Paxos USDG (Global Dollar)

Contract Addresses

Core Contracts (Ethereum)

Contract	Address	Type
USDG Token (Proxy)	0xe343167631d89B6Ffc58B88d6b7fB0228795491D	ERC1967 / UUPS Proxy (Solidity 0.8.9)
USDG Implementation	0xFACd5ff359adf87822374275699DD518Aaf9A65f	USDG (Solidity 0.8.28)
Supply Control (Proxy)	0x9a7164112029b81c07636AB7b59fA813E0883BBF	ERC1967 / UUPS Proxy
Supply Control Implementation	0x9e12c058a20c5b0eebaa00e44a712ec54b838971	SupplyControl (Solidity 0.8.17)

All four are source-verified on Etherscan (checked via getsourcecode), so the unverified-source critical gate does not trigger.

Token Facets (live since February 28, 2026)

The USDG proxy routes 118 function selectors to five external facet contracts via setFacet / getFacet. Facet addresses were enumerated from the complete FacetUpdate(bytes4,address) log history on the token (476 events, two deployment batches). All five are source-verified, Solidity 0.8.28.

Facet	Address	Purpose
PayoutGroupFacet	0x77fe0365db15a1ec05833b7c1802d68356a363df	Payout-group lifecycle, address registration, group config
MultiplierMgmtFacet	0x018a090fb8d50376bf8464922ffda935a1fe2859	Reward multiplier (APR) creation and scheduled rate changes
TokenExtensionsFacet	0x7569ae2be6ac51ed7f92f8167090b52615f86497	EIP-2612/3009/1271 permit handling, cancelPermits
TokenAdminFacet	0xe90c0e2fecd06c5875b50f6b13f3b8dbdb4ce946	Admin surface (claim source, rate bounds, role plumbing)
ClaimableRewardsFacet	0x2fe2faef627a56e811e09b4e1b810b59f38f3a81	claimAll, claimForAddresses, and the …To(destination) admin variants

Governance Contracts

Contract	Address	Type
Token Admin (TimelockController)	0x9036566eAa5F83E0b9E1161C6c602b0Adf997654	OpenZeppelin TimelockController — 24-hour minimum delay
DEFAULT_ADMIN Multisig	0x137Dcd97872dE27a4d3bf36A4643c5e18FA40713	SimpleMultiSig — 20 owners, threshold 3
Operational Multisig (no current roles)	0x0644Bd0248d5F89e4F6E845a91D15c23591e5D33	SimpleMultiSig — 20 owners, threshold 3; no longer holds any onchain roles
Operations MPC Wallet (PAUSE / ASSET_PROTECTION / Timelock PROPOSER+EXECUTOR+CANCELLER / SupplyControl SCM)	0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B	MPC wallet (likely Fordefi — see governance section for evidence) — holds PAUSE_ROLE, ASSET_PROTECTION_ROLE on token; PROPOSER_ROLE, EXECUTOR_ROLE, CANCELLER_ROLE on timelock; SUPPLY_CONTROLLER_MANAGER on SupplyControl

Supply Controllers

Read from SupplyControl.getAllSupplyControllerAddresses() and getSupplyControllerConfig(address) on 0x9a71…3BBF (August 15, 2026). Exactly three controllers are registered.

#	Address	Type	Mint Limit Capacity	Refill Rate	Refill Window	Allow Any Address	Mint Destination Whitelist
SC1	0xf845a0A05Cbd91Ac15C3E59D126DE5dFbC2aAbb7	EOA	500,000,000 USDG	138,888 USDG/sec	1 hour	No	0x264b…97B5 only
SC2	0x2fb074FA59c9294c71246825C1c9A0c7782d41a4	EOA	1,000,000,000 USDG	277,777.78 USDG/sec	1 hour	No	itself only
SC3	0x147BdE4F997f0d4C7544ED0C55eAcf1E5E6bf9c4	OFTWrapper (LayerZero bridge)	200,000,000 USDG	2,315 USDG/sec	24 hours	Yes	n/a (unrestricted)

Mint scope is much narrower than the capacity figures suggest. allowAnyMintAndBurnAddress is false for SC1 and SC2, and true only for SC3. Per SupplyControl.sol, canMintToAddress reverts unless the destination is in the controller's whitelist, and canBurnFromAddress reverts unless sender == burnFromAddress. A compromise of the SC1 or SC2 key therefore cannot mint to an attacker-controlled address and cannot burn any third party's balance — it can only inflate one specific Paxos-operated address and burn its own holdings. Both values were set at addSupplyController time and have never changed: zero AllowAnyMintAndBurnAddressUpdated, MintAddressAddedToWhitelist, and MintAddressRemovedFromWhitelist events over the contract's lifetime.

SC3's ceiling has been raised seven times since launch. Full LimitConfigUpdated history for the bridge controller: 10M (April 2025 launch) → 20M (Apr 22, 2025) → 30M (Sep 22, 2025) → 45M (Dec 5, 2025) → 70M (Mar 24, 2026) → 100M (May 18, 2026) → 125M (Jun 4, 2026) → 200M (Jun 30, 2026).

Note on the rate limits. Expressed as a refill window rather than a per-second rate, SC1 can mint 500M USDG per hour and SC2 1B USDG per hour. These are not meaningful constraints on Paxos itself — they are anti-fat-finger guards. The binding constraint on both EOA controllers is the destination whitelist, not the rate limit. Only SC3 has a genuinely restrictive limit (200M per 24h) relative to its unrestricted destination set.

Current balances: SC1 holds 4,493,836.57 USDG, SC2 holds 15,000,000.00 USDG, SC3 (the wrapper) holds 0 — confirming the burn-and-mint bridge model rather than lock-and-release. SC1's sole permitted mint destination 0x264b…97B5 is an EOA holding 11,622,266.31 USDG and ~5,173 ETH; it is the same address this report identifies as the MPC gas station, so it serves as both Paxos's issuance treasury and its gas-funding account.

Multi-Chain Deployments

Supply figures below are totalSupply() read directly on each chain on August 15, 2026 (all 6 decimals), not a DeFiLlama snapshot. The onchain sum ($3.468B) agrees with CoinGecko's market cap to within 0.01%; DeFiLlama's headline ($3.405B) is lower only because it treats the Ink and Hyperliquid balances as bridged-out Ethereum supply and subtracts them from the Ethereum row.

Chain	Token Address	totalSupply()	Share	LayerZero peer (eid)
X Layer	0x4ae46a509F6b1D9056937BA4500cb143933D2dc8	1,963,763,308.96	56.6%	0x9a71…3bbf (30274)
Solana	2u1tszSeqZ3qBWF3uNGPFc8TzMk2tdiwknnRMWGWjGWH	635,627,250.19	18.3%	OFT store PDA (30168)
Ethereum	0xe343167631d89B6Ffc58B88d6b7fB0228795491D	448,595,698.67	12.9%	— (origin chain)
Robinhood Chain	0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168	356,518,732.97	10.3%	0x0d54…28d1 (30416)
Ink	0xe343167631d89B6Ffc58B88d6b7fB0228795491D	62,747,404.93	1.8%	0x9e12…8971 (30339)
Hyperliquid L1	USDG0 HIP-1 spot token (index 352)	~1,781,131 (DeFiLlama)	<0.1%	none — not a wrapper peer
Arbitrum	0x004b506865409877c9fa29bfb1eba929984b9bbc	601,207.02	<0.1%	0xc327…b6b6 (30110)
Total		~3,467,853,603	100%

Notes on the table:

