Under active development. We're continuously fixing and improving the metrics and parameters, so scores and ratings may change. See changelog

RWABeat

Syrup USDC

Share in a Maple USDC lending pool (ERC-4626). Its value grows with interest from overcollateralized loans to crypto institutions and from Aave and Sky strategies. It is not a stablecoin.

Private creditNon-US persons onlyOnchain dataIssued by Maple Finance · Platform Maple Finance
Value
$936.9M
Stage
None
Below Stage 0: key facts not disclosed
Single-key powers
13
Single key holds critical power
Oracle age
Live
NAV computed onchain every block
Used as DeFi collateral
$63.5M· 11 markets

Control

Who can freeze, mint, pause or upgrade, and what stops them?

Red

A single key can change the onchain price.

  1. A single key can change the onchain price.

  2. A single key can move the assets backing the token.

  3. Multisig signers aren't named, so their independence can't be checked.

  4. A 3-of-6 multisig can replace the contract code with no timelock.

  5. A 3-of-5 multisig can change the onchain price with no timelock.

  6. A 3-of-5 multisig can move the assets backing the token with no timelock.

  7. A 3-of-5 multisig can grant or revoke every other role with no timelock.

  8. A single key can change who may hold the token.

  9. On arbitrum, base, ink, monad, tempo, robinhood chain, arc, solana, the token depends on a bridge (Chainlink CCIP).

  10. The issuer documents its admin powers.

  11. Audited by Sigma Prime (2026-01).

  • Bug bounty on Immunefi, up to $500,000.

Audits and bug bounty

  • Sigma Prime · CCIP Receiver1 Jan 2026

Bug bounty on Immunefi, up to $500,000.

Chains and bridges

Holders on a bridged chain also depend on the bridge.

  • ethereumIssued natively · Maple
  • arbitrum, base, ink, monad, tempo, robinhood chain, arc, solanaBridged copy · Chainlink CCIP

Who controls syrupUSDC on Ethereum

Token and service contracts on the left, the accounts holding their powers on the right. Edge color is the risk status of that power.

Powers

Every privileged power we found, normalized to canonical power types.

  • UpgradeCriticalYellow
    Maple SecurityAdmin SafeSafe 3/60x6b1A…0818

    No delay · via MapleWithdrawalManager.upgrade · securityAdmin, no delay, to any version the governor registered on the WithdrawalManager factory (the pool delegate can also upgrade after a 7-day scheduled call)

  • UpgradeCriticalYellow
    Maple SecurityAdmin SafeSafe 3/60x6b1A…0818

    No delay · via LoanManager.upgrade · securityAdmin, no delay, to any version the governor registered on the LoanManager factory (the pool delegate can also upgrade after a 7-day scheduled call)

  • UpgradeCriticalYellow
    Maple SecurityAdmin SafeSafe 3/60x6b1A…0818

    No delay · via MapleAaveStrategy.upgrade · securityAdmin, no delay, to any version the governor registered on the strategy factory (the pool delegate can also upgrade after a 7-day scheduled call)

  • UpgradeCriticalYellow
    Maple SecurityAdmin SafeSafe 3/60x6b1A…0818

    No delay · via LoanManager.upgrade · securityAdmin, no delay, to any version the governor registered on the LoanManager factory (the pool delegate can also upgrade after a 7-day scheduled call)

  • UpgradeCriticalYellow
    Maple SecurityAdmin SafeSafe 3/60x6b1A…0818

    No delay · via MaplePoolManager.upgrade · securityAdmin, no delay, to any version the governor registered on the PoolManager factory (the pool delegate can also upgrade after a 7-day scheduled call)

  • UpgradeCriticalYellow
    Maple SecurityAdmin SafeSafe 3/60x6b1A…0818

    No delay · via MapleSkyStrategy.upgrade · securityAdmin, no delay, to any version the governor registered on the strategy factory (the pool delegate can also upgrade after a 7-day scheduled call)

  • UpgradeCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MapleProxyFactory.registerImplementation, setDefaultVersion, enableUpgradePath · governor (decides which code MaplePoolManager can be upgraded to)

  • Set priceCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via LoanManager.impairLoan, removeLoanImpairment · pool delegate or governor (marks a loan's value down or back up in the NAV)

