Summary
LlamaRisk supports the onboarding of stAVAX to Aave V3 Avalanche, with low caps initially set due to limited DEX liquidity. The liquid staking token was previously assessed for onboarding to the Avalanche instance and has changed its name from ggAVAX to stAVAX. Other changes include the introduction of a withdrawal mechanism that introduces a more predictable 15-day withdrawal process and an additional yield stream through validators engaging in MEV. This predictability, however, creates friction for potential Aave liquidations, as liquidators would experience a time lag when trying to redeem stAVAX from Hypha.
Negative changes impacting stAVAX include the significant decline in DEX liquidity, with ~$192K worth of stAVAX being able to be swapped within a ~7.5% price impact. This decline contrasts the $13M available for trade we observed in January 2025. Additionally, liquidity venues have seen recent large withdrawals, limiting secondary market trading opportunities (the largest pool currently has $~585K in TVL).
The centralization risk we observed persists, as Multisig Labs remains limited in transparency, controlling all protocol functions. Onchain supply remains relatively concentrated, with three holders controlling ~60%.
1. Asset Fundamental Characteristics
1.1 Asset
Staked AVAX (stAVAX) is an Avalanche liquid staking token issued by Hypha protocol, formerly known as GoGoPool (we previously analyzed ggAVAX in January 2025). stAVAX follows the ERC-4626 tokenized vault standard, representing a share of the underlying AVAX accrued through the Hypha protocol’s staking pools.
Hypha is an Avalanche-based infrastructure platform that enables custom Layer 1 (L1s) to launch on Avalanche’s C-Chain, providing a distributed staking and validation system. Developed by Multisig Labs, the staking design is similar to established liquid staking protocols, with AVAX deployed to Minipools allocated to operators.
1.2 Architecture
Deposit and Minting
Users receive stAVAX when staking AVAX on Hypha, receiving the prevailing internal exchange rate. Deposited AVAX is transferred to Avalanche’s P-Chain, where AVAX is staked to validator nodes called minipools through the MinipoolManager.
Staking rewards are programmatically returned to the Minipool’s vault, which increases the value of the stAVAX share token.
Minipools
Minipools are vaults that represent a validator node that AVAX jointly funds from a minipool operator and AVAX matched from the liquid staking deposit pool.
To operate a minipool, an operator must stake at least 1000 AVAX and 10% of the amount of the borrowed AVAX in GGP (Hypha’s governance token). Validators may be slashed should the operator not act in the interest of those delegating to them (for example, by failing to meet consensus on the network). stAVAX users do not need to repeatedly delegate their AVAX, as this is handled through protocol contracts.
Source: Past Minipools, Panopticon, October 23, 2025
Yield Accrual and Fees
Hypha runs on a continuous 15-day staking cycle; funds are transferred from the P-Chain to the C-Chain vault at the end of each cycle. Validators may participate in MEV (Maximal Extractable Value) to capture additional yield. Rewards are streamed as GGP and AVAX; stAVAX rewards are withdrawn as AVAX. MEV has yielded 0% APY, with yields coming exclusively from staking.
A current 10% protocol fee is charged on rewards earned, which the Protocol DAO determines. A lastRewardsAmt The call shows the most recent rewards distribution.
Unstaking and withdrawals
stAVAX withdrawals follow a First In First Out queuing system. After every 15 days, requests are processed in line with the staking cycle. A 3-day window is enforced for AVAX to be claimed before being restaked. Alternatively, instant DEX swaps are available via the Hypha App. The stakingTotalAssets function indicates AVAX staked. The 15-day lag would limit liquidators who try to redeem claimed stAVAX collateral from Hypha, reducing potential liquidation incentives for stAVAX.
While similar to established staking designs seen in other onboarded LSTs, Hypha’s liquid staking design presents unique features such as dual staking reward streams and a staking marketplace for Avalanche-based L1s.
1.3 Tokenomics
Each stAVAX represents a share of deposited and accrued AVAX from staking rewards. stAVAX is non-rebasing and represents a share of an underlying vault.
GGP is an ERC20 token that is the protocol token used to operate minipools, DAO governance, and reward distribution. It may also be slashed if the validator results in low runtime. Their slashed GGP will be auctioned to other GGP holders at a discount, with funds generated passed to stAVAX stakers.
The GGP token serves two DAOs: the protocol DAO and the oracle DAO. The Oracle DAO is focused on fundamental protocol operations such as staking rewards distribution. The Protocol DAO is more concerned with longer-term strategic initiatives like liquidity approaches or treasury management. Neither of these DAOs currently exists.
1.3.1 Token Holder Concentration
The top 5 addresses hold approximately ~70% stAVAX, with the top 3 addresses being a Multisig (~39%), EOA (~11%), and a Folks Finance contract (~9%). Total supply is currently 1.13M stAVAX.
Source: stAVAX Holders, Snowtrace, October 23, 2025
2. Market Risk
2.1 Liquidity
Liquidity is relatively low, with 8800 stAVAX (~$192K) that can be swapped within a ~7.5% price impact for WAVAX. This represents a significant decline from our initial analysis from $13M swappable within a ~7% price impact.
Source: Kyberswap stAVAX to WAVAX, October 23, 2025
2.1.1 Liquidity Venue Concentration
4 pools are available with a TVL over $10K as tracked by Dexscreener. The most significant pool is a stAVAX/WAVAX LFJ pool worth $585K.
