GHO

An automated structural risk report on GHO: every number below is read from Ethereum at block 26100308 and can be reproduced (see the verify page).

read 2026-10-01 21:58 UTC · block 26100308 · report d07a2702 · intake sheet 29682310
Disclosures 22.0 days old on average · worst waEthUSDT, 93.0 days old, 4.1% of backingRule changes: no delay3 notice(s): freeze coverage below target, off-venue share 93.0% and gate failure

The finding ?The three figures that summarise this report, read at block 26100308; the written summary arrives with the prose stage.

Notice: gate failure (entry GHO:17, first fired 2026-10-01)

The token's backing is split between assets checked directly on-chain, wrapped assets checked one layer down, and disclosures; 33.0% of the backing is held in assets whose value can be checked directly on-chain, 38.5% in wrapped assets whose value can be checked on-chain one layer down, and 28.5% through an issuer's or custodian's published disclosures. The headline stress scenario shows that forced sales equal $7.3M against exit liquidity of $23.0M, giving a ratio of 31.7%, while bad debt is $7.3M or 1.0% of supply.

Supply ?Every GHO in existence at block 26100308: total supply plus any supply bridged by burning on another chain.
$699.0M
Bad debt, headline scenario ?Shortfall left after liquidations in the headline scenario (−50% collateral crash, no LP flight), across the Aave facilitators in scope, at block 26100308.
$7.3M
1.04% of supply
Exit liquidity, headline scenario ?GHO that could be sold into the frozen set of exit pools before its price falls 2%, in the headline scenario, at block 26100308.
$23.0M

Where the backing sits ?The collateral behind GHO, across the Aave facilitators in scope, split by how far its value can be checked on-chain, at block 26100308.

verifiability treeSupply $699.0Moriginated $699.0M · residual $0minted for other chains, not traced here (21.5%)Checkable on-chain — 33.0%WETH23.1%AAVE9.6%LINK0.4%Checkable one layer down — 38.5%wstETH32.8%weETH2.4%tBTC2.3%rETH0.9%Depends on disclosures — 28.5%WBTC13.6%same dayJAAA4.4%truncatedwaEthUSDT4.1%93.0 days oldcbBTC2.6%same dayUSCC1.0%truncatedUSDC0.9%62.0 days old+8 more belowWhere the backing sits and how far it can be checked on-chain; shares are of the value of all backing collateral.

Automated contracts can change minting and oracle settings with no delay.

The token's backing is split across three classes: 33.0% held in assets whose value can be checked directly on-chain, 38.5% held in wrapped assets whose value can be checked one layer down through the wrapper, and 28.5% whose value is checked through an issuer's or custodian's published disclosures. The largest collateral in each class is WETH at 23.1% of backing, wstETH at 32.8%, and WBTC at 13.6%.

Some disclosed assets are stale: waEthUSDT last updated on 2026-06-30 with a staleness of 93.0 days, USDC on 2026-07-31 with 62.0 days, and sUSDe on 2026-08-26 with 36.0 days. WBTC shows no staleness as of its last disclosure on 2026-10-01. Additionally, 6.3% of backing is depth-truncated, meaning the pipeline does not analyze the node's own backing for those assets.

The admin qualifier banner states that verifiability is conditional on mint and automated contracts plus none, and oracle settings plus automated contracts plus none.

What could break it ?The headline stress scenario and the grid around it: collateral price falls of 20–70% with liquidity-provider flight of 0–60%, across the Aave facilitators in scope, at block 26100308.

Notice: off-venue share > 25% (entry GHO:9, first fired 2026-09-14)

Notice: freeze coverage below target (entry GHO:10, first fired 2026-09-14)

The headline scenario is a 50% fall in the price of volatile collateral, with no extra discount on liquid-staking tokens and liquidity providers staying put: the one scenario the archetype memo names as the headline (memo §6.2.6).

In that scenario liquidations leave $7.3M of bad debt (1.04% of supply) and require selling $7.3M into $23.0M of exit liquidity.

