Maple syrupUSDC

TL;DR

• What it is: ERC-4626 vault on Ethereum (0x80ac24aA…190f5Cc0b), ~$1.18B TVL, that lends USDC as fixed-rate overcollateralized loans to KYC’d institutional borrowers, with BTC/XRP collateral held at Anchorage, BitGo, and Zodia.
• Yield source: Predominantly the loan-book credit-risk premium (fixed-rate interest on overcollateralized institutional loans); the USTB T-bill carry leg present at the prior review has since been fully exited, with idle reserves now in PYUSD plus a small Arrakis LP. No token incentives in headline APY.
• Biggest risk: No privileged role is timelocked — a 3-of-6 SecurityAdmin Safe (0x6b1A78C1…D60818) can push instant contract upgrades, and the PoolDelegate is a single EOA that can fund loans; the 7-day Governor delay Maple’s docs cite is not the binding constraint (Risk #1, Key-compromise threshold).
• For detail: syrupUSDC is also collateral for ~$111M of Morpho lending — including the market our morpho-paypal-usd-main position supplies, so holding both is one credit (study, Risk #6). Plus BGD Labs (2025-08-13, admin perimeter), LlamaRisk (2025-07-03), Chaos Labs (2025-07-15).

How it works

Deposit and accounting. Deposit USDC into Maple’s ERC-4626 syrupUSDC pool and receive syrupUSDC shares; the exchange rate (convertToAssets()) starts at 1 and grows as borrower interest accrues, non-rebasing (1.174533 USDC/share, 2026-07-21). Cross-chain deposit is available on Arbitrum, Base, Solana, and Ink via Chainlink CCIP — those wrapped tokens are backed by Ethereum syrupUSDC locked in a CCIP LockReleaseTokenPool (0x20b79d39…6491, ~$282M, 24.0% of supply — roughly doubled since June) — but the canonical pool is on Ethereum and that is where redemption settles. The pool runs under a Cayman SPC structure that ring-fences syrupUSDC assets from other Maple pools.

Where capital goes (2026-07-21). Pool.totalAssets() = $1.177B is the NAV backing syrupUSDC — overwhelmingly the loan book plus accrued interest, with only ~$10.6M idle USDC in the pool itself (0.90%). Loans are USDC lent under fixed-rate overcollateralized agreements to KYC’d borrowers, collateralized by BTC, XRP, cbBTC, and HYPE at regulated custodians; Maple’s app reports 167% collateralization, 136% lowest (Oct 2025 stress, all margin calls cured) — off-chain figures, not on-chain-verifiable. Maple Direct is sole underwriter; off-chain credit decisions are opaque. Maple’s oracle layer (MapleGlobals.priceOracleOf(USDC) → 0x5DC5E14b…) returns a hardcoded $1.00 for USDC via manualOverridePrice, so a USDC depeg is invisible to on-chain collateral-ratio math and must be detected manually. Off-pool “available liquidity” — advertised for redemptions but not part of the pool NAV and not contractually committed — sits in single-key EOAs and shrank ~41% this quarter, to $230.7M PYUSD (2026-07-21, from $287.5M); the $101.3M USDC wallet 0x2570…3e08 has been drained to $67. We cannot see whether that capital moved to fresh reserve wallets or left Maple’s redemption perimeter entirely — Maple publishes no reserve-address register, so the advertised buffer is unauditable by design (Risk #5). The $154.5M USTB (Superstate) leg present at the prior review remains fully exited.

Capital quality. convertToAssets() has risen monotonically since launch (1.124 → 1.174533, Sep-2025 → Jul-2026): no credit loss has ever been socialized, which corroborates the “all margin calls cured” claims on-chain. TVL grew ~$1.1B → $1.8B through late 2025 (the Oct-2025 cascade was a −2% blip), then the Apr-2026 bridge-attack run cut it from $1.804B (Apr 10) to $1.067B (Apr 25), −41%. That run was borne entirely by the mobile float (−62%) while the dominant ALM allocator stayed frozen; it cleared at NAV (no haircut) and recovered to ~$1.35B. Since then TVL has drifted down again to $1.177B (−13% since June), and the pattern repeated in miniature: the top holder sat flat at 525.7M shares through 2026-07-14, then redeemed ~$90M in the final week. The read is unchanged and now twice-observed — the strategic base is sticky only as long as Sky-ecosystem allocation mandates hold, not from organic conviction, and the redeemable float is small and flighty (Risk #4).

Exit. FIFO-queued, not atomic. Call requestRedeem(); shares enter WithdrawalManagerQueue (0x1bc47a0D…6207cfE3), and USDC pays out as it accumulates from new deposits, near-term loan maturities, and borrower repayments. Typical clearance < 2d when the buffer is healthy; documented worst case 30d. A two-rate design (deposit vs redemption) blocks the post-loss arbitrage where a depositor enters at an impaired rate and exits at the pre-loss one.

