Executive Summary
LlamaRisk supports the onboarding of syrupUSDC to Aave V3 Core. We recommend its addition as a collateral-only asset, with the primary use case foreseen being leveraged yield strategies through stablecoin looping. Since our initial assessment, several improvements have been made that modestly strengthen the asset’s overall risk profile without changing our recommendation.
Median redemption times have fallen to 3.42 minutes, DEX liquidity has remained stable at $10.96M within a 4% price impact range, and six additional audits covering recent contract upgrades have also been completed. Finally, Maple has introduced the GovernorTimelock, which enforces a minimum 24-hour delay between proposal submission and execution, strengthening contract upgrade security. However, multisig controls remain recommended for wallets controlling the GovernorTimelock unless the corresponding EOAs are secured through MPC-based custody.
1. Asset Fundamental Characteristics
1.1 Asset
According to the Asset Classification Framework (AAcA), syrupUSDC is classified as a yield-bearing stablecoin backed by overcollateralized institutional loans underwritten and managed by Maple Direct. It is an immutable ERC-4626 vault whose shares represent a pro rata claim on the pool’s net asset value. As yield accrues, the value of each share increases continuously, making syrupUSDC a non-rebasing token.
The vault currently manages approximately 1.36B USDC, representing the aggregate capital deposited into the pool. Nearly 99% of these assets are allocated to the OpenTermLoan strategy. Approximately 34M USDC is currently held as unallocated liquidity to facilitate redemptions. Over time, a portion of this idle liquidity may also be deployed into DeFi protocols such as Aave to generate additional yield alongside returns from the active loan portfolio.
1.2 Architecture
The syrupUSDC core architecture has remained unchanged since our initial analysis, with improvements in redemption times observed recently.
The withdrawal queue median time-to-process is at 3.42 minutes, with the size-weighted average being 1.11h, and 92% of redemptions (91.3% of volume) settle within the hour. Tail risk concentrates in 320 events that exceeded 24 hours (65.4M USDC), with the worst case stretching to 124.7 h. The scatter shows these are typically smaller, older requests (red) rather than recent large ones (green), which cluster near zero hours.
Source: LlamaRisk, June 17, 2026
The improvement in redemption times can be seen in the weekly size-weighted averages plot below, which reveals a clear improvement in queue throughput over time. Only 9 weeks ever crossed the 24-hour threshold, all concentrated in the early operating period, and the recent weeks are essentially noise around zero, suggesting Maple’s pool is now sized to absorb redemptions as they arrive.
Source: LlamaRisk, July 17, 2026
Loan Collateral
The USDC open-term book comprises $1,330M of principal backed by $1,834M of collateral, corresponding to an aggregate collateralization ratio of 1.379x. Roughly three-quarters of the collateral is crypto-collateralized, with BTC accounting for the majority. Around one-fifth is effectively cash-secured through loans backed by PYUSD, USDC, and USTB held on an approximately 1:1 basis. These positions have close to 100% LTV by construction and carry no meaningful directional risk. The collateral composition is shown below.
| Collateral | Principal | Share | Loans | Weighted CR | LTV range |
|---|---|---|---|---|---|
| BTC | $751M | 56.5% | 21 | 1.51x | 38-78% |
| PYUSD | $345M | 26.0% | 2 | 1.00x | 100-100% |
| XRP | $104M | 7.8% | 2 | 1.50x | 64-69% |
| ETH | $61M | 4.6% | 4 | 1.77x | 50-71% |
| USDC | $28M | 2.1% | 5 | 1.00x | 100-100% |
| HYPE | $20M | 1.5% | 2 | 1.70x | 59-60% |
| cbBTC | $20M | 1.5% | 1 | 1.50x | 67-67% |
| USTB | $0M | 0.0% | 1 | 1.00x | 100-100% |
Borrower concentration is material, with the top three borrowers accounting for 56% of outstanding principal and the top five accounting for 77%. Notably, the largest exposure, 0x1fcc47ee, represents 26% of the portfolio ($345M) but is fully cash-secured with PYUSD and USTB collateral, making its size less concerning from a directional risk perspective. Excluding this position, the largest single-borrower exposures are BTC-collateralized loans.
