# Wrapped Ether (WETH) on Aave Arc Assessments **URL:** \ **Category:** Assessments\ **Created:** [September 15, 2026, 7:54pm UTC](https://governance.aave.com/t/wrapped-ether-weth-on-aave-arc-assessments/25648 "2026-09-15T19:54:28Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![AaveLabs](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/aavelabs/32/6388_2.png) [@AaveLabs](https://governance.aave.com/u/AaveLabs)\ **Post date:** [September 15, 2026, 7:54pm UTC](https://governance.aave.com/t/wrapped-ether-weth-on-aave-arc-assessments/25648/1 "2026-09-15T19:54:28Z")
This thread is the home for all risk and technical assessments of WETH on Aave Arc. It collects, in one place: - The pre-listing asset risk assessment, under the Aave Risk Framework. - The pre-listing technical asset assessment, under the Technical Asset Listing Framework. - All post-listing monitoring reports, periodic refresh assessments, and any re-evaluations triggered by material changes. New assessments and updates will be posted as replies below as they are produced, so the full history stays in a single thread. ---
**Author:** ![AaveLabs](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/aavelabs/32/6388_2.png) [@AaveLabs](https://governance.aave.com/u/AaveLabs)\ **Post date:** [September 15, 2026, 7:54pm UTC](https://governance.aave.com/t/wrapped-ether-weth-on-aave-arc-assessments/25648/2 "2026-09-15T19:54:54Z")
**Title:** [Asset Technical Assessment] WETH on Arc **Author:** Aave Labs **Date:** 2026-09-15 * * * ## Summary Technical assessment of WETH on Arc, following the [Technical Asset Listing Framework](https://governance.aave.com/t/arfc-technical-asset-listing-framework/24988). **Overall result:** 🟡 MEDIUM 🟡 WETH is a bridged representation of canonical Ethereum WETH9 with a live Chainlink ETH/USD price feed. The principal considerations are Circle’s proxy upgrade privilege and emergency bridge admin-takeover capability, both held by Circle but with no concentration risk since they sit on distinct addresses (see Section 3), the registry based code path, and the Cross Chain Token Service bridge configuration. ### Technical conclusion From a technical standpoint, WETH is eligible for listing on Arc. ## Asset under review | Field | Value | | --- | --- | | Asset | Wrapped Ether (WETH) | | Target chain | Arc mainnet (chain ID `5042`) | | Token contract | `0x128cC466B61f542da60c70e3aA11c10e19B84EDB` | | Native to target chain? | No, bridged representation of Ethereum WETH9 through Circle’s Cross Chain Token Service | | Aave Asset Classification (AAcA) | Bridged representation of a wrapper | WETH on Arc is backed by canonical WETH9 escrowed by the token manager on Ethereum. ## 0. Pre-screening WETH is an active Arc deployment whose logic is supplied through Circle’s Cross Chain Token Service (CCTS) registry. The token’s logic contract matches byte for byte the CrossChainToken implementation designated by the CCTS registry on Ethereum, a minimal-functionality token that represents the asset on Ethereum as part of Circle’s Cross Chain Transfer Protocol (CCTP). The registry implementation has now been publicly verified, though the issuer behind this deployment is not established. **Rating:** 🟡 MEDIUM 🟡 → the token logic has established provenance, but issuer accountability behind the deployment remains unestablished. ## 1. ERC20 Compliance WETH is a standard ERC20 with 18 decimals and EIP-2612 permit support: `transfer()` and `transferFrom()` return a boolean, with no fee on transfer, rebasing, ERC777 or ERC1363 hooks, or flash mint. It has no local `deposit()` or `withdraw()` functions because it is a bridged representation, and contracts can hold and transfer it subject to the pause and denylist controls assessed in Section 3. **Rating:** 🟢 GOOD 🟢 ## 2. Oracle A live Chainlink ETH/USD feed on Arc provides a price with eight decimals, a 24 hour heartbeat, and a 0.5% deviation threshold. Ethereum mainnet’s ETH/USD feed uses a 1 hour heartbeat, considerably shorter