  • Set priceCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via MapleAaveStrategy.impairStrategy, deactivateStrategy, reactivateStrategy · pool delegate, governor or operationalAdmin (changes how the strategy's assets count in the NAV)

  • Set priceCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via LoanManager.impairLoan, removeLoanImpairment · pool delegate or governor (marks a loan's value down or back up in the NAV)

  • Set priceCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via MaplePoolManager.triggerDefault, finishCollateralLiquidation · pool delegate, governor or operationalAdmin (realizes loan losses into the NAV)

  • Set priceCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via MapleSkyStrategy.impairStrategy, deactivateStrategy, reactivateStrategy · pool delegate, governor or operationalAdmin (changes how the strategy's assets count in the NAV)

  • Set priceCriticalYellow
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MapleAaveStrategy.impairStrategy, deactivateStrategy, reactivateStrategy · pool delegate, governor or operationalAdmin (changes how the strategy's assets count in the NAV)

  • Set priceCriticalYellow
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MaplePoolManager.triggerDefault, finishCollateralLiquidation · pool delegate, governor or operationalAdmin (realizes loan losses into the NAV)

  • Set priceCriticalYellow
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MapleSkyStrategy.impairStrategy, deactivateStrategy, reactivateStrategy · pool delegate, governor or operationalAdmin (changes how the strategy's assets count in the NAV)

  • Set priceCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via LoanManager.impairLoan, removeLoanImpairment · pool delegate or governor (marks a loan's value down or back up in the NAV)

  • Set priceCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MapleAaveStrategy.impairStrategy, deactivateStrategy, reactivateStrategy · pool delegate, governor or operationalAdmin (changes how the strategy's assets count in the NAV)

  • Set priceCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via LoanManager.impairLoan, removeLoanImpairment · pool delegate or governor (marks a loan's value down or back up in the NAV)

  • Set priceCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MaplePoolManager.triggerDefault, finishCollateralLiquidation · pool delegate, governor or operationalAdmin (realizes loan losses into the NAV)

  • Set priceCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MapleGlobals.setManualOverridePrice, setPriceOracle · governor (collateral price oracles used for liquidations)

  • Set priceCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MapleSkyStrategy.impairStrategy, deactivateStrategy, reactivateStrategy · pool delegate, governor or operationalAdmin (changes how the strategy's assets count in the NAV)

  • Allocate fundsCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via LoanManager.fund, rejectNewTerms, acceptNewTerms · pool delegate (only to loans whose borrower the governor or operationalAdmin approved)

  • Allocate fundsCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via MapleAaveStrategy.fundStrategy, withdrawFromStrategy · pool delegate or a STRATEGY_MANAGER instance registered in Globals

  • Allocate fundsCriticalRed
    STRATEGY_MANAGER bot (single wallet)EOA0xfB2C…2b62

    None · via MapleAaveStrategy.fundStrategy, withdrawFromStrategy · pool delegate or a STRATEGY_MANAGER instance registered in Globals

  • Allocate fundsCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via LoanManager.fund, callPrincipal, removeCall +2 more · pool delegate (only to loans whose borrower the governor or operationalAdmin approved)

  • Allocate fundsCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via MaplePoolManager.setIsStrategy · pool delegate, governor or operationalAdmin (turns a strategy that can pull pool funds on or off)

  • Allocate fundsCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via MapleSkyStrategy.fundStrategy, withdrawFromStrategy · pool delegate or a STRATEGY_MANAGER instance registered in Globals

  • Allocate fundsCriticalRed
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via MapleSkyStrategy.setPsm · pool delegate, governor or operationalAdmin

  • Allocate fundsCriticalRed
    STRATEGY_MANAGER bot (single wallet)EOA0xfB2C…2b62

    None · via MapleSkyStrategy.fundStrategy, withdrawFromStrategy · pool delegate or a STRATEGY_MANAGER instance registered in Globals

  • Allocate fundsCriticalYellow
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MaplePoolManager.addStrategy · governor or operationalAdmin

  • Allocate fundsCriticalYellow
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MaplePoolManager.setIsStrategy · pool delegate, governor or operationalAdmin (turns a strategy that can pull pool funds on or off)

  • Allocate fundsCriticalYellow
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MapleSkyStrategy.setPsm · pool delegate, governor or operationalAdmin

  • Allocate fundsCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MaplePoolManager.addStrategy · governor or operationalAdmin

