Bottom line
What can and cannot be verified
- Yield: verifiable. Anyone can recompute 3.3% (3.9% over a year, against 2.4% to 2.5% for weETH) from the on-chain price history. The price fell 9 times in 651 updates, never by more than 12.9 bps, including through a 13x loop’s borrow spike and the Cork loss, so it behaves as a managed number, not a marked one.
- Price against assets: not verifiable. The operator sets the price, and it cannot be rebuilt from on-chain holdings at any quarter-end since 2024.
- Allocations: mostly verifiable. 77% of what is owed to holders is verified on-chain position by position, 11% exists but is valued on another party’s figure, and 12% (21,276 ETH, about $57M) cannot be found.
- The biggest red flag: the share price is set by the operator and cannot be rebuilt from on-chain assets. Known losses never reached it, and 12% of what holders are owed cannot be located.
- Verifiable and real regardless: the 4-of-6 no-timelock Safe and single-wallet price control (R1, R4); exits of up to 12.3 days paid in weETH, with 47% of Ethereum supply held by two wallets (R6, R7); and the 13.3x Aave loop at health factor 1.027 (R2).
What it is. liquidETH (0xf0bb…416C) is a Veda BoringVault run by ether.fi, with Nonce Capital as strategy provider. It takes weETH, eETH, WETH, ETH or stETH and pays out weETH through a solver-filled queue. NAV at the pin: 176,950 ETH ($474.8M) across 125,558 shares on Ethereum and 34,341 on Optimism. The book is a 13.3x weETH/WETH loop on Aave, a wstETH loop on Spark, and a $167M dollar sleeve that borrows against 83,132 weETH and deposits into Sentora, Cap and Hastra, partly funding its own borrowing, plus smaller legs on Monad, Plasma and Fluid.
Before any deposit, ether.fi would need to answer: (1) the position list and addresses behind “stables_basis”, which is where the 21,276 ETH gap sits; (2) how the Cork loss and the April borrow cost were booked; (3) the live strategist allowlist (Merkle leaves); (4) whether a performance fee is taken inside the rate.
Share price and reproducibility
Yield from the price history is reproducible. All 651 rate updates since June 2024 are on-chain. Realized, net of the 0.35% management fee:
| Window | liquidETH | weETH | wstETH |
|---|---|---|---|
| 30 days | 3.31% | 2.36% | 2.26% |
| 90 days | 3.33% | 2.40% | 2.24% |
| 180 days | 3.29% | 2.43% | 2.36% |
| 1 year | 3.88% | 2.48% | 2.48% |
The price itself is not reproducible from holdings. Unlike an ERC-4626 vault, the BoringVault does not compute its price from its assets; a 2-of-4 Safe posts it once a day, and one EOA can also post it. Valuing every token, lending position, Uniswap range and pending withdrawal held by the vault, its drone and its 13 owned contracts at past quarter-ends (scripts/reconstruct.py, data/reconstruction.json):
| Date | Owed to holders (ETH) | Matched on-chain (ETH) | Gap | Published price | Price implied by assets |
|---|---|---|---|---|---|
| 2024-09-30 | 149,469 | 124,798 | 16.5% | 1.036 | 0.865 |
| 2024-12-31 | 152,304 | 94,588 | 37.9% | 1.044 | 0.648 |
| 2025-05-20 (before Cork) | 189,713 | 122,088 | 35.6% | 1.054 | 0.678 |
| 2025-06-15 (after Cork) | 209,533 | 139,635 | 33.4% | 1.055 | 0.703 |
| 2025-09-30 | 231,144 | 165,717 | 28.3% | 1.065 | 0.764 |
| 2025-12-31 | 175,865 | 128,070 | 27.2% | 1.079 | 0.786 |
| 2026-04-17 (before Kelp) | 184,202 | 128,623 | 30.2% | 1.091 | 0.762 |
| 2026-05-25 (after Kelp) | 108,077 | 72,430 | 33.0% | 1.094 | 0.733 |
| 2026-07-31 | 122,194 | 73,158 | 40.1% | 1.101 | 0.659 |
| 2026-09-30 | 176,955 | 147,042 | 16.9% | 1.107 | 0.920 |
The historical figures are lower bounds on assets: Pendle LP, Karak, Symbiotic and Fluid positions and other-chain legs are not priced, so part of each gap is method. The Position map below values the pin fully and leaves 12.0% unaccounted.