• Ink grew fastest over the last two weeks — 40.0M → 62.7M USDG (+57%) since the July 30 reading, while Ethereum was roughly flat (452.3M → 448.6M).
• Arbitrum is not tracked by DeFiLlama but the deployment is live: symbol() returns USDG, totalSupply() is 601,207.02 USDG, and the mainnet wrapper holds a peer for eid 30110. Supply is negligible today, but the route is an active inbound mint path into SC3's 200M capacity.
• Peers were enumerated onchain, not taken from documentation: all PeerSet events on the wrapper since deployment plus current peers(uint32) reads. Re-verified August 15, 2026 — still exactly five peers, no new chains added. The wrapper returns bytes32(0) for the Hyperliquid eid (30367).
• The Robinhood Chain token address is confirmed from the wrapper itself — token() on 0x0d54…28d1 returns 0x5fc5…d168 (rpc.mainnet.chain.robinhood.com, chain id 4663).
• Every configured inbound route requires the same 3-of-3 DVN quorum, re-verified August 15, 2026 and unchanged. Read from EndpointV2.getConfig(wrapper, receiveLib, srcEid, 2) with receiveLib = 0xc02Ab410f0734EFa3F14628780e6e695156024C2 for all five routes: required DVNs are LayerZero Labs 0x589d…236b, Canary 0xa4fe…c2cd, and Paxos 0xb0b2…2daf, with optionalDVNCount = 0. Confirmation requirements are Robinhood Chain and Arbitrum (40), X Layer and Ink (168), and Solana (32). Paxos itself operates one of the three required DVNs, so only two verifiers are independent of the issuer.
• The wrapper's owner() and its LayerZero delegate are both the Operations MPC wallet 0x3Af3…024B, with no timelock. That address can therefore add a new peer chain or rewrite the DVN configuration unilaterally and immediately. See Governance.
• Hyperliquid L1 is not reachable from the Paxos wrapper. The balance DeFiLlama attributes to LayerZero is a HIP-1 spot token named USDG with fullName: USDG0, tokenId: 0xae87b5246dd9f377b14bbadcf3c72131, isCanonical: false, and no linked EVM contract (Hyperliquid spotMeta API). The mainnet OFTWrapper returns bytes32(0) for the Hyperliquid eid (30367), and its full PeerSet history contains no Hyperliquid peer. The operator and control model of the USDG0 route remain unverified: this evidence establishes only that it is not a configured peer of this Paxos wrapper, not whether Paxos or a third party controls a separate adapter or custody route. Additional checks found no code at the canonical USDG address on HyperEVM and no USDG entry in LayerZero's public OFT registry. Identifying the controller requires tracing Ethereum USDG holders and Transfer events for the corresponding ~1.8M-balance escrow or recovering HyperCore deployment metadata.

Audits and Due Diligence Disclosures

Paxos has conducted 6 security audits from 3 reputable firms (Zellic, Trail of Bits, Halborn) covering the core stablecoin contracts, cross-chain integration, rewards system, and signature validation. All audits are publicly available in the paxos-token-contracts GitHub repository.

Audit History

Firm	Scope	Report
Zellic	Core stablecoin contract review	PDF
Trail of Bits	Cross-chain integration	PDF
Halborn	Token contracts	PDF
Halborn	Domain separator functionality	PDF
Zellic	EIP-1271 signature validation	PDF
Zellic	USDG rewards system (V3), Feb 24, 2026	PDF

(A seventh report, PAXG V2 - Zellic, is in the same directory but scopes Pax Gold, not USDG.)

Audit firms: Zellic (3 audits) is a top-tier smart contract auditor. Trail of Bits (1 audit) is one of the most reputable security firms in the industry. Halborn (2 audits) is a well-known blockchain security firm.

Bug Bounty

Paxos launched a $1M bug bounty on Cantina on March 27, 2026, explicitly covering the USDG smart contracts and cross-chain infrastructure alongside PYUSD and PAXG, plus Web2 products, APIs, and domains. (Paxos announcement; the program is listed on the Cantina bounties page, where the max reward, live status, and March 27, 2026 start date were confirmed directly.)

Attribute	Value
Platform	Cantina (Cantina-triaged)
Max payout	$1,000,000, paid in USDG
Status	Live
Access	Private / invite-only — restricted to researchers already active in the Cantina network; others must request access
Scope	USDG, PYUSD, PAXG contracts and cross-chain infrastructure; public products, APIs, domains

The invite-only gating means it is not fully equivalent to an open Immunefi listing. Not listed on SEAL Safe Harbor.

Claimable Rewards System (V3)

The February 2026 V3 upgrade moved Global Dollar Network partner rewards onchain. Per the description Paxos gave Zellic, it "replaces 30-day delayed reconciliation with on-chain reward calculation" using a shares-based model with O(1) claim gas. Verified onchain state as of August 15, 2026:

• 28 live payout groups (ids 1–30, with 20 and 29 deleted), holding a combined 358,462,181.85 USDG of registered balance — roughly 80% of Ethereum USDG supply. The largest single group (id 18) has 198,460,907.10 USDG registered.
• Five distinct multiplier (APR) curves are in use across those groups.
• Rewards are not minted. ClaimableRewardsBase._claimRewards debits a pre-funded claimSource address and credits the destination, reverting with InsufficientClaimSourceBalance if the source is short. The rewards system therefore adds no new mint authority — the mint-authority set remains SC1, SC2, SC3.
• Registration does not require holder consent. registrarRegisterRewardAddress / …Batch are callable by PAYOUT_GROUP_REGISTRAR_ROLE alone. Partner-signed registration (proposeRegisterRewardAddress / acceptRegisterRewardAddress) exists but isPartnerSignedRegistrationsEnabled() currently returns false. Enrolling an address does not move its principal, but it does route the reward accrual on that balance to the group's configured destination — which may be a third party.
• Two of the six new roles can redirect funds, per the inline documentation in Roles.sol: PAYOUT_GROUP_ADMIN_ROLE ("CAN redirect funds by changing payout destinations to arbitrary addresses") and CLAIM_ADMIN_ROLE ("CAN redirect funds by specifying arbitrary claim destinations"). Both are held by the MPC wallet. The blast radius is bounded by the claimSource balance — Paxos's own reward pool — not by user balances.

Role holders were enumerated from the token's complete RoleGranted / RoleRevoked log history and confirmed with live hasRole reads:

Role	Holder	Type	Can redirect funds?
MULT_ADMIN_ROLE	0x3Af3…024B (MPC wallet)	MPC	No
MULT_RATE_ROLE	0x3Af3…024B (MPC wallet) and 0x4e43…eef8	MPC + EOA	No
PAYOUT_GROUP_REGISTRAR_ROLE	0x55f7…9684	EOA	No (but can enroll/unenroll any address)
PAYOUT_GROUP_ADMIN_ROLE	0x3Af3…024B (MPC wallet)	MPC	Yes
CLAIM_OPERATOR_ROLE	0x5fd9…2e38	EOA	No (destination is group-configured)
CLAIM_ADMIN_ROLE	0x3Af3…024B (MPC wallet)	MPC	Yes

The three EOA holders are plain externally-owned accounts (cast code returns 0x). Roles.sol labels these role tiers "hot wallet" by design, and none of them can redirect funds or touch user principal — but they are single keys with no timelock, and this is a governance surface that did not exist at the previous assessment.

