Summary
Position: on 22 October 2026 the Performance Safe posted 4,500 wstETH to the Morpho Blue USDT/wstETH market, borrowed 6,500,000 USDT and deposited all of it into Maple syrupUSDT. At the pin the debt is 6,500,289.54 USDT and the 5,656,007.67 syrupUSDT shares are worth 6,500,238.61 USDT. The loan-to-value is 48.44% and the health factor is 1.776.
Return: the structure adds the syrupUSDT yield minus the Morpho borrow cost on 6.5m USDT; the collateral keeps its Lido return either way. At the pin the borrow rate, 5.96% APY, is above both Maple’s trailing 30-day yield of 5.34% and the loan book’s current run rate of 3.73%. Our borrow, followed by a supplier withdrawal, lifted the market above its 90% utilization target and doubled the rate from 2.92% APY. Over the previous 30 days the borrow rate averaged 3.69% APY, which would leave a spread of 1.66 percentage points.
Exit: redeeming through Maple’s queue repaid the whole debt in a fork, short by 50.59 USDT. That queue is first-in-first-out and only Maple’s redeemer can process it; behind one larger request our redemption received nothing until Maple recalls loans. Repaying from a wstETH sale does not need Maple: 2,180 wstETH sold for 6.45m USDT, 73 to 87 bp below the oracle. Selling the syrupUSDT itself at full size loses 38.8%.
Dominant risks: the carry can invert under Morpho’s adaptive rate. The exit and the credit both depend on Maple operators: 96.8% of syrupUSDT is open-term loans to eight borrower wallets, 30.1% of it to one wallet, and loan funding, recalls and queue processing sit with single keys. A Maple upgrade package executed 63 minutes after the pin; it lets Maple’s security admin move this pool’s manager and withdrawal queue to new code without delay, and that code was not reviewed. Liquidation is 43.7% below the pinned collateral price.
Mechanism and true exposure
| Account / venue | Assets or claims | Debt |
|---|---|---|
| Performance Safe — Morpho Blue | 4,500 wstETH collateral | 6,500,289.54 USDT |
| Performance Safe — Maple | 5,656,007.67 syrupUSDT, worth 6,500,238.61 USDT | — |
The Safe opened the position in two transactions. At block 26,247,168 (09:10 UTC) it supplied the collateral and borrowed through Morpho’s BlueBundlesV1 contract, with no referral fee. At block 26,247,218 (09:20 UTC) it deposited the USDT through Maple’s SyrupRouter at the pool’s share price, with no fee. No token approvals remain. The Safe still authorizes BlueBundlesV1 and Morpho’s Bundler3 general adapter on Morpho; the verified source of both acts only on the caller’s own position.
The diagram shows the verified structure; balances, rates and scenario results are in the tables.
Label versus exposure: syrupUSDT is a claim on Maple’s open-term loan book, not a USDT savings balance. Of its 331.78m USDT net asset value, 321.24m (96.8%) is loans and 10.54m (3.2%) is cash in the pool; its Aave strategy has held nothing since April 2026. By collateral, the book is BTC 34.3%, USDtb 17.8%, XRP 17.2%, USDC 15.6%, PYUSD 6.2%, aUSDT 6.1% and USDT 2.9%. All eight borrowers are wallets without contract code. One wallet borrows 96.56m (30.1%) against USDtb, PYUSD and aUSDT. A 50m loan recorded as USDC-collateralised pays 0.75% to a wallet that holds no USDC on Ethereum. Two borrowers, holding 21.9% of the principal, also borrow from syrupUSDC. Maple’s API reports a 133.87% collateral ratio, which cannot be checked on-chain, and Maple’s protocol has no USDT price at all.
Leverage and reuse: our structure adds one leverage layer, the Morpho loan. syrupUSDT is itself reused: Aave Core holds 34.6% of its supply as collateral in a mode that lends USDT at up to 90% loan-to-value. Those loops compete with us in Maple’s queue when they unwind.
