Title [Asset Technical Assessment] cirBTC on Ethereum
Author: Aave Labs
Date: 2026-11-10
Summary
Technical assessment of cirBTC on Ethereum, following the Technical Asset Listing Framework.
At the token level cirBTC is clean: it runs Circle’s FiatToken V2.2 implementation, unchanged since deployment, with standard ERC20 behavior and a live Chainlink BTC/USD price reference. The binding constraint is control: authority over the token and over the Circle bridges that can mint it on Ethereum sits with single keys, some of unconfirmed custody, and no onchain delay (see Sections 3 and 6). The most material open item is the bridge framework in the mint path, whose audit has not been made available (see Section 8).
Technical conclusion
From a technical standpoint, cirBTC is eligible for listing on Ethereum.
Asset under review
| Field |
Value |
| Asset |
Circle Wrapped Bitcoin (cirBTC) |
| Target chain |
Ethereum mainnet (chain ID 1) |
| Token contract |
0x72dfb2e44f59c5ad2bafe84314e5b99a7cd5075e |
| Native to target chain? |
Yes, issued directly on Ethereum by Circle’s minting wallets, and also mintable through two Circle bridge routes (see Section 6) |
| AAcA classification |
Custodial wrapper backed by Bitcoin |
cirBTC is issued by Circle, and each token is intended to represent one bitcoin held offchain by Circle International Bermuda Limited. Circle’s minting wallets issue cirBTC on Ethereum, while redemption to bitcoin is an offchain process limited to Circle’s permitted participants, and as issuer Circle can pause transfers and freeze addresses. The token is an upgradeable proxy running Circle’s FiatToken V2.2, the implementation behind USDC, and supply can also reach Ethereum through two Circle bridges: the Cross Chain Token Service, paired with Arc, and Circle Gateway, which mints against deposits held on other chains. Ethereum supply stood at approximately 910.15 cirBTC (about $70.12 million) at review.
0. Pre-screening
cirBTC has been active on Ethereum since April 2026 as a transparent proxy whose source verified implementation is Circle’s FiatToken V2.2, the same implementation contract that USDC on Ethereum delegates to. The asset falls within the custodial wrapper AAcA classification and is not currently a reserve on Aave on Ethereum; the closest comparable listed asset is cbBTC, also a custodial Bitcoin wrapper. Audit coverage of the implementation is detailed in Section 7.
Rating: ★★★ Strong
1. ERC20 Compliance
cirBTC is a standard ERC20 with eight decimals: transfer() and transferFrom() return a boolean, and it has no fee on transfer, rebasing, ERC777 or ERC1363 hooks, or flash mint. Its signed transfer entry points (permit and transferWithAuthorization) make no callback into the recipient. Smart contracts, including Aave, can hold and transfer the token, subject to the global pause and the freeze list described in Section 3.
Rating: ★★★ Strong
2. Oracle
Ethereum has a live Chainlink BTC/USD feed in Chainlink’s low market pricing risk category, with a 1 hour heartbeat and a 0.5% deviation threshold; as a 1:1 wrapper with no exchange rate, cirBTC can be priced directly from it without an adapter, the same approach used for cbBTC on Aave on Ethereum. No Chainlink feed prices cirBTC itself and no cirBTC proof of reserve feed exists on Ethereum, so pricing assumes par and a depeg of the wrapper would not be reflected in the price reference. The only cirBTC proof of reserve feed is deployed on the chain paired with Ethereum by Circle’s bridge route (see Section 6) and covers supply on both chains; its latest reading is 0.17% below combined supply, and 5 of its 10 updates through 2026-10-20 reported reserves below supply (as low as 4.65% below), including a shortfall of 26.85 BTC (0.46%) against 5,786.02 cirBTC that stood for more than six hours. Most of these readings were corrected within minutes to supply plus about 1.24 BTC; whether they reflect redemptions in flight, a reporting artifact, or a custody gap cannot be determined onchain, and the feed does not gate minting.
Rating: ★★☆ Acceptable → Bitcoin pricing is live and robust, but no feed prices cirBTC itself and the only reserve feed has recently reported reserves below supply.
3. Access Control
The token’s proxy administrator, owner, pauser, freeze authority, and the owner of its MasterMinter contract (which sets each minter’s allowance) are each a single key externally owned account (EOA) for which Circle has provided custody information, but none is behind a multisig or timelock, so an upgrade, role change, pause, or freeze takes effect in one transaction. The owner can reassign every role except the upgrade key, including the MasterMinter, and so indirectly reaches mint, pause, and freeze power; the upgrade key, owner, and pauser have never sent a transaction. Live minter allowances total about 1,627 cirBTC, about 1.8 times the Ethereum supply, with 1,032.68 cirBTC held by a single minting wallet; each allowance is an onchain cap but can be raised, or new minters added, with no delay, and Circle has stated that mint controls will not change before launch and remain a roadmap item, with allowance raises following the same operational procedures as for USDC and EURC. A pause halts all transfers, including those needed to liquidate a position, and the freeze authority, which has frozen 476 addresses, can block any address, though neither power can seize or destroy balances.
Rating: ★☆☆ Concern → live mint allowances exceed the Ethereum supply and can be raised without delay, while upgrade, role, pause, and freeze authority also sit with single keys without an onchain delay.
