Summary
LlamaRisk supports onboarding USDe to the Aave V3 X Layer instance, contingent on bootstrapping sufficient DEX liquidity to provide a reliable local exit venue for liquidators. At present, no local DEX liquidity is available on X Layer, leaving liquidators dependent on off-chain or cross-chain exit routes. The team is expected to supply $5M in DEX liquidity before launch in the coming days, addressing this key launch prerequisite. USDe is already listed on multiple Aave markets, including V3 and V4. Native USDe minting is not available on X Layer, and USDe is instead bridged using LayerZero’s Omnichain Fungible Token (OFT) standard, with backing escrowed on Ethereum.
On the access control side, the USDe OFT on X Layer is controlled by a custom timelock controller with a 24-hour delay, which maintains a whitelist allowing certain functions to bypass the delay. Currently, setPeer is whitelisted for the Ethena 5/10 multisig, allowing it to add or remove peers from the OFT mesh without a delay. A separate pauser mechanism for incident response currently doesn’t exist. Timelock coverage now extends to 16 of the 34 networks, and remains absent on Solana and TON, the two largest balances outside Ethereum.
1. Asset Fundamental Characteristics
1.1 Asset
USDe is a dollar-pegged synthetic stablecoin issued by Ethena Labs, backed by a diversified portfolio spanning liquid assets, institutional lending, RWA, DeFi lending, and delta-neutral strategies. It is not a fiat-redeemable stablecoin and does not represent a deposit claim. It is a claim on a diversified portfolio of yield-generating positions managed by the issuer, with a stability mechanism resting on primary-market arbitrage by whitelisted counterparties rather than on a statutory redemption right.
Under the Aave asset classification framework, USDe is a USD-pegged asset classified as a strategy-backed instrument. Holding USDe alone accrues no yield. Yield accrues to sUSDe, the ERC-4626 vault share obtained by staking USDe.
USDe on X Layer is deployed as a LayerZero OFT similar to other chains in the mesh.
1.2 Architecture
Ethereum
Direct minting and redemption remain restricted to counterparties that have cleared KYC/KYB checks with Ethena. An approved counterparty transfers an accepted reserve asset and receives USDe in the same transaction, and burns USDe to receive backing assets on the same basis. There is no queue and no epoch: settlement for approved counterparties is atomic.
The mint and redeem contract on Ethereum caps minting at 200,000,000 USDe and redemption at 20,000,000 USDe per block, both in aggregate and for each collateral asset, and exposes a disableMintRedeem function. Six stablecoins are accepted at those per-asset caps (PYUSD, USDC, USDG, USDT, USDm, and USDtb), along with DAI at 2,000,000 USDe in each direction. No volatile collateral remains enabled, and the contract rejects any stablecoin mint or redemption priced at a rate better than 1:1 for the counterparty. Both addWhitelistedBenefactor and disableMintRedeem are on the Ethereum timelock’s bypass whitelist, meaning the issuer can suspend primary minting and redemption without waiting out the 24-hour delay.
Extensive analysis of the core architecture has been conducted in prior assessments that detail their underlying design and risk considerations, including: Asset Risk Assessment: Ethena USDe, Addendum to Asset Risk Assessment: Ethena USDe, and Onboard USDe to Aave V3 on Ethereum.
X Layer
USDe on X Layer cannot be minted natively and is bridged exclusively through LayerZero V2. On Ethereum, an OFT Adapter escrows canonical USDe. On X Layer, the OFT mints and burns against LayerZero messages. The Ethereum adapter currently escrows 2.28B USDe.
