EUR CoinVertible (EURCV) on Aave Ethereum

Risk Assessments
2

Summary

LlamaRisk conditionally supports the listing of EURCV on Aave V4, pending the launch of the bug bounty program. The Euro-denominated asset represents a 1:1 reserve-backed stablecoin issued by Societe Generale-Forge, which holds its underlying collateral in a segregated account managed by Societe Generale. EURCV operates similarly to other centrally issued stablecoins, with the issuer ultimately retaining access control privileges and a gated minting/redemption flow accessible only to KYC/KYB entities and, more broadly, via secondary markets and partners.

Offchain and onchain mechanisms control the assets’ collateralization, with automated systems enabling continuous minting/redemption flows for permissioned users (Preferred partners and the issuer). No bug bounty is currently active, and the team indicates that one will be introduced. Reserve attestations are currently reported by the issuer, with audited 3rd party attestations to be introduced. EURCV has kept a relatively tight peg to the Euro, comparable to EURC since its introduction in late 2025.

1. Asset Fundamental Characteristics

1.1 Asset

EUR CoinVertible (EURCV) is an ERC20 Euro stablecoin issued by Societe Generale-Forge as part of the CoinVertible asset series. Under the AAcA framework, EURCV is classified as a reserve-backed stablecoin, backed 1:1 by reserves held in segregated Euro-denominated accounts managed by Societe Generale-Forge. For EURCV, the Initial Collateral Custodian is Societe Generale.

Reserve assets are held in a segregated account and may consist of cash and low-risk liquid securities. The issuer indicates, however, that reserves are currently 100% fiat and maintain a 1:1 collateralization ratio. EURCV is natively minted on different chains, including Ethereum, Solana, XRP Ledger, and Stellar.

1.2 Architecture

EURCV is issued behind an upgradeable ERC1967 proxy. The SmartCoin contract implements strict access controls, blacklisting capabilities, and redemption mechanisms. 3 operators are defined in the contract, each with distinct roles:

  • Registrar: The most significant role, responsible for compliance controls (freezing/blacklisting), managing the redemption process, token supply (mint/burn), and governance.
  • Technical: Manages contract upgrades.
  • Operations: Has no defined role within the contract; its updated primary role is an involvement in contract upgrades. (see section 4.2.1 for more details)

Minting and burn access is privileged, with only the issuer-controlled registrar permitted to perform these functions. No fees are associated with direct minting or burning.

The following subsections (preferred partners, minting, and redemption) are defined in the EURCV whitepaper.

Preferred Partners

Preferred Partners are financial institutions (network of exchanges, brokers, and market makers) that are permitted to act as distributors of electronic money for Societe Generale, allowing them to process minting and redemption of EURV from the issuer. Currently onboarded partners, as indicated on the “Network of partners" section on the Coinvertible website, include: Bitpanda, Bitstamp, Bullish, BCB Group, Flowdesk, Keyrock, and Wintermute. Bitstamp is the primary Preferred Partner for EURCV issued on Ethereum.

Minting

Minting is permissioned, with minting available directly from the issuer or indirectly through approved Preferred Partners. Potential direct purchasers are required to pass a “Valid Purchaser” assessment to access EURCV from the issuer as a subscriber and/or purchaser.

Valid Purchasers are required to transfer/deliver the agreed assets to the segregated account specified by the issuer. Upon confirmation of receipt, EURCV is either minted directly into the Valid Purchaser’s address or transferred. Valid Purchasers are required to pass KYC/AML and Sanctions Rule verifications by the issuer before being approved to receive EURCV.

The stablecoin can also be purchased on secondary exchanges, with the issuer retaining the right to blacklist addresses from holding EURCV, exercised at the issuer’s sole discretion (for illegal activities or violations of the issuer’s requirements).

Redemption

EURCV holders have 2 options when redeeming EURCV back into fiat: directly from the issuer or through a Preferred Partner.

