ethena.fi
Summary
Ethena is a ~$5B synthetic-dollar protocol issuing USDe (delta-neutral, CEX-hedged) and sUSDe (yield-bearing stake), plus treasury-backed USDtb and the ENA governance token across 14+ chains. Core USDe minting and staking contracts are verified, heavily audited, and controlled by a 5-of-10 multisig—but documentation claims 7 signatures and 7-day timelocks that do not exist on-chain. The largest on-chain red flag is USDtb: its upgradeable proxy is controlled by a single EOA, not a multisig. USDe backing depends on off-chain CEX hedging and custodians that smart-contract audits cannot fully cover; the Feb 2025 Bybit incident briefly depegged USDe and triggered ~$22M in Aave liquidations despite no reported backing loss. Overall risk is moderate (5.7/10).
Trust Assumptions
Users must trust that a 5-of-10 Dev Multisig (not the documented 7-of-7) will not abuse immediate admin powers over USDe minting, sUSDe staking, ENA inflation (up to 10% annually), and blacklist/redistribution controls. USDe's $1 peg requires centralized exchanges to remain solvent and operational, whitelisted custodians (e.g., Copper ClearLoop) to hold collateral safely, and Ethena's off-chain hedge book to stay delta-neutral—none of which is enforceable in smart contracts. Cross-chain USDe on 14+ chains depends on LayerZero bridge integrity and per-chain multisigs that can reconfigure peers without timelock. USDtb holders additionally trust a single EOA admin and ~90% BlackRock BUIDL treasury concentration. ENA holders rely on discretionary airdrop campaigns and an approved-but-unimplemented fee switch, not contractual revenue share.
What Could Go Wrong
A CEX counterparty failure or hedge mismatch could impair USDe backing—the Bybit hack already stressed ~20% of CEX collateral, depegging USDe to ~$0.96–$0.994 and causing ~$22M Aave liquidations before Ethena settled PnL in 90 minutes. The USDtb EOA admin could upgrade the token implementation instantly to mint, pause, or blacklist without multisig delay—a structurally different and more centralized risk profile than core USDe. Compromise of the 5-of-10 Dev Multisig or GATEKEEPER EOAs could halt mint/redeem, seize sUSDe via blacklist redistribution, or misconfigure LayerZero bridge peers to mint unbacked tokens on L2s. Heavy insider ENA vesting (~40M tokens/month through 2028), yield-compressed sUSDe (~3–4% APY vs ~18% in 2024), and points-driven mercenary capital create secondary-market depeg and TVL flight risk, as seen in the Oct 2025 flash crash ($0.97) and repeated web2 incidents (Discord Sep 2024, domain drainer Sep 2024).
Recommendation
USDe/sUSDe exposure is defensible for risk-tolerant allocators given strong audit coverage (14+ reviews, $3M Immunefi bounty), zero core contract exploits, and demonstrated crisis response on Bybit—but size positions assuming off-chain hedge and custodian dependencies, not just on-chain code quality. Treat USDtb as a separate, higher-centralization product until its EOA admin is replaced with a multisig and timelock. Avoid using Ethena tokens as collateral in leveraged DeFi loops given composability losses (~$12.9M Balancer BEX tripool, Nov 2025). Monitor CEX hedge concentration, USDe peg deviation, insider ENA unlocks, fee-switch implementation, and any changes to multisig signers or bridge peer configuration. Reduce exposure if documentation continues to overstate on-chain protections relative to verified contract reality.
Key Findings (30)
Analysis Sections
Ethena's core USDe stack is controlled by a 5-of-10 Gnosis Safe (Dev Multisig) with no on-chain timelock. Documentation claims 7-of-7 signatures and 7-day timelocks that are not enforced in verified contracts. USDtb uses separate governance: minting is controlled by a distinct 5-of-11 Safe, but the USDtb token proxy and ProxyAdmin are owned by a single EOA. ENA "governance" is primarily off-chain committees; on-chain ENA inflation is controlled by the Dev Multisig.
Findings (11)
USDtb (0xC139190F447e929f090Edeb554D95AbB8b18aC1C) is a TransparentUpgradeableProxy whose ProxyAdmin (0x3c405f68d5c6ece868e5646cac926679839acd68) is owned by EOA 0xd93826bb299765c87d13aeba2a7e5d9b27a03956. The implementation owner()/DEFAULT_ADMIN is the same EOA. This key can upgrade the token implementation, pause/unpause, and grant mint/burn/blacklist roles without multisig or timelock.