Ruled out as causes: pending ether.fi withdrawals (zero at every date; all 575,891 eETH sent to the queues came back as ETH), EigenLayer deposits (none), Lido conversions (all 26 settled in the same transaction), and hidden sub-accounts (129 recipient contracts checked on Aave, Spark and Morpho; only the known drone has a position).
What it shows. The gap does not step up at Cork or at April 2026, so it is not explained by a few unbooked losses. It has existed at every date since 2024, so the vault has never been independently reproducible from on-chain data. Checking the app’s APY against the price history only checks the operator against itself.
April 2026 in the price. No update on 18 and 19 April, two updates of +0.0 bps on 20 and 21 April, then normal-looking gains: 2.6% annualized from 17 April to 19 May while the Aave loop paid 5% to borrow against about 2.5% of yield for 16 days (about 550 ETH of negative carry). From 17 April to 25 May no token transfer, no plain-ETH transfer (traced) and no third-party Aave repayment from ether.fi reached the vault.
Position map
Snapshot at Ethereum block 26,089,398 (2026-09-30 09:28 UTC) and Optimism block 157,582,403; ETH $2,683.52 (Chainlink), weETH 1.104757 ETH, wstETH 1.245174 ETH. Tier A: read on-chain. B: exists on-chain, valued from another party’s figure. C: balance on-chain, price from DefiLlama. D: bridged out, current holdings not read. Rebuilt by scripts/allocation.py into data/allocation.csv.
Assets
| # | Tier | Venue | Position | Amount | ETH | % of assets |
|---|---|---|---|---|---|---|
| 1 | A | Aave v3 Core (eMode) | weETH supplied, vault | 401,299 weETH | 443,337 | 67.3% |
| 2 | A | Aave v3 Core | weETH supplied, drone | 45,182 weETH | 49,915 | 7.6% |
| 3 | A | Spark | wstETH supplied | 27,770 wstETH | 34,579 | 5.2% |
| 4 | A | Morpho | weETH collateral, RLUSD market | 17,983 weETH | 19,866 | 3.0% |
| 5 | A | Morpho | weETH collateral, PYUSD market | 9,964 weETH | 11,008 | 1.7% |
| 6 | A | Morpho | weETH collateral, USDC market | 10,004 weETH | 11,051 | 1.7% |
| 7 | A | Morpho | Hastra PRIME collateral, PYUSD/PRIME market | $26.35M | 9,819 | 1.5% |
| 8 | A | Sentora | Sentora RLUSD Main | $49.28M | 18,364 | 2.8% |
| 9 | A | Sentora | Sentora PRIME Main (PYUSD) | $49.18M | 18,327 | 2.8% |
| 10 | A | Cap | stcUSD | $30.21M | 11,259 | 1.7% |
| 11 | A | Uniswap V3 | WETH/weETH range, 5 bps pool | 5,031 | 0.8% | |
| 12 | A | Uniswap V3 | WETH/weETH range, 1 bp pool | 1,845 | 0.3% | |