| Borrower | Principal | Share | Loans | Collateral |
|---|---|---|---|---|
0x1fcc47ee |
$345M | 26.0% | 3 | PYUSD, USTB |
0x282b6cca |
$200M | 15.0% | 5 | BTC |
0x09b845bb |
$200M | 15.0% | 1 | BTC |
0x198aec3c |
$165M | 12.4% | 3 | BTC |
0x8669f318 |
$114M | 8.6% | 3 | BTC, XRP |
0xb62446a8 |
$76M | 5.7% | 5 | BTC, ETH, HYPE |
Breaking down the secured book against each loan’s policy thresholds highlights where the remaining risk buffer actually resides. The secured book comprises 38 loans across 18 borrowers, representing $1,330M of principal backed by $1,834M of collateral. The portfolio has an aggregate ACM of 1.379x and a principal-weighted LTV of 75.9%. The chart below shows the 20 largest positions.
Source: LlamaRisk, July 17, 2026
The tightest market-priced positions, defined as those with the smallest buffer to their respective margin call thresholds, are:
| Loan | Collateral | Principal | LTV | Margin call | Liquidation |
|---|---|---|---|---|---|
0xeb9acf |
ETH | $10.0M | 71.1% | 77.0% (5.9pp) | 85.0% (13.9pp) |
0xd37f59 |
HYPE | $15.0M | 58.6% | 65.0% (6.4pp) | 75.0% (16.4pp) |
0x13841f |
XRP | $62.2M | 68.5% | 75.0% (6.5pp) | 83.0% (14.5pp) |
0x0d4864 |
ETH | $10.0M | 67.9% | 77.0% (9.1pp) | 87.0% (19.1pp) |
The binding constraint is the tightest of these, 0xeb9acf (ETH), which currently stands at 71.1% LTV against a 77.0% margin call threshold, leaving 5.9% of headroom. As BTC is the dominant collateral asset, the more relevant systemic measure is how far BTC prices must decline before the BTC-backed book begins receiving margin calls. The tightest BTC-backed loan would reach its margin call threshold following an approximately 10% BTC drawdown, while the median BTC-backed loan would require a decline of around 15%.
A sharp BTC selloff could therefore trigger margin calls across a large share of the portfolio within a short period. At that point, pool safety depends on borrowers satisfying those margin calls through off-chain processes within approximately 24 hours rather than through any on-chain mechanism that Aave can directly observe.
1.3 Tokenomics
The syrupUSDC total supply has no fixed cap and increases/contracts based on users depositing USDC.
1.3.1 Token Holder Concentration
The top 5 holders of syrupUSDC:
- Sky AMLProxy: 45.19% of the total supply.
- CCIP LockReleaseTokenPool: 18.98% of the total supply.
- Morpho: 10.05% of the total supply.
- Grove Finance: 7.39% of the total supply.
- EOA: 1.79% of the total supply.
Source: syrupUSDC Top 100 Holders, Etherscan, July 17, 2026
Supply is concentrated in the top 5 accounts (83%), with supply predominantly in DeFi applications. The collective holding of the top 5 EOAs amounts to nearly 5%. The low centralization risk largely remains unchanged since our initial analysis.
2. Market Risk
2.1 Liquidity
Users can swap 9.35M syrupUSDC worth up to $10.96M for USDC within a price impact of 4%.
Source: syrupUSDC/USDC Swap Liquidity, LlamaSwap, July 17, 2026
Simulated routes indicate that the majority of swaps within this price impact range would be facilitated directly via Uniswap and Fluid pools. syrupUSDC, therefore, has deep primary liquidity to cover liquidations.
Source: syrupUSDC/USDC Liquidity Routes, Kyberswap, July 17, 2026
2.1.1 Liquidity Venue Concentration
Liquidity on Ethereum Mainnet is concentrated in the Uniswap V4 syrupUSDC/USDC pool, which currently holds $13.36M. An additional $0.77M of liquidity is available in the Fluid syrupUSDC/USDC pool.
