Metronome Synths (msUSD / msETH)

msUSD / msETH / Ethereum, Base, Optimism / May 19, 2026

Score Breakdown

Category	Weight	Score
Audits & Historical	20%	2.50
Centralization & Control	30%	3.30
Funds Management	30%	2.25
Liquidity Risk	15%	2.00
Operational Risk	5%	2.00
Final Score		2.6 / 5.0

Medium Risk

Overview

Metronome is a decentralized multi-collateral, multi-synthetic protocol that allows users to deposit crypto assets as collateral and mint synthetic versions of popular assets. The core product, Metronome Synth, enables minting of msUSD (synthetic USD), msETH (synthetic ETH), and msBTC (synthetic BTC).

Users deposit collateral (e.g., USDC, ETH, WBTC, or yield-bearing Vesper Finance tokens like vaUSDC, vaETH) and mint synthetics up to their collateral factor limit. Synthetic assets are always internally valued at their reference asset's oracle price (msUSD = $1.00, msETH = ETH price), which protects against DEX peg deviations triggering liquidations on the debt side.

Key features:

Productive Collateral: Vesper Finance yield-bearing tokens (vaUSDC, vaETH, etc.) can be used as collateral, earning yield while backing synthetics
Smart Farming: Automated yield looping — deposit productive collateral → mint synth → swap on DEX → redeposit
Synth Marketplace: In-protocol swap between synthetic assets with zero slippage
Cross-chain: Deployed on Ethereum, Optimism, Base, and Hemi via LayerZero OFT

The protocol was originally launched as Metronome 1.0 in June 2018. It relaunched as Metronome 2.0 in August 2022 with a new governance token (MET 2.0). The Synth protocol launched in early 2023. Built by Bloq, Inc., the same company behind Vesper Finance.

Links:

Risk Summary

Key Strengths

Deep and growing liquidity: $122.5M DEX pool TVL across in-scope chains (up from $93.4M, +31%), with ~$190M in yield aggregators (Main Street, Morpho, Vesper, Convex, Stake DAO, Beefy, Yearn, Pendle, Extra Finance).
Multi-chain presence: Deployed on Ethereum, Base, Optimism with significant liquidity on each.
Experienced team: Bloq Inc. (Jeff Garzik, Matthew Roszak) with 8+ years in crypto infrastructure. Same team behind Vesper Finance.
Long production history: Metronome 1.0 since 2018, Synth protocol since early 2023 (~3 years), with no direct smart contract exploits.
Fully on-chain over-collateralized model: Transparent reserves in Treasury contracts, Chainlink oracles, programmatic liquidations.
Comprehensive DeFi integration: Integrated with Main Street, Stake DAO, Morpho, Convex, Vesper, Beefy, Yearn, Pendle — indicating broad trust from major DeFi protocols.

Key Risks

Single multisig controls everything: The 3/5 Safe owns both ProxyAdmins (upgrades) and is the governor() on Pool and PoolRegistry (parameters). The on-chain Governor/Timelock is entirely unused. All 5 signers are identical on Ethereum, Base, and Optimism (5/5 overlap). L2s have no timelock. All signers are anonymous EOAs.
Governance completely inactive: No Snapshot proposals since MIP-30 (March 2025) — over 1 year of zero governance activity. Only 5-12 votes per proposal when active.
Vesper Finance dependency: Productive collateral tokens (vaUSDC, vaETH) introduce multi-layer smart contract risk — Vesper strategies route through Euler, Aave, Curve, Convex, and Frax beneath the va-tokens. Same parent company (Bloq) creates concentration risk. LlamaRisk noted >92% of collateral consists of Vesper tokens.
No fallback oracle: Chainlink is the sole oracle with no cross-check or fallback source. Quantstamp flagged this as medium-risk; still unresolved.
Collateral factors untested: LlamaRisk noted collateral factors were "chosen without testing whether they are optimal" — and they have since been increased (from 60-75% to 67-85%) without public simulation results.
No insurance fund: Protocol lacks an insurance fund to cover potential bad debt from suboptimal liquidation parameters.
Modest bug bounty: $50K max payout is low relative to protocol TVL (~$25M).
No new audits: Most recent audit is from February 2023 — over 3 years without a new security review despite ongoing code changes.
Frontrunning risk: Synthetic marketplace swaps execute at oracle price with only 0.45-0.55% fee protection, exploitable when inter-update volatility exceeds the fee.

