# Collateral Assessment: pathUSD (Tempo Chain)
**Asset Class:** Fiat-Backed Stablecoin (TIP-20)
**Assessed by:** DeFi Risk Research
**Date:** April 16, 2026
**Overall Risk Rating:** 🔴 HIGH — Do Not List (Pending Conditions)

---

## 1. Executive Summary

pathUSD is a USD-pegged stablecoin issued by Bridge (bridge.xyz), a Stripe subsidiary, natively deployed on Tempo — a new payments-first Layer 1 blockchain incubated by Stripe and Paradigm. It is the foundational payment token and sole quote asset of Tempo's enshrined stablecoin DEX.

pathUSD is implemented as a **TIP-20 token** — Tempo's native token standard, which extends ERC-20 with protocol-level compliance primitives, built-in memo fields, a fixed 6-decimal precision, and an immutable ISO 4217 currency field. These are not optional add-ons but are enshrined at the consensus layer, meaning that changes to the token standard require a hard fork.

Despite a credible issuer with strong regulatory momentum and a well-resourced chain, the asset carries **HIGH risk** at this stage due to: (1) no published smart contract audit for either pathUSD or Tempo's core protocol, (2) no active bug bounty, (3) nascent mainnet with a rapid-fork history (5 hard forks in the first ~30 days), (4) only ~$2.6M DEX liquidity, and (5) no reserve attestation yet published for the pathUSD token specifically.

**Recommendation: Defer listing pending the six conditions enumerated in Section 9.**

---

## 2. Token Identity & Contract Details

| Field | Value |
|---|---|
| Token Name | pathUSD |
| Symbol | pathUSD |
| Token Standard | TIP-20 (Tempo-native; not ERC-20) |
| Contract Address | `0x20C0000000000000000000000000000000000000` |
| Contract Type | Protocol precompile — enshrined at consensus layer |
| Chain | Tempo Mainnet (Chain ID: 4217) |
| Decimals | **Fixed 6** (TIP-20 mandatory; non-configurable) |
| Currency Field | `"USD"` (ISO 4217, immutable post-deploy) |
| Supply Cap | Configurable via `setSupplyCap()` (Bridge admin role) |
| DEX Quote Role | Root quote token: `quoteToken() = address(0)` — all stablecoin pairs on Tempo route through pathUSD |
| Issuer | Bridge Ventures LLC / Bridge Building Inc (bridge.xyz), a Stripe subsidiary |
| Mainnet Live | March 18, 2026 |
| Circulating Supply | ~3,070,235 pathUSD |
| Market Cap | ~$3.9M |

> **Critical note on contract architecture:** pathUSD is *not* a standard ERC-20 deployed by a protocol. It is deployed at a deterministic protocol address and its logic is enshrined in Tempo's consensus layer. This means that modifying pathUSD's behavior requires a full Tempo hard fork — it cannot be upgraded unilaterally by Bridge. This is a meaningful structural distinction with both security benefits and tail risks (see Section 7).

---

## 3. TIP-20 Contract Specification (vs ERC-20)

Understanding pathUSD's risk profile requires understanding how TIP-20 differs mechanically from ERC-20. These are not cosmetic differences — they change the trust, compliance, and gas model materially.

### 3.1 Fixed Decimals & Currency Field

TIP-20 mandates **6 decimals** for all tokens (vs ERC-20's developer-configurable precision, typically 18). This eliminates an entire class of precision-mismatch bugs (e.g., the 1inch "bug" that exploited 6 vs 18 decimal assumptions). Additionally, each TIP-20 token carries an **immutable `currency()` field** containing an ISO 4217 currency code (pathUSD → `"USD"`), which has no ERC-20 equivalent. This field cannot be modified post-deployment, providing on-chain assurance that the token's peg target is permanent and protocol-enforced.

### 3.2 Role-Based Access Control (RBAC)

pathUSD inherits TIP-20's native RBAC system with three critical roles:

| Role | Controller | Function |
|---|---|---|
| `ISSUER_ROLE` | Bridge (bridge.xyz) | Sole authority to `mint()` and `burn()` tokens |
| `PAUSER_ROLE` | Bridge (bridge.xyz) | Can freeze all transfers via `pause()` / `unpause()` |
| `BURN_BLOCKED_ROLE` | Bridge (bridge.xyz) | Can prevent specific addresses from having tokens burned |

**Risk Implication:** All mint/burn/pause authority is held unilaterally by Bridge. There is no confirmed on-chain multisig or timelock governing these roles. A compromised or coerced Bridge hot wallet could mint unbacked pathUSD or freeze all transfers protocol-wide. This is the single most critical centralization risk for the asset.