Bad debt as the collateral price fallsBad debt as the collateral price falls$0$37.6Mbad debt ($)-20.0%$216.1k-35.0%$1.2M-50.0%$7.3M-70.0%$37.6Mfall in volatile collateral prices
price fallno LP flight30% LP flight60% LP flight
-20.0%0.9%1.0%1.0%
-35.0%5.1%5.2%5.2%
-50.0%31.7%32.3%32.4%
-70.0%163.7%166.7%167.2%

Each cell: collateral that must be sold ÷ liquidity available to absorb it; “exit exhausted” = no liquidity left at that level of liquidity-provider flight. ?Each cell divides the collateral liquidations must sell by the exit liquidity left in that scenario, across the Aave facilitators in scope, at block 26100308; above 100% the sales cannot all be absorbed.
0 under 0.1% under 10% under 100% 100% or more exit exhausted

At a 50% fall, forced sales use 31.67% of available exit liquidity; at a 70% fall, forced sales need more than all available exit liquidity (163.68%); and if 60% of liquidity providers leave at a 70% fall, forced sales need more than all available exit liquidity (167.19%).

When the GSM freezes, most exit liquidity leaves with itWhen the GSM freezes, most exit liquidity leaves with itExit liquidity in the headline scenario$23.0MExit liquidity once the GSM freezer trips$481.8k

Prices may lag the market by up to 1.00%: the largest update threshold among this token's price feeds (AAVE).

Who can change the rules ?Who holds each administrative power over the protocol's contracts and how long a change takes to take effect, read at block 26100308.

How it trades ?Webacy's view of how this token trades, fetched at the time shown under the chart; not read at this report's block and not verified by this pipeline.

Peg price ?Webacy's latest price for the token, against its $1 peg.
0.9985
Deviation from peg ?How far that price sits from the peg, in basis points (100 bp = 1%).
−14.7 bp
Webacy depeg score ?Webacy's 0–100 depeg risk score; higher is riskier. Its tiers: ok 0–24, watch 25–49, warning 50–69, critical 70–100.
7 of 100
tier ok
DEX liquidity ?Liquidity Webacy counts for the token across decentralised-exchange pools, with its depth tier.
$6.9M
depth medium
Supply change, 7 days ?Net tokens minted less burned over seven days, per Webacy; the % is of Webacy's circulating supply 7 days earlier ($697.9M).
$0
0.0%
Top-10 holder share ?Share of supply held by the ten largest organic holders, with exchanges, bridges, pools and protocol contracts excluded, with Webacy's risk band.
0.9%
risk band low
Peg deviation over seven days, in basis points0−23.1 bp10-11 12:5510-18 12:15
7-day max |deviation|: 23.1 bp
Liquidity by Ethereum DEX poolGHO/USDC$3.0M · 39.5%GHO/crvUSD$1.6M · 20.3%GHO/sUSDe$970.3k · 12.6%GHO/cbBTC$546.1k · 7.1%GHO/WETH$544.7k · 7.1%other listed pools$1.0M · 13.3%
Share of liquidity among the 10 Ethereum pools Webacy lists, $7.7M
Net supply change by window$07 days$030 days+$49.6M90 days
Net supply change, per Webacy
Share of supply by holder grouptop 10: 0.9%holders 11–30: 0.2%all others: 98.9%
Share of supply held, 8,065 holders
DEX pools, top 10 by liquidity
#DEXpairliquidity24h volumepool
1Uniswap v4GHO/USDC$3.0M$41.9k0xb3ec…c03c
2CurveGHO/crvUSD$1.6M$402.1k0x635e…8595
3fluid-ethereumGHO/sUSDe$970.3k$110.3k0xdd5f…6be3
4CurveGHO/cbBTC$546.1k$1.3k0x8a4f…33bf
5CurveGHO/WETH$544.7k$3.9k0x8a4f…6cc2
6CurveGHO/cbBTC/WETH$543.6k$6.0k0x8a4f…d77f
7Uniswap v4GHO/USDT$135.9k$259.5k0x4ece…2de2
8CurveGHO/fxUSD$132.8k$31.0k0x7434…3c5b
9BalancerGHO/GHO/USDT/USDC/USDC/USDT$121.0k$5460x8353…b2af
10balancerGHO/USDT$87.3k$2530x8353…1ec7

Behavioral data: Webacy, fetched 2026-10-18 12:36 UTC. Fetched, not computed or verified by this pipeline.

How to check this ?Every figure is pinned to block 26100308; the verify page lists the calls that reproduce them.

