaviour:

  • Transfers between two greenlisted wallets that are not blacklisted: pass.
  • Transfers or mints to a wallet without M_WIN_GREENLISTED_ROLE: revert.
  • Burns: skip the greenlist check, so burn-from-any-holder remains functional.
  • Blacklisted addresses cannot send or receive.
  • Every transfer, mint, or burn must leave both sides holding either nothing or at least one whole mWIN, roughly $130,966 at the live net asset value, unless the address holds M_WIN_MIN_BALANCE_EXEMPT_ROLE.

The minimum balance reaches partial liquidation directly. A seizure that would strand a sub-token remainder on either side reverts unless the address concerned is exempt, so the smallest position a non-exempt wallet can carry, and the smallest remainder a partial liquidation can leave, is one note. Six addresses hold the exemption, the swapper’s external liquidity provider among them and none of the three mWIN vaults, and the exemption changes by a role action that executes immediately.

The burn function takes an explicit holder address and does not check allowances, so the burn-operator role can destroy any holder’s mWIN without approval, flagged in Hacken’s December 2023 audit as low severity and accepted by design. Metadata setting is restricted to the top-level administrator role.

3.7 Oracle architecture

mWIN prices off a two-contract feed chain. A single network-asset-value custom aggregator holds the manually submitted mWIN/USD price, and a Chainlink-compatible data-feed wrapper reads that aggregator and exposes the base-18 price the vaults consume. Chainlink has deployed an mWIN NAV feed on Ethereum mainnet, reported by a Chainlink oracle network through an OCR2 aggregator, which at the time of this assessment carries the same net asset value as the Midas aggregator. There is no separately deployed mint feed at a positive offset and no redemption feed at a negative offset, so the deposit vault mints at the net asset value the aggregator reports and the redemption vault settles at that same value less the instant fee.

The custom aggregator is an AggregatorV3-style contract whose answer the oracle role-manager wallet holding M_WIN_CUSTOM_AGGREGATOR_FEED_ADMIN_ROLE submits each round, striking one round each business day. Three on-chain circuit-breakers bound a submission:

  • a per-round deviation band of plus-or-minus 27%,
  • a floor of $90,000 and a ceiling of $140,000 on the answer,
  • a staleness tolerance of 30 days carried on the data-feed wrapper.

The attestation pipeline is a Chainlink Cross-Chain Runtime Environment (CRE) proof-of-reserve that has confirmed overcollateralization since August 3, 2026, computed from claims Midas provides using Northern Trust’s net asset value. The vLayer-notarised email flow described in the offering materials is not the deployed pipeline, and Northern Trust application programming interface (API) access that would let the workflow pull the net asset value directly is pending.

3.8 Minting and redemption vaults

Three vaults bracket the token. A deposit vault handles stablecoin-in (USDC or PayPal USD) and mWIN-out. Two redemption vaults, the swapper and the Internal Liquidity Sleeve vault, handle mWIN-in and stablecoin-out.

Source: LlamaRisk, September 17, 2026

The deposit vault exposes an instant entry point that settles in one transaction and a request-based entry point that queues for back-office processing. Every entry passes three checks: the caller must not hold the blacklist role, must clear the Chainalysis sanctions oracle, and the relevant selector must not be paused. The instant mint limit is 155 mWIN a day, roughly $20.2 million,

The redemption vault with swapper settles an instant redemption from its own balance of the output asset where that balance is sufficient, and otherwise activates the swapper path. The redeemer’s mWIN is transferred to the external liquidity provider, the provider supplies mTBILL in return at the two oracle rates, and the vault redeems that mTBILL for USDC through mTBILL’s redemption vault, so the externally sourced USDC is raised by redeeming short-dated treasury-bill collateral.

The blacklist and sanctions checks apply on both branches. The vault’s own greenlist check greenlistEnabled is false. A redeemer must still be greenlisted in practice, because only a wallet holding M_WIN_GREENLISTED_ROLE can hold mWIN at all, and the swapper branch re-tests both parties at the token level when the mWIN moves to the provider. The gap is the payout destination. The entry point that names a separate recipient no longer screens that recipient, so redemption proceeds can be paid to a wallet that has never been greenlisted, subject only to the blacklist and sanctions checks.