| 13 | A | Katana pre-deposit (Yearn V3) | kpdWETH, 1:1 WETH | 2,500 kpdWETH | 2,500 | 0.4% |
| 14 | A | Vault wallet | Idle stETH, weETH, WETH, eETH, rETH, wstETH | 810 | 0.1% | |
| 15 | A | Vault wallet | Native ETH | 25 ETH | 25 | 0.0% |
| 16 | A | Lido | Finalized withdrawal, unclaimed | 25 stETH | 25 | 0.0% |
| 17 | A | Vault-owned loan managers | PYUSD dust | $21.5k | 8 | 0.0% |
| 18 | A | Optimism vault | weETH and WETH | 1,391 | 0.2% | |
| 19 | B | Liquid Monad ETH | 100% of its shares at its own rate; assets on Monad | 10,670 shares | 10,725 | 1.6% |
| 20 | B | Fluid | Position #4241, at Seven Seas’ 1.77% allocation | 3,132 | 0.5% | |
| 21 | C | Vault wallet | Reward tokens, mostly 5.10M ETHFI | $3.76M | 1,401 | 0.2% |
| 22 | D | Plasma | USDT bridged out over USDT0, net, at cost | 12.44M USDT | 4,636 | 0.7% |
| 23 | ? | Cork Protocol | weETH Liquidity Vault shares, market drained 2025-05-28 | 2,161 shares | 0 | 0.0% |
| Gross assets | 659,054 | 100% |
Debts
| # | Venue | Position | Amount | ETH | % of debt |
|---|---|---|---|---|---|
| 24 | Aave v3 Core (eMode) | WETH borrowed, vault | 410,074 WETH | 410,074 | 81.5% |
| 25 | Spark | WETH borrowed | 31,038 WETH | 31,038 | 6.2% |
| 26 | Aave v3 Core | USDC borrowed, drone | $64.53M | 24,047 | 4.8% |
| 27 | Aave v3 Core | USDT borrowed, drone | $12.04M | 4,486 | 0.9% |
| 28 | Morpho | RLUSD borrowed | $35.91M | 13,381 | 2.7% |
| 29 | Morpho | PYUSD borrowed, weETH market | $19.45M | 7,248 | 1.4% |
| 30 | Morpho | USDC borrowed | $17.16M | 6,394 | 1.3% |
| 31 | Morpho | PYUSD borrowed, PRIME market | $18.01M | 6,712 | 1.3% |
| Gross debt (all tier A) | 503,380 | 100% |
Accounted versus owed
| ETH | % of owed | |
|---|---|---|
| Owed to holders: 125,558 shares on Ethereum and 34,341 on Optimism, at 1.106636 ETH | 176,950 | 100% |
| Tier A, on-chain assets less debts (639,160 less 503,380) | 135,781 | 76.7% |
| Tier B, Monad and Fluid | 13,857 | 7.8% |
| Tier C, reward tokens | 1,401 | 0.8% |
| Tier D, Plasma | 4,636 | 2.6% |
| Accounted for | 155,674 | 88.0% |
| Unaccounted | 21,276 | 12.0% |
Every traced outflow from the vault family ends in a known position, a swap, a redemption or a counted bridge. Seven Seas, which feeds the ether.fi app, reports about 21,000 ETH more in its “stables_basis” and Morpho buckets than exists at any address linked to the vault; its Aave, Spark, Uniswap and Monad buckets match ours. Scroll supply is 4 shares.