Critical Risks

Single-entity rug risk: LlamaRisk assessed that Bloq can effectively rug users. The 3/5 Safe is both the ProxyAdmin owner (upgrades) and the governor() on Pool and PoolRegistry (parameter changes) — meaning it controls every aspect of the protocol without governance approval or timelock. The on-chain Governor/Timelock is entirely unused. All 5 signers are anonymous EOAs; there is no on-chain evidence that "external signers" (promised in Phase 2 of decentralization) were actually added. All 5 signers are identical across Ethereum, Base, and Optimism Safes (5/5 overlap, verified on-chain 2026-05-19), and the L2 deployments have no timelock at all. At the time of LlamaRisk's review (2/4 multisig), they concluded: "the entire protocol can essentially be shut down at any moment by two people who work for the same private U.S. company (Bloq)." The threshold increased to 3/5, but if all signers remain Bloq-affiliated, the structural risk is unchanged.
Governance abandoned: No Snapshot proposals since March 2025 (over 1 year). Only 5-12 votes per proposal when active. On-chain Governor on Ethereum appears unused. This suggests governance is effectively dead and the protocol is operated unilaterally by the multisig.

Full Report

Contract Addresses

Ethereum Mainnet

Contract	Address
Pool	`0x3364f53cB866762Aef66DeEF2a6b1a17C1F17f46`
PoolRegistry	`0x11eaD85C679eAF528c9C1FE094bF538Db880048A`
msUSD Synthetic	`0xab5eB14c09D416F0aC63661E57EDB7AEcDb9BEfA`
msETH Synthetic	`0x64351fC9810aDAd17A690E4e1717Df5e7e085160`
msBTC Synthetic	`0x8b4F8aD3801B4015Dea6DA1D36f063Cbf4e231c7`
msUSD Debt	`0x480e3178Fa102dF852643d47CAbdb9adf5dB0174`
msETH Debt	`0xF43de8E0c2596E30c77d69d158842D1d9B937D7c`
msBTC Debt	`0xB93f48D3eA42a25f367fAde092A6Bb56DAB5F7cB`
FeeProvider	`0x6b53C16B94c1502C661140073ed522aC7Dbc5E5E`
Treasury	`0x3691EF68Ba22a854c36bC92f6b5F30473eF5fb0A`
SmartFarmingManager	`0xE0e7Ac2b0884BA8A05190fb6CEAFFaDc7c3AEDf1`
CrossChainDispatcher	`0x8BD81c99a2D349F6fB8E8a0B32C81704e3FE7302`
MsUSD ProxyOFT	`0xF37982E3F33ac007C690eD6266F3402d24aA27Ea`
MsETH ProxyOFT	`0x5c574153B195AE284C063a84fB9C73d9fd37955F`
NativeTokenGateway	`0x564baA321227abf6B2E88a38557b6517077aAD32`
MET Token	`0x2Ebd53d035150f328bd754D6DC66B99B0eDB89aa`
esMET (MET Escrow)	`0xA28D70795a61Dc925D4c220762A4344803876bb8`
Governor	`0xc8697de7c190244bfd63d276823aa20035cb5a12`
Timelock	`0x4c510878B907d6DDf69E6057ad2f865f60fB7775`
ProxyAdmin (Synths)	`0x2fa85a496a9b79c6d50cef590304bdd36efa2dcc`
ProxyAdmin (Pool)	`0xd4de85da9f2ca8c7c63dcdb417d0b5ce65a6f1be`

Both ProxyAdmin contracts are owned by 0xd1DE3F9CD4AE2F23DA941a67cA4C739f8dD9Af33 — a 3/5 Gnosis Safe (verified on-chain 2026-05-19). This means contract upgrades on Ethereum bypass the Governor/Timelock and are controlled directly by the multisig. All 5 signers are identical to the L2 Safe signers (5/5 overlap, verified on-chain). All signers are anonymous EOAs.