### 3.3 TIP-403 Policy Registry (Built-in Compliance Layer)

pathUSD can be attached to Tempo's **TIP-403 Policy Registry**, deployed at the deterministic address `0x403c000000000000000000000000000000000000`. This is a protocol-level compliance system with no ERC-20 equivalent. Available policy types include:

- **Whitelist policies:** Only pre-approved addresses can hold or transfer pathUSD
- **Blacklist policies:** Specific addresses are blocked (e.g., OFAC-sanctioned wallets)
- **Compound policies:** Composable combinations of the above

This means Bridge can — and in regulated contexts, will — restrict pathUSD transfers at the protocol level. For DeFi use cases, this creates a risk that liquidity pool interactions could be silently blocked if counterparties are blacklisted. Integrators must verify their smart contract addresses and user wallets are not subject to TIP-403 policies before listing.

### 3.4 Memo Fields (`transferWithMemo` / `mintWithMemo` / `burnWithMemo`)

TIP-20 introduces native 32-byte on-chain memo support via three additional functions:

```
transferWithMemo(address to, uint128 amount, bytes32 memo) 
mintWithMemo(address to, uint128 amount, bytes32 memo)
burnWithMemo(address from, uint128 amount, bytes32 memo)
```

Each memo-enabled call adds approximately 5,000 gas vs the standard transfer, but enables on-chain payment reference tracking — essential for payroll, remittance, and B2B payment reconciliation use cases. Importantly, amount fields use **`uint128`** (not `uint256` as in ERC-20), meaning integrators must update ABI encoders accordingly.

### 3.5 Quote Token Routing & DEX Integration

pathUSD is designated as the **root quote token** on Tempo's enshrined stablecoin DEX (`0xDEc0000000000000000000000000000000000000`). Every other TIP-20 stablecoin on Tempo has pathUSD as its quote token (`quoteToken() != address(0)`), while pathUSD itself returns `address(0)` from `quoteToken()`. This creates a hub-and-spoke routing model:

```
AlphaUSD → pathUSD → BetaUSD  (two-hop via pathUSD orderbook)
USDC.e ⇔ pathUSD              (direct pair, primary liquidity pool)
USDT0 ⇔ pathUSD               (direct pair)
```

This architecture means that any liquidity crisis in pathUSD has cascading effects across all stablecoins on Tempo. It also means pathUSD liquidity depth is a systemic risk factor, not just an asset-specific one.

### 3.6 Gas Payment & Fee AMM

Tempo has **no native gas token**. All transaction fees are paid in TIP-20 stablecoins including pathUSD. The Fee AMM contract handles real-time pricing of gas in stablecoin units. This makes pathUSD a critical piece of chain infrastructure — a depeg event would directly impair the ability to pay gas and execute transactions on-chain.

### 3.7 Gasless Approvals (TIP-1004 / EIP-2612 Permit)

As of the T2 hard fork, pathUSD supports `permit()` (gasless ERC-20-style approvals via off-chain signatures), aligning with EIP-2612. This enables meta-transactions and is important for UX in payment-focused contexts, but also expands the phishing/signature attack surface relative to earlier TIP-20 implementations.

### 3.8 `InvalidRecipient` Guard

TIP-20 includes a built-in revert on `transfer(address(this), amount)`, i.e., sending tokens to the token contract itself. This prevents the classic ERC-20 token-locking bug that has permanently destroyed millions of dollars in ERC-20 assets across DeFi. For integrators, this means no special `rescue` functionality is needed for this specific failure mode.

### 3.9 TIP-20 vs ERC-20 Comparison Table

| Feature | ERC-20 | TIP-20 (pathUSD) |
|---|---|---|
| Decimals | Developer-configurable (typically 18) | Fixed at 6 — protocol-enforced |
| Currency ID | None | ISO 4217 field (e.g., `"USD"`) — immutable |
| Compliance layer | None native (require external contracts) | TIP-403 Policy Registry — built in at `0x403c...` |
| Memo support | None | `transferWithMemo` / `mintWithMemo` / 32-byte on-chain memo |
| Amount type | `uint256` | `uint128` — note ABI compatibility difference |
| Gasless approvals | Via EIP-2612 add-on (optional) | TIP-1004 (EIP-2612) — standardized, added in T2 |
| Gas payment | Paid in ETH (or chain native) | Paid in TIP-20 stablecoins (no native gas token) |
| Supply cap | External contract or manual governance | Native `setSupplyCap()` — on-chain enforced |
| Quote routing | No native DEX routing | Root quote token on enshrined DEX |
| Token loss guard | No guard on transfer-to-self | `InvalidRecipient` revert — prevents locking |
| Upgradeability | Proxy pattern available | None — enshrined; changes require hard fork |
| RBAC | Custom (no standard) | `ISSUER_ROLE`, `PAUSER_ROLE`, `BURN_BLOCKED_ROLE` |

