Paxos Gold (PAXG) on Aave Ethereum Assessments

[LlamaRisk]

1. Asset Fundamental Characteristics

1.1 Asset

Pax Gold (PAXG) is an ERC-20 token issued by Paxos Trust Company, National Association, a national trust bank supervised by the Office of the Comptroller of the Currency (OCC), that represents title to physical gold. Each token corresponds to one troy ounce of a London Good Delivery bar held in vaults accredited by the London Bullion Market Association (LBMA), with individual bars allocated to holders by serial number through an off-chain registry Paxos exposes via a public lookup tool (Paxos, Pax Gold). The token launched in September 2019 and carries 18-decimal precision. It is non-rebasing and accrues no yield: its value tracks the spot gold price and supply expands only when Paxos vaults additional metal (Pax Gold whitepaper). Circulating supply stands at roughly 441,900 PAXG, matching the same number of troy ounces held under custody. Redemption for USD, unallocated gold, or physical bars is available directly through Paxos.

1.2 Architecture

Pax Gold is an upgradeable ERC-20 token. The address holders and integrators interact with, 0x45804880De22913dAFE09f4980848ECE6EcbAf78, is a ZeppelinOS AdminUpgradeabilityProxy. The proxy holds all token state and delegates every logic call to a separate implementation contract, so an upgrade replaces behaviour without migrating balances. The current implementation is 0x7Da4C5d9EcA180A03765a6d27196F2A0380Fa543, verified on Etherscan and drawn from the shared PaxosTokenV2 codebase that also backs Paxos-issued USDG and PYUSD.

The implementation follows standard token conventions: ERC-20 with 18-decimal precision and signed-message support through EIP-2612 permit for gasless approvals alongside the full EIP-3009 set, transferWithAuthorization, receiveWithAuthorization and cancelAuthorization, for gasless transfers. The delegated-transfer path of the pre-2026 contract is gone: betaDelegatedTransfer, its batch variant and the relayer whitelist are all absent from the deployed runtime. Signature recovery routes through OpenZeppelin’s SignatureChecker, which rejects malleable signatures and accepts EIP-1271 contract signatures. None of these paths touch pool accounting. The same codebase exposes permissioned supply-control and asset-protection functions, covering mint, burn, and the freeze or wipe of a sanctioned balance. Minting and redemption themselves run off-chain through Paxos, so circulating supply reflects gold Paxos has vaulted, with individual bar allocation tracked in an off-chain registry.

Upgrade authority is the principal architectural risk surface, because control of the proxy admin slot governs which implementation the token runs. That authority sits with the proxy admin address 0xc94bcf6e1d8b3558e3b62e743630d50497e3851c.

1.2.1 Cross-chain Deployments and Bridge Scope

PAXG is natively issued by Paxos on Ethereum mainnet and additionally exists as a native Token-2022 mint on Solana, bridged through a Paxos-deployed LayerZero OFT route surfaced via the Stargate interface. The union of deployments is the unit of assessment, so the Solana route is in scope as a bridge dependency even though the Solana leg itself is non-EVM and outside the Aave listing.

Source: Etherscan and Solscan, August 7, 2026

Chain	Token address	Bridge stack
Ethereum	0x45804880De22913dAFE09f4980848ECE6EcbAf78	native (Paxos issuance)
Solana	5GgRAEmv8ZxF2PR5hY72Qs5x1bnQ6UK2RbTPoqJ3wSwW	LayerZero OFT, Paxos-deployed adapter 0xd09ede557ef195983c9544a5724046fbd6e8a3c6 (Stargate interface), launched June 2026

The Solana OFT program is immutable with its upgrade authority burned, while the Ethereum token runs behind an upgradeable proxy under an untimelocked admin key. The mint authority is a 1-of-4 Solana Program Library (SPL) multisig whose signers are the OFT store and three Paxos-held keys, and the freeze authority, permanent delegate, and transfer-fee authority all resolve to a single Paxos system account. The permanent delegate is the Solana analog of the Ethereum wipe power, and the transfer-fee extension sits at 0 basis points with its authority live, so a fee could be reintroduced on Solana even though the Ethereum implementation removed one. Solana supply is minted through the burn-and-mint bridge route rather than issued directly by Paxos vaulting metal against it, so the Solana float is a claim on the same Ethereum-side reserve.

An older Wormhole-wrapped Solana representation (C6oFsE8nXRDThzrMEQ5SxaNFGKoyyfWDDVPw37JKvPTe) also circulates but is not native Paxos issuance, and dust-scale legacy wrappers persist on Harmony and BSC.

1.3 Tokenomics

Circulating supply mirrors the gold Paxos holds on deposit. Each PAXG is minted only after Paxos vaults a troy ounce of London Good Delivery gold and is burned when a holder redeems, so the token count tracks metal under custody rather than any algorithmic issuance schedule. The token carries no hard cap, and supply expands with demand as Paxos vaults additional bars, a path with no vesting or unlock schedule. Outstanding tokens correspond one-to-one with the troy ounces reported in the monthly reserve attestation, currently signed by KPMG LLP and previously by WithumSmith+Brown (Paxos, PAXG transparency). The most recent published KPMG report reconciles exactly: 452,355 troy ounces in reserve against 452,355 PAXG outstanding, one-to-one with no surplus or deficit and no restricted or time-locked tokens.