Every figure on this page comes from one data table built from on-chain reads at a single block. Reproduce any of them from the verify page. Verify page · report fingerprint d07a270251811597

The behavioral tier — how the token trades: peg deviation, liquidity, holder concentration and supply flows — is shown under "How it trades", from Webacy's data fetched at a timestamp rather than read at this report's block. This report is the structural tier only: what backs the token, how far that backing can be checked on-chain, and how it holds up under stress.

Detail for specialists

Collateral nodes whose backing depends on disclosures or stops at a truncation
depth-truncated nodereasonshare of backing
USCCdepth truncated at USCC; node's own backing not analyzed by this pipeline1.0%
USTBdepth truncated at USTB; node's own backing not analyzed by this pipeline0.9%
JAAAdepth truncated at JAAA; node's own backing not analyzed by this pipeline4.4%
DAIdepth truncated at DAI; node's own backing not analyzed by this pipeline
Sky reserves ≈ USDC-via-LitePSM + RWA; note only, not analyzed (analyst-supplied 2026-09-01)
< 0.1%
sDAIdepth truncated at sDAI; node's own backing not analyzed by this pipeline
Sky reserves ≈ USDC-via-LitePSM + RWA; note only, not analyzed (analyst-supplied 2026-09-01)
< 0.1%
USDSdepth truncated at USDS; node's own backing not analyzed by this pipeline
Sky reserves ≈ USDC-via-LitePSM + RWA; note only, not analyzed (analyst-supplied 2026-09-01)
< 0.1%
disclosure-dependent nodelast disclosuredays oldshare of backing
WBTC2026-10-01013.6%
waEthUSDT2026-06-3093.0 days4.1%
sUSDe2026-08-2636.0 days0.6%
USDC2026-07-3162.0 days0.9%
cbETH2026-10-010< 0.1%
cbBTC2026-10-0102.6%
waEthUSDC2026-07-3162.0 days< 0.1%
USDT2026-06-3093.0 days0.3%

6.3% of backing depth-truncated — staleness not assessed

Supply, what was originated, and the residual with its named causes
figurevalue
supply699,000,000.00
originated supply699,000,000.00
supply the tree covers699,000,000.00
residual (supply − originated)0
unexplained after named causes0
stabilizer debt ÷ supply0
protocol stabilizer debt0 (0 of supply)
ceiling aggregate: the upper bound of the protocol stabilizer slice0 (0 of supply)
minted against off-mainnet facilitators; backing on Arbitrum/Monad/Plasma, not traced by this tree150,000,000.00 (21.5% of supply)
Every figure in the headline scenario
metricvalue
collateral coverage before the shock1.2710
collateral coverage after the shock1.7979
coverage restored by the liquidation mechanism0.5269
bad debt7,269,853.53
bad debt as a share of supply1.0%
collateral that must be sold7,269,853.53
exit liquidity22,952,874.14
forced sales ÷ exit liquidity31.7%

Mechanism state in the headline scenario

quantityvalue
which side binds liquidation capacity first: the GHO liquidators can source, or the collateral they can sellcollateral_sellable
collateral liquidators can sell within the liquidation bonus, bounded by the analyst's dated sell-side capacity40,151,656.84
the counterfactual lines printed with this scenario
exit liquidity in this scenario22,952,874.14
GHO liquidators can source within the liquidation bonus: pool buy-side depth plus the GSMs' remaining mint headroom286,345,491.60
GHO the GSMs can still mint before their exposure caps bind; one part of the GHO liquidators can source285,469,153.78
share of liquidity providers leaving in this scenario0

Facilitator bucket levels

addressGHO minted by each facilitator, which its bucket cap bounds; the cap limits recovery minting, not liquidation
0x0cb7c2…713450,000,000.00
0x2bd010…66e950,000,000.00
0x2ce01c…728545,000,000.00
0x436dcc…dfed50,000,000.00
0x551322…fa05135,000,000.00
0xb639d2…62b80
0xe10c78…b9ea59,000,000.00
0xe9ac52…27d2310,000,000.00

GSM freezers

addressthe GSM's freezer routing: freezer_effective means the freezer can act, which removes that GSM from exit liquidity in a depeg scenario; in a collateral crash the GSM stays an exit venue
0x3a3868…4112freezer_effective
0x882285…f5e3freezer_effective
What changes under the counterfactual assumptions
counterfactualaffectsas modelledunder the counterfactual
H2 freezerm3481,779.5922,952,874.14

No written summary for this section this run: the local model's draft did not pass the figure guard.