Contract Complexity

The USDG system is moderate complexity:

• UUPS upgradeable proxy for both the token and SupplyControl contracts
• AccessControl role-based permissions — nine distinct roles on the token: DEFAULT_ADMIN, PAUSE, ASSET_PROTECTION, plus the six V3 rewards roles. (SUPPLY_CONTROLLER_MANAGER is a SupplyControl role, not a token role — see Governance.) SupplyControl carries three more: SUPPLY_CONTROLLER_MANAGER, SUPPLY_CONTROLLER, and TOKEN_CONTRACT
• Diamond-like facet pattern — the USDG contract uses setFacet/batchSetFacet to route 118 selectors across five external facet contracts, adding upgradeability surface area beyond the proxy. Facet changes are made by DEFAULT_ADMIN_ROLE, i.e. through the 24h timelock
• Onchain claimable-rewards accounting (V3) — shares/multiplier model with 28 live payout groups; every transfer involving a registered address updates share accounting
• Rate-limited minting via the SupplyControl contract with per-controller capacity, refill rates, and destination whitelists
• EIP-2612/EIP-3009/EIP-1271 gasless and smart-wallet signature support
• LayerZero V2 OFT bridge wrapper for cross-chain transfers
• Freeze/wipe capability for regulatory compliance

USDG is no longer well described as "a standard ERC-20 with a pause and a freeze": the transfer path now runs through shares math for ~80% of Ethereum supply by balance.

Version History

Version	Date	Key Changes
v2.0.0	Nov 4, 2024	Major rewrite: consolidated Paxos stablecoins, Solidity 0.8.17, EIP-3009/2612, SupplyControl, Hardhat migration
v2.0.1	Nov 12, 2024	Bugfix: prevent frozen addresses from cross-chain transfers
v2.0.2	Aug 8, 2025	Patch: domain separator initialization fix
v2.1.0	Jan 6, 2025	EIP-1271 smart contract wallet support, dynamic DOMAIN_SEPARATOR for chain fork handling
Governance restructure	~Aug 2025–Feb 2026	Timelock deployed Jan 2026 with 24h delay; governance consolidated from multisigs to MPC wallet (Fordefi); SupplyControl admin moved from EOA to timelock; both multisigs expanded to 20 owners
v3.0 — Claimable Rewards	Feb 26, 2026	Onchain rewards system: 5 facets, 118 selectors, 6 new roles. Implementation → 0x8b73…1897 (tx), executed via the timelock
v3.0.1	Feb 28, 2026	All five facets redeployed and implementation → 0xFACd…A65f (tx). Sole source diff: added name() override on PayoutGroupFacet

Upgrade history is short and fully timelocked. The token proxy has six Upgraded events in its lifetime (Oct 2024 ×1, Oct–Nov 2024 ×2, Dec 2025 ×1, Feb 2026 ×2). Both 2026 upgrades were submitted by the MPC wallet to the TimelockController (execute, selector 0x134008d3) rather than directly — confirming the 24h delay was actually exercised, not bypassed. No upgrade has occurred since February 28, 2026. SupplyControl has been on the same implementation since October 31, 2024.

Historical Track Record

• Contract deployed: October 7, 2024 (block 20,915,336) — ~22 months in production
• Official launch: November 1, 2024
• Total supply: ~$3.47B across 6 chains with material supply (~$449M on Ethereum)
• Growth trajectory: From ~$352M (mid-2025) to ~$3.47B (August 2026) — approximately 885% growth
• 30-day change: +521.3M USDG (+18.1%)
• Security incidents: None. No exploits, hacks, or depegging events reported
• Peg stability: Over the trailing 365 days the daily close ranged $0.99943–$1.0351 and never traded below $0.995; the high print is a thin-liquidity artifact, not a premium regime CoinGecko
• Paxos track record: Paxos has operated USDP (Pax Dollar, formerly PAX) since 2018 and operates PYUSD (PayPal USD) on behalf of PayPal. No Paxos-issued stablecoin has suffered a security incident or depeg

Distribution partners: Kraken, Robinhood, Anchorage Digital, Galaxy Digital, Bullish, Nuvei, BitGo, Paysafe, GSR, KuCoin, Virtual Assets Group, Tokenize

Funds Management

Accessibility

• Minting: Available through Paxos distribution partners and direct API integration. Minting requires a Paxos account with KYC/AML verification. Not permissionless
• Redemption: Direct 1:1 redemption through Paxos (requires account). Onchain, USDG can be exchanged via DEXes or CEXes
• No onchain mint/redeem: Unlike USDC's permissionless onchain redemption, USDG minting and burning are controlled by Paxos supply controllers via the SupplyControl contract. End users cannot directly mint or burn
• Fees: No fees for minting or redeeming USDG through Paxos (standard network gas fees apply)
• Geographic restrictions: Available globally except sanctioned jurisdictions. KYC required for direct minting/redemption

Collateralization

• Backing: 100% backed by cash and cash equivalents — primarily short-duration U.S. Treasury Bills and high-quality liquid assets held in segregated accounts at regulated custodians
• Collateral quality: U.S. Treasury Bills are the lowest-risk financial instruments globally — backed by the full faith and credit of the U.S. government
• Segregation: Reserve assets are held in accounts segregated from Paxos's own operating funds, providing protection in a Paxos insolvency scenario
• Regulatory requirement: As a Major Payments Institution supervised by MAS, Paxos is required to maintain 1:1 reserves and hold them in segregated accounts
• Offchain: All reserves are held offchain at regulated banking institutions. Token holders cannot independently verify specific reserve compositions onchain

Provability

• Monthly attestation by KPMG: Paxos publishes monthly reserve composition reports verified by an independent accounting firm. Per the USDG Transparency page, all reports posted on or after February 27, 2026 are issued by KPMG LLP, whose examination is conducted under standards established by the Institute of Singapore Chartered Accountants (ISCA)
• Onchain supply: Total USDG supply is verifiable onchain via totalSupply() on each chain
• No Chainlink Proof of Reserves: No onchain oracle feed independently verifying reserves
• Offchain verification: Reserves cannot be independently verified onchain by token holders. Must rely on the attestation reports, MAS regulatory oversight, and Paxos's institutional framework
• Regulatory reporting: Paxos is subject to MAS supervisory requirements including regular regulatory reporting
• MiCA compliance: USDG claims compliance with MiCA (Markets in Crypto-Assets) framework for Electronic Money Tokens under European Banking Authority oversight

Liquidity Risk

DEX Liquidity (Ethereum)

Pool data below is the DeFiLlama yields API snapshot of August 15, 2026, filtered to genuine DEX pools (lending and yield venues are broken out separately below). n/r means DeFiLlama does not report a volume figure for that pool — it is not a claim of zero volume.

Pool	DEX	Liquidity	7d Volume
USDG/USDC	Curve	$30.48M	$25.06M
USDC/USDG	Ekubo	$1.11M	n/r
syrupUSDG/USDG	Uniswap V4	$0.99M	n/r
USDC/USDG	Uniswap V4 (2 pools)	$1.17M	n/r
USDC/USDG	Maverick V2	$0.20M	$8.38M
USDT/USDG, USDC/USDG	Ekubo (2 pools)	$0.37M	n/r
Ethereum Total	8 pools	~$34.3M

Measured slippage on the Curve USDG/USDC pool 0xc061…1622. These are live get_dy quotes read onchain on August 15, 2026, not estimates. Pool balances are 12,362,223.19 USDG / 18,112,954.31 USDC, with A = 3000 and fee = 0.01%:

Sell size (USDG → USDC)	Output	Slippage
$1,000,000	1,000,007.14	−0.001%
$5,000,000	4,999,586.52	0.008%
$10,000,000	9,997,749.77	0.023%
$15,000,000	14,989,824.96	0.068%
$17,000,000	16,968,189.65	0.187%
$20,000,000	18,091,732.58	9.541%

The high amplification coefficient keeps execution nearly flat up to ~$15M, then the curve breaks hard once the USDC side of the pool (~$18.1M) is exhausted. The practical single-pool ceiling is ~$17M. The reverse direction is comparably deep ($10M USDC → USDG at 0.137%).