Paxos earns revenue from PAXG through creation and redemption fees. That mint-and-redeem fee is tiered by transaction size. The roughly 0.02% on-chain transfer fee levied under the original contract has been removed in the current PaxosTokenV2 implementation, so on-chain transfers now carry no protocol-level deduction. Paxos charges no storage fee at present but reserves the right to introduce one applied pro rata to all holders (Pax Gold whitepaper). Because PAXG represents allocated gold and pays no yield, holders bear the opportunity cost of idle metal and any future custody charge.

Source: Etherscan, August 2026

1.3.1 Token Holder Concentration

The top holder controls 18.58% of supply, top-5 controls 27%, and top-10 controls 33%. Etherscan records 85,813 PAXG holders, with the hundred largest addresses jointly holding 56.40% of supply, or 246,056 PAXG, and 44% of the float sitting outside them. LlamaRisk reviewed the wallet composition and found no material issuer overhang within it. The balances in question are on the order of 1% of supply, immaterial against the exchange-held float above. The largest PAXG holder is a Binance exchange wallet, and six of the ten largest are exchange or issuer wallets tagged by Etherscan, two Binance, two Kraken and two Paxos issuance addresses, so a substantial share of the concentrated float sits in omnibus custody rather than a single controlling counterparty.

2. Market Risk

2.1 Liquidity

Current depth implies roughly 2.64% slippage for selling 2,100 PAXG (~$9.13M) into USDG. Against a market capitalisation near $1.85 billion, a $9 million sale is a small fraction of outstanding supply and clears at a price impact a plausible liquidation bonus would tolerate.

Source: LlamaSwap, August 10, 2026

2.1.1 Liquidity Venue Concentration

GeckoTerminal indexes roughly $31.9 million of on-chain PAXG liquidity across 20 pools. The dominant venue is the Uniswap V2 PAXG/WETH pool at $13.75 million, 43.0% of indexed TVL, followed by a cluster of PAXG/XAUt gold-to-gold pools.

Source: GeckoTerminal, August 10, 2026

The saturation point is located between $9.1 million and $13.0 million, which means selling more PAXG stops costing incrementally more and starts costing disproportionately more.

Source: LlamaSwap, August 10, 2026

A $9.1 million sale has 2.64% impact, inside a plausible commodity liquidation band, while $13.0 million has 10.42% as the router exhausts the core venues and reaches for tail liquidity.

2.1.2 DEX LP Concentration

PAXG liquidity on Ethereum is heavily concentrated in its largest pool, where most of the liquidity comes from a single anonymous externally owned account rather than from the issuer or a protocol treasury. This concentration raises the likelihood of an abrupt liquidity withdrawal, as unaligned liquidity carries no commitment to the venue, and that one address alone accounts for roughly a third of all indexed on-chain depth. Below is the breakdown for the 5 largest pools by TVL on Ethereum:

• Uniswap V2 PAXG/WETH ($13.75M TVL, 43.0%): An externally owned account is the top supplier with 78.31% share of the pool’s liquidity, and the two largest together supply 97.46%.
• Uniswap V3 PAXG/XAUt 0.01% ($6.02M TVL, 18.8%): The top supplier holds 11.37% share of the pool’s liquidity, and no owner exceeds 12% across 176 live positions.
• Uniswap V3 PAXG/XAUt 0.05% ($3.27M TVL, 10.2%): The top supplier holds 67.72% share of the pool’s liquidity across 227 live positions.
• Fluid PAXG/XAUt ($2.17M TVL, 6.8%): Liquidity-provider distribution is not readable through the automated scan, so this venue is unassessed.
• Uniswap V3 PAXG/USDC 0.05% ($2.06M TVL, 6.4%): The top supplier is a contract with 11.25% share of the pool’s liquidity across 300 live positions.

The dominant pool rests on one liquidity provider, and the second gold-to-gold pool is two-thirds held by a single supplier, while the deepest gold-to-gold pool and the largest USDC pool are broadly distributed with no owner above 12%.

2.2 Volatility

Source: Chainlink, August 6, 2026

The volatility that matters for PAXG is its gap to gold spot rather than any dollar peg, measured as the Chainlink PAXG/USD feed against the Chainlink XAU/USD feed. The basis is tight, with a median of +0.08%, 97.7% of days inside ±1%, and annualized realized volatility of 26.1% against the reference feed’s own 26.7%, so the token imports the metal’s volatility and adds little of its own. The daily extremes are a 2.00% premium and a 1.05% discount, and the median sits on the premium side, so pricing PAXG at gold spot is conservative more often than not. Weekend staleness is the channel that carries what tail there is, since the gold reference holds its last on-market print flat through closed hours while PAXG continues to trade, and the creation and redemption friction described in §3.4 slows the arbitrage that closes the gap.

