General
Token Asset Name
wUSDM (Wrapped USD Mountain)
A description of the project and the token
USDM, the first product offered by Mountain Protocol, is a regulated, permissionless, and yield-bearing stablecoin, fully backed by US Treasuries. It is designed to maintain a consistent value pegged to the US dollar, making it a reliable digital asset for transactions and savings. Peg is kept by having primary customers buy/sell USDM at $1 and by the US Treasuries held as collateral for USDM on a bankruptcy remote SPV: USDM Reserves Ltd.
USDM follows a proven model used by all the well-known stablecoins, rewarding holders, currently at a 5% APY. The wrapped USDM (wUSDM), on the other hand, represents a wrapped version of the native USDM stablecoin, built as a value-appreciating token that ensures that its price increases reflect all the rewards that USDM has generated over time.
Mountain Protocol is a prudentially-regulated financial entity, Class F licensed by the Bermuda Monetary Authority (License #202302512) and following regulated entity requirements such as governance, risk management, external audits, and more.
Benefits to Compound Community
Using wUSDM as collateral allows users to arbitrage the yield on Compound when borrow rates are low, creating a virtual “floor” on yields at or about the USDM rates (5% APY).
This means that when appetite for leverage is low, lenders of USDC/USDT can still earn yield by creating an arbitrage with USDM, resulting in a more efficient market.
Resources
Website: https://mountainprotocol.com/
Twitter: x.com
Linkedin: Mountain Protocol | LinkedIn
Github: Mountain Protocol · GitHub
Documentation: https://docs.mountainprotocol.com/
The proposal author their contact info
Martin Carrica
Telegram: @mcarrica
Twitter: @mcarrica
Linkedin: Martin Carrica - Mountain Protocol | LinkedIn
The relationship between the author of the new market proposal and the token
CEO and Co-founder of Mountain Protocol
Social channels Metrics
Official media accounts can be found here: link
Market Risk Assessment
Market Cap of the token
US$ 43,276,696 USDM market cap total (as of August 7th, 2024)
US$ 4,267,638 USDM market cap on Arbitrum (as of August 7th, 2024)
Minimum and maximum market cap of the token within the last 6 months.
Total
Maximum: US$ 156.1M (April 2nd, 2024)
Minimum: US$ 43.2M (August 7th, 2024)
Ethereum
Maximum: US$ 154.7M (March 31th, 2024)
Minimum: US$ 33.7M (August 12th, 2024)
Arbitrum
Maximum: US$ 6.8M (August 13th, 2024)
Minimum: US$ 30.1k (February 14th, 2024)
The largest exchanges where the token is listed and its respective liquidity*
- DeGate on Ethereum USDM 10,224,470.
- Curve sDAI/USDM pool on Ethereum US$ 10,268,327.
- Curve USDM/USDC pool on Arbitrum, total liquidity of US$ 6,094,465.
- Curve USDM/USDC pool on Optimism, total liquidity of US$ 2,345,529.
- Curve USDM/USDC pool on Polygon PoS, total liquidity of US$ 1,428,728.
- Curve USDM/3crv pool on Ethereum, total liquidity of US$ 820,817
- Curve USDM/USDC pool on Base, total liquidity of US$ 252,059.
- Uniswap v3 wUSDM/wstETH pool on Arbitrum, total liquidity of US$ 206,525
All as of August 7th, 2024
The largest smart contracts balances of tokens and what those contracts do.
Besides the above-mentioned liquidity pools
- Ethereum:
- Manta wUSDM 1,992,603 - token bridge
- Injective wUSDM 272,248 - token bridge
- Arbitrum:
- IPOR USDM 450,073 - hedging pool
- Dolomite wUSDM 297,659 - lending market
- HMX wUSDM 179,426 - perp dex
- Base:
- Morpho wUSDM 482,611 - lending market
Provide the volatility of the token. Rolling windows of 1,3,6 & 12 month periods would be ideal. For more info see Gauntlet’s volatility guide.