Main risk by allocation
| Allocation | ETH | Main risk | Ref |
|---|---|---|---|
| Aave eMode loop | 33,263 net | 13.3x at health factor 1.027 on a 30 bps spread; a WETH borrow spike turns carry negative; a 2.6% fall in weETH’s exchange rate liquidates it | R2 |
| Spark loop | 3,541 net | The same carry on wstETH at 9.8x, health factor 1.036 | R2 |
| weETH collateral for dollar loans | 91,840 | Liquidated by a 21.6% to 32.7% ETH/USD fall; the RLUSD and PYUSD markets price weETH at market | R3 |
| Sentora vaults | 36,691 | Sentora lends back into the markets the vault borrows from; its RLUSD book was half kBTC on 2026-08-13 (memo); NOCA already holds Sentora’s PYUSD vault | R5 |
| Hastra PRIME | 9,819 | Figure home-equity credit; single-key rewards minter and payout float; a 20.5% fall in PRIME’s rate liquidates the PYUSD/PRIME loan | Liquid RWA review, 2026-09-08 |
| Cap stcUSD | 11,259 | 35.5% of stcUSD; lent to whitelisted borrowers secured by restaked collateral; redemptions can be delayed at full utilization (Cap docs) | R3 |
| Uniswap ranges | 6,876 | 100% of in-range weETH/WETH liquidity, withdrawable at will | R6 |
| Monad sub-vault | 10,725 | Holdings not readable; valued at its own operator rate | R8, R10 |
| Plasma | 4,636 | Current holdings and the Yuzu protocol not reviewed | R8, R10 |
| Fluid | 3,132 | Valued only from Seven Seas’ allocation | R8 |
| Cork Liquidity Vault | 0 to 2,691 | Market drained; never written down in the price | R12 |
| Reward tokens | 1,401 | ETHFI price; unknown whether the rate counts them | |
| Unaccounted | 21,276 | No position found | R8 |
Mechanism
Deposits go through the teller (0x9AA7…4734), which mints shares at the accountant’s rate. Strategists move assets through a Merkle-verified manager (0xf9f7…bcca); a BoringDrone (0x0a42…c02c) holds a second Aave account. Code is immutable, but the RolesAuthority owner (0xCEA8…ec96) can change every role, root, hook and accountant parameter.
Equity by leg at block 26,089,398. Controls on the top row act without a timelock.
- Leverage. The vault and drone supply 32.7% of all weETH on Aave Core and owe 23.4% of all WETH borrowed there. It is the largest participant, not the pool’s manager.
- Circularity. Sentora RLUSD Main supplies 100% of the $107.0M RLUSD/weETH market; liquidETH borrows $35.9M there and holds $49.3M of Sentora RLUSD Main. Sentora PRIME Main supplies 100% of the $210.0M PYUSD/PRIME market; liquidETH borrows $18.0M there and holds $49.2M of the vault.
- Liquidation prices. Aave prices weETH at its capped exchange rate (
0x8762…6d4C), so a market discount cannot liquidate the loop. The RLUSD and PYUSD Morpho markets use Chainlink’s weETH/ETH market feed (3.4 bps below the exchange rate at the pin); the USDC market uses the exchange rate; the PRIME market uses Hastra’s PRIME/wYLDS rate. - Operators. ether.fi markets the product; Veda supplies contracts and the solver; Nonce Capital is named as strategy provider and also as proposed risk admin of an Aave V4 instance that would accept liquidETH as collateral (Aave governance 25314).
Net economics
Estimated run-rate at pin rates against unlevered weETH (data/carry-estimate.json):
| Leg | Excess over unlevered, share of NAV |
|---|---|
| Aave eMode loop (2.40% weETH yield against 2.08% WETH borrow) | +75 bps |
| Spark loop | +3 bps |
| Dollar sleeve with Merkl rewards | +18 bps |
| Dollar sleeve without Merkl rewards | −40 bps |
| Management fee | −35 bps |
| Estimated | +62 bps |
| Observed over weETH, 90 days | +92 bps |
- Merkl rewards go to depositors. Ripple and PayPal fund RLUSD and PYUSD rewards for Sentora depositors. The strategist EOA is the vault’s registered Merkl operator, no alternative recipient is set, and 167.3k RLUSD and 146.3k PYUSD were claimed into the vault in 41 claims from 9 August, then sold for WETH. The pace is about $2.2M a year; when the campaigns stop, the sleeve costs about 40 bps.
