Summary
LlamaRisk supports onboarding USDe to the Aave V4 Core Hub on Avalanche. USDe is already listed on multiple Aave markets, including V3 and V4. Native USDe minting is not available on Avalanche, and USDe is instead bridged using LayerZero’s Omnichain Fungible Token (OFT) standard, with backing escrowed on Ethereum. The USDe OFT mesh currently spans 31 networks.
On the access control side, the USDe OFT on Avalanche is controlled by a custom timelock controller with a 24-hour delay, which maintains a whitelist allowing certain functions to bypass the delay. Currently, setPeer is whitelisted for the Ethena 5/10 multisig, allowing it to add or remove peers from the OFT mesh without a delay. While this can serve as a plausible incident response mechanism, it could also be exploited by an attacker-controlled address on a chain where the OFT has been compromised. A separate pauser mechanism for incident response currently doesn’t exist. Timelock coverage is absent on some prominent networks in the mesh, with Ethena working to extend coverage over the next few weeks.
USDe DEX liquidity on Avalanche is concentrated in a single Uniswap V3 USDe/USDC pool with approximately $0.5M in TVL, which is relatively low for initial liquidity. Thus, we’re proposing conservative initial caps. Given recent changes to the USDe IRM, particularly the base rate increase, borrowing USDe at current rates is unattractive. We therefore recommend onboarding USDe as a collateral-only reserve on Avalanche, with borrowing disabled.
1. Asset Fundamental Characteristics
1.1 Asset
USDe is a dollar-pegged synthetic stablecoin issued by Ethena Labs, backed by a diversified portfolio spanning liquid assets, institutional lending, RWA, DeFi lending, and delta-neutral strategies. It is not a fiat-redeemable stablecoin and does not represent a deposit claim. It is a claim on a diversified portfolio of yield-generating positions managed by the issuer, with a stability mechanism resting on primary-market arbitrage by whitelisted counterparties rather than on a statutory redemption right.
Under the Aave asset classification framework, USDe is a USD-pegged asset classified as a strategy-backed instrument. Holding USDe alone accrues no yield. Yield accrues to sUSDe, the ERC-4626 vault share obtained by staking USDe.
USDe on Avalanche is deployed as a LayerZero OFT similar to other chains in the mesh.
1.2 Architecture
Ethereum
Direct minting and redemption remain restricted to counterparties that have cleared KYC/KYB checks with Ethena. An approved counterparty transfers an accepted reserve asset and receives USDe in the same transaction, and burns USDe to receive backing assets on the same basis. There is no queue and no epoch: settlement for approved counterparties is atomic.
The mint and redeem contract on Ethereum exposes per-block maximum mint and redeem parameters, as well as a disableMintRedeem function. Both addWhitelistedBenefactor and disableMintRedeem are on the Ethereum timelock’s bypass whitelist, meaning the issuer can suspend primary minting and redemption without waiting out the 24-hour delay.
Extensive analysis of the core architecture has been conducted in prior assessments that detail their underlying design and risk considerations, including: Asset Risk Assessment: Ethena USDe, Addendum to Asset Risk Assessment: Ethena USDe, and Onboard USDe to Aave V3 on Ethereum.
Avalanche
USDe on Avalanche cannot be minted natively and is bridged exclusively through LayerZero V2. On Ethereum, an OFT Adapter escrows canonical USDe. On Avalanche, the OFT mints and burns against LayerZero messages. The Ethereum adapter currently escrows 1.95B USDe.
The Avalanche OFT has a peer configured for Ethereum only. No other pathway is peered, so every inbound and outbound transfer must route through Ethereum. Disruption of the Ethereum pathway leaves no alternative route. Bridge and verifier configuration for Ethereum to Avalanche:
Effective verification is 4 signatures from 5 distinct providers in each direction. The configuration is symmetric and, in both directions, the OApp pins its own receive library rather than inheriting LayerZero’s mutable default. The executor in both directions is LayerZero Labs’ standard executor.
Rate Limits: The Ethereum to Avalanche and Avalanche to Ethereum lanes are both configured at 10,000,000 USDe per 1 hour window. At the current Avalanche supply of 5,769,127 USDe, a single window’s outbound capacity is approximately 1.7 times the entire local supply, so the rate limit is not a binding constraint on an exit from Avalanche.