N/A (USDM is a stablecoin).
Price has been $1 with the expected volatility around $1 before arbitrage opportunities offset gas costs.
Total supply*
There is no total max supply. Supply is generated by purchase of USDM.
Emission schedule.
No schedule.
Note: Gauntlet will also pull live data to conduct their market risk assessment after the Checklist is submitted.
Decentralization
How is this asset distributed amongst token holders? List the top 10 holders, the percentage of each holder, and tag any of them if they are known.*
As of August 13th, 2024:
List all of the privileged roles in the token contract. This can include whitelisted EOAs, Multi-sigs or DAOs.*
Is it pausable?*
Yes.
Does it have a blacklist or whitelist?*
Can have a blacklist. No need to whitelist.
Smart contract risks
Codebase & On-chain Activity:
Provide a Github repository for the underlying token contracts*
Provide a test suite with code coverage.
OpenZeppelin Security Center: https://security.mountainprotocol.com/
Provide Etherscan links with verified contracts
USDM: $1.00 | Mountain Protocol USD (USDM) Token Tracker | Etherscan
wUSDM: Wrapped Mountain Protocol USD (wUSDM) Token Tracker | Etherscan
Give the age of the token in days*
On Ethereum: 353
On Arbitrum: 245
Given the number of transactions in the contract to date
USDM:
Ethereum: 6,370
Arbitrum: 29,983
wUSDM:
Ethereum: 4,050
Arbitrum: 36,629
Security Posture
What audits, if any, were performed? Provide links to the reports if they exist.*
USDM and wUSDM where independently audit by OpenZeppelin.
Does the project have an active bug bounty program?*
Provide emergency contacts with their responsiveness levels and response availabilities*
- Matias Caricato, CTO and Co-founder, tg: @matieth (responsiveness level high - 24/7)
- Martin Carrica, CEO and Co-founder, tg: @mcarrica (responsiveness level high - 24/7)
- Jason Mindlin, Chief of Staff, tg: @jasonmindlin (responsiveness level medium - weekdays)
- Mountain Protocol has an alert suite with shifts to ensure 24/7 coverage of market anomalies, such as depegs, large trades or other suspicious activity.
List additional security and formal verification tools used in development
- Static Analysis: Slither (tokens/.github/workflows/code-quality.yml at main · mountainprotocol/tokens · GitHub)
- Symbol Execution: Mythril (tokens/.github/workflows/code-quality.yml at main · mountainprotocol/tokens · GitHub)
- GitHub CodeQL analysis
- GitHub Dependabot
- Private vulnerabilities scan and pentests
List all monitoring services used by the token, if any.
-
Security Center by OpenZeppelin: https://security.mountainprotocol.com/
-
Security Policy: tokens/SECURITY.md at main · mountainprotocol/tokens · GitHub
-
Forta
-
Custom Bots
Multi-Chain Strategy
Will the token include implementations on other networks*?
Yes. USDM is available on Ethereum Mainnet, Polygon PoS, Base, Arbitrum, and Optimism. Will be available also on Avalanche, CELO, Gnosis, Linea, Polygon zkEVM, and Scroll in the coming months.
If so, will the tokens be natively minted on the other networks or bridged across?
Above-mentioned chains are natively minted. There are some chains with bridged wUSDM, namely Manta Network and Injective, expected given the permissionless nature of USDM/wUSDM.
Are there any mitigations in the contracts in case a bridge becomes inoperable or compromised?
The contract can be paused and upgraded and/or specific addresses can be blocklisted, as per regulatory requirement.
Note that USDM and wUSDM is issued natively on multiple chains, without bridge risk (Arbitrum, Base, Ethereum, Optimism, Polygon POS)
Token contract Behavior:
Does the token have more than one address?*
No, for native USDM and wUSDM all token addresses are the same on all chains.