Source: stAVAX DEX Pools on Avalanche*,
Dexscreener, October 23, 2025*
2.1.2 DEX LP Concentration
As shown above, the LFJ pool is the most active by 24-hour volume, representing the main trade venue. However, it should be noted that the pool experienced a large withdrawal of liquidity by a single address on September 25, 2025 (>September 25 Liquidity Book Router contract).
Source: stAVAX/WAVAX LFJ pool Balance History, Arkham, October 23, 2025
Source: Large pool withdrawal, Arkham, September 25, 2025
2.2 Volatility
stAVAX’s secondary market price relative to WAVAX experienced continuous growth until mid-September 2025. September 15 and SeptSeptember 15aw thSeptember 25-off figures over 6 months. This is consistent with the large withdrawals from one of the most historically liquid pools.
Source: ggAVAX/WAVAX price chart, GeckoTerminal, October 24, 2025
stAVAX/WAVAX’s internal exchange rate, by contrast, has remained relatively consistent. The recent volatility in open markets represents a low opportunity for arbitrage by purchasing stAVAX on the secondary market and unstaking from Hypha. When users unstake, stAVAX is converted to a fixed AVAX value (additionally, incentives depend on factoring in protocol fees and deviations persisting for longer than the 15-day unstaking cycle in profit estimates).
Source: stAVAX ratio, Hypha Dune, October 23, 2025
2.3 Exchanges
stAVAX is still only available on decentralized exchanges.
2.4 Growth
Total AVAX staked in Hypha has grown, with periodic fluctuations over the last 12 months. A total of ~1.13M stAVAX is currently in circulation. TVL is currently ~$28M.
Source: stAVAX TVL and Growth, Hypha Dune, October 20, 2025
3. Technological Risk
3.1 Smart Contract Risk
The protocol has been audited 4 times.
- Kudelski (November 2022): 1 high and 4 medium issues were found.
- Code4rena (January 2023): 6 high and 22 medium vulnerabilities were found.
- Zellic (February 2023): 4 high-severity and 1 medium-severity issues were found.
- Quantstamp (August 2025): 1 high, 9 low, and 1 informational issues were found.
The most recent audit covers the stAVAX vault system and withdrawal queue mechanisms. All issues were either acknowledged or fixed.
3.2 Bug Bounty Program
Hypha has an Immunefi bug bounty with a max bounty of $50K (labeled under its previous name, GoGoPools). All key contracts are in scope. The payout is in GGP denominated in USD.
3.3 Price Feed Risk
The stAVAX/AVAX exchange ratio is determined using the convertToAssets() function (where assets = shares Ă— totalAssets() / totalSupply()). Pricing stAVAX can be done with this function in addition to a Chainlink AVAX/USD price feed.
3.4 Dependency Risk
Much of what we found in our initial analysis remains in terms of dependency risk, namely:
- Ownership of the asset is held with Multsig Labs (more in section 4.1).
- Minipool operators who, while unable to access underlying AVAX, may act in a way counter to the best interests of the protocol - potentially reducing economic incentive.
4. Counterparty Risk
4.1 Governance and Regulatory Risk
The asset possesses no governance risk stemming from a DAO. All functions are maintained exclusively by MultiSig Labs.
This legal assessment incorporates the prior legal review, as there have been no observed changes to the governing Terms or the entity designated to operate the protocol. Without any modifications, the previously conducted analysis remains directly applicable.
Additionally, we have requested information from representatives of stAVAX concerning their ongoing initiatives to obtain regulatory certainty for the product. We anticipate reviewing any legal opinions, interpretive guidance, non-action letters issued by relevant regulatory bodies, or other documented indications of regulatory approval or comfort that may have been secured for stAVAX.
4.2 Access Control Risk
4.2.1 Contract Modification Options
stAVAX is deployed as TransparentUpgradeableProxy, with a ProxyAdmin contract whose owner is the Timelock contract. This Timelock contract is owned by the protocol Guardian 2/5 Multisig, meaning only the Guardian can submit calls to the Timelock assigned as the ProxyAdmin contract for stAVAX.
The 2/5 Multisig is assigned as the DEFAULT_ADMIN_ROLE, which allows the multisig to:
- Grant/revoke all privileged roles
- Pause and unpause deposits and withdrawals.
- Manage staking funds
- Distribute rewards
- Manage protocol parameters via ProtocolDAO
4.2.2 Timelock Duration and Function
A 24-hour delay has been set for Timelock actions, including upgrades of the contract ownership or implementation contracts via the ProxyAdmin.
4.2.3 Multisig Threshold / Signer identity
Signers of the â…– Multisig Safe (Entirely owned by Multisig Labs):
- 0x9513375C5c6c0B1c29d47a782A63D51d4b93c3C4
- 0x37B63061775fc127E59444DE392077c3D6f3dB7D
- 0x7de56fe2bb806BA048FE95efc2f0C3547F539dc8
- 0xf44E9e56B3b9377D0Cb1f2e52D0f7c5015b54051
- 0x81BD38A5042Ab97a533d1AE73A3c64e0dbAE67DE
Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.
Aave V3 Specific Parameters
Parameters will be presented jointly with @chaoslabs, including stAVAX/WAVAX E-mode.
Price Feed Recommendation
We recommend using the internal stAVAX/AVAX exchange ratio in conjunction with Chainlink’s AVAX/USD price feed.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