DEX Liquidity (Solana)

Pool	DEX	Liquidity	7d Volume
USDG/USDC	Orca	$25.69M	$3.41M
USDG/USDC	Kamino Liquidity	$16.01M	$0.22M
SOL/USDG	Orca	$3.51M	$3.33M
USDG/ONYC	Raydium	$3.19M	$1.47M
USDG/USX	Orca	$2.99M	$0.67M
Other pairs	Orca / Kamino / others	~$14.6M	~$11.1M
Solana DEX Total		~$66.0M

A further ~$25.7M of Solana USDG sits in lending venues (Kamino Lend, Jupiter Lend, Loopscale, Sentora), which is integration depth rather than exit liquidity.

Other Chains

Robinhood Chain has become the largest DeFi venue for USDG by a wide margin — Morpho steakUSDG ($313.5M), Morpho syrupUSDG ($85.2M), Spark Savings ($35.4M), Morpho spUSDG ($35.3M) — and carries $130.7M of the token's $194.6M daily volume across Uniswap V3/V4, Ramses, and Ekubo. This depth is real but is not reachable by an Ethereum holder without crossing the LayerZero wrapper.

Aggregate Liquidity

Source	Available	Notes
DEX (Ethereum)	~$34.3M	8 pools; $10M exits at 0.023% slippage on Curve alone (measured onchain)
DEX (Solana)	~$66.0M	Orca and Kamino carry the depth
DEX (Robinhood Chain)	high volume	$130.7M/24h, but behind the bridge from an Ethereum holder's perspective
CEX	OKX ($4.55M), Bullish ($4.78M), Biconomy ($1.07M), Kraken ($0.71M), Gate ($0.14M)	~$11.3M total 24h volume
Direct redemption	Unlimited (via Paxos)	Requires KYC account, processed during business hours
Total 24h volume, all venues	$194.6M	CoinGecko

• Primary exit (permissionless): DEX swap — ~$34.3M on Ethereum, 89% of it in the Curve USDG/USDC pool. A $10M exit costs 0.023%; the single-pool ceiling is ~$17M
• CEX depth is thin. CoinGecko shows ~$11.3M across named CEX venues, and KuCoin does not list a USDG ticker. The headline $194.6M daily figure is overwhelmingly DEX volume on Robinhood Chain, not centralized order-book depth. For an Ethereum-based integrator, CEX routing is a weaker backstop than it appears
• Lending-market depth is not exit liquidity: a further ~$296M USDG sits in Ethereum lending/yield venues (Maple $262.0M, Aave v4 $64.7M supplied / $19.7M borrowed, Aave v3 $4.1M, Pendle ~$3.8M, Morpho PT-USDG $1.6M). Withdrawing depends on each market's utilization and does not add sell-side liquidity
• Primary exit (KYC): Direct 1:1 redemption from Paxos — unlimited and most capital-efficient, but requires account setup and business-hours processing
• Same-value asset: USD stablecoin — no price divergence risk from the underlying
• No withdrawal queue: DEX/CEX exits are instant. Direct Paxos redemption follows standard processing times

Centralization & Control Risks

Governance

Token governance has been restructured from a two-tier multisig model to a model consolidated under an MPC wallet with a 24-hour timelock.

Governance was restructured between August 2025 and February 2026. The 7-owner DEFAULT_ADMIN multisig and 3-of-7 operational multisig that previously held onchain roles have been fully removed from them. Governance is now concentrated in an MPC wallet (likely Fordefi), with a 24-hour timelock on upgrades and role changes — but not on pause, freeze, or bridge configuration.

MPC wallet evidence: The operations address 0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B exhibits a classic MPC custody wallet pattern:

• Gas station funding: A dedicated gas station (0x264bd8291fae1d75db2c5f573b07faa6715997b5, nonce 5.6M+, balance ~4,986 ETH, funding 62+ distinct EOAs) sends just-in-time ETH (~0.02–0.05 ETH) before each batch of operations. The account never holds large ETH balances independently.
• Rotating gas stations: Multiple funding addresses have serviced this EOA over its lifetime (0x9195, 0x4b39, 0xf492, 0xca67, 0x264bd), consistent with MPC provider infrastructure rotation.
• No single key holder: In MPC wallets, the private key is cryptographically sharded across multiple parties — no individual ever holds the full key. Transactions require internal policy-based approvals within the workspace.
• Provider: The pattern (dedicated gas station with 5.6M+ nonce, just-in-time funding, multi-address servicing) is consistent with institutional MPC custody infrastructure. Paxos's website lists "Fordefi by Paxos" — a comprehensive MPC wallet platform — in its footer navigation, indicating Paxos has a direct relationship with an MPC wallet provider. This strongly suggests Paxos uses Fordefi (or similar) MPC technology for its own operational key management.

Important caveat: The internal MPC quorum/threshold and policy configuration are not publicly verifiable onchain. The security depends on the provider's implementation and Paxos's internal policy controls (e.g., requiring multiple workspace members to approve transactions). While this is significantly stronger than a single-EOA held by one person, the exact risk profile depends on the unknown internal parameters.

⚠️ Public documentation does not match onchain state. This is a standing finding, not a footnote: every role holder published in the USDG GitHub README is wrong, and the discrepancy has stood for over a year. Verified against the README and onchain state on August 15, 2026:

README states	Onchain reality
DEFAULT_ADMIN_ROLE = 0x137Dcd… (multisig)	TimelockController 0x903656…
PAUSE_ROLE = 0x0644Bd… (multisig)	MPC wallet 0x3Af3e8…
ASSET_PROTECTION_ROLE = 0x0644Bd… (multisig)	MPC wallet 0x3Af3e8…
SUPPLY_CONTROLLER_MANAGER_ROLE = 0x0644Bd…	Not a token role; on SupplyControl it is the MPC wallet

The README further states that "the addresses above utilize multisignature contracts… Any change requires the presence of a quorum of signers in the same physical location." That is not merely stale — it describes a stronger and more specific protection than what exists. Governance is an MPC wallet whose quorum and policy are undisclosed, and neither of the two multisigs has held any role since August 2025.

The docs site documents no governance structure at all — no mention of the timelock, the MPC wallet, payout groups, or facets on either the overview or mainnet pages. An integrator relying on published documentation would model this system incorrectly, which is why it is treated as a live risk rather than a cosmetic gap.

All roles were re-verified onchain on August 15, 2026 via hasRole reads on the token, SupplyControl, and TimelockController, cross-checked against the complete RoleGranted/RoleRevoked log history of all three contracts. Every role assignment described below is current. No unexpected holder was found.