Exit liquidity at four price-impact levels
Exit liquidity by how much price impact sellers acceptExit liquidity by how much price impact sellers accept$0$23.0Mexit liquidity ($)0.5%$22.9M1.0%$22.9M2.0%$23.0M5.0%$23.0Mprice impact sellers acceptpool liquidityGSM swap capacity
Exit liquidity available if sellers accept up to 0.5%, 1%, 2% or 5% price impact; the report's headline uses 2%.

Depeg scenario target: 0xdac17f…1ec7 · every scenario in the appendix

Headline exit liquidity 22,952,874.14; LP capital assumed sticky.

LP-flight grid 0% / 30% / 60%: assumed scenario modifier, not data-derived.

modeled pools: the largest pools covering 90% of the frozen set, which itself covered 95% of discovered on-Curve liquidity at freeze time (2026-09-08). K-subset share of the frozen set: 100.0%

A collateral price crash triggers Aave liquidations for GHO, forcing the sale of collateral within the protocol's defined limits. Before the shock, collateral coverage stood at 1.27; after the shock, it rose to 1.80 as the mechanism restored 0.53 in coverage. The forced sales volume totaled $7.3M against exit liquidity of $23.0M, resulting in a ratio of 31.7%. Bad debt reached $7.3M, representing 1.0% of supply.

The binding side for liquidation capacity is the collateral that can be sold, which limits recovery minting rather than the act of liquidation itself. Facilitator buckets hold up to $50.0M each, while one facilitator holds $45.0M and another holds $135.0M. The GSMs remain active exit venues in a collateral crash scenario, even if their freeze status is pending.

GHO liquidators can source up to $286.3M within the liquidation bonus, with the GSMs providing an additional $285.5M of mint headroom. No liquidity providers leave in this scenario, and the exit-exhausted cells indicate that forced sales are bounded by the available sell-side capacity rather than a lack of buyers.

A depeg of the paired stablecoin, USDT at its middle target, triggers forced sales in the Member-2 headline scenario. The mechanism shows $24.4M in forced sales against only $481.8k of exit liquidity, creating a ratio of 5054.9%. This imbalance means the token faces significant pressure through its recomputed exit-liquidity curves rather than remaining unaffected by the shock.

The depth curve at a 0.5% price impact holds $22.9M in total value, with $22.5M contributed by the stability module. At a 1.0% impact, the total remains $22.9M while the pool depth grows to $446.7k. By the time the curve reaches a 2.0% price impact, the total value is $23.0M and the pool depth sits at $481.8k.

Further along the curve, a 5.0% price impact shows a total of $23.0M with a pool depth of $513.9k. The stability module consistently contributes $22.5M across these levels. Two GSM venues enter the exit process: one holds a balance of $0.03 at a 0.0015 fee, and the other holds $22.5M at a 0.0010 fee.

