Executive Summary
This publication presents an overview of the new Gho Stability Module (GSM) architecture developed by TokenLogic with support from Aave Labs and Bored Ghost Developing. development team.
The RemoteGSM Upgrade introduces a three-layer model (GhoDirectFacilitator → GhoReserve → multiple GSMs) replacing the current design, where each GSM has a unique facilitator with its own bucket, with a new single GhoDirectFacilitator per network that mints GHO into a common GhoReserve from where it is distributed to any number of GSMs and other entities via per-entity limits.
The upgrade enables GSMs on L2s for the first time and simplifies adding new swap assets, since new GSMs no longer require separate facilitator registration. Contracts have been audited, deployed and activated via AIP 452 and 453.
Introduction
The design of GHO ensures that all GHO entering the supply are minted on the Ethereum mainnet through governance-approved facilitators and then bridged via Chainlink’s CCIP bridge lanes to other networks, preserving accounting with counter burning/minting occurring on each side of the bridge. Each facilitator has its own Bucket: a bucketCapacity (max mintable GHO) and a bucketLevel (currently outstanding).
Before the remoteGSM upgrade, two of the active facilitators were GSMs, pegging stability mechanisms that enable 1:1 swaps between GHO and approved stablecoins (USDC, USDT). When GHO is below peg, arbitrageurs buy discounted GHO on the market and redeem it for stablecoins via the GSM. When GHO is above peg, stablecoins are deposited, and the received GHO is swapped on the market. This creates a hard arbitrage band around the peg, bounded by the swap fee.
GSM Evolution
Original GSMs (2024) held raw USDC and USDT. Capital sat idle, generating zero yield, with opportunity costs rising as holdings increased.
stataGSM migration (early 2025) replaced the initial GSMs with yield-bearing variants. Underlying stablecoins are supplied to Aave V3 as stataTokens (ERC-4626 vault shares), with interest flowing to the DAO treasury.
Fee structure is asymmetric: 0% to mint GHO (deposit stablecoins), 0.08-0.10% to redeem (withdraw stablecoins), encouraging accumulation of our stablecoin while adding friction to selling GHO.
Current Limitations
1. Each GSM is its own facilitator. Adding a new swap pair means a new facilitator registration via governance proposal, plus separate bucket capacity and exposure cap management. Operationally heavy for routine expansion.
2. No L2 support. GSMs require facilitators who mint and burn GHO directly. Since minting only exists on the Ethereum mainnet, GSMs cannot operate on L2 networks.
RemoteGSM: The New Architecture
The upgrade replaces facilitator-per-GSM with three layers:
GhoDirectFacilitator is registered on the GHO token contract. It mints GHO into a GhoReserve. Initial deployment is one per network, though the model supports multiple (e.g., separate ones for GSMs vs. direct minters).
GhoReserve holds pre-minted GHO and enforces per-entity withdrawal limits. It must hold enough GHO to cover the limits it sets. The Reserve is not limited to GSMs; the longer-term vision consolidates other facilitator types into this model.
GSM retains its user-facing swap role but no longer mints or burns; it now draws and restores GHO from its GhoReserve. Fees accumulate on the GSM for DAO distribution. Each GSM maintains its own exposure cap as an asset-level safety boundary.
Operational Flow
On Ethereum mainnet:
- Increase GhoDirectFacilitator bucket capacity
- Mint GHO into the GhoReserve
- Add the entity to the Reserve and set its limit
- Set the exposure cap on the GSM
On L2s, the same applies, but GHO must first be minted on Ethereum and bridged to the L2 Collector via Chainlink CCIP before funding the Reserve. Bridging must be performed via governance; thus, any GHO expansion into new networks is always a DAO decision.
Day-to-day parameter adjustments across all three layers are to continue to be handled by GHO Stewards within their governance-defined boundaries.
V4 Alignment: GhoReserve as Credit Line
In Hubs & Spokes in Aave V4 forum post, we outlined how GHO flows from a Reserve through capped Credit Lines to each Hub.
RemoteGSM follows a similar principle: reserve-based distribution and independently capped channels. In V4, those channels become Hub Credit Lines; GSMs continue as separate peg stability modules with their own caps.
Next Steps
GhoRouter
We have developed a GhoRouter contract that enables a one-hop transition from the underlying to GHO or sGHO, without requiring users to first acquire the stata token, which is directly swappable for GHO. The same contract allows users to swap from either sGHO or GHO to a specified underlying. This contract’s audit starts next week.
Gho Expansion
Bootstrap GHO liquidity into new markets with GSM support.
Disclosure
TokenLogic is an active service provider to the Aave DAO, the beneficiary of stream 100072 and the KPI as outlined in this publication. The scope of this engagement is available via this forum proposal.
TokenLogic supports and maintains an independent delegate voting platform within the Aave community.
TokenLogic and associated entities have no undisclosed material conflicts of interest at the time of submission.
Copyright
Copyright and related rights waived via CC0.