Issuer-based redemptions require the holder to submit their redemption request directly via email. Prerequisites, including completion of KYC/AML, permitted transferees, sanctions rules, and other controls (see section 4.1 for more details), need to be completed before redemptions can be processed. On successful completion and the EURCV being transferred to the redemption address, the relevant redemption amount in Euros is transferred to the holder’s account by the last business day of the month following the month the controls were completed. If a holder fails to complete these controls, EURCV is sent back to their wallet.

Preferred Partner redemptions require EURCV holders to satisfy the partner’s KYC/AML and sanctions requirements. Once onboarded, redemption requests follow the procedure established by the partner, which may include transferring EURCV to the partner prior to confirming the redemption request. Upon confirmation, the corresponding EURCV is frozen, and the partner requests that the issuer transfer the equivalent amount in Euros no later than the last business day of the month following the month in which the redemption request was confirmed. The funds are then credited to the holder’s Preferred Partner account.

Redemptions are restricted to EEA residents and Permitted Transferees who satisfy applicable KYC/AML and sanctions requirements under both direct and Preferred Partner (EU residents) instances.

The issuer retains the right to exercise redemptions under 2 conditions:

  • Unwind Event: Upon 90 days’ notice, the issuer may redeem all outstanding EURCV and liquidate the collateral. Holders will be entitled to receive one EURO per EURCV. Upon the Redemption Date, EURCV shall become void, and no payment shall be made in respect thereof
  • Special Event: Following a Tax, Regulatory, and/or Force Majeure Event, the issuer retains the right to issue a 90-day notice for the redemption of EURCV.

A “Business Day” in the context of EURCV is defined as a day on which:

  • Commercial banks settle payments and are open for general business in France; and
  • The Trans-European Automated Real-Time Gross Settlement Express Transfer (T2) System (or any replacement thereof) is operating.

Redemption limits are set per KYC client for direct redemptions, while redemptions facilitated by preferred partners are not limit-bound.

Offchain System

EURCV minting and redemption on Ethereum is enabled via an integrated offchain system. The automated system enables minting and redemption that are processed within 2 minutes on average, according to the issuer. Automated requests are processed continuously and are not subject to market times. Manual mint/burns are also available but operate during market hours (9 am to 6 pm, Monday to Friday).

According to the issuer, EURCV minting is triggered by an internal API that monitors incoming cash flows to the collateral account held by Société Générale. Once the API detects a deposit, an automated minting engine initiates the mint workflow on mainnet.

For redemption operations, each valid customer is assigned a dedicated address used exclusively for burning purposes, which is assigned onchain using the addRedemptionAddresses function. When EURCV is sent to the address, the smart contract detects if the transfer meets the isRedemptionAddress parameter, which initiates the redemption process and directs the EURCV to the Registrar account. The offchain settlement system monitors for the RedemptionStarted event emission before transferring the equivalent amount in fiat to the customer’s designated bank account. Once a settlement is confirmed, the Registrar burns the associated tokens. Transaction screening is handled automatically via Chainalysis.

1.3 Tokenomics

There is no supply cap enforced on EURCV. The total supply currently sits at 105.6M, with 70.6M on Ethereum. The underlying collateralization value equals the total EURCV outstanding multiplied by 1 unit of Euro.

As stated in section 1.2, the issuer retains discretionary rights to blacklist addresses from holding EURCV, with the whitepaper indicating that the primary justifications include:

  1. If the issuer suspects that these addresses may be involved in illegal activities or violate the issuer’s requirements and/or the provisions outlined in the whitepaper
  2. If a holder sends or receives EURCV from a blacklisted address, the Issuer has the right to freeze the corresponding EURCV.
  3. The issuer may be required to freeze EURCV and/or surrender any related Euro held in the Segregated Account(s) if it receives a legal order from a valid government authority mandating such actions.

1.3.1 Token Holder Concentration

image

Source: Etherscan, September 15th, 2026

Of the total 6,846 holders, the top 5 holders include:

Over 90% of the mainnet supply is held by the top 5 addresses, the majority of which is locked in a Morpho vault, specifically a Steakhouse Prime EURCV vault. The associated concentration in an Aave competitor currently does not offer potentially distorting incentives, with its APY capped at 3.00%. EURCV is primarily used as a loanable asset enabled as collateral for cbBTC, WBTC, wstETH, EUTBL, eurSAFO, and steakUSDC (min LTV is 86%).

