GHO vs UPD: Aave's DAO-Governed Stablecoin Meets a Permissionless One

January 13, 2026. Yield Protocol executes a routine vault rebalance. A swap converts about $3.84 million of stkGHO, the staked version of Aave's stablecoin, into roughly $122,000 of USDC. That's a 96.8% slippage event on what was supposed to be a dollar-for-dollar rotation. Blockchain security researchers quickly confirmed the call flow: no smart-contract exploit of GHO, no depeg of GHO, just a routing failure into thin stkGHO liquidity pools (KuCoin News, Phemex). The user's money was still gone.

Stani Kulechov didn't need to apologize. Aave's core contracts performed exactly as specified. That's the first lesson of this comparison. GHO, like most modern stablecoins, is a system, not a token. The token layer is clean. The system around the token, its facilitators, its stewards, its staking derivatives, its cross-chain bridges, its MiCA-licensed ramp, is where the risk actually lives.

UPD approaches the same dollar-peg problem from the opposite end. There are no facilitators. There are no stewards. There is no staking derivative that can blow up at a routing layer. There isn't a DAO vote that can mint new supply to a new market. The surface area is smaller by design, and this post walks through exactly what that means when you put the two architectures beside each other.

Key Takeaways

• GHO is minted by governance-approved facilitators with bucket capacities set by Aave DAO. As of late 2025, active facilitators include the Aave v3 Ethereum Pool, FlashMinter, the GHO Stability Module (GSM) against USDC/USDT, and Chainlink CCIP bridges for Base and Arbitrum (Aave docs, Llamarisk).
• The GHO Stewards are a multisig of Aave DAO service providers (ACI, Chaos Labs, TokenLogic, Karpatkey) authorized by Proposal 61 to adjust the borrow rate by up to 500 basis points, tune GSM caps, and set bucket capacities without a full governance vote (Aave Proposal 61).
• Bluechip assigned GHO a D grade in late 2023 after it traded below par for months and bottomed near $0.917 on October 24, 2023 (GHO D-Grade analysis, Nansen Research). The peg has since tightened to near parity, but the design choices that produced the D grade remain intact.
• In November 2025, Aave Labs' subsidiary Push obtained a MiCA CASP license from the Central Bank of Ireland for zero-fee fiat on-ramping of GHO across the European Economic Area (Crowdfund Insider). GHO's monetary policy stays on-chain; its ramp is now a regulated subsidiary.
• UPD has no facilitators, no stewards, no fixed borrow rate set by committee, no GSM, no CCIP bridge as of this writing. The UPDToken contract grants MINTER_ROLE and BURNER_ROLE exclusively to StabilizerNFT, and no blacklist function exists in the token.

What Is GHO, and Who Actually Mints It?

GHO is an ERC-20 deployed at 0x40d16fc0246ad3160ccc09b8d0d3a2cd28ae6c2f on Ethereum. Holding GHO in a wallet behaves the same as holding DAI or USDC at the transfer layer. The token contract has no blacklist. Circulating supply sat around 584 million tokens in April 2026, placing GHO somewhere near the 90th to 100th slot among all crypto assets by market cap (GHO on Etherscan, Ethplorer).

What makes GHO unusual is how it enters circulation. It isn't minted by a single contract or by a single facility. It's minted by a list of facilitators, each granted permission by the Aave DAO to print up to a governance-set bucketCapacity. The GhoToken contract implements OpenZeppelin's AccessControl with two roles that run the system: FACILITATOR_MANAGER_ROLE to add or remove facilitators, and BUCKET_MANAGER_ROLE to resize their buckets (GhoToken source).

The Facilitator List

As of the December 2025 Llamarisk portfolio analysis, four facilitator types were live (Llamarisk RWA analysis):

• Aave v3 Ethereum Pool Facilitator. The primary venue. Users deposit collateral into Aave v3, borrow GHO against it, and the facilitator mints the GHO to them. Repay the loan, the GHO is burned. Around $185 million of GHO was minted through this facilitator by December 2025.
• FlashMinter Facilitator. Mints GHO for flash loans that must be repaid within the same transaction. Supports arbitrage and liquidations that need atomic GHO liquidity (aave/gho-core).
• GHO Stability Module (GSM) Facilitators. Two of them, one for USDC and one for USDT. Arbitrageurs can swap 1 USDC for 1 GHO (and vice versa) near par, with the GSM minting or burning GHO against reserved stablecoins (GSM docs).
• CCIP Bridge Facilitators. GHO is canonically minted on Ethereum and bridged to Arbitrum and Base via Chainlink CCIP. The bridge facilitator mints a bridged representation on the destination chain and burns it on return, enforcing rate limits that Chaos Labs has proposed changes to (ARFC cross-chain parameters).