Risks

Verified on-chain (2026-07-21, block 25,582,684): pool NAV and share price, USDC buffer, queue depth, SecurityAdmin Safe threshold/owners/modules, PoolDelegate and Governor codesize, the hardcoded USDC oracle, off-pool reserve-wallet balances, and the Morpho Blue syrupUSDC holding + its four collateral markets. Taken on trust: Maple’s off-chain 167% / 136% collateralization and margin-call cure times, LlamaRisk’s unconfirmable “4-of-7” Governor, Maple Direct’s underwriting, and all cited third-party reviews (each >90d stale).

Key-compromise threshold

syrupUSDC is markedly more centralized than a timelocked protocol — no privileged action sits behind an enforced delay, so the relevant counts are small.

• Funds (theft / unbacked drain / loss): single point of failure. The PoolDelegate (1 EOA, 0xC1e18FFD…0B49f) can fund a loan to an attacker-controlled borrower against worthless collateral and never repay — draining available pool USDC, with the loss socialized via convertToAssets(). Separately, the 3-of-6 SecurityAdmin Safe (0x6b1A78C1…D60818) can push an instant contract upgrade with no timelock → full drain. Either is sufficient; neither is gated by the 7-day Governor delay.
• Liveness (freeze / NAV distortion / forced exit): 3-of-6 SecurityAdmin can pause the protocol or upgrade to block redemptions; the PoolDelegate (1 EOA) can stall queue clearance by withholding loan funding. The FIFO requestRedeem path is otherwise permissionless.
• Single point of failure: yes — the PoolDelegate EOA alone breaches the funds tier (sham-loan drain), and no role is timelocked. Above it, the Governor (0x2eFFf887…, a contract — the “4-of-7” is per LlamaRisk and not confirmable via standard Safe calls) controls securityAdmin, the oracle, and the timelock parameters, and can set the delay to zero.

Liquidity & exit

Primary: FIFO withdrawal queue (WithdrawalManagerQueue 0x1bc47a0D…6207cfE3). Typical < 2d when buffer healthy; documented worst case 30d. WithdrawalManagerQueue.totalShares() = 0 — nothing pending (2026-07-21). Buffer: USDC.balanceOf(0x80ac24aA…) = $10,565,082 = 0.90% of Pool.totalAssets() = $1,177,325,727 (2026-07-21), far below the ~$263M / ~22% at Aave listing; volatile and actively managed — it ranged $4.4M–$29.1M over the past seven weeks and spiked to ~$219M during the April run, so read it as a series, not a level. Backup: Arrakis-managed Uniswap V4 syrupUSDC/USDC, ~$15M depth (still unrefreshed — last verified ~12 months ago; treat as unverified before relying); largest historical deviation from the internal rate ~0.61% (Jun 2025). Plus ~$1.2M on Fluid DEX.

Defensible size at current liquidity (post-haircut): ~$5M. ~$15M DEX depth at < 100bps steady-state; worse of (3× current, worst comparable past stress) per rubric.md — no clean Arrakis-pool stress data, so the 3× factor binds → ~$5M reliable exit in 1d at < 300bps. The April-2026 run is reassuring above that line: the pool met a −41% / ~$738M redemption at NAV without a prolonged freeze (queue peaked ~$10M), so a queued exit larger than $5M is serviceable within the documented 30d — not promised < 2d, and we would queue behind any ALM-allocator exit given the ~60% allocator concentration.

Stress scenario — NOCA exits 50% of cap ($2.5M) in 7d while peer redeemers also exit. $2.5M is trivial against the buffer in isolation. The binding question is allocator behavior: the top holder alone is ~$527M (44.8%) and top-3 is ~79%, so a single allocator-governance exit dwarfs the buffer and pushes everyone into the queue. April-2026 shows that case resolves at NAV within 2 weeks (the mobile float ran −62% and cleared), so our $2.5M clears inside the 30d worst case, likely faster — but cannot promise < 2d under a coordinated allocator exit. Cap is set by the DEX-alone size ($5M), not a fraction of the buffer.

Aggregate with the PYUSD vault, not beside it. Per Risk #6, size a syrupUSDC holding and any morpho-paypal-usd-main holding against a single combined limit — on a Maple markdown the collateral leg converts to unsecured Maple credit in the same block, so the two positions add rather than diversify.

External reviews

Source links for the third-party takes in the Risks table. Per rubric.md, reviews older than 90d (⚠️) are stale — refresh before relying.

• LlamaRisk — syrupUSDC Aave onboarding assessment · 2025-07-03 · ⚠️ stale
• Chaos Labs — Aave supply-cap recommendation · 2025-07-15 · ⚠️ stale
• BGD Labs — admin-perimeter risk review · 2025-08-13 · ⚠️ stale
• OAK Research — institutional-lending overview · 2025 · ⚠️ stale
• DeFiSafety — process-quality review (92%) · 2023-03-09 · ⚠️ stale