GHO
An automated structural risk report on GHO: every number below is read from Ethereum at block 26100308 and can be reproduced (see the verify page).
The finding ?The three figures that summarise this report, read at block 26100308; the written summary arrives with the prose stage.
Notice: gate failure (entry GHO:17, first fired 2026-10-01)
The token's backing is split between assets checked directly on-chain, wrapped assets checked one layer down, and disclosures; 33.0% of the backing is held in assets whose value can be checked directly on-chain, 38.5% in wrapped assets whose value can be checked on-chain one layer down, and 28.5% through an issuer's or custodian's published disclosures. The headline stress scenario shows that forced sales equal $7.3M against exit liquidity of $23.0M, giving a ratio of 31.7%, while bad debt is $7.3M or 1.0% of supply.
Where the backing sits ?The collateral behind GHO, across the Aave facilitators in scope, split by how far its value can be checked on-chain, at block 26100308.
Automated contracts can change minting and oracle settings with no delay.
The token's backing is split across three classes: 33.0% held in assets whose value can be checked directly on-chain, 38.5% held in wrapped assets whose value can be checked one layer down through the wrapper, and 28.5% whose value is checked through an issuer's or custodian's published disclosures. The largest collateral in each class is WETH at 23.1% of backing, wstETH at 32.8%, and WBTC at 13.6%.
Some disclosed assets are stale: waEthUSDT last updated on 2026-06-30 with a staleness of 93.0 days, USDC on 2026-07-31 with 62.0 days, and sUSDe on 2026-08-26 with 36.0 days. WBTC shows no staleness as of its last disclosure on 2026-10-01. Additionally, 6.3% of backing is depth-truncated, meaning the pipeline does not analyze the node's own backing for those assets.
The admin qualifier banner states that verifiability is conditional on mint and automated contracts plus none, and oracle settings plus automated contracts plus none.
What could break it ?The headline stress scenario and the grid around it: collateral price falls of 20–70% with liquidity-provider flight of 0–60%, across the Aave facilitators in scope, at block 26100308.
Notice: off-venue share > 25% (entry GHO:9, first fired 2026-09-14)
Notice: freeze coverage below target (entry GHO:10, first fired 2026-09-14)
The headline scenario is a 50% fall in the price of volatile collateral, with no extra discount on liquid-staking tokens and liquidity providers staying put: the one scenario the archetype memo names as the headline (memo §6.2.6).
In that scenario liquidations leave $7.3M of bad debt (1.04% of supply) and require selling $7.3M into $23.0M of exit liquidity.
| price fall | no LP flight | 30% LP flight | 60% LP flight |
|---|---|---|---|
| -20.0% | 0.9% | 1.0% | 1.0% |
| -35.0% | 5.1% | 5.2% | 5.2% |
| -50.0% | 31.7% | 32.3% | 32.4% |
| -70.0% | 163.7% | 166.7% | 167.2% |
Each cell: collateral that must be sold ÷ liquidity available to absorb it; “exit exhausted” = no liquidity left at that level of liquidity-provider flight. ?Each cell divides the collateral liquidations must sell by the exit liquidity left in that scenario, across the Aave facilitators in scope, at block 26100308; above 100% the sales cannot all be absorbed.
0 under 0.1% under 10% under 100% 100% or more exit exhausted
At a 50% fall, forced sales use 31.67% of available exit liquidity; at a 70% fall, forced sales need more than all available exit liquidity (163.68%); and if 60% of liquidity providers leave at a 70% fall, forced sales need more than all available exit liquidity (167.19%).
Prices may lag the market by up to 1.00%: the largest update threshold among this token's price feeds (AAVE).
Who can change the rules ?Who holds each administrative power over the protocol's contracts and how long a change takes to take effect, read at block 26100308.
- Minting: automated contracts, with no delay.
- Debt ceilings: automated contracts, with no delay.
- Contract upgrades: no one holds this power.