Base

Contract	Address
Pool	`0xAeDF96597338FE03E8c07a1077A296df5422320e`
msUSD Synthetic	`0x526728dbc96689597f85ae4cd716d4f7fccbae9d`
msETH Synthetic	`0x7ba6f01772924a82d9626c126347a28299e98c98`
Governor (Safe 3/5)	`0xE01Df4ac1E1e57266900E62C37F12C986495A618`

Optimism

Contract	Address
Pool	`0x4c6bf87b7fc1c8db85877151c6ede38ed27c34f6`
msUSD Synthetic	`0x9dabae7274d28a45f0b65bf8ed201a5731492ca0`
msETH Synthetic	`0x1610e3c85dd44af31ed7f33a63642012dca0c5a5`
Governor (Safe 3/5)	`0xE01Df4ac1E1e57266900E62C37F12C986495A618`

Base and Optimism are governed by a 3/5 Gnosis Safe (0xE01Df4ac1E1e57266900E62C37F12C986495A618) with the same 5 anonymous EOA signers on both chains. All 5 signers are identical to the Ethereum ProxyAdmin Safe (5/5 overlap, verified on-chain 2026-05-19).

Token Supply (as of 2026-05-19):

Token	Chain	Supply
msUSD	Ethereum	~11,912,879
msUSD	Base	~7,091,318
msUSD	Optimism	~1,228,178
msUSD	Total	~20,232,375
msETH	Ethereum	~5,421 ETH
msETH	Base	~14,897 ETH
msETH	Optimism	~509 ETH
msETH	Total	~20,827 ETH

Audits and Due Diligence Disclosures

The GitHub repository (autonomoussoftware/metronome-synth-public) contains an audits/ directory with at least 12 audit reports:

Auditor	Scope	Date	Link
Halborn	Vesper Finance Synth Smart Contract	2022-2023	GitHub audits/
Halborn	Vesper Synth (second report)	2022-2023	GitHub audits/
Internal (Vesper/Bloq)	Metronome Synth Core (BLOQ-MSC)	Dec 2022	GitHub audits/
Internal (Vesper/Bloq)	BLOQ AMO	2022-2023	GitHub audits/
Internal (Vesper/Bloq)	Vesper Synth Delta audits	Jan-June 2022	Multiple reports in GitHub audits/
Internal (Vesper/Bloq)	Vesper Metronome Synth + esMET	Feb 2023	GitHub audits/
Quantstamp	Metronome Synth	2022-2023	GitHub audits/

Quantstamp Audit Findings: 2 medium-risk, 3 low-risk, 11 informational issues. 9 resolved. Notable unresolved: absence of fallback oracle (Chainlink-only, no cross-check or fallback source — classified as medium risk). The team indicated a fallback would be added but it has not been implemented as of this assessment.

Note: A LlamaRisk assessment was also conducted (early-stage, when TVL was ~$2M and governance was a 2/4 multisig). Key concerns raised: Vesper dependency (>92% of collateral), collateral factors chosen without simulation testing, frontrunning risk on synthetic marketplace, and no insurance fund for bad debt. The multisig threshold has since increased from 2/4 to 3/5, and on-chain Governor+Timelock contracts were deployed on Ethereum — but the Governor/Timelock is not wired into live governance (Pool.governor() and PoolRegistry.governor() both return the 3/5 Safe), so parameter control and upgrades remain directly on the Safe. Several structural concerns from the LlamaRisk review therefore remain unchanged.

Smart Contract Complexity

High complexity. The repository contains ~175 Solidity files. Core contracts include:

Pool.sol (29.6 KB) — central contract for deposits, debt, liquidations, swaps, leverage
SmartFarmingManager.sol (29.3 KB) — automated yield looping
CrossChainDispatcher.sol (30.2 KB) — LayerZero cross-chain operations
DepositToken.sol (20 KB), DebtToken.sol (19.7 KB), SyntheticToken.sol (12.7 KB)

All contracts use OpenZeppelin upgradeable proxy pattern (TransparentUpgradeableProxy). MIT license.

Bug Bounty

Platform: Immunefi
Launch Date: February 21, 2023
Maximum Payout: $50,000 (critical smart contract)
High: $5,000-$10,000
Medium: $1,000-$5,000
KYC Required: Yes
PoC Required: Yes
Assets in Scope: 92 assets across Ethereum, Optimism, and Base (including AMO, CrossChainDispatcher, deposit tokens, and the Metronome dApp)

The $50K max bounty is relatively modest compared to similarly-sized protocols.

The protocol is not listed in the SEAL Safe Harbor registry.