1.3 Backing and Reserve Analysis
Total backing stands at $4.50B against 4.51B USDe outstanding, representing a 0.9973 coverage ratio before the reserve fund. Including the $62.09M reserve fund brings total coverage to approximately 1.011x. The backing composition has changed majorly from our prior assessments. Delta-neutral perpetual basis, once the entirety of the backing, is now 13.4% of it. The portfolio weight has shifted to new categories including RWA, institutional lending and existing strategies like DeFi Lending, subject to Ethena governance.
Source: LlamaRisk, September 14, 2026
The dominant exposures are now credit risk on institutional borrowers, smart-contract and liquidation risk in DeFi lending venues, issuer risk on the stablecoins held as liquid balances, and manager and valuation risk on the RWA sleeve.
The asset-level series available from Ethena shows liquid cash rising to dominate the portfolio through 2026, with BTC and ETH balances (the crypto basis collateral) reduced to $293.0M and $281.1M respectively.
Source: LlamaRisk, September 14, 2026
Ethena publishes backing at the position level, with the asset, chain, holding wallet, curator or custodian for each position. The tables below map each strategy sleeve. Shares are of total backing of $4.6B.
Crypto Basis
| Exchange |
Assets |
Custodian |
Exposure |
Share of backing |
| Binance |
BTC $205.6M, ETH $129.2M, SOL $20.5M, BNB $6.0M |
Ceffu |
$361,357,082 |
7.9% |
| OKX |
ETH $85.2M, BTC $72.1M |
Copper |
$157,316,071 |
3.4% |
| Bybit |
ETH $58.7M, BTC $1.6M |
Copper |
$60,302,014 |
1.3% |
| Coinbase INTX |
BTC $11.5M, ETH $9.9M |
Copper |
$21,477,984 |
0.5% |
| Total |
|
|
$600,453,151 |
13.0% |
Crypto basis collateral is not held on the exchanges themselves. It sits with an off-exchange settlement custodian and is mirrored to the exchange as margin, which is designed so that an exchange failure costs the hedge rather than the collateral. The custodian dependency this creates is covered in Section 3.5.
DeFi lending
USDe’s backing includes $806.9M supplied into Aave V3 and V4, 17.5% of total backing, and Aave V3 alone, at $781.8M or 17.0%, is the single largest counterparty.
| Protocol |
Asset |
Chain |
Exposure |
Share of backing |
Holding wallet |
| Aave V3 |
USDT0 |
Plasma |
$285,862,753 |
6.2% |
0xb873…313c |
|
USDT |
Ethereum |
$210,055,322 |
4.6% |
0xb873…313c |
|
RLUSD |
Ethereum |
$151,841,776 |
3.3% |
0xb873…313c |
|
USDT0 |
Mantle |
$133,996,475 |
2.9% |
0xb873…313c |
|
USDT0 |
Monad |
$19,230,967 |
0.4% |
0xb873…313c |
| Aave V4 |
USDT |
Ethereum |
$2,958,184 |
0.1% |
0xb873…313c |
|
USDC |
Ethereum |
$2,958,184 |
0.1% |
0xb873…313c |
| Total |
|
|
$806,903,661 |
17.5% |
|
Morpho, Jupiter Lend, and Kamino positions sit in curated vaults or isolated markets whose risk parameters are set by the named curator.
| Protocol |
Asset |
Curator |
Chain |
Exposure |
Share of backing |
Holding wallet |
| Morpho |
PYUSD |
Sentora |
Ethereum |
$150,182,173 |
3.3% |
0x2bf5…f67c |
|
USDC |
Gauntlet |
Base |
$75,046,466 |
1.6% |
0x2bf5…f67c |
|
USDC |
Steakhouse |
Base |
$60,821,257 |
1.3% |
0x2bf5…f67c |
|
USDC |
Steakhouse |
Base |
$30,585,278 |
0.7% |
0x2bf5…f67c |
|
USDG |
Steakhouse |
Ethereum |
$23,555,139 |
0.5% |
0x2bf5…f67c |
|
USDtb |
Steakhouse |
Ethereum |
$1,734,870 |
0.0% |
0x2bf5…f67c |
| Jupiter Lend |
USDG |
Bitwise |
Solana |
$253,121,863 |
5.5% |
C23F…H34L |
| Kamino |
PYUSD |
Sentora |
Solana |
$249,984,435 |
5.4% |
C23F…H34L |
| Total |
|
|
|
$845,031,481 |
18.3% |
|
Institutional lending
Ethena publishes a holding wallet for the Maple position and Bitcoin addresses for CBAM, and no address for FalconX, Kraken, or Anchorage, so those three are verifiable only through attestation. The failure impact of these strategies is default on the underlying institutional loans, with recovery dependent on borrower collateral.