-USDM: 0x59d9356e565ab3a36dd77763fc0d87feaf85508c
-wUSDM: 0x57f5e098cad7a3d1eed53991d4d66c45c9af7812
Does the token use a compiler version greater than 0.8.0 or the SafeMath? If not, explain how the protocol deals with possible overflows and underflows*
Solidity version higher than 0.8.0
During the execution of the token’s functions, does the token execute external code chosen by the caller or receiver? If so, please explain the reasoning behind this decision*
Yes, during the execution of the wUSDM transfers, the token executes external code through calls to USDM.isBlocked and USDM.paused. These calls are made to ensure a unified state for both USDM and wUSDM regarding pausing and the blocklist.
How does the token contract deviate from a standard implementation of ERC20? Any additional features that the Compound DAO should know about?*
USDM (which backs the proposed wUSDM) is a rebasing token + mint/burn + blocklist + pausing.
Is it burneable?*
Yes
Does the token contract have a fallback function? If so, when does it revert?
No, the token contract wUSDM does not have a fallback function.
Does it have a fixed supply? If no, who can mint?*
No, Mountain Protocol, as the sole issuer of USDM, has the authority to mint new tokens.
Is it a rebasing token?*
The USDM is a rebasing token. The wUSDM is a value-appreciating token that has a deterministic price path based on the USDM rewards rate, using a tokenized vault standard ERC4626.
Does the token charge fees on transfers?*
No
Does it implements any transfer hooks? Or hooks on any method?*
Yes, _beforeTokenTransfer for checking pausing and blocklisting state.
Is the contract performing arbitrary delegatecalls?* If the answer is yes, indicate who can make these calls and to what contracts.
Not directly on wUSDM. Instead, it inherits this capability from the OpenZeppelin UUPSUpgradeable contract. Only the account with the UPGRADE_ROLE can make these calls, and it can specify the target contract for the delegatecall during the upgrade process.
Is it flash mintable? If yes, please provide more information on this feature*
No, given compliance requirements.
Is it flash loanable? If yes, please indicate who offers the service.*
No.
What are the typical gas costs for calling each of the standard ERC20 functions?
40-60k gas for transfer
Price Feed Behavior
Is the price feed supported by ChainLink?
Chainlink has confirmed that they will provide a price feed for wUSDM and should be up and running in a matter of weeks.
If not, what entity is responsible for posting price updates? List names and addresses which may update the price feed
Chronicle (Arbitrum): Chronicle Protocol - Cost-Efficient, Verifiable Blockchain Oracles
How often will price updates be posted?
Chronicle: >1% price difference or >24 hours
Chainlink: TBC
At what price difference threshold will price updates be posted?
Chronicle: >1%
Chainlink: TBC
Can the AggregatorV3Interface functions for this price feed ever revert when called?
Chronicle Oracle is read-protected by address whitelisting.
Chainlink: TBC
Does the bytecode of the custom price feed match an audited version?
Yes. Chronicle Oracles have been audited by ChainSecurity, ABDK & Spearbit.
Chainlink: TBC
Upgradability:
Is it upgradeable?* If so:
Yes.
Who is authorized to make an upgrade?
Role has not been assigned to any address. If it were, it would be exclusively for the Mountain Protocol team. Access is granted by Admin (4/7 multisig): 0x313d5B7EfDcd84e8a52D425282B03860e9354d74
Can an upgrade happen instantaneously or is there a time-lock delay?
No timelock, similar to other centralized stablecoins.
Which components are upgradable?
Full contract, due to regulatory requirements, similar to other centralized stablecoins.
How does the upgradeability design work? Who manages it and are how upgrades performed?
Details are not shared due to OpSec reasons. At a high level, the company uses the Admin to grant role to an upgrader using OpenZepellin Defender + safe multisig approval (4/7). All upgrades are first tested on testnet before formal upgrades.
We do not expect upgrades to the SC given how simple it is.
Does it emit an event when the implementation is updated?
Yes, Emits an Upgraded event (OZ UUPSUpgradeable).
. 