Oracle and liquidation: the market prices wstETH as Chainlink stETH/ETH × Lido’s wstETH rate ÷ Chainlink USDT/ETH; Compound’s WstETHPriceFeed wraps the first two. A stETH market discount therefore reaches liquidation. Both Chainlink feeds have a 24-hour heartbeat, with 0.5% and 1% deviation thresholds. At the pin the price is 2,982.32 USDT per wstETH; the stETH/ETH reading of 0.99978 is from 05:01 UTC and the USDT/ETH reading is from 15:12 UTC. Liquidation starts at 1,679.66 USDT per wstETH, 43.7% lower, which is about 1,347 USDT per ETH with stETH at par. The liquidator receives a 4.38% bonus on the collateral it seizes.
| Fork scenario at the pin | Result |
|---|---|
| Price set to 1,690 | Liquidation reverts: the position is healthy |
| Price set to 1,679 | A liquidator repaid 6,500,289.54 USDT and seized 4,041.26 wstETH; the Safe kept 458.74 wstETH and its syrupUSDT |
| Price set to 1,500 | A liquidator seized all 4,500 wstETH for 6,466,500 USDT; Morpho wrote the remaining debt off against suppliers; the Safe kept its syrupUSDT |
Since the market was created on 31 January 2024, the oracle’s worst fall over 30 days was 43.0% across 990 daily samples, and no 30-day window reached the current distance. Over 90 days, 83 of 900 windows did; over one year, 361 of 625 did. These windows assume a static position with no top-ups.
Net economics, benchmark and capacity
Return convention: APY on the 6.5m USDT of borrowed principal: the syrupUSDT yield after Maple’s fees, minus the Morpho borrow cost. The wstETH collateral earns the same Lido return as unborrowed wstETH, so it is excluded. Entry carried no fees; gas is excluded.
| Case | syrupUSDT | Borrow | Spread | Per year on 6.5m |
|---|---|---|---|---|
| Pin borrow rate, Maple’s forward run rate | 3.73% | 5.96% | −2.23 pp | −145k USDT |
| Pin borrow rate, trailing 30-day Maple yield | 5.34% | 5.96% | −0.61 pp | −40k USDT |
| 30-day average borrow rate, trailing 30-day Maple yield | 5.34% | 3.69% | +1.66 pp | +108k USDT |
| Rate just before our borrow, trailing 30-day Maple yield | 5.34% | 2.92% | +2.42 pp | +157k USDT |
The syrupUSDT yields are realised share-price growth (5.17% over 7 days, 5.34% over 30 days) and the loan manager’s current issuance of 12.38m USDT a year, which is 3.73% of NAV. Maple takes 12.5% of interest before it reaches the share price; the delegate fee is zero. No rewards are included: Maple’s Drips programme has ended and there was no live Merkl campaign for syrupUSDT on 22 October.
Benchmarks: Aave Core paid 3.35% APY to USDT suppliers at the pin, a lower-risk use of the same USDT. Aave Core charged 4.33% APY to USDT borrowers, an alternative funding venue whose wstETH collateral terms were not assessed.
Capacity: the Morpho market had 147.80m USDT supplied and 137.52m borrowed, a utilization of 93.05%; our debt is 4.7% of all borrowing. Just before our borrow, utilization was 85.66% and the rate 2.88% APR. Above the 90% target, Morpho’s adaptive curve raises the rate immediately and then keeps raising its base rate; at 93.05% the base rate grows by about 4.3% a day, or about 3.5 times in 30 days if utilization stays there. In the last 60 days of daily readings the borrow rate peaked at 11.26% APR on 21 September, at 99.19% utilization. Three vault families supply 82% of the market: Spark Blue Chip USDT 36.1%, Steakhouse Prime USDT 24.5% and Steakhouse USDT 21.3%. Their withdrawals raise our rate; they cannot block repayment. On the Maple side, the run rate sits below the trailing yield because a large part of the principal is in stablecoin-collateral loans at 0.75% to 3.75%, so additional deposits do not earn the trailing figure.