The modelling assumptions and the data behind each
assumptionwhat it meansdatasource
stock_only Capacity is measured as a stock at the run block; how each mechanism's stock-only reading errs is the bias table below. bias: Collateral-sell-side bound: see appendix
bias mechanism: see appendix
bias tokens: crvUSD, GHO
bias reason: see appendix
… 32 more in table.json
memo §7.1
observation Prices are taken as observed instantly at the run block; the oracle table lists each feed's update condition. deviation: 0.50%
deviation: 0.50%
deviation: 0.50%
deviation: 0.25%
… 14 more in table.json
memo §7.2
lp_sticky Liquidity providers are assumed to stay in their pools unless a scenario applies the liquidity-flight modifier. LP-flight assumption line: see appendix memo §6.1.4
lp_grid Liquidity-provider flight is an assumed modifier of 0%, 30% and 60%, not a measured behaviour. LP-flight assumption line: see appendix memo §6.1.4
sell_side_bound Collateral that liquidations must sell is bounded by the analyst's dated sell-side capacity per volatile collateral. sell-side bound: USCC: 0
sell-side bound: tBTC: 28.13
sell-side bound: WBTC: 131.25
sell-side bound: LINK: 425,000.00
… 7 more in table.json
memo §6.3
h5_slippage_bound What liquidators can buy is bounded by the smallest liquidation bonus among the shocked reserves. reserve liquidation bonus: 106.00%
reserve liquidation bonus: 107.50%
reserve liquidation bonus: 107.50%
reserve liquidation bonus: 105.00%
… 34 more in table.json
memo §6.3 H5
gsm_fee_exit A GSM counts as an exit at its exit fee, and only where that fee is below the price impact sellers accept. GSM venue fee exit: 0.0015
GSM venue fee exit: 0.0010
memo §5.10
par_numeraire paired assets counted at 1.00 for depth — memo §6.1.3
shock_grid_fixed The shock grid is fixed by the archetype memo, not tuned per token. — memo §6.2.1
lst_discount_grid Liquid-staking tokens take an additional discount of 0%, 5% or 10%. — memo §6.2.2
member2_target The depeg scenario targets the paired stablecoin named in the frozen pool set. Member-2 target: 0xdac17f…1ec7 memo §6.2.5
freeze_reference Exit venues are the pool set frozen on the freeze date shown. freeze date: 2026-09-08 memo §5.7
freezer An additional modelling disclosure carried by the stress model; its full text is in the appendix. assumption: freezer: see appendix —
health_factor An additional modelling disclosure carried by the stress model; its full text is in the appendix. assumption: health factor: see appendix —
lp_flight Liquidity providers' capital is assumed to stay in the exit pools in the headline cell; other cells of the grid show what happens when part of the paired asset is withdrawn. assumption: lp flight: see appendix —
oracle_assumption An additional modelling disclosure carried by the stress model; its full text is in the appendix. assumption: oracle assumption: see appendix —
tail_reserves An additional modelling disclosure carried by the stress model; its full text is in the appendix. assumption: tail reserves: see appendix —
How a stock-only reading errs, mechanism by mechanism

stock-only capacity — direction of error per mechanism

mechanismtokensdirectionreason
Collateral-sell-side boundcrvUSD, GHOoverstatesfull bound treated as immediately absorbable
GSM cap headroom (H2.i)GHOoverstatesfull cap headroom treated as instantly mintable
Liquidator recycling (H5)GHOunderstatesno multi-round capital recycling
Stability Pool refills (H3)LUSDunderstatesno SP deposits between liquidation waves
PegKeeper effective headroom (H1)crvUSDoverstatesfull effective headroom treated as deployed within the window; peer co-deployment dynamics omitted — runs conservative
H4 redemption capacityLUSDoverstatesfull schedule capacity treated as immediately available; base-rate decay (regenerative, 12h half-life) omitted — runs conservative
H5 liquidator appetite (composite)GHObothtwo named opposite-sign terms; `binding_side` states per cell which dominates
Pool exit depth — no LP inflowallunderstatesno LP inflow modeled
Pool exit depth — LP sticky at flight-0alloverstatesstatic composition; spread disclosed by the LP-flight grid
The admin-power table, row by row

The system allows minting through automated contracts with no delay and no veto, while debt ceilings are managed by the same automated entities without a pause window. Contract upgrades are immutable because no one holds that power, yet pausing is possible via a multisig or an automated contract depending on the specific module being halted.

Freezing assets, setting oracle parameters, and adjusting risk settings all rely on automated contracts that act instantly with no veto capability. Blacklisting addresses and seizing assets are powers held by no one, meaning those actions cannot occur under current configuration.