---

## 4. Issuer Analysis: Bridge (bridge.xyz)

### 4.1 Corporate Structure

Bridge was founded by **Zach Abrams** (CEO, ex-Coinbase, ex-Square) and **Sean Yu** (CTO, ex-Coinbase, ex-Square) as an independent stablecoin orchestration platform. In early 2025, Stripe acquired Bridge for **$1.1 billion** — the largest acquisition in Stripe's history — and Bridge has since operated as a Stripe subsidiary. pathUSD is the first native stablecoin issued directly by Bridge under the Stripe umbrella.

Tempo was jointly incubated by Stripe and Paradigm, making Bridge the natural stablecoin issuer for Tempo's foundational payment token. The chain, the issuer, and the stablecoin are co-developed within the same institutional ecosystem.

### 4.2 Regulatory Status

Bridge currently operates as a **registered Money Services Business (MSB)** with US state-level Money Transmission Licenses (MTLs) across applicable jurisdictions, operating under the legal entity Bridge Building Inc (NMLS #2450917).

On **February 17, 2026**, Bridge received **conditional approval from the US Office of the Comptroller of the Currency (OCC)** to organize a federally chartered national trust bank. Once fully approved, this charter will allow Bridge to operate stablecoin issuance, custody, and reserve management under direct federal banking oversight — the same regulatory tier as JPMorgan or Bank of America for the relevant product lines. Bridge has explicitly stated its compliance framework is "GENIUS Act ready."

**Key caveat:** The OCC approval is *conditional* — final charter approval is pending. Until it converts to a full charter, Bridge remains subject to state-level MTL regimes, not federal banking supervision.

### 4.3 Reserve Composition

Per Bridge's disclosed reserve policy for its stablecoin products, reserves are held in:

- US short-dated Treasury securities
- Overnight reverse repurchase agreements (repos)
- Money market funds (government-grade)
- Cash deposits at regulated institutions

Custodians: BlackRock, Fidelity, Apex — held in **segregated, bankruptcy-remote accounts** such that Bridge creditors cannot reach reserve assets.

### 4.4 Reserve Attestation Status — CRITICAL GAP

Bridge has committed to **quarterly reserve attestations**. However, as of the assessment date (April 2026), **no attestation has been published specifically for pathUSD**. The token launched March 18, 2026 — the first attestation could reasonably be expected in June 2026. Until that first attestation is published and verified by an independent third-party accountant (Big 4 or equivalent), there is no external verification that the ~3.07M circulating pathUSD is backed 1:1.

This is not grounds to assume fraud — Bridge's general reserve disclosures are credible and they have strong institutional incentives to maintain backing given their Stripe relationship and OCC process. But for listing purposes, absence of attestation is a genuine disclosure gap.

---

## 5. Chain Risk: Tempo

### 5.1 Chain Maturity

Tempo mainnet launched **March 18, 2026** — approximately 29 days before this assessment. This is an extremely new chain. In the first ~30 days of mainnet operation, Tempo has executed the following hard forks:

| Fork | Approx Date | Notes |
|---|---|---|
| T1 | March 2026 | Initial mainnet |
| T1a | March 2026 | Patch |
| T1b | March 2026 | Patch |
| T1c | March 12, 2026 | Pre-mainnet testnet corrections |
| T2 | March 2026+ | Added TIP-1004 (permit), additional fixes |

The fork cadence signals active development and rapid issue resolution. It also signals that the chain is not yet in a stable, audit-validated state.

