[Direct to AIP] Add rlUSD as Collateral

Summary

LlamaRisk does not recommend enabling RLUSD as collateral at this stage, primarily due to the absence of a timelock mechanism that allows unrestricted contract upgrades. Additionally, RLUSD’s DEX liquidity has not scaled proportionally with its rapidly growing supply on Ethereum and Aave (Core and Horizon), where ~80% of the circulating tokens are concentrated. In fact, it has declined over the past six months, from $60M to $52M currently, which may lead to potential liquidity risk during periods of stress. Moreover, RLUSD lacks a bug bounty program that covers its smart contracts, further elevating its technical risk profile. The Ripple team is working to resolve these issues, particularly the upgrade control via a timelock. Once these issues are resolved, RLUSD’s collateral eligibility can be revisited.

Asset Risk

According to the Asset Classification Framework (AAcA), RLUSD is a reserve-backed stablecoin pegged to the USD. It is issued by Standard Custody & Trust Company, a Ripple subsidiary regulated by the New York Department of Financial Services (NYDFS). RLUSD is available on both the XRP Ledger (XRPL) and Ethereum (via the ERC20 standard). Over the past six months, its supply on Ethereum has more than tripled, from 250M in May 2025 to 786M currently. While the overall supply growth may be influenced by multiple factors, the sharp increase in RLUSD deposited on Aave (Core + Horizon) can be attributed to ongoing incentive programs. Currently, approximately 80% of the circulating RLUSD is held on Aave, highlighting the concentration of liquidity within the protocol.


Source: LlamaRisk, October 31, 2025

Access Control

RLUSD employs a role-based access control system to manage its core functions, including minting, burning, upgrading, freezing, and pausing. The UPGRADER_ROLE is assigned to a 7/8 threshold MultiSig contract, which can perform unrestricted contract upgrades as no timelock mechanism is in place. This lack of upgrade constraints presents a significant risk, and RLUSD should not be enabled as collateral until the issue is addressed. The Ripple team has indicated that a timelock implementation is in work, but the timeline is uncertain.

Additionally, RLUSD does not have a bug bounty program covering its smart contracts, further contributing to the overall technical risk. The team confirmed that the existing bug bounty applies only to the XRPL, and expansion to include Ethereum deployment is planned for H1 2026.

Market Risk


Source: RLUSD/USDC Swap Liquidity, DeFiLlama, October 31, 2025

Users can swap up to $27M worth of RLUSD for USDC on Ethereum DEXs within a 6% price impact. Onchain liquidity is primarily concentrated in the Curve RLUSD/USDC pool ($49.8M TVL) and the Uniswap V3 RLUSD/USDC pool ($2.1M TVL). While this liquidity has historically remained stable, it has declined over the past six months from $60M to $52M. The current composition is shown below.


Source: LlamaRisk, October 31, 2025

RLUSD is also available on various CEXs, creating an additional secondary market liquidity buffer. Approximately 10M RLUSD can currently be sold in CEXs under the -2% slippage threshold.


Source: RLUSD Top CEX Markets, Coingecko, October 31, 2025

Volatility


Source: RLUSD Secondary Market Price, GeckoTerminal, October 31, 2025

Over the past six months, RLUSD has consistently maintained its secondary market peg on the Curve pool, trading within a 0.1% spread. The largest deviation observed was 14 bps in May 2025, indicating deep and stable liquidity.

E-mode

Given the current risk profile of RLUSD, we do not recommend enabling it for E-mode. Once the necessary improvements are implemented and RLUSD is approved as collateral, its inclusion in E-mode can be reconsidered.

Disclaimer

This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.