Overview
To address the community’s concerns regarding the proposal, we provide additional information on the risk scenarios associated with the USDe oracle and its pricing setup. This includes an analysis of the current active oracle configuration and the alternative approach, pricing USDe using a USDT oracle. Additionally, this analysis will explore further risk considerations arising from the integration of Ethena and USDe, referencing adverse scenarios, primarily exchange failure and sustained negative funding accrual. To provide full context on its risk-reward profile, we also provide details on its benefits to Aave.
Importantly, the proposed setup is intended as a temporary solution to improve relative stability by minimizing the system’s reaction to transitory price events. From a risk perspective, pricing USDe as USDT introduces either a negligible change in risk outcomes compared to utilizing the prevailing market price or offers a sufficient time buffer to adjust the configuration or implement alternative risk mitigation measures if needed.
This approach is transitional as we anticipate migrating to a Proof of Reserves oracle once it becomes available. A PoR oracle would provide a more accurate reflection of USDe’s backing by verifying its reserves in real time, effectively mitigating risks associated with uncertainty in its collateralization.
Custodians
The use of custodians’ solutions and their off-exchange settlement options effectively insulates Ethena and USDe from exchange insolvency risks and prevents a situation such as the FTX collapse from significantly affecting USDe backing.
USDe’s collateral backing is safeguarded by four custodians: Copper, Ceffu, Coinbase, and Cobo. These custodians are explicitly detailed in the monthly backing attestations, offering transparency about the distribution and management of assets. Notably, Ceffu and Copper hold the majority share, with approximately 90-95% of USDe’s backing assets managed between these two custodians. The following chart depicts the historical allocation of assets across custodians.
Both Ceffu and Copper offer off-exchange settlement capabilities, which mitigate USDe’s exposure to exchange-related risks. Under this model, Ethena’s backing assets remain stored in custodian-managed wallets and are not used as collateral on exchanges. Instead, centralized exchange accounts for Ethena are credited with virtual balances that mirror the custodian holdings. These virtual balances, being used to perform the ETH short hedges, allow for daily reconciliation and settlement of positions, significantly reducing the net exposure to exchange solvency and limiting it to the daily profit/loss from the short hedges. Ceffu primarily facilitates Binance-related settlement, while Copper handles interactions with other centralized exchanges such as Bybit and OKX. Furthermore, off-exchange settlement enables the instant delegation of assets, significantly reducing the risk of liquidation of the ETH hedges during periods of heightened market volatility.
Copper’s off-exchange settlement structure further incorporates bankruptcy-remote protections, ensuring that assets remain segregated and shielded from risks associated with Copper itself. Both Ceffu and Copper utilize Multi-Party Computation (MPC) to jointly manage keys with Ethena, mitigating risks of key loss, a vulnerability that has previously impacted other custodians.
While off-exchange settlement mitigates the risk posed by an exchange failure, this risk is not eliminated. Given the daily settlement of balances, Ethena maintains risk exposure to the daily profits/losses from the short positions. In the case of an exchange failure, we expect the value of BTC and ETH to drop as a reaction to the news; the profit on hedges would likely be lost.
An associated duration risk is present and quantified as the time between the exchange failure and the return of funds from Copper’s custody to Ethena (Copper users’ funds were wholly available within days of Coinflex’s exchange failure).
Analyzing the current distribution of health scores in the sUSDe market positions, with the minimum health score being 1.02, Aave would only incur bad debt in the event of large price declines in BTC and ETH between the time of exchange failure and the Copper-custodied assets being released from custody. As the loss from this event is exclusively derived from the accumulated hedge profits stuck within the failed exchange, the value of the assets held by Copper during this time can decrease as much as the delta between the bad debt threshold of 1/(1+LB) and the LTV of the position with the minimum health score, which in the case of sUSDe is 6%, before Aave accrues any bad debt (we have detailed bank run scenarios in the previous post). Using OKX and the current exchange allocation as an example, BTC and ETH collateral values would need to drop by 55% before Ethena could recover the collateral and establish a new hedge for Aave to accrue bad debt from sUSDe positions.
