Maple syrupUSDC

TL;DR

• What it is: ERC-4626 vault on Ethereum (0x80ac24aA…190f5Cc0b), ~$1.07B TVL, that lends USDC as fixed-rate overcollateralized loans to KYC’d institutional borrowers, with BTC/XRP collateral held at Anchorage, BitGo, and Zodia.
• Yield source: Predominantly the loan-book credit-risk premium (fixed-rate interest on overcollateralized institutional loans); the USTB T-bill carry leg present at the prior review has since been fully exited, with idle reserves now in PYUSD alone — the wallet holding the Arrakis LP leg has been drained to dust. No token incentives in headline APY.
• Biggest risk: No privileged role is timelocked — a 3-of-6 SecurityAdmin Safe (0x6b1A78C1…D60818) can push instant contract upgrades, and the PoolDelegate is a single EOA that can fund loans; the 7-day Governor delay Maple’s docs cite is not the binding constraint (Risk R1, Key-compromise threshold).
• For detail: syrupUSDC is also collateral for ~$100M of Morpho lending — including the market our morpho-paypal-usd-main position supplies, so holding both is one credit (study, Risk R6). Plus BGD Labs (2025-08-13, admin perimeter), LlamaRisk (2025-07-03), Chaos Labs (2025-07-15).

How it works

Deposit and accounting. Deposit USDC into Maple’s ERC-4626 syrupUSDC pool and receive syrupUSDC shares; the exchange rate (convertToAssets()) starts at 1 and grows as borrower interest accrues, non-rebasing (1.176562 USDC/share, 2026-08-03). Cross-chain deposit is available on Arbitrum, Base, Solana, and Ink via Chainlink CCIP — those wrapped tokens are backed by Ethereum syrupUSDC locked in a CCIP LockReleaseTokenPool (0x20b79d39…6491, ~$310M, 29.0% of supply — the share keeps climbing as Ethereum-side holders redeem around it) — but the canonical pool is on Ethereum and that is where redemption settles. The pool runs under a Cayman SPC structure that ring-fences syrupUSDC assets from other Maple pools.

Where capital goes (2026-08-03). Pool.totalAssets() = $1.067B is the NAV backing syrupUSDC — overwhelmingly the loan book plus accrued interest, with only ~$15.8M idle USDC in the pool itself (1.48%). Loans are USDC lent under fixed-rate overcollateralized agreements to KYC’d borrowers, collateralized by BTC, XRP, cbBTC, and HYPE at regulated custodians; Maple’s app reports 167% collateralization, 136% lowest (Oct 2025 stress, all margin calls cured) — off-chain figures, not on-chain-verifiable. Maple Direct is sole underwriter; off-chain credit decisions are opaque. Maple’s oracle layer (MapleGlobals.priceOracleOf(USDC) → 0x5DC5E14b…) returns a hardcoded $1.00 for USDC via manualOverridePrice, so a USDC depeg is invisible to on-chain collateral-ratio math and must be detected manually. Off-pool “available liquidity” — advertised for redemptions but not part of the pool NAV and not contractually committed — sits in single-key EOAs and has collapsed to $94.2M PYUSD (2026-08-03), −59% in the 13 days since the last review ($230.7M) and −67% since June ($287.5M); the $101.3M USDC wallet 0x2570…3e08 is now dust ($62.59). We cannot see whether that capital moved to fresh reserve wallets or left Maple’s redemption perimeter entirely — Maple publishes no reserve-address register, so the advertised buffer is unauditable by design (Risk R5). The $154.5M USTB (Superstate) leg present at the prior review remains fully exited.

Capital quality. convertToAssets() has risen monotonically since launch (1.124 → 1.176562, Sep-2025 → Aug-2026): no credit loss has ever been socialized, which corroborates the “all margin calls cured” claims on-chain. TVL grew ~$1.1B → $1.8B through late 2025 (the Oct-2025 cascade was a −2% blip), then the Apr-2026 bridge-attack run cut it from $1.804B (Apr 10) to $1.067B (Apr 25), −41%. That run was borne entirely by the mobile float (−62%) while the dominant ALM allocator stayed frozen; it cleared at NAV (no haircut) and recovered to ~$1.35B. Since then TVL has drifted down to $1.067B (−21% since June, −9% in the 13 days to 2026-08-03) — back to the April-run trough, this time without a run, and the pattern repeated at scale: the top holder went 525.7M → 342.0M shares between 07-20 and 07-26 (~$216M redeemed in six days) and has sat flat since. That cleared at NAV with the queue never leaving zero. The read is unchanged and now three times observed — the strategic base is sticky only as long as Sky-ecosystem allocation mandates hold, not from organic conviction, and the redeemable float is small and flighty (Risk R4).

Exit. FIFO-queued, not atomic. Call requestRedeem(); shares enter WithdrawalManagerQueue (0x1bc47a0D…6207cfE3), and USDC pays out as it accumulates from new deposits, near-term loan maturities, and borrower repayments. Typical clearance < 2d when the buffer is healthy; documented worst case 30d. A two-rate design (deposit vs redemption) blocks the post-loss arbitrage where a depositor enters at an impaired rate and exits at the pre-loss one.