4. Exchange Rate and Yield
Not applicable. cirBTC is a custodial 1:1 Bitcoin wrapper with no exchange rate function, rebase, or yield accrual.
Rating: N/A
5. Token Architecture
cirBTC has a single canonical token contract on Ethereum, with no fixed supply cap; additional supply can enter only through the minters described in Sections 3 and 6. Mint and burn events are emitted, and the full mint and burn history reconciles exactly to totalSupply(). The logic contains no tx.origin authorization or delegatecall outside the proxy pattern, and every privileged function is gated by its role.
Rating: ★★★ Strong
6. Bridge and Cross-Chain Risk
Two Circle bridges can mint cirBTC on Ethereum: the Cross Chain Token Service (CCTS), a burn and mint route paired only with Arc, and Circle Gateway, which mints on Ethereum against deposits held on other chains; no other bridge provider carries cirBTC. CCTS messages require both of two attesters (the signers that approve a message), each operated by Circle, so the route relies on one issuer trust domain; separately, the keys that upgrade and configure the CCTS message verification contract on Ethereum, and both Gateway contracts on Ethereum and Arc, are single key EOAs whose control and custody the issuer has not confirmed. The Ethereum CCTS minter is not pinned to a fixed implementation and takes its code from a registry whose owner, a single key, can replace it in one transaction, and another single key sets its limits of 9 cirBTC per message and 135 cirBTC of net flow per six hour window (within its minting allowance), with no timelock on either; on Arc, a single key raised the route’s minting allowance by 180 cirBTC in October 2026. Gateway’s cirBTC allowance stands at 300.00 cirBTC and can be raised further at any time through the MasterMinter (see Section 3), so a single signature can authorize mints up to that amount.
Rating: ★☆☆ Concern → a single signature authorizes a Gateway mint, and key bridge administration sits with single keys whose custody is not confirmed.
7. Audit and Security History
The token runs Circle’s FiatToken V2.2, audited by Halborn according to Circle, which also confirmed that the deployed source matches the audited version, though the report itself is not public. The implementation has not been rotated since deployment, and the token has had no pause, role rotation, or known exploit. Circle runs a public vulnerability disclosure program, but the inclusion of cirBTC in its scope is not established, nor is any commitment to notify Aave in advance of upgrades, role changes, or changes to allowances and bridge limits.
Rating: ★★☆ Acceptable → the token logic is audited and unchanged since deployment, but the audit report is not public and bug bounty coverage of cirBTC is not established.
8. Dependencies
The CCTS framework (see Section 6) sits in the mint path, and the audit of it reported by the issuer has not been made available; Circle Gateway, audited by ChainSecurity, has had its wallet contract upgraded three times since that audit, and CCTS messages travel over Circle’s Cross Chain Transfer Protocol (CCTP), also audited by ChainSecurity. Backing depends on Circle’s offchain custody, whose only onchain telemetry is the reserve feed described in Section 2, and redemption to bitcoin is an offchain process limited to Circle’s permitted participants. Onchain exit liquidity sits in three Uniswap V3 pools, paired with WBTC, USDC, and WETH, and a single wallet holds a concentrated share of Ethereum supply.
Rating: ★☆☆ Concern → a bridge framework without an available audit sits in the mint path.
9. Summary
Findings table
Ratings in this table use the star scale from the section Rating lines: ★★★ Strong, ★★☆ Acceptable, ★☆☆ Concern, and N/A where not applicable.
| Area |
Key finding |
Rating |
| 0. Pre-screening |
Active, source verified FiatToken V2.2 proxy, the same implementation as USDC on Ethereum, with no implementation change since deployment. |
★★★ |
| 1. ERC20 |
Standard ERC20 with eight decimals, no fee, rebase, hooks, or flash mint. |
★★★ |
| 2. Oracle |
Live, low risk Chainlink BTC/USD feed, but no cirBTC price feed, no reserve feed on Ethereum, and recent reserve readings below supply. |
★★☆ |
| 3. Access control |
Upgrade, role, mint configuration, pause, and freeze authority held by single keys without a timelock; live mint allowances about 1.8 times supply. |
★☆☆ |
| 4. Exchange rate / yield |
Custodial Bitcoin wrapper with no yield or exchange rate mechanism. |
N/A |
| 5. Token architecture |
Single canonical contract with observable mint and burn events reconciling exactly to supply. |
★★★ |
| 6. Bridge and cross-chain |
Two Circle bridge routes can mint on Ethereum; a single signer authorizes Gateway mints within a 300 cirBTC allowance; key administration by single keys whose custody is not confirmed; CCTS minter unpinned. |
★☆☆ |
| 7. Audit and security |
Audited token logic unchanged since deployment, confirmed by Circle; audit report not public and bug bounty scope not established. |
★★☆ |
| 8. Dependencies |
Bridge framework without an available audit in the mint path, offchain Bitcoin custody, offchain redemption, and concentrated holdings. |
★☆☆ |
Disclaimer
Aave Labs has no formal or informal affiliation with Circle or the cirBTC issuer beyond this technical assessment. Aave Labs has not been compensated by Circle or any related party in connection with this work.