Title: [Asset Technical Assessment] cirBTC on Arc
Author: Aave Labs
Date: 2026-09-15
Summary
Technical assessment of cirBTC on Arc, following the Technical Asset Listing Framework.
Overall result: 
MEDIUM
cirBTC is a custodial Bitcoin wrapper with a standard ERC20 interface, live Bitcoin price feeds, and a proof of reserve feed that reports reserves above combined supply. The principal considerations are the lack of a cirBTC specific price feed, Circle’s privileged controls without an onchain delay, and the Cross Chain Token Service bridge mint route, whose code and limits are controlled by single addresses. All of Circle’s privileged roles are held by Circle, but there is no concentration risk since each sits on its own distinct address (see Section 3).
Technical conclusion
From a technical standpoint, cirBTC is eligible for listing on Arc.
Asset under review
| Field |
Value |
| Asset |
Circle Wrapped Bitcoin (cirBTC) |
| Target chain |
Arc mainnet (chain ID 5042) |
| Token contract |
0x171A4217b86A807A64eB94757Db6849fb4bDbAA0 |
| Native to target chain? |
Yes, issued locally on Arc by Circle, with an additional Cross Chain Token Service bridge route from Ethereum |
| Aave Asset Classification (AAcA) |
Custodial wrapper backed by Bitcoin |
cirBTC is Circle’s custodial wrapper for Bitcoin, with each token intended to represent one bitcoin held offchain by Circle. The Arc deployment uses eight decimals and can be issued by Circle’s local minters or through the bridge route.
0. Pre-screening
cirBTC is an active Arc deployment implemented as a ZeppelinOS transparent proxy. The implementation matches Circle’s canonical FiatToken V2.2 build and has not changed since deployment. The canonical FiatToken V2.2 codebase has third party audit coverage, detailed in Section 7.
Rating: 
GOOD
1. ERC20 Compliance
cirBTC is a standard ERC20 with eight decimals: transfer() and transferFrom() return a boolean, with no fee on transfer, rebasing, ERC777 or ERC1363 hooks, or flash mint. Contracts can hold and transfer cirBTC, subject only to the issuer’s account freeze capability, assessed in Section 3.
Rating: GOOD
2. Oracle
Arc has live Chainlink BTC/USD and CBBTC/USD feeds, each with a 24 hour heartbeat and a 0.5% deviation threshold, plus a cirBTC proof of reserve feed reporting 41.2554097 BTC against combined supply of 40.02650077 cirBTC. Neither price feed prices cirBTC itself, so a depeg of the wrapper would not be reflected in the price reference. Ethereum mainnet’s BTC/USD feed uses a 1 hour heartbeat, considerably shorter than Arc’s 24 hour heartbeat, with the same 0.5% deviation threshold; its CBBTC/USD feed uses the same 24 hour heartbeat as Arc, with a wider 2% deviation threshold.
Rating: MEDIUM → price and reserve references are available on Arc, but no feed captures cirBTC price directly.
3. Access Control
Circle’s proxy administrator, token owner, pauser, freeze authority, and the owner of the MasterMinter contract governing the token contract at 0x171A4217b86A807A64eB94757Db6849fb4bDbAA0 are Cold Storage EOAs, meaning single-key addresses held in offline storage by Circle’s team, under the recorded reviewer determination. Each role sits on its own distinct address, so no single key holds more than one privileged role. No onchain timelock protects these roles: the token owner can rotate roles, the pauser can halt token activity, and the freeze authority has frozen 419 addresses. Frozen balances cannot be seized or destroyed. All of these roles are held by Circle, concentrating every privileged control over cirBTC in a single entity, though not in a single address.
Rating: MEDIUM → privileged controls are accepted as Cold Storage EOAs, but operate without an onchain delay and retain authority over token roles, transfers, and upgrades.
4. Exchange Rate and Yield
Not applicable. cirBTC is a custodial 1:1 Bitcoin wrapper with no exchange rate function, rebase, or yield accrual.
Rating: 
N/A
5. Token Architecture
cirBTC has one canonical token contract on Arc, with mint and burn events for supply observability. Its logic contains no tx.origin authorization or delegatecall outside the proxy pattern, and its privileged functions are access-controlled.
Rating: GOOD
6. Bridge and Cross Chain Risk
cirBTC has one external mint route, Circle’s Cross Chain Token Service (CCTS), which burns supply on Ethereum and mints it on Arc. The route is live and has been exercised, and it uses Cross Chain Transfer Protocol (CCTP) message verification, for which the verified audit report identified no relevant findings. The bridge minter’s code comes from a registry whose upgrade key is a single address, and its rate limit and per transfer ceiling can be raised in one transaction by a single address. The registry code has now been publicly verified.
Rating: MEDIUM → the route is operational and uses audited CCTP message verification, but its code and transfer limits remain controlled by single addresses without an onchain delay.
7. Audit and Security History
The token implementation matches Circle’s canonical FiatToken V2.2 build apart from its linked library address and source metadata, with no implementation rotation after deployment. CCTP’s verified audit report identified no relevant findings. The reviewer had access only to the FiatToken V2.2 and CCTP audit reports, not a report covering the CCTS registry implementation that controls the bridge minter’s code. Circle has confirmed that the relevant audit report will be made public shortly after launch.
Rating: MEDIUM → the token implementation and CCTP message verification are both covered by reviewed audits, but the CCTS registry implementation is not; Circle has confirmed a public report will follow shortly after launch.
8. Dependencies
cirBTC depends on Circle’s offchain Bitcoin custody, its MasterMinter control path (see Section 3), the CCTS bridge (see Section 6), and the Chainlink price and reserve feeds (see Section 2). The reserve feed reports coverage above combined supply but is not a mint gate, and redemption through Circle is an offchain process for permitted participants.
Rating: MEDIUM → value, issuance, redemption, and the bridge route depend on Circle’s offchain operations and privileged onchain control paths.
9. Summary
Findings table
Ratings in this table are plain text (Good / Medium / Critical / N/A), no icons.
| Area |
Key finding |
Rating |
| 0. Pre-screening |
Active Arc deployment using the canonical FiatToken V2.2 build apart from its linked library address and source metadata, with no implementation rotation. |
Good |
| 1. ERC20 |
Standard ERC20 with eight decimals, no fee on transfer, rebase, hooks, or flash mint. |
Good |
| 2. Oracle |
Live Bitcoin price feeds and a proof of reserve feed, but no cirBTC specific price feed. |
Medium |
| 3. Access control |
Cold Storage EOAs control upgrades, roles, pause, and freezes without an onchain delay; 419 addresses are frozen. |
Medium |
| 4. Exchange rate / yield |
Custodial Bitcoin wrapper with no yield or exchange rate mechanism. |
N/A |
| 5. Token architecture |
Single canonical contract with observable mint and burn events and standard access controls. |
Good |
| 6. Bridge and cross chain |
Live CCTS burn and mint route using audited CCTP message verification; registry code and transfer limits remain controlled by single addresses. |
Medium |
| 7. Audit and security |
Token implementation and CCTP are covered by reviewed audits; the bridge registry implementation is not, though Circle confirmed a public report will follow shortly after launch. |
Medium |
| 8. Dependencies |
Relies on Circle’s custody, redemption, minting, and bridge operations, alongside Chainlink price and reserve feeds. |
Medium |
Disclaimer
Aave Labs has no formal or informal affiliation with Circle or the cirBTC issuer beyond this technical assessment. Aave Labs has not been compensated by Circle or any related party in connection with this work.
Copyright
Copyright and related rights waived via CC0.