- Pausing: a multisig, with no delay.
- Freezing assets: automated contracts, with no delay.
- Oracle settings: automated contracts, with no delay.
- Risk parameters: automated contracts, with no delay.
- Pausing GSM swaps: automated contracts, with no delay.
- Pausing GSM swaps: automated contracts, with no delay.
- Blacklisting addresses: no one holds this power.
- Seizing assets: no one holds this power.
How it trades ?Webacy's view of how this token trades, fetched at the time shown under the chart; not read at this report's block and not verified by this pipeline.
DEX pools, top 10 by liquidity
| # | DEX | pair | liquidity | 24h volume | pool |
|---|---|---|---|---|---|
| 1 | Uniswap v4 | GHO/USDC | $3.0M | $41.9k | 0xb3ec…c03c |
| 2 | Curve | GHO/crvUSD | $1.6M | $402.1k | 0x635e…8595 |
| 3 | fluid-ethereum | GHO/sUSDe | $970.3k | $110.3k | 0xdd5f…6be3 |
| 4 | Curve | GHO/cbBTC | $546.1k | $1.3k | 0x8a4f…33bf |
| 5 | Curve | GHO/WETH | $544.7k | $3.9k | 0x8a4f…6cc2 |
| 6 | Curve | GHO/cbBTC/WETH | $543.6k | $6.0k | 0x8a4f…d77f |
| 7 | Uniswap v4 | GHO/USDT | $135.9k | $259.5k | 0x4ece…2de2 |
| 8 | Curve | GHO/fxUSD | $132.8k | $31.0k | 0x7434…3c5b |
| 9 | Balancer | GHO/GHO/USDT/USDC/USDC/USDT | $121.0k | $546 | 0x8353…b2af |
| 10 | balancer | GHO/USDT | $87.3k | $253 | 0x8353…1ec7 |
How to check this ?Every figure is pinned to block 26100308; the verify page lists the calls that reproduce them.
Every figure on this page comes from one data table built from on-chain reads at a single block. Reproduce any of them from the verify page. Verify page · report fingerprint d07a270251811597
The behavioral tier — how the token trades: peg deviation, liquidity, holder concentration and supply flows — is shown under "How it trades", from Webacy's data fetched at a timestamp rather than read at this report's block. This report is the structural tier only: what backs the token, how far that backing can be checked on-chain, and how it holds up under stress.
Detail for specialists
Collateral nodes whose backing depends on disclosures or stops at a truncation
| depth-truncated node | reason | share of backing |
|---|---|---|
| USCC | depth truncated at USCC; node's own backing not analyzed by this pipeline | 1.0% |
| USTB | depth truncated at USTB; node's own backing not analyzed by this pipeline | 0.9% |
| JAAA | depth truncated at JAAA; node's own backing not analyzed by this pipeline | 4.4% |
| DAI | depth truncated at DAI; node's own backing not analyzed by this pipeline | < 0.1% |
| sDAI | depth truncated at sDAI; node's own backing not analyzed by this pipeline | < 0.1% |
| USDS | depth truncated at USDS; node's own backing not analyzed by this pipeline | < 0.1% |
| disclosure-dependent node | last disclosure | days old | share of backing |
|---|---|---|---|
| WBTC | 2026-10-01 | 0 | 13.6% |
| waEthUSDT | 2026-06-30 | 93.0 days | 4.1% |
| sUSDe | 2026-08-26 | 36.0 days | 0.6% |
| USDC | 2026-07-31 | 62.0 days | 0.9% |
| cbETH | 2026-10-01 | 0 | < 0.1% |
| cbBTC | 2026-10-01 | 0 | 2.6% |
| waEthUSDC | 2026-07-31 | 62.0 days | < 0.1% |
| USDT | 2026-06-30 | 93.0 days | 0.3% |
Supply, what was originated, and the residual with its named causes
| figure | value |
|---|---|
| supply | 699,000,000.00 |
| originated supply | 699,000,000.00 |
| supply the tree covers | 699,000,000.00 |
| residual (supply − originated) | 0 |
| unexplained after named causes | 0 |
| stabilizer debt ÷ supply | 0 |
| protocol stabilizer debt | 0 (0 of supply) |