2. Market Risk

2.1 Liquidity

image

Source: EURCV/USDC Swap, DeFiLlama Swap, September 15th, 2026

Approximately 3.15M EURCV ($3.63M) can be swapped within a 5.5% price impact for USDC.

2.1.1 Liquidity Venue Concentration

image

Source: EURCV pools, GeckoTerminal, September 15th, 2026

There are only 2 pools with meaningful liquidity on mainnet: a Uniswap EURCV/EUROC pool with a TVL of ~$5.8M and a Uniswap EURCV/USDC pool with a TVL of $3.4M.

2.1.2 DEX LP Concentration

Within the EURCV/USDC and EURCV/EUROC pools, an EOA is the sole source of liquidity. The EOA is associated with SG Forge and is controlled by their main market maker for those pools.

2.2 Volatility

EURCV vs EUR/USD Oracle Deviation

Since the EURCV/USDC Uniswap pool launched in late September 2025, the pool market rate has tracked the Chainlink EUR/USD oracle closely. Over the full trading history, the pool traded within a deviation range of -1.06% to +4.36%, with a mean deviation of just +0.04%. The elevated positive tail was concentrated in the first two weeks of pool operation, where thin initial liquidity allowed the market rate to briefly dislocate from the oracle reference. Excluding that bootstrapping period, the pool has maintained tight oracle tracking since mid-October 2025.

image

Source: EURCV Oracle Deviation, Steakhouse, September 2026

EURCV/USDC vs EURC Market Rates

Relative to the most liquid EUR-based stablecoin, EURC, the EURCV/USDC Uniswap pool market rate has tracked the EURC DEX average daily rate closely across its full trading history. Since pool inception through September 3, 2026, the spread ranged from a low of -0.41% to a high of +3.04%, with the positive extreme again attributable to the illiquid early deployment window in October 2025. Once liquidity matured, the spread range compressed to -0.41% to +0.66% against the EURC reference rate, with a mean of +0.01%. The narrow steady-state range reflects broad parity between the assets.

image

Source: EURCV/USDC vs EURC market rates, LlamaRisk, September 2026

2.3 Exchanges

EURCV is available on two exchanges, Bullish and Bitstamp, which also act as Preferred Partners.

image

Source: EURCV CEX pools, Coingecko, September 15th, 2026

2.4 Growth

The total supply of EURCV on mainnet has steadily grown since its inception, peaking at 132.2M as of September 3rd. Relative to other chains, Ethereum represents the largest supply of EURCV, with approximately 80% of the overall supply.

image

Source: EURCV mainnet supply, LlamaRisk, September 2026

image

Source: EURCV, RWA.xyz, September 15th, 2026

3. Technological Risk

3.1 Smart Contract Risk

A Hacken audit on the SmartCoin contract was completed in June 2025. 1 medium and 1 low-severity issue were found.

The most recent upgrade to the SmartCoin occurred in November 2025. Relative to the previous implementation, the current implementation includes 194 lines removed (41.6% reduction) and introduced 60 new lines of code.

This presents a potential blocker given the lack of re-attestation on subsequent material upgrades.

3.2 Bug Bounty Program

There is currently no bug bounty in place for Societe Generale-Forge or CoinVertible-related assets.

The issuer indicated that they planned to introduce a bug bounty shortly. SG Forge indicated that they would introduce a bug bounty in 2027.

3.3 Price Feed Risk

A native EURCV Chainlink price feed is currently unavailable; however, the Chainlink EUR/USD price feed can serve as a suitable proxy, given that the underlying collateral is held in Euro fiat and remains redeemable at 1:1 par value.

Because the EUR/USD feed is a standard Forex price source, updates occur during defined FX trading hours, 24/5 (18:00 ET Sunday to 17:00 ET Friday), which introduces stale price-reporting risk outside those hours. This follows an established pattern used across onboarded Euro-denominated assets, including EURe on Gnosis, EURA and jEUR on Polygon (disabled), EURS on Arbitrum (frozen) and Polygon (disabled), and EURm on Celo. Currently, EURC is the sole Euro-stable asset supported by a dedicated, asset-specific EURC/USD feed.