| Borrower or platform |
Exposure |
Share of backing |
Published address |
| Maple Institutional |
$302,941,604 |
6.6% |
0xb873…313c |
| FalconX |
$124,145,320 |
2.7% |
Not published |
| Kraken |
$75,000,000 |
1.6% |
Not published |
| CBAM |
$5,000,000 |
0.1% |
3LWi…d6C9, 3AYo…mjKx, 35Zs…zAXk |
| Anchorage |
$1,000,000 |
0.0% |
Not published |
| Total |
$508,086,924 |
11.0% |
|
Real-world assets
Both funds hold AAA-rated CLO tranches. Their value is set by fund NAV rather than by an on-chain market price, so the failure modes are mark-to-market impairment of the tranches and redemption gating at the fund level. STAC’s underlying assets are custodied at BNY.
| Asset |
Fund |
Manager |
Chain |
Exposure |
Share of backing |
Holding address |
| STAC |
Securitize Tokenized AAA CLO Fund |
Securitize Capital, sub-advised by BNY Investments |
Solana |
$253,013,814 |
5.5% |
4FaQ…rbtN |
| JAAA |
Janus Henderson Anemoy AAA CLO Fund |
Janus Henderson, tokenized by Centrifuge |
Solana |
$202,296,550 |
4.4% |
4FaQ…rbtN |
|
|
|
Base |
$50,574,137 |
1.1% |
0x2d4d…7bb4 |
| Total |
|
|
|
$505,884,501 |
11.0% |
|
Liquid stablecoins
Ethena publishes five Ethereum wallets for these balances, 0x2d4d…7bb4, 0x1c3b…c337, 0x6cd5…c4b5, 0xafbb…2a62, and EthenaMinting, together with a custodial omnibus account whose custodian and share are not disclosed.
| Asset |
Chain |
Held in |
Exposure |
Share of backing |
| PYUSD |
Ethereum |
Ethena wallets and a custodial omnibus account |
$575,861,601 |
12.5% |
| RLUSD |
XRPL |
Copper |
$300,000,000 |
6.5% |
| USDC |
Ethereum |
Ethena wallets and a custodial omnibus account |
$231,320,784 |
5.0% |
| USDT |
Ethereum |
Ethena wallets and a custodial omnibus account |
$115,457,819 |
2.5% |
| USDtb |
Ethereum |
Ethena wallets and a custodial omnibus account |
$90,787,120 |
2.0% |
| USDG |
Robinhood |
Ethena wallets and a custodial omnibus account |
$20,091,817 |
0.4% |
| USDG |
Ethereum |
Not published |
$1,499,938 |
0.0% |
| Total |
|
|
$1,335,019,079 |
29.0% |
PYUSD at 12.5% of backing, the largest stablecoin exposure and larger than any single hedging venue. USDe’s backing depends more on PayPal USD holding its peg than on any one exchange.
1.3.1 Reserve fund
The reserve fund, held in a 4-of-10 Safe, stands at $62,081,856, equal to 1.35% of USDe underlying supply. Ethena’s documentation states that the share of protocol revenue allocated to the reserve fund is currently 0%, with 100% directed to incentive rewards, promotional distributions, and distribution incentives. The fund’s adequacy is a function of supply. Should supply return toward October 2025 peak levels without a change to the revenue allocation, coverage would fall to 0.42% correspondingly.
1.3.2 Proof of reserves
Ethena publishes position-level backing data through its transparency dashboard, providing asset-level attribution of counterparties, custodians, and venues. Custodian attestations are published separately by Ethena Labs, HT Digital, LlamaRisk, and Chainlink. LlamaRisk independently attests to Ethena’s proof-of-reserves solution, with the corresponding PoR reports available here.