| ceiling aggregate: the upper bound of the protocol stabilizer slice | 0 (0 of supply) |
| minted against off-mainnet facilitators; backing on Arbitrum/Monad/Plasma, not traced by this tree | 150,000,000.00 (21.5% of supply) |
Every figure in the headline scenario
| metric | value |
|---|---|
| collateral coverage before the shock | 1.2710 |
| collateral coverage after the shock | 1.7979 |
| coverage restored by the liquidation mechanism | 0.5269 |
| bad debt | 7,269,853.53 |
| bad debt as a share of supply | 1.0% |
| collateral that must be sold | 7,269,853.53 |
| exit liquidity | 22,952,874.14 |
| forced sales ÷ exit liquidity | 31.7% |
Mechanism state in the headline scenario
| quantity | value |
|---|---|
| which side binds liquidation capacity first: the GHO liquidators can source, or the collateral they can sell | collateral_sellable |
| collateral liquidators can sell within the liquidation bonus, bounded by the analyst's dated sell-side capacity | 40,151,656.84 |
| the counterfactual lines printed with this scenario | |
| exit liquidity in this scenario | 22,952,874.14 |
| GHO liquidators can source within the liquidation bonus: pool buy-side depth plus the GSMs' remaining mint headroom | 286,345,491.60 |
| GHO the GSMs can still mint before their exposure caps bind; one part of the GHO liquidators can source | 285,469,153.78 |
| share of liquidity providers leaving in this scenario | 0 |
Facilitator bucket levels
| address | GHO minted by each facilitator, which its bucket cap bounds; the cap limits recovery minting, not liquidation |
|---|---|
0x0cb7c2…7134 | 50,000,000.00 |
0x2bd010…66e9 | 50,000,000.00 |
0x2ce01c…7285 | 45,000,000.00 |
0x436dcc…dfed | 50,000,000.00 |
0x551322…fa05 | 135,000,000.00 |
0xb639d2…62b8 | 0 |
0xe10c78…b9ea | 59,000,000.00 |
0xe9ac52…27d2 | 310,000,000.00 |
GSM freezers
| address | the GSM's freezer routing: freezer_effective means the freezer can act, which removes that GSM from exit liquidity in a depeg scenario; in a collateral crash the GSM stays an exit venue |
|---|---|
0x3a3868…4112 | freezer_effective |
0x882285…f5e3 | freezer_effective |
What changes under the counterfactual assumptions
| counterfactual | affects | as modelled | under the counterfactual |
|---|---|---|---|
| H2 freezer | m3 | 481,779.59 | 22,952,874.14 |
No written summary for this section this run: the local model's draft did not pass the figure guard.
Exit liquidity at four price-impact levels
A collateral price crash triggers Aave liquidations for GHO, forcing the sale of collateral within the protocol's defined limits. Before the shock, collateral coverage stood at 1.27; after the shock, it rose to 1.80 as the mechanism restored 0.53 in coverage. The forced sales volume totaled $7.3M against exit liquidity of $23.0M, resulting in a ratio of 31.7%. Bad debt reached $7.3M, representing 1.0% of supply.
The binding side for liquidation capacity is the collateral that can be sold, which limits recovery minting rather than the act of liquidation itself. Facilitator buckets hold up to $50.0M each, while one facilitator holds $45.0M and another holds $135.0M. The GSMs remain active exit venues in a collateral crash scenario, even if their freeze status is pending.
GHO liquidators can source up to $286.3M within the liquidation bonus, with the GSMs providing an additional $285.5M of mint headroom. No liquidity providers leave in this scenario, and the exit-exhausted cells indicate that forced sales are bounded by the available sell-side capacity rather than a lack of buyers.