Proof of reserves data is currently only available offchain, published on the issuer’s Coinvertible page and stated to be updated several times per day, with internal audits purportedly carried out before each reserve update. The issuer has indicated that formal third-party proof of reserves attestations are planned to be published on a quarterly or monthly basis (the frequency is yet to be determined). Until these attestations are established and published consistently, collateralization risk remains elevated given the absence of sufficient independent attestation measures.

3.4 Dependency Risk

The primary risks associated with EURCV are centralized custodian and reserve management risk. Holders rely on Societe Generale as the custodian of the underlying reserves. As the sole custodian for safely holding and managing the underlying assets, EURCV’s dependency risk is entirely concentrated in the operational soundness and transparency of the bank. The 1:1 redemption guarantee requires that reserves be managed and reported transparently. While internal systems and a webpage are updated regularly, a PoR feed would provide greater onchain visibility and minimise trust assumptions.

According to the EURCV white paper, holders are potentially exposed to the credit risks of Societe Generale and Preferred Partners (during redemptions) if they default or go bankrupt while user collateral is being held.

Additionally, while Euro reserves are held in a segregated account, this represents pooled collateral shared across all networks on which EURCV is deployed. EURCV does not make cross-chain calls, but the commingling of assets across external networks creates potential contagion risk; an exploit on one network could undercollateralize EURCV on Ethereum until the necessary interventions are made.

4. Counterparty Risk

4.1 Governance and Regulatory Risk

SG-FORGE holds three load-bearing French regulatory authorisations, each relevant to the EURCV business model:

  1. Electronic Money Institution (EMI) license - granted by the ACPR effective 1 July 2024. This is the basis for issuing EMTs under MiCA Title III via Art. 48 (any credit institution or EMI may issue EMTs without further authorisation under MiCA, provided the whitepaper notification process is observed).
  2. Investment firm authorisation - also supervised by the ACPR and conduct-regulated by the AMF. Provides the MiFID2 capital-markets perimeter under which SG-FORGE provides ancillary services.
  3. Crypto Asset Service Provider (CASP) - granted by the AMF in July 2023, predating MiCA. Under MiCA’s CASP regime, this French authorisation transitions into a MiCA CASP license through the EU’s grandfathering provisions (Art. 143).

EURCV satisfies each MiCA EMT compliance pillar: (i) issuance by an authorised EMI (Art. 48); (ii) whitepaper notified to the ACPR on 30 May 2024 and offer commenced 1 July 2024 (Art. 51); (iii) 1:1 redemption-at-par right for EEA holders (Art. 49); (iv) no interest payable to holders (Art. 50); (v) reserve segregation and asset eligibility (Arts. 36, 38); (vi) recovery and redemption plans submitted under Arts. 46–47 within six months of offer commencement; (vii) marketing communications subject to ACPR oversight (Art. 53). The whitepaper further states that EURCV is not a “significant” EMT under Art. 56 - i.e., outstanding supply has not crossed the EBA-administered thresholds that would trigger enhanced supervision (i.e., €5bn or 2.5m daily-transaction-count threshold).

EURCV is structured as a 100% cash- and high-quality-liquid-asset–backed EMT. The whitepaper provides specific composition rules: the Segregated Account holds (i) non-invested cash and cash distributions received by the issuer and (ii) Euro-denominated securities qualifying as “highly liquid financial instruments with minimal market risk, credit risk, and concentration risk, in accordance with Article 38(1) of MiCA,” with a credit rating “at least equivalent to the long term unsecured credit rating of senior preferred debt of Société Générale.” The Collateral Test imposes a hard floor: “cash held in Segregated Account(s) represent at least 30% of the Required Collateral Assets Value.” The eligibility criteria, therefore, explicitly map onto MiCA Art. 38 reserve-asset constraints.