than Arc’s 24 hour heartbeat, with the same 0.5% deviation threshold. **Rating:** 🟢 GOOD 🟢 ## 3. Access Control WETH’s token contract is ownerless: `owner()` returns an address that does not exist onchain, a placeholder rather than a controlled account. Circle’s team retains the proxy upgrade privilege over the token’s code path, held by a separate Cold Storage EOA, meaning a single-key address held in offline storage by Circle’s team, and Circle’s Cross Chain Token Service (CCTS) can take over ownership if needed in an emergency, also held as a Cold Storage EOA, assessed in Section 6. No Safe, multisig, or timelock protects these roles, and no reviewer determination is recorded for them. Both the proxy upgrade privilege and the bridge’s emergency takeover capability are held by Circle, concentrating control in a single entity. **Rating:** 🟡 MEDIUM 🟡 → the token itself is ownerless, but Circle’s proxy upgrade privilege remains a single, undelayed control point, and the bridge carries a separate emergency admin-takeover capability. ## 4. Exchange Rate and Yield Not applicable. WETH is a 1:1 representation of ether with no exchange rate function, rebase, or yield accrual. **Rating:** ⚪ N/A ⚪ ## 5. Token Architecture The token has one canonical contract on Arc, with mint and burn events observable through ERC20 transfer events. Its logic is resolved from the CCTS registry rather than being fixed by the token itself, and neither the token nor its token manager pins that implementation. **Rating:** 🟡 MEDIUM 🟡 → the token logic is identified, but its behavior remains dependent on a registry controlled outside the token. ## 6. Bridge and Cross Chain Risk WETH has one bridge route, CCTS, which locks canonical WETH9 on Ethereum and mints a matching amount on Arc. The route has been used in both directions, and Ethereum escrow covers Arc supply at 1.1004 times. The route’s rate limits can be removed by single operator addresses, neither token manager has a configured pause authority, and neither manager pins its implementation. Circle’s team also holds an emergency admin-takeover capability over the bridge, without an onchain delay. **Rating:** 🟡 MEDIUM 🟡 → escrow and the bridge model are verified, while the route’s controls, implementation path, and an emergency admin-takeover capability remain concentrated with Circle. ## 7. Audit and Security History The framework is identified as Circle’s CCTS, and the token’s logic matches the CrossChainToken implementation designated by the Ethereum CCTS registry (see Section 0). The reviewer had access only to the NativeFiatToken V2.2 and CCTP audit reports, and neither directly covers this registry implementation. No registry rotation has occurred after deployment. Circle has confirmed that the relevant audit report will be made public shortly after launch. **Rating:** 🟡 MEDIUM 🟡 → the token logic has established provenance, but the registry implementation is not covered by a reviewed audit report; Circle has confirmed a public report will follow shortly after launch. ## 8. Dependencies WETH depends on the CCTS registry for token and token manager logic, Cross Chain Transfer Protocol (CCTP) message transport, the Ethereum escrow manager, and the Chainlink ETH/USD feed. The registry is administered by a single address and is part of both the code path and mint path. **Rating:** 🟡 MEDIUM 🟡 → the representation depends on the Ethereum escrow and a bridge framework whose control paths are concentrated in single addresses. ## 9. Summary ### Findings table Ratings in this table are plain text (Good / Medium / Critical / N/A), no icons. | Area | Key finding | Rating | | --- | --- | --- | | 0. Pre-screening | Active CCTS deployment with token logic that matches the Ethereum CCTS implementation, now publicly verified; issuer accountability is not established. | Medium | | 1. ERC20 | Standard ERC20 with 18 decimals and permit support, without transfer fees, rebase, hooks, or flash mint. | Good | | 2. Oracle | Live