Historical Track Record

Production History: Metronome 1.0 launched June 2018. Metronome 2.0 (MET token migration) launched August 2022. Metronome Synth launched early 2023. The protocol has been live in production for approximately 3+ years (Synth product for ~3 years).
TVL (DeFiLlama, as of 2026-05-19):
- Ethereum: $16,687,983
- Base: $6,735,576
- Optimism: $1,983,697
- Total Protocol TVL: ~$25.41M (up ~4% from $24.42M on 2026-04-22; Base TVL grew ~66%, offsetting an ~8% Ethereum decline)
Market Data (CoinGecko, as of 2026-03-28):
- msUSD: $0.996, market cap $19.9M, 24h volume $7.1M
- msETH: $2,009.97, market cap $34.7M, 24h volume $7.2M
Incidents:
- Sonne Finance exploit (May 2024): Affected Metronome positions on Optimism. A Metronome Improvement Proposal (MIP) was submitted for remediation.
- No direct smart contract exploits of Metronome Synth contracts found on rekt.news.
Peg Stability (CoinGecko):
- msUSD currently trading at $0.997 (slight discount to $1.00)
- Historical ATL of $0.43 (Oct 2025) and ATH of $3.43 (Oct 2025) reflect past depeg events during early thin liquidity periods; current DEX depth significantly mitigates this risk
Concentration Risk: With ~$25M protocol TVL spread across 3 chains, user base is moderately concentrated.

Funds Management

Metronome Synth is a self-contained CDP protocol — collateral is held within protocol-owned Treasury contracts (one per chain; Pool.treasury() on Ethereum returns 0x3691EF68Ba22a854c36bC92f6b5F30473eF5fb0A). It does not delegate funds to external lending protocols. However, users can deposit yield-bearing Vesper Finance tokens as productive collateral, which indirectly exposes funds to Vesper Finance strategies.

Accessibility

Minting: Anyone can deposit collateral and mint synthetics up to their collateral factor limit.
Redemption: Users repay their synthetic debt to unlock collateral. There is no direct 1:1 redemption mechanism (unlike Liquity). Users exit by repaying debt and withdrawing collateral, or by selling synthetics on DEXes.
Fees:

Fee Type	Amount	Notes
Synth Balance Fee	Annualized, per-second	Applied by increasing outstanding position
Marketplace Swap Fee	0.45% (OP/Base), 0.55% (Ethereum)	In-protocol synth-to-synth swaps
Liquidation Fee	18% total	10% to liquidator, 8% to protocol

Rate Limits: Deposit caps per collateral asset and mintage caps per synth. Cross-chain bridge caps via maxBridgedInSupply() and maxBridgedOutSupply().
No explicit cooldown periods documented.

Collateralization

Backing: All synthetics are over-collateralized. Users must maintain collateral value above their collateral factor threshold.
Collateral Quality: Mix of blue-chip assets (USDC, ETH, WBTC, DAI) and yield-bearing Vesper tokens (vaUSDC, vaETH, etc.) with varying risk profiles.
Collateral Factors (maximum borrowing power as % of collateral value):

Asset	Collateral Factor	Category
USDC	85%	Stablecoin
DAI	85%	Stablecoin
FRAX	83%	Stablecoin
vaUSDC	82%	Productive Stablecoin
vaFRAX	80%	Productive Stablecoin
ETH	83%	ETH
vaETH	80%	Productive ETH
sfrxETH	80%	ETH LST
vastETH	78%	Productive ETH
varETH	75%	Productive ETH
vacbETH	67%	Productive ETH
WBTC	80%	BTC

Liquidations: On-chain, anyone can call liquidate(). Liquidator repays synthetic debt and receives collateral + 10% bonus. Protocol takes 8%. No grace period.
Deposit Caps (Ethereum):

Asset	Cap
USDC	10,000,000
DAI	10,000,000
FRAX	9,000,000
ETH	4,286
WBTC	311
vaUSDC	8,000,000
vaETH	3,190

Risk Curation: Collateral factors are determined by a 5-variable risk scoring framework (Issuance/Market Cap, Open Market Liquidity, Lindy Score, Peg Volatility, Rehypothecation). Changes require governance action.

Ethereum Treasury Collateral Balances (on-chain, 2026-05-19):

Collateral is held in the Treasury contract (0x3691EF68Ba22a854c36bC92f6b5F30473eF5fb0A), not directly in the Pool.

