Summary
LlamaRisk supports onboarding PAXGy to the Aave V4 Global Dollar Hub as collateral in two placements: on the existing Gold Spoke against USDG, at a 70% collateral factor and a 7.50% maximum liquidation bonus and on a new Gold Correlated Spoke against PAXG, at 85% and 4%, each with a 480 PAXGy add cap. PAXGy is a non-upgradeable vault share over PAXG whose exchange rate an operator writes about once a day from a gold-lending book targeting about 80% of assets.
The on-chain setup is sound. Every contract sits behind a 24-hour timelock, and the token carries a dedicated audit and a bug bounty. The main risk lies off-chain, in the lending book and in redemption. Paxos Labs targets about 80% of the vault for lending to four borrowers, the largest taking nearly two thirds of capacity, and values those loans from statements it produces itself, with no independent check. It states that pledged loans are fully collateralised and that no loan runs longer than 30 days, but the insurance does not cover a default, so any uncovered loss falls on all holders through a lower exchange rate. Redemption is open only to whitelisted institutions, so most retail holders would exit through the market. A loss first pauses the accountant, freezing the price and liquidations, and reaches the price only through a timelocked markdown at least 24 hours later.
LlamaRisk recommends the listing at these parameters, alongside making PAXG borrowable under a rate model that matches PAXGy’s 3% yield at 60% utilisation, so leverage looping is profitable below that point and unwinds above it. This makes rehypothecation at the current size of the PAXG reserve limited. The support is conditional on the liquidity Paxos Labs has committed on Ethereum being live at the time of listing, $2 million in a Uniswap pool against PAXG and $1 million in the PAXG/USDC pool.
1. Asset Fundamental Characteristics
1.1 Asset
PAXGy is an ERC-20 vault share issued by Paxos Protocol Inc. and operated by Paxos Labs on Ethereum mainnet and X Layer, carrying 18-decimal precision and deployed at the same address on both chains. Holders deposit Pax Gold (PAXG) and receive PAXGy, and each share redeems for a quantity of PAXG that grows as the vault earns a return on the deposited metal. The token is non-rebasing, so the return sits in the exchange rate and is denominated in ounces of gold. Paxos Labs describes the return source as fixed-rate, fixed-term lending of the deposited gold to institutional borrowers. Each PAXG is title to one troy ounce of a London Good Delivery bar held in vaults accredited by the London Bullion Market Association (LBMA), issued by Paxos Trust Company, National Association (Paxos, Pax Gold, Pax Gold whitepaper). As of October 8, 2026, 265.53 PAXGy are outstanding across the two chains, at an exchange rate of 1.0017 PAXG per share, and the vault holds 190.70 PAXG on Ethereum. Paxos Labs publishes developer documentation listing the token and its main entry points on both chains. It publishes no terms of service or yield disclosure.
1.2 Architecture
PAXGy is the share token of a BoringVault, the vault contract of the Veda stack, and on Ethereum the vault itself holds the deposited PAXG. Every contract in the cluster is deployed directly with no proxy in front of it, so changing behaviour means deploying a replacement and repointing the cluster at it. Function is split across the teller that mints, burns, and bridges shares, the accountant that publishes the exchange rate the teller prices against, the depositor that fronts the mint path, the withdraw queue that takes redemption orders, the manager that executes calls on the vault’s holdings, and the transfer hook the vault consults on every share movement. A roles registry grants each module and operator the individual function selectors it may call. A 24-hour timelock owns every contract in the cluster, and a 3-of-5 Safe is the only address that can schedule an operation on it.
Source: Etherscan and OKLink, October 1, 2026
Minting routes PAXG through the depositor into the teller, which issues shares at the accountant’s rate. Redemption runs in two steps. The holder submits an order to the withdraw queue and receives an ERC-721 position representing it, and a single operator key then processes the queue in submission order through the teller’s bulk-withdraw path. Depositing, submitting a redemption order, and the teller’s combined deposit-and-bridge path are restricted to 10 whitelisted addresses on Ethereum. The Safe granted 8 of them directly between August 19 and September 21, 2026, and the 2 added since the timelock took ownership on September 21, 2026 went through it. Bridging existing shares is open to any holder.
Share transfers are otherwise open. The hook is a freeze list that reverts a transfer, a withdrawal, or a bridge send whose sender, recipient, or caller is listed. It holds 124 addresses, all added on September 16, 2026 by a single operator key, and the same addresses are frozen on X Layer. The list gates frozen addresses alone, so secondary transfers of PAXGy carry no know-your-business check.
Deposited gold leaves the vault by two routes. The first is the teller’s withdrawal path against burned shares. The second is the manager, which executes calls whose target and calldata match a Merkle root that the timelock sets per strategist. A single strategist key carries a live root, and 75.19 PAXG has left the vault through it to a Paxos deposit address, which forwards each transfer within minutes to the Paxos wallet Etherscan labels Paxos 4. Once a call is approved in that Merkle allowlist, nothing else on-chain limits how much gold it can move or where it can send it. So the allowlist itself is the only on-chain guardrail on vault outflows.
1.2.1 Cross-chain Deployments and Bridge Scope
PAXGy moves between Ethereum and X Layer over a Chainlink Cross-Chain Interoperability Protocol (CCIP) lane that burns shares on the source chain and mints them on the destination. The X Layer teller accepts no PAXG for deposit or withdrawal, and the X Layer withdraw queue has never taken an order, so shares reach X Layer through the lane and leave it through the lane.