1.4 Tokenomics
As of September 14, 2026, the USDe on-chain supply on Avalanche is 5.77M. This supply fluctuates depending upon bridged transfers from Ethereum via LayerZero.
1.4.1 Token Holder Concentration
Source: USDe Top 100 holders on Avalanche, Snowscan, September 14, 2026
The five top holders are as follows:
Ninety of the top 100 holders holding 71.78% share of USDe Avalanche supply are byte-identical proxies resolving to a single upgradeable beacon at 0xc831…8448, whose implementation and deployer are common across all of them.
2. Market Risk
2.1 Liquidity
Source: DeFiLlama, September 14, 2026
Users can swap 132K USDe for USDC within a price impact of 7.5% on Avalanche.
2.1.1 Liquidity Venue Concentration
Source: GeckoTerminal, September 14, 2026
USDe DEX liquidity on Avalanche is concentrated in a single venue: Uniswap V3 USDe/USDC pool with $0.5M TVL, which is relatively low.
2.1.2 DEX LP Concentration
Liquidity in the Uniswap V3 USDe/USDC pool is highly concentrated, with a single EOA providing all of the liquidity. If this entity withdraws its position, USDe exit liquidity could become severely constrained, creating a liquidity crunch.
2.2 Volatility and Peg History
Source: LlamaRisk, September 14, 2026
Since the deployment of the Uniswap USDe/USDC pool, no sustained deviations from the peg have been observed. However, the peg deviation exceeded 150 bps on three occasions. As pool liquidity continues to deepen, the frequency and magnitude of such deviations are expected to decline, consistent with the improvement observed over the past month.
2.3 Exchanges
Source: Coingecko, September 14, 2026
USDe is actively traded on centralized exchanges, including Binance and Bybit, with approximately $10M in sell-side liquidity available within a 2% price impact.
2.4 Growth
Source: LlamaRisk, September 14, 2026
Aggregate USDe supply is 4.61B, approximately 31% of the October 3, 2025 peak of 14.82B. The contraction is attributable to the October 2025 deleveraging event and to the subsequent compression in perpetual funding, which removed the yield differential that had drawn capital into sUSDe. On Avalanche, however, USDe supply remains above its October peak, currently standing at $5.78M. Current inflows are primarily dependent on cross-chain transfers from Ethereum via LayerZero.
2.5 Oracle and Price Feed Treatment
Source: LlamaRisk, September 14, 2026
Aave prices USDe using a capped oracle on the underlying USDT/USD feed categorized by Chainlink as low market risk, rather than the USDe/USD feed, which carries a medium market-risk classification and has experienced significant deviations from the peg on two separate occasions.
| Event |
Feed low |
Deviation |
Context |
| February 21, 2025, 15:45 UTC |
$0.97721 |
-228 bps |
Bybit security incident |
| October 10, 2025, 23:04 UTC |
$0.99294 |
-71 bps |
Market-wide deleveraging |
Given the likelihood of such events occurring and the higher risk classification of the USDe/USD feed, we recommend maintaining the current price feed configuration.
3. Smart Contract Security
3.1 Architecture and Access Controls
3.1.1 Contract Modification Options
The following contracts power USDe on Avalanche:
The sensitive functions exposed by Avalanche USDe OFT:
These are the USDe controlling wallets on Avalanche:
- Ethena Multisig: 5/10 Safe multisig, admin of the timelock controller and can execute
setPeer function bypassing the timelock.
- EthenaTimelockController: 24-hour RBAC timelock controlled by Ethena, handles USDe OFT wide admin functions.
3.1.2 Timelock Duration and Function
USDe on Avalanche is owned by EthenaTimelockController with minDelay of 86,400 seconds (24 hours). However, this contract extends OZ’s TimelockController with a function-level whitelist. A holder of WHITELISTED_EXECUTOR_ROLE may call a function with no delay. Entries are added and removed by addToWhitelist and removeFromWhitelist, both of which are restricted to the timelock itself and therefore require a full 24 hour delay to take effect.
On Avalanche, the timelock’s only instant-effect authority over USDe is setPeer. Setting a peer to zero immediately severs a bridging pathway, which is a plausible incident-response action. However, the same authority can add or repoint a peer without delay, which presents a risk because peer mapping is the only authentication check applied to inbound messages.