Asset	Balance	Type
USDC	58,222	Direct
WETH	99.17	Direct
WBTC	42.42	Direct
sfrxETH	1,761.03	Direct
FRAX	101.46	Direct
DAI	152.42	Direct
vaUSDC	~1,205,964 tokens	Vesper yield-bearing
vaFRAX	~612,255 tokens	Vesper yield-bearing
vaETH	~1,983 tokens	Vesper yield-bearing

Shifts since 2026-04-22: direct USDC recovered (5.7K → 58K), WETH and sfrxETH ticked up modestly, and Vesper-token balances drifted slightly lower (vaUSDC −1.5%, vaFRAX −14%, vaETH +9.6%). FRAX, DAI, and WBTC balances are effectively unchanged. The composition remains heavily weighted toward Vesper productive collateral.

Provability

On-chain Verification: Collateral balances are fully verifiable on-chain in Treasury contracts on each chain (Pool delegates collateral custody to Treasury, confirmed via Pool.treasury()).
Oracle-based Pricing: Chainlink oracle feeds determine collateral values and health factors. Synth assets are hard-coded to their reference asset's oracle price internally (msUSD = $1, msETH = ETH price), preventing peg deviations from triggering liquidations.
No Exchange Rate: Synthetics are not yield-bearing vault tokens — there is no PPS/exchange rate to verify. The system tracks debt positions, not share prices.
Productive Collateral Transparency: Vesper Finance tokens (vaUSDC, vaETH, etc.) have their own on-chain exchange rates, which can be independently verified.

Liquidity Risk

On-Chain Liquidity Summary

Total DEX Pool TVL: $122.47M (DeFiLlama, as of 2026-05-19; excludes Sonic pools tracked under a sibling deployment):

DEX / Chain	TVL	Pools
Aerodrome Slipstream (Base)	$52.26M	5
Curve (Ethereum)	$32.05M	7
Aerodrome V1 (Base)	$30.53M	3
Balancer V3 (Ethereum)	$3.39M	2
Velodrome V2 (Optimism)	$3.24M	4
Uniswap V3 (Ethereum)	$0.99M	1

An additional ~$55M in smsUSD/vgUSDC liquidity sits on Beethoven X (Sonic) under a wrapped-msUSD deployment that is not explicitly in scope of this assessment — flagged for context only and excluded from the figures above and from the score.

Top DEX Pools by TVL

Chain	DEX	Pool	TVL
Base	Aerodrome Slipstream	WETH-msETH	$26.13M
Base	Aerodrome Slipstream	msUSD-USDC	$24.27M
Base	Aerodrome V1	WETH-msETH	$21.60M
Ethereum	Curve	msETH-WETH	$13.32M
Ethereum	Curve	FRXUSD-msUSD	$10.63M
Base	Aerodrome V1	msUSD-USDC	$8.14M
Ethereum	Curve	msUSD-FRAXBP	$6.12M

DEX TVL by Chain

Chain	DEX TVL
Base	$82.80M
Ethereum	$36.43M
Optimism	$3.24M

Yield/Wrapper Ecosystem

An additional $190M is locked in yield aggregators and lending protocols built on top of the DEX pools, indicating strong and growing DeFi integration:

Protocol	Notable Pools	TVL
Main Street	msUSD	$77.96M
Morpho V1	GT msUSDC, GT msETHC vaults (Ethereum + Base)	$31.29M
Vesper	msUSD, msETH (Ethereum + Base)	$28.07M
Convex	msETH-WETH, msUSD-FRAXBP, FRXUSD-msUSD	$18.92M
Stake DAO	msETH-WETH, FRXUSD-msUSD, msUSD-CRVFRAX	$16.65M
Beefy	Various (Ethereum + Base)	$9.11M
Pendle	msUSD	$2.63M
Extra Finance	Various	$2.18M
Yearn	msETH-WETH, msUSD vaults	$1.71M

Liquidity Assessment

Ethereum msUSD: ~$36.4M Curve + Uniswap + Balancer liquidity. Sufficient for large exits.
Ethereum msETH: ~$13.3M Curve liquidity. Good depth.
Base msUSD/msETH: ~$82.8M Aerodrome liquidity (nearly doubled from $48.5M in the prior assessment). Deepest liquidity overall.
Exit Path: No direct 1:1 redemption. Users must either repay debt + withdraw collateral, or sell on DEX. Market-based exit via DEX pools.
Historical Peg: msUSD experienced price deviations in early days (ATL $0.43, ATH $3.43 in Oct 2025) when liquidity was thin. Current DEX depth substantially reduces peg stability risk. Currently trades at ~$0.996.
Yield Ecosystem Growth: Total yield/wrapper TVL grew from ~$170M to ~$190M over the past month, with Main Street's msUSD vault leading at ~$78M.

