Onboarding verification briefAave governance #25499

PAXGy (Paxos Labs): control-plane state at Ethereum Mainnet block 26,408,330

Read-only verification of who can change PAXGy (Paxos Labs) and the Aave V4 Global Dollar Hub (Ethereum) it is proposed for, pinned to a canonical block and reproducible on any archive node. Forum thread: [ARFC] Onboard PAXGy to Aave V4 Global Dollar Hub ↗.

Asset: PAXGy (Paxos Labs)
Venue: Aave V4 Global Dollar Hub (Ethereum)
Pinned block: Ethereum Mainnet #26,408,330 · 2026-11-13 20:07:23 UTC Canonical (EIP-1898)
Block hash: 0x8efc8256…979f4d
Data: /api/v1/onboarding.json · slug paxos-paxgy-eth

Owner

TimelockController

24h min delay

Rate bounds

+0.04% / -0.00%

≥ 60 min apart

Supply

1,312.57 PAXGy

rate 1.0044

0s capabilities

Via RolesAuthority

1. Findings

owner() of the vault, accountant, teller and manager is the TimelockController 0x0DcC…df08 (getMinDelay() = 86,400s). The RolesAuthority 0xC444…99DD is also owned by it. Owner-only changes (including setManageRoot, which no role holds) therefore wait at least 24 hours.
Timelock roles (9 events replayed): DEFAULT_ADMIN_ROLE → 0x0DcC…df08; PROPOSER_ROLE → 0x0000…3f2F; EXECUTOR_ROLE → 0x0000…3f2F, 0x1D60…9312, 0x317e…A024, 0x4143…652C, 0x6Be5…526E, 0xFBf7…1A5e; CANCELLER_ROLE → 0x0000…3f2F.
Capabilities granted through the RolesAuthority execute with no delay. updateExchangeRate is held by the 3-of-5 Safe 0x0000…3f2F and by 0x1755…4B56 (EOA (no contract code); 8,269 transactions sent). The accountant bounds each update: upper 10004 bps, lower 10000 bps of the current rate, at least 3,600s apart (current rate 1.004425 PAXG per PAXGy; platform / performance fee 0 / 0 bps). In the upstream Veda AccountantWithRateProviders source, an update outside these bounds or sooner than the minimum delay stores the new rate and pauses the accountant instead of reverting (the deployed bytecode was not compared with that source here).
Full role → capability → holder map below, replayed from 68 RolesAuthority events (blocks 25,740,680–26,408,330). Selectors without a public signature are shown as raw 4-byte values.
Teller 0x41AB…A6f7: isPaused() = false, shareLockPeriod() = 0s. The previous teller 0x5C43…fe72 is paused (isPaused() = true).

2. Observed state at block 26,408,330

Block hash 0x8efc8256…979f4d; every read below used EIP-1898 {blockHash, requireCanonical: true} and returned byte-identical results on 2 independent RPC endpoints.

Check	Contract	Value
PAXGy totalSupply()	0x6c64…700e	`1312565336266516561465`
PAXGy decimals()	0x6c64…700e	`18`
PAXGy owner()	0x6c64…700e	`0x0DcC87BC40E775A8207eB2e65b68CF51964cdf08`
PAXGy authority()	0x6c64…700e	`0xC444dA4DF6AF6A9A3891a720c1712a4188d899DD`
Timelock getMinDelay()	0x0DcC…df08	`86400`
RolesAuthority owner()	0xC444…99DD	`0x0DcC87BC40E775A8207eB2e65b68CF51964cdf08`
Accountant accountantState()	0x397e…C1fd	`payoutAddress 0x0000000000417626ef34d62c4dc189b021603f2f · words 1-4 0, 1312565336266516561465, 1004424843612274693, 1004424843612274693 · allowedExchangeRateChangeUpper (bps) 10004, allowedExchangeRateChangeLower (bps) 10000, lastUpdateTimestamp 1794598067, isPaused 0, minimumUpdateDelayInSeconds 3600, platformFee (bps) 0, performanceFee (bps) 0`
Accountant getRate()	0x397e…C1fd	`1004424843612274693`
Accountant owner()	0x397e…C1fd	`0x0DcC87BC40E775A8207eB2e65b68CF51964cdf08`
Teller isPaused()	0x41AB…A6f7	`false`
Teller owner()	0x41AB…A6f7	`0x0DcC87BC40E775A8207eB2e65b68CF51964cdf08`
Teller shareLockPeriod()	0x41AB…A6f7	`0`
Previous teller isPaused()	0x5C43…fe72	`true`
Manager owner()	0x3537…1015	`0x0DcC87BC40E775A8207eB2e65b68CF51964cdf08`
Operations Safe getThreshold()	0x0000…3f2F	`3`
Operations Safe getOwners()	0x0000…3f2F	`[5] 0x41431e315A84659012B5622627b8f9e9Bf79652C, 0x6Be51156C578414E7893B91FDE1627E8741D526E, 0xFBf73C3622668cfE655fAFF8fCb9876015001A5e, 0x317eEbf4B4a2ceE0e9a73f276628986Ab254A024, 0x1D607E4eb747f1294AE632D3490f121B00Db9312`
Rate-updater account eth_getCode	0x1755…4B56	`0 bytes`
Rate-updater account transaction count	0x1755…4B56	`8269`

