[Asset Technical Assessment] sUSDe on Aave V3 Monad
Author: Aave Labs
Date: 2026-06-30
Summary
Technical assessment of sUSDe (Staked USDe) for onboarding to Aave V3 Monad, following the Technical Asset Listing Framework.
Overall result: 
MEDIUM
sUSDe is the staked, yield-bearing form of Ethena’s USDe, an ERC-4626 vault on Ethereum whose share grows in USDe value as protocol yield accrues. On Monad it is a bridged representation: an immutable LayerZero V2 Omnichain Fungible Token (OFT) with no token-level admin powers (no owner mint, cap, blacklist, freeze, pause, fee, rebase, or hooks), where supply is created only by a verified message that clears four independent required verifiers, is rate-limited, and is fully backed by canonical sUSDe locked on Ethereum. The Monad token carries no vault logic and no exchange-rate method, so its value lives on the Ethereum vault and is supplied to Monad by a price feed; the conditions that hold this at Medium are the oracle’s reliance on a chain of feeds and thin on-chain sUSDe liquidity, the slow exit through the vault’s redemption cooldown, the underlying vault’s freeze power, and the bridge governance items described below.
Listing Recommendation
From a technical standpoint, sUSDe on Aave V3 Monad is technically eligible for listing, with conditions. Several non-blocking items are recommended for the issuer to address and to revisit as exposure to the asset grows. On Monad sUSDe can be priced either through a direct market feed or through a multi-step exchange-rate composition (a sUSDe to USDe to USDT route) built on the Chainlink sUSDe/USDe exchange-rate feed; the elements for the composition are available on Monad, and it is the standard Correlated-Asset Price Oracle (CAPO) design already used to price sUSDe on other Aave instances, so it may suit this listing as well. The residual consideration is that the composition depends on a chain of feeds including the USDe valuation and that sUSDe currently has negligible on-chain liquidity on Monad to corroborate a direct price independently. Exit from Monad is slow, with ultimate redemption to USDe routed through the Ethereum vault’s 24-hour unstaking cooldown (adjustable by the issuer up to a 90-day maximum), and there is no native redemption on Monad; the outbound bridge leg is symmetric with the inbound limit and is no longer the binding exit constraint. The underlying Ethereum vault carries an Ethena freeze-and-seize power over fully-restricted holders that can impair the redemption path, the LayerZero bridge configuration and delegate on both ends sit on a single 5-of-10 Ethena Safe with no timelock, and no dedicated published audit of the OFT deployment was located. None of these is a blocker.
Asset under review
| Field | Value |
|---|---|
| Asset | Staked USDe (sUSDe) |
| Target chain | Monad (chain ID 143) |
| Target market | Aave V3 Monad |
| Token contract | 0x211Cc4DD073734dA055fbF44a2b4667d5E5fE5d2 |
| Native to target chain? | No. sUSDe on Monad is a bridged representation; the Monad token is a LayerZero V2 burn-and-mint OFT, while canonical sUSDe is locked in an OFT Adapter on Ethereum. |
| AAcA classification | Group 3 (yield-bearing, staked-stablecoin wrapper) |
sUSDe is the staked form of Ethena’s USDe: on its home chain, Ethereum, it is an ERC-4626 vault where depositors lock USDe and receive sUSDe shares that grow in USDe value as protocol yield accrues. On Monad it is a bridged representation: canonical sUSDe is locked inside an OFT Adapter on Ethereum and a matching amount is minted on Monad, kept in step by LayerZero messages, so sending it back burns the Monad token and releases the Ethereum escrow. The Monad token carries no vault logic and no exchange-rate method, so its USDe value lives on the Ethereum vault and must be supplied to Monad by a price feed.
0. Pre-screening
sUSDe is deployed on Monad at 0x211Cc4DD…5d2 as an immutable contract that is not a proxy, reporting name “Staked USDe”, symbol “sUSDe”, 18 decimals, and a negligible total supply consistent with a freshly seeded deployment. It is classified Group 3 (yield-bearing wrapper) and is not in any non-approved or sanctioned category, and on Monad it resolves as a burn-and-mint OFT, while the same shared address on Ethereum is instead the OFT Adapter (lockbox) holding canonical sUSDe. Aave is not yet deployed on Monad, so sUSDe is not currently listed on this instance; references on other Aave deployments are context only. The EIP-1967 implementation, admin, and beacon slots are empty and proxiableUUID() reverts, so the contract is non-upgradeable, and its on-chain behaviour matches the canonical LayerZero V2 OFT, with the deployed source verified on the Monad explorer.
