[Asset Technical Assessment] weETH on Aave V3 Monad
Author: Aave Labs
Date: 2026-06-30
Summary
Technical assessment of weETH (Wrapped eETH) for onboarding to Aave V3 Monad, following the Technical Asset Listing Framework.
Overall result: 
MEDIUM
weETH on Monad is a well-governed bridged liquid-restaking token: an upgradeable LayerZero V2 Omnichain Fungible Token (OFT), EtherFi’s EtherfiOFTUpgradeable, with no mint authority assigned (the minter role set is empty, mint happens only on the verified bridge path), no blacklist, and no fee, rebase, or hooks. The upgrade, peers, and rate limits run through a 72-hour timelock controlled by a 4-of-7 EtherFi Safe, with no externally owned account on the upgrade path, and Monad supply is fully backed by canonical weETH locked in the Ethereum lockbox. A live WEETH/USD market feed, a live weETH/ETH exchange-rate feed, and a live ETH/USD feed are present on Monad, so the asset is priceable through either a direct market feed or a Correlated-Asset Price Oracle (CAPO) composition (ETH/USD combined with the weETH/ETH exchange rate), the latter being the design already used on other Aave instances. The conditions that hold this at Medium rather than Good are the bridge configuration authority sitting outside the timelock, a single-key bridge pause role, and the absence of any native redemption on Monad.
Listing Recommendation
From a technical standpoint, weETH on Aave V3 Monad is technically eligible for listing, with conditions. Several non-blocking items are recommended for the issuer to address and to revisit as exposure to the asset grows: the LayerZero delegate (the verifier and library configuration authority) is the 4-of-7 Safe acting without the timelock, so that configuration can change instantly while the upgrade, peers, and rate limits do go through the 72-hour timelock. This is not a blocker.
Asset under review
| Field | Value |
|---|---|
| Asset | Wrapped eETH (weETH) |
| Target chain | Monad (chain ID 143) |
| Target market | Aave V3 Monad |
| Token contract | 0xA3D68b74bF0528fdD07263c60d6488749044914b |
| Native to target chain? | No. weETH on Monad is a bridged representation: the Monad token is a LayerZero V2 burn-and-mint OFT, while canonical weETH is locked in an OFT Adapter (lockbox) on Ethereum. |
| AAcA classification | Group 3 (yield-bearing, liquid-restaking wrapper) |
weETH is the non-rebasing wrapper of EtherFi’s eETH, a liquid-restaking token: a holder’s balance stays fixed while each token becomes worth more eETH as staking and restaking rewards accrue. On its home chain, Ethereum, weETH is the canonical token. On Monad it is a bridged representation: canonical weETH is locked inside an OFT Adapter (lockbox) on Ethereum and a matching amount is minted on Monad via LayerZero, with a direct route to Base as well. There is no local restaking or redemption on Monad, so the value and the exit path both depend on the Ethereum side and the bridge.
0. Pre-screening
weETH is deployed on Monad at 0xA3D68b74…914b as a thin proxy carrying genuine contract code, reporting name “Wrapped eETH”, symbol “weETH”, 18 decimals, and a negligible total supply consistent with a freshly seeded deployment. It is classified Group 3 (yield-bearing wrapper) and is not in any non-approved or sanctioned category, and the lineage is confirmed on-chain because its registered Ethereum peer resolves to EtherFi’s OFT Adapter, whose underlying token is canonical weETH. weETH is listed on multiple live Aave deployments on other chains, useful as context for the same asset rather than as proof of this listing’s safety. The deployment behaves as the audited EtherfiOFTUpgradeable type behind a standard OpenZeppelin Transparent proxy, and the deployed implementation is source-verified on the Monad explorer (see Section 7).
Rating: 
GOOD
1. ERC20 Compliance
The weETH token on Monad is a standard ERC20 with 18 decimals built on a Solady-based ERC20 under LayerZero’s OFT: transfer() and transferFrom() return bool, with no fee on transfer, no rebasing, no ERC777 or ERC1363 hooks, and no flash mint. There are no transfer restrictions and no blacklist or allowlist on the token, so smart contracts can hold and transfer it without restriction. The Monad token holds no rebasing machinery, consistent with weETH being a non-rebasing wrapper whose yield accrues in the eETH-per-weETH ratio that lives on Ethereum (see Section 4). The only mint entry point is the role-gated path and the internal LayerZero receive path (see Section 3).
Rating: GOOD
2. Oracle
A live weETH/ETH exchange-rate feed and a live ETH/USD feed are present on Monad, and a Chainlink WEETH/USD market feed also exists on Monad, live and fresh at review. Both pricing strategies are therefore available: a direct WEETH/USD market feed, or a Correlated-Asset Price Oracle (CAPO) composition of ETH/USD combined with the weETH/ETH exchange rate. The elements for the composition are present on Monad, and it is the design already used to price weETH on other Aave instances, so it may suit this listing as well. The pricing approach can be selected at listing.
