https://governance.aave.com/t/23234
Summary
LlamaRisk recommends onboarding syrupUSDC on Base at this stage, as supply has successfully bootstrapped over the past month and currently exceeds $10M. SyrupUSDC on Base is supported by approximately $20M of DEX liquidity, fully supplied by the Maple team. Consistent with our previous assessments of syrupUSDC and syrupUSDT, no new structural concerns are identified.
syrupUSDC on Base has robust administrative controls in place, with a 1-day delay on contract upgrades enforced via a GovernorTimelock controlled by Maple’s 4-of-8 threshold multisig and an EOA (if not MPC-based, a multisig configuration is recommended). 44.6% of the USDC backing syrupUSDC is deployed into Open Term Loans at a 146.9% collateralization ratio, with loans primarily collateralized by BTC and XRP. The remaining USDC is maintained as active liquidity to support syrupUSDC redemptions and is deployed across various DeFi protocols by Maple.
1. Asset Fundamental Characteristics
1.1 Asset
According to the Asset Classification Framework (AAcA), syrupUSDC is classified as a yield-bearing stablecoin backed by overcollateralized institutional loans underwritten and managed by Maple Direct. The syrupUSDC ERC-4626 vault currently manages 1.64B USDC, representing the sum of all USDC deposited into the pool and managed by various syrupUSDC strategies. A portion of this backing is allocated to maintain readily available liquidity for redemptions. This liquidity is deposited across various DeFi protocols on Ethereum, including Aave. Consequently, the underlying yield is derived from both the active loans and the DeFi yield generated on the liquidity reserves.
The current open term loan composition shows that the USDC backing syrupUSDC is lent out to loans primarily composed of BTC ($338M) and XRP ($253M). The overall collateralization ratio for USDC-based loans stands at 146.9%, with a total of $732M USDC lent out.
Source: LlamaRisk, December 18, 2025
1.2 Architecture
The primary architecture of syrupUSDC was discussed in detail during the V3 Core onboarding, and no changes have been made to its design or functionality. The core operations of syrupUSDC, including fixed-rate loan underwriting and liquidity management, are managed on Ethereum by Maple.
Issuance of syrupUSDC on Base is facilitated through Chainlink’s CCIP bridge, employing a lock-and-mint mechanism in which tokens remain locked in the LockReleaseTokenPool contract on Ethereum while syrupUSDC is bridged to Base. Conversely, transfers from Base back to Ethereum follow a burn-and-unlock mechanism.
1.3 Tokenomics
The loan underwriting infrastructure for syrupUSDC resides on Ethereum; therefore, its supply on Base remains capped by the total amount of syrupUSDC minted on Ethereum, i.e., 1.43B. As of December 18, 2025, the total supply of syrupUSDC on Base stands at 10.68M.
1.3.1 Token Holder Concentration
Source: BaseScan, December 18, 2025
The top 3 holders of syrupUSDC on Base are:
These three holders collectively control over 99.99% of syrupUSDC’s supply on Base. This high utilization across DEXs is generally positive and provides a safe liquidity buffer to support Aave supply logistics.
2. Market Risk
2.1 Liquidity
Source: syrupUSDC/USDC Swap Liquidity, Odos, December 18, 2025
On Base, users can swap up to 7.3M syrupUSDC worth $8.34M for 8M USDC within a price impact of 4%.
2.1.1 Liquidity Venue Concentration
Source: syrupUSDC DEXs on Base, GeckoTerminal, December 18, 2025
syrupUSDC liquidity on Base is concentrated in two venues: Fluid syrupUSDC/USDC pool ($9.99M TVL) and Aerodrome syrupUSDC/USDC pool ($9.93M TVL).
2.1.2 DEX LP Concentration
syrupUSDC liquidity on Base is highly concentrated in the two DEX venues, with the liquidity provider being Maple themselves. This concentration reduces the likelihood of an abrupt liquidity withdrawal, as protocol-controlled liquidity is generally more stable and less prone to sudden outflows. Below is the LP concentration breakdown for the two pools on Base (as of December 18, 2025):
- Fluid syrupUSDC/USDC: The top supplier is Maple with ~100% share of the pool’s liquidity.
- Aerodrome syrupUSDC/USDC: The top supplier here is also Maple with ~100% share of the pool’s liquidity.
2.2 Volatility
Source: LlamaRisk, December 18, 2025
The syrupUSDC Fluid pool on Base has consistently traded within a 10 bps range with respect to the syrupUSDC-USDC exchange rate since December 1, 2025, when the liquidity was bootstrapped by Maple, with the current composition of the pool being $4.57M in syrupUSDC and $5.46M in USDC.
2.3 Exchanges
syrupUSDC is exclusively traded on DEXs and is not currently listed on any centralized exchange.
2.4 Growth
Source: LlamaRisk, December 18, 2025
To date, a total of 1.44B syrupUSDC has been minted on Ethereum, out of which 10.68M is currently supplied to Base via a lock-and-mint mechanism as the token is only natively issued on Ethereum. Its total supply on Base remains capped by the available circulating supply on Ethereum, which stands at 1.43B.
3. Technological Risk
The technological risks associated with syrupUSDC on Ethereum, including smart contract risk, bug bounty coverage, and dependency risk, remain unchanged from our syrupUSDC Core onboarding review and are omitted here for brevity, as the underlying architecture is identical. On Base, however, an additional dependency exists on Chainlink CCIP due to its role in facilitating cross-chain transfers of syrupUSDC between Ethereum and Base.
4. Counterparty Risk
4.1 Governance and Regulatory Risk
The regulatory risk has been previously discussed in detail as part of the syrupUSDC Core onboarding review. As there have been no material changes, that assessment remains applicable here.
4.2 Access Control Risk
4.2.1 Contract Modification Options
Here are the syrupUSDC controlling wallets on Base:
The following contracts power the syrupUSDC architecture on Base:
- syrupUSDC: Immutable ERC20 contract for the syrupUSDC token controlled by the GovernorTimelock.
- BurnMintTokenPool: Pool implementation responsible for minting/burning tokens (syrupUSDC) on the destination chain (Base) and is owned by the RBAC Timelock.
syrupUSDC employs a role-based access control framework to manage sensitive functions:
4.2.2 Timelock Duration and Function
A delay of 1 day (86400 seconds) has been implemented on the syrupUDSC contract upgrades via the GovernorTimelock.
4.2.3 Multisig Threshold / Signer identity
Maple-controlled Multisig A (4/8 Safe) and EOA 1 are the admins of the GovernorTimelock contract, which has the following role-based access control:
| Controlling Addresses |
Role |
Functionality |
| Multisig A, EOA 1 |
ROLE_ADMIN |
Can update roles including the role admin role itself |
| EOA 2, Multisig B |
EXECUTOR_ROLE |
Can execute all proposals including role updates |
| Multisig A |
PROPOSER_ROLE |
Can schedule proposals but can not schedule role updates |
| Multisig C |
CANCELLER_ROLE |
Can unschedule proposals but can not unschedule role updates |
Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.
Aave V3 Specific Parameters
Aligned and presented with @ChaosLabs above.
Price feed Recommendation
Chainlink’s syrupUSDC/USDC Exchange Rate feed, combined with the USDC/USD base feed and CAPO can be used to price syrupUSDC on Aave’s Base market.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
