Summary
LlamaRisk supports replacing the current secondary market oracle for mUSD with a hardcoded 1 USD oracle as a temporary measure. This change is proposed due to the transient depegs observed during the initial asset launch phase, which were caused by low liquidity. However, it is essential to note that borrowers bear the downside price risk, as they would be required to repay at $1 even if mUSD were to depeg due to loss of backing, an unlikely scenario, but one that still needs to be acknowledged.
Importantly, this approach remains appropriate for the protocol as long as mUSD is not enabled as collateral. With collateral enabled, a hardcoded oracle would expose Aave to the potential risk of bad debt, as a genuine loss of backing resulting in a sustained depeg would not be reflected in the price feed. In such a case, a switch to a PoR-based oracle would be required.
Current Capped mUSD Oracle
The current mUSD oracle sources price data from secondary markets, making it susceptible to manipulation. Aave applies an upside cap of 1.04 to guard against upward price spikes. However, it does not include downside protection. In the historical price data, a few downward spikes were identified in the Oracle data on October 13, 2025, when the feed momentarily reported prices as low as 0.9621 on Ethereum and 0.9476 on Linea, as shown below.
Source: LlamaRisk, December 4, 2025
These observations raise the question of whether such deviations could be exploited. To assess this, we consider the scenario of a potential exploit, where a user borrows larger amounts of cheaper mUSD priced by the oracle during a temporary depeg. When the oracle price later returns to peg, the borrowed mUSD becomes more expensive relative to the supplied collateral, potentially resulting in bad debt for the protocol. Such a case would require d > 1 – LTV, where d is the negative deviation from peg. The maximum respective LTVs at which mUSD can be borrowed on Ethereum and Linea are 80.5% and 80%, both against WETH.
This exploit would require the oracle to publish a $0.8 price, implying a 20% drawdown, which is nearly four times larger than what has been observed in the current illiquid secondary market environment (Linea – 5.24%, Ethereum – 3.79%). This makes the scenario unlikely. Moreover, since October 13, 2025, the price data reported by the oracle has also remained highly stable, with the lowest downtick being just 14 basis points on November 4, 2025, for Ethereum.
Hardcoded Oracle
The use of a fixed 1 USD oracle works well in the current setup, as mUSD is not enabled as collateral, as it shields the system from short-lived deviations in the secondary market oracle due to thin liquidity. In this configuration, liquidations are not a factor as mUSD can’t be used as collateral, and the main downside price movement risk is borne by borrowers, who may need to repay at $1 even when mUSD’s market price trades lower, including in the case of a permanent depeg from loss of backing.
However, this approach could create issues if Aave were to enable mUSD as collateral in the future. A hardcoded oracle would expose Aave to a bad debt situation if a genuine loss of backing were to occur and mUSD experienced a sustained depeg. In that case, a live market feed, such as the current secondary market feed, or a PoR-based oracle would be required.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.