Additionally, in the event in which the sUSDe market price deviation from USDe remains too large to perform liquidations, Aave can increase the safety buffer by 4% (equal to the Liquidation Penalty) by internalizing liquidations; in this event, Aave could withstand an 86% loss of value from the OKX-held hedges before incurring bad debt.
In order to internalize liquidations, the Liquidation Penalty can be set to 0 through Guardians, followed by the Aave DAO liquidating affected positions to acquire sUSDe, redeeming it through the 7-day process, and then selling the redeemed USDe into replenished market liquidity, managing the situation without relying on external liquidators.
The two plots below show the amount of bad debt taken by Aave from sUSDe during an exchange failure, considering the price change of ETH and BTC between the failure and when the funds are recovered. The top depicts a version in which Aave internalizes liquidations, and the bottom shows the outcome given only external liquidations.
As shown, the most significant risk to Aave is Binance’s exchange failure. In the event Aave internalizes liquidations, 1% of the Safety Module valued at $13M is sufficient to cover a 27% BTC and ETH drawdown between Binance exchange failure and fund recovery.
In the event that fund recovery takes multiple days, Aave is able to freeze the market while waiting for resolution and revert the oracle configuration to the USDe market price to reflect the loss of backing and to allow liquidations when market liquidity allows for them.
Finally, despite their high-security standards, including MPC signing and use of safely stored cold wallets, custodians remain susceptible to hacks, which could compromise USDe’s backing assets. To mitigate the risk of custodian hacks or collusion, Ceffu and Copper provide additional monetary insurance on their custodied assets. The combined insurance policy value between the two major providers equals $1.5B.
Risk-Reward Balance
Following the explanation of risks, it is important to provide context on the revenue accrual of the asset. Since November 15, sUSDe has generated $1.4M in revenue for the Aave DAO. Assuming full utilization of the current supply cap and maintaining the average interest rate observed over the past month, the annualized revenue solely from sUSDe would exceed the aforementioned $13M.
Onboarding sUSDe has brought a notable improvement in the alignment of stablecoin interest rates on Aave with broader market dynamics. As shown in the chart, prior to the introduction of sUSDe and the gradual increase of its supply caps, stablecoin rates for USDC and USDT on Aave were largely unresponsive to funding rate movements on centralized exchanges. This is best exemplified by the period from early November to mid-December, during which funding rates diverged from Aave rates; this gap was quickly reduced as sUSDe supply increased.
CEX funding rates reflect the market’s demand for leverage. Thus, the convergence of Aave stable rates with funding rates is a positive for the protocol, improving market efficiency and attracting additional stablecoin supply to Aave. The recent decline in funding rates and the corresponding decrease in Aave’s stablecoin rates further reinforces the strengthened correlation after sUSDe’s introduction.
Tether
The decision to align the USDe oracle price with USDT stems from Tether exposure being an inherent fact of USDe’s structure. Given Tether’s significant influence on the broader cryptocurrency market, the majority of exchange and perpetual contracts are denominated in USDT. Ethena’s hedging system, which relies heavily on market liquidity and size to function efficiently, is dependent upon USDT-denominated pairs, as they offer the most liquidity and the largest open interest. To effectively hedge substantial positions, Ethena’s exposure correlates directly with the market’s open interest in USDT-denominated contracts. Currently, approximately 76% of total market open interest for ETH and BTC is denominated in USDT.
This significant exposure to USDT perpetual contracts creates a direct correlation between USDT value and USDe’s backing. If the underlying value of USDT declines, the relative price of assets paired with USDT will rise, causing Ethena to incur negative PnL on USDT-denominated short hedge positions. The impact on USDe’s backing reflects this correlation, with a direct effect at a ratio equal to Ethena’s exposure to USDT-denominated perp contracts. By adopting a USDT oracle, Aave ensures that the USDe price most accurately represents its underlying value, aligning with its inherent risk profile.
Scenarios
We identify two primary risk scenarios for USDe and its integration with Aave: (1) the impact of an exchange failure and collateral devaluation and (2) sustained periods of negative funding rates. Below, we outline these scenarios and their implications under two different approaches: relying on USDe market prices and using a USDT-based oracle configuration.