Rating: 
GOOD
1. ERC20 Compliance
The sUSDe token on Monad is a standard ERC20 with 18 decimals: transfer() and transferFrom() return bool and revert on invalid input, with no fee on transfer, no rebasing, no ERC777 or ERC1363 hooks, and no flash mint. There are no transfer restrictions on the Monad token (isBlacklisted and isBlocked are absent), so smart contracts can hold and transfer it without restriction. The token holds no vault accounting, consistent with a bridged representation rather than the canonical Ethereum vault, and it exposes no EIP-2612 permit (DOMAIN_SEPARATOR() reverts). The freeze and seize power exists on the Ethereum vault, not on the Monad token (see Section 8).
Rating: GOOD
2. Oracle
sUSDe on Monad can be priced through either of two strategies: a direct market feed, or a multi-step exchange-rate composition. The elements for the composition are available on Monad: a live Chainlink sUSDe/USDe exchange-rate feed exists, reporting the vault’s USDe-denominated value of one sUSDe on-chain, and that exchange rate can be composed with the USDe price along a sUSDe to USDe to USDT route to reach a USD value: the exchange-rate feed gives sUSDe in USDe terms, and USDe is in turn valued against USDT. This composition (a base asset price combined with the vault exchange rate) is the standard Correlated-Asset Price Oracle (CAPO) design already used to price sUSDe on other Aave instances, so it may suit this listing as well. The pricing approach can be selected at listing; the residual consideration is that the composition relies on a chain of feeds including the USDe valuation, while sUSDe has negligible on-chain market depth on Monad to corroborate a direct price at assessment.
Rating: MEDIUM → both a direct market feed and the exchange-rate composition (sUSDe to USDe to USDT) are available, the latter being the CAPO design already used on other Aave instances; either way the price depends on a chain of feeds including the USDe valuation, and sUSDe has negligible on-chain liquidity on Monad to corroborate it independently.
3. Access Control
The Monad token has no AccessControl roles and no privileged powers: minter(), MINTER_ROLE(), DEFAULT_ADMIN_ROLE(), cap(), maxSupply(), paused(), and isBlacklisted() all revert, so there is no owner mint, cap, blacklist, freeze, or pause authority on the token, and no externally owned account (EOA) anywhere in the control path. Supply is created only when LayerZero delivers a verified message from the Ethereum lockbox and destroyed only on outbound bridging, with no direct mint function and no arbitrary-wallet burn, and the rate limiter bounds the inbound and outbound flow per lane. The contract is immutable, with the EIP-1967 proxy slots empty and proxiableUUID() reverting, so there is no proxy admin or upgrade path to assess. The only privileged authority is the LayerZero bridge configuration and delegate, which on both the Monad OFT and the Ethereum lockbox sits on a 5-of-10 Ethena Safe (the same signer set) with no timelock, carried into Section 6.
Rating: MEDIUM → the Monad token is admin-free and immutable, but the only privileged authority, the LayerZero bridge configuration and delegate, sits on a 5-of-10 Safe with no timelock and no separation between owner and delegate.
4. Exchange Rate and Yield
sUSDe is yield-bearing, so this section applies. The Monad token holds no vault accounting (convertToAssets and pricePerShare are absent on Monad), so the rate that matters for pricing lives on the Ethereum vault, where one sUSDe is worth a growing amount of USDe as protocol yield accrues, and on Monad value is supplied by the Chainlink sUSDe/USDe exchange-rate composition (see Section 2). The rate accrues from yield on Ethereum and cannot be moved by a donation or a flash loan in a single Monad transaction, since there is no vault on Monad to manipulate, and it is monotonically non-decreasing under normal operation, falling only on a negative-yield or loss event. There is no native redemption on Monad: exit is either selling into a Monad DEX or bridging back to Ethereum and then unstaking the vault to USDe through its 24-hour cooldown (adjustable up to a 90-day maximum), so the realistic liquidation path is DEX-first with a bridge fallback whose binding delay is the vault cooldown rather than the bridge rate limit.