Tier 1 — Critical operations (upgrades, role management):

• TimelockController (0x9036566eAa5F83E0b9E1161C6c602b0Adf997654) with 24-hour minimum delay onchain
• Holds DEFAULT_ADMIN_ROLE and owner() on the USDG token
• Also holds DEFAULT_ADMIN_ROLE on the SupplyControl contract (SupplyControl admin no longer an EOA)
• Controls contract upgrades (UUPS upgradeTo), role granting/revoking, and facet changes
• PROPOSER_ROLE, EXECUTOR_ROLE, and CANCELLER_ROLE on the timelock are all held by the MPC wallet, and by nobody else (0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B). The timelock's entire role history is four grants on January 22, 2026 — DEFAULT_ADMIN to itself, and proposer/executor/canceller to the MPC wallet — with zero revocations since. hasRole(CANCELLER_ROLE, …) returns false for both multisigs, the token, the issuance treasury, and the timelock itself.
• There is therefore no independent canceller, which changes what the 24-hour delay actually buys. A timelock protects against a compromised admin only if some other party can cancel a malicious proposal during the delay. Here the sole party who can cancel is the same party who can propose. If the MPC key is compromised, the attacker schedules a malicious upgrade and is also the only address able to stop it; Paxos's recourse would be to act with the same key it has lost. The 24h window is best understood as a monitoring and exit window for integrators, not as a circuit breaker. That is a genuine protection — and it is worth materially more now that a $10M Ethereum exit clears at 0.023% slippage than it was when this report estimated exits above $5M needed CEX routing — but it is weaker than the rubric's "constrained by timelock" language implies. MPC policy controls mean multiple internal approvals are typically required to initiate transactions, which is the real mitigant here
• The DEFAULT_ADMIN_ROLE on the timelock is held by the timelock itself (self-administered) — the timelock can grant/revoke roles on itself

Tier 2 — Operational / emergency (pause, freeze, supply management, bridge config):

• MPC wallet (0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B) holds PAUSE_ROLE and ASSET_PROTECTION_ROLE directly on the token (no onchain timelock — but internal MPC policy likely requires multiple approvals) verified onchain
• The MPC wallet also holds SUPPLY_CONTROLLER_MANAGER_ROLE on the SupplyControl contract
• The MPC wallet is the owner() of the LayerZero OFTWrapper (0x147BdE4F997f0d4C7544ED0C55eAcf1E5E6bf9c4) and its LayerZero delegate on EndpointV2. There is no timelock on either. This is the single most consequential unmitigated power in the system: the wrapper is Supply Controller SC3 with allowAnyMintAndBurnAddress = true and 200M USDG/24h of capacity, so the same key that can call setPeer (adding a chain, or repointing an existing one) and rewrite the receive-side DVN configuration also controls a mint path to arbitrary Ethereum addresses. A compromise of this key does not require defeating the 3-of-3 DVN quorum — it can replace it
• The former operational multisig (0x0644Bd0248d5F89e4F6E845a91D15c23591e5D33) no longer holds any roles on the token, timelock, or SupplyControl
• SUPPLY_CONTROLLER_MANAGER_ROLE is not a token role at all. It is declared in SupplyControl.sol and appears nowhere in the token implementation or any of its five facets, whose role set is DEFAULT_ADMIN plus the eight constants in Roles.sol. Querying hasRole(SUPPLY_CONTROLLER_MANAGER_ROLE, …) on the token returns false for every address, but that is the trivial result for any role hash a contract does not use — it is not evidence of an unassigned role. On SupplyControl the role is held by the MPC wallet

Tier 3 — Rewards operations (V3, new since February 2026):

• Six additional roles govern the claimable-rewards system. The MPC wallet holds the four privileged ones (MULT_ADMIN, MULT_RATE, PAYOUT_GROUP_ADMIN, CLAIM_ADMIN); three hot-wallet EOAs hold MULT_RATE, PAYOUT_GROUP_REGISTRAR, and CLAIM_OPERATOR. Full table and analysis in Claimable Rewards System (V3)
• None of these roles can mint, and none can touch a holder's principal. PAYOUT_GROUP_ADMIN_ROLE and CLAIM_ADMIN_ROLE can redirect reward payouts to arbitrary destinations, bounded by the claimSource balance — a loss to Paxos and its partners, not to USDG holders
• The registrar EOA can enrol or remove any address from a payout group without that address's consent. For a Yearn vault or strategy holding USDG this is not a fund-loss path, but it does determine who receives the reward accrual on that balance

Multisig status (neither holds active governance roles):

• DEFAULT_ADMIN Multisig (0x137Dcd97872dE27a4d3bf36A4643c5e18FA40713): 20 owners, threshold 3, 43 transactions — no governance roles
• Operational Multisig (0x0644Bd0248d5F89e4F6E845a91D15c23591e5D33): 20 owners, threshold 3, 855 transactions — no governance roles

SupplyControl governance:

• DEFAULT_ADMIN_ROLE on SupplyControl is now held by the Token Admin Timelock (24h delay) — this is an improvement from the previous EOA admin
• SUPPLY_CONTROLLER_MANAGER_ROLE on SupplyControl is held by the MPC wallet 0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B
• Two EOA supply controllers (SC1, SC2) have very large mint capacities ($500M/hour and $1B/hour respectively) — but both are restricted to a single whitelisted mint destination and can only burn their own balance. See the correction note under Supply Controllers. Their practical blast radius on key compromise is inflation of one Paxos-operated address, not theft from holders
• The bridge controller SC3 is the opposite shape: unrestricted destinations, but a hard 200M USDG/24h ceiling and contract-mediated (not key-mediated) minting. Its risk is concentrated in whoever controls setPeer and the DVN config — the MPC wallet, with no timelock

Separating mandated powers from architectural ones. A regulated fiat-backed stablecoin is required to hold powers that would be red flags in a permissionless protocol, and scoring USDG down for them would double-count a trait shared by every asset in its class. It is worth stating explicitly which of USDG's admin powers fall on each side of that line, because only one side is actually informative about USDG specifically:

Power	Mandated by USDG's regulatory posture?	Comparable to USDC/USDT?
ASSET_PROTECTION_ROLE — freeze and wipe balances	Yes — sanctions and law-enforcement compliance	Yes, equivalent capability
PAUSE_ROLE — halt all transfers	Yes — standard regulatory emergency control	Yes
Permissioned mint/burn via SupplyControl	Yes — inherent to 1:1 fiat backing with KYC issuance	Yes
Upgradeable proxy	Effectively yes — compliance requirements evolve	Yes
Untimelocked ownership of the OFT wrapper (peers + DVN quorum)	No — an architecture choice	No; peers of comparable size place bridge config behind delays or multi-party control
Sole holder of proposer + executor + canceller	No — an independent canceller costs nothing to add	No
allowAnyMintAndBurnAddress = true on SC3 at 200M/24h	No — the ceiling is a business decision	Partly
Three hot-wallet EOAs on rewards roles	No	No
Undisclosed MPC quorum and policy	No — disclosure is voluntary	USDC's governance is more publicly documented

The top four rows are why USDG cannot score near the top of the governance rubric, and they are also why it should not be penalised relative to USDC — they are the price of the regulatory wrapper that makes the reserves trustworthy in the first place. The bottom five rows are the part that is specific to USDG and are not required by any regulator; they are what keep the governance score at 3.0 rather than lower.

