Proposer: Stake DAO Association - Curation working group
LMAP Framework reminder
| Parameter | Value |
|---|---|
| Forum debate period | 72 hours |
| Voting period | 72 hours |
| Debate and vote | Concurrent (debate and vote run in parallel) |
| Quorum | 15% of total vlSDT supply |
| Approval threshold | Simple majority (>50% of votes cast, excl. abstentions) |
| Anticipated execution | If super-quorum is reached |
Proposal Summary
This proposal sets the risk grade and allocation terms for Metronome Synth USD (msUSD), assessed as the variable leg of the frxUSD/msUSD Curve LP used as collateral in the Stake DAO frxUSD v2 vault. The borrowable asset (frxUSD) is not assessed.
| Item | Value |
|---|---|
| Vault | Stake DAO frxUSD v2 |
| Collateral | frxUSD/msUSD Curve LP (via Stake DAO) — assessed asset: msUSD |
| msUSD token (mainnet) | 0xab5eB14c09D416F0aC63661E57EDB7AEcDb9BEfA |
| Collateral / Curve LP token | 0xA31b5941F2e74d89bDC66632959FE6A152692920 |
| Morpho market id | 0x328aadb887d060f3d03727f6baaee56ed88570a97dc2ab49b2064a9410ccfd06 |
| LLTV | 91.5% |
| Cap (vault asset) | 3,370,000 frxUSD |
| Issuer | Metronome (Bloq / Autonomous Software) |
| Pre-assessment screening | PASS |
| Layer | Grade | Driver |
|---|---|---|
| Asset rating (msUSD) | C (theoretical) | Admin capabilities — red flag (see below) |
| Platform rating | S (5) | Curve 5 / Stake DAO 5 |
| Market rating | B (3) | Healthy pool; Relatively high cap v/s total pool size |
| Red flags | 2 | Admin capacities and Audit scope |
| Final theoretical grade | C | Worst layer = Asset rating |
Decision proposed: the theoretical grade is C, constrained by the overly flexible admin capacity. Given (i) the strong, fully-doxxed issuer / high social score and (ii) the nature of the limiting factors (in other words, the main risk is a risk of rug pull by the team, which is reputable, doxxed, and operates through a US-based company), we suggest exceptionally allowing for a provisional B grade, while giving time to the Metronome team to perform the necessary changes. If the two conditions below are not met by 31st August 2026, the grade will be downgraded to C and funds will be de-allocated from the market following a second LMAP to revise the grade.
Detail of the risk assessment and grade computation can be found here.
2. Background & Current Position
msUSD is already used as collateral in the frxUSD v2 vault and the protocol has live exposure. The reassessment was triggered by a deeper review of msUSD’s minting and strategy-routing architecture, which surfaced a centralisation red flag at the asset layer. Per the downgrade policy, an asset reassessed to grade D/C is subject to governance review; this LMAP formalises the outcome and a conditional remediation path that avoids an abrupt de-allocation.
3. Asset Overview — msUSD
msUSD is a USD-pegged, over-collateralised synthetic (CDP-type) issued by Metronome Synth. It is not a reserve-backed stablecoin: it is protocol debt, created either (a) by users borrowing against collateral, or (b) by an Algorithmic Market Operations (AMO) contract pre-minting msUSD into external Morpho markets (MIP-24, Septmber 2025) so it can be borrowed in a standard CDP fashion.
Global circulating supply is approximately $25M (sum of per-chain ERC-20 supply: Ethereum ~13.8M, Base ~10.3M, Optimism ~1.0M, Hemi ~0), consistent with a ~$25.7M market cap. A large share (~$20M) is AMO-minted inventory routed into the Gauntlet-curated Morpho msUSD vault via a Vesper strategy.
4. Risk Assessment Summary
As mentioned above, the overall grade is constrained by the Asset layer which scores a C grade.
The Asset layer is graded on the worst of its pillars. The binding constraint is the Asset pillar technical criterion which is dragged down by Admin capabilities scoring a red flag (grade D / 1) and caps the asset rating at C (see the spreadsheet for a deeper understanding of the grading mechanisms).