Chainlink ETH/USD feed with eight decimals, within its 24 hour heartbeat. | Good | | 3. Access control | The token contract is ownerless; a separate Cold Storage EOA controls the registry upgrade path, and Circle retains a separate emergency bridge admin-takeover capability, also a Cold Storage EOA. | Medium | | 4. Exchange rate / yield | 1:1 ether representation with no yield or exchange rate mechanism. | N/A | | 5. Token architecture | The registry supplies token logic, and neither the token nor its manager pins the implementation. | Medium | | 6. Bridge and cross chain | Ethereum escrow exceeds Arc supply, while route limits, pause configuration, implementation control, and an emergency admin-takeover capability remain concentrated with Circle. | Medium | | 7. Audit and security | Token logic has established provenance; the CCTS registry implementation is not covered by a reviewed audit report, though Circle confirmed one will follow shortly after launch. | Medium | | 8. Dependencies | The registry is a dependency controlled by a single address in the token code and mint paths. | Medium | ## Disclaimer Aave Labs has no formal or informal affiliation with the WETH issuer or any related party beyond this technical assessment. Aave Labs has not been compensated by the WETH issuer or any related party in connection with this work. ## Copyright Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain/zero/1.0/). ---
**Author:** ![LlamaRisk](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/llamarisk/32/12865_2.png) [@LlamaRisk](https://governance.aave.com/u/LlamaRisk)\ **Post date:** [September 18, 2026, 2:40pm UTC](https://governance.aave.com/t/wrapped-ether-weth-on-aave-arc-assessments/25648/3 "2026-09-18T14:40:22Z")
## Summary WETH on Arc is deployed as a `CrossChainToken` implementation different from other Circle-issued assets, as it is not natively minted on Arc and is instead a bridged representation backed by WETH escrowed on Ethereum. Its owner and pauser slots remain unclaimed, so no party can modify its privileged roles, and the token cannot be paused through its own pause function. However, the Cross Chain Token Service (CCTS) retains ownership assignment authority and can resolve the unclaimed state at any time. Additionally, the WETH token and its TokenManager contracts, do not pin their own implementation and instead resolves it through the CCTS singleton at call time. This means the CCTS owner ultimately controls the code executed by the TokenManager and WETH. WETH also has no native blacklist and instead inherits the blacklist functionality of Arc USDC. Other findings include that access control across all contracts, including both the asset and bridge contracts in scope, relies on EOAs managed under Circle’s enterprise-grade key management program, which they claim maintains SOC 2 Type 2 attestation and follows NIST frameworks across the infrastructure. Further, no timelocks gate sensitive contract upgrades, consistent with Circle’s operational model for USDC and EURC on other networks. ## 1. Asset Fundamental Characteristics [WETH](https://explorer.arc.io/address/0x128cC466B61f542da60c70e3aA11c10e19B84EDB) is wrapped ETH from the Ethereum Mainnet made available on Arc through Circle’s CCTPx protocol. It is deployed as an upgradeable `CrossChainToken` contract which is a purpose-built ERC20 built on OpenZeppelin upgradeable primitives rather than a FiatTokenV2\_2 deployment, so it does not inherit the role structure of the Circle-issued stablecoins. Unlike USDC, EURC, and cirBTC, which are natively minted on Arc, WETH is a bridged representation rather than a native asset. The underlying WETH stays on Ethereum, locked in the [TokenManager](https://etherscan.io/address/0x8b86d0A92d779BbCc3208a98Df0ab1926B3Ac4Dd) contract, currently holding 85.1759 WETH, and an equivalent amount of WETH is minted on Arc, so each WETH on Arc is backed by WETH escrowed on Ethereum. WETH is therefore not a Circle-issued reserve asset but