Exchange Failure or Collateral Loss
Using USDe Market Price
In the event of uncertainty regarding USDe’s redemption capability, the market price of USDe is expected to drop, leading to significant redemption demand. With a current stablecoin buffer of $600M, redemptions can proceed for up to one hour before delays occur due to the operational time required to close positions. Given the limited DEX liquidity for sUSDe (approximately $10–15M) and the 7-day withdrawal time for arbitrage — introducing a significant time risk to holding it during market uncertainty — the market price of sUSDe may move out of its liquidity range before USDe’s price deviates sufficiently to trigger liquidations.
This limited liquidity makes it unlikely that sUSDe positions eligible for liquidation during this period will be liquidated profitably. These positions are expected to only be liquidated following an improvement in the market’s confidence in Ethena’s ability to perform redemptions, as this is expected to reduce sUSDe to USDe deviation and make the liquidations profitable.
If the price deviation is permanent due to collateral loss, liquidations would only occur after liquidity realigns with the new underlying backing value. If the value deviation of USDe backing from $1 exceeds 6%, a threshold defined by the health score of the positions and the asset’s LT, this could result in bad debt for Aave.
This approach is undesirable, as users would be liquidated when sUSDe begins to recover, but not in a situation in which backing is permanently lost.
Using USDT Market Price
Using a USDT oracle for the USDe price creates an outcome comparable to using the market price, albeit for different reasons. During an initial deviation, liquidations would effectively be halted, as positions would not meet the eligibility criteria for liquidation due to the lack of deviation in the oracle price. This provides a crucial window for Aave to monitor the situation and, if necessary, update the oracle configuration upon confirmation of a substantial backing deviation.
Given the limited liquidity outside the current price range, the ability to perform liquidations without generating bad debt on Aave becomes binary, directly tied to the collateral lost by Ethena. The 6% buffer before incurring bad debt remains dependent on market parameters and the collateral available post-incident. Thus, the ability to liquidate hinges on Ethena’s remaining assets and the replenishment of DEX liquidity pools at the adjusted price.
In the interim, Aave Guardians can mitigate further risks by setting the LTV for USDe to 0, effectively freezing the market and preventing new borrowing activity until the new backing rate is confirmed. This safeguard ensures that collateral loss cannot be exploited by opportunistic borrowing during periods of uncertainty.
This approach mirrors the risk profile of using a market oracle in scenarios where USDe’s backing is compromised. However, it adds the advantage of preventing premature liquidations of sUSDe positions during the recovery phase. This allows Aave to maintain stability and liquidity until Ethena’s backing is confirmed and priced by the market.
Sustained Negative Funding Rates
Using USDe Market Price
During prolonged periods of negative funding, the USDe Insurance Fund is designed to absorb initial losses, effectively shielding USDe backing from immediate impact. However, once the Insurance Fund is drawn upon, uncertainty can lead to deviations in the USDe market price from its underlying value. While this could theoretically trigger unwarranted liquidations of sUSDe positions, the expected strong correlation between sUSDe price and market uncertainty makes such liquidations unlikely for the reasons explained above.
Liquidations in these scenarios are more likely to occur during the recovery phase, once funding rates stabilize and revert to positive territory. This aligns with the behavior described previously, in which liquidations are driven by temporary price volatility rather than fundamental value.
Using USDT Market Price
In the event of sustained negative funding, Aave benefits from a significant time buffer before USDe’s backing is directly impacted. This buffer is provided by the USDe Insurance Fund, which absorbs the initial funding rate losses. Based on historical data, using the bottom 10 percentile of funding rates as a reference, the Insurance Fund is expected to last approximately seven days before negative funding begins to affect USDe’s backing.
By employing a USDT market oracle rather than a USDe-specific oracle, Aave can utilize this time buffer to adapt the oracle configuration as the Insurance Fund diminishes and the USDe backing approaches negative territory. This ensures that unnecessary liquidations caused by temporary changes in funding rates are avoided, providing a more stable and predictable environment for users.
Disclaimer
Chaos Labs has not been compensated by any third party for publishing this ARFC. Our pre-launch risk reports on Ethena, published over a year ago, bear no implications on the current state of the protocol and can be viewed here on our website.
Copyright
Copyright and related rights waived via CC0
