Circle USD (USDC) on Aave X Layer Assessments

Risk Assets Assessments
1

This thread is the home for all risk and technical assessments of USDC on Aave X Layer.

It collects, in one place:

  • The pre-listing asset risk assessment, under the Aave Risk Framework.
  • The pre-listing technical asset assessment, under the Technical Asset Listing Framework.
  • All post-listing monitoring reports, periodic refresh assessments, and any re-evaluations triggered by material changes.

New assessments and updates will be posted as replies below as they are produced, so the full history stays in a single thread.

1 Like
2

1. Asset Fundamental Characteristics

1.1 Asset

USDC is an ERC20 reserve-backed stablecoin issued by Circle. The USD-pegged asset is natively issued on X Layer, with underlying collateral that is centrally custodied, consisting of 1:1 liquid cash and cash-equivalent assets. USDC has been onboarded to several instances and represents a familiar asset supplied and borrowed within different use cases.

1.2 Architecture

Recently launched on X Layer (July 27th, 2026), USDC is deployed as an upgradable ERC20 FiatTokenProxy contract that uses the FiatTokenV2_2 implementation contract. Circle Mint natively mints USDC; redemptions through Circle Mint are accessible only to qualified persons/businesses. The token’s design is consistent with other instances where USDC is already listed.

At the time of writing, ~11M USDC is circulating on X Layer. The implementation does not introduce any additional risks compared to the asset’s existing listings on Aave.

Bridging

USDC is bridgeable to and from X Layer via CCTP. The bridge contract TokenMessengerV2 is deployed behind AdminUpgradableProxy. TokenMessengerV2 utilizes a burn and mint mechanism. The main benefit of CCTP is greater capital efficiency when bridging, given unified liquidity across ecosystems.

Reserves

According to the Circle Transparency page, the Circle Reserve Fund can contain cash, short-dated US Treasuries, and overnight US Treasury repurchase agreements.

The majority of the USDC reserve is held in the Circle Reserve Fund (USDXX), an SEC-registered 2a-7 government money market fund. USDC reserve holdings are fully disclosed weekly, along with associated mint/burn flows.

usdc_reserves
usdc_reserves643Ă—637 29.9 KB

Source: USDC Balances, Circle Transparency, August 17th, 2026

1.3 Tokenomics

Minting

USDC can be minted when a user deposits fiat into Circle Mint via their linked bank account. The equivalent amount of USDC is then minted to the user’s Mint account. Settlement times vary from 15 minutes to 3 days depending on the deposit method used.

Redemption

Mint redeems back into Fiat when a user makes a payout request, returning USDC to be burned and receiving the equivalent fiat amount to their designated bank account. Payouts are reported to settle by the following business day. Redemptions are limited to approved Mint account holders.

1.3.1 Token Holder Concentration

Given the recent deployment, assessing the level of holder concentration would be premature. The highly liquid asset is likely to see a change in holder composition.

usdc_holders
usdc_holders1516Ă—570 41 KB

Source: USDC holders, oklink, August 17th, 2026

2. Market Risk

2.1 Liquidity

DEX liquidity is currently limited; pools were deployed relatively recently. The team committed to support USDC up to similar levels as USDT0.

2.1.1 Liquidity Venue Concentration

USDC pools have been set up to pair with stables and Wrapped xStock tokens such as Google and Tesla.

DEX Pair TVL
Uniswap V3 USDC/USDT0 $1.4M
Uniswap V3 USDC/USDG $991K
Uniswap V3 USDC/wGOOGLx $396K
Curve USDC/USDT0 $300K
Uniswap V3 USDC/wTSLAx $202K

2.1.2 DEX LP Concentration

Looking at the two most liquid pools, Uniswap USDC/USDT0 and USDC/USDG, share the same LP, an EOA (0x8fa071f8729821591cf1465f9afb610aa93ee31d). Given the early stage of USDC and the pools on X Layer, the LP distribution is likely to improve.

2.2 Volatility

Peg stability data on X Layer is limited given the recent deployment.

3. Technological Risk

3.1 Smart Contract Risk

USDC and CCTP have been audited by independent auditors such as Chain Security and OtterSec, among others. According to the USDC whitepaper, every USDC smart contract before launch or upgrade is audited.

3.2 Bug Bounty Program

A HackerOne bug bounty program is active with a max bounty payout of $5K for critical vulnerabilities. Both USDC and CCTP contracts are covered in the scope of the bug bounty. This value falls short of our recommended minimum of $50K and is not representative of one of the largest stablecoins by TVL.

According to the USDC Whitepaper:

Circle operates a public vulnerability disclosure program and a private bug bounty program via HackerOne that enables vulnerabilities to be disclosed to Circle.

3.3 Price Feed Risk

A Chainlink USDC/USD price feed is available to USDC on the X Layer instance. The reference feed has a Deviation threshold of 0.5% and a 24-hour heartbeat.