Rating: GOOD
3. Access Control
Access control uses Solady integer roles: role assignment is gated by the token owner, an OpenZeppelin TimelockController with a 72-hour minimum delay whose proposer, executor, and canceller is a 4-of-7 EtherFi Safe, so role membership ultimately flows through the timelock and no externally owned account sits on that path. The minter role set is empty, so no address holds direct mint authority and supply is created only on the verified LayerZero receive path, with no token-level supply cap and no path to burn from an arbitrary wallet; the token carries no blacklist. The pause role is held by a single externally owned account, but its guard applies only to the LayerZero send and receive functions and not to ordinary transfers, so it can halt bridging (a denial-of-service on the bridge) but cannot freeze a holder’s weETH or block an Aave liquidation, and unpausing requires the 4-of-7 Safe. The token sits behind an OpenZeppelin Transparent proxy whose ProxyAdmin is owned by the same 72-hour timelock, so the upgrade key is the timelock and not an externally owned account, but the LayerZero delegate that can edit the route’s verifier and library configuration directly on the endpoint is the 4-of-7 Safe acting without the timelock, so that configuration can change in a single transaction.
Rating: MEDIUM → the upgrade path is a 4-of-7 Safe behind a 72-hour timelock and the minter set is empty, but the LayerZero configuration delegate is the Safe acting without a timelock and the bridge pause role is a single externally owned account (bridge-pause only, not a holder freeze).
4. Exchange Rate and Yield
weETH is yield-bearing, so this section applies. The Monad token holds no rate logic; the rate that matters for pricing is the eETH-per-weETH ratio that lives on the Ethereum weETH contract, accruing from staking and restaking rewards, and on Monad value is supplied through the CAPO composition described in Section 2 (ETH/USD combined with the weETH/ETH exchange rate). Because there is no rate function on Monad, the rate cannot be moved by a donation or a flash loan in a single Monad transaction, and it is monotonically non-decreasing under normal operation, falling only on a slashing or negative restaking event on Ethereum that would pass through to the Monad value. There is no native redemption on Monad: the exit paths are selling into a Monad decentralized exchange (negligible depth at assessment) or bridging back to Ethereum (burn on Monad, release the Ethereum escrow) and then redeeming through EtherFi’s withdrawal queue, both rate-limited and slow, so the realistic liquidation path is a decentralized-exchange sale first.
Rating: MEDIUM → the rate is not single-transaction manipulable on Monad and is monotonic under normal conditions, but there is no native Monad redemption and the exit depends on EtherFi’s withdrawal queue or thin decentralized exchange depth.
5. Token Architecture
Supply on Monad rises only through verified LayerZero inbound mints and falls only through outbound burns, both gated to the verified bridge path, with no token-level cap and the effective bound being the inbound rate limiter plus the Ethereum escrow. Standard Transfer events are emitted to and from the zero address on mint and burn for observability, and there are no transfer restrictions on ordinary transfers, so the token is fully composable. The token logic contains no tx.origin authorization and no application-level delegatecall beyond the Transparent proxy’s own delegation to its fixed implementation, and all privileged functions sit behind explicit access control. There is a single token proxy and a single bridge mint authority, with the only inbound mint routes being the Ethereum and Base lanes and no migration or duplicate path to the same supply.
Rating: GOOD
6. Bridge and Cross-Chain Risk
Monad weETH is a LayerZero V2 OFT: Monad mints and burns a local representation in response to verified messages while canonical weETH is locked on Ethereum in the OFT Adapter, a burn-and-mint model on Monad against lock-and-release on Ethereum, with a direct route to Base as well. The OFT has exactly two non-zero peers, the Ethereum Adapter and the Base weETH OFT, both reciprocal and with no rogue routes, and each lane is verified by four independent required Decentralized Verifier Networks (DVNs), namely LayerZero Labs, Canary, Nethermind, and Horizen Labs, with no issuer DVN, over pinned canonical libraries; inbound and outbound transfers are rate-limited on every lane. The Ethereum lockbox holds canonical weETH that vastly exceeds the Monad representation, so Monad supply is fully backed with surplus, and the OFT owner and ProxyAdmin owner are the 72-hour timelock controlled by the 4-of-7 Safe, with the separate Ethereum lockbox owner governed by its own 48-hour timelock. Held above Good are the LayerZero delegate acting without a timelock on the verifier and library configuration, the single externally owned account bridge pauser (bridge-pause only), and the single-provider design across both lanes.
Rating: MEDIUM → four independent required DVNs, pinned libraries, reciprocal Ethereum and Base lanes with no rogue peers, a surplus-collateralised lockbox, and a 72-hour-timelocked upgrade and peer path are strong, but the configuration delegate acts without a timelock, the bridge pauser is a single externally owned account, and a single bridge provider serves both lanes.