The X Layer OFT has a peer configured for Ethereum only. No other pathway is peered, so every inbound and outbound transfer must route through Ethereum. Disruption of the Ethereum pathway leaves no alternative route. Bridge and verifier configuration for Ethereum to X Layer:
| Direction |
Required DVNs |
Optional DVNs (threshold) |
Block confirmations |
Send library |
Receive library |
Inherits LZ default receive library |
| Ethereum to X Layer |
LayerZero Labs, Canary Subsidized |
Horizen, Nethermind, StablecoinX (2 of 3) |
15 |
0xbB2E…dCe1 |
0xc02A…24C2 |
No |
| X Layer to Ethereum |
LayerZero Labs, Canary Subsidized |
Horizen, Nethermind, StablecoinX (2 of 3) |
6,000 |
0xe184…1043 |
0x2367…8312 |
No |
Effective verification is 4 signatures from 5 distinct providers in each direction. The configuration is symmetric in its verifier set and, in both directions, the OApp pins its own receive library rather than inheriting LayerZero’s mutable default. The executor in both directions is LayerZero Labs’ standard executor.
The messages leaving X Layer wait 6,000 block confirmations, roughly 100 minutes at the chain’s observed block rate, against 15 confirmations on the Ethereum side (3 minutes).
Rate Limits: The Ethereum to X Layer and X Layer to Ethereum lanes are both configured at 10,000,000 USDe per 1 hour window. At the current X Layer supply of 62.78 USDe, a single window’s outbound capacity is roughly 159,000 times the entire local supply, so the rate limit is not a constraint on an exit from X Layer.
1.3 Backing and Reserve Analysis
USDe’s backing composition, reserve fund, and counterparty exposure were examined in our USDe Avalanche review in September 2026. As of October 12, 2026, backing totals $4.76B against 4.76B USDe outstanding, allocated to DeFi lending (36.9%), liquid stablecoins (24.9%), crypto basis (17.6%), institutional lending (14.3%), and RWA (6.0%).
1.4 Tokenomics
As of October 12, 2026, the USDe on-chain supply on X Layer is 62.78 USDe. The OFT was deployed on June 14, 2024, and the chain has never held a material balance. Since deployment, daily supply has never exceeded 542.72 USDe, a peak reached on January 3, 2025.
2. Market Risk
USDe secondary-market liquidity on X Layer is currently effectively zero, with no DEX pools bootstrapped. Following discussions with the team, $5M in DEX liquidity is expected to be added ahead of launch in the coming days. On-chain liquidity remains crucial for onboarding because liquidators currently depend on bridging USDe back to Ethereum, a process that takes roughly 100 minutes in block confirmations before execution, as highlighted above. While USDe is actively traded on centralized exchanges, it is not currently supported on OKX, increasing reliance on third-party CEXs and introducing additional execution friction and operational complexity. This is particularly relevant during liquidations, when speed and reliable access to liquidity are critical.
Source: LlamaRisk, October 12, 2026
3. Smart Contract Security
3.1 Architecture and Access Controls
3.1.1 Contract Modification Options
The following contracts power USDe on X Layer:
The sensitive functions exposed by X Layer USDe OFT:
These are the USDe controlling wallets on X Layer:
- Ethena Multisig: 5/10 Safe multisig, admin of the timelock controller and can execute
setPeer function bypassing the timelock.
- EthenaTimelockController: 24-hour RBAC timelock controlled by Ethena, handles USDe OFT wide admin functions. It is also the LayerZero delegate for the OFT, so endpoint-level configuration follows the same delay.
3.1.2 Timelock Duration and Function
USDe on X Layer is owned by EthenaTimelockController with minDelay of 86,400 seconds (24 hours). However, this contract extends OZ’s TimelockController with a function-level whitelist. A holder of WHITELISTED_EXECUTOR_ROLE may call a function with no delay. Entries are added and removed by addToWhitelist and removeFromWhitelist, both of which are restricted to the timelock itself and therefore require a full 24 hour delay to take effect.
On X Layer, the timelock’s only instant-effect authority over USDe is setPeer. Setting a peer to zero immediately severs a bridging pathway, which is a plausible incident-response action. However, the same authority can add or repoint a peer without delay, which presents a risk because peer mapping is the only authentication check applied to inbound messages. Consequently, a peer could be repointed to a contract outside Ethena’s control with no effective rate limit on either side, leaving the amount that could be minted on X Layer effectively uncapped. The 5-of-10 Ethena Safe is the sole authority over this change. A separate pauser mechanism for incident response currently doesn’t exist.
Everything else, including setRateLimits, setDelegate, transferOwnership, and the LayerZero library and DVN configuration, requires the full 24 hour delay on X Layer.
