Title [Asset Technical Assessment] USDC on X Layer
Author: Aave Labs
Date: 2026-09-10
Summary
Technical assessment of USDC (USD Coin) on X Layer, following the Technical Asset Listing Framework.
Overall result: 
MEDIUM
USDC is Circle’s native stablecoin on X Layer, with a standard token implementation, a live Chainlink USDC/USD feed, and no yield or exchange rate mechanics. The material consideration is the immediate authority held by Circle’s MPC-based wallets, which use multi-party computation to authorize upgrades, minting capacity changes, freezes, pauses, and control of the route across chains. Standing mint allowances also substantially exceed the current total supply on X Layer.
Technical conclusion
From a technical standpoint, USDC is eligible for listing on X Layer.
Asset under review
| Field |
Value |
| Asset |
USD Coin (USDC) |
| Target chain |
X Layer (chain ID 196) |
| Token contract |
0xB6CEceAB302E2E4948951eE7843FC24E92933061 |
| Native to target chain? |
Yes. Circle issues USDC natively on X Layer through direct minting and its Cross-Chain Transfer Protocol (CCTP) after a burn on another supported chain. |
| AAcA classification (Aave Asset Classification Framework) |
Stablecoin, backed by fiat reserves and controlled by the issuer |
Backed by Circle’s offchain cash and short dated US Treasury reserves, the X Layer deployment is Circle’s FiatToken implementation and is not a wrapped or escrow backed representation.
0. Pre-screening
USDC is deployed on X Layer as an upgradeable Circle FiatTokenProxy at 0xB6CEceAB302E2E4948951eE7843FC24E92933061. Its implementation matches Circle’s production USDC implementation, except for the linked library and metadata specific to this deployment, and it has not changed since deployment. The asset is a fiat backed stablecoin and is not in an AAcA non-approved or sanctioned category.
Rating: 
GOOD
1. ERC20 Compliance
USDC is a standard ERC-20 with six decimals: transfer() and transferFrom() return a boolean, and there is no transfer fee, rebasing, ERC-777 or ERC-1363 hook, or flash mint. Smart contracts can hold and transfer the token unless an address is blacklisted, which is assessed in Section 3. The contract also supports permit and signed transfer authorisations.
Rating: GOOD
2. Oracle
A live Chainlink USDC/USD feed is available on X Layer at 0xB8a08c178D96C315FbFB5661ABD208477391BC40, with a 0.5% deviation threshold and a 24-hour heartbeat, both wider than the 0.25% deviation threshold and 23-hour heartbeat on the same USDC/USD pair on Ethereum. The aggregator also caps its reported answer at an upper bound of $1.05. Chainlink’s published feed directory classifies the X Layer feed as low market pricing risk, the same classification carried by the Ethereum feed.
Rating: MEDIUM → the feed carries Chainlink’s low market pricing risk classification, matching Ethereum, but its deviation threshold and heartbeat are wider than the Ethereum feed.
3. Access Control
The token proxy admin, token owner, pauser, blacklister, MasterMinter owner, minters, and allowance controllers are MPC-based wallets that require multiple parties to authorize an action. These roles are separated across distinct addresses, with no single address concentrating multiple critical authorities, and mint allowance controllers are separate from minters, but no authority is subject to an onchain timelock. Three minters hold approximately 205.19 million USDC in combined live allowance against approximately 13.18 million USDC in X Layer supply, and controllers can increase allowances immediately. The pauser can halt transfers and the blacklister can freeze any address, which can interrupt liquidations, while the proxy admin can replace the token implementation.
Rating: MEDIUM → critical authorities are held by MPC-based wallets, but they can act immediately and configured mint capacity substantially exceeds current supply.
4. Exchange Rate and Yield
Not applicable. USDC is a non-yield-bearing fiat stablecoin with a 1:1 dollar peg, no rebase, and no onchain exchange rate or redemption queue mechanics.