2.3 Exchanges

PAXG trades actively across centralised venues, with the top-20 markets by 24-hour volume turning over roughly $108 million. Volume concentrates on the three largest books, GroveX, LBank and Binance, which together carry about $48 million or 51% of the tabled total, all quoted against USDT. The biggest on-chain venues are the Uniswap V3 PAXG/XAUt and PAXG/USDC pairs, appearing at rank 10 with roughly $2 million and $1.6 million of daily volume and wider spreads than the centralised books. The dollar-exit depth is thinner than gross trading volume implies, since most of that volume turns over on exchange-internal USDT books that a liquidation cannot clear atomically.

Source: CoinGecko, August 10, 2026

2.4 Growth

Source: Etherscan, August 8, 2026

PAXG supply has grown from roughly 400 tokens at its September 2019 launch to 441,921 PAXG at the current reading. Growth was steady through 2024 and 2025, and supply peaked near 514,000 PAXG in April 2026 before contracting about 14% as the gold rally at that time prompted net redemptions, a decline the June 30, 2026 attestation snapshot of 452,355 PAXG sits inside. The outstanding float now corresponds to a market capitalisation near $1.88 billion at the August 5, 2026 gold print.

3. Technological Risk

3.1 Smart Contract Risk

PAXG has been audited across three generations of its codebase. The base Paxos Standard token was reviewed before launch in 2018, and the gold-specific functions were examined in 2019. The current implementation, PaxosTokenV2 at 0x7Da4C5d9EcA180A03765a6d27196F2A0380Fa543 and shared with USDG and PYUSD, carries its own reviews from 2024 to 2026. This is a delta from the prior assessment, which recorded that the implementation had never changed since deployment; the upgrade to PaxosTokenV2 is now the audited production code. Paxos publishes no consolidated audits page (paxos.com/audits returns 404), so the GitHub repositories are the authoritative index.

• Nomic Labs, ChainSecurity, and Trail of Bits (2018): base Paxos Standard token. No severe findings, all issues resolved per the LlamaRisk prior review. ChainSecurity, Nomic Labs, Trail of Bits.
• ChainSecurity and CertiK (2019): PAXG V1 gold functions, CertiK including formal verification. No severe findings, all resolved per the prior review. ChainSecurity, CertiK.
• Zellic (November 7, 2024): the full shared codebase, covering PaxosTokenV2, SupplyControl, EIP-2612, EIP-3009 and the rate limiter. One Critical, two Informational, nothing between. The Critical, “Frozen tokens available for cross-chain transfer”, found that decreaseSupplyFromAddress did not check the frozen flag, so a frozen balance could be bridged out. It was fixed before deployment and the frozen-address guard is present in the deployed source. This is the review that covers PAXG’s production code path.
• Trail of Bits (November 7, 2024): the LayerZero cross-chain integration. Four Low and seven Informational, no High or Medium.
• Zellic (December 15, 2025): signature-validation hardening, replacing the in-house EIP-712 recovery with OpenZeppelin SignatureChecker and adding EIP-1271 support.
• Zellic PAXG V2 (April 20, 2026): a patch review of the cross-chain upgrade rather than a full audit, scoped to storage-migration layout and frozen-balance semantics across two pull requests, at 1.5 person-days. One Informational, nothing higher.
• Halborn (engagement October 17 to November 3, 2025): the USDG rewards and payout-group contracts, which PAXG does not execute. One High, three Medium, three Low and one Informational, all marked solved.

3.2 Bug bounty program

Paxos runs an active bug bounty program hosted on Cantina, paying up to $1,000,000 for critical-severity findings against an annual cap of $2,000,000 (Cantina program page). Smart contracts deployed on mainnet and actively used in a Paxos product are in scope, and PAXG is named explicitly alongside PYUSD, USDG, USDP, and the cross-chain bridging infrastructure (Paxos announcement). The program launched March 27, 2026, initially open only to researchers already active in the Cantina network, though the live program page now invites any researcher to sign in and join.

3.3 Price Feed Risk

Chainlink has a token-specific PAXG/USD feed live on Ethereum mainnet since December 6, 2024, with a deviation threshold of 0.5% and a heartbeat of 86400 seconds. It is a production push feed carrying Chainlink’s Low Market Risk classification. No Proof-of-Reserve feed is wired against the Paxos gold reserve. The deeper, TradFi XAU/USD feed also exists on Ethereum, carries the same Low Market Risk classification with a 0.3% deviation threshold and the same 86400-second heartbeat, and already serves as the live price source for gold-backed collateral on Aave.

Pricing against the underlying commodity values PAXG at full gold spot even when the token trades at a discount. The basis parameters are as follows:

Median basis	Days inside ±1%	Daily extremes	Observations
+0.08%	97.7%	-1.05% / +2.00%	470

A CAPO (Correlated Asset Price Oracle) growth-ceiling wrapper is not recommended, as PAXG carries no yield accrual and no monotonic exchange-rate growth for a cap to bound. Given the depth and maturity of the XAU/USD aggregator, that feed can be considered suitable for pricing PAXG on Aave.