3. Role maps (replayed from events)

RolesAuthority capability history · 0xC444…99DD · 68 events, blocks 25,740,680–26,408,330

Role	Holders at the pinned block	Capability (target · function)
role 1	0x4061…672a (EOA, 2 txs) 0x50E8…e2bB (EOA, 11 txs) 0xf5c6…F8FF (EOA, 2 txs)	0x3537…1015 `manageVaultWithMerkleVerification(bytes32[][],address[],address[],bytes[],uint256[])`
role 2	0x3537…1015 (contract, 7,920 bytes)	0x6c64…700e `manage(address[],bytes[],uint256[])` 0x6c64…700e `manage(address,bytes,uint256)`
role 3	0x41AB…A6f7 (contract, 19,569 bytes)	0x6c64…700e `exit(address,address,uint256,address,uint256)` 0x6c64…700e `enter(address,address,uint256,address,uint256)`
role 4	0x0000…3f2F (3-of-5 Safe) 0x1755…4B56 (EOA, 8,269 txs)	0x397e…C1fd `updateExchangeRate(uint96)`
role 5	0x69e0…8FB4 (contract, 17,313 bytes)	0x41AB…A6f7 `bulkWithdraw(address,uint256,uint256,address)`
role 6	0x0000…3f2F (3-of-5 Safe) 0x07F9…D5f7 (contract, 4,758 bytes) 0xe5Cc…cD9E (EOA, 66 txs)	0x3537…1015 `pause()` 0x397e…C1fd `pause()` 0x41AB…A6f7 `pause()` 0x5C43…fe72 `pause()`
role 7	0x9c5F…c160 (contract, 9,340 bytes) 0xF6dE…f62C (contract, 9,340 bytes)	0x41AB…A6f7 `deposit(address,uint256,uint256)`
role 9	0xaA0e…3372 (EOA, 21 txs)	0x69e0…8FB4 `0xf1bfdc06`
role 10	—	0x2e30…B7Ee `0x5efbc32a`
role 12	0x46e3…a055 (EOA, 510 txs, EIP-7702 → 0x8029…c2Bb) 0x4AB8…e944 (EOA, 787 txs, EIP-7702 → 0x0795…abe9) 0x4Fe9…E003 (contract, 5,314 bytes) 0x6CeE…71C9 (EOA, 1 txs) 0x8999…5a0B (EOA, 556 txs) 0xAc97…4C6d (EOA, 26 txs) 0xC180…2cb9 (EOA, 90 txs) 0xDFAF…6cBa (EOA, 73 txs, EIP-7702 → 0x69e6…541D) 0xDeAd…6A02 (EOA, 429 txs) 0xF368…3898 (EOA, 7,600 txs) 0xae54…811B (EOA, 272 txs) 0xd28a…85eA (EOA, 44 txs) 0xd306…C082 (EOA, 9 txs)	0x41AB…A6f7 `depositAndBridge(address,uint256,uint256,(uint32,address,address,uint64,bytes))` 0x69e0…8FB4 `0x13bd894c` 0x9c5F…c160 `0x2d7174c8` 0xF6dE…f62C `0x2d7174c8` 0xF6dE…f62C `0x6dbc73ff`
public	anyone	0x0000…0000 `0x2d7174c8`
public	anyone	0x41AB…A6f7 `bridge(uint256,(uint32,address,address,uint64,bytes))`
public	anyone	0x5C43…fe72 `bridge(uint256,(uint32,address,address,uint64,bytes))`
public	anyone	0x9c5F…c160 `0x2d7174c8`
public	anyone	0x9c5F…c160 `0x6dbc73ff`