Rating: MEDIUM → the rate is not single-transaction manipulable on Monad and is monotonic under normal conditions, but there is no native redemption on Monad, the on-chain DEX backstop is thin, and exit is slow through the Ethereum vault’s 24-hour cooldown (adjustable up to a 90-day maximum).
5. Token Architecture
Supply on Monad rises only through verified inbound LayerZero mints and falls only through outbound burns, with no fixed cap at the token level and the effective bound set by the inbound rate limiter and the Ethereum escrow, and standard Transfer events emitted from and to the zero address for observability. There are no transfer restrictions on the token, and all privileged functions (the LayerZero configuration setters) are owner-gated, with no supply-affecting path beyond the verified bridge route. The token logic contains no tx.origin authorization and no application-level delegatecall, consistent with a self-contained non-proxy OFT. There is a single immutable token address and a single Ethereum inbound lane, with no migration contract or duplicate path to the same supply.
Rating: GOOD
6. Bridge and Cross-Chain Risk
Monad sUSDe is a LayerZero V2 OFT that mints and burns a local representation in response to verified messages, while canonical sUSDe is locked on Ethereum in the OFT Adapter, a burn-and-mint model on Monad against lock-and-release on Ethereum. Topology is observed on-chain rather than assumed: the Monad OFT has exactly one non-zero peer, the Ethereum Adapter, and reciprocity is confirmed from the Ethereum side, so Monad sUSDe bridges only to and from the Ethereum lockbox over a single reciprocal lane with no spoke-to-spoke routes. The route is verified by four independent required Decentralized Verifier Networks (DVN): LayerZero Labs, Canary, Nethermind, and Horizen Labs, with no issuer verifier, over pinned (non-default) canonical libraries with custom confirmations on both legs, and the Ethereum Adapter holds canonical sUSDe that vastly exceeds the Monad supply, so the representation is fully backed with surplus. The route is governed by Ethena Safes with the same 10-signer set on both ends (the Monad OFT owner and delegate, and the Ethereum Adapter owner, each 5-of-10) with no timelock, the bridge uses a single provider with no cross-provider redundancy, and the deployment-level audit gap noted in Section 7 applies.
Rating: MEDIUM → four independent required DVNs, pinned libraries, a single reciprocal lane with no rogue peers, and a fully collateralised lockbox with surplus, held at Medium by the no-timelock 5-of-10 Safe owning and delegating the bridge configuration on both ends, the single-provider design, and the audit-coverage gap.
7. Audit and Security History
The deployed token is the canonical LayerZero V2 OFT standard with canonical libraries and a standard rate limiter, and the LayerZero OFT and OFT Adapter standard contracts have public audits, while the underlying Ethereum sUSDe vault sits within Ethena’s published audit set as the dependency beneath this bridged token. No dedicated published audit of Ethena’s assembled OFT, OFT Adapter, and rate-limiter deployment was located, a coverage gap at the deployment level, though the components are audited at the standard-contract level. The contract is immutable, so no implementation rotation is possible, the deployed source is verified on the Monad explorer, and on-chain behaviour matches the canonical OFT standard. The bridge configuration reflects post-incident hardening to a four-required-DVN quorum with per-chain rate limits, no exploit of this OFT on Monad was identified, and an issuer commitment to pre-notify Aave governance of bridge configuration, rate-limit, or delegate changes is recommended at listing, as the absence of a timelock provides no built-in warning window.
Rating: MEDIUM → built on LayerZero’s audited OFT standard over an audited underlying vault and reflecting post-incident hardening, but no dedicated published audit of the assembled OFT deployment was located.