3.4 Dependency Risk

Off-chain Operational Infrastructure

PAXG’s integrity rests on Paxos Trust Company, National Association, a national bank limited to trust-company operations and supervised by the Office of the Comptroller of the Currency (OCC). Paxos Trust Company, LLC held a New York limited-purpose trust charter from the New York State Department of Financial Services (NYDFS) from 2015 until December 12, 2025, when it converted to a national trust bank under the OCC’s conditional approval (OCC news release, December 2025). That release records the approval rather than its consummation. The conversion completed: the OCC’s roster of trust banks active as at June 30, 2026 lists Paxos Trust Company, National Association under charter number 25379, the entity no longer appears on the NYDFS virtual-currency licensee list, and the June 30, 2026 KPMG examination report is addressed to the National Association entity. Each token maps to a specific allocated London Good Delivery bar through an off-chain registry that holders can query by serial number, weight, and purity at paxg.com. The link between physical reserves and circulating supply is a reconciliation Paxos performs off-chain, not a property the contract enforces, so a lag or misstatement between vault inventory and on-chain supply would surface through the monthly reserve attestation, performed by WithumSmith+Brown, PC through February 2025 and by KPMG LLP from February 28, 2025. The most recent quantified reconciliation shows 452,355 fine troy ounces against 452,355 PAXG redeemable tokens outstanding with no surplus or deficit and no timing differences. Mint and redeem pricing draws from a StoneX direct feed of London gold pricing, a single off-chain reference the issuer controls.

London Bullion Market

PAXG tracks the price of physical gold, which ties it to the health and accessibility of the wholesale gold market administered by the London Bullion Market Association (LBMA). Paxos sources bars from StoneX (formerly INTL FCStone), and both the redemption and pricing legs reference Loco London settlement. That market closes on weekends and holidays, so the price reference is discontinuous in a way a dollar reference is not.

Custodial and Physical Asset Risks

Brink’s Global Services Ltd and Industrial and Commercial Bank of China (ICBC) Standard Bank are the vault providers, both LBMA-approved, and Paxos names StoneX Group Inc. as the source of the metal. The Pax Gold whitepaper additionally lists HSBC. The gold sits under Paxos Trust Company custody in a bankruptcy-remote structure that segregates customer gold from Paxos corporate assets, an obligation that runs to the OCC. The vault providers maintain insurance against loss in storage and transit.

Redemption Mechanics

Primary redemption is gated to onboarded Paxos customers. Institutional customers can redeem for unallocated Loco London gold, and all account holders can redeem for allocated bars or for USD at market price, with zero storage fees and zero on-chain transfer fees and settlement quoted as near-instantaneous alongside a T+2 option (Paxos PAX Gold). Paxos reserves suspension and eligibility rights under its general terms. Non-customers, which includes most DeFi liquidators and arbitrageurs, have no primary-redemption access and exit only through the DEXs. The stress case for a commodity token is a basis dislocation rather than a peg break. When PAXG trades below gold spot, the arbitrage that closes the gap is redemption at reserve value, but only KYC-onboarded customers can execute it and the fiat and physical legs do not settle instantly, so under stress the correction runs through onboarded desks and the on-chain basis quantified in §2.2 rather than through open liquidator arbitrage. The disclosed schedule below prices that correction: an onboarded desk redeeming at size pays roughly 0.125%, rising to 1.00% for small redemptions, so the primary-arbitrage cost floor that bounds a PAXG-below-spot dislocation is about 0.125% for the participants who can access it.

Paxos disclosed the live fee schedule. The creation minimum is 0.03 PAXG and creation fees are currently zero. Redemption is tiered by size: 0.02 PAXG flat from 0.03 to 2 PAXG, 1.00% from 2 to 25, 0.75% from 25 to 50, 0.50% from 50 to 75, 0.25% from 75 to 200, 0.15% from 200 to 800, and 0.125% above 800 PAXG. Two caveats remain. Off-chain primary-market pricing is not verifiable on-chain, and the schedule is stated as current rather than contractual, so whether Paxos can change it unilaterally is an open follow-up.

3.5 Bridge Risk

PAXG carries one live cross-chain route that matters to this listing, plus a tail of legacy representations. The native Solana deployment launched in June 2026 as a Token-2022 mint at 5GgRAEmv8ZxF2PR5hY72Qs5x1bnQ6UK2RbTPoqJ3wSwW, served by a Paxos-deployed LayerZero Omnichain Fungible Token (OFT) route surfaced through the Stargate bridge interface. The Ethereum-side adapter at 0xd09ede557ef195983c9544a5724046fbd6e8a3c6 appears in LayerZero’s deployment registry and is verified on Etherscan as an ERC1967 proxy over the OFTWrapperUpgradeable implementation at 0xc54ca36efe594e4c774ba8463adf67ba3de1236f. The function token() resolves to PAXG, the endpoint is the canonical LayerZero V2 endpoint, and the registered peer for the Solana lane decodes to the OFT store CdxPHbQjNbxyaDBjA92Bbka3YFC9t3JVyQ2cA1mSbNBR that owns the mint’s escrow account. A classic Solana Program Library (SPL) token at 8YodUvAZaDwSkD3tLdAWBM39wF3DZNQ9GqBWHTBnYMW3 also carries the PAXG symbol but is not Paxos issuance.