Exit, cost and latency
| Route | What it needs | Result |
|---|---|---|
| A. Redeem syrupUSDT, repay, withdraw wstETH | Maple’s redeemer to process the queue; pool cash or loan recalls | Fork, our request alone: 6,500,238.71 USDT paid; full repayment needed 6,500,289.30, a 50.59 USDT gap; all 4,500 wstETH withdrawn |
| A, behind a larger request | The same | Fork, the third-largest holder’s 14.63m shares queued first: it received 10,458,290.82 of the pool’s 10,536,032.86 USDT cash; we received nothing; 11.18m shares stayed queued |
| B. Repay from a wstETH sale, redeem syrupUSDT later | Aggregator liquidity; no Maple action | 2,180 wstETH quoted at 6,445,199 USDT (Kyber) and 6,453,930 USDT (CoW), 86.5 and 73.1 bp below the oracle, at 16:45 UTC; the syrupUSDT is then held without debt |
| C. Sell syrupUSDT | One Uniswap V4 pool | 3.25m USDT of shares at 0.33% below NAV; the full 6.5m at 38.8% below NAV (Kyber, 17:08 UTC) |
Route A uses Maple’s withdrawal queue. Requests are processed in order, only by Maple’s redeemer role, and only up to the pool’s cash. When cash runs out, the pool delegate can recall principal: 68.1% of it is callable on one day’s notice, 92.3% within 14 days and all of it within 60 days. A borrower that does not repay within its notice period defaults instead. Maple’s documentation says most withdrawals settle within 24 hours and some can take 30 days; nothing on-chain enforces either figure.
The April 2026 run is the observed stress case. Between 15 and 24 April syrupUSDT’s NAV fell from 1,173.6m to 372.9m USDT, 68%. The queue peaked at 236.08m shares, about 265m USDT and 25.5% of the pool, at block 24,909,051; a single 222.5m-share request from Spark’s ALM proxy drove it. The queue cleared within days and the share price never fell.
Route B removes the Maple dependency from the debt, not from the syrupUSDT, which then waits in the queue without leverage. Applying the rubric’s three-times stress haircut to the quoted slippage puts its cost at 2.2% to 2.6%, about 142k to 169k USDT. Each route needs three of the Safe’s six owners to sign.
Risks
Runtime check IDs below refer to this strategy in Tower monitors.yaml; position configuration belongs in Tower positions.yaml, keyed by morpho-wsteth-usdt-syrupusdt-carry. The strategy’s checks, its syrupUSDT position and the vault controls come from nocaeth/tower#301, which is open, so they do not run until it merges; nocaeth/tower#302 adds the code needed to declare the Morpho loan. exposure-discovery, safeControlActions and safeAdmin already run. Mapping checked against Tower main at 5508262bda32fa2901ee3f323a6682f6c3ab42d2 and the #301 head 9372876857e6ede1c694a41117f5251a1513206e on 2026-10-23; this is configuration evidence, not a live health assertion.
| ID | Risk | Mechanism and evidence | Runtime check |
|---|---|---|---|
| R1 | Carry inversion under an adaptive borrow rate | The borrow rate of 5.96% APY exceeds Maple’s 3.73% run rate and its 5.34% trailing yield. Our borrow and a following supplier withdrawal took utilization from 85.66% to 93.05%; above 90% the base rate keeps compounding upward, about 4.3% a day at the pin. | not monitored: Tower has no check that compares a borrow rate with a vault’s yield, and its Morpho rate and utilization warnings apply only to declared loans; declaring this loan needs nocaeth/tower#302. |
| R2 | Exit through Maple’s permissioned queue | Route A needs Maple’s redeemer to process a first-in-first-out queue funded by pool cash of 10.54m USDT. In the fork, one larger request ahead of ours took all available cash. Recalls depend on the pool delegate and on borrowers repaying; the full 6.5m sells at 38.8% below NAV. Route B avoids Maple for the debt only. | syrupusdt-queue-depth; not monitored: pool cash, the redeemer’s processing, loan recalls and secondary-market depth. A pool-cash check was not enabled because it would have warned on 252 of 356 days. |