8. Dependencies
The asset rests on the Ethereum sUSDe vault as its dominant dependency, the source of sUSDe’s value, yield, and exit timing, an audited ERC-4626 contract that carries Ethena’s restricted-staker freeze and a seize power over fully-restricted holders (the redistributeLockedAmount function, present on-chain and DEFAULT_ADMIN_ROLE-gated) and a 24-hour redemption cooldown; that power acts on Ethereum, not on Monad transfers, but can impair the redemption path back to USDe. Beneath the vault, USDe redeems to roughly its dollar value from Ethena’s delta-hedged collateral held largely off-chain, which is not on-chain-verifiable. The supply integrity of Monad sUSDe depends on LayerZero V2 (four required DVNs, pinned libraries) and the Ethereum lockbox that holds the backing, both governed by the same no-timelock Ethena Safe, and valuation depends on the Chainlink sUSDe/USDe exchange-rate composition (sUSDe to USDe to USDT) on Monad. The realistic exit runs through the vault’s 24-hour cooldown (adjustable up to a 90-day maximum), with the outbound bridge no longer the binding constraint, so in practice liquidators would trade on a Monad DEX, where depth is negligible at assessment. That backing risk and redemption mechanisms falls outside the contract layer and must be addressed through risk parameters.
Rating: MEDIUM → dependencies are audited and the escrow is a large surplus, but the bridge and lockbox sit under a no-timelock multisig, the underlying vault has a freeze-and-seize power and a redemption cooldown (24 hours, adjustable up to a 90-day maximum), and the deepest backing of USDe’s off-chain collateral is not on-chain-verifiable.
9. Summary
Findings table
Ratings in this table are plain text (Good / Medium / Critical / N/A), no icons.
| Area | Key finding | Rating |
|---|---|---|
| 0. Pre-screening | Immutable, non-proxy OFT at 0x211Cc4DD…5d2, 18 decimals, Group 3 yield-bearing wrapper; burn-and-mint OFT on Monad against the Ethereum lockbox; behaviour matches canonical OFT, deployed source verified on the explorer. |
Good |
| 1. ERC20 | Standard 18-decimal ERC20; returns bool, no fee on transfer, no rebase, no ERC777 or ERC1363 hooks, no flash mint, no transfer restrictions on the Monad token, no permit. | Good |
| 2. Oracle | Both a direct market feed and a CAPO-style exchange-rate composition (sUSDe to USDe to USDT, on the live Chainlink sUSDe/USDe feed) are available; the composition is the design already used on other Aave instances. Residual reliance on a chain of feeds including the USDe valuation, and negligible on-chain sUSDe liquidity on Monad. | Medium |
| 3. Access control | No token roles at all, immutable, no EOA in the control path; only privileged authority is the LayerZero bridge configuration and delegate on a 5-of-10 Ethena Safe with no timelock; mint only via the verified bridge path, rate-limited. | Medium |
| 4. Exchange rate / yield | Yield-bearing; rate lives on the Ethereum vault, not on Monad; not single-transaction manipulable and monotonic under normal conditions; no native Monad redemption, exit via the 24-hour vault cooldown (adjustable up to 90 days) and a thin DEX. | Medium |
| 5. Token architecture | Single immutable token, single bridge supply path, gated mint and burn; no tx.origin, no application-level delegatecall, no duplicate supply path. |
Good |
| 6. Bridge and cross-chain | LayerZero V2 OFT, four independent required DVNs, pinned libraries, single reciprocal lane to the Ethereum lockbox (escrow far exceeds Monad supply), rate-limited; 5-of-10 Ethena Safe owner and delegate on both ends with no timelock, single provider. | Medium |
| 7. Audit and security | Built on LayerZero’s audited OFT standard over an audited underlying vault, configuration reflects post-incident hardening; no dedicated published audit of the assembled OFT deployment located. | Medium |
| 8. Dependencies | Ethereum sUSDe vault (freeze-and-seize, 24-hour cooldown), USDe and its off-chain collateral, LayerZero V2, and the Ethereum lockbox; bridge and lockbox under a no-timelock multisig; exit slow and throttled. | Medium |
Disclaimer
Aave Labs has no formal or informal affiliation with Ethena or the sUSDe issuer beyond this technical assessment. Aave Labs has not been compensated by Ethena or any related party in connection with this work.
Copyright
Copyright and related rights waived via CC0.