Reserves are held in segregated accounts opened in SG-FORGE’s name on the books of “Collateral Custodians.” The Initial Collateral Custodian is Société Générale S.A. (the issuer’s parent G-SIB). The whitepaper contemplates Subsequent Collateral Custodians at other banks rated at or above SG’s senior unsecured rating, but as of the 27/04/2026 reserve snapshot, the entire EURCV reserve is held at SG. The segregation construct relies on Article L. 526-32 of the French Monetary and Financial Code (which insulates safeguarded e-money funds from issuer creditors), supplemented by Article L. 522-17 CMF (the segregated-account agreement requirement) and the Issuer-Custodian agreement dated June 2024.

Per the issuer’s confirmation, SG-FORGE’s Finance and Compliance teams are currently developing a formal concentration-risk framework, and the issuer does not consider the current EURCV AUM to pose significant concentration risk at this scale. Separately, SG-FORGE’s parallel USDCV product is custodied at Bank of New York, demonstrating that the issuer has the operational and contractual infrastructure to onboard non-affiliated Subsequent Collateral Custodians - a meaningful piece of forward-looking optionality for EURCV reserve diversification, though no such diversification has yet been activated for EURCV.

Holders who are EEA residents have an unconditional right of redemption at par per MiCA Art. 49, but the practical settlement timeline is materially longer than a 24/7 instant-redemption flow. The whitepaper provides for a controlled multi-step process: redemption request by email → 5 business-day acknowledgment → KYC/AML/Permitted-Transferee/Sanctions controls → settlement “at the latest on the last Business Day of the month following the month the controls were successfully completed.” On the inside, that can be ~T+5; on the outside, it can stretch to more than a month, particularly if the request lands at the start of a month and controls take time. Holders can alternatively redeem through a “Preferred Partner” (currently Bitstamp on Ethereum and Bullish on Solana), whose own settlement timelines apply.

Reserves are reported by the issuer on its own website, with composition and Collateral Test results published the business day following each Collateral Test Date. The whitepaper provides for the optional appointment of a Collateral Monitoring Agent, but does not name one. Independent third-party reserve attestations are not provided.

SG-FORGE applies multi-jurisdictional sanctions screening at issuance, redemption, and on a continuous basis through smart-contract address blacklisting. The whitepaper adopts a four-source sanctions definition; per the issuer’s confirmation, the operative screening framework covers UN, EU, OFAC, OFSI, G7, and local-authority sanctions lists - i.e., a broader regime than the four-source whitepaper definition would suggest. Compliance operates under a Société Générale Group three-lines-of-defence model: AML, CFT, and sanctions policies (including KYC and CDD/EDD) are reviewed and approved annually by senior management, supervised quarterly by the Supervisory and Risk Committee, and reported at the Board level. Client onboarding, ongoing due diligence, PEP, adverse-media, and name screening are largely delegated to Société Générale and run through group tools — Dow Jones Risk & Compliance for sanctions/PEP/adverse-media data and Fircosoft for screening orchestration. On-chain transaction and sanctions monitoring is managed locally by SG-FORGE through a Know-Your-Transaction framework run on Chainalysis; screening is performed for every transaction, with alerts escalated to Compliance and (where applicable) to local authorities. Smart-contract enforcement is performed by SG-FORGE through a freeze/blacklist function held in the Issuer’s sole discretion.

EURCV applies a tiered user-restriction architecture. At the issuance gateway, only “Valid Purchasers” who pass KYC/AML and qualify as “Permitted Transferees” can receive EURCV directly from the issuer. The Permitted Transferee construct excludes U.S. persons under Regulation S of the U.S. Securities Act, the U.S. Commodity Exchange Act, and Section 15G of the U.S. Securities Exchange Act. EEA residents who do not pass KYC at redemption time can be functionally barred from exercising redemption rights even though they hold the token.