### 5.2 Performance Characteristics

| Metric | Value |
|---|---|
| Target TPS | 100,000–200,000+ (benchmark: 20,000 on testnet) |
| Finality | < 0.5 seconds (Simplex BFT via Commonware) |
| Gas cost per transfer | < $0.001 (TIP-20 transfer ~50,000 gas) |
| EVM Compatibility | Full (targeting Osaka hardfork) |
| Consensus | Simplex BFT |
| Chain ID | 4217 |
| Language | Rust (74.5% codebase), Solidity (21.7%) |

### 5.3 Security Posture — CRITICAL GAP

**Audit status:** Per Tempo's own SECURITY.md (confirmed via GitHub):

> *"Note: The Tempo blockchain is still undergoing audit and does not have an active bug bounty. Submissions will not be eligible for a bounty until audits have concluded."*

This is the most significant risk factor in this entire assessment. Tempo is a live mainnet blockchain holding real user funds with:
- **No published smart contract audits** for pathUSD, TIP-20, TIP-403, or the enshrined DEX
- **No active bug bounty program** — researchers cannot earn rewards for disclosures
- A codebase that includes 74.5% Rust and 21.7% Solidity, spanning consensus, VM, token standard, and DeFi primitives

For context, comparable protocols at launch (Uniswap v4, Aave v3, etc.) had 6–12 months of auditing prior to deployment. Tempo has launched without completing this process.

### 5.4 Team & Backers

| Person | Background |
|---|---|
| Liam Horne | Former CEO of Optimism (OP Mainnet) |
| Georgios Konstantopoulos | Former CTO of Paradigm |
| Dankrad Feist | Former Ethereum Foundation researcher |

**Backers:** Stripe (incubator), Paradigm (incubator), Thrive Capital, Greenoaks Capital — $500M raised at $5B valuation (September 2025).

**Enterprise partners:** Anthropic, DoorDash, Mastercard, Nubank, OpenAI, Ramp, Revolut, Shopify, Standard Chartered, Visa.

The team pedigree and institutional backing are exceptional and reduce execution risk. They do not, however, substitute for security audits.

### 5.5 Oracle Infrastructure

Oracle provider: **RedStone** — live on Tempo from block 1 (March 18, 2026). RedStone provides:

- The **first native pathUSD price feed** on Tempo
- Sub-second update frequency
- FX pairs including USD/KRW, USD/MXN for global payment use cases
- Prior deployments: Morpho, Ethena, EtherFi, BlackRock BUIDL (via Securitize)

RedStone was selected after competitive evaluation. It is a credible oracle provider with >$8.5B in TVS. Single-oracle dependency is a residual risk — no multi-oracle redundancy has been announced.

---

## 6. Liquidity & Market Structure

| Metric | Value |
|---|---|
| Circulating Supply | ~3,070,235 pathUSD |
| Market Cap / FDV | ~$3.9M |
| DEX TVL (Tempo native DEX) | ~$1.53M (DefiLlama) |
| Primary Pool (USDC.e/pathUSD) | ~$2.62M liquidity |
| 24h Trading Volume (primary pool) | ~$40,360 (1,224 transactions) |
| Active Stablecoin Pools | 3 (USDC.e/pathUSD, USDT0/pathUSD, TDOGE/pathUSD) |
| Cross-chain Bridge | Across Protocol (USDC ↔ pathUSD; live March 18, 2026) |

**Liquidity depth is critically insufficient** for DeFi collateral use. A $2.62M pool size means:
- A $500K collateral liquidation event would consume ~19% of available liquidity, causing severe slippage
- A $1M event would deplete ~38% of the pool — liquidation failure risk is high
- Industry standard for stablecoin collateral listing: >$25–50M in DEX liquidity minimum

The USDT0 integration (live March 27, 2026) adds a second dollar-liquidity venue, but the overall market depth remains far below threshold.

---

## 7. Peg Mechanism & Stability Analysis

### 7.1 Peg Structure

pathUSD targets 1:1 USD at all times. It is a **fiat-backed stablecoin** with full reserve backing — not an algorithmic or partially-collateralized model.

### 7.2 Mint/Burn Mechanics

Minting and burning are controlled exclusively by Bridge via `ISSUER_ROLE`. The mint/burn flow:
1. User deposits USD (via Bridge API)
2. Bridge mints pathUSD to the user's Tempo address via `mint(address, uint128)` or `mintWithMemo(address, uint128, bytes32)`
3. On redemption, Bridge calls `burn(address, uint128)` after verifying fiat receipt
4. Supply cap (`setSupplyCap()`) sets the absolute ceiling on mintable supply — preventing runaway issuance even if ISSUER_ROLE credentials are compromised

### 7.3 Peg Stability Observations

- No significant depeg events observed since launch (March 18 – April 16, 2026)
- RedStone pathUSD feed provides on-chain pricing reference
- pathUSD acts as gas payment token — any depeg event directly affects chain operability
- Primary arbitrage mechanism: Across Protocol bridge (pathUSD ↔ USDC on other chains) enables cross-chain peg correction

### 7.4 Tail Risk: Chain-Level Insolvency

Because pathUSD is the gas payment token and root DEX quote asset, a severe pathUSD depeg (e.g., >5%) would simultaneously: (a) raise effective gas costs for all Tempo users, (b) impair all stablecoin-to-stablecoin routing on the enshrined DEX, and (c) cascade into all collateral positions denominated in pathUSD. This creates correlated systemic risk unique to Tempo's architecture.