Source: Etherscan and OKLink, October 1, 2026
1.3 Tokenomics
PAXGy is issued against PAXG deposits on Ethereum only and reaches X Layer over the CCIP lane, which burns shares on Ethereum and mints the same number on X Layer. Of the 265.53 PAXGy outstanding, 139.64 sit on Ethereum and 125.89 on X Layer, with none in transit. Supply follows deposits and redemptions, with no emission schedule, no vesting, and no allocation withheld from circulation. Since September 10, 2026, 289.33 PAXG has been deposited and 23.55 PAXGy redeemed. Shares carry no lock after minting, and the withdraw queue rejects any order below 0.001 PAXGy. All 12 orders submitted to it have been processed.
The depositor carries a supply cap of 6,843.38 ounces of gold, about $28.5 million at the October 1, 2026 gold price. The check multiplies the Ethereum-side share supply by the exchange rate, so shares bridged to X Layer fall outside it, and so do mints through the teller’s deposit-and-bridge path, which bypasses the depositor. The 139.64 PAXGy on Ethereum count as 139.88 ounces against it, about 2.0% of the cap. No contract bounds total PAXGy across the two chains. Paxos Labs sized the cap at $30 million, states that it can scale lending capacity to $100 million at launch if needed, and expects up to $500 million of capacity within 6 weeks of launch.
The accountant contract’s exchange rate sets what a share is worth. It is written about once a day by an operator key and stood at 1.001655 PAXG per PAXGy on October 7, 2026, up from 1.000000 on September 18. Each new value is held to at most a 0.04% increase over the standing rate, at least one hour since the previous write, and no decrease, and a value outside those bounds pauses the accountant without publishing. Daily increments have run between 0.20 and 0.75 basis points, except for steps of 4.00 basis points on September 23, 2.83 on September 30, and 2.61 on October 7. Only the timelock can change the bounds or lift a pause.
A 25 basis point fee applies to PAXG redemptions, charged by the withdraw queue’s fee module and paid to the admin Safe. The depositor’s fee module charges nothing on a PAXG mint, and the accountant’s management and performance fees are zero. The dynamic deposit and withdrawal fee modules named in the developer documentation are deployed but not connected to the depositor or the queue.
1.3.1 Token Holder Concentration
Pool contracts hold 41.26% of the supply on the two chains. The concentrated-liquidity USDG/PAXGy pool on X Layer holds 40.40% and the deJAAA/PAXGy pool on X Layer holds 0.86%. The largest holder outside the pools is an unattributed externally owned account (EOA) on Ethereum with 29.63%. It is followed by an ether.fi Cash account, a contract funded by ether.fi’s Cash factory, with 13.10%, an address Etherscan tags as a market maker with 9.40%, and 1 of the 10 whitelisted minting addresses with 5.25% on X Layer.
Source: Etherscan and OKLink, October 8, 2026
The top holder controls 40.40% of the 265.53 PAXGy outstanding on the two chains, the top 5 control 97.78%, and the top 10 control 99.44%. The X Layer rows are drawn from addresses that have held or moved PAXGy on either chain, which hold 99.3% of X Layer supply, so an X Layer holder outside that set is missing from them.
On Ethereum, 30 addresses hold the 139.64 PAXGy on that chain. The largest Ethereum holder holds 56.34% of it, and the three largest hold 99.12%.
Source: Etherscan, October 8, 2026
2. Market Risk
2.1 Liquidity
A liquidator who seizes PAXGy against USDG debt has three exits on Ethereum and each starts by selling PAXGy:
- Sell PAXGy to the market makers for USDC, then convert the USDC into USDG. The USDC-to-USDG leg cleared $1 million at under 0.01% slippage on October 8, 2026.
- Sell PAXGy for PAXG, then sell the PAXG. On the PAXG leg, 241 PAXG (about $1 million) cleared into USDC at 0.46% and into USDG at 0.22% slippage on October 8, 2026.
- Sell PAXGy for PAXG, then redeem the PAXG with Paxos for US dollars at the gold price, from 0.01 ounce (Paxos, Pax Gold), and convert the dollars into USDG.
Selling PAXGy draws on two sources of liquidity. On Ethereum, PAXGy trades against PAXG in a Uniswap V4 pool at a 0.003% fee tier, holding about $777 on October 5, 2026. Paxos Labs has committed $2 million of liquidity to a Uniswap pool against PAXG in the first half of October 2026, and a further $1 million to the PAXG/USDC pool. Paxos Labs also states that four market makers have committed to quoting PAXGy.
2.1.1 Liquidity Venue Concentration
GeckoTerminal indexes five PAXGy pools on October 5, 2026, all on Uniswap. The USDG/PAXGy pool on X Layer holds 97.1% of the indexed liquidity.
| Chain |
Venue |
Pair |
Liquidity |
24h volume |
| X Layer |
Uniswap V3 |
PAXGy/USDG 0.05% |
$694,000 |
$42,000 |
| X Layer |
Uniswap V3 |
deJAAA/PAXGy 0.30% |
$19,000 |
$0 |
| Ethereum |
Uniswap V4 |
PAXG/PAXGy 0.003% |
$777 |
$1,000 |
| X Layer |
Uniswap V4 |
PAXGy/USDG |
$2 |
$0 |
| X Layer |
Uniswap V3 |
PAXGy/USDC 0.05% |
$0 |
$0 |
Source: GeckoTerminal, October 5, 2026
Paxos Labs states that PAXGy is coming to Pendle on X Layer and Ethereum, Uniswap, EtherFi, 0x, Axal, and LI.FI Intents over the coming weeks.