Centralization & Control Risks

Governance

Ethereum:

On-chain Governor: Compound-style Governor at 0xc8697de7c190244bfd63d276823aa20035cb5a12
- Voting token: esMET (MET Escrow) at 0xA28D70795a61Dc925D4c220762A4344803876bb8
- esMET Total Supply: ~10,919,594 esMET
- Proposal threshold: 25,000 MET
- Quorum: 4% of esMET total supply (~375,000-575,000 esMET depending on current supply)
- Voting delay: 5,760 blocks (~19.2 hours)
- Voting period: 40,320 blocks (~134.4 hours / ~5.6 days)
Timelock: 0x4c510878B907d6DDf69E6057ad2f865f60fB7775 — 48-hour delay
ProxyAdmin Owner: 0xd1DE3F9CD4AE2F23DA941a67cA4C739f8dD9Af33 — controls upgrades for both ProxyAdmin contracts
Pool & PoolRegistry governor: On-chain Pool.governor() and PoolRegistry.governor() both return 0xd1DE3F9CD4AE2F23DA941a67cA4C739f8dD9Af33 — the same 3/5 Safe. This means parameter changes (collateral factors, deposit caps, fees) are also directly controlled by the multisig, not routed through the Governor/Timelock. The on-chain Governor and Timelock appear to be entirely unused for both upgrades and parameter governance.

Base / Optimism:

Governor: 3/5 Gnosis Safe (0xE01Df4ac1E1e57266900E62C37F12C986495A618)
Same 5 anonymous EOA signers on both chains, all 5 identical to Ethereum ProxyAdmin Safe (5/5 overlap)
No timelock on L2 deployments

Governance Process (Progressive Decentralization):

Phase	Description
Phase 1 (Launch)	Sentiment votes, 2-of-4 multisig implements outcomes
Phase 2 (~1 month)	Multisig expands to 3-of-5 with external signers
Phase 3 (~3 months)	Binding votes begin; multisig retains veto on safety
Phase 4 (~9 months)	More binding votes; multisig loses veto except on token supply
Phase 5 (~15 months)	Full decentralization, all decisions by community vote

Snapshot Governance: ~30 MIPs on Snapshot. Low voter participation (5-12 votes per proposal). Last proposal (MIP-30) was in March 2025 — over 1 year with no governance activity.

Privileged Roles:

3/5 Safe (0xd1DE) is the ProxyAdmin owner (upgrades) AND the Pool/PoolRegistry governor (parameters) on Ethereum — all control flows through a single multisig
Same 3/5 Safe controls all contracts on Base and Optimism (5/5 signer overlap, no timelock)
Governor/Timelock system exists on Ethereum (48h delay) but is not wired to Pool or PoolRegistry — effectively unused

Programmability

Core Operations: Fully programmatic on-chain — deposits, minting, liquidations, and swaps are all automated via smart contracts.
Smart Farming: Automated yield looping via SmartFarmingManager contract.
No PPS/Rate: Synthetics are debt-position based, not share-price based. No admin-controlled exchange rate.
Oracle Dependency: Chainlink price feeds are used for all collateral valuation and health factor calculations. No fallback oracle (medium-risk finding from Quantstamp audit, still unresolved).
Frontrunning Risk: Synthetic marketplace executes swaps at oracle price with only a fee (0.45-0.55%) as protection. LlamaRisk identified this as exploitable when inter-oracle-update volatility exceeds the fee.
Fee Adjustments: FeeProvider contract parameters can be changed by governance.