3.4 Dependency Risk

Custodial Risk

As noted in section 1.2, reserves are primarily custodied by the Circle Reserve Fund; the issuer may hold treasuries and overnight reverse repurchase agreements; and the balance of cash reserves not custodied by Circle is held by highly liquid and regulated global banks. Holders are reliant on the proper management of underlying collateral by these institutions, ensuring 1:1 representation is maintained. Mismanagement resulting in the loss of funds would impair Circle’s ability to redeem USDC.

Bankruptcy Risk

Users are potentially exposed to bankruptcy risk associated with Circle and banks where funds are custodied, causing potential delays in mint/redeem operations.

Third Party Risk

Reserves and mint/burn flows are reported weekly by an appointed accounting firm; should these attestations be misrepresented, inaccurate, or delayed, Circle’s ability to perform mint/redemptions may be impaired, affecting the asset’s peg stability, which relies on accessible arbitrage. During periods of price dislocation, USDC would be more volatile on secondary markets.

4. Counterparty Risk

4.1 Governance and Regulatory Risk

4.2 Access Control Risk

4.2.1 Contract Modification Options

USDC uses a role-based pattern, with EOAs (or MPCs) assigned all the critical privileges. The controlling wallets include:

The main contract enabling USDC includes:

  • FiatTokenProxy: OpenZeppelin transparent proxy holding the USDC state.
  • FiatTokenV2_2 (implementation): Circle’s standard ERC-20 stablecoin implementation with blacklisting, pausing, and minter management.
  • MasterMinter: Circle’s controller contract that manages minting allowances. Grants and revokes minter roles on the FiatToken via controller accounts.
  • TokenMinter: CCTP v2 minter contract. Holds minter rights on the FiatToken and is invoked by the TokenMessengerV2 to mint USDC on incoming cross-chain transfers.
  • TokenMessengerV2: Circle’s CCTP v2 messenger contract. Handles depositForBurn (outgoing transfers) and mintAndWithdraw (incoming transfers, calls TokenMinter).

Sensitive functions exposed per contract:

FiatTokenProxy (FiatTokenV2_2)

  • pause(): Halts all token transfers, approvals, minting, and burning. Restricted to pauser (EOA 2).
  • unpause(): Resumes normal operation. Restricted to pauser (EOA 2).
  • blacklist(address): Permanently freezes an account’s balance and blocks transfers involving it. Restricted to blacklister (EOA 3).
  • unBlacklist(address): Unfreezes a blacklisted account. Restricted to blacklister (EOA 3).
  • configureMinter(address,uint256): Grants minting rights up to a specified allowance to any address. Restricted to masterMinter (MasterMinter contract, owned by EOA 5).
  • removeMinter(address): Revokes minting rights from an address. Restricted to masterMinter.
  • upgradeTo(address) / upgradeToAndCall(address,bytes): Replaces the token implementation with any arbitrary contract. Restricted to proxy admin (EOA 4). This is the highest-impact function in the system.
  • transferOwnership(address): Transfers the owner role, giving the new owner the ability to reassign all other roles. Restricted to owner (EOA 1).
  • updatePauser(address): Replaces the pauser. Restricted to owner (EOA 1).
  • updateBlacklister(address): Replaces the blacklister. Restricted to owner (EOA 1).
  • updateMasterMinter(address): Replaces the masterMinter. Restricted to owner (EOA 1).

MasterMinter

  • configureController(address controller, address minter): Maps a controller address to a minter address, authorizing the controller to set allowances for that minter. Restricted to owner (EOA 5).
  • configureMinter(address,uint256): Called by a controller to set a minter’s allowance on the FiatToken. Triggers MinterConfigured on the token.
  • removeMinter(address): Removes a minter entirely. Called by its designated controller.

TokenMinter

  • mint(address,uint256): Mints USDC on behalf of the TokenMessengerV2. The TokenMinter is the only address with isMinter = true on the USDC proxy. Note: current minterAllowance is 0, limiting live minting capacity.
  • burn(address,uint256): Burns USDC during cross-chain sends via CCTP.
  • Pause functions: TokenMinter owner (EOA 6) and pauser (EOA 7) can halt minting and burning independently of the FiatToken pause.

TokenMessengerV2

  • depositForBurn(...): Publicly callable. Burns USDC on X Layer and initiates a cross-chain transfer via the CCTP message protocol.
  • mintAndWithdraw(...): Called by Circle’s off-chain relayer after attesting a burn on another chain. Triggers TokenMinter to mint USDC on X Layer. Not directly callable by arbitrary users.
  • addLocalMinter(address): Sets or replaces the TokenMinter. Restricted to owner (EOA 8). Changing this would redirect all CCTP minting to a different contract.
  • removeLocalMinter(): Removes the local minter, effectively disabling CCTP inbound minting. Restricted to owner (EOA 8).
  • transferOwnership(address): Restricted to owner (EOA 8).

4.2.2 Timelock Duration and Function

No timelocks are implemented. This is consistent with Circle’s standard deployment.

4.2.3 Multisig Threshold / Signer Identity

No multisigs or onchain governance mechanism is used.

Disclaimer

This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.

[Direct-to-AIP] Asset Listing - USDC X Layer