2.1.2 DEX LP Concentration
The Ethereum PAXG/PAXGy pool rests on a single position, held by 1 of the 10 whitelisted minting addresses in a range between 1.0001 and 1.0005 PAXG per PAXGy. Paxos Labs states that $2 million would be committed to a Uniswap pool against PAXG, so it is expected that Ethereum liquidity for PAXGy will rest on a single provider. That concentrates liquidation depth in one provider. The four committed market makers quote PAXGy alongside that pool.
2.2 Volatility
PAXGy’s price history is short. The accountant first moved the exchange rate on September 19, 2026 and no exchange lists the token, so this section measures its two price drivers separately: PAXG’s price against gold, and the vault’s share price.
The first is gold. Across 664 daily observations from December 7, 2024 to October 1, 2026, the underlying PAXG has priced within 1% of gold spot on 96.5% of days, at a median premium of 0.11% and extremes of a 2.68% premium and a 1.47% discount. Realised annualised volatility is 24.8% for the token and 24.5% for the gold reference, so PAXG carries the metal’s volatility and adds little of its own. Weekends are under a third of the sample but account for 10 of the 23 days outside 1%. This happens because the gold reference holds its last market price while markets are closed, but the token keeps trading. The basis measured here is the underlying’s. PAXGy’s own gap to gold carries the vault’s share price on top of this one.
Source: Chainlink PAXG/USD and Chainlink XAU/USD, October 1, 2026
The second is the share price. The accountant accepts an increase of at most 0.04% per update and requires an hour between updates, and a write below the standing rate pauses the accountant instead of publishing. A loss in the gold-lending book can reach the share price only after the timelock lowers the accountant’s floor, an operation scheduled on-chain at least 24 hours before it takes effect. Until then the loss appears as a rate that stops advancing.
The two strategies of PAXGy on Aave carry different price exposure. A position that borrows USDG against PAXGy carries the full gold price, at 24.5% realised annualised volatility, together with PAXG’s basis to gold. A position that borrows PAXG against PAXGy carries only the ratio between the two, which in redemption terms is the accountant’s rate. The rate has risen by 0.20 to 0.75 basis points a day apart from three larger steps, and it falls only through a markdown.
2.3 Exchanges
No exchange lists PAXGy, and the token has no CoinGecko entry. Paxos Labs states that PAXGy is coming to OKX Exchange, OKX Global Earn, Pendle on X Layer and Ethereum, 0x, Axal, EtherFi, Uniswap, and LI.FI Intents over the coming weeks, with committed market makers quoting on some of these exchanges.
2.4 Growth
Supply grew from 0.04 PAXGy on September 10, 2026, when the first deposit through the teller landed, to 265.53 PAXGy on October 8, 2026, nearly all of it minted from September 23 onward. Deposits between October 1 and October 8 came to 183.41 PAXG. A net 125.89 PAXGy has been bridged to X Layer. PAXGy runs on Ethereum and X Layer, and Paxos Labs plans further chain deployments, all on the CCIP bridge stack.
3. Technological Risk
3.1 Smart Contract Risk
Pashov Audit Group reviewed PAXGy itself from March 4 to March 5, 2026, covering the vault, the base and cross-chain tellers, the asset-specific fee module, the distributor code depositor, and the freeze-list transfer hook in the code repository. The review found 1 high, 1 medium and 11 low-severity issues. All were resolved except 2 low-severity findings that were acknowledged: bridging burns shares sent to a frozen recipient, and a frozen address can deposit assets it cannot withdraw. The remaining contracts are covered by reviews in the repository’s audit directory.
Every contract in the cluster is source-verified on Etherscan and on OKLink, the X Layer explorer.
Paxos and Paxos Labs materials, the vault code repository, and peer reviews of Paxos-issued assets record no security incident as of October 1, 2026.
3.2 Bug Bounty Program
Paxos Labs is launching a dedicated $500,000 bug bounty programme on Immunefi covering its products, PAXGy included, in October 2026. The deployed vault, accountant, and teller name security@paxoslabs.com as their security contact. Paxos, the issuer of PAXG, runs a separate bug bounty on Cantina paying up to $1,000,000 for a critical finding against a $2,000,000 annual cap, scoped to the PYUSD, PAXG, USDG and USDP contracts and Paxos cross-chain bridging.
3.3 Price Feed Risk
No Chainlink PAXGy/USD market price feed is deployed on Ethereum or X Layer, and no Proof-of-Reserve feed is wired into the deployment. A Chainlink PAXGy/Gold exchange-rate feed on Ethereum publishes once a day the value the accountant wrote the day before. The accountant publishes the rate in PAXG per share and counts each PAXG as one ounce of gold, and a Chainlink XAU/USD feed already prices gold-backed collateral on Aave, so the Correlated Asset Price Oracle (CAPO) adapter composing the two is suitable.
3.4 Dependency Risk
Underlying Asset and Custody
PAXGy holds a single asset. The teller accepts and pays out PAXG and no other token, so PAXG’s dependencies are PAXGy’s. PAXG is issued and custodied by Paxos Trust Company, National Association, a national trust bank supervised by the Office of the Comptroller of the Currency (OCC) (Paxos, Pax Gold). The Pax Gold whitepaper names Brink’s London bullion vaults as the storage venue and the metal as held in a segregated account outside the issuer’s estate. KPMG LLP examines reserves monthly, most recently for August 2026 (Paxos, Pax Gold attestations).