External Dependencies

Dependency	Criticality	Risk Level
Chainlink	Critical — sole oracle for all price feeds, no fallback	Medium. Well-established but single point of failure. Quantstamp flagged absence of fallback oracle as medium-risk finding (still unresolved)
Vesper Finance	High — productive collateral tokens (vaUSDC, vaETH, etc.)	Medium-High. Same parent company (Bloq). Vesper strategies introduce multi-layer protocol risk (Euler, Aave, Curve, Convex, Frax) beneath the va-tokens
LayerZero	High — cross-chain synthetic transfers (OFT pattern)	Medium. Major cross-chain messaging protocol
Stargate	Medium — cross-chain token bridging	Medium
Curve	Medium — DEX used for Smart Farming swaps	Low. Battle-tested DEX
OpenZeppelin	Low — upgradeability framework	Low. Industry standard

Operational Risk

Team Transparency: Built by Bloq, Inc. (Chicago/Atlanta, founded 2016). CEO Jeff Garzik is a well-known Bitcoin Core developer. Chairman Matthew Roszak is a known crypto investor. ~40 team members (120 including Bloq spinoffs). The team operates under the Autonomous Software GitHub organization.
Documentation Quality: Good. Comprehensive GitBook documentation at docs.metronome.io covering protocol mechanics, risks, governance, and contracts. Open-source codebase (MIT license).
Legal Structure: Bloq, Inc. is a US-based company. Vesper Brewing Co Ltd (BVI) appears as the entity for the Vesper Finance GitHub org. DAO governance via MET token.
Incident Response: Demonstrated response to Sonne Finance exploit impact (MIP remediation proposal). Immunefi bug bounty since Feb 2023. No specific incident response plan documented.
MET Token Distribution: Total supply at migration: 14,377,915 MET. Distribution: DAO Treasury (8.2M, 57%), Uniswap LP (2M), Team & Advisors (2M, 24-month vesting), Community (1.87M).

Monitoring

Key Contracts to Monitor

Ethereum:

Pool: 0x3364f53cB866762Aef66DeEF2a6b1a17C1F17f46
msUSD: 0xab5eB14c09D416F0aC63661E57EDB7AEcDb9BEfA
msETH: 0x64351fC9810aDAd17A690E4e1717Df5e7e085160
Governor: 0xc8697de7c190244bfd63d276823aa20035cb5a12
Timelock: 0x4c510878B907d6DDf69E6057ad2f865f60fB7775
ProxyAdmin Owner: 0xd1DE3F9CD4AE2F23DA941a67cA4C739f8dD9Af33

Base / Optimism:

Pool contracts and Safe multisig on each chain

Critical Events to Watch

Contract upgrades via ProxyAdmin (Ethereum) or multisig (Base/Optimism)
Collateral factor or deposit cap changes on Pool contracts
Large mint/burn events on synthetic tokens
msUSD peg deviations >2% on DEXes
Liquidation events — elevated liquidation activity may indicate collateral stress
Governor proposals and timelock executions
Cross-chain bridge activity anomalies (LayerZero OFT transfers)
Vesper Finance vault health (vaUSDC, vaETH exchange rates)

Recommended Frequency

Hourly: Peg monitoring, large transaction alerts
Daily: TVL changes, collateral ratio trends, DEX pool balance ratios
Weekly: Governance activity, Vesper vault health, cross-chain supply consistency