| R3 | Maple credit and opaque collateral | 96.8% of NAV is open-term loans to eight wallets; one holds 30.1% against USDtb, PYUSD and aUSDT, and a 50m USDC-collateral loan at 0.75% goes to a wallet with no USDC on Ethereum. BTC and XRP back 51.5%, with custody unverified. Losses reach holders through the share price. Maple has no USDT price, so a USDT depeg is invisible to its accounting. | syrupusdt-exit-price-drawdown reads the impairment-aware exit price; usdt-depeg and usdt-feed-staleness watch the USDT price that Maple cannot see; not monitored: borrower concentration, collateral composition and custody, and the collateral ratio. |
| R4 | Maple control plane and executed upgrade | The pool delegate, a single wallet, alone funds loans, recalls principal and can impair loans. The 3-of-6 SecurityAdmin can pause. Governor changes wait three days; two wallets that have never sent a transaction hold role-admin and executor roles and can grant themselves roles in three days without cancellation. A Governor package executed at 17:34:35 UTC on 22 October (block 26,249,682): it replaced Maple’s Globals implementation, registered four new factories and enabled upgrades of this pool’s manager from version 400 to 500 and of its withdrawal queue from 200 to 201. The SecurityAdmin can apply those upgrades without delay; the pool delegate needs a scheduled call. The new code was not reviewed; at block 26,256,136 the pool still ran the old versions. | maple-syrupusdt-admin-safe-proposals for SecurityAdmin and Governor-proposer Safe proposals that touch this pool’s contracts or the Governor; the syrupUSDT vault controls pool-delegate, pool-manager and pool-active; safeControlActions for SecurityAdmin proposals that target MapleGlobals; not monitored: the pool delegate’s own transactions, which appear only through the exit price and the queue, role updates and executions by the two never-used Governor wallets, and a withdrawal-queue upgrade made by the pool delegate. |
| R5 | Liquidation and oracle | Liquidation starts at 1,679.66 USDT per wstETH, 43.7% below the pin, with a 4.38% liquidation bonus. The price includes Chainlink’s stETH/ETH market feed, so a stETH discount counts. The worst 30-day fall since January 2024 was 43.0%; 83 of 900 90-day windows exceeded the current distance. | exposure-discovery reports this loan as undeclared every day and becomes critical below health factor 1.3, about 2,184 USDT per wstETH; steth-market-discount, steth-eth-feed-staleness and usdt-eth-feed-staleness watch the oracle’s inputs; not monitored: health-factor warnings and oracle validation, which need nocaeth/tower#302 and a follow-up declaration of the loan. |
| R6 | Concentrated and reflexive syrupUSDT holders | Aave Core holds 34.6% of supply as collateral for USDT loops, and Chainlink’s cross-chain pool holds 33.2%. Loop unwinds and bridged exits queue ahead of or alongside us. NAV fell 68% in nine days in April 2026. | syrupusdt-queue-depth sees unwinds once they reach the queue; not monitored: holder concentration and the health of Aave’s syrupUSDT loops. |
| R7 | USDT issuer control | Tether’s 3-of-6 multisig can pause USDT, which blocks repayment and liquidation, or blacklist the Maple pool, Morpho or our Safe. Blacklisting the pool would freeze redemptions. None was blacklisted at the pin. | usdt-paused; not monitored: blacklisting of the pool, Morpho Blue or the Safe, because the USDT blacklist read arrives with nocaeth/tower#302. |
| R8 | Treasury keys and standing authorizations | The Performance Safe is a 3-of-6 of six wallets without contract code, with no modules or guard; it shares its owners with DAO-ETH-Performance-2. Two Morpho bundler contracts stay authorized on its positions. At the pin the same Safe also carried a Morpho wstETH/WETH loan; on 23 October it moved that borrowing to its Spark account, which also holds the Compound strategy’s USDS loan. | safeAdmin for the Safe’s owners and threshold; not monitored: Morpho authorizations. |
| R9 | Concentration in Maple across strategies | Our Maple exposure is about 20.2m USD: 4.63m syrupUSDC in the Performance Safe, 9.04m syrupUSDC in DAO-ETH-Performance-2 and this 6.50m syrupUSDT. The pools share Maple’s admins and underwriter, and two borrowers. | not monitored: cross-strategy concentration is reviewed at refresh. |
Alert thresholds
Warnings go to the positions channel and pages to the critical channel. Daily samples run from 30 October 2025 to the pin unless stated.