On the deployed contract the payment tokens are USDC and PayPal USD, the instant fee is 0.5%, the daily limit is 4 mWIN, roughly $524,000 at the live net asset value, and a fiat settlement adds 0.1% plus a flat $30. The configured minimum of roughly $1.00 of mWIN is not the operative floor, because the token leaves any redeemer holding either nothing or at least one whole mWIN. The slippage bound is 0.2%, compared in base-18 USD-equivalent units on both sides of the swap, so the denomination error Sherlock flagged in the BUIDL variant does not apply. Request-based redemptions settle through the dedicated request-redeemer.

The sleeve vault settles without an external provider. Its verified implementation MWinRedemptionVaultWithMToken burns the redeemed mWIN and always pays USDC, never delivering mTBILL in kind. Where its own USDC is short it redeems its mTBILL through the same mTBILL redemption vault inside the transaction, a fee-exempt hop. That vault raises its USDC by redeeming Superstate USTB and carries its own daily limit of 10 million mTBILL, roughly $10.7 million, so it does not bind ahead of the two mWIN vaults’ 4 mWIN limits. The vault holds the compartment’s mTBILL, roughly $1.9 million at the live read, screens against the same Chainalysis sanctions oracle as the deposit vault, shares the request-redeemer with the swapper, and sends collected fees to the fee receiver.

The daily limits, the fees, the slippage bounds, the greenlist flags, the swapper’s liquidity provider, and both mTBILL swap targets change by a vault-admin role action that takes effect immediately, outside the 48-hour upgrade timelock, and all of them are carried in the monitoring inventory shipped with this report. At the live total value locked the redemption vaults’ 4 mWIN daily limits are the binding throttle on an exit. That immediate-change power stands to lift the instant daily limits on short notice under redemption need

IV. Parametrization Recommendations

4.1 Market Parameters

Base Analysis (Without Buffer)

Two distances govern the parameter set, both measured from a fully drawn position at the maximum loan-to-value ratio: the net asset value decline that reaches the liquidation trigger, and the decline at which the collateral no longer covers the debt plus the 8% liquidation bonus.

Distance Base (67% LTV / 72% LT) GHO E-Mode (69% / 74%)
To the liquidation trigger 6.94% 6.76%
To bad debt 27.6% 25.5%

The deepest single-day print anywhere in the ten-year proxy record is 3.43%, from the March 2020 short-duration credit dislocation, struck on a proxy carrying a 2.6-year spread duration. The distance covers that raw print roughly twice over, and covers it about 2.1 times at the live book’s 2.6-year spread duration, which matches the proxy’s, once diluted by the sleeve, roughly 3.3% as published. At the four-year spread-duration limit the same print is roughly 5.0% as published, still inside the trigger distance. Measured against the ordinary daily distribution the margin is far wider again, since the proxy record’s daily standard deviation is near 0.2% and its worst day outside 2020 is under 1%.

Multi-day drawdowns are not sized into the spread, because they do not arrive in one print. A crisis-scale slide reaches the feed as a sequence of daily strikes, positions delever or liquidate progressively as it runs. The deepest drawdown the model book has printed, the 13.32% of March 2020, is roughly 17% carried to the live book’s spread duration.

Buffer Adjustment

The Internal Liquidity Sleeve dilutes the portfolio’s mark-to-market volatility, because the published net asset value blends the Wellington book with the sleeve’s short-dated treasury-bill holding. At the 5% cap every shock reaches the feed at 95% of its size, which leaves the manager’s worst forward scenario inside the trigger at roughly 3.1% carried to the live book’s spread duration and trims the scaled March 2020 drawdown to roughly 16.1% as published, roughly 11.5 percentage points inside the bad-debt distance. At the four-year spread-duration limit the same drawdown is roughly 24.8% as published, still inside the bad-debt distance. Episode-scale shocks still cross the trigger and liquidate progressively across the prints that carry them. The sleeve also carries a yield drag. Its mTBILL holding earned 3.27% annualized over the trailing 91 days, against the book’s 4.63% net-of-fee yield, which costs roughly 7 basis points of blended accrual and about 20 basis points of looped return at the 67% loan-to-value ratio. The looping figures below are struck on that blended basis.

Looping Profitability

The looping case turns on the spread between mWIN’s blended net asset value accrual, roughly 4.56% on the model portfolio’s market yield, and the Horizon borrow rate. At the recommended 67% loan-to-value ratio and the June 30, 2026 rates, looping mWIN against RLUSD returns roughly 7.0% on equity and against USDC roughly 3.7%. The USDC loop returns below the unlevered yield, so at these rates levering against USDC reduces the return on equity rather than raising it.

