Tenor is live on Base! The fixed-rate lending and borrowing platform, built on @Morpho 🕛

1. Intro Vitalik recently wrote about where the EF should go; Aya added a note to explain how we got here, and why. I’ll write about the execution. We now have enough clarity to stop treating “what is the EF for?” as an open-ended question. Our mandate is clear: The EF exists to ensure Ethereum is, becomes, and remains real permissionless infrastructure for self-sovereignty: censorship (and capture) resistant, free and open source, private, and secure; and capable of supporting sovereignty-preserving coordination at scales where trusted institutions hitherto have been unavoidable. The following are my thoughts on some of the points that follow from the mandate and how we are translating it to action. But first, a short reminder about 2. What the EF is not for We are not here to optimize for EF importance, corpo/pol appeal, or ecosystem popularity. We are also not here to please short-term speculators, prop up TBTF neo-SIFIs, market every app on Ethereum, help anyone look good to their crypto or investor friends, or provide on-demand entertainment for dinner parties and private retreats. 3. What the EF is for: Eliminating weaknesses We are here to defensively strengthen places where Ethereum is, or can still become, extractive, totalizing, or vulnerable to cartel or state capture, or authoritarian tools of surveillance or coercion. We will base our actions on a full examination of what Ethereum is and can be at the protocol layer (what is actually running as “Ethereum”), the access layer (what users use to interact with the protocol), the user layer (the end-users who need and will need Ethereum), and the institutional layer (the intermediated paths that scale self-sovereign usage). The EF exists to harden every surface of Ethereum, including those where Ethereum can remain formally permissionless while becoming practically captured. Some obvious surfaces are the transaction pipeline, staking and network security, access layer standards and interfaces, self-sovereignty norms, privacy expectations, institutional adoption patterns, and social layer governance processes. The primary concerns are similar across most of them: does the status quo and its future trajectory minimize trusted dependencies, minimize points of leverage and capture vectors, make user privacy the default, preserve exit, and make trust assumptions legible? The work starts with the EF itself. We are moving compensation and major financial relationships toward ETH and mandate-compliant Ethereum-native stables, with exceptions where positive law or unavoidable operational constraints require exceptions. Rather than a purity ritual or instruction for people to take unmanaged personal risk, it is robustness, alignment, and product pressure. If the EF’s work is to make Ethereum usable as infrastructure for self-sovereignty, everyone at the EF will increasingly live inside the constraints of the system the EF exists to improve: wallet UX, volatility, accounting, privacy gaps, payment friction, stablecoin trust assumptions, recovery, dependency risk, etc. If we can’t use these tools ourselves, it is unrealistic to expect others to. Ethereum is already mature; those who do not depend on the user-facing stack have no business trying to shape its future, at any layer. The transaction pipeline is next. Preventing toxic MEV capture is core EF work, not a peripheral market-structure concern. Transaction supply, ordering, inclusion, block construction, propagation, and settlement are part of Ethereum’s neutrality boundary. Some MEV may persist as an adversarial phenomenon the protocol contains, but it must be absolutely minimized and, for that to be possible, we must guard against the acquisition of unwarranted influence by its beneficiaries. If credibly neutral execution is subverted by privileged orderflow, cartelized builders, trusted relays, opaque routing, or validators outsourcing into a narrow supply chain, Ethereum will look permissionless while users experience it as intermediated at the moment value moves. EF protocol work will therefore prioritize lower barriers to block building and validation, stronger inclusion guarantees, reduced extraction opacity, competitive transaction pipelines, user-facing legibility of trust assumptions, and more aggressively exploring the open orderflow solution space. None of this is simple. A good solution in one place can aggravate problems elsewhere. FOCIL is good for censorship resistance, but it may introduce more cross-block MEV. While ePBS solves the relayer trust problem, we must make sure that its implementation does not inadvertently obstruct long-term solutions to even larger problems. It would be unacceptable, for example, if ePBS enshrining the builder economy ends up making it harder to reduce reliance on the private orderflow that has emptied out the public mempool. Encrypted mempools may not only reduce pre-execution transparency and pending orderflow visibility, but also shift competitive advantage to new privileged actors, including specialized hardware operators in some designs, while adding protocol complexity. In order to avoid wasting time playing whack-a-mole, we must commit to solving the extraction problem at a whole system scale. Doing so will require creativity, courage, and the understanding that failure to solve this problem is unacceptable. If we fail, we will have left in place an unnecessary barrier to institutional adoption, but, more importantly, we will also have surrendered a core part of the promise of Ethereum - the replacement of extractive middlemen with permissionless, credibly neutral infrastructure and competitive markets. That must not happen. MEV is likely to be the next major front in the cypherpunk war. We must set ourselves up to win here. Privacy is just as fundamental. A public ledger without serious privacy defaults is a surveillance substrate with settlement guarantees. That is not an acceptable end state for the world computer. Unconditional privacy will be readily available across Ethereum, with programmability on top for selective disclosure, proofs, auditability, compliance logic, reputation, governance, identity, and other constraints chosen by users and their communities. The temporal order matters: unconditional privacy must exist first, opt-in constraints come second. It is also important to avoid forcing users to assemble a fragile stack of special wallets, RPCs, bridges, apps, compliance providers, and operational habits to attain privacy. Deep privacy must be more secure than this. Privacy is a condition for Ethereum’s viability as freedom-respecting coordination infrastructure and as such must be robust. Staking must be treated as protocol infrastructure risk. Staking is not merely a yield product, and liquid staking is not merely an app-layer market. If stake, liquidity, validator access, DeFi collateral, and governance influence concentrate around a small set of issuers or operators, Ethereum’s security layer becomes vulnerable to capture through capture of the economic layer around it. EF will support research, specifications, and designs that keep staking permissionless, private where possible, plural in operation, and resistant to intermediaries becoming permanent control points. The access interfaces are where users access either the protocol directly or through intermediated defaults. The primary problem to solve here is not getting Ethereum into more rooms directly, but making its users, both end users and institutions, more self-sovereign and less susceptible to coercion, and avoiding normalization of soft coercion in exchange for reach. EF will not help Ethereum become more acceptable by sanding off the properties that make it uniquely valuable. Ethereum does not need to become another permissioned settlement backend with better branding. It needs to show, in production, that self-sovereign coordination at scale is possible. Across Ethereum, the EF’s defensive work seeks to ensure that Ethereum is infrastructure people can still use when counterparties fail, platforms censor, governments overreach, intermediaries extract, and coordination problems become infeasible for trusted systems to handle. A core part of that is to make that infrastructure secure and robust against capture at every layer wherever capture opportunities can hide. 4. What the EF is also for: Seizing opportunities Shoring up the fundamentals is not enough. Ethereum’s potential is still largely unrealized, but that does not mean that the path ahead is going to be straight. Opportunities must be seized when the time is right. At this moment in time, a number are visible, including: * Ethereum becoming the first quantum-resistant global infrastructure. Ethereum researchers will lead the post-quantum cryptographic migration before the threat becomes urgent, not after it becomes a governance emergency. That means hardening Ethereum’s cryptographic foundations while there is still time to design carefully. The same applies to other long-horizon risks, where waiting for market demand means waiting until the window for principled design has already closed. * Verifiably self-sovereign stack, from soup to nuts, whether local or remote, with no censorship or extraction openings: browsers, wallets, intents, broadcasts, orderflow, inclusion, block construction, proposal, proving, exit, and recovery. Minimal MEV, and zero toxic MEV entrenchment, either in or around the protocol. No execution layer that is formally permissionless but practically gatekept by privileged supply chains. If there’s a funnel towards an extractive private lane, there’s other options that keep the game live. The goal is not only to prevent extraction or capture, but to make credibly neutral execution competitive enough that serious users prefer it. * Making ETH normal digital cash: a private, dignity-respecting, debasement-resistant and surveillance-resistant medium of exchange and store of value, as well as the native asset of private computation and private coordination for both humans and their agents. If Ethereum can make private economic life and private institutional life possible without routing users back through the friction and potential abuse of custodians, surveillance vendors, or permissioned ledgers with softer branding, as well as provide a venue for secure and competitive machine economics, the value unlocks will be immense. * Personal wallets with personal AI agents that users can actually own and run on their own personal computers. Not your keys, not your coins; not your model, not your mind. As agents become interfaces for more economic and social action, the question of who owns the wallet, the model, the memory, the policy, and the signing authority becomes an existential question about sovereignty instead of UX details - we are all users above any other roles, and no one at EF will forget this. * Institutional and enterprise use cases where Ethereum wins by not disappearing into an invisible backend, gatekept by intermediaries or terrible UX, and by not compromising into a compliant fintech rail with web3 branding. Rather, we will win through proving