---

## 8. Risk Matrix

| Risk Category | Severity | Probability | Score | Notes |
|---|---|---|---|---|
| **Smart Contract / Protocol Bug** | Critical | High | 🔴 CRITICAL | No audit published; no bug bounty; 5 hard forks in 30 days |
| **Admin Key Compromise (Bridge)** | Critical | Low | 🟠 HIGH | Unilateral mint/pause/burn via ISSUER_ROLE and PAUSER_ROLE; no multisig/timelock confirmed |
| **Reserve Backing Risk** | Medium | Low | 🟡 MEDIUM | Credible issuer; no pathUSD-specific attestation yet; segregated accounts claimed |
| **Liquidity / Liquidation Risk** | High | High | 🔴 HIGH | Only ~$2.6M liquidity; cannot support meaningful collateral liquidations |
| **Chain Maturity / Stability Risk** | High | Medium | 🔴 HIGH | 29-day mainnet; rapid-fork cadence; no production track record |
| **Oracle Failure (RedStone)** | Medium | Low | 🟡 MEDIUM | Single oracle; credible provider; no multi-oracle redundancy |
| **TIP-403 Policy Freeze** | Medium | Low | 🟡 MEDIUM | Bridge can restrict transfers; DeFi integrations may be silently blocked |
| **Regulatory / Bridge Shutdown** | Low | Low | 🟢 LOW | Stripe subsidiary; OCC conditional approval; strong incentive to operate |
| **Peg Mechanism / Algorithmic Risk** | Low | Low | 🟢 LOW | Simple fiat-backed model; no algorithmic component |
| **Cross-chain Bridge Risk** | Low | Low | 🟢 LOW | Across Protocol intent bridge; established provider |

---

## 9. Listing Conditions

The following conditions must be met before pathUSD can be considered for collateral listing:

| # | Condition | Target Timeline |
|---|---|---|
| 1 | **Full smart contract audit published** by a named, reputable firm (Trail of Bits, OpenZeppelin, Spearbit, or equivalent), covering pathUSD (TIP-20), TIP-403, and the enshrined DEX | Before listing |
| 2 | **Active bug bounty program launched** on Immunefi, Sherlock, or Cantina, with minimum $1M critical-severity payout | Before listing |
| 3 | **Multisig + 24-hour timelock** on Bridge's ISSUER_ROLE and PAUSER_ROLE admin keys — proven on-chain | Before listing |
| 4 | **DEX liquidity ≥ $25M** in the USDC.e/pathUSD pool (or equivalent) to support meaningful liquidation flows | Before listing |
| 5 | **First quarterly reserve attestation published** by an independent Big 4 or equivalent accountant, specifically covering pathUSD circulating supply | Before listing |
| 6 | **≥ 6 months of stable mainnet operation** without critical exploits or emergency hard forks | ~September 2026 at earliest |

---

## 10. Summary Verdict

| Dimension | Assessment |
|---|---|
| Issuer Quality | ✅ Strong — Stripe subsidiary, OCC approval in progress, credible reserve policy |
| Token Standard | ⚠️ Novel — TIP-20 is protocol-enshrined but unaudited; built-in compliance tools add complexity |
| Chain Infrastructure | ⚠️ Very New — 29 days on mainnet; rapid fork cadence; strong team but no production track record |
| Security | 🔴 Critical Gap — No published audit; no active bug bounty |
| Liquidity | 🔴 Insufficient — $2.6M vs $25M+ required for collateral use |
| Reserve Transparency | ⚠️ Pending — Attestation framework credible; no pathUSD-specific attestation yet |
| Regulatory Clarity | ✅ Strong — OCC conditional approval; GENIUS Act aligned |
| **Overall** | **🔴 HIGH RISK — Do Not List** |

---

*Report prepared using on-chain data, GitHub security disclosures, regulatory filings, and official protocol documentation. Data as of April 16, 2026. This is a risk research document, not financial advice.*