Ethena documentation states the protocol multisig requires 7 signatures from distributed stakeholders. On-chain, the primary Dev Multisig is configured as 5-of-10. This mismatch reduces transparency for users relying on published trust assumptions.
Verified Ethena contracts implement SingleAdminAccessControl and Ownable2Step but contain no TimelockController, delay parameters, or schedule/execute patterns. Documentation asserts 7-day timelocks on core admin and GATEKEEPER changes; this protection is not verifiable on-chain and may only exist as off-chain operational policy.
On-chain verification shows the Dev Multisig (0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862) holds DEFAULT_ADMIN_ROLE or owner() on USDe, EthenaMinting V2, StakedUSDeV2, ENA, Ethereum LayerZero OFT adapters, and StakingRewardsDistributor. The Safe requires 5 of 10 signatures. No timelock contract or delay modifier exists in verified source code; admin actions including transferAdmin(), setMinter(), collateral changes, and bridge peer configuration can execute immediately once a Safe transaction passes.
USDtbMinting (0xa3DDBf92077b850E29C4805Df0a2459Ae048416a) DEFAULT_ADMIN is a separate 5-of-11 Gnosis Safe (0xe897d8620d5eba2c8ecaaf0ada191a23230ab8ec), not the Dev Multisig. This reflects the BlackRock/Anchorage partnership structure but creates a split governance surface: USDe and USDtb products have different admin keys and signer sets.
EthenaMinting V2 defines a GATEKEEPER_ROLE that can disableMintRedeem() and revoke MINTER/REDEEMER/COLLATERAL_MANAGER roles without re-enable authority. Documentation assigns this to EOAs at Ethena Labs and external security firms for rapid response. This is an intentional circuit breaker but concentrates emergency power outside the multisig admin path.
StakedUSDeV2 grants DEFAULT_ADMIN (Dev Multisig) and blacklist managers the ability to restrict addresses and call redistributeLockedAmount() to move locked sUSDe from restricted wallets to arbitrary unrestricted addresses. Admin can also rescueTokens(). These are powerful compliance controls but create custodial risk if admin keys are compromised.
Despite ENA being marketed as a governance token with committee-based off-chain governance (Snapshot, Risk Committee), on-chain ENA mint() is onlyOwner and owner is the Dev Multisig. Owner can mint up to 10% of total supply once per year. Tokenholder votes do not gate this inflation path.
Ethereum USDeOFTAdapter owner is the Dev Multisig, but Arbitrum and Base USDeOFT owners are separate chain-local 5-of-10 Safes (0xc9647361742Eb964965B461C44Bdf5c4Bc3c406d on Arbitrum, 0xbC89D10EB486b6591583F218acB9545087dBF293 on Base). Signer sets largely overlap with the Dev Multisig (10/10 shared signers on Arbitrum), but distinct Safe contracts mean bridge peer misconfiguration on L2 requires a separate multisig transaction.
StakingRewardsDistributor (0xf2fa332bd83149c66b09b45670bce64746c6b439) and Arbitrum ENAOFT (0x58538e6A46E07434d7E7375Bc268D3cb839C0133) lack verified source in Etherscan. StakingRewardsDistributor owner is the Dev Multisig on-chain, but bytecode cannot be independently audited from this repo.
Ethena documentation and StakedUSDeV2 comments reference Ethena DAO governance for yield allocation, but on-chain control of core contracts remains multisig-based. Ethena Foundation operates Risk and other committees via Snapshot elections. Users should not assume ENA token voting directly controls minting, collateral, or upgrade parameters.
Governance Checklist
Key Admin Entities
On-Chain Ownership (Ethereum)
| Contract | Admin / Owner | Admin Type |
|---|---|---|
| USDe | 0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862 | Gnosis Safe 5/10 |
| EthenaMinting V2 | 0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862 | Gnosis Safe 5/10 (DEFAULT_ADMIN) |
| StakedUSDeV2 | 0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862 | Gnosis Safe 5/10 (DEFAULT_ADMIN) |
| ENA | 0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862 | Gnosis Safe 5/10 |
| USDe minter | 0xe3490297a08d6fc8da46edb7b6142e4f461b62d3 | EthenaMinting V2 contract |
| USDtb (proxy) | 0xd93826bb299765c87d13aeba2a7e5d9b27a03956 | EOA |
| USDtb ProxyAdmin | 0xd93826bb299765c87d13aeba2a7e5d9b27a03956 | EOA |
| USDtbMinting | 0xe897d8620d5eba2c8ecaaf0ada191a23230ab8ec | Gnosis Safe 5/11 |
| USDeOFTAdapter (ETH) | 0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862 | Gnosis Safe 5/10 |