Every facilitator has a ceiling. Every ceiling is a governance parameter. The token itself doesn't decide who can print it. The DAO does.

The Economic Consequence

That design has a clean economic story. Each GHO in circulation corresponds to a borrower on Aave v3, to a dollar in the GSM reserve, to a flash loan repaid in the same block, or to a bridged token on an L2. Total collateral backing GHO sat around $741.7 million against $326.2 million of effective circulating debt in December 2025, implying a global collateralization ratio of roughly 2.27x (Llamarisk portfolio analysis).

Strong backing. Genuinely overcollateralized in portfolio terms. But read that list again. The minters are governance-approved contracts. A future DAO can add a new facilitator with a new source of GHO. A future DAO can deprecate one. The composition of what backs GHO is not a fixed property of the token. It's a rolling policy decision.

Who Are the GHO Stewards, and What Can They Change?

GHO is not a pure "one token, one DAO" design. Layer in the GHO Stewards and the picture gets more realistic.

Aave Governance Proposal 61, passed in mid-2024, activated GHO Steward V2, a multisig composed of delegates from four service providers: ACI (Aave Chan Initiative) for growth, Chaos Labs for risk, TokenLogic and Karpatkey for finance. The proposal granted the multisig several admin roles: Pool Admin via the Aave ACL manager, Bucket Manager on the GHO token, and Configurator on the GSM contracts for USDC and USDT (Proposal 61, StableLab Governance Report).

What they can change, within governance-defined bounds (Levex GHO guide, Proposal 61):

• GHO borrow rate. Adjustable by up to 500 basis points within short intervals when GHO trades outside roughly the $0.995 to $1.005 band for 30 days. This is monetary policy by multisig.
• GHO borrow cap. The total amount of GHO that can be owed to the Aave v3 pool facilitator.
• GSM exposure caps and bucket capacities. How much 1:1 swap capacity lives between GHO and each approved stablecoin.
• GSM fee strategy. How much arbitrageurs pay to move through the stability module in either direction.

These aren't token-level powers. The Stewards cannot zero a wallet, cannot reverse a transfer, cannot brick balances. What they can do is reshape the cost structure and the supply level of GHO itself, programmatically and at multisig cadence.

Why This Matters More Than a Freeze

If the Aave DAO votes tomorrow to raise GHO's borrow rate from 4% to 9%, your leveraged farming position becomes unprofitable. If Stewards cut the GSM's USDC exposure cap, the primary peg-defense mechanism for a downward drift gets smaller. If governance lists a new facilitator with a $200 million bucket against a novel RWA collateral you don't trust, GHO's backing composition changes under you without a consent step.

None of these are attacks. All of them are authorized, on-chain, visible, and proper uses of the DAO's powers. The question we keep asking in this series isn't "is it a freeze." It's "how much discretionary authority sits above the token, and who holds it." For GHO, the answer is: a lot, and a named multisig of paid service providers elected by veCRV-style delegation mechanics in the AAVE token.

The Peg Story: What Bluechip's D Grade Actually Measured

For GHO's entire first year, it didn't hold $1. At all.

Through late 2023, GHO traded consistently between $0.96 and $0.98 despite being over-collateralized with hundreds of millions in Aave collateral above it. Nansen's "A Tale of Two Stablecoins" post named the cause with unusual bluntness: Aave set a low 1.5% fixed borrow rate and a 30% stkAAVE discount at genesis to grow supply quickly, but there wasn't matching demand to hold GHO, only to mint and sell it (Nansen). Mint, sell, take the spread, repeat. Under-peg for months.

On July 31, 2023, less than two weeks after launch, GHO slid to around $0.96 during fallout from the Curve Finance Vyper reentrancy exploit (CryptoNews incident report). On October 26, 2023, Aave's own risk forum documented a rapid drop from $0.962 to $0.946 as USDC liquidity was drained from the main Uniswap v3 GHO/USDC pool (Aave risk forum). Bluechip, an independent stablecoin rating initiative, assigned GHO a D grade in late 2023, citing that it had not meaningfully held parity since inception and that a low-circulation asset with persistent under-peg carried real tail risk (Bluechip analysis via Pro-Blockchain). The all-time low sat near $0.917 on October 24, 2023.