A single Paxos key can pause all PAXG transfers, freeze any address, and destroy the balance of a frozen address. The role administrator that grants those powers is a TimelockController with a 24-hour minimum delay.
Gold Lending Counterparties
Paxos Labs targets roughly 80% of the backing in secured gold lending facilities. Paxos Labs states that a loan leaves as PAXG, transferred from a Paxos qualified custody account under its control directly to the borrower, and that the claim on each loan, the PAXG delivered plus accrued interest, is held by PXL Bullion Corp. The vault holds no claim on the borrower, and no contract in the cluster records PXL Bullion Corp’s claim. Paxos Labs lends to four borrowers, unnamed under confidentiality provisions, with the following capacity at launch: a gold bullion retailer and wholesaler that turns the gold into bars, coins and scrap for sale or refining ($15 to 20 million), a gold leasing syndicator funding short-dated leases to wholesalers, jewellers and miners ($15 to 20 million), a gold bullion trading desk running physical arbitrage between wholesalers ($100 million), and a secured credit desk that posts the lent gold as collateral to raise cash under risk limits set by Paxos Labs’ underwriting team ($25 million).
Paxos Labs underwrites borrowers against an internal framework that rates each one on a five-tier scale, from CR1 for the strongest counterparties to CR5 for a borrower in default, and states that all initial borrowers are rated CR2 or better. The rating sets each borrower’s allocation tier and facility cap. Paxos Labs states that each loan carries either of two forms of security. The first is a pledge of the borrower’s gold or cash inventory, with advance rates set by purity and quality. The second is an account-control arrangement over the custody account that holds the lent gold, which lets Paxos Labs seize its contents by instructing the third-party custodian. For pledged loans, Paxos Labs verifies the eligible inventory before each drawdown so that the gold advanced is fully collateralised. PXL Bullion Corp is the named insured under Lloyd’s of London policies placed per borrower, each covering 100% of the value of the lent assets, and Paxos Labs states that the policies do not pay when a borrower defaults, so the insurance does not respond to a borrower failing to return the gold.
Paxos Labs targets at least 50% of the book redeemable within 7 days, holding 20% undeployed and 30 to 40% on a 7-day recall window at launch, through laddered loan terms and allocation to borrowers that can meet a 7-day recall. Recall terms differ by borrower. Paxos Labs states that no loan in the book runs longer than 30 days, and that one borrower’s facility can be called on 48 hours’ notice on any day, with 5 business days for the gold to settle. The recall period runs from the moment Paxos Labs calls the loan. If the borrower does not return the gold within the window, Paxos Labs can take control of the custody accounts and deliver the gold to itself, and the holder’s redemption order stays valid and is filled once the gold is back. Recalling a loan before its term costs neither the vault nor the redeeming holder.
Paxos Labs states that a loan in default is carried at face value until it determines a definite shortfall. Recovery depends on the borrower’s security, from repossession under an account-control agreement within 1 to 2 business days to a court process. A shortfall that Paxos Labs does not cover directly passes to all PAXGy holders pro rata through a lower exchange rate. On-chain, a lower rate can be published only after the timelock lowers the accountant’s floor, at least 24 hours after that change is scheduled, and a lower write before then pauses the accountant, which halts minting and redemption. All holders rank equally against the book, with no junior tranche absorbing a loss ahead of them.
Exchange-Rate Publication
The value Aave would price is computed off-chain. The accountant contract denominates the share in a placeholder token named “XAU stand in” and treats one PAXG as one ounce of that base, so the rate is PAXG per share, with each PAXG counted as one ounce. An authorised operator publishes the rate on-chain. The contracts cannot verify it against the underlying lending book. One externally owned account has written every update since September 19, 2026, about once a day, on Ethereum and on X Layer, which carries its own accountant at the same address and the same rate.
Paxos Labs states that the rate is set from three components: the PAXG in the vault, the loans outstanding, and PAXG in transit between custody and borrowers. A loan is valued at the PAXG delivered plus interest accrued daily at the loan rate. Interest is paid monthly, so the figure carries up to 30 days of accrued, unpaid interest. PAXG in transit, for 5 to 30 minutes per transfer, is counted at its quantity. Paxos Labs produces the borrower statements behind the loan value itself, daily, as application programming interface (API) output and PDF, and no third party verifies them. A late loan is not written down automatically. Paxos Labs assesses it manually and moves to its default process if it determines a default occurred, and an impaired loan goes straight to that process.
Redemption Mechanics
Primary redemption is closed to the public. Paxos Labs restricts direct minting and redemption to institutional liquidity providers, market makers, and exchange partners cleared under its know-your-business (KYB) checks, and adds each cleared address to a whitelist. On-chain, that whitelist holds 10 addresses on Ethereum. The vault held 190.70 PAXG on October 8, 2026 against 265.97 PAXG owed to holders at the standing rate, a liquid buffer of 71.7% against the 20% of assets Paxos Labs keeps liquid for same-day redemption. The queue settles orders in submission order with no per-order or per-day cap, and only the timelock can fill an order out of turn. Redemptions funded from that buffer settle the same day, and anything beyond it waits while deployed gold is recalled. Because the queue is open to the whitelisted addresses alone and stops while the accountant is paused, it supports the market price through whitelisted arbitrage and is not an exit for an Aave liquidator.