Key governance concerns:

1. All governance consolidated into an MPC wallet — the MPC wallet (0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B) holds PAUSE_ROLE, ASSET_PROTECTION_ROLE, timelock PROPOSER+EXECUTOR+CANCELLER, and SupplyControl SCM. However, as an MPC wallet (likely Fordefi), the private key is sharded across multiple parties — no single individual can unilaterally sign transactions. The risk is comparable to a multisig with an unknown internal quorum, not a standard single-key EOA
2. 24-hour timelock is a strong improvement — the 3h delay increased to 24h, providing a meaningful monitoring window for contract upgrades. Combined with MPC policy controls, this creates defense-in-depth for critical changes
3. Emergency actions are immediate by design — PAUSE_ROLE and ASSET_PROTECTION_ROLE are exercisable onchain without delay, which is the correct design for an emergency control; the MPC wallet's internal policy layer is what governs their use
4. SupplyControl admin improvement — moving DEFAULT_ADMIN on SupplyControl from an EOA to the 24h timelock prevents unilateral addition of supply controllers
5. Freeze/wipe capability — ASSET_PROTECTION_ROLE can freeze individual addresses and wipe frozen balances. This is standard for regulated stablecoins (USDC, USDT have equivalent capabilities). The MPC wallet structure provides internal governance but the onchain capability remains unilateral from the contract's perspective
6. Internal MPC quorum unknown — while MPC is inherently multi-party, the exact number of key shards, approval threshold, and policy rules are not publicly verifiable. This is a transparency gap
7. Bridge configuration is not behind timelock — the MPC wallet owns the OFTWrapper and is its LayerZero delegate, so peer set and DVN quorum can both be changed with immediate effect, upstream of a 200M/24h mint path. Contract upgrades get 24 hours of warning; adding a new mint route does not
8. Rewards system introduces hot-wallet EOAs — three single-key EOAs hold operational rewards roles. They cannot mint or seize funds, so this is a bounded concern, but it reverses part of the 2026 consolidation away from EOA-held roles
9. Supply controller destination whitelisting is a genuine mitigant — SC1 and SC2 are whitelist-bound, which is the main reason governance is not scored higher despite items 7 and 8

Programmability

• Token: Standard ERC-20 with EIP-2612/EIP-3009 gasless support. Transfers are fully programmatic onchain
• Minting/burning: Through SupplyControl contract with rate-limited supply controllers. Onchain but Paxos-controlled (not permissionless)
• Exchange rate: Fixed 1:1 USD peg — no oracle needed for the token itself
• Reserves: Entirely offchain. Reserve management, yield generation, and reporting are handled by Paxos and its custodians with no onchain visibility into specific holdings
• Partner reward accounting is now onchain — the V3 rewards system replaced a 30-day offchain reconciliation process with onchain share/multiplier accounting settled from a funded claim source. This is a genuine programmability improvement over the model assessed in March 2026, though the reward rates (multipliers) are still set by admins rather than derived
• Pause mechanism: PAUSE_ROLE can freeze all transfers/approvals; minting/burning remain operational during pause
• Operations split: Token operations (transfers, approvals, reward accrual and claims) are onchain and programmatic. Reserve operations (investment, custody, yield generation) are entirely offchain and centralized

External Dependencies

• No DeFi protocol dependencies — USDG is a standalone stablecoin, not dependent on any external DeFi protocols
• Banking infrastructure — reserves held at regulated custodians (inherent to fiat-backed stablecoins)
• LayerZero V2 — cross-chain bridging via OFTWrapper to Solana, X Layer, Ink, Arbitrum, and Robinhood Chain. Still non-critical for Ethereum-only usage — an Ethereum holder's balance does not depend on the bridge — but the exposure has grown on two axes since the last assessment: ~87% of total supply now sits on chains reachable through this wrapper, and the inbound receive path can mint canonical USDG on Ethereum up to 200M USDG/24h (raised from 45M in four steps between March and June 2026). The wrapper's owner/delegate is the MPC wallet with no timelock
• Curve/Uniswap — DEX liquidity for secondary market exits (not a protocol dependency, but relevant for exit liquidity)

Operational Risk

• Team: Paxos was founded in 2012 by Charles Cascarilla (CEO) and Rich Teo (co-founder). Paxos is a well-established, regulated fintech company with 200+ employees
• Track record: Operates multiple stablecoins: USDP (since 2018), PYUSD (PayPal USD, since 2023), USDG (since 2024). No security incidents across any Paxos stablecoin
• Regulation: Paxos Digital Singapore Pte. Ltd. (PDS) — the issuer of USDG — is a Major Payments Institution supervised by the Monetary Authority of Singapore. USDG also claims MiCA compliance via the EU entity
• US entity is now OCC-supervised, not NYDFS (corrected — resolves issue #388). On December 12, 2025 the Office of the Comptroller of the Currency conditionally approved the application of Paxos Trust Company, LLC (a New York state trust company) to convert to an uninsured national trust bank, operating as Paxos Trust Company, National Association under OCC Charter Number 25379 (OCC conditional approval letter, OCC decision document, Paxos announcement). All of Paxos Trust Company's US-based activity is now subject to OCC supervision rather than NYDFS. Two qualifications matter for risk purposes: (a) the bank does not take deposits and is not FDIC-insured; (b) the conversion covers the US entity behind PYUSD and PAXG — USDG's issuer remains PDS in Singapore under MAS, so USDG's direct regulator is unchanged. The correct framing is that the Paxos group's US supervision moved from state to federal, which strengthens the group-level regulatory picture without altering USDG's own licensing
• Documentation: Comprehensive documentation at docs.paxos.com covering integration guides, API reference, and contract addresses. Source code is MIT-licensed and publicly available on GitHub. Gaps: the GitHub README's role-holder list is stale by more than a year, and neither the docs site nor any public post documents the 2026 governance restructure or the V3 rewards system
• Legal structure: Paxos Digital Singapore Pte. Ltd. (Singapore entity, issuer of USDG), with Paxos Trust Company, N.A. (US federal trust bank, issuer of USDP/PYUSD/PAXG) and Paxos Issuance SARL (EU entity) as sister companies

Monitoring

Key Contracts to Monitor

Contract	Address	Monitor
USDG Token	0xe343167631d89B6Ffc58B88d6b7fB0228795491D	totalSupply(), paused(), Transfer events, Mint/Burn events
SupplyControl	0x9a7164112029b81c07636AB7b59fA813E0883BBF	Supply controller additions/removals, rate limit changes
TimelockController	0x9036566eAa5F83E0b9E1161C6c602b0Adf997654	CallScheduled, CallExecuted events (24h delay — gives monitoring window)
Operational Multisig	0x0644Bd0248d5F89e4F6E845a91D15c23591e5D33	Submitted/executed transactions (currently role-less; any re-grant is notable)
Operations MPC Wallet (all governance)	0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B	Any transactions — controls pause, freeze, timelock scheduling, supply controllers, and the OFT wrapper's peers + DVN config. MPC wallet (likely Fordefi) — key sharded across multiple parties. Monitor for unexpected transactions
OFTWrapper (SC3)	0x147BdE4F997f0d4C7544ED0C55eAcf1E5E6bf9c4	PeerSet events (new/changed chains), OwnershipTransferred, DelegateSet on EndpointV2, and receive-library/DVN config changes. Highest-leverage surface in the system that is not behind a timelock
Issuance Treasury / Gas Station	0x264bd8291fae1d75db2c5f573b07faa6715997b5	SC1's only permitted mint destination and the MPC gas funder. Monitor large USDG inflows (new issuance) and unusual ETH outflows (possible MPC key migration or provider change)