Stani Kulechov, Aave's founder, argued publicly that the DAO should focus on growing integration surface first and peg-defense mechanisms second (BeInCrypto). He was right that this wasn't an imminent insolvency event. But the market treated a DeFi-native stablecoin that couldn't hold its peg as exactly that.

What Fixed It

The governance response is exactly the thing this post is examining. Higher borrow rates via the newly-empowered Stewards. GSM capacity deployed and later expanded. Liquidity incentives routed through the DAO's veBAL holdings to seed Balancer pools. Cross-chain expansion to Arbitrum and Base so the demand surface widened beyond mainnet DeFi farmers (ALC Phase VI).

By early 2026, GHO was trading around $0.9999 with daily deviations under a basis point, comparable to any other decentralized overcollateralized stablecoin (CoinStats analysis). The peg issue is, operationally, resolved.

What resolved it is also what created it. A DAO setting a rate too low, then a committee raising it. A DAO deploying liquidity, then routing more. A DAO adding facilitators, then tuning their caps. Every intervention is a demonstration of how much policy authority sits above this token.

How Does UPD Refuse the Facilitator Model?

UPD's design starts from a different premise. There isn't a list of approved minters. There's exactly one: the StabilizerNFT contract.

The UPDToken contract exposes two role-gated functions:

function mint(address to, uint256 amount) external;  // onlyRole(MINTER_ROLE)
function burn(address from, uint256 amount) external; // onlyRole(BURNER_ROLE)

Per the UPD smart contracts reference, StabilizerNFT holds both roles. No other address can mint or burn. No blacklist function exists (UPD Smart Contracts).

There is no analog of the BUCKET_MANAGER_ROLE. There is no analog of a facilitator list. There is no GSM. There is no FlashMinter. There is no CCIP bridge facilitator that can conjure a bridged representation on an L2 governed by a bridge's rate limiter. If UPD supply goes up by 1, somewhere a stabilizer's stETH moved into a PositionEscrow and a minter received the corresponding dollars. There isn't a second path.

Why the Narrow Path

This is a trade-off that cuts both ways. GHO's facilitator model is flexible. It lets the DAO route new sources of backing (RWAs via Horizon, stablecoin reserves via GSM, cross-chain supply via CCIP) into a unified token without redeploying. That's a strength for protocol evolution.

UPD trades that flexibility for a smaller governance surface. If a future version of UPD wants a second collateral type (say rETH in addition to stETH) or a second chain, that's a protocol upgrade, not a new facilitator plugged into a live token contract. Harder to iterate. Easier to reason about for anyone running a position.

Who Pays the Interest?

There's a revenue difference worth stating plainly. GHO borrowers pay interest. That interest flows directly to the Aave DAO treasury (Aave docs on GHO). Even at a low borrow rate, GHO is a revenue engine for the protocol, which is the core reason it exists.

UPD doesn't work this way. Stabilizers earn stETH-native yield via Lido rebasing; minters hold a dollar-denominated IOU backed by that collateral. There's no protocol-collected interest line that flows to a DAO treasury. The economics of running UPD are closer to a dollar-issuance pool for stETH yield than to a lending market with a protocol-captured spread.

That's a design preference, not a ranking. Protocol-captured revenue is useful when a DAO needs to fund ongoing operations. Absent-revenue designs avoid the governance incentive to raise borrow rates as a policy lever. Each shape of the tree has its own failure modes.

Liquidation: CDP Borrower vs Stabilizer-Minter Split

GHO is a CDP. A user deposits collateral into Aave v3, borrows GHO against it, and holds both ends: they are the collateral provider and the GHO recipient. When their health factor dips below 1, Aave's standard liquidation machinery kicks in, and a liquidator bot swaps the collateral for enough GHO to restore solvency (Aave v3 docs on GHO).

UPD splits these roles deliberately. A stabilizer owns an NFT and deposits stETH into a PositionEscrow. A minter is a user who wants UPD. When the minter calls mint, the StabilizerNFT contract walks a priority queue of stabilizers by NFT ID, pulls stETH from their escrows to back the requested UPD at the system's 125% minimum collateral ratio floor, and mints the UPD to the minter.

Liquidation works on the stabilizer's position. The token ID the liquidator uses determines the threshold. NFT 1 can liquidate at 125%. NFT 2 at 124.5%. Each subsequent ID drops 0.5 percentage points down to a 110% floor. Anyone holding UPD can liquidate any position at or below 110% with no NFT at all.

The liquidator transfers UPD, which gets burned; the contract pays out 105% of par in stETH. Any excess above 105% goes to the InsuranceEscrow. If the position is too underwater to pay 105%, the InsuranceEscrow tops up best-effort.