Avalanche’s OFT enforces rate limits only on outbound transfers, as do all Ethena deployments except Tempo. While Tempo’s adapter supports inbound rate limits, its only active lane currently has no limit. Consequently, a peer could be repointed to a contract outside Ethena’s control with no effective rate limit on either side, leaving the amount that could be minted on Avalanche effectively uncapped. The 5-of-10 Ethena Safe is the sole authority over this change. A separate pauser mechanism for incident response currently doesn’t exist.
Everything else, including setRateLimits, setDelegate, transferOwnership, and the LayerZero library and DVN configuration, requires the full 24 hour delay on Avalanche.
3.1.3 Multisig Threshold / Signer identity
Ethena Multisig (5/10 Safe) is the admin of the EthenaTimelockController contract and has the following role-based access control:
| Role |
Assigned addresses |
Functionality |
DEFAULT_ADMIN_ROLE |
EthenaTimelockController |
Grant and revoke roles. Self-administered, so any role change must itself pass the 24 hour delay. |
PROPOSER_ROLE |
Ethena Multisig |
Schedule operations, which then wait 24 hours. |
CANCELLER_ROLE |
Ethena Multisig |
Cancel a scheduled operation before execution. |
EXECUTOR_ROLE |
EOA A, Multisig B, Ethena Multisig |
Execute an operation once its delay has elapsed. Cannot schedule. |
WHITELISTED_EXECUTOR_ROLE |
Ethena Multisig |
Execute a pre-whitelisted function with no delay. |
3.2 Multi-Chain Evaluation Scope
USDe is registered at 32 LayerZero V2 endpoints, of which 29 are EVM chains and three are non-EVM (Solana, Aptos, TON). Ethereum is the canonical chain and holds the OFT Adapter. Every other endpoint runs a mint-and-burn OFT.
Source: LlamaRisk, September 14, 2026
The peered lanes all route through Ethereum, with outbound lanes connecting it to 29 of the 30 networks in the mesh. Swell is the sole exception and remains disconnected from all peers. Zircuit, Swell, zkSync, Scroll, Manta, Mode, Metis, and Kava appear to be marked for deprecation, with all inbound rate limits set to zero.
Ownership
Of the 32 networks in the mesh, 13 are controlled by an EthenaTimelockController, each with the same 24-hour minimum delay: Ethereum, Base, Robinhood, Monad, BNB Chain, HyperEVM, Avalanche, Arbitrum, MegaETH, Ink, Optimism, Linea, and Scroll.
The remaining 19 networks are controlled directly by multisigs, primarily 5/10 Safes on EVM chains, without timelock protection. Among these, Solana has the largest USDe OFT balance at 531M, controlled by a 4/10 Squads multisig with no timelock, followed by Plasma at 380.9M, TON at 171.8M under a 5/11 multisig, and Mantle at 60.3M. Berachain (11.9M) and Blast (0.93M) also remain under untimelocked ownership.
Ethena is working to extend timelock coverage to the remaining networks over the next couple of weeks, with deprecation planned for some networks by year-end.
3.3 Audit Coverage
Ethena’s core protocol contracts (USDe, minting) have been audited by multiple firms including Zellic (July 2023) and others listed on Ethena’s audits page. The LayerZero OApp/OFT framework used for cross-chain bridging was separately audited by Zellic (September 2025). The Avalanche-specific OFT deployment uses the same audited codebase but has not received a chain-specific audit.
3.4 Bug Bounty Program
- Ethena: Maximum bounty of $3M via Immunefi for critical smart contract vulnerabilities (10% of affected funds, minimum $100k).
- LayerZero: Maximum bounty of $15M via Immunefi for critical smart contract vulnerabilities. However, OFT-related contract impacts are classified as low severity with a maximum payout of $10,000.
