Ethena Labs Security Smart Contract Audit

Summary

This report presents the results of an audit conducted by the Quantstamp team on the USDe token by Ethena Labs. The USDe token aims to be a decentralized stablecoin backed by interest-bearing tokens and shorts with the equivalent value in a delta-neutral strategy. USDe is a standard ERC-20 token with the OpenZeppelin burnable and permit extensions. While USDe is truly permissionless on-chain, minting and redeeming USDe is handled by Ethena Labs through a centralized smart contract. Owners of the USDe token can choose to stake their USDe in return for stUSDe, which will reward them with some of the profits of the underlying assets. Users should be aware that trust is required in the Ethena Labs team to manage the underlying financial positions that support the value of USDe. This also requires users to trust the exchanges in which Ethena Labs is creating their positions and that the perpetual shorts can be exercised, even in extreme market turbulence. The audit uncovered 13 findings, including four issues of medium severity. Our primary concern revolves around the high amount of trust users must have in Ethena Labs to maintain the value of USDe (ETHN-1). Overall, the code is well-written and contains sufficient documentation. It relies heavily on OpenZeppelin Contracts to handle various components of the project such as access control and tokens along with their extensions. We recommend reviewing this document in detail and fixing all the issues before deploying the code in production. **Update** We would like to highlight the commitment of the team to address all issues. Of the 13 issues raised, nine were fixed and the remaining four were acknowledged with sufficient reasoning. Additionally, updates were made to the documentation to clearly state the trust assumptions of the protocol.

Project