that credibly neutral infrastructure can handle disintermediated coordination so competitively that trusted intermediaries have to meet Ethereum users on Ethereum’s terms. * Security-preserving scaling. L2s and related infrastructure will be able to meet institutional-level needs without accepting dependencies on closed operators, opaque sequencing, custodial UX, or upgrade committees that users cannot realistically exit. Scale is not throughput alone. Scale is the guaranteed availability of self-sovereignty under real load. We are ensuring Ethereum remains the hardest bedrock for settlement, local and worldwide; and beyond that, a civilizational ledger and execution substrate to stand the test of time. When future civilizations speak of the infrastructure they inherited from the Antiquity of the Information Age, their first example should be Ethereum. Ethereum will outlast all of us. More than enough people watching understand this. Many wondered why it needed saying at all, but it did. If you don't believe us or don't get it, we don't have time to try to convince you, sorry. 5. Addressing departures There has been a lot of online speculation about departures from EF, both before and after the mandate. Some people resigned, others were terminated. Some departures were about strategy, some about role fit, some about normal institutional change, and some simply about people deciding that their best work for Ethereum should happen somewhere else. We will not litigate individual personnel matters on Twitter. That is the default because it is better for EF, better for the people involved, and better for Ethereum. People who contributed through EF deserve dignity on the way out. They do not deserve to have their employment history turned into factional content. Where possible, we have let people describe their departures in their own words as a matter of courtesy, and not concession. If public claims materially mislead people about EF’s direction, decision-making, or mandate, we may correct the record at the level of policy, process, and institutional facts. We still will not turn personal files into public spectacle. Ethereum is permissionless. People may disagree, criticize, compete, fork, and build elsewhere. We intend to keep exits dignified and expect others to do the same. It will suffice to say that we are thankful for what all contributors have built; we will continue to do work Ethereum needs. 6. Addressing EF spinouts Some work should and will leave the EF in the months to come. We hope and expect this process to result in some excellent work being done in service of scaling self-sovereign adoption, but we also must take care lest it becomes an abdication of responsibility or an excuse for undisciplined spending. Some work is not mandate-compatible and should not be carried forward with EF funds or EF endorsement, either inside or outside the Foundation. The efforts carried out by the spinouts will vary widely. Some efforts will leave EF because another org would be a better home for them; others will leave because markets should decide on their worth. Some will leave because they are not compatible with the direction set out in the mandate; others because they are useful but not EF work. Just as a spinout is not automatically good because it reduces EF headcount, former EF affiliation is not a claim on EF funding. The question we ask when deciding on funding is not “did this come from the EF?” But, rather the questions that should be asked about all external funding: “Is this work mandate-critical? Would the EF do this work internally if it had the organizational and financial capacity? Is there no better natural home? Can the external party execute without increasing capture risk, private extraction, opacity, or dependence? Does supporting it reduce Ethereum’s dependence on the EF over time, without prematurely transferring resources and legitimacy to new organizations and thereby risking operational failure or mission drift?” EF funding for work being done externally can be appropriate when it is a capacity solution for mandate work - work the EF should responsibly want done; work that protects CROPS; work that advances self-sovereignty and scales it; essential work that no actor can or will reliably do without EF funding; and work that can be scoped, reviewed, and held accountable without creating a permanent dependency. Such funding is not appropriate when it is a lazy continuity payment, a friendship payment, a reputational hedge, a way to avoid making a hard decision, or a way to support work that is not compatible with the mandate. EF has finite funds, finite legitimacy, and a specific mandate. We will spend all three as if they matter. When we say “EF is one of many nodes”, we mean that we intend to be one of many nodes working to keep self-sovereignty and its scaling the North Star, and working to keep CROPS the undisplaceable first-class properties of the network. We don’t mean that we will support orgs or projects with different priorities. Diversity that leads to ecosystem resilience, coordination cost right-sizing, and better decision-making is good. Diversity that leads to mission drift is not. We are not neutral on the direction Ethereum takes. CROPS are not just things we “believe in”, they are characteristics we understand must be thoughtfully prioritized at every fork for Ethereum to realize its potential. We are partisans for and builders of something of such incredible neutrality that it will fundamentally reshape the world we live in; we wish to work with everyone committed to this shared purpose.