The Ethereum leg is burn-and-mint rather than lock-and-release. The adapter source credits inbound transfers through increaseSupplyToAddress and debits outbound ones through decreaseSupplyFromAddress, holds no PAXG itself, and carries SUPPLY_CONTROLLER_ROLE on the SupplyControl contract at 0xbe62dB8ed4838e10e1318593aC9e3eb9ccFb2dC7. Anyone who compromises the Solana side or the verifier set can therefore mint unbacked PAXG on Ethereum.

Two limits bound that scenario. The adapter enforces a native LayerZero rate limit of 4,440 PAXG per 86,400-second window in each direction, and SupplyControl caps the adapter as a supply controller at 13,320 PAXG, refilling at 0.155 PAXG per second for a full refill in about a day. Worst case is therefore 4,440 PAXG a day, roughly 1.0% of supply, and both limits live on Ethereum. Paxos also registered the adapter with allowAnyMintAndBurnAddress, which lifts the destination whitelist without touching either amount.

Neither limit protects if Paxos itself is compromised. The admin and roles key at 0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B holds SUPPLY_CONTROLLER_MANAGER_ROLE and DEFAULT_ADMIN_ROLE on SupplyControl, owns the adapter, and is the LayerZero configuration delegate. It can raise either limit, replace the gatekeeper contract, or switch the SupplyControl limiter off by writing a refill rate of zero, which RateLimit treats as no limit rather than as no flow. Each is one transaction with no timelock.

Three Decentralized Verifier Networks (DVNs) are required with no optional set, LayerZero Labs, Canary and a Paxos-branded DVN, and all three must verify every message, so one compromised DVN cannot forge. Send and receive libraries are pinned rather than default, so an endpoint-level upgrade cannot silently change message handling. The same admin key is the configuration delegate, so that set can be rewired without delay.

On the Solana side the OFT program paxosVkYuJBKUQoZGAidRA47Qt4uidqG5fAt5kmr1nR is immutable with its upgrade authority burned. The mint authority is a 1-of-4 SPL multisig whose signers are the OFT store and three Paxos-held keys, while the freeze authority, permanent delegate and transfer-fee authority all resolve to a single Paxos account. The permanent delegate is the Solana analog of the Ethereum wipe. The transfer-fee extension sits at zero basis points with its authority live, so a fee could be reintroduced there even though the Ethereum contract removed one.

The adapter has no pause, kill switch or emergency stop: none of pause, unpause, paused, setPaused, emergencyStop, stop or kill appears in its implementation runtime. The owner can still halt the route in one transaction by clearing the Solana peer or zeroing a rate limit, so the capability exists without a dedicated control.

Route	Bridge stack	Custody / mint	DVN set / threshold	Receive-library pinning	Rate limits
Ethereum ↔ Solana (native 5GgRAEmv8ZxF2PR5hY72Qs5x1bnQ6UK2RbTPoqJ3wSwW)	LayerZero OFT V2, Paxos-deployed adapter	burn-and-mint, verified from source and role wiring	3-of-3 required: LayerZero Labs, Canary, Paxos-branded; no optionals	pinned, send and receive	native, both directions: 4,440 PAXG/24 h; SupplyControl backstop 13,320 PAXG capacity, ≈24 h refill
Solana wrapper C6oFsE8nXRDThzrMEQ5SxaNFGKoyyfWDDVPw37JKvPTe	Wormhole	lock-and-mint: 12.32 PAXG locked, over-backed against the wrapped supply	n/a	n/a	n/a
Harmony 0x7afb0e2eba6dc938945fe0f42484d3b8f442d0ac and BSC 0x7950865a9140cb519342433146ed5b40c6f210f7	OFT V1 (Harmony, wired); unresolved (BSC, not wired)	lock: 1.46 PAXG in ProxyOFT 0x50ed722744d883a54e36dca49ba3cebcb1da1957	n/a	n/a	n/a

The 4,440 PAXG daily limit is roughly twenty times the entire native Solana supply to date of 215.66 PAXG. The Wormhole wrapper is over-backed and lock-side, so its worst case moves already-circulating PAXG rather than inflating supply. Paxos confirmed that it neither controls nor created the wrapper. The Harmony wrapper’s supply of 1.487 PAXG sits marginally above the 1.4602 PAXG escrowed in the ProxyOFT, an over-mint of 0.027 PAXG. The ProxyOFT itself is owned by 0x19565f4771843467aad632d6b56c75396785b06c. The BSC representation of 50 PAXG exposes no OFT surface at all, with owner() and trustedRemoteLookup() both reverting, so it is a stranded legacy representation which cannot draw on any Ethereum-side escrow. Paxos confirmed that it is inactive and no longer used. Ethereum-side exposure from the entire legacy tail is bounded by the 13.78 PAXG held in escrow across both routes, 1.46 PAXG in the Harmony ProxyOFT and 12.32 PAXG in the Wormhole token bridge. Neither contract can mint, so the tail can only move already-circulating PAXG.

On speed, LayerZero message passing settles in minutes but Solana sits outside the Aave venue set, so its PAXG liquidity cannot be credited to the Ethereum listing at any route speed.