Why the Split Matters

In GHO, the person whose collateral gets liquidated is the same person who took out GHO. That's simple and it's what every CDP does.

In UPD, the liquidated party is the stabilizer, not the person holding the minted UPD. A UPD holder can transfer, pay, shield into UPP, or hold forever; their dollars don't depend on their own collateral management. Their counterparty risk is against the stabilizer queue and the InsuranceEscrow, not against their own self-discipline.

For institutional settings where the party that wants to hold the stablecoin isn't the party that wants to manage collateral (a treasury that wants dollars but doesn't want to run an Aave position, or a structured product that routes collateral separately from liquidity), this separation is the feature. GHO doesn't offer it natively. You'd need to add an intermediary layer on top of Aave to split the roles, and now you're stacking protocol risks.

MiCA, Push, and the First Centralized Surface

Most of this post has discussed on-chain design. The newest wrinkle in the GHO story is off-chain.

In November 2025, Aave Labs' subsidiary Push received Crypto-Asset Service Provider authorization from the Central Bank of Ireland under MiCA (Crowdfund Insider, Cryptopolitan, Stabledash). That license lets Push run regulated, zero-fee fiat-to-stablecoin ramps for GHO across the European Economic Area.

Aave communicated the move clearly. The MiCA license covers the centralized ramp, not the token. GHO itself remains governed by the Aave DAO and minted by facilitators. Push is a licensed corporate entity that operates on the edge of that system, moving euros in and out of wallets holding GHO.

What This Changes (and Doesn't)

For a European institutional user, Push is the first time there's a regulated party in the GHO user flow. That's valuable for compliance teams who want a MiCA-authorized counterparty on the ramp. It doesn't change what the DAO can do with the token, but it changes the population of users who can practically hold GHO without jumping through unregistered-ramp hoops.

UPD has no analog. There's no corporate subsidiary. There's no MiCA license on the protocol side. For European users who need a MiCA-licensed ramp as a compliance requirement, GHO via Push is a real differentiator today. For users who specifically want to avoid a regulated intermediary in their stablecoin stack, it's the opposite.

Both positions are defensible. The institutional market does not agree on which is preferable, and this post won't pretend otherwise.

Head-to-Head Comparison

Which Risk Profile Fits Your Use Case?

When GHO Fits

• You want a decentralized-governed stablecoin with nearly three years of operational history and a peg that currently holds at parity
• You value multi-collateral support (ETH/LSTs, blue-chip crypto, stablecoins, USCC RWA via Horizon) that's live across Ethereum, Arbitrum, Base, and Mantle
• You're comfortable that a DAO-governed Stewards multisig holds ±500bp rate authority, bucket-capacity authority, and GSM-configuration authority over the token
• You're a European institution that wants a MiCA CASP-licensed on/off-ramp via Push as part of your compliance story
• You want to earn yield via sGHO or stkGHO inside Aave's Umbrella Safety Module ecosystem

When UPD's Risk Profile Fits

• You need shielded transfers on the dollar leg of a settlement or payment flow via UPP
• Your compliance team can work with an ASP-based attestation model and wants no token-level freeze authority anywhere in the stack
• Your protocol design benefits from separating the stabilizer (collateral provider) from the minter (stablecoin recipient), including structured products and institutional liquidity flows
• You'd rather reason about a single minter contract (StabilizerNFT) than a list of DAO-approved facilitators that can expand over time
• You prefer no DAO-set interest rate lever and no multisig that can tune monetary policy on a weekly cadence
• You accept an earlier-stage protocol maturity profile in exchange for a narrower governance surface

These aren't exclusive categories. A European treasury shop might hold GHO for MiCA-ramped flows and UPD for shielded cross-border B2B settlement. The architectures answer different questions.

Frequently Asked Questions

Is GHO really decentralized if the DAO can raise my borrow rate overnight?

Depends on what "decentralized" is doing in the sentence. At the token layer, GHO has no freeze, no blacklist, no claw-back. That's a strong decentralization claim relative to USDC or PYUSD. At the parameter layer, Aave DAO and the Stewards multisig can adjust the borrow rate within ±500bp when GHO trades outside a tight band for 30 days (Levex analysis). That's discretionary authority exercised on-chain by an identified multisig. Whether you call that "decentralized" or "DAO-governed" is a language choice. Both are defensible as long as you're explicit.

What actually happened with the Yield Protocol $3.7M stkGHO loss?