7. Audit and Security History
The deployed OFT type, EtherFi’s EtherfiOFTUpgradeable, was reviewed by Certora in October 2025 with zero findings for weETH, and this is the directly relevant audit for the deployed Monad OFT, with the pairwise rate limiter covered as part of that contract. The OFT framework underneath is LayerZero V2 with canonical libraries, themselves publicly audited, and the deployed implementation exposes exactly the audited type’s interface (Solady integer roles, the bridge pause functions, and the pairwise rate limiter), matching the audited commit. EtherFi’s separate native-minting framework is not in scope because Monad has no such mechanism (the minter set is empty, see Section 3), and no exploit of the weETH OFT on Monad was identified, with EtherFi maintaining a public bug bounty. The deployed implementation is source-verified on the Monad explorer, pinning the deployed bytecode to the audited type; an issuer commitment to pre-notify Aave governance of upgrades, role changes, and rate-limit or configuration changes should be obtained at listing.
Rating: GOOD
8. Dependencies
The asset rests on EtherFi’s eETH and restaking stack on Ethereum (the ultimate backing, where value, yield, and slashing exposure originate, along with the eETH-per-weETH rate and the withdrawal queue), LayerZero V2 (the supply integrity of Monad weETH, with four required DVNs and pinned libraries), the Ethereum lockbox (the audited EtherFi Adapter that escrows the canonical weETH backing all remote supply, governed by a 48-hour timelock), and the Chainlink feeds on Monad (valuation). A direct route to Base is a second on-chain path, so a Base-side compromise could in principle propagate, but it is verified by the same four-DVN quorum and rate-limited. The bridge configuration delegate is a multisig acting without a timelock, and the redemption path is slow because it combines a bridge round trip with EtherFi’s withdrawal queue, with liquidators in practice trading on a Monad decentralized exchange (negligible depth at assessment).
Rating: MEDIUM → the dependencies are audited and the escrow is a large surplus, but the bridge configuration delegate is a multisig without a timelock, a second route to Base exists, and the exit depends on EtherFi’s withdrawal queue plus thin Monad liquidity.
9. Summary
Findings table
Ratings in this table are plain text (Good / Medium / Critical / N/A), no icons.
| Area | Key finding | Rating |
|---|---|---|
| 0. Pre-screening | Thin proxy at 0xA3D68b74…914b, Group 3 yield-bearing wrapper; lineage confirmed against canonical weETH via the Ethereum peer; behaves as the audited EtherfiOFTUpgradeable behind an OpenZeppelin Transparent proxy; deployed implementation source-verified on the explorer. |
Good |
| 1. ERC20 | Standard 18-decimal Solady-based ERC20 under LayerZero’s OFT; returns bool, no fee on transfer, no rebase, no ERC777 or ERC1363 hooks, no flash mint, no transfer restrictions. | Good |
| 2. Oracle | Both strategies available: a direct WEETH/USD market feed, or a CAPO composition (ETH/USD combined with the weETH/ETH exchange rate); the composition is the design already used on other Aave instances. All feeds live on Monad. | Good |
| 3. Access control | Solady integer roles; minter set empty; owner is a 72-hour timelock controlled by a 4-of-7 Safe; bridge pauser is a single externally owned account (bridge-pause only); LayerZero delegate is the Safe acting without the timelock. | Medium |
| 4. Exchange rate / yield | Non-rebasing wrapper; rate accrues on Ethereum, not manipulable in one Monad transaction; no native Monad redemption, exit is a thin decentralized exchange or a slow, rate-limited bridge round trip plus EtherFi’s withdrawal queue. | Medium |
| 5. Token architecture | Single token, single bridge supply path (Ethereum and Base lanes), no migration or duplicate path; supply only via verified mint and burn; no tx.origin, no application-level delegatecall. |
Good |
| 6. Bridge and cross-chain | LayerZero V2 OFT, four required DVNs (LayerZero Labs, Canary, Nethermind, Horizen Labs), pinned libraries, reciprocal Ethereum and Base lanes; surplus lockbox; 72-hour timelock on upgrade and peers; delegate acts without timelock, pauser is a single externally owned account, single provider. | Medium |
| 7. Audit and security | Certora audit of EtherfiOFTUpgradeable (October 2025, zero findings), built on LayerZero’s audited standard; deployed type matches the audited commit; deployed implementation source-verified on the explorer. |
Good |
| 8. Dependencies | EtherFi eETH and restaking stack (Ethereum), LayerZero V2, the Ethereum lockbox (48-hour timelock), and Chainlink feeds; bridge config delegate is a multisig without a timelock; second route to Base; exit via EtherFi’s withdrawal queue plus thin Monad liquidity. | Medium |
Disclaimer
Aave Labs has no formal or informal affiliation with EtherFi or the weETH issuer beyond this technical assessment. Aave Labs has not been compensated by EtherFi or any related party in connection with this work.
Copyright
Copyright and related rights waived via CC0.