3.6 Technical Risk Summary

Strengths

1. The deployed code is audited and reproduces exactly from the verified source. The November 2024 Zellic review covers the production code path in full, each subsequent material upgrade carries its own re-attestation through December 2025 and April 2026, and the deployed runtime bytecode is an exact match to the verified source.
2. There is an active bug bounty. The Cantina program pays up to $1,000,000 per critical finding against a $2,000,000 annual cap, names PAXG explicitly in scope, and has moved from invitation-only to open enrollment.
3. The legacy fee-on-transfer has been removed. feeRate(), feeController(), and feeRecipient() revert in PaxosTokenV2, so no active or settable transfer fee can shortchange Aave pool accounting, and the token remains a non-rebasing ERC-20 with clean transfer semantics.
4. The upgrade authority and role holders are readable on-chain. Control resolves to two identifiable Paxos-operated keys and the SupplyControl mint and burn gate.
5. A mature oracle path is available. A Chainlink XAU/USD aggregator already serves as the live price source for gold-backed collateral in Aave, so PAXG can be priced without a new feed deployment, and its token-versus-spot basis is tight and mean-reverting.
6. The live bridge route has a limit on the maximum damage that an external attacker can do. The LayerZero route to Solana uses a verifier set of three verifiers. All three verifiers are necessary. The send library and the receive library are pinned. On-chain rate limits give a maximum unbacked mint of 4,440 PAXG in one day. This quantity is inside a SupplyControl capacity of 13,320 PAXG. The OFT program on the Solana side is immutable, because Paxos burned its upgrade authority.

Weaknesses

1. The upgrade path carries no timelock. The single externally owned proxy admin can replace the implementation in one transaction, and the 3-hour defaultAdminDelay covers only DEFAULT_ADMIN_ROLE handover. Paxos confirmed on August 13, 2026 that a timelock is being implemented with rollout expected the week of August 17, 2026, and the proxy admin still resolved to the externally owned account at the time of this review.
2. Control concentrates in two Paxos-operated externally owned accounts with no on-chain multisig. The issuer has disclosed that they utilize a hardware-security-module quorum that LlamaRisk sees as sufficiently safe for smart contract changes.
3. The bridge’s control surfaces concentrate in the same untimelocked Paxos keys as the token’s. The Ethereum-leg custody is burn-and-mint, and while dual on-chain rate limits cap a bridge-side compromise, the adapter is an upgradeable proxy owned by the admin key, that key is also the LayerZero config delegate able to rewire the verifier set and both rate limiters without delay, and the Solana authorities, a 1-of-4 mint multisig, a single-key freeze and permanent delegate, and a live transfer-fee authority at zero basis points, are all undisclosed-custody Paxos keys. The adapter exposes no pause or emergency stop, and the token-level pause does not reach the bridge mint path, so there is no issuer-side circuit breaker for an in-progress inflation event short of clearing the peer or zeroing a rate limit.
4. Reserve integrity and primary arbitrage rest off-chain. The reserve-versus-circulating reconciliation is not contract-enforced and surfaces only through the monthly attestation, mint and redeem pricing draws on a single StoneX feed the issuer controls, and the primary redemption that would close a discount is gated to KYC-onboarded customers rather than open liquidators.

Recommendations

1. Disclose the signer composition behind the two Ethereum control keys and the Solana authority keys, including organisational and hardware diversity and per-key scope, and reconcile it with the on-chain Solana mint multisig under a non-disclosure agreement.
2. For the legacy representations: with the BSC representation confirmed inactive, commit it to a formal freeze or deprecation where Paxos controls it and confirm non-control of the Harmony route.
3. Complete the migration of the proxy admin behind a timelock, and confirm its minimum delay and which parties hold the proposer, executor and canceller roles.
4. Add a dedicated pause to the bridge adapter.

4. Counterparty Risk

4.1 Governance and Regulatory Risk

In substance, Paxos holds a federal prudential charter under which the activity in question is expressly permitted. OCC Conditional Approval #1358 authorises a business plan comprising “custody of crypto-assets, fiat currency, securities, and commodities on a fiduciary basis; U.S. dollar-backed stablecoin issuance; gold-backed digital asset issuance; escrow, fiduciary agent, payment agent and exchange agent services; and cryptocurrency exchange, brokerage, and trade facilitation services.” Supervision sits with the OCC’s Novel Bank Supervisory Office. Consummation is corroborated by the bank’s appearance on the OCC’s list of active trust banks as at June 30, 2026.

The reserve is allocated physical gold. Each token “is equal to one fine troy ounce of London Good Delivery gold,” and tokens “represent fractional ownership of London Good Delivery gold bars, which are held by Paxos Trust on a segregated basis for the benefit of PAXG holders within LBMA-approved security carrier vaults.” Allocation is to specific serialised bars, is maintained continuously by an automated process, as Paxos may reallocate between bars “such that all PAXG tokens will be allocated to specific gold bars at all times”, and where a holding falls short of a full bar the holder takes a pro rata share of it. The June 2026 examination discloses a single asset-type line in the reserve: London Good Delivery gold, 452,355 ounces, against 452,355 tokens.