a lock-and-mint bridged claim on Ethereum WETH, and its risk profile is driven primarily by the CCTPx bridge rather than by an issuer reserve. ### 1.1 Bridge Risk Circle’s new bridging protocol, **CCTPx,** is a permissionless extension that allows third-party assets to be bridged over CCTP. CCTP itself is a burn-and-mint protocol scoped to Circle’s own native tokens, such as USDC, while CCTPx layers a lock-and-mint model on top of CCTP’s cross-chain messaging so that an asset Circle does not issue, in this case wETH, can be represented on a destination chain. For wETH, Circle creates a lock-and-mint connection between Ethereum and Arc. The underlying wETH on Ethereum is custodied in a lock/unlock Token Manager contract deployed by the CCTPx protocol, and on Arc, the protocol deploys both a new ERC20 contract and an accompanying mint/burn Token Manager, with the Arc supply managed through mint and burn commands to keep parity with the amount escrowed in the Ethereum Token Manager. The protocol has three critical components: - The **Cross Chain Token Service (CCTS)** is a singleton contract deployed on each chain that coordinates the bridge creation process and cross-chain transfers, and it integrates into the pre-existing CCTP smart contracts for cross-chain messaging. - The **Token Manager** is the contract that defines and controls the bridging mechanism for a single token bridge connection, either lock/unlock or mint/burn, on the chain where it is deployed. - The **Cross Chain Token** is the ERC20 contract deployed as part of bridge creation when a token is issued to a new chain, and Circle states it is based on a modified version of Circle’s audited FiatTokenV1 contract, with modifications to support cross-chain transfer functionality. Transfers use a lock-and-mint model in both directions. From Ethereum to Arc, wETH is approved and locked in the Ethereum Token Manager as bridge collateral, while the Ethereum CCTS sends a cross-chain message that instructs the Arc Token Manager to mint an equivalent amount of WETH for the recipient. From Arc to Ethereum, WETH is approved and burned by the Arc Token Manager, and the Arc CCTS sends a message instructing the Ethereum Token Manager to unlock and release the corresponding escrowed wETH to the recipient. #### **Attester Threshold** Because CCTS routes its messages through the existing CCTP contracts, the authenticity of a cross-chain transfer message inherits CCTP’s attestation model, which on Ethereum is the 2-of-2 Circle-operated attester set. #### **Rate Limits** Cross-chain transfers are bounded by a rate limit that controls the net flow of wETH to and from each deployed chain (Arc \<\> Ethereum) over a rolling 6-hour window. The [TokenManager on Arc](https://explorer.arc.io/address/0x8b86d0A92d779BbCc3208a98Df0ab1926B3Ac4Dd) and the [TokenManager on Ethereum](https://etherscan.io/address/0x8b86d0A92d779BbCc3208a98Df0ab1926B3Ac4Dd) are configured symmetrically, at 2,500 WETH per six-hour window in each direction, alongside a per-transfer ceiling of 500 WETH. ## 2. Market Risk ### 2.1 Liquidity Users can swap 100 WETH for $233K USDC within a price impact of 5.5%. ![image](https://europe1.discourse-cdn.com/flex013/uploads/aave/original/2X/9/9859a672b942593128c6dd0868ebd92129bf9cb6.png) _Source: WETH/USDC Swap Liquidity on Arc,_ [_KyberSwap_](https://kyberswap.com/swap/arc/weth-to-usdc)_, September 17, 2026_ #### 2.1.1 Liquidity Venue Concentration On-chain liquidity for WETH on Arc is available on multiple venues the most liquidity being [Aerodrome WETH/USDC](https://www.geckoterminal.com/arc/pools/0x6f302decb49fb30b2d2c609bdd16e04e7dd096fc) ($479K in TVL), [Aerodrome WETH/cirBTC](https://www.geckoterminal.com/arc/pools/0x72dff32c9c5c28758565be0a7d4e6e42fb498506) ($465K in TVL), and [Uniswap V4 WETH/USDC](https://www.geckoterminal.com/arc/pools/0x0e3778957c57c367e7ea5513122d3e300a1ee635166e22d07c284b01dcea1f95) pools ($47K in