3.5 Bridge Risk
PAXGy carries one cross-chain route, a Chainlink CCIP lane between the Ethereum teller and the X Layer teller. Each teller holds the vault’s mint and burn role on its own chain, burns shares on a send and mints them on a receive, so no wrapped representation or escrow exists. Shares sent to X Layer net of shares returned match X Layer supply plus the shares in transit.
| Field |
Ethereum to X Layer and X Layer to Ethereum |
| Bridge stack |
Chainlink CCIP, OnRamp and OffRamp version 2.0.0 |
| Custody and mint mechanism |
burn and mint, teller holds the vault’s mint and burn role on each chain |
| Verifier set |
lane default committee verifier, resolved through a Chainlink-owned resolver contract |
| Threshold |
9 of 16 committee signers in each direction |
| Verifier pinning |
not pinned, the teller requires no specific verifier and accepts the lane default |
| Finality |
both tellers wait for source-chain finality |
| Rate limits |
6,843.38 PAXGy outbound and 6,843.38 PAXGy inbound on each teller, refilling over 24 hours |
Source: Etherscan and OKLink, October 1, 2026
The committee verifier is the CCIP default for the lane. The resolver that selects it is owned on each chain by a Chainlink RBACTimelock (Ethereum, X Layer) with a 3-hour minimum delay, during which a scheduled change can be cancelled. The same timelock carries an immediate bypass path that requires approval from three separate signer branches of a Chainlink ManyChainMultiSig, at least eight signatures in total. Adding a chain, changing a rate limit, or changing the finality setting is an owner action on each teller and passes through the 24-hour timelock on that chain. The rate limits match the depositor’s supply cap in size. Sending shares across the lane is open to any holder not on the freeze list. The route meets the four bridge standards of Aave’s revised risk framework: CCIP consensus, a verifier default held by Chainlink’s multi-party governance, native rate limits in both directions, and a 9-of-16 committee with no single-party verifier.
3.6 Technical Risk Summary
Strengths
- No contract in the cluster is upgradeable. The vault, the teller, the accountant, the manager, the withdraw queue, the depositor, the freeze hook, and both fee modules are direct deployments with both ERC-1967 slots empty on Ethereum and X Layer, so changing code requires deploying a replacement and repointing the cluster at it.
- A 24-hour TimelockController owns every contract on each chain, with the admin Safe as its only proposer and canceller. Hook replacement, fallback-hook installation, authority and ownership changes, mint and burn outside the teller, Merkle root changes, the accountant’s bounds, whitelist changes, fees, and bridge configuration are all visible on-chain at least 24 hours before they execute.
- A single rate write cannot move the price materially. The accountant rejects any write more than 0.04% above the standing rate and pauses instead of publishing on any write below it, with a minimum interval of 3,600 seconds between writes, and only the timelock can loosen those bounds.
- The cross-chain route runs on Chainlink CCIP with a 9-of-16 committee verifier in each direction, burns and mints without an escrow, and carries native rate limits on both directions of both tellers.
- PAXGy has a dedicated audit from Pashov Audit Group (March 2026) and a separate review of its CCIP teller (August 2026), with every high and medium-severity finding resolved. The withdraw queue, the freeze list, and the vault framework carry their own reviews by Pashov Audit Group, Zenith, 0xMacro and Spearbit.
Weaknesses
- The lending book is concentrated. Paxos Labs lends it to four borrowers, and the largest, a gold bullion trading desk, accounts for $100 million of the $155 million to $165 million of launch capacity and $500 million of the $900 million Paxos Labs expects in total. While unlikely for collateralised gold lending, a default by that borrower would mark down a large share of the vault in one step.
Recommendations
- Disclose a per-borrower allocation cap for the lending book and diversify the borrower set as capacity grows, so that no single borrower’s default can mark down a large share of the vault.
4. Counterparty Risk
4.1 Governance and Regulatory Risk
The legal review below is based on the issuer corpus and public records relevant to the asset. The corpus comprises the issuer’s fourteen due diligence responses and structure chart, the Aave V4 governance filing of 18 August 2026, and the public record for the Paxos group. The constitutional and structuring documents were supplied separately and have been reviewed; nothing in this record is cited from them.
PAXGy is described as an ERC-20 vault share:
“PAXGy is an ERC-20 token representing proportional economic exposure to a pool of gold assets through an appreciating exchange rate against PAXG.”
The Aave V4 filing of 18 August 2026 describes the same mechanism:
“PAXGy is a vault share token issued by Paxos Labs. Holders deposit PAXG into the vault and receive PAXGy in return. The vault is designed to generate a return on the deposited PAXG and to pass that return to holders by letting each PAXGy share redeem for a growing amount of PAXG over time.”
The return is generated by lending:
“PAXGy earns gold-denominated yield through institutional gold lending. Approximately 80% of assets are deployed into short-duration, secured, gold-denominated lending facilities extended to institutional counterparties; the remaining approximately 20% is held as an unencumbered PAXG liquidity reserve.”
and:
“Target net yield is approximately 3% per annum in gold terms. Yield is not distributed as a separate payment — it’s reflected in a rising PAXGy-to-PAXG exchange rate. Token balances stay fixed (PAXGy is non-rebasing); borrower interest accrues daily and is paid monthly in arrears and reflected via an onchain oracle, so each unit of PAXGy represents a growing claim on PAXG over time.”
The structure chart shows the vault splitting deposits two ways: an idle PAXG reserve “[h]eld within the vault as an unencumbered liquidity buffer for on-demand redemptions (target ~20% of TVL)”, and approximately 80% flowing to Paxos Labs Bullion Corp, which “[d]eploys into” secured gold lending facilities with “[i]nstitutional counterparties in the physical gold supply chain”.