A depeg of the paired stablecoin, USDT at its middle target, triggers forced sales in the Member-2 headline scenario. The mechanism shows $24.4M in forced sales against only $481.8k of exit liquidity, creating a ratio of 5054.9%. This imbalance means the token faces significant pressure through its recomputed exit-liquidity curves rather than remaining unaffected by the shock.
The depth curve at a 0.5% price impact holds $22.9M in total value, with $22.5M contributed by the stability module. At a 1.0% impact, the total remains $22.9M while the pool depth grows to $446.7k. By the time the curve reaches a 2.0% price impact, the total value is $23.0M and the pool depth sits at $481.8k.
Further along the curve, a 5.0% price impact shows a total of $23.0M with a pool depth of $513.9k. The stability module consistently contributes $22.5M across these levels. Two GSM venues enter the exit process: one holds a balance of $0.03 at a 0.0015 fee, and the other holds $22.5M at a 0.0010 fee.
The modelling assumptions and the data behind each
| assumption | what it means | data | source |
|---|---|---|---|
stock_only |
Capacity is measured as a stock at the run block; how each mechanism's stock-only reading errs is the bias table below. | bias: Collateral-sell-side bound: see appendix bias mechanism: see appendix bias tokens: crvUSD, GHO bias reason: see appendix … 32 more in table.json |
memo §7.1 |
observation |
Prices are taken as observed instantly at the run block; the oracle table lists each feed's update condition. | deviation: 0.50% deviation: 0.50% deviation: 0.50% deviation: 0.25% … 14 more in table.json |
memo §7.2 |
lp_sticky |
Liquidity providers are assumed to stay in their pools unless a scenario applies the liquidity-flight modifier. | LP-flight assumption line: see appendix | memo §6.1.4 |
lp_grid |
Liquidity-provider flight is an assumed modifier of 0%, 30% and 60%, not a measured behaviour. | LP-flight assumption line: see appendix | memo §6.1.4 |
sell_side_bound |
Collateral that liquidations must sell is bounded by the analyst's dated sell-side capacity per volatile collateral. | sell-side bound: USCC: 0 sell-side bound: tBTC: 28.13 sell-side bound: WBTC: 131.25 sell-side bound: LINK: 425,000.00 … 7 more in table.json |
memo §6.3 |
h5_slippage_bound |
What liquidators can buy is bounded by the smallest liquidation bonus among the shocked reserves. | reserve liquidation bonus: 106.00% reserve liquidation bonus: 107.50% reserve liquidation bonus: 107.50% reserve liquidation bonus: 105.00% … 34 more in table.json |
memo §6.3 H5 |
gsm_fee_exit |
A GSM counts as an exit at its exit fee, and only where that fee is below the price impact sellers accept. | GSM venue fee exit: 0.0015 GSM venue fee exit: 0.0010 |
memo §5.10 |
par_numeraire |
paired assets counted at 1.00 for depth | — | memo §6.1.3 |
shock_grid_fixed |
The shock grid is fixed by the archetype memo, not tuned per token. | — | memo §6.2.1 |
lst_discount_grid |
Liquid-staking tokens take an additional discount of 0%, 5% or 10%. | — | memo §6.2.2 |
member2_target |
The depeg scenario targets the paired stablecoin named in the frozen pool set. | Member-2 target: 0xdac17f…1ec7 | memo §6.2.5 |
freeze_reference |
Exit venues are the pool set frozen on the freeze date shown. | freeze date: 2026-09-08 | memo §5.7 |
freezer |
An additional modelling disclosure carried by the stress model; its full text is in the appendix. | assumption: freezer: see appendix | — |
health_factor |
An additional modelling disclosure carried by the stress model; its full text is in the appendix. | assumption: health factor: see appendix | — |
lp_flight |