A vault at Yield Protocol (ticker YO) executed a swap that should have rotated roughly $3.84M of stkGHO into USDC. Instead it routed through thin stkGHO liquidity, and the output was around $122,000 (KuCoin News report). This wasn't a GHO exploit. GHO's price held; GHO's contracts performed correctly. The loss lived in the interaction between a staking derivative (stkGHO) and a routing layer that didn't have the liquidity it assumed. The lesson for this comparison is that the surface area of a "stablecoin system" keeps growing past the token contract, and each new layer adds failure modes even when the core token stays solid.

Can the Aave DAO freeze my GHO?

No. There's no blacklist or freeze function on the token. The DAO and Stewards control supply, rates, facilitator composition, and GSM parameters. They cannot zero a wallet or revert a transfer. That's a clear distinction from USDT, USDC, PYUSD, RLUSD, and similar token-level-freezable stablecoins.

Does UPD have any governance authority at all?

Yes, and we say so plainly. The PositionEscrow and StabilizerEscrow contracts are deployed behind UpgradeableBeacon instances, and the admin of those beacons can push new implementations. The PriceOracle is UUPS-upgradeable. The UPDToken itself is not upgradeable, so balances cannot be rewritten, but an admin could upgrade an escrow beacon to a malicious implementation that drains stETH. That's a real risk the reader should understand. The mitigation path is progressive: admin, then timelock, then governance, with a narrower scope than managing a live interest-rate lever. Different authority, different process for exercising it.

Why use UPD if GHO has years of live operation and a MiCA ramp?

For most users, GHO's maturity advantage is real. UPD is worth considering when your requirements include shielded transfers through UPP, ASP-compatible compliance rather than MiCA-licensed-ramp compliance, stabilizer-minter separation in your own protocol architecture, or a narrower governance surface than facilitator-based monetary policy. If none of those apply, GHO is the more operationally-proven choice today.

How does the MiCA Push license actually affect GHO's risk profile?

It affects the ramp, not the token. Push runs a regulated fiat on/off-ramp in the European Economic Area as an Aave Labs subsidiary licensed by the Central Bank of Ireland (Crowdfund Insider). European institutional users gain a licensed counterparty at the ramp edge. GHO's on-chain properties (minting, burning, interest, collateral composition) are unchanged and still governed by the DAO. For compliance teams who want a regulated entity in the flow, Push is a real differentiator. For users who prefer no regulated intermediary in their stablecoin stack, the protocol is in the same place it was before.

What's the closest analog to GHO's facilitator model in UPD?

There isn't one. The design choice UPD makes is that a stablecoin's supply sources should be a single path with no parallel mint routes. New collateral types or new chains are protocol upgrades, not new facilitators plugged into a live contract. Less flexible for protocol evolution. Smaller surface to attack, audit, or govern.

Conclusion

GHO is the most institutionally-integrated DAO-governed stablecoin in DeFi. It has a regulated EU ramp. It has a ~$584M circulating supply. It has a collateral portfolio at 2.27x backing, a steward multisig tuning monetary policy at weekly cadence, and a staking derivative (stkGHO) integrated into Aave's Safety Module. For a certain kind of institutional user, that's the right answer and an impressive piece of financial engineering.

The architecture UPD offers is narrower by design. One minter contract. No facilitator list. No interest-rate lever. No multisig for monetary policy. A single collateral type at this stage. An explicit stabilizer-minter split instead of a CDP. Integration with the Universal Private Pool for shielded transfers and ASP-based compliance.

Neither approach is strictly better. They are different answers to "how should a non-freezable dollar be issued." GHO's answer is a DAO-governed facilitator network with a licensed ramp. UPD's answer is a single-path issuer with no governance interest in monetary policy. Pick the model that matches the shape of your risk tolerance.

Read Proposal 61. Read the Llamarisk portfolio analysis. Read the Bluechip D-grade writeup. Then decide which set of failure modes you're more comfortable holding.

• crvUSD vs UPD: Curve's LLAMMA vs Pure Non-Freezability - another DAO-governed comparison
• Liquity (LUSD + BOLD) vs UPD: The Closest Competitor We Have - immutability vs governed parameters
• DAI vs UPD: When Decentralized Isn't Decentralized Enough - collateral-upstream freeze risk
• What Is a Non-Freezable Stablecoin? - pillar post on the core property
• Stablecoin Regulation in 2026: GENIUS, MiCA, and the Global Freeze Mandate - MiCA context for Push
• ASP vs Proof of Innocence - compliance architecture for private pools

UPD is pre-audit and deployed on Sepolia testnet at time of writing. This comparison is architectural and educational, not investment or legal advice.