Risks

Verified on-chain (2026-08-03, block 25,674,549): pool NAV and share price, USDC buffer (as a 14-day daily series, not a spot read), queue depth, holder concentration, SecurityAdmin Safe threshold/owners/modules, PoolDelegate and Governor codesize, the hardcoded USDC oracle and timelock parameters, off-pool reserve-wallet balances (daily series), and the Morpho Blue syrupUSDC holding + borrow across all twelve syrupUSDC-collateral markets. The admin perimeter is byte-identical to the 2026-07-21 pass. Taken on trust: Maple’s off-chain 167% / 136% collateralization and margin-call cure times, LlamaRisk’s unconfirmable “4-of-7” Governor, Maple Direct’s underwriting, and all cited third-party reviews (each >90d stale).

Key-compromise threshold

syrupUSDC is markedly more centralized than a timelocked protocol — no privileged action sits behind an enforced delay, so the relevant counts are small.

• Funds (theft / unbacked drain / loss): single point of failure. The PoolDelegate (1 EOA, 0xC1e18FFD…0B49f) can fund a loan to an attacker-controlled borrower against worthless collateral and never repay — draining available pool USDC, with the loss socialized via convertToAssets(). Separately, the 3-of-6 SecurityAdmin Safe (0x6b1A78C1…D60818) can push an instant contract upgrade with no timelock → full drain. Either is sufficient; neither is gated by the 7-day Governor delay.
• Liveness (freeze / NAV distortion / forced exit): 3-of-6 SecurityAdmin can pause the protocol or upgrade to block redemptions; the PoolDelegate (1 EOA) can stall queue clearance by withholding loan funding. The FIFO requestRedeem path is otherwise permissionless.
• Single point of failure: yes — the PoolDelegate EOA alone breaches the funds tier (sham-loan drain), and no role is timelocked. Above it, the Governor (0x2eFFf887…, a contract — the “4-of-7” is per LlamaRisk and not confirmable via standard Safe calls) controls securityAdmin, the oracle, and the timelock parameters, and can set the delay to zero.

Liquidity & exit

Primary: FIFO withdrawal queue (WithdrawalManagerQueue 0x1bc47a0D…6207cfE3). Typical < 2d when buffer healthy; documented worst case 30d. WithdrawalManagerQueue.totalShares() = 0 — nothing pending (2026-08-03). Buffer: USDC.balanceOf(0x80ac24aA…) = $15,793,396 = 1.48% of Pool.totalAssets() = $1,066,674,380 (2026-08-03), far below the ~$263M / ~22% at Aave listing; the ratio improved only because NAV fell faster than the buffer did. Volatile and actively managed — the daily series ran $0.93M–$49.18M over the prior fortnight and spiked to ~$219M during the April run, so read it as a series, not a level. Off-pool: a further $94.2M PYUSD is advertised but uncommitted and single-key (Risk R5). Backup: Arrakis-managed Uniswap V4 syrupUSDC/USDC, historically ~$15M depth (last verified ~12 months ago) — but the entire Uniswap V4 singleton holds only $2.83M of syrupUSDC (2026-08-03), a hard ceiling on what is instantly swappable there even if Arrakis holds further just-in-time inventory off-pool. Largest historical deviation from the internal rate ~0.61% (Jun 2025). Plus ~$1.2M on Fluid DEX.

Defensible size at current liquidity (post-haircut): ~$5M — provisional, likely too generous. The figure derives from ~$15M DEX depth at < 100bps steady-state with worse of (3× current, worst comparable past stress) per rubric.md, the 3× factor binding for want of clean Arrakis-pool stress data. That $15M premise is now in doubt: only $2.83M of syrupUSDC sits in the Uniswap V4 singleton, so unless Arrakis supplies substantial just-in-time inventory the DEX leg is a fraction of the assumed depth and the cap should fall with it. Do not size up against this number until a fresh depth study lands. The April-2026 run is reassuring above that line: the pool met a −41% / ~$738M redemption at NAV without a prolonged freeze — though the queue peaked $61.0M, not the ~$10M this assessment previously stated (corrected 2026-08-04 from an on-chain re-read at block 24,931,764), so “no prolonged freeze” is the accurate claim and “barely any queue” is not. A queued exit larger than $5M is serviceable within the documented 30d — not promised < 2d, and we would queue behind any ALM-allocator exit given the ~60% allocator concentration.

Stress scenario — NOCA exits 50% of cap ($2.5M) in 7d while peer redeemers also exit. $2.5M is trivial against the buffer in isolation. The binding question is allocator behavior: the top holder alone is ~$402M (37.7%) and top-3 is ~78%, so a single allocator-governance exit dwarfs the buffer and pushes everyone into the queue. Both April-2026 and the ~$216M July-2026 redemption resolved at NAV without the queue building, so our $2.5M clears inside the 30d worst case, likely faster — but cannot promise < 2d under a coordinated allocator exit. Cap is set by the DEX-alone size, not a fraction of the buffer — and see the depth caveat above.

Aggregate with the PYUSD vault, not beside it. Per Risk R6, size a syrupUSDC holding and any morpho-paypal-usd-main holding against a single combined limit — on a Maple markdown the collateral leg converts to unsecured Maple credit in the same block, so the two positions add rather than diversify.

External reviews

Source links for the third-party takes in the Risks table. Per rubric.md, reviews older than 90d (⚠️) are stale — refresh before relying.

• LlamaRisk — syrupUSDC Aave onboarding assessment · 2025-07-03 · ⚠️ stale
• Chaos Labs — Aave supply-cap recommendation · 2025-07-15 · ⚠️ stale
• BGD Labs — admin-perimeter risk review · 2025-08-13 · ⚠️ stale
• OAK Research — institutional-lending overview · 2025 · ⚠️ stale
• DeFiSafety — process-quality review (92%) · 2023-03-09 · ⚠️ stale