TVL). ![image](https://europe1.discourse-cdn.com/flex013/uploads/aave/original/2X/3/3a69dbc075b8bd1d4396bcc75e6d4460189676fd.png) _Source: WETH DEX liquidity pools on Arc,_ [_GeckoTerminal_](https://www.geckoterminal.com/arc/pools/0x72dff32c9c5c28758565be0a7d4e6e42fb498506)_, September 17, 2026_ #### 2.1.2 DEX LP Concentration WETH LP concentration on Arc is moderately low with the LP breakdown for the top two pools is as follows: - Aerodrome WETH/USDC: 42.38% of the pool’s liquidity is supplied by an [EOA 1](https://debank.com/profile/0xbe7019f8333b0b3cfc707ac353ebc2123140134c). - Aerodrome WETH/cirBTC: The top supplier is another [EOA 2](https://debank.com/profile/0xf8587ec80ede1b55ce44e565b96215327894d138) with a 23.08% share of the pool’s liquidity. ### 2.2 Volatility As the Arc chain went live only two days ago, limited volatility data is available for WETH’s secondary market price. Therefore, no meaningful conclusions regarding its price stability can yet be drawn. ### 2.3 Exchanges WETH issued by Circle only trades on Arc DEXs currently and is not listed on any centralized exchange. ## 3. Technological Risk ### 3.1 Smart Contract Risk The bridge contracts were audited by third-party auditors. However, the reports were not publicly available at the time of review, preventing independent verification of the findings. The following contracts power CCTPx bridge on the Arc chain: - [CrossChainTokenService](https://explorer.arc.io/address/0x431871229103b780868f8c6bb820cd16ecf942bc): Upgradeable, ERC-1967 proxy. Singleton that creates bridges, routes cross-chain messages, and acts as both the upgrade authority and the ownership assigner for every CCTPx contract on Arc. Controlled by an [EOA A](https://explorer.arc.io/address/0xdfe2de0653f46331fbdcb2558ab513c37795545f). - [CCTP MessageTransmitterV2](https://explorer.arc.io/address/0x81d40f21f12a8f0e3252bccb954d722d4c464b64): Upgradeable, ERC-1967 proxy. The underlying CCTP contract that verifies attester signatures on inbound messages and emits outbound ones. Controlled by an [EOA B](https://explorer.arc.io/address/0xb3ad729b38bf4d1257e224084322cb38edd74ed5). - [FeeService](https://explorer.arc.io/address/0x88e0fee76fe71f467009dfddcfa759ddc6b1a575): Upgradeable, ERC-1967 proxy. Quotes and collects the cross-chain transfer fee. Controlled by an [EOA C](https://explorer.arc.io/address/0xede2dd51f54dbcb9f03abefbb7b9973d7d14e82a). - [DeploymentDelegate](https://explorer.arc.io/address/0xd25ebea31f01b81c80960fa6f6351e0af9c21367): Immutable. Deploys new bridges and tokens on behalf of the service. No owner role. - [TransferDelegate](https://explorer.arc.io/address/0xe98bc278d3cd5cedc8fbff511e807447fde273ff): Immutable. Executes the mint, burn, lock, and unlock legs of a transfer. No owner role. - [FiatTokenDenylistAdapter](https://explorer.arc.io/address/0x3ebe1f103151890346cd7dbcec1c596cc50ef58e): Immutable. Service-wide denylist source. A view-only adapter that forwards `isDenylisted` to the Arc USDC contract’s `isBlacklisted`. No owner role, so the effective control sits with the USDC `blacklister`. The WETH token and its TokenManager contracts are beacon proxies that resolve their implementation through the [Cross Chain Token Service](https://explorer.arc.io/address/0x431871229103b780868f8c6bb820cd16ecf942bc) singleton at call time as the local override is unset. Whoever controls the CCTS on a given chain can therefore change the code of every CCTPx TokenManager and CCTPx-issued token on that chain in a single action. ### 3.2 Access Control The Arc-side WETH contract is the CCTPx `CrossChainToken` rather than a `FiatTokenProxy` deployment, and it exposes a narrower role set than the three Circle-issued assets above: it has an `owner`, a `pauser`, a minter set, and a `denylistProvider` as shown below: | Controlling Wallet | Role | Functionality | | --- | --- | --- | | Unclaimed, assignable by the [Cross Chain Token Service](https://explorer.arc.io/address/0x431871229103b780868f8c6bb820cd16ecf942bc) | `owner` | Add/remove `minters`, set the `pauser` and