4.2 Access Control Risk

Here are the controlling wallets:

  • EOA 1: assigned the Registrar role
  • EOA 2: assigned the Technical role
  • EOA 3: assigned the Operations role

The SmartCoin contract exposes the above roles known collectively as “Operators”. These Operators and their sensitive functions assigned to them include:

  • Registrar, the compliance/admin authority role is assigned to a single EOA.
Functions Description
mint() Mints new tokens and assigns them to an unfrozen address.
burn() Burns registrar’s balance (within redemption flow).
wipeFrozenAddress() Burns the balance of a frozen address.
freeze() Freezes account(s) from transferring or receiving tokens.
unfreeze() Unfreezes accounts.
pause() Halts all token operations.
unpause() Resumes normal contract operation.
addRedemptionAddresses() Registers redemption addresses.
removeRedemptionAddresses() Deregisters redemption addresses.
nameNewOperators() Designates the three operator addresses for the next contract implementation. Named operators must subsequently accept their roles before an upgrade can proceed.
authorizeImplementation() Pre-approves a new implementation contract for upgrades. Requires all named operators to have already accepted their roles.
  • Technical, executes upgrades initiated by the Registrar.
Functions Description
upgradeTo() Upgrades the proxy to a new implementation contract.
upgradeToAndCall() Same as upgradeTo, but additionally calls an initialization function on the new implementation with the provided data.
  • Operations, the role is retained in the latest implementation, but no longer has any specific permissions or functions.

The assignment of EOAs presents a potential security risk; if the EOAs assigned to the registrar and technical roles were to be compromised, then

4.2.1 Contract Modification Options

Here are the main contracts of the architecture:

Contract upgrades require that the Operators be upgraded in tandem. This means the nominated addresses assume their new roles, while the current Operators remain in place until the upgrade is complete.

The main upgrade process steps include:

  1. Registrar nominates the next Operators
  2. Each operator accepts their nominated role
  3. The current (old)Technical deploys a new contract
  4. The current Registrar authorize the update to the new contract
  5. The current Technical calls the upgradeTo function
  6. The upgradeTo function checks each operator has accepted, and then the upgrade is performed.

Upgrades, therefore, require both the Technical and Registrar to execute contract upgrades. The same addresses can be re-nominated to the Operator roles, but they will still need to accept their roles via the acceptXYZRole function before an upgrade can be effected.

  • Operations role

As stated in section 4.2, the Operations role has no assigned functions and is solely required in contract upgrade operations. The role has been retained in the latest version of the Smartcoin contract and is not intended to be reactivated or its permissions/functions expanded in the future. The role is a legacy Operator that remains to avoid reworking the existing contract upgrade mechanisms, which require that a set of Operators be nominated and assigned before an upgrade.

Removing the Operations role would require timely and complex modifications to the system; thus, this role is maintained for technical and architectural continuity. Its presence does not introduce any security issues and is retained for simplicity within the existing upgrade workflow.

4.2.2 Timelock Duration and Function

No timelock is currently implemented, allowing contract modifications and upgrades to take effect immediately upon execution.

4.2.3 Multisig Threshold / Signer identity

Operator-assigned EOA private keys are stored within Ripple Custody (an institutional custody solution), where they are encrypted using the HSM key management (Hardware Security Module). Only the HSM is able to decrypt these keys, and they are never exposed in plain text. Transactions enacted with these EOAs are performed exclusively through Ripple Custody, following a multi‑role approval workflow:

  • For the Registrar, an operator prepares the transaction, and a controller must approve it before it can be executed.
  • For the Technical, a technical user prepares the transaction, which must then be approved first by an operator and subsequently by a controller.

The security of this model depends entirely on the integrity of Ripple Custody’s access controls and HSM integration. Access to roles, thus, is only technically accessible outside of these workflows if the Ripple Custody admin can bypass the approval workflow.

Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V4. This framework is continuously updated and available here.

Aave V4 Specific Parameters

Given the lack of a bug bounty, the appropriate parameters will be proposed with an addendum post once this blocker has been resolved.

Price feed Recommendation

We recommend using the Chainlink EUR/USD price feed to price EURCV.

Disclaimer

This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed

1 Like
[ARFC] Onboard EURCV to Aave V4 Core Instance on Ethereum
LlamaRisk - Monthly Community Update