Rating: 
N/A
5. Token Architecture
Standard mint, burn, and transfer events provide observability for supply activity. The implementation does not rely on tx.origin for authorisation, and delegatecall is limited to the proxy’s standard forwarding mechanism.
Rating: GOOD
6. Bridge and Cross-Chain Risk
CCTP V2 is the only route across chains that can mint this USDC, using a model that burns USDC on the source chain and mints it on X Layer, with no escrow or lockbox. Cross-chain mints require both signatures in Circle’s 2-of-2 attester set, with no independent operator, and its membership and threshold can be changed immediately by an MPC-based wallet. The route has a 10 million USDC limit for each message, but this does not constrain a sequence of messages; its contracts and token pairing can also be changed without delay.
Rating: MEDIUM → the route and its limit for each message are sound, but its verifier set and administrative controls are fully operated by the issuer with no onchain timelock.
7. Audit and Security History
CCTP V2 was audited by ChainSecurity, with no open Critical, High, or Medium findings in the reviewed code. Aave Labs reviewed the FiatTokenV2_2 audit report directly and it carries no significant open finding. The ChainSecurity audit report explicitly states that its assessment covers CCTP V2’s behavior and EVM specifications on Ethereum only, and that compatibility must be assessed and tested thoroughly before deployment on any other chain, including a zkEVM chain such as X Layer.
Rating: MEDIUM → CCTP V2 audit coverage is positive, and Aave Labs reviewed the FiatTokenV2_2 audit report directly with no significant open finding identified, though the report itself is not public; the ChainSecurity audit’s scope is also explicitly limited to Ethereum’s behavior and EVM specifications, with compatibility on other chains requiring further assessment and testing.
8. Dependencies
USDC depends on Circle’s offchain reserve attestations, Circle’s offchain CCTP attestation service, and the Chainlink USDC/USD feed. No onchain proof of reserve feed attests the dollars backing USDC on X Layer. The asset also shares X Layer’s chain-level dependencies, including its rollup operator and sequencer.
Rating: MEDIUM → reserve backing and cross-chain attestations depend on Circle’s offchain operations, with no onchain proof of reserves.
9. Summary
Findings table
Ratings in this table are plain text (Good / Medium / Critical / N/A), no icons.
| Area |
Key finding |
Rating |
| 0. Pre-screening |
Native Circle USDC deployment with an unchanged implementation matching Circle’s production implementation. |
Good |
| 1. ERC20 |
Six decimal ERC-20 with no transfer fee, rebase, transfer hooks, or flash mint. |
Good |
| 2. Oracle |
Live Chainlink USDC/USD feed, classified low market pricing risk like the Ethereum feed, but with a wider deviation threshold and heartbeat, and an upper bound of $1.05. |
Medium |
| 3. Access control |
MPC-based wallets hold separated token powers without an onchain timelock; active mint allowances exceed current supply. |
Medium |
| 4. Exchange rate / yield |
Not yield-bearing and has no exchange rate mechanics. |
N/A |
| 5. Token architecture |
Supply controlled by the issuer, with observable mint, burn, and transfer events and no privileged authorisation shortcuts. |
Good |
| 6. Bridge and cross-chain |
CCTP V2 is the sole route, using a Circle-operated 2-of-2 attester set and immediate administrative controls. |
Medium |
| 7. Audit and security |
CCTP V2 audit coverage; FiatTokenV2_2 audit report reviewed by Aave Labs with no significant open finding, though not public; ChainSecurity audit scoped to Ethereum only, requiring further assessment and testing before other chains. |
Medium |
| 8. Dependencies |
Circle reserves and attestation service are offchain dependencies, without an onchain USDC proof of reserve. |
Medium |
Disclaimer
Aave Labs has no formal or informal affiliation with Circle beyond this technical assessment. Aave Labs has not been compensated by Circle or any related party in connection with this work.
Copyright
Copyright and related rights waived via CC0.