Liquidity providers' capital is assumed to stay in the exit pools in the headline cell; other cells of the grid show what happens when part of the paired asset is withdrawn. | assumption: lp flight: see appendix | — |
oracle_assumption |
An additional modelling disclosure carried by the stress model; its full text is in the appendix. | assumption: oracle assumption: see appendix | — |
tail_reserves |
An additional modelling disclosure carried by the stress model; its full text is in the appendix. | assumption: tail reserves: see appendix | — |
How a stock-only reading errs, mechanism by mechanism
stock-only capacity — direction of error per mechanism
| mechanism | tokens | direction | reason |
|---|---|---|---|
| Collateral-sell-side bound | crvUSD, GHO | overstates | full bound treated as immediately absorbable |
| GSM cap headroom (H2.i) | GHO | overstates | full cap headroom treated as instantly mintable |
| Liquidator recycling (H5) | GHO | understates | no multi-round capital recycling |
| Stability Pool refills (H3) | LUSD | understates | no SP deposits between liquidation waves |
| PegKeeper effective headroom (H1) | crvUSD | overstates | full effective headroom treated as deployed within the window; peer co-deployment dynamics omitted — runs conservative |
| H4 redemption capacity | LUSD | overstates | full schedule capacity treated as immediately available; base-rate decay (regenerative, 12h half-life) omitted — runs conservative |
| H5 liquidator appetite (composite) | GHO | both | two named opposite-sign terms; `binding_side` states per cell which dominates |
| Pool exit depth — no LP inflow | all | understates | no LP inflow modeled |
| Pool exit depth — LP sticky at flight-0 | all | overstates | static composition; spread disclosed by the LP-flight grid |
The admin-power table, row by row
The system allows minting through automated contracts with no delay and no veto, while debt ceilings are managed by the same automated entities without a pause window. Contract upgrades are immutable because no one holds that power, yet pausing is possible via a multisig or an automated contract depending on the specific module being halted.
Freezing assets, setting oracle parameters, and adjusting risk settings all rely on automated contracts that act instantly with no veto capability. Blacklisting addresses and seizing assets are powers held by no one, meaning those actions cannot occur under current configuration.
| power | holder | type | delay | veto | upgradeable | scope | evidence |
|---|---|---|---|---|---|---|---|
| minting | 0x5300a1…192a | automated contracts | none | — | — | 0x40d16f…6c2f |
contract read: hasRole(bytes32,address) |
| debt ceilings | 0x46aa10…5409 | automated contracts | none | — | — | 0x40d16f…6c2f |
contract read: hasRole(bytes32,address) |
| contract upgrades | — | none | none | — | immutable | 0x40d16f…6c2f |
absence read |
| pausing | 0x2cfe3e…aa30 | a multisig | none | — | — | 0x4e0339…58b1 0x87870b…a4e2 0xae05cd…32c8 |
contract read: hasRole(bytes32,address) |
| freezing assets | 0x2ce01c…7285 | automated contracts | none | — | — | 0x4e0339…58b1 0x87870b…a4e2 0xae05cd…32c8 |
contract read: hasRole(bytes32,address) |
| oracle settings | 0x09e8e1…7dda | automated contracts | none | — | — | 0x4e0339…58b1 0x87870b…a4e2 0xae05cd…32c8 |
contract read: hasRole(bytes32,address) |
| risk parameters | 0x2ce01c…7285 | automated contracts | none | — | — | 0x4e0339…58b1 0x87870b…a4e2 0xae05cd…32c8 |
contract read: hasRole(bytes32,address) |
| pausing | 0x6e5193…0047 | automated contracts | none | — | — | 0x3a3868…4112 |
contract read: hasRole(bytes32,address) SWAP FREEZER ROLE 0x3a3868…4112 (contract read) |