The same chart labels the subscription arrow “Deposit PAXG or stablecoins”. Stablecoin subscriptions are not addressed anywhere else in the corpus: no conversion mechanic, pricing basis or reconciliation to the gold-denominated exchange rate is stated.
The token terms do not yet exist.
Entities and the licensing perimeter
The issuer response identifies two entities and states their regulatory position: “PAXGy’s structure spans two entities. Paxos Protocol Inc., incorporated in Panama, is the IP rights holder to the smart contracts that support PAXGy as a product. Paxos Labs Bullion Corp., incorporated in the Cayman Islands, is the lending entity—it acts as the lender of record under the gold lending facilities. None of these entities are themselves licensed or regulated (or required within their respective jurisdictions to perform the operations necessary to enable the creation of the product).”
Further, “Paxos Protocol Inc. issues the token”, and “Paxos Labs, Inc. builds and operates the smart contract infrastructure”.
No crypto-asset or virtual-asset service provider licensing regime has been in force in Panama.
Lending is outside the Virtual Asset (Service Providers) Act (2024 Revision) in Cayman Islands. Section 2(1) defines: “‘virtual asset service’ means the issuance of virtual assets or the business of providing one or more of the following services or operations for or on behalf of a natural or legal person or legal arrangement — (a) exchange between virtual assets and fiat currencies; (b) exchange between one or more other forms of convertible virtual assets; (c) transfer of virtual assets; (d) virtual asset custody service; or (e) participation in, and provision of, financial services related to a virtual asset issuance or the sale of a virtual asset;”
The opening words of the same definition are “the issuance of virtual assets”, and section 4(1) prohibits carrying on virtual asset service “in or from within the Islands” without registration. Act 4 of 2026 defines issuance as “the sale of newly created virtual assets to the public in or from within the Islands in exchange for fiat currency, other virtual assets or other consideration”. Issuer’s response addresses the Cayman entity only as a lender while the issuance is conducted by the Panama-incorporated entity.
4.2 Access Control Risk
4.2.1 Ownership and Modification Paths
A TimelockController with a 24-hour minimum delay is the owner of the vault, the teller, the accountant, the manager, the withdraw queue, the depositor, the freeze hook, both roles registries, and both live fee modules on Ethereum. The admin Safe is the timelock’s only proposer and only canceller, and its five signers and the Safe can execute a ready operation. The timelock is its own administrator, so a change to its delay or its roles is itself a timelocked operation. X Layer mirrors the arrangement with a second 24-hour TimelockController owning the X Layer contracts, and a second Safe with the same five signers and threshold as its proposer and canceller.
| Surface |
Ethereum |
X Layer |
| Deployment pattern |
direct deployment, no proxy, ERC-1967 slots zero |
direct deployment, no proxy, ERC-1967 slots zero |
| Owner (every contract) |
0x0DcC87BC40E775A8207eB2e65b68CF51964cdf08 |
0x35b979C55c331767E62EAa69fdce3FB7d8B1D38F |
| Timelock minimum delay |
86,400 seconds |
86,400 seconds |
| Proposer and canceller |
0x0000000000417626Ef34D62C4DC189b021603f2F |
0xd4cbD7a1B1cc869Ea34068DFeC2A15a1fD65EEC5 |
| Multisig flavour and threshold |
Safe 1.3.0, 3 of 5, no module, no guard |
Safe 1.4.1, 3 of 5, no module, no guard |
| Ownership renunciation |
not exposed, ownership moves by transferOwnership under the owner check |
not exposed |
Source: Etherscan and OKLink, October 1, 2026
The same five addresses sign both Safes:
Because no contract is upgradeable, code changes require a redeployment and a repointing of the cluster, and repointing runs through the timelock. The vault carries three owner-only setters that change behaviour without a redeployment. It can be renamed and re-symbolled, its transfer hook can be replaced with any contract, and a fallback hook can be installed that answers every selector the vault does not already implement. No fallback hook is installed. Each of these, along with the accountant’s rate bounds, unpausing the accountant, whitelist changes, Merkle root changes, fee changes, and bridge configuration, takes at least 24 hours from a publicly visible scheduling transaction. Since the timelock took ownership on September 21, 2026, four operations have run through it, each at the full delay: setting the redemption fee, setting the withdraw queue’s recovery address, and two whitelist additions.
Outside the timelock, the Safe holds the exchange-rate write and the pause role directly, and owns the shared Pauser contract, which holds the pause role and has no PAXGy contract registered on it. A single operator key holds the freeze-list role on the hook’s own roles registry on both chains, and the strategists, rate updater, pause holder, and order processor also act outside it.
4.2.2 Permissioned Functions
Authorisation runs through a roles registry, deployed at the same address on both chains, that grants an address one function selector on one target at a time. The owner, the timelock, is authorised for every gated selector without holding a role.