The Pope just allied with Anthropic. The arc of history is long but it bends towards Warhammer 40K.

I sometimes dig onchain contracts and find admin wallets that are unverified msig proxies. A function "Is this a proxy" must be triggered *at least* once to detect the implementation, and access signers/thresholds/etc. If you need to click on this, it means nobody checked before

This 8 minute video by Nassim Taleb will show you how a 70-year-old formula used by quants separates top traders from bankrupt ones Bookmark & watch it. It will change the way you trade forever. Then read the post below

people going crazy about the EF mandate and CROPS don't understand that this is completely orthogonal to other areas of improvement — there are NO tradeoffs

time to build @Bulkman3D

I had a great time working on this project, and am confident this type of infrastructure will make DeFi safer. For those interested in the technical details of the SAVE framework used by the Midas Attestation Engine, checkout this blog post -> ionlab.io/blog/save-framewor…

As 2025 draws to a close, we want to express our deepest gratitude to our clients, partners, and fellow service providers building alongside us. From launching LlamaGuard NAV to expanding our team, we are forging a safer DeFi future. Read our full end-of-year statement below 👇 As we close the year, we’ve found ourselves returning to a simple idea that has grounded us throughout 2025: our work is fundamentally an act of service to the people who build, secure, and rely on open financial systems. DeFi is often described in terms of protocols, models, or code, but what inspires us most is the human network behind it: clients, partners, our fellow service providers, and the DeFi users who depend on the systems we help safeguard. This community constitutes a large extended family, and we are grateful to play our small part in supporting it. Thank you for trusting us, challenging us, collaborating with us, and sharing in our vision for a safer, more transparent, and more resilient on-chain world. Highlights this Year This year marked meaningful steps forward in our mission: Make DeFi win through transparent and rigorous risk management. 🔹 Onboarded as Risk Partner for Aave Horizon Horizon represents the frontier of TradFi–DeFi convergence, and we’re honored to serve as its risk partner. Our work spans onboarding asset issuers, implementing risk alerting systems, managing protocol parameters, and helping to ensure safe and competitive growth for the ecosystem’s leading institutional venue. 🔹 Launched LlamaGuard NAV on Aave Horizon We introduced LlamaGuard NAV, a next-generation risk-aware NAV oracle developed with our partners Chainlink Labs and Aave Labs. As DeFi applications scale into more complex data environments, real-time, transparent risk intelligence becomes core infrastructure — and we’re proud to contribute to that foundation. 🔹 Expanded Real-Time Transparency with PoR Systems Our independent PoR work with Ethena strengthened our conviction that the industry needs robust, credibly neutral, high-frequency reserves attestations. This year’s progress set the stage for a generalized, automation-ready PoR framework that can support a broad set of issuers and markets. Stay tuned for exciting updates on this topic. 🔹 Prepared Curve for LlamaLend V2 We supported Curve with research for safe debt ceilings, oracle configurations, and market parameterization for LlamaLend V2. We also developed new interest rate models for looping markets and built the risk foundations for PT markets — now progressing through audit. A Year of Collaboration We’re grateful to our core partners for the collaborations and your continued trust in us this year: @aave, @chainlink, @CurveFinance, @ethena 🎄 As a small nod of appreciation, our holiday card features ornaments representing teams we believe exemplified excellence this year. We’re grateful to be learning from and building with you. Every step forward this year was shaped by the teams who worked alongside us — developers, asset issuers, risk contributors, growth teams, and service providers. Whether we were designing collateral methodologies, refining PoR standards, or implementing new risk primitives, your insight and partnership consistently elevated the work. In a year defined by rapid innovation and increasing complexity, your partnership grounded us. It reinforced our belief that DeFi thrives when we operate as a true extended family: supporting one another, learning from one another, and working collectively to make the ecosystem safer and more resilient for everyone. Looking Ahead In 2025, we focused deeply on a small group of core protocol partners, investing in their systems and communities. That commitment remains unchanged. But the demand for reliable, real-time risk tooling continues to grow — and with it, our responsibility to support a larger share of the ecosystem. To meet this need, we’re expanding LlamaGuard automations, transforming our methodologies into scalable, on-chain risk infrastructure. Our roadmap includes: Risk-managed price feeds that strengthen oracle reliability and market integrity A generalized proof-of-reserves framework adaptable to diverse issuers and asset structures Automated implementations of risk methodologies, enabling continuous, verifiable oversight at protocol scale Delivering these systems requires close collaboration across the stack: working with Chainlink on foundational automation and oracle infrastructure; partnering with risk and growth teams to operationalize their methodologies; and supporting asset issuers in meeting the increasingly rigorous expectations of their clients. Our goal is straightforward: scale high-quality risk management to more protocols, more assets, and ultimately more users. By extending our reach without sacrificing depth, we plan to maximize the benefit to the millions of people who rely on DeFi every day. We’re Hiring The industry’s growing focus on responsible risk management has led to a significant expansion in demand for our work — and we’re scaling our team accordingly. In 2026, we’re hiring across: Quantitative Research Backend & Smart Contract Engineering Business Development Marketing & Communications If you’re energized by the challenge of building the risk infrastructure that will underpin the next decade of DeFi, we’d love to hear from you. Visit our careers page or reach out on Telegram. Final Thoughts As we enter the new year, we remain committed to: putting people at the center of our risk frameworks, building tools that empower protocols and users alike, strengthening the foundations of open, transparent finance, and serving this extended family with humility, rigor, and heart. Thank you for being part of our journey. Wishing you a warm and restful holiday season — from all of us at LlamaRisk. Here’s to a safe, collaborative, and inspired 2026. ❤️