Asset layer recap
| Pillar | Criterion | Rationale | Criterion grade |
|---|---|---|---|
| Issuer | Social | Fully-doxxed team (Bloq), Jeff Garzik / Matt Roszak / Zane Huffman; live since 2018; low turnover | S |
| Issuer | Decentralisation | Snapshot governance; execution by multisig; internal holders <15% of locked MET | B |
| Asset | Technical | msUSD mintable with no timelock; upgradeable proxies controlled by a 3/5 Safe; strategy recipient changeable by a Vesper 3/6 multisig. => red flag. All governances held by 3/5 or 3/6 multisigs with similar signers. Over-collateralised CDP; collateral on-chain, msUSD not 1:1 redeemable by holders | C |
| Asset | Bridge risk | Only bridge is Layer 0. msUSD is built as an OFT. Ownership of the bridge is a similar multisig on all chains (Metronome’s 0xd1DE…). | S |
| Operational risk | Lindy | AMO mint-into-Morpho path live since ~Sept 2025 (~9 months) | B |
| Operational risk | Audits | Core + AMO audited (Resonance/Halborn); deployed ≈ audited; Vesper ERC4626 strategy claimed audited but not publicly verifiable => red flag | D |
| Operational risk | Bug bounty | Immunefi, live since 2023, max $50k, bounties paid | S |
| Operational risk | External ratings | Pharos: C+ (every category received a great grade except the decentralisation one which scored D, dragging the grade into C+. It’s still higher than a lot of comparable stable coins). Skynet: msUSD not rated, but Metronome rated BBB (70/100). | B |
| Operational risk | Peer reviews | Gauntlet curates the msUSD Morpho markets | B |
5. Key Risk Findings
5.1 Binding red flag — minting & routing without timelock
- msUSD supply cap (maxTotalSupply), AMO cap (maxAmoSupply) and bridge caps are governor-settable via onlyGovernor functions, with no timelock. The governor is a single 3-of-5 Gnosis Safe (0xd1DE3F9CD4AE2F23DA941a67cA4C739f8dD9Af33) with no on-chain guard or timelock module.
- Day-to-day minting is performed by a keeper (onlyAuthorized) via the AMO; the destination Vesper pool is set by the governor (updateVesperPool). The Vesper vamsUSD vault that can change the strategy is governed by a 3-of-6 multisig (bare majority).
- All relevant contracts (msUSD token, AMO minter, ProxyOFT bridge) are upgradeable proxies. Net effect: a single 3/5 can raise caps, change the strategy/recipient, or upgrade logic with immediate effect. This is the red flag driving the theoretical C.
- Potential attack vector: Minted funds could be routed to an attacker-controlled recipient via an instant updateVesperPool / strategy change, or extracted via an immediate proxy upgrade of the token or AMO contract. .
5.2 Mitigants
- Global / per-chain / bridge supply caps; Morpho markets carry their own timelocks; collateral allocation is controlled by Gauntlet (separation of duties from the minting multisig).
- Metronome team claims good operational security (hardware-wallet signers, no-blind-signing policy and third-party transaction screening), but we cannot verify.
- Strong, fully-doxxed issuer with a multi-year track record; live since 2018.
- What would really mitigate the risk regarding the admin capabilities would be to implement the two improvements listed below.
6. Recommendation & Conditional Decision
Theoretical grade: C — eligible only for Partner vault mandates under the standard policy.
Provisional grade: B — maintained for a 2-month remediation period, supported by the strong issuer profile and the nature of the red flag (risk of rug pull by the team due to the absence of timelock in the minting and allocation process). The existing live allocation is the reason for an orderly remediation window rather than immediate de-allocation; it is not a factor in the grade itself.
Cap & LLTV: Reduced from the current allocation (cap 3,370,000 frxUSD; LLTV 91.5%). No new top-up beyond the current cap is recommended until remediation is confirmed.
7. Conditions & Timeline
Metronome is given until the 31st of August 2026 (2 months) to implement BOTH of the following:
- Implement a timelock on strategy changes (the contract authority able to add/remove or re-point the msUSD routing strategy).
- Move the msUSD minter authority from the current 3-of-5 to a 4-of-7 multisig.
The rationale for those two recommendations is that the Asset pillar’s grade is calculated using the rounded down average of the grade of Admin capabilities, Governance security, and Reserves auditability. The implementation of those two recommendations would raise both the Admin capabilities and Governance security grades by one point, allowing the Asset pillar’s grade to reach B score.
Failure condition: if either condition is unmet by the deadline, the asset grade is downgraded to C and msUSD is de-allocated from this market following a follow-on LMAP, with depositors notified via the Stake DAO governance forum per the downgrade policy.
Re-rating: upon verified completion of both conditions, the provisional B is confirmed and the red flag is cleared; a further uplift would require improvements on external ratings and the open audit item (Section A.5).
Annex A — Technical Due Diligence Detail
This annex records the on-chain and documentary checks performed during the reassessment. Items verified on-chain are marked [verified]; issuer claims not independently confirmed are marked [claim].
A.1 Minting & routing architecture
- [verified] Path: AMO minter 0x82Ed3Fc9D93112124B04B6C7B35394A5AbA8af39 (gov. Metronome 3/5) → Vesper vamsUSD vault 0x4C73F025a1947ec770327B9956Fc61f535F72C22 (gov. Vesper 3/6, can change strategy) → Vesper strategy 0x351567b6F2Ee293c0F724A657F7d59f61361e8b0 → Gauntlet Morpho msUSD vault 0x6859B34a9379122d25A9FA46f0882d434fee36c3.
- [verified] AMO functions: mintAndDeposit / withdrawAndBurn / harvest are onlyAuthorized (keeper); updateVesperPool / updateKeeper / sweep are onlyGovernor. Minting can only target the governor-whitelisted Vesper pool (VesperPoolIsNotAllowed check).