| pausing | 0x733ab1…125b | automated contracts | none | — | — | 0x882285…f5e3 |
contract read: hasRole(bytes32,address) SWAP FREEZER ROLE 0x882285…f5e3 (contract read) |
| blacklisting addresses | — | none | none | — | — | absence read | |
| seizing assets | — | none | none | — | — | 0x3a3868…4112 0x882285…f5e3 |
absence read |
Price feeds: type, update threshold and heartbeat
| collateral | market or reserve | update rule | threshold | window / heartbeat | staleness |
|---|---|---|---|---|---|
| USCC | 0xae05cd…32c8 | nav schedule | — | 1 day | not assessed in this pilot |
| tBTC | 0x87870b…a4e2 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| WBTC | 0x87870b…a4e2 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| USTB | 0xae05cd…32c8 | nav schedule | — | 1 day | not assessed in this pilot |
| LINK | 0x87870b…a4e2 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| JAAA | 0xae05cd…32c8 | nav schedule | — | 86,436 s | not assessed in this pilot |
| DAI | 0x87870b…a4e2 | deviation heartbeat | 0.25% | 1 hour | not assessed in this pilot |
| waEthUSDT | 0x87870b…a4e2 | deviation heartbeat | 0.25% | 1 day | not assessed in this pilot |
| wstETH | 0x4e0339…58b1 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| AAVE | 0x87870b…a4e2 | deviation heartbeat | 1.00% | 1 hour | not assessed in this pilot |
| sDAI | 0x87870b…a4e2 | deviation heartbeat | 0.25% | 1 hour | not assessed in this pilot |
| sUSDe | 0x4e0339…58b1 | deviation heartbeat | 0.25% | 1 day | not assessed in this pilot |
| USDC | 0x87870b…a4e2 | deviation heartbeat | 0.25% | 23 hours | not assessed in this pilot |
| rETH | 0x87870b…a4e2 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| cbETH | 0x87870b…a4e2 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| WETH | 0x4e0339…58b1 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| cbBTC | 0x87870b…a4e2 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| weETH | 0x87870b…a4e2 | deviation heartbeat | 0.50% | 1 hour | not assessed in this pilot |
| waEthUSDC | 0x87870b…a4e2 | deviation heartbeat | 0.25% | 23 hours | not assessed in this pilot |
| USDT | 0x87870b…a4e2 | deviation heartbeat | 0.25% | 1 day | not assessed in this pilot |
| USDS | 0x87870b…a4e2 | deviation heartbeat | 0.30% | 23 hours | not assessed in this pilot |
The notice GHO:9 fired on 2026-09-14 because a larger share of the discovered on-chain exchange liquidity sits in venues this report does not model than the rubric allows without a notice; the exit-liquidity figures cover the modelled venues only. The data show that $35.4M of all DEX liquidity discovered for the token, every venue exists, while $2.5M of off-venue curve mainnet liquidity is recorded. Of this total, 93.0% of discovered DEX liquidity lies outside modeled venues as of 2026-10-01.
On 2026-09-14, the system flagged that the frozen set of exit pools covers less liquidity than the archetype's target under a dated waiver. The freeze date is 2026-09-08, and the coverage shortfall applies only to the pools active on that date.
Audits, bug bounty and counterparties
- SigmaPrime 2023-10-23: GSM (v2.4; scope includes Gsm4626.sol; commits e4ea98c, 7c03c52)
- Certora 2023-12-07: GSM formal verification (work 2023-08-09 → 2023-12-07, commit f368bef, scope Gsm.sol and Gsm4626.sol; no publication date on the document)
- Emanuele Ricci 2024-01: GSM (AIP-8)
- Certora 2024-03-14: GhoStewardV2
- Certora 2024-06-11: UpgradeableGHO
- Certora 2024-09-15: ModularGhoStewards
- Certora 2025-07-15: RemoteGSM
- OpenZeppelin 2022-08-12: GHO token
- OpenZeppelin 2022-11-10: GHO token
- ABDK 2023-03-01: GHO
- Certora 2023-02-28: GHO formal verification
- SigmaPrime 2023-07-06: GHO