powerholdertypedelayvetoupgradeablescopeevidence
minting0x5300a1…192aautomated contracts none—— 0x40d16f…6c2f contract read: hasRole(bytes32,address)
debt ceilings0x46aa10…5409automated contracts none—— 0x40d16f…6c2f contract read: hasRole(bytes32,address)
contract upgrades—none none—immutable 0x40d16f…6c2f absence read
pausing0x2cfe3e…aa30a multisig none—— 0x4e0339…58b1 0x87870b…a4e2 0xae05cd…32c8 contract read: hasRole(bytes32,address)
freezing assets0x2ce01c…7285automated contracts none—— 0x4e0339…58b1 0x87870b…a4e2 0xae05cd…32c8 contract read: hasRole(bytes32,address)
oracle settings0x09e8e1…7ddaautomated contracts none—— 0x4e0339…58b1 0x87870b…a4e2 0xae05cd…32c8 contract read: hasRole(bytes32,address)
risk parameters0x2ce01c…7285automated contracts none—— 0x4e0339…58b1 0x87870b…a4e2 0xae05cd…32c8 contract read: hasRole(bytes32,address)
pausing0x6e5193…0047automated contracts none—— 0x3a3868…4112 contract read: hasRole(bytes32,address)
SWAP FREEZER ROLE 0x3a3868…4112 (contract read)
pausing0x733ab1…125bautomated contracts none—— 0x882285…f5e3 contract read: hasRole(bytes32,address)
SWAP FREEZER ROLE 0x882285…f5e3 (contract read)
blacklisting addresses—none none—— absence read
seizing assets—none none—— 0x3a3868…4112 0x882285…f5e3 absence read
Price feeds: type, update threshold and heartbeat
collateralmarket or reserveupdate rulethresholdwindow / heartbeatstaleness
USCC0xae05cd…32c8nav schedule — 1 day not assessed in this pilot
tBTC0x87870b…a4e2deviation heartbeat 0.50% 1 hour not assessed in this pilot
WBTC0x87870b…a4e2deviation heartbeat 0.50% 1 hour not assessed in this pilot
USTB0xae05cd…32c8nav schedule — 1 day not assessed in this pilot
LINK0x87870b…a4e2deviation heartbeat 0.50% 1 hour not assessed in this pilot
JAAA0xae05cd…32c8nav schedule — 86,436 s not assessed in this pilot
DAI0x87870b…a4e2deviation heartbeat 0.25% 1 hour not assessed in this pilot
waEthUSDT0x87870b…a4e2deviation heartbeat 0.25% 1 day not assessed in this pilot
wstETH0x4e0339…58b1deviation heartbeat 0.50% 1 hour not assessed in this pilot
AAVE0x87870b…a4e2deviation heartbeat 1.00% 1 hour not assessed in this pilot
sDAI0x87870b…a4e2deviation heartbeat 0.25% 1 hour not assessed in this pilot
sUSDe0x4e0339…58b1deviation heartbeat 0.25% 1 day not assessed in this pilot
USDC0x87870b…a4e2deviation heartbeat 0.25% 23 hours not assessed in this pilot
rETH0x87870b…a4e2deviation heartbeat 0.50% 1 hour not assessed in this pilot
cbETH0x87870b…a4e2deviation heartbeat 0.50% 1 hour not assessed in this pilot
WETH0x4e0339…58b1deviation heartbeat 0.50% 1 hour not assessed in this pilot
cbBTC0x87870b…a4e2deviation heartbeat 0.50% 1 hour not assessed in this pilot
weETH0x87870b…a4e2deviation heartbeat 0.50% 1 hour not assessed in this pilot
waEthUSDC0x87870b…a4e2deviation heartbeat 0.25% 23 hours not assessed in this pilot
USDT0x87870b…a4e2deviation heartbeat 0.25% 1 day not assessed in this pilot
USDS0x87870b…a4e2deviation heartbeat 0.30% 23 hours not assessed in this pilot

Independent market reference prices are not available from a pinned source in this pilot (11 collaterals).

instant observation — nearly exact: Chainlink deviation triggers ≤ 1.00%

oracle manipulation out of scope — feed control reported under the admin-power surface (the oracle settings rows of the admin-power table). oracle failure/staleness out of scope. sequencer/infra risk n/a — mainnet only.

The notice GHO:9 fired on 2026-09-14 because a larger share of the discovered on-chain exchange liquidity sits in venues this report does not model than the rubric allows without a notice; the exit-liquidity figures cover the modelled venues only. The data show that $35.4M of all DEX liquidity discovered for the token, every venue exists, while $2.5M of off-venue curve mainnet liquidity is recorded. Of this total, 93.0% of discovered DEX liquidity lies outside modeled venues as of 2026-10-01.

On 2026-09-14, the system flagged that the frozen set of exit pools covers less liquidity than the archetype's target under a dated waiver. The freeze date is 2026-09-08, and the coverage shortfall applies only to the pools active on that date.

Audits, bug bounty and counterparties

Audit list (analyst-supplied 2026-09-13)

Bug bounty: Immunefi, max USD 1,000,000 (analyst-supplied 2026-09-13). Last material change audited: yes (analyst-supplied 2026-09-13). Audit status as of 2026-09-13. Counterparties: n/a — archetype #1 holds no off-chain counterparties. WBTC custodian captured in §4 look-through.