| Function |
Contract |
Caller |
Modifier |
| manageVaultWithMerkleVerification |
Manager |
strategists 0x40617CF21a5d4ecae4f7a6656f85bcCaA760672a, 0xf5c62c8E997156466B82Ec3Ee6a63Cc601BBF8FF, 0x50E87E017C749eBD46C0C5CD3d5A97BB1f46e2bB |
requiresAuth (role 1) |
| manage |
Vault |
Manager 0x353741aBa79974a90F88594f6CBd1a9c54651015 |
requiresAuth (role 2) |
| enter (mint), exit (burn) |
Vault |
Teller 0x41AB5d8387e60E30AACCF11357C306f6d875A6f7 |
requiresAuth (role 3) |
| updateExchangeRate |
Accountant |
Safe, and rate updater 0x1755397BEc366a1e1160d8aE0106C60E7e344B56 |
requiresAuth (role 4) |
| bulkWithdraw |
Teller |
WithdrawQueue 0x69e0BF658bE5600864A946b4e5B911736D248FB4 |
requiresAuth (role 5) |
| pause |
Teller, Accountant, Manager |
Safe, pause holder 0xe5CcB29Cb9C886da329098A184302E2D5Ff0cD9E, and Pauser 0x07F99eF00C778d5D30e86C2EDB15E69e8763D5f7 |
requiresAuth (role 6) |
| deposit |
Teller |
Depositor 0xF6dE922D08cF9Ee4e7cE25ca1f3936EC1AA1f62C |
requiresAuth (role 7) |
| processOrders |
WithdrawQueue |
operator 0xaA0e7f8b3bf12e48b0ff4AB7D30B5f8dDf263372 |
requiresAuth (role 9) |
| deposit, depositWithPermit |
Depositor |
ten whitelisted addresses |
requiresAuth (role 12) |
| submitOrder |
WithdrawQueue |
ten whitelisted addresses |
requiresAuth (role 12) |
| depositAndBridge |
Teller |
ten whitelisted addresses |
requiresAuth (role 12) |
| setFreezeList |
Hook |
operator 0x363c256D368277BBFaf6EaF65beE123a7AdbA464 |
requiresAuth (role 10, hook registry) |
| unpause, updateLower, updateUpper, updateDelay |
Accountant |
Timelock only |
requiresAuth (no role granted) |
| setBeforeTransferHook, setFallbackHook, setNameAndSymbol, setAuthority, transferOwnership |
Vault |
Timelock only |
requiresAuth (no role granted) |
| setManageRoot, forceProcess, setUserRole, setRoleCapability |
Manager, WithdrawQueue, roles registries |
Timelock only |
requiresAuth (no role granted) |
| bridge |
Teller |
anyone |
public capability |
Source: Etherscan, October 1, 2026
The strategists, the rate updater, the pause holder, the order processor, and the freeze-list operator are externally owned accounts, each acting on a single signature. The order processor cannot reorder the queue, but it chooses when to process it and therefore the rate at which each order settles. Of the three strategists, only one carries a non-zero Merkle root. On X Layer the registry grants the rate write to the X Layer Safe and the same rate updater, the pause role to the same pause holder and the X Layer Safe, and the mint and burn role to the teller. No strategist, processor, or whitelisted address holds a role on X Layer among the Ethereum role holders and admin addresses checked there, and X Layer has no deposit asset or redemption path in use. Unlike Ethereum, the depositor’s deposit functions are a public capability on X Layer, and the X Layer teller does not accept PAXG.
4.2.3 Transfer Semantics
PAXGy deducts no fee on transfer, and no contract in the cluster exposes a setter that could introduce one. The token does not rebase. Balances change only through the role-gated mint and burn paths, and the return sits in the accountant’s exchange rate. Transfers are gated by a freeze list that reverts a transfer whose sender, recipient, or calling contract is listed, and applies the same test on the withdraw, bridge-send, and bridge-receive paths. It holds 124 addresses on each chain.
4.2.4 Issuer Powers and Aave Exposure
A frozen Aave hub address reverts every movement of PAXGy into or out of the hub, so suppliers cannot withdraw their collateral and a liquidator cannot take the underlying, while liquidations settled in spoke shares continue to work. Freezing a single supplier’s address blocks that supplier’s own withdrawal without blocking a liquidation against them, because the seizure moves tokens from the hub to the liquidator and touches neither the borrower’s address nor the borrower as caller. A pause of the accountant stops every mint and every redemption, because the teller prices both through the accountant’s pause-reverting rate read, and only the timelock can lift it, through an operation scheduled at least 24 hours before it executes.
The balance-moving powers over the vault sit behind the timelock. Only the timelock can mint shares against no deposit, burn shares from any holder including the Aave hub, or change the Merkle root that bounds the manager’s calls against the vault’s gold. Each of these is visible on-chain at least 24 hours before it can execute, and none carries an amount limit or a rate limit once executed. Bridge mints carry the lane’s 6,843.38 PAXGy daily limit in each direction. The exchange-rate write outside the timelock is bounded at 0.04% per hour, about 0.96% a day. Removing the rate updater’s role is itself a timelocked operation, so the immediate response to a compromised updater key is a pause by the pause holder or the Safe. Paxos Labs has disclosed the signer set of both Safes to LlamaRisk, and we deem it in line with the requirements of the Aave Risk Framework.
5. PAXG Borrowability
The recommended parameters make PAXG borrowable on the Global Dollar Hub for the first time, lent through the Gold Correlated Spoke against PAXGy under a rate model that charges 3% at 60% utilisation, with a 400 PAXG Draw Cap. One address supplies nearly three quarters of hub PAXG.
5.1 Borrowability on the Hub
The hub holds 599.33 PAXG, all supplied as collateral on the Gold Spoke. None of it is drawn, because no spoke carries a PAXG draw cap. The hub applies a placeholder rate model to PAXG that charges 0% at any utilisation, with no liquidity fee, and no PAXGy spoke exists on the hub yet. The Gold Correlated Spoke and the recommended PAXG rate model are therefore the first borrow configuration PAXG receives.