| Check | Warns | Pages | Evidence |
|---|---|---|---|
syrupusdt-exit-price-drawdown | Any confirmed fall | 1% below its high | The exit price never fell across 356 daily samples. In a fork at the pin, the pool delegate impairing a 2.2m loan cut it 0.665% and impairing a 20m loan cut it 6.04%. |
syrupusdt-queue-depth | Above 25m USDT | Above 50m USDT | The same dollar levels as syrupUSDC. The queue exceeded 25m on 6 of 356 days and 50m on 4, all four in the April 2026 run, which peaked at 136.8m. The other two days were in May and September 2026. |
usdt-depeg | Below 0.995 for 15 minutes | Below 0.99 | The lowest of 366 daily readings was 0.99791. |
steth-market-discount | Below 0.99 for 15 minutes | Below 0.97 | The lowest of 990 daily readings since the market opened was 0.99238; the June 2022 reading of 0.93775 would page. |
steth-eth-feed-staleness, usdt-eth-feed-staleness, usdt-feed-staleness | Older than 25 hours | Older than 27 hours | Each feed’s heartbeat is 24 hours. The longest gaps were 24.03 hours over 400 stETH/ETH rounds, 24.01 hours over 400 USDT/ETH rounds and 24.01 hours over the 39 USDT/USD rounds of its current phase. |
usdt-paused | — | Paused | — |
| Health factor, after nocaeth/tower#302 | Below 1.543 | Below 1.340 | A repeat of the oracle’s worst 7-day fall since January 2024, 35.2%, would bring a loan at the warning level to liquidation; a repeat of its worst 1-day fall, 25.4%, would do the same from the page level. |
Trust and control
| Authority | Verified control |
|---|---|
| Morpho Blue | The market’s loan token, collateral, oracle, rate model and 86% liquidation threshold are immutable. The 6-of-10 owner Safe can switch on a fee that only suppliers pay. |
| Chainlink feed owner | The stETH/ETH and USDT/ETH feed proxies share one owner contract; a wrong feed price can trigger liquidation. |
| Maple pool delegate | A wallet without contract code; funds loans, recalls principal and can impair loans without delay. |
| Maple SecurityAdmin — 3-of-6 | Can pause the protocol and cancel scheduled Governor proposals other than role updates. Since 22 October it can also upgrade this pool’s manager and withdrawal queue to the newly enabled versions without delay. |
| Maple Governor | Three-day delay with a two-day execution window. The 4-of-7 proposer Safe and two never-used wallets with role-admin and executor roles. |
| Maple OpsAdmin — 3-of-5 | An executor of Governor proposals and a redeemer. |
| Tether owner — 3-of-6 | Can pause USDT, blacklist addresses and destroy blacklisted balances. |
| Performance Safe — 3-of-6 | Safe v1.4.1, six wallets without contract code, no modules or guard, empty transaction queue at 16:50 UTC. |
Minimum compromise for principal loss: three of the Safe’s six keys can move everything. On the Maple side, the pool delegate’s key plus one whitelisted borrower’s key can lend out the pool’s cash and default; the delegate alone can impair loans and lower the exit price. Two never-used Governor wallets can take over Maple’s roles after three days, and nobody can cancel that. Control of the Chainlink feeds can force a liquidation at a 4.38% penalty.
Minimum compromise for liveness: one key. The pool delegate can withhold recalls, and Maple’s redeemer role can leave the queue unprocessed. Above them, the 3-of-6 SecurityAdmin can pause Maple and Tether’s 3-of-6 can pause USDT. The pool delegate is a single point of failure for both the exit and the credit.
Evidence boundary
Pinned and reproducible: Ethereum block 26,249,369, 22 October 2026, 16:31:35 UTC, hash 0x5202fc3b3f0adfc74ea1c8b1313ff1a68c640967921dc1c439d83e84f598577a. snapshot.json holds the cited values. Position, market, oracle, Safe, Maple pool, loan, role and Governor reads were taken at this block; the market and oracle histories use daily archive reads. Liquidation and exit tests ran on an Anvil 1.7.1 fork of this block with impersonated callers and an oracle replaced by a constant price; no live transaction was sent. Reads at block 26,256,136 (23 October 2026, 15:10:59 UTC) record the executed Maple upgrade, the closed Morpho wstETH/WETH loan and the Spark account.
External inputs: Maple API at 16:42 UTC; Kyber and CoW quotes at 16:45, 16:56 and 17:08 UTC; Chainlink’s feed directory; Maple’s documentation; LlamaRisk and Chaos Labs reviews on the Aave Core syrupUSDT onboarding thread (October and November 2025, stale under the rubric) and LlamaRisk’s CAPO snapshot update (13 October 2026), all accessed 22 October 2026.
Unresolved:
- What the new Globals implementation and the pool manager and withdrawal-queue versions enabled on 22 October change, and whether Maple applies them to this pool.
- Who controls the borrower wallets, where the BTC, XRP, USDC and PYUSD collateral is held, and the collateral ratio beyond Maple’s API.
- Who controls the two never-used Governor wallets and the redeemer.
- Whether the Morpho suppliers’ public allocator would pull utilization back below 90%.
- How Aave’s syrupUSDT loops and the cross-chain pool behave in a run.
- The off-chain custody of the Safe’s six signer keys.