Source: syrupUSDC DEX pools, GeckoTerminal, July 17, 2026
2.1.2 DEX LP Concentration
A Maple-controlled wallet provides approximately $13M of liquidity to the Uniswap V4 syrupUSDC/USDC pool through Arrakis, making Maple the dominant liquidity provider. As a result, secondary market liquidity is protocol-aligned but remains dependent on a single provider and a single trading venue.
2.2 Volatility
The syrupUSDC/USDC conversion rate on the Uniswap V4 pool continues to track this internal rate and has traded consistently at a mean discount of ~9 basis points. The largest absolute secondary market deviation was 22 bps, observed on April 20, 2026, amid the Kelp exploit event, but has since returned to the original rate.
Source: LlamaRisk, July 17, 2026
2.3 Exchanges
syrupUSDC is exclusively traded on DEXs and is not currently listed on any centralized exchange.
2.4 Growth
SyrupUSDC total supply peaked at approximately 1.66B on March 22, 2026, and currently stands at 1.22B. Following the Kelp exploit on April 18, 2026, elevated rates across markets prompted significant user withdrawals, causing circulating supply on Ethereum to decline sharply to 800M. Approximately 18% of total supply on Ethereum remains locked in the CCIP Bridge Lockbox. Despite the contraction in circulating supply, DeFi utilization remains elevated, as discussed in Section 1.3.1.
Source: LlamaRisk, July 17, 2026
3.1 Smart Contract Risk
Since our earlier assessments, six additional Audits have been conducted on Maple smart contracts:
- Governor Timelock Contract Upgrade Audits
- Sherlock (September, 2025): 3 low/informational issues found.
- 0xMacro (September, 2025): 1 low issue found and addressed.
- Withdrawal Manager Upgrade Audits
- Spearbit (November, 2025): 1 high and 4 informational issues found. The high-risk issue was fixed, while the informational issues were fixed or acknowledged.
- Spearbit (November, 2025): None.
- Maple CCIP Receiver Release Audits:
- Dedaub (November, 2025): None
- Sigma Prime (January, 2026): 6 low and 7 informational issues. Issues were either closed or resolved.
3.2 Bug Bounty Program
Maple has a live bug bounty program on Immunefi offering rewards of up to $500,000 (10% of affected funds) for critical smart contract bugs.
3.3 Price Feed Risk
syrupUSDC loans are open-term and rely on off-chain custody and risk management. Loan LTVs, margin calls, and liquidations are managed by Maple’s operations desk, with collateral liquidated off-chain via OTC desks and proceeds returned to the pool. As a result, Aave has no on-chain oracle or direct visibility into the collateral backing syrupUSDC. Credit assurance depends on Maple’s underwriting, custody, and collateral management processes.
Maple’s internal accounting does not rely on a price oracle for USDC. Deposits, redemptions, NAV accounting, and the syrupUSDC/USDC exchange rate are all denominated directly in USDC at par, with the exchange rate returned by convertToExitAssets() reflecting the pool’s underlying assets net of unrealized losses. While Maple exposes a constant on-chain price of 1 USDC = $1 through a manualOverridePrice entry in Globals, this value is only used by the on-chain liquidator for fixed-term loans and is never exercised by the syrupUSDC pool, whose portfolio consists entirely of open-term loans settled off-chain.
For Aave markets, the recommended pricing path combines the internal syrupUSDC/USDC exchange rate (convertToExitAssets) with the Chainlink USDC/USD feed. CAPO can additionally be configured to bound potential upward price movements.
3.4 Dependency Risk
The dependency risks associated with syrupUSDC on Ethereum remain unchanged from our syrupUSDC Core onboarding review and are omitted here for brevity, as the underlying architecture is identical.
4. Counterparty Risk
4.1 Governance and Regulatory Risk
The regulatory risk has been previously discussed in detail as part of the syrupUSDC Core onboarding review. As there have been no material changes, that assessment remains applicable here.