- The loop is not managed for carry. Nothing adjusts automatically. In April 2026 the operator pulled collateral first and cut the loop only 15% during 16 days of negative carry; most of the unwind came after rates normalized, to fund withdrawals. The health factor reached 1.011 on 12 May and is now 1.027, below the pre-crisis 1.054 (
data/aave-loop-history.json).
| Date | weETH collateral | Health factor | WETH borrow APR |
|---|---|---|---|
| 2026-04-19 | 543,181 | 1.054 | 2.31% |
| 2026-04-20 | 528,181 | 1.025 | 8.35% |
| 2026-04-30 | 463,181 | 1.068 | 5.00% |
| 2026-05-12 | 283,481 | 1.011 | 1.94% |
| 2026-09-30 | 401,299 | 1.027 | 2.06% |
Exit
The holder requests weETH on the BoringOnChainQueue (0x0D2d…2cE0) at the request-time rate less a 0 to 10 bps discount; a solver EOA fills it. An accountant pause blocks every fill.
| Month | Solved | Median hours | Worst hours |
|---|---|---|---|
| 2025-12 | 181 | 24.8 | 71.9 |
| 2026-02 | 429 | 8.7 | 71.4 |
| 2026-04 | 472 | 47.1 | 294.1 |
| 2026-06 | 197 | 2.2 | 72.9 |
| 2026-09 | 202 | 21.3 | 144.4 |
- April 2026. Kelp’s rsETH bridge was exploited on 18 April (liquidETH held no rsETH). Teller paused 18 to 20 April; requests rose from about 12 a day to 92 on 19 April; Aave WETH borrow went to 8.35%, then 5%. Requests from 19 and 20 April were filled together on 27 April (up to 8.1 days); requests from 28 April on 10 May (12.3 days).
- Second leg. Proceeds are weETH. DEX depth is about 3,000 weETH within 18 bps, and the vault is 100% of in-range Uniswap liquidity. Otherwise ether.fi’s own queue (weETH memo).
- Holders. Two EOAs hold 47% of Ethereum supply; one minted 27,488 shares in July and August 2026. ether.fi Cash on Optimism holds 32,695 shares as borrower collateral that liquidations would push into the same queue. Supply fell 74% from August 2025 to July 2026.
Compared with NOCA’s book
Figures for the other strategies come from their memos at their last review.
| Aspect | liquidETH | Closest in the NOCA book |
|---|---|---|
| Wrapper and control | Operator-run vault; 4-of-6 Safe, no timelock | IPOR Fusion Liquity vault: operator-run, 2-of-3 Safe, no timelock. Steakhouse Prime USDC has 7 to 14 day timelocks |
| Yield engine | Borrow dollars against weETH and park them in dollar vaults | Aave wstETH → GHO → sGHO and Compound USDC/wstETH carries: the same trade with far more room (the GHO carry liquidates only on a 51% ETH fall) |
| Loan cushion | Health factor 1.027 | Liquity’s Morpho loan 1.053; Aave GHO carry 2.06 |
| Subsidy dependence | Merkl rewards; ether.fi says it absorbed the April 2026 cost | Liquity: about 90% of return is a WETH subsidy. Sentora PYUSD: 62% Merkl rewards. Steakhouse and Maple: organic |
| Exit | Solver queue, worst 12.3 days, paid in weETH | Aave carry: self-executed. Steakhouse: about 35% instant. Maple: under 2 days typical, 30 days worst |
| Verifiability | Price not reproducible from assets; 12% of liabilities unlocated | Every other position in the book traces end to end on-chain |
| Where NOCA’s risk sits | The share token only; leverage stays inside the vault | Liquity: NOCA’s own Safe carries the Morpho loan |
| Overlap | Sentora RLUSD and PRIME vaults inside the dollar sleeve | NOCA already holds Sentora’s PYUSD vault |
Risks
No monitor.yaml while under review; each row carries the trigger a spec would encode.