Appendix: Contract Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                      GOVERNANCE LAYER                               │
│                                                                     │
│  ┌──────────────────┐    ┌──────────────┐    ┌──────────────────┐  │
│  │  Governor         │    │  Timelock     │    │  3/5 Safe         │  │
│  │  (esMET voting)   │    │  (48h delay)  │    │  0xd1DE...        │  │
│  │  0xc869...        │    │  0x4c51...    │    │  Live control     │  │
│  │  [UNUSED]         │    │  [UNUSED]     │    │  (upgrades +      │  │
│  │                   │    │               │    │   parameters)     │  │
│  └──────────────────┘    └──────────────┘    └────────┬─────────┘  │
│                                                       │             │
│                           Upgrades + Pool.governor()──┘             │
│                           + PoolRegistry.governor()                 │
│                                                                     │
│  L2 (Base/Optimism): 3/5 Safe 0xE01D... (same 5 signers, no TL)   │
└─────────────────────────────────────────────────────────────────────┘
                                    │
┌─────────────────────────────────────────────────────────────────────┐
│                     VAULT / TOKEN LAYER                             │
│                                                                     │
│  ┌────────────┐  ┌────────────┐  ┌────────────┐                    │
│  │  msUSD      │  │  msETH      │  │  msBTC      │  Synthetic       │
│  │  0xab5e...  │  │  0x6435...  │  │  0x8b4F...  │  Tokens          │
│  └────────────┘  └────────────┘  └────────────┘                    │
│  ┌────────────┐  ┌────────────┐  ┌────────────┐                    │
│  │  msUSD-Debt │  │  msETH-Debt │  │  msBTC-Debt │  Debt Tokens     │
│  │  0x480e...  │  │  0xF43d...  │  │  0xB93f...  │                  │
│  └────────────┘  └────────────┘  └────────────┘                    │
│  ┌───────────────────────────────────┐                              │
│  │  Deposit Tokens (msd*)            │  Receipt tokens per          │
│  │  msdUSDC, msdWETH, msdvaETH...   │  collateral type             │
│  └───────────────────────────────────┘                              │
└─────────────────────────────────────────────────────────────────────┘
                                    │
┌─────────────────────────────────────────────────────────────────────┐
│                      PROTOCOL LAYER                                 │
│                                                                     │
│  ┌──────────────────┐    ┌────────────────────────┐                 │
│  │  Pool             │───▶│  Treasury               │  Holds all     │
│  │  0x3364...        │    │  0x3691...              │  collateral     │
│  └──────────────────┘    └────────────────────────┘                 │
│  ┌──────────────────┐    ┌────────────────────────┐                 │
│  │  SmartFarming     │    │  CrossChainDispatcher   │  LayerZero     │
│  │  Manager          │    │  0x8BD8...             │  OFT bridge     │
│  │  0xE0e7...        │    └────────────────────────┘                 │
│  └──────────────────┘    ┌────────────────────────┐                 │
│  ┌──────────────────┐    │  FeeProvider            │                 │
│  │  PoolRegistry     │    │  0x6b53...             │                 │
│  │  0x11eA...        │    └────────────────────────┘                 │
│  └──────────────────┘                                               │
└─────────────────────────────────────────────────────────────────────┘
                                    │
┌─────────────────────────────────────────────────────────────────────┐
│                     UNDERLYING LAYER                                │
│                                                                     │
│  Collateral Assets:                                                 │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐              │
│  │ USDC      │ │ WETH      │ │ WBTC      │ │ sfrxETH   │ Direct    │
│  └──────────┘ └──────────┘ └──────────┘ └──────────┘              │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐              │
│  │ vaUSDC    │ │ vaETH     │ │ vaFRAX    │ │ vaSTETH   │ Vesper    │
│  └──────────┘ └──────────┘ └──────────┘ └──────────┘ (yield)      │
│         │            │            │            │                     │
│         ▼            ▼            ▼            ▼                     │
│  ┌─────────────────────────────────────────────┐                    │
│  │  Vesper Finance Strategies                   │  Multi-layer      │
│  │  (Euler, Aave, Curve, Convex, Frax)         │  protocol risk    │
│  └─────────────────────────────────────────────┘                    │
│                                                                     │
│  Oracle: Chainlink (sole oracle, no fallback)                       │
│  Bridge: LayerZero OFT (Ethereum ↔ Base, Optimism)                 │
└─────────────────────────────────────────────────────────────────────┘

Fund Flow: User → deposit collateral → Pool → Treasury (holds collateral)
           User → mint synth → Debt Token created → Synthetic Token minted
           Liquidator → repay debt → receives collateral + 10% bonus

Trust Boundaries:
  ⚠ 3/5 Safe controls BOTH upgrades (ProxyAdmin) AND parameters (Pool.governor)
  ⚠ Governor/Timelock exists on Ethereum but is entirely unused
  ⚠ Same 5 anonymous signers control all chains (no independent signers)
  ⚠ No timelock on Base/Optimism contract upgrades or parameter changes

Reassessment Triggers

Time-based: Reassess in 6 months (November 2026) or sooner if governance resumes activity
TVL-based: Reassess if protocol TVL changes by more than 50%
Incident-based: Reassess after any exploit, governance change, or collateral modification
Governance-based: Reassess if ProxyAdmin ownership is transferred to the Timelock, if multisig threshold/signers change, or if upgrade timelock is added
Dependency-based: Reassess if Vesper Finance experiences any security incident or significant TVL decline
Audit-based: Reassess when/if top-tier audit is completed or bug bounty is significantly increased

Last verified: May 19, 2026