Critical Events to Monitor

• Pause events — Paused/Unpaused on the token — all transfers stop when paused (MPC wallet can trigger immediately, but internal policy likely requires multiple approvals)
• Freeze events — individual address freezes via ASSET_PROTECTION_ROLE — could affect DeFi integrations (MPC wallet, no onchain timelock)
• Supply changes — large mints/burns (>5% of supply in 24h) could indicate operational issues
• Contract upgrades — Upgraded events via UUPS proxy — 24h timelock provides advance notice via CallScheduled
• Supply controller changes — SupplyControllerAdded/Removed via SupplyControl — SCM role held by MPC wallet, admin role under 24h timelock
• Rate limit changes — LimitConfigUpdated. SC3's capacity has been raised seven times since launch (10M → 200M); each raise widens the bridge's inbound mint blast radius
• Mint destination whitelist changes — MintAddressAddedToWhitelist / RemovedFromWhitelist and AllowAnyMintAndBurnAddressUpdated. Zero of these have ever fired. Any first occurrence — especially flipping allowAnyMintAndBurnAddress to true on SC1 or SC2 — would remove the principal mitigant on the EOA supply controllers and should be treated as a high-priority alert
• OFT peer and DVN changes — PeerSet on the wrapper and receive-config changes on EndpointV2. Untimelocked, upstream of a 200M/24h mint path
• Timelock events — CallScheduled gives 24h advance notice of all critical admin changes
• Facet changes — FacetUpdate(bytes4,address) events indicate functional changes to the token contract without a proxy upgrade
• Rewards system events — PayoutGroupCreated/Deleted, PayoutGroupDestinationSet, AccountRegistered/Deregistered, ClaimSourceSet, MultiplierRateScheduled. Integrators holding USDG should watch AccountRegistered for their own vault/strategy addresses, since registration is registrar-initiated and does not require consent
• MPC wallet transactions — any transaction from 0x3Af3e85f4f97De7AD0f000B724Fb77fE5ffc024B — controls all governance actions. MPC structure provides multi-party security, but the address remains the single onchain governance point
• Rewards hot-wallet EOAs — transactions from 0x4e43…eef8, 0x55f7…9684, 0x5fd9…2e38

Monitoring Functions

Function	Contract	Purpose	Frequency
totalSupply()	Token	Supply tracking	Every 6 hours
paused()	Token	Operational status	Hourly
isFrozen(address)	Token	Address freeze status	On integration
getSupplyControllerConfig(address)	SupplyControl	Capacity, refill rate, whitelist, allowAnyMintAndBurnAddress	Daily
getAllSupplyControllerAddresses()	SupplyControl	Detect a fourth controller being registered	Daily
getMinDelay()	TimelockController	Timelock delay changes (currently 24h)	Weekly
owner()	OFTWrapper	Bridge admin key rotation	Daily
peers(uint32)	OFTWrapper	New/changed bridge routes	Daily
getFacet(bytes4)	Token	Facet routing changes	On FacetUpdate
payoutGroupIdOf(address)	Token	Whether your own vault/strategy has been enrolled in a payout group	On integration, then weekly
hasRole(CANCELLER_ROLE, …)	TimelockController	Whether an independent canceller has been added (improvement) or the sole-holder setup persists	Weekly
Role events	Token / SupplyControl / TimelockController	Monitor RoleGranted/RoleRevoked — contracts use plain AccessControl, so holders cannot be enumerated and must be reconstructed from logs	On change

Reassessment Triggers

• Time-based: Reassess in 6 months (February 2027)
• TVL-based: Reassess if total supply changes by more than ±50% from current $3.47B
• Incident-based: Reassess after any exploit, freeze affecting DeFi protocols, depegging event, or adverse regulatory action
• Governance-based (IMPORTANT): Reassess if governance transitions from MPC wallet back to multisig (score improvement), or if MPC wallet shows signs of compromise. Any change in role holders, timelock delay, or MPC provider/gas station infrastructure warrants reassessment
• Independent canceller (score improvement): Reassess if CANCELLER_ROLE on the timelock is granted to any party other than the MPC wallet. This is the cheapest change Paxos could make that would meaningfully improve the governance score — it would convert the 24h delay from a monitoring window into an actual circuit breaker. Conversely, reassess if the sole-holder configuration is extended to any newly-deployed governance contract
• MPC transparency: Reassess if Paxos discloses MPC provider, quorum, and policy configuration (potential score improvement from reduced uncertainty)
• Governance-based: Reassess if SupplyControl admin or SCM transitions, or if multisig composition/threshold changes
• Bridge-based (IMPORTANT): Reassess on any PeerSet event adding or repointing a chain on the OFT wrapper, any change to its owner() or LayerZero delegate, any receive-library/DVN configuration change, or any further increase to SC3's mint capacity beyond 200M USDG/24h
• Supply-controller scope: Reassess immediately if AllowAnyMintAndBurnAddressUpdated fires for SC1 or SC2, or if a mint-destination whitelist changes. None of these events has ever occurred; the first would remove the principal mitigant on the EOA supply controllers
• Rewards system: Reassess if the claimSource changes, if rewards roles move to or from EOAs, if partner-signed registrations are enabled, or if a Yearn-controlled address is registered into a payout group
• Regulatory-based: Reassess if MAS takes enforcement action, if Paxos loses its MPI license, if the OCC modifies or rescinds the conditional approval of Charter 25379, or if USDG issuance moves between legal entities
• Bug bounty: Reassess if the Cantina program opens to the public (further improvement) or is discontinued (deterioration)
• Proof of Reserves: Reassess if onchain reserve verification (e.g., Chainlink PoR) is deployed (score improvement)
• Attestation: Reassess if the attestor changes from KPMG LLP or the monthly cadence lapses
• Documentation (score improvement): Reassess if Paxos brings public documentation into sync with onchain state. Operational Risk is held at 1.5 solely by the documentation column; reaching 1.0 requires (a) correcting the four role rows in the usdg-contract README, (b) removing the "quorum of signers in the same physical location" claim, and (c) documenting the governance model (timelock delay, MPC wallet, which powers are timelocked and which are immediate), the V3 rewards system, and the bridge's supply-controller role and mint ceiling

---

Appendix A — USDG Risk as a Held Asset in yvUSD

Context: yvUSD is a USDC-denominated Yearn V3 vault that deploys USDC into multiple yield strategies. This appendix assesses the risk of including USDG as an asset held within yvUSD strategies — e.g., lending USDC against USDG collateral in Morpho markets, or holding USDG positions as part of yield strategies.

Risk Assessment for yvUSD Exposure

Depeg Risk: LOW

• USDG is backed 1:1 by cash and U.S. Treasury Bills at regulated custodians under MAS supervision
• Paxos has a 7+ year stablecoin track record with zero depegging incidents across USDP, PYUSD, and USDG
• Strong peg stability observed: price consistently at $0.999-$1.000
• Risk is comparable to holding USDC — both are regulated fiat-backed stablecoins

Smart Contract Risk: LOW-MEDIUM

• 6 audits from reputable firms, source code is open and verified
• UUPS upgradeable proxy with 24h timelock + MPC wallet governance
• Diamond-like facet pattern adds upgradeability surface area
• Contract complexity is moderate (standard ERC-20 + AccessControl + rate-limited supply)

Freeze Risk: MEDIUM

• Paxos can freeze any address and wipe frozen balances via ASSET_PROTECTION_ROLE (held by MPC wallet)
• If a Yearn vault or strategy contract holding USDG gets frozen, those funds become inaccessible until unfreezing
• This is the same risk profile as USDC (Circle can freeze addresses) — it has never been used against DeFi protocols but the capability exists
• Mitigation: Ensure the vault/strategy addresses are known to Paxos and not on any sanctions list

Liquidity Risk for yvUSD: LOW

• Ethereum DEX liquidity (~$34.3M) with measured execution: $10M exits at 0.023% slippage, $15M at 0.068% on the Curve USDG/USDC pool alone
• The practical single-pool ceiling is ~$17M; beyond that, route across the other seven Ethereum pools or use Paxos redemption
• Given yvUSD's scale, USDG liquidity is comfortably adequate — liquidity is not the binding constraint on this integration

Rewards enrolment: a yvUSD strategy address holding USDG can be registered into a Paxos payout group by the PAYOUT_GROUP_REGISTRAR_ROLE EOA without consent. This does not move or encumber the strategy's principal, but it routes the reward accrual on that balance to the group's configured destination — potentially a third party. Check payoutGroupIdOf(<strategy>) on the token at integration time and monitor AccountRegistered events for Yearn-controlled addresses.