Since launching in August, @aave Horizon has quickly risen to #1 venue for the composable use of Real-World Assets attracting over $550M. Our report covers key trends: the growing demand for borrowing against RWAs and the new risk infrastructure supporting institutional adoption. Market Trends Supply growth has been driven primarily by high-yield assets, such as @SuperstateInc's USCC, with close to 50% of its total supply being used as collateral on Horizon. Although recent basis compression, resulting from a significant shift in market sentiment, has reduced yields from approximately 10% to 5%, these assets continue to be the primary collateral used. The data suggests users, by borrowing stablecoins against RWAs, are profiting from the spread between asset yields and borrow costs. This activity has pushed the blended utilization rate to 53.6%. Infrastructure Evolution From day one, reliance on single self-reported offchain data points for NAV has been identified as a key risk vector. To address this, LlamaRisk has deployed LlamaGuard NAV in collaboration with @chainlink and @aave Labs. This system uses Adaptive Bounds to validate offchain pricing data against dynamic thresholds. If a price update falls outside expected market conditions, it is rejected before reaching the Horizon, protecting users from faulty liquidations. The Asset Landscape The ecosystem continues to diversify with support for @Ripple's RLUSD, @vaneck_us's VBILL @anemoycapital JTRSY/JAAA, @SuperstateInc USCC/USTB @Circle USDC/USYC. Significant growth potential is foreseen from credit strategies like @anemoycapital's JAAA, which provides exposure to AAA CLOs. We’re also in communication with several more reputable issuers, such as @Securitize, to expand integrations. Although lower-yielding assets, such as Money Market funds and T-Bill-backed assets, have seen modest usage within Aave Horizon, we expect new use cases to emerge in the coming months.

It is rather unfortunate you lost your son’s college fund at the roulette table last night but I hope you noticed how smoothly the wheel was spinning and how efficiently the dealer scooped your chips off the table