  • Allocate fundsCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MaplePoolManager.setIsStrategy · pool delegate, governor or operationalAdmin (turns a strategy that can pull pool funds on or off)

  • Allocate fundsCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MapleSkyStrategy.setPsm · pool delegate, governor or operationalAdmin

  • Grant rolesCriticalYellow
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MapleGlobals.setValidBorrower, setValidPoolDelegate, setValidInstanceOf +2 more · governor or operationalAdmin (approves borrowers, pool delegates and bots)

  • Grant rolesCriticalYellow
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MaplePoolPermissionManager.setPermissionAdmin · admin or operationalAdmin

  • Grant rolesCriticalYellow
    Maple governance proposer SafeSafe 4/70xd6d4…a196

    No delay · via MaplePoolPermissionManager.setPermissionAdmin · admin or operationalAdmin

  • Grant rolesCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MapleGlobals.setSecurityAdmin, setOperationalAdmin, setPendingGovernor +6 more · governor

  • Grant rolesCriticalGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MapleGlobals.setValidBorrower, setValidPoolDelegate, setValidInstanceOf +2 more · governor or operationalAdmin (approves borrowers, pool delegates and bots)

  • PauseHighGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MapleGlobals.setProtocolPause, setContractPause, setFunctionUnpause · governor or securityAdmin

  • PauseHighGreen
    Maple SecurityAdmin SafeSafe 3/60x6b1A…0818

    No delay · via MapleGlobals.setProtocolPause, setContractPause, setFunctionUnpause · governor or securityAdmin

  • Set complianceHighYellow
    SyrupRouter (syrupUSDC; grants deposit permission on Maple-signed authorizations)Unknown contract0x134c…df76

    None · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighYellow
    SyrupRouter (other Maple pool)Unknown contract0x191a…3849

    None · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighYellow
    Permission admin (single wallet)EOA0x252e…B5d5

    None · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighYellow
    Permission admin (single wallet)EOA0x4575…8655

    None · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighYellow
    Permission admin (single wallet)EOA0x4f6F…aA1B

    None · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighYellow
    Permission admin (single wallet)EOA0x54b1…9Dca

    None · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighYellow
    Pool delegate (single wallet)EOA0xC1e1…B49f

    None · via MaplePoolPermissionManager.setPoolPermissionLevel, setPoolBitmaps, setLenderAllowlist +1 more · pool delegate, admin or operationalAdmin (decides who can deposit, redeem and transfer syrupUSDC)

  • Set complianceHighYellow
    SyrupRouter (other Maple pool)Unknown contract0xF007…5Ee2

    None · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighGreen
    Maple GovernorTimelockTimelock 3d0x2eFF…426b

    → Safe 4/7

    3-day delay · via MaplePoolManager.setLiquidityCap, setPoolPermissionManager · governor or operationalAdmin

  • Set complianceHighGreen
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MaplePoolManager.setLiquidityCap, setPoolPermissionManager · governor or operationalAdmin

  • Set complianceHighGreen
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighGreen
    Maple OperationalAdmin SafeSafe 3/50xCe1c…34E8

    No delay · via MaplePoolPermissionManager.setPoolPermissionLevel, setPoolBitmaps, setLenderAllowlist +1 more · pool delegate, admin or operationalAdmin (decides who can deposit, redeem and transfer syrupUSDC)

  • Set complianceHighGreen
    Maple governance proposer SafeSafe 4/70xd6d4…a196

    No delay · via MaplePoolPermissionManager.setLenderBitmaps · permission admins, admin or operationalAdmin

  • Set complianceHighGreen
    Maple governance proposer SafeSafe 4/70xd6d4…a196

    No delay · via MaplePoolPermissionManager.setPoolPermissionLevel, setPoolBitmaps, setLenderAllowlist +1 more · pool delegate, admin or operationalAdmin (decides who can deposit, redeem and transfer syrupUSDC)

For regulated securities, freeze and force-transfer powers are often legally required. Control rates who holds them and what checks exist, not whether they exist. A single key holding a critical power or freeze is red; a multisig with no timelock is yellow.

Discovered at block 26,176,587 · 12 Oct 2026 · tool discovery-0.1.0 · View raw JSON on GitHub ↗