Overall Assessment for yvUSD: USDG is a suitable stablecoin asset for yvUSD strategies. Risk is comparable to other regulated stablecoins. Position sizing should be driven by freeze risk and issuer concentration rather than by exit depth, which is ample at current scale.

Risk Factor	Level	Notes
Depeg	Low	Regulated, T-Bill backed, KPMG-attested; never below $0.995 in 365 days
Smart Contract	Low-Medium	6 audits + $1M bounty, but upgradeable, and V3 added 118 facet-routed selectors on a light audit engagement
Freeze	Medium	Standard for regulated stablecoins, never used vs DeFi
Liquidity	Low	~$34.3M DEX; $10M exits at 0.023% measured onchain
Rewards enrolment	Low	Non-custodial, but a registrar EOA can redirect reward accrual on a held balance
Overall	Low-Medium	Suitable; freeze risk, not liquidity, is the binding constraint

Appendix B — USDG Risk as Collateral for yvUSDC-1 Lending

Context: yvUSDC-1 is a USDC-denominated Yearn V3 vault that deploys USDC into lending strategies. This appendix assesses the risk of lending USDC against USDG as collateral — e.g., in Morpho markets where borrowers post USDG to borrow USDC.

Risk Assessment for Lending Against USDG

Collateral Quality: HIGH

• USDG is 1:1 backed by U.S. Treasury Bills — same quality as USDC collateral
• Regulatory framework (MAS supervision) provides strong assurances on reserve integrity
• No history of depegging or reserve shortfalls
• Appropriate for same-value lending (USDG collateral for USDC borrows)

What the major lending markets actually do with USDG

Every major Ethereum lending market assigns USDG a collateral factor of zero — it is listed as a borrowable/supply asset, not as collateral. Read onchain August 15, 2026:

Venue	USDG role	LTV / Collateral Factor	Liquidation threshold	Notes
Aave v3 (Ethereum)	Borrow-only	0	0	usageAsCollateralEnabled = false, borrowingEnabled = true, active, not frozen. Borrow cap 100M, supply cap 120M, reserve factor 20%. Read via AaveProtocolDataProvider.getReserveConfigurationData on 0x0a16…bECD
Aave v4 (Core spoke 0x94e7…c485)	Borrow-only	collateralFactor = 0	maxLiquidationBonus 10000 (= 1.0×), liquidationFee 0	Reserve id 11. 64,683,806.35 USDG supplied, 19,662,983.50 borrowed. Same treatment as EURC, RLUSD, frxUSD, GHO in that spoke — while USDC and USDT both carry CF 7800
Morpho Blue (Ethereum)	Loan asset only	n/a	n/a	Zero markets use USDG as collateral. Three dust-sized markets (WBTC, wstETH, cbBTC collateral) borrow USDG at 86% LLTV
Maple	Lending pool asset	n/a	n/a	$262.0M syrupUSDG — the largest single USDG venue on Ethereum

The pattern is unambiguous and consistent across independent risk managers: USDG is treated as a good asset to lend and a poor asset to collateralize, most plausibly because of the freeze/wipe capability discussed below rather than because of any depeg concern. Aave's own risk process assigns USDC and USDT an 78% collateral factor in the same spoke where USDG gets zero.

Liquidation Risk: MEDIUM

• DEX liquidation path: the Curve USDG/USDC pool ($30.5M liquidity) is the primary liquidation venue on Ethereum. Measured onchain: a $10M liquidation executes at 0.023% slippage and a $15M liquidation at 0.068%
• Liquidation depth vs exposure: the hard constraint is the ~$18.1M USDC side of the pool. A $20M single-block liquidation would incur ~9.5% slippage; positions above ~$15M need multi-block execution or routing across the other seven Ethereum pools
• Same-value asset: Since USDG and USDC are both USD stablecoins, liquidation is essentially a stablecoin-to-stablecoin swap — much lower risk than volatile collateral liquidations

Freeze Risk for Lending: MEDIUM-HIGH

• If USDG collateral in a Morpho vault gets frozen by Paxos, the lending protocol cannot liquidate that collateral
• This creates bad debt risk: the borrower defaults, but the collateral is frozen and cannot be seized/sold
• This is the most significant risk for lending against USDG — the freeze capability creates a scenario where collateral becomes illiquid and unliquidatable
• Mitigation: This risk exists for all regulated stablecoins (USDC, USDT) used as collateral and has never been triggered against DeFi protocols. MAS supervision provides accountability

Counterparty Risk: LOW

• Paxos is well-regulated with zero incidents — very low probability of voluntary freeze of legitimate DeFi contracts
• Involuntary freezes (law enforcement, sanctions) would target specific addresses, not the broad DeFi ecosystem
• Regulatory clarity is improving, reducing the probability of blanket DeFi restrictions

Overall Assessment for yvUSDC-1: USDG is acceptable as lending collateral on its own merits — T-Bill backing, a clean 22-month peg record, and deep same-value liquidation liquidity. The parameters below are conservative because no major venue currently lends against it at all: where USDG is used in production, it is as the loan asset, not the collateral.

Risk Factor	Level	Notes
Collateral Quality	High	T-Bill backed, MAS-supervised issuer, KPMG-attested, 1:1 with USD
Liquidation	Low-Medium	~$30.5M Curve depth; $10M liquidates at 0.023%, but a hard cliff past ~$17M
Freeze (Collateral)	Medium-High	Frozen collateral = unliquidatable = bad debt risk
Market acceptance	Notable	Aave v3, Aave v4, and Morpho all assign USDG zero collateral factor on Ethereum
Counterparty	Low	Paxos well-regulated, zero incident history
Overall	Medium	Acceptable at conservative parameters; note that no major venue currently agrees

Recommended parameters for lending against USDG:

• Max LTV: 80% — the freeze/wipe capability is the binding consideration: if Paxos freezes a borrower's collateral, the position becomes unliquidatable at any LTV, so the buffer is protecting against an event that LTV cannot actually mitigate. An 80% ceiling keeps the position economically sensible for a same-value pair while acknowledging that every major independent risk manager has declined to lend against USDG at all
• Liquidation threshold: 85%
• Max exposure: min($5M, 25% of Ethereum USDG DEX liquidity, 10% of total vault TVL) — the DEX-liquidity fraction is set at 25% because the Curve pool's usable depth is bounded by its ~$18.1M USDC side, not by its ~$30.5M headline TVL
• Prefer the market-standard shape: if the objective is USDG exposure rather than USDG collateral, supplying USDG as a loan asset (Aave v3/v4, Maple, Morpho) matches how every major venue has chosen to underwrite it
• Monitor: Paxos freeze events (ASSET_PROTECTION_ROLE), Curve pool USDC-side balance rather than headline TVL, USDG peg, and any change in Aave/Morpho collateral-factor configuration — a venue enabling USDG as collateral would be a meaningful signal to revisit these parameters upward