3.5 Dependency Risk
Bridge and messaging
| Dependency |
Role |
Authority |
Failure impact |
| LayerZero V2 Endpoint |
Message transport |
Routes verified messages to the OFT |
Bridging halts in both directions. |
| LayerZero Labs DVN |
Required verifier |
Must sign every message |
Bridging halts. Cannot forge alone. |
| Canary DVN |
Required verifier |
Must sign every message |
Bridging halts. Cannot forge alone. |
| Horizen, Nethermind, StablecoinX DVNs |
Optional verifiers, 2 of 3 |
Two must sign |
Bridging halts if two of the three are unavailable. |
| LayerZero Labs Executor |
Delivers verified messages |
Calls lzReceive on the destination |
Messages verify but do not deliver until an alternative executor is used. |
| Ethereum OFT Adapter |
Escrow |
Holds 2.03B USDe backing all bridged supply |
Escrow compromise breaks the backing of every bridged USDe including Avalanche. |
Strategy risk
Beyond the bridge, USDe depends on four layers of third parties through its backing: the managers who run each strategy, the protocols the capital is deployed into, the chains those protocols run on, and the custodians holding off-chain collateral. Position-level detail is in the strategy tables in Section 1.3.
Outside Aave, all DeFi lending exposure is managed by a third-party curator that sets each market’s risk parameters, collateral rules, and allocation, rather than by Ethena directly. Institutional and RWA exposure is likewise delegated to a lending platform or a fund manager. Sentora is the largest curator at $400.2M (8.7% of backing), across a Morpho PYUSD vault on Ethereum and an isolated Kamino PYUSD pool on Solana, so a single curator’s risk decisions reach two protocols on two chains. Aave supply ($806.9M) is not curator-managed, and its risk sits at the protocol level. CBAM ($5.0M) and Anchorage ($1.0M) complete the institutional book.
Protocol risk
35.9% of USDe backing sits in five lending protocols, and Aave (V3 & V4) accounts for 17.5%, across its Ethereum, Plasma, and Mantle markets. Morpho, Jupiter Lend, and Kamino positions sit in curated vaults or isolated markets, which confine a loss to the market concerned but place its parameters with the curator.
Chain risk
On-chain backing of $3,492.8M (75.9%) is spread across eight networks. Ethereum holds $1,558.2M (33.9%) and Solana $958.4M (20.8%), the latter concentrating two lending markets and both RWA funds. USDT0 positions on Mantle, Monad, and Plasma total $439.1M (9.5%) and depend on the USDT0 bridge as well as on the chain. Plasma carries both an Aave position and the largest USDe OFT balance still under untimelocked ownership (379,381,434 USDe, Section 3.2). The remaining $600.5M of crypto basis collateral and $508.1M of institutional loans sit off-chain.
| Chain |
Allocations |
Exposure |
Share of backing |
| Ethereum |
Liquid stablecoins, Aave V3 and V4, Morpho |
$1,558,212,910 |
33.9% |
| Solana |
Jupiter Lend, Kamino, STAC, JAAA |
$958,416,662 |
20.8% |
| XRPL |
RLUSD, custodied at Copper |
$300,000,000 |
6.5% |
| Plasma |
USDT0 supplied to Aave V3 |
$285,862,753 |
6.2% |
| Base |
Morpho USDC vaults, JAAA |
$217,027,138 |
4.7% |
| Mantle |
USDT0 supplied to Aave V3 |
$133,996,475 |
2.9% |
| Robinhood |
USDG |
$20,091,817 |
0.4% |
| Monad |
USDT0 supplied to Aave V4 |
$19,230,967 |
0.4% |
Aave is already deployed on Ethereum, Plasma, Base, Mantle, and Monad, all of which were assessed in depth as part of their respective onboarding processes. Solana, XRPL, and Robinhood, however, have not yet undergone a comparable assessment.
Custodian risk
Custodied backing totals $900.5M (19.6%) across two named custodians. Copper holds $539.1M, of which $239.1M is exchange collateral for OKX, Bybit, and Coinbase INTX under off-exchange settlement and $300.0M is RLUSD on XRPL, and STAC’s underlying assets are custodied at BNY. Ceffu holds the $361.4M of Binance collateral. Off-exchange settlement keeps collateral off exchange balance sheets, which moves the dependency from the exchange to the custodian rather than removing it.
4. Regulatory Risk
Regulatory risks associated with USDe were assessed in previous reviews, with no material changes identified. Accordingly, they are omitted from this report for brevity.
Disclaimer
This review was independently prepared by LlamaRisk, a community-led decentralized organization funded in part by the Aave DAO. LlamaRisk serves as an independent attestor of Ethena’s PoR solution. LlamaRisk did not receive compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