Gold is purchased from a single named supplier, StoneX Group Inc., in unallocated form and allocated on vaulting. Paxos states that “gold enters the vault before tokens enter the market.” Unallocated gold balances held on the Paxos platform “are issued by a third party bank (a ‘Clearing Bank’),” and Paxos “is not responsible for any losses associated with any default by a Clearing Bank.” The bank is not named in any public Paxos document.

Section 15.2 of PAX Gold Terms and Conditions permits Paxos to “charge storage fees to all token holders by issuing to Paxos new PAXG tokens, thereby diluting the value of existing PAXG tokens,” on thirty days’ notice, as an obligation of “all PAXG token holders, regardless of whether such token holder is a Customer,” with the obligation deemed assigned to subsequent holders on transfer.

Redemption rail

Three redemption routes exist on paper: dollars, unallocated Loco London gold, and allocated physical bars.

Redemption of any kind requires a verified Paxos account, and the covenant that governs it is qualified rather than absolute. Only verified customers may redeem; Paxos may refuse where it believes redemption “would be contrary to applicable law or would otherwise expose us to legal liability”; and the operative promise is that “absent a reasonable justification not to convert or redeem PAXG, and provided that you are a fully verified Customer of Paxos, your PAXG are freely convertible.” That formulation converts the holder’s core entitlement into a standard-based obligation assessed by the obligor in the first instance.

Physical bar redemption carries a 430-token minimum per bar, “plus the fee set forth in the Paxos User Guide,” possible additional due diligence, and delivery risk that passes to the customer at handover: “once your bars are in the possession of the delivery service you choose, then Paxos will have been deemed to have fulfilled its obligation for delivery.”

The unallocated route is less freely available than the marketing implies. The terms require the customer to supply Loco London unallocated gold account details, or intermediary bank details where the account is not held with a clearing member; the product page scopes unallocated redemption to “institutional customers.” That requirement is in practice an institutional gate. The consequence is that for a retail holder below 430 ounces there is one route, not three: dollars, supplemented by a partner arrangement for fractional physical redemption that Paxos describes but no longer names in its own current copy.

Custody

The gold is vaulted in London with two LBMA-approved operators, Brink’s Global Services Ltd. and ICBC Standard Bank. Until very recently there were three. HSBC appears in the custody set through the 31 December 2025 examination and is absent from 30 January 2026 onward, so the change took effect in that window.

Verification

Verification is monthly, independent, opinion-bearing, and performed by a Big Four firm. KPMG has issued the reports since February 2025, replacing WithumSmith+Brown, and conducts an examination “in accordance with attestation standards established by the American Institute of Certified Public Accountants,” expressing an opinion that management’s assertion “is fairly stated, in all material respects.” This is an examination engagement carrying reasonable assurance, not an agreed-upon-procedures engagement.

Sanctions and asset controls

On Ethereum, an asset protection role “can freeze and unfreeze the token balance of any address on chain” and “can also wipe the balance of an address after it is frozen to allow the appropriate authorities to seize the backing assets.” The whitepaper frames this as regulator-mandated and reserved for cases where Paxos is “required to do so by law, including by court order or other legal process.” The published V2 upgrade documentation supplies a figure that is genuinely useful and rarely available: 285 frozen addresses on mainnet. No register of frozen addresses or of the basis for each freeze is published.

The contractual freeze right, meanwhile, is wider than the whitepaper’s stated standard. Section 14.2 provides that Paxos “will only freeze such assets (1) if required to do so by law… (2) pursuant to a formal notification by a Paxos partner according to previously agreed contractual terms, or (3) as deemed necessary by Paxos in its sole discretion.” §14.5 permits frozen assets to become “wholly and permanently unrecoverable and unusable,” and in appropriate circumstances to be destroyed, which makes a permanent discretionary freeze economically indistinguishable from confiscation. Section 14.6 applies the entire regime “to all holders of PAXG, regardless of whether the holder is a Customer of Paxos.”

Screening infrastructure is described only in the 2019 whitepaper, which names ComplyAdvantage and Chainalysis for transaction monitoring. No current public statement describes the stack, its coverage of on-chain versus platform activity, or escalation procedures.

User restrictions

A permissioned-mint, permissionless-transfer design is implemented. Primary issuance and redemption are gated by full KYC (“only verified Customers may purchase PAXG from us or convert or redeem PAXG from us,” and an account is required to transact on the platform), while secondary transfer is unrestricted between any Ethereum or Solana addresses. There is no allowlist, no transfer restriction, and no holder cap at contract level. The compliance perimeter is therefore the boundary, with the freeze power discussed above as the only in-flight control.

There are no investor qualifications: no accreditation, sophistication, suitability or minimum-net-worth requirement, and a purchase minimum of 0.01 PAXG.