| ID | Risk | Mechanism and evidence |
|---|---|---|
| R1 | Owner Safe can take everything, instantly | RolesAuthority owner 0xCEA8…ec96: 4-of-6 bare EOAs, no guard, module or timelock. It can grant the manager role and move any asset, including the Monad sub-vault’s. Trigger: any role grant, ownership change or new Merkle root. |
| R2 | Aave loop: 13.3x on a 30 bps spread | Health factor 1.027 (1.011 in May). Liquidated by a 2.6% fall in weETH’s exchange rate or an Aave parameter change; a WETH borrow spike turns carry negative, which happened in April 2026. Trigger: health factor below 1.02, or WETH borrow above weETH yield for 72 hours. |
| R3 | Dollar sleeve | $167.1M of dollar debt against 83,132 weETH; liquidated by a 21.6% to 32.7% ETH fall; carry depends on Merkl rewards. Includes Cap and Hastra credit. Trigger: any leg within 10% of liquidation. |
| R4 | Operator-published, smoothed share price | Posted by 2-of-4 Safe 0x41df…a6ae; EOA 0x18de…8e99 can also post up to 0.5% per six hours without a pause. No attestation. Never more than −12.9 bps in 651 updates, flat through April 2026 and Cork. Trigger: an update from any other address, or above +0.05%. |
| R5 | Circular funding with Sentora | Sentora funds 100% of two markets the vault borrows from while holding $98.5M of the vault’s money. A Sentora loss lands on both sides. Trigger: either market above 95% utilization for 24 hours. |
| R6 | Exit through a permissioned solver | Median 12.5 hours, worst 12.3 days. Solver EOAs 0xdb83…b0a2 and 0xd230…6ca2. DEX depth is the vault’s own. Trigger: a request older than 72 hours. |
| R7 | Concentrated, reflexive holders | Two EOAs hold 47%; ether.fi Cash collateral is 20% of all shares. |
| R8 | Price not reproducible; assets unaccounted | 21,276 ETH (12.0%) of liabilities not found at the pin; 16% to 40% gaps at every quarter-end since 2024. Clear by: ether.fi’s position list and addresses. |
| R9 | Unpublished allowlist, single-key strategist | EOA 0xc811…23a2 acts daily under root 0x9479…1066; published leaf files hash to other roots. |
| R10 | Cross-chain surfaces | Optimism can mint up to 25,000 shares per four hours on Ethereum (4-of-4 DVNs; separate 4-of-6 Safe 0x183f…27E3). Monad assets crossed CCIP and Wormhole; Plasma crossed USDT0. |
| R11 | Transfer hook and past approval exploit | A legacy queue flaw drained about $40K from users’ wallets on 2026-09-11; the vault was not affected. |
| R12 | Cork loss never booked | 2,161 wstETH went into Cork’s weETH Liquidity Vault in May 2025; the market was drained on 28 May (3,761 wstETH, post-mortem); the core contract holds 0.48 wstETH; the shares are still held and the price never fell. |
Trust and control
- Funds: 4 of 6 owner Safe signers, no delay. One key can skim within bounds: the rate EOA (0.5% per six hours) or a strategist EOA inside an unpublished allowlist.
- Liveness: 1 key, any of eight pausers, a solver EOA, or the rate EOA posting an out-of-bounds rate, which pauses all fills until the owner unpauses.
- Code: immutable; audited by 0xMacro, Spearbit/Cantina, Certora and Sigma Prime; in production since June 2024; Veda’s $1M Immunefi bounty covers it.
Evidence boundary
Pinned. Ethereum block 26,089,398 (0x9e94…27b1) and Optimism block 157,582,403. scripts/refresh.py rebuilds snapshot.json, the supply series and the Aave-loop history; scripts/allocation.py the position map and carry estimate; scripts/reconstruct.py the historical reconstruction, collecting its inputs from chain data; render.sh the figure. Events and traces from HyperSync (chains 1, 10, 534352); verified sources from Blockscout.
External. ether.fi docs and incident pages, Seven Seas API (APY, allocation), Morpho API, DefiLlama, Fluid API, Cap docs, Cork post-mortem, Aave governance 25314, accessed 2026-09-30 to 2026-10-02. No third-party risk assessment of liquidETH was found.
Unresolved. The four questions in the Bottom line, plus the Monad and Plasma holdings and the signer identities of the owner, rate and strategist Safes.