Introducing LlamaGuard NAV Powered by Chainlink—a dynamic risk-adjusted oracle solution purpose-built for pricing tokenized real-world assets (RWAs), built in collaboration between Chainlink, @LlamaRisk, and @aave. llamarisk.com/research/llama… Built on Chainlink’s proven decentralized oracle network infrastructure and backed by LlamaRisk’s risk management expertise, LlamaGuard NAV enhances the robustness of delivering Net Asset Value (NAV) data onchain by incorporating smart dynamic price bounds. The initial implementation of LlamaGuard NAV is live and integrated with Aave Horizon—the largest RWA lending market in DeFi where institutions or other qualified users borrow stablecoins against RWAs. The next major upgrade to LlamaGuard NAV will leverage the Chainlink Runtime Environment (CRE) for enhanced modularity and extensibility. With the market for tokenized RWAs now totaling over $30B and expected to grow rapidly in the years to come, the need for mission-critical infrastructure to safely price and manage the risk around RWA markets is ever increasing. By combining the proven reliability and neutrality of Chainlink infrastructure for onchain data delivery with LlamaRisk’s deep expertise on protocol risk management, LlamaGuard NAV provides Aave with a robust, automated risk management solution based on macroeconomic data that can safely scale the adoption of tokenized assets across DeFi.

Introducing LlamaGuard NAV ⛊ A next-gen oracle for RWAs, built with @chainlink & @aave, is going live in production on Aave Horizon. It delivers dynamic, risk-adjusted NAV feeds with automated safeguards, powering secure and scalable DeFi. Read the full announcement ↓

First week of Horizon is behind us. TVL surpassing $80m & over $16.5m RWA-backed loans, the protocol is showing promising results! Built on @aave V3 with @chainlink bounded NAV feeds, Horizon combines DeFi liquidity with institutional-grade risk oversight from LlamaRisk.👇 ➡️ Key Performance Metrics: - Total Value Locked (TVL): Exceeded $80 million. Stablecoin deposits constitute approximately $50 million of this total. - Total Borrows: Surpassed $16.5 million. - RLUSD Supply: The supply cap was raised twice (from $25M to $40M) to accommodate demand, which was influenced by an active rewards campaign. The cap was reached rapidly - USCC Supply: The supply cap was increased from $10.6M to $40M. Horizon now holds approximately 7.5% of the total on-chain supply of USCC. ➡️Three primary use cases we expect: 1- Instant Institutional Credit: Access immediate working capital by borrowing against tokenized assets, avoiding issuer redemption delays and fees. 2- Leveraged Carry Trades: Execute a carry trade by borrowing stablecoins against yield-bearing RWAs, using recursive looping to scale the position and capture the basis between the borrow rate and asset yield. 3- DeFi Yield Generation: Generate yield through two primary avenues: passively supply stablecoins to earn interest from institutional borrowing, or actively execute farming strategies like supplying an RWA to mint and stake GHO.

3 months into @Aave's Umbrella module, the data is compelling! This first-loss layer is a vast improvement on the legacy Safety Module, boosting efficiency, cutting the cost per dollar of coverage from $0.21 to $0.12. Our quants dug into the on-chain data—here's what we found.👇 First, a quick recap. Umbrella is a set of first-loss capital vaults (USDC, USDT, WETH, GHO) that act as the first defense against protocol shortfalls. Deployed by @bgdlabs, its architecture features permissionless slashing, which can be triggered once a deficit is recognized above a parametrizable offset. The impact on efficiency for the @AaveAave DAO is undeniable: the annual cost per dollar of coverage has plummeted by 43%. A full transition could drop this cost to an incredible $0.028. This success is fueled by strong capital inflows, with the modules attracting a cumulative $554M in deposits. Beyond just Aave users, Umbrella pulled in $164M in new capital from across the ecosystem, including Binance, Sky Protocol, Fluid, and Morpho. More importantly, the capital is sticky, with ~82% retention among new users from identified protocols. Digging deeper, we see significant whale influence, especially in the WETH module, where one whale group accounts for ~54% of the TVL. We also observed a "perpetual cooldown" behavior: while up to 45% of funds in the USDC module are in the 20-day cooldown, actual withdrawal rates are low (~38-40%), as users obtain optionality while continuing to earn rewards. The ecosystem is already building on top of Umbrella, with DeFi protocols like @pendle_fi and @yield creating secondary markets for the staked tokens. This adds another utility layer and signals a strong future for the module's composability. Overall, the first three months show the Umbrella Safety Module is a major step forward in capital efficiency and protocol safety for @Aave. We’re excited to contribute to the next phase of the Umbrella roll-out!.