3.1.3 Multisig Threshold / Signer identity
Ethena Multisig (5/10 Safe) is the admin of the EthenaTimelockController contract and has the following role-based access control:
| Role |
Assigned addresses |
Functionality |
DEFAULT_ADMIN_ROLE |
EthenaTimelockController |
Grant and revoke roles. Self-administered, so any role change must itself pass the 24 hour delay. |
PROPOSER_ROLE |
Ethena Multisig |
Schedule operations, which then wait 24 hours. |
CANCELLER_ROLE |
Ethena Multisig |
Cancel a scheduled operation before execution. |
EXECUTOR_ROLE |
EOA A, Multisig B, Ethena Multisig |
Execute an operation once its delay has elapsed. Cannot schedule. |
WHITELISTED_EXECUTOR_ROLE |
Ethena Multisig |
Execute a pre-whitelisted function with no delay. |
3.2 Multi-Chain Evaluation Scope
USDe is registered at 34 LayerZero V2 endpoints, of which 31 are EVM chains and three are non-EVM (Solana, Aptos, TON). Ethereum is the canonical chain and holds the OFT Adapter, which escrows 2.28B USDe. Every other endpoint runs a mint-and-burn OFT. The peered lanes all route through Ethereum, with outbound lanes connecting it to 25 of the 33 other networks, and 23 of those peering back. Kava, Linea, Manta, Mode, Scroll, Swell, and zkSync now have no peer configured in either direction and are effectively disconnected from the mesh, while the Ethereum lanes into Blast and Zircuit remain peered but carry a zero limit, which closes them in that direction
Ownership
Of the 34 networks in the mesh, 16 are controlled by an EthenaTimelockController, each with the same 24-hour minimum delay: Ethereum, Plasma, Base, Robinhood, Mantle, BNB Chain, Monad, Avalanche, HyperEVM, Arbitrum, MegaETH, Ink, Optimism, Linea, Scroll, and X Layer.
The remaining 16 networks are controlled directly by multisigs, primarily 5/10 Safes on EVM chains, without timelock protection. Among these, Solana has the largest USDe OFT balance at 473.4M, controlled by a 4/10 Squads multisig with no timelock, followed by TON at 168.9M under a 5/11 multisig and Berachain at 13.2M. Together the untimelocked deployments hold roughly 657M USDe.
Ethena continues to extend timelock coverage to the remaining networks, with deprecation planned for some networks by year-end, which is in progress as the peered lane count has fallen from 66 to 56 since our September review.
3.3 Audit Coverage
Ethena’s core protocol contracts (USDe, minting) have been audited by multiple firms including Zellic (July 2023) and others listed on Ethena’s audits page. The LayerZero OApp/OFT framework used for cross-chain bridging was separately audited by Zellic (September 2025). The X Layer OFT deployment uses the same audited codebase but has not received a chain-specific audit. Its runtime bytecode is byte-identical to the Base deployment of the same OFT, so it is the same compiled contract rather than a chain-specific variant.
3.4 Bug Bounty Program
- Ethena: Maximum bounty of $3M via Immunefi for critical smart contract vulnerabilities (10% of affected funds, minimum $100k).
- LayerZero: Maximum bounty of $15M via Immunefi for critical smart contract vulnerabilities. However, OFT-related contract impacts are classified as low severity with a maximum payout of $10,000.
3.5 Dependency Risk
USDe’s dependencies, covering the strategy managers, lending protocols, chains, and custodians behind its backing, along with the bridge and oracle inputs, were mapped in our USDe Avalanche review in September 2026. X Layer specific additional dependencies include LayerZero configuration and access controls already documented in prior sections.
4. Regulatory Risk
Regulatory risks associated with USDe were assessed in previous reviews, with no material changes identified. Accordingly, they are omitted from this report for brevity.
Disclaimer
This review was independently prepared by LlamaRisk, a community-led decentralized organization funded in part by the Aave DAO. LlamaRisk serves as an independent attestor of Ethena’s PoR solution. LlamaRisk did not receive compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