the `denylistProvider`, upgrade to a custom implementation. | | Unclaimed | `pauser` | Pause the contract, preventing all transfers, minting, and burning. | | One minter is configured: the [TokenManager](https://explorer.arc.io/address/0x8b86d0A92d779BbCc3208a98Df0ab1926B3Ac4Dd) | `minters` | Create/destroy tokens. Unlike the FiatToken assets, the contract holds no per-minter allowance, so the minter is bounded by the TokenManager’s own bridge limits rather than by a token-level ceiling. | | [FiatTokenDenylistAdapter](https://explorer.arc.io/address/0x3ebe1f103151890346cd7dbcec1c596cc50ef58e), delegating to the [USDC](https://explorer.arc.io/address/0x3600000000000000000000000000000000000000) blacklist, controlled by [EOA 4](https://explorer.arc.io/address/0x2A2b7FF330F15F9A8c52af5Fec27D775f5138467) of the USDC table | `denylistProvider` | Block transfers to/from an address. | Minting is not allowance-capped at the token level, and both the `owner` and `pauser` slots are currently unclaimed as they return to [an `ASSIGNABLE_OWNER` sentinel](https://explorer.arc.io/address/0x173d00f7e8702d176628963FbD4E1Bcc18B29F94). CCTPx uses it to mark a contract whose ownership has not yet been claimed. The practical consequence is that no party can currently call the token’s owner-gated or pauser-gated functions. The [Cross Chain Token Service](https://explorer.arc.io/address/0x431871229103b780868f8c6bb820cd16ecf942bc) remains able to change the shared implementation the token proxies to, as described under Smart Contract Risk above. The CCTS is also registered as the token’s `ownershipAssigner` and can assign an owner at any time through `assignOwnership`, after which the nominee claims the role via `acceptAssignedOwnership`. The TokenManager and CCTS contracts use a three-role structure of `owner`, `pauser`, and `operator`. The `owner` can upgrade the contract and manage the other two roles, the `operator` sets the rate limit, the maximum transfer amount, and the rate limit window, and the `pauser` halts and resumes the contract. They have the following role assignments: | Contract | `owner` | `pauser` | `operator` | | --- | --- | --- | --- | | [WETH TokenManager (Arc)](https://explorer.arc.io/address/0x8b86d0A92d779BbCc3208a98Df0ab1926B3Ac4Dd) | Unclaimed | Unassigned | [EOA D](https://explorer.arc.io/address/0x045d2fe2f72f7916c71bdbf7e0c0c7b540563f3c) | | [WETH TokenManager (Ethereum)](https://etherscan.io/address/0x8b86d0A92d779BbCc3208a98Df0ab1926B3Ac4Dd) | Unclaimed | Unassigned | [EOA E](https://etherscan.io/address/0x4eda43f99f54aa3e5dbd2bd85ea9d4e9cf2b7006) | | [Cross Chain Token Service (Arc)](https://explorer.arc.io/address/0x431871229103b780868f8c6bb820cd16ecf942bc) | [EOA A](https://explorer.arc.io/address/0xdfe2de0653f46331fbdcb2558ab513c37795545f) | [EOA F](https://explorer.arc.io/address/0x58bc35dd79c4f433ee56c7859f87586e015977c4) | [EOA G](https://explorer.arc.io/address/0xf3d063a9d5c1838d452b10472da191b5cedeb9f9) | | [Cross Chain Token Service (Ethereum)](https://etherscan.io/address/0x431871229103b780868f8c6bb820cd16ecf942bc) | [EOA H](https://etherscan.io/address/0x568fb87a8559728007b88142688483214d678e82) | [EOA I](https://etherscan.io/address/0x0335894695dff4c58e59c950bcb317f488ef3ac4) | [EOA J](https://etherscan.io/address/0xae7ca7e1cc3e666fe12d72118b120a136ed99915) | No multisig or timelock sits on any of these contracts, including the CCTS, which is the upgrade authority for all of them and the assigner of ownership for those that are unclaimed. Across the CCTPx deployment on both chains, all privileged assigned addresses are different. No wallet holds two roles, no wallet appears on both the Arc and the Ethereum side, and none of these matches any of the controlling wallets, masterMinter owners, or funded minters on the USDC, EURC, or cirBTC contracts. ## Disclaimer This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work. The information provided should not be construed as legal, financial, tax, or professional advice.