“Don’t Trust, Verify” has never been more relevant in DeFi. With smart contracts growing increasingly complex and billions in assets secured on-chain, the question arises: what role do bug bounty programs play in safeguarding against vulnerabilities? We analyzed the landscape of @Aave listed assets 👇 Bug bounty programs incentivize independent researchers to discover vulnerabilities by offering financial rewards. Long established in Web2, this model is now an essential layer in Web3 security, addressing the unique risks of smart contracts—especially the potential loss of user funds. Rewards scale by severity, with the highest-impact bugs earning maximum payouts. Our report reviewed Aave V3 markets and focused on assets with at least $5M in total value supplied (TVS). Each asset was evaluated based on whether it was: • Explicitly included in a bug bounty scope, • Implicitly covered by protocol-wide policies, or • Without any verifiable coverage. Where coverage could not be confirmed via public documentation, the asset was deemed to lack a formal bounty. Baseline Standards • A minimum bounty of $50,000 is required to attract skilled researchers, regardless of TVL. • For protocols with TVL > $250M, maximum payouts should exceed $1M to demonstrate a serious commitment and provide a competitive incentive versus black-hat exploitation. Findings • 47 assets on Aave V3 met our review threshold (> $5M TVS). • 33 assets ($19.7B supplied) are backed by adequately sized bounties. • 10 assets ($19.2B supplied) have either no coverage or severely insufficient programs. • 4 assets ($10.8B supplied) meet minimum criteria but require higher payouts or broader scope. Issuers needing improvement include: @circle (USDC, EURC), @tether (USDT), @BitGo (WBTC), @EtherFi (eBTC, weETH), @monerium (EURe), @GnosisDAO (GNO), @Ripple (RLUSD), @PayPal (PYUSD), @withAUSD (AUSD), @KelpDAO (rsETH), @avax (WAVAX), @Binance (WBNB). Next Steps Following this report, we’ll launch a weekly/daily series spotlighting issuers flagged in our analysis. The goal: encourage asset issuers to establish—or upgrade—bug bounty programs in line with our recommended standards.

Checkout our new SVR dashboard 👀 @chainlink Now supporting the Core and Prime markets of @aave —> svr.llamarisk.com

Llamas ♥️ Ghosts We've been renewed @aave - this time for an entire year! This vote is proof that bet the DAO took on the little guy is continuing to pay off and the superior user fund protection of dual-risk provider systems Thank you to each friendly 👻👻👻

Alt L1s are cooked on speed/cost. So what's left for them? Some alt L1s, like hl or Story, claim they have to be alt L1s for their tech customizations. This used to be true, but is becoming false. Ethereum L2 SDKs are gradually winning this. All that's left for alt L1s are classic general network effects like VM, active wallets, capital, devs, integrations, accumulated state, and app-level network effects. Every alt L1 is hopelessly cooked here except - we must be honest - Solana. Solana started with a tech strength (speed/cost) and now their tech is becoming uncompetitive and they've graduated to rely on classic ecosystem network effects. In this next era, Solana is best thought of as having weak tech but highly competitive ecosystem/growth programs. Ethereum is on track to dominate speed/cost/tech/UX. But to maximize our market share, we still need to utterly defeat Solana's respectable ecosystem momentum. That's why the time is now for Ethereum to 10x-100x app layer growth programs. And this is exactly what's happening across all L2s, the L1, the EF, and new institutions like Etherealize. The culture shift has already occurred. Capital and talent are actively being allocated to app layer growth - especially novel real world apps instead of a focus on infra. The future is extremely bright for the Ethereum community and ETH holders.

Because of the reserves announcement now is the time - a short window of opportunity for everyone who builds large stable DeFi, institutional custody solutions, institutional staking, stablecoins, institutional wallets to present how mature, how secure, and how broadly integrated in global finance Ethereum ecosystem is. I cannot promise it would be delivered by the EF quickly enough, I am not sure if Etherealize is already fully operational to execute this within hours - so please go and do not wait for us. We will look how to improve it with EF but Ethereum is a sum of all great builders and it handles really high institutional stakes. @Anchorage @aave @21shares_us @BitGo @CoinSharesUS @MorphoLabs @Etherealize_io @EtherFi @LidoFinance @twinstake_io @FigmentCapital @base @arbitrum @Optimism @Starknet @Consensys @zksync @Uniswap @1inch @nethermind (I am writing from memory, please add and highlight more - also let us talk more)