5.2 Liquidity and Minting
A Gold Correlated Spoke liquidator repays PAXG debt and so has to acquire PAXG.
| Size |
Best route from USDC |
Best route from USDG |
| $500,000 |
+0.48% |
+0.49% |
| $1,000,000 |
+0.98% |
+0.91% |
| $2,000,000 |
+1.80% |
+1.82% |
Source: KyberSwap and 0x, October 9, 2026
The 400 PAXG Draw Cap is $1.67 million at the gold price, between the $1 million and $2 million sizes. The PAXG leg routes through Uniswap V3 and V4 pools, Fluid, and request-for-quote market makers.
Apart from buying on-chain, a liquidator can acquire PAXG by minting it. New PAXG comes from Paxos, which sells it to holders of a Paxos account with near-instant settlement. On-chain, minting runs through a supply-control contract whose rate-limited minters Paxos appoints, and the largest, with a 177,000 PAXG capacity, can mint only to the Paxos platform wallet. A liquidator cannot mint PAXG inside the transaction that repays a loop, so minting can’t fund an atomic liquidation. A liquidator or market maker with a Paxos account can buy PAXG at the gold price ahead of time and hold it for repayment, and the same route lets arbitrageurs sell PAXG above gold.
5.3 Pricing PAXG Debt
The Gold Correlated Spoke prices PAXG debt at Chainlink XAU/USD and prices PAXGy collateral at the same feed times the accountant’s rate.
| Window |
Median |
P95 |
P99 |
Max |
Days above +1.00% |
| All, 664 days |
+0.11% |
+0.82% |
+1.33% |
+2.68% |
20 |
| Trailing 180 days |
−0.16% |
+0.28% |
+0.45% |
+0.57% |
0 |
| Trailing 90 days |
−0.13% |
+0.35% |
+0.47% |
+0.57% |
0 |
Source: Chainlink PAXG/USD and Chainlink XAU/USD, daily reads from December 7, 2024 to October 1, 2026
PAXG’s premium to gold, measured as the Chainlink PAXG/USD price over Chainlink XAU/USD, reached its maximum of 2.68% on February 28, 2026. The longest run above 1.00% lasted two days, and several of the 20 days fell on weekends, when the gold feed holds its last market price while PAXG trades. On October 9, 2026 the premium was 0.04%.
The Gold Correlated Spoke pays a 4.00% bonus at any health factor below 1, and the liquidator keeps 3.60% of it after the 10% liquidation fee. Buying $2 million of PAXG cost 1.8% over gold on October 9, 2026, at a near-zero premium. Adding the 0.82% P95 premium brings the total to 2.6%, and adding the 1.33% P99 premium brings it to 3.1%, both below 3.60%. The 2.68% maximum premium with the same purchase cost exceeds it. The liquidator receives PAXGy and returns to PAXG through the Ethereum PAXGy/PAXG pool, whose depth rests on the $2 million Paxos Labs committed.
5.4 Suppliers and Utilisation
PAXG on the Gold Spoke comes from 24 addresses, each with PAXG enabled as collateral. The largest supplier, an externally owned account, holds 442.96 PAXG, or 73.91%, and the 10 largest hold 99.17%.
The rate model’s kink sits at 60% utilisation, 359.60 PAXG at current hub supply. The 400 PAXG Draw Cap is 66.74% of current hub supply, so a full draw leaves 199.33 PAXG undrawn. Hub PAXG is not bounded by the Gold Spoke’s 2,500 PAXG add cap, because another spoke registered for PAXG carries an unlimited add cap, though it holds no PAXG. At the 60% kink, borrowers pay 3% and suppliers earn 0.9% after the 50% liquidity fee. At a full draw, borrowers pay 6.37%, above PAXGy’s 3% yield, so a loop stops paying before the Draw Cap is reached.
Drawn PAXG cannot be withdrawn. At a full draw on current supply, Gold Spoke suppliers can withdraw at most 199.33 PAXG between them, less than half the largest supplier’s position. A liquidator seizing PAXG on the Gold Spoke draws on the same liquidity. Where the hub has too little, the Gold Spoke lets the liquidator take spoke shares, which it can withdraw once liquidity returns. Above 60% utilisation the borrow rate climbs by a further 20 percentage points, reaching 23% at full utilisation.
5.5 PAXG Controls
PAXG is an upgradeable proxy. Its upgrade admin is a timelock contract with a 24-hour minimum delay, and its role administrator is a second timelock contract with a 24-hour delay and a 3-hour delay on any transfer of the admin role. A single Paxos key holds the pause role and the asset-protection role, which act instantly. Reassigning either role goes through the 24-hour timelock.
For a borrowed asset, freezing the hub’s address blocks every PAXG transfer to or from it, which stops draws, repayments, withdrawals and liquidation repayments in PAXG. Wiping a frozen hub burns the hub’s PAXG balance while the hub’s accounting still records it. A pause stops every PAXG transfer, so no PAXG debt can be drawn, repaid or liquidated until it is lifted. On October 9, 2026 PAXG was not paused and neither the hub nor the Gold Spoke was frozen. PAXG has been paused once, on August 26, 2019, and Paxos has wiped the balances of 10 frozen addresses since 2019.
5.6 Demand and Sizing
On October 9, 2026, 269.73 PAXGy were outstanding across both chains, against an Add Cap of 480 PAXGy on the Gold Correlated Spoke. At the 85% collateral factor and the 1.0017 exchange rate, a full Add Cap supports about 409 PAXG of borrowing, and the 400 PAXG Draw Cap sits just below it.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