Borrow asset Borrow rate Net looping APY at 67% LTV (blended yield)
RLUSD 3.34% ~7.0%
USDC 4.98% ~3.7%
Unlevered n/a ~4.56%

Source: Aave, August 2026

The economics remain viable for the cheaper borrowable and negative for USDC at present rates. The figures carry the sleeve drag measured above, roughly 20 basis points of looped return, which the leverage partially offsets.

Supply Cap

The initial cap is 80 mWIN, roughly $10.5 million at the live net asset value of $131,064 per token, sized against redemption capacity and the expected lined-up demand. A filled cap clears through the standard fee-free route within one to two business days of the portfolio-sale settlement. Any increase is set on the same basis at the then-current supply.

General Market Parameters

Aave Horizon is an Aave v3.3 instance, and its live listings carry their collateral parameters in the base reserve configuration with a GHO e-mode adding a small collateral-efficiency uplift.

Parameter LlamaRisk recommendation
LTV 67%
Liquidation Threshold 72%
Liquidation Bonus 8%
Reserve Factor -
Optimal Utilization -
Base Variable Borrow Rate -
Variable Slope1 -
Variable Slope2 -
Supply Cap 80 mWIN
Borrow Cap -
Borrowing Enabled No
Usage as Collateral Yes
Isolation Mode No
Siloed Borrowing No
Borrowable in Isolation No
E-Mode mWIN GHO
Flashloan Enabled No

GHO E-Mode

Asset mWIN GHO
Collateral Yes No
Borrowable No Yes
LTV 69% -
LT 74% -
Liquidation Bonus 8% -

V. Pricing Setup

mWIN prices off the single administrator-submitted NAV feed read on-chain as stated in the technological review. The setup is the standard one used across the Horizon listings: the daily NAV struck by Northern Trust is published through the Chainlink mWIN NAV feed the Aave price source reads, and wrapped in LlamaGuard safety bounds parameterized to the asset. The feed carries the same value as the issuer’s administrator-submitted aggregator. The setup does not verify the source, because the aggregator round is an administrator submission and the Chainlink CRE proof-of-reserve runs on Midas-provided claims, so the bounds and the freshness window constrain how far a published value may move and how stale it may be. The analysis values a Pool-held or liquidator-held position at published NAV.

Two design features simplify the setup:

  • mWIN mints atomically at the full reported NAV with no mint fee and redeems the full fee-adjusted value in one transfer, so no entry or exit haircut bears on how collateral is valued while a position is open.
  • NAV publishes daily, so upward moves are small increments of accrued yield that are safe to release gradually, downward moves are losses that must reflect promptly, and the cadence already compresses the recognition lag the design has to defend.

5.1 Feed Behaviour and Bounds

The oracle steps to each newly published NAV when it is written and holds flat until the next write. The published NAV is net of the management fee and blends the Wellington book with the 5% mTBILL sleeve, so the feed accrues at roughly 4.56%, an average daily accrual of roughly 1.8 basis points. The full daily accrual lands in one block at each strike, but that block is under 2 basis points, so the step-function arbitrage the bounds must contain is negligible.

LlamaGuard wraps the feed with the parameters below, each sized to mWIN’s daily step and the drawdown magnitudes:

Parameter Value
maxExpectedApy 800 bps (8%)
upperBoundTolerance 50 bps (0.5%)
maxDiscount 250 bps (2.5%)
lowerBoundTolerance 100 bps (1%)
lookbackWindowSize 4

Disclaimer

This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.

1 Like

Thanks @LlamaRisk for the review, and for documenting the aggregator’s circuit-breakers – a $90,000 floor and a $140,000 ceiling on each submission. One check on the layer above it: on-chain, the data-feed wrapper’s minExpectedAnswer was set to 129,000 on 12 August and its maxExpectedAnswer to 150,000 on 29 July, and Midas noted (post 5) that the data feed reverts outside its bounds. If those still stand, the point from posts 2, 4 and 7 about a floor 0.8% below issue has moved layer rather than closed. Are they being brought in line when ready?

Two further items:

Staleness: the report still carries 30 days on the data-feed wrapper. Midas noted (post 5) that Aave would rely on staleness parameters set by LlamaRisk – what are they for the Horizon feed?

The bounds themselves: the report notes role changes are not timelocked. Does the same hold for changes to the floor and ceiling, and who can make them?

With the daily limits binding at roughly $1.05 million a day against an 80 mWIN cap, both matter the first time the book needs to exit quickly.