A.2 Governance / Safe
- [verified] Governor Safe 0xd1DE3F9CD4AE2F23DA941a67cA4C739f8dD9Af33 is 3-of-5, Safe v1.3.0, no guard and no modules (no on-chain timelock). It is proxyAdmin/governor across the Synth contracts.
- [verified] msUSD token, AMO and the LayerZero ProxyOFT bridge contracts are all upgradeable proxies.
A.3 Supply reconciliation
- [verified] Per-chain msUSD totalSupply (17 June 2026): Ethereum 13,815,087; Base 10,290,605; Optimism 975,552; Hemi ~3. Sum ≈ 25.08M, matching the ~$25.7M market cap. The contract’s bridgedOut (~29M) and amo (~20M) variables are accounting/attribution figures, not additive supply.
A.4 Bridge (LayerZero)
- [verified] msUSD is a LayerZero OFT with a per-chain ProxyOFT (mainnet 0xF37982E3F33ac007C690eD6266F3402d24aA27Ea), upgradeable, and Ownable: LZ parameters (trusted remotes, config, versions, min-gas) are onlyOwner with no timelock. The owner per chain should be confirmed; the timelock requested in this proposal should ideally also cover bridge-config changes.
A.5 Audits
- [verified] Core Synth & cross-chain audited by Resonance (Cross-Chain/MSC 2023; AMO September–October 2024, commit 57fcfbf) and Halborn, plus 2022/2023 launch audits.
- [verified] Deployed implementations diffed against audited-era versions: AMO impl 0x4681A847863f1d1a584c298aE5A7aC4343704e8f (v1.3.2) vs 0x9b72E0CC30D83402027EC2511bBe45420B246c73 (v1.3.1); SyntheticToken impl 0xD8A7CECcEcbEded9F5350F4Ca8faf55Ab92F3390 (v1.3.2) vs 0x99da110f6c529ddf5954c8f337895aacd8a91256 (v1.3.1). Only change in both: a systematic msg.sender → _msgSender() (SynthContext) refactor + cosmetic renames; no change to mint/burn, amoSupply, caps or bridge logic. The new _msgSender() resolves the sender via a governor-set Operator contract (not ERC-2771) — Operator audit coverage to be confirmed.
- [verified] The Vesper strategy holding msUSD in Morpho is a 13-line wrapper (MorphoVault, impl 0xADa1165650CE6eB96b563D93841762A63D9BD9d5, shared by 4 Vesper pools) over ERC4626Strategy; all logic is in ERC4626Strategy.
- [claim] Metronome states the ERC4626 strategies are audited and the deployed wrapper is a ~4-line override of the audited base. This could NOT be evidenced publicly: the Metronome audits folder and the entire Vesper audit repo (v1/v2/v3+, incl. the content of the Halborn Aug-2022 “Pools+Strategies” report) contain no ERC4626/Morpho coverage — only Aave/Curve/Convex/Compound/Maker/Yearn. The ERC4626 strategy code sits in a private repo. Open item: obtain the ERC4626Strategy / MorphoV1 audit (auditor, date, audited commit).
A.6 Strategy TVL & maturity
- [verified] The MorphoVault strategy family secures ~$27M across 4 Vesper pools (msUSD ~$19.9M, msETH ~$5.1M, hyETH ~$2M, USDC ~$0), live since Nov 2025 (~6–7 months). Our direct exposure (msUSD) is ~$19.9M routed through this contract.
A.7 Underlying collateral risk — exposure to siUSD (Infinifi)
[verified]
A large portion of msUSD (c.$18m) is borrowed against siUSD (Infinifi) as collateral in the Morpho markets, and siUSD carries limited liquidity relative to the at-risk collateral it backs. Under a mass-withdrawal scenario, Infinifi can raise liquidity by de-allocating from its liquid venues, but it currently holds several short-term illiquid positions — New Silver Income Fund ($5.05m), Fasanara mGlobal ($30.84m) and Fasanara Genesis Fund ($5.1m) — alongside a liquid but currently loss-making STRC position ($10.19m), giving the vault indirect exposure to those assets. According to Infinifi’s reporting, 90% of the iUSD backing is accessible within four weeks, and 100% within 8 weeks.
In a loss event, Infinifi’s junior tranche absorbs losses before the senior tranche (siUSD). The junior tranche currently stands at ~$11m, of which ~$7m is locked for ≥8 weeks, providing a first-loss buffer ahead of siUSD.
Critically, even if the junior tranche were fully consumed and the senior (siUSD) tranche were impaired, this would not, in itself, prevent the liquidation of msUSD, which retains good market liquidity. The risk to the liquidity of this market is therefore accepted but will be actively monitored.
A.8 Bridge risk
Only bridge is Layer 0. msUSD is built as an OFT. Ownership of the bridge is a similar multisig on all chains (Metronome’s 0xd1DE…).
A.9 Disclaimer
This document applies Stake DAO Association’s internal heuristic risk methodology. It is not a credit rating, investment advice or a financial promotion. Grades are point-in-time and subject to revision via governance. All deposits carry risk of partial or total loss. This assessment does not opine on the regulatory classification of msUSD (e.g., under MiCA or any e-money/stablecoin regime).