4.2 Access Control Risk

4.2.1 Contract Modification Options

The token runs behind a ZeppelinOS AdminUpgradeabilityProxy at 0x45804880De22913dAFE09f4980848ECE6EcbAf78, whose upgrade authority is the proxy admin 0xc94bcf6e1d8b3558e3b62e743630d50497e3851c, an externally owned account with no contract code. That single key can replace the implementation with arbitrary logic and is the principal control surface. Everything the running implementation gates flows through OpenZeppelin AccessControl, and the DEFAULT_ADMIN_ROLE, PAUSE_ROLE, and ASSET_PROTECTION_ROLE all resolve to one externally owned account 0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B, which also owns the external SupplyControl gatekeeper 0xbe62dB8ed4838e10e1318593aC9e3eb9ccFb2dC7 that authorises mint and burn. Control funnels to two keys, both operated by Paxos. The address 0x2fb074FA59c9294c71246825C1c9A0c7782d41a4 is simultaneously one of the three live SupplyControl supply controllers. The bridge adapter holds SUPPLY_CONTROLLER_ROLE as a third, contract-based supply controller, itself owned by the same admin key, so control still funnels to the two Paxos keys.

Surface	Value
Proxy (ZeppelinOS AdminUpgradeabilityProxy)	0x45804880De22913dAFE09f4980848ECE6EcbAf78
Implementation (PaxosTokenV2)	0x7Da4C5d9EcA180A03765a6d27196F2A0380Fa543
Proxy admin / upgrade authority	0xc94bcf6e1d8b3558e3b62e743630d50497e3851c (EOA)
DEFAULT_ADMIN + PAUSE + ASSET_PROTECTION roles	0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B (EOA)
SupplyControl mint/burn gate	0xbe62dB8ed4838e10e1318593aC9e3eb9ccFb2dC7 (owner = admin EOA)
defaultAdminDelay	10,800 s (3 h), admin-role handover only
Timelock on the upgrade path	none at the moment, issuer-confirmed implementation pending
On-chain multisig (getOwners / getThreshold)	not exposed (off-chain MPC)

Function	Caller	Access modifier
upgradeTo / upgradeToAndCall	proxy admin EOA	ZeppelinOS ifAdmin
pause / unpause	PAUSE_ROLE (admin EOA)	onlyRole(PAUSE_ROLE)
freeze / freezeBatch / unfreeze / unfreezeBatch	ASSET_PROTECTION_ROLE (admin EOA)	onlyRole(ASSET_PROTECTION_ROLE)
wipeFrozenAddress	ASSET_PROTECTION_ROLE (admin EOA)	onlyRole(ASSET_PROTECTION_ROLE)
increaseSupply / mint	any caller, gated	supplyControl.canMintToAddress
decreaseSupply / burn	any caller, gated	supplyControl.canBurnFromAddress
setSupplyControl / reclaimToken	DEFAULT_ADMIN_ROLE (admin EOA)	onlyRole(DEFAULT_ADMIN_ROLE)
beginDefaultAdminTransfer / acceptDefaultAdminTransfer	DEFAULT_ADMIN_ROLE (admin EOA)	3 h defaultAdminDelay

4.2.2 Timelock

No timelock governs the upgrade path or the asset-protection and pause functions, and the proxy admin key can upgrade the implementation in a single transaction. The implementation’s AccessControlDefaultAdminRules base enforces a 3-hour delay (10,800 seconds) on transferring the DEFAULT_ADMIN_ROLE, but that delay applies only to the admin handover and not to upgrades, freezes, or pauses, so it is not a timelock on any path material to Aave’s exposure. The implementation does not expose renounceOwnership, and a simulated call from the admin reverts, so the admin cannot be renounced through that route.

4.2.3 Admin-key Composition and Signer Disclosure

Both controlling addresses read on-chain as externally owned accounts rather than an on-chain multisig. Paxos disclosed details about their setup and infrastructure under NDA and LlamaRisk sees them as sufficiently safe.

4.2.4 Transfer Semantics and Issuer-Powers Blast Radius

PAXG is non-rebasing. A balance changes only for a transfer, a mint, a burn, or an asset-protection wipe. There used to be an on-chain transfer fee of approximately 0.02%, but it has been turned off by Paxos. It is still possible to block a transfer at the address level. The pause power stops all transfers, including Aave market activities like supply, borrow or repay. Also worth noting is that a token-level pause does not stop the bridge mint path.

The asset-protection role can freeze a specified address and then wipe its balance. Paxos can freeze the Aave Pool or a collateral vault. Then the PAXG at that address becomes non-transferable, and withdrawals and liquidations against it fail. A subsequent wipe destroys that balance. A wipe converts that balance directly into a loss for the suppliers. The SupplyControl contract controls the mint power and the burn power. This contract does enforce a limit on the quantity for each supply controller. This limit controls the holder of the role. It does not control the holder of the key. The addSupplyController function and the updateLimitConfig function are gated on the SUPPLY_CONTROLLER_MANAGER_ROLE. The _authorizeUpgrade function is gated on the DEFAULT_ADMIN_ROLE. The admin and roles key at address 0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B has both roles. Thus the key holder can register a new supply controller, increase an existing limit, or install a new version of the gatekeeper contract. The key holder can execute each of these in one transaction.

The limiter can be turned off by setting the refill rate to zero. Freeze, wipe and upgrade carry no quantity limit at all. Contract-level limits cap how much damage each power can do in a single action excluding Paxos itself.

Disclaimer

This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.