4.2 Access Control Risk
Here are the syrupUSDC controlling wallets on Ethereum:
- GovernorTimelock: 24-hour RBAC timelock controlled by Maple, handles protocol-wide admin functions such as redemptions, role/parameter changes.
- PoolDelegate: Syrup-controlled MPC, with upgrade functionality over PoolManager, WithdrawalManagerQueue, and LoanManagers.
- SecurityAdmin: 3/6 Safe multisig, can call emergency pause function (freezes the protocol entirely).
- OperationalAdmin: 3/5 Safe multisig, can execute a subset of operational functions.
The following contracts power syrupUSDC on Ethereum:
- syrupUSDC Pool: Immutable ERC4626 standard vault, allows users to exchange USDC for syrupUSDC token.
- PoolManager: Upgradeable contract managing core accounting of the pool contract, controlled by PoolDelegate.
- FixedTermLoanManager: Upgradeable contract, manages fixed-term loan types on behalf of PoolManager, handling fund flow.
- OpenTermLoanManager: Upgradeable contract, manages open-term loan type.
- WithdrawalManagerQueue: Upgradeable contract, used to process user withdrawal requests.
- PoolDelegateCover: Immutable contract facilitating funds transfer and the recipient of liquidation funds.
- SyrupRouter: Immutable, permissioned deposit entry point.
- MapleGlobals: Upgradeable contract, responsible for storing Maple-wide system parameters. It is controlled by the GovernorTimelock.
4.2.2 Timelock Duration and Function
A delay of 1 day (86400 seconds) has been implemented on the syrupUDSC contract upgrades via the GovernorTimelock.
4.2.3 Multisig Threshold / Signer Identity
Maple DAO Multisig (4/7 Safe) and EOA 1 are the admins of the GovernorTimelock contract, which has the following role-based access control:
| Controlling Addresses | Role | Functionality |
|---|---|---|
| Maple DAO Multisig, EOA 1 | ROLE_ADMIN | Can update roles, including the role admin role itself |
| EOA 2, OperationalAdmin | EXECUTOR_ROLE | Can execute all proposals, including role updates |
| Maple DAO Multisig | PROPOSER_ROLE | Can schedule proposals, but can not schedule role updates |
| SecurityAdmin | CANCELLER_ROLE | Can unschedule proposals, but can not unschedule role updates |
Using multisig wallets instead of EOA addresses is recommended to reduce the risk of a single private key compromise.
Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.
Aave V3 Specific Parameters
| Parameter | Recommendation |
|---|---|
| Borrowable | No |
| Collateral Enabled | No |
| Supply Cap | 50,000,000 |
| Borrow Cap | - |
| LTV | - |
| LT | - |
| Liquidation Bonus | - |
| Liquidation Protocol Fee | 10% |
| Reserve Factor | - |
| Base Variable Borrow Rate | - |
| Variable Slope 1 | - |
| Variable Slope 2 | - |
| Uoptimal | - |
| E-Modes | Stablecoin E-Mode |
Stablecoin E-Mode
| Parameter | Value |
|---|---|
| Isolated | False |
| LTV | 90.00% |
| LT | 92.00% |
| Liquidation Bonus | 4.00% |
| Asset | syrupUSDC | USDC | GHO |
|---|---|---|---|
| Collateral | Yes | No | No |
| Borrowable | No | Yes | Yes |
CAPO
Source: LlamaRisk, July 17, 2026
The syrupUSDC APY on 7d, 14d, and 30d trailing windows shows a clear yield-compression trend from 2025 which has stabilized near 5% presently. Keeping growth considerations in mind, we recommend setting the Snapshot Delay to 7 days and the maxYearlyGrowthRatio to 8.05%.
Price feed Recommendation
We recommend pricing syrupUSDC on Aave using Maple’s syrupUSDC/USDC internal exchange rate (convertToExitAssets) in combination with Capped USDC/USD feed and CAPO adapter.
Disclaimer
This review was independently prepared by LlamaRisk, a community-led decentralized organization funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.