TimelockController role history · 0x0DcC…df08 · 9 events, blocks 25,984,137–26,408,330

Role	Holders at the pinned block	Capability (target · function)
`DEFAULT_ADMIN_ROLE`	0x0DcC…df08 (contract, 6,577 bytes)	—
`PROPOSER_ROLE`	0x0000…3f2F (3-of-5 Safe)	—
`EXECUTOR_ROLE`	0x0000…3f2F (3-of-5 Safe) 0x1D60…9312 (EOA, 362 txs, signer of 0x0000…3f2F) 0x317e…A024 (EOA, 103 txs, signer of 0x0000…3f2F) 0x4143…652C (EOA, 187 txs, signer of 0x0000…3f2F) 0x6Be5…526E (EOA, 1 txs, signer of 0x0000…3f2F) 0xFBf7…1A5e (EOA, 267 txs, signer of 0x0000…3f2F)	—
`CANCELLER_ROLE`	0x0000…3f2F (3-of-5 Safe)	—

4. Reproduce

Reproduce every value on any archive node

# Ethereum Mainnet block 26408330
cast block 26408330 --field hash --rpc-url "$ETH_RPC_URL"
# expect 0x8efc8256deb932e65b5117f040db264dc8200850636d90eecd5daccb99979f4d

# PAXGy totalSupply()
cast call 0x6c6494Fd9962eB98B94ffA48F6679058F820700e "totalSupply()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# PAXGy decimals()
cast call 0x6c6494Fd9962eB98B94ffA48F6679058F820700e "decimals()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# PAXGy owner()
cast call 0x6c6494Fd9962eB98B94ffA48F6679058F820700e "owner()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# PAXGy authority()
cast call 0x6c6494Fd9962eB98B94ffA48F6679058F820700e "authority()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Timelock getMinDelay()
cast call 0x0DcC87BC40E775A8207eB2e65b68CF51964cdf08 "getMinDelay()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# RolesAuthority owner()
cast call 0xC444dA4DF6AF6A9A3891a720c1712a4188d899DD "owner()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Accountant accountantState()
cast call 0x397e38359f169748a02bc11f98D4f451FE88C1fd "accountantState()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Accountant getRate()
cast call 0x397e38359f169748a02bc11f98D4f451FE88C1fd "getRate()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Accountant owner()
cast call 0x397e38359f169748a02bc11f98D4f451FE88C1fd "owner()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Teller isPaused()
cast call 0x41AB5d8387e60E30AACCF11357C306f6d875A6f7 "isPaused()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Teller owner()
cast call 0x41AB5d8387e60E30AACCF11357C306f6d875A6f7 "owner()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Teller shareLockPeriod()
cast call 0x41AB5d8387e60E30AACCF11357C306f6d875A6f7 "shareLockPeriod()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Previous teller isPaused()
cast call 0x5C43aD60Beb32F88D14296fEF67ec0F329f3fe72 "isPaused()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Manager owner()
cast call 0x353741aBa79974a90F88594f6CBd1a9c54651015 "owner()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Operations Safe getThreshold()
cast call 0x0000000000417626Ef34D62C4DC189b021603f2F "getThreshold()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Operations Safe getOwners()
cast call 0x0000000000417626Ef34D62C4DC189b021603f2F "getOwners()" --block 26408330 --rpc-url "$ETH_RPC_URL"
# Rate-updater account eth_getCode
cast code 0x1755397BEc366a1e1160d8aE0106C60E7e344B56 --block 26408330 --rpc-url "$ETH_RPC_URL"
# Rate-updater account transaction count
cast nonce 0x1755397BEc366a1e1160d8aE0106C60E7e344B56 --block 26408330 --rpc-url "$ETH_RPC_URL"

# RolesAuthority capability history: replay 68 events
cast logs --from-block 25740680 --to-block 26408330 --address 0xC444dA4DF6AF6A9A3891a720c1712a4188d899DD --rpc-url "$ETH_RPC_URL"

# TimelockController role history: replay 9 events
cast logs --from-block 25984137 --to-block 26408330 --address 0x0DcC87BC40E775A8207eB2e65b68CF51964cdf08 --rpc-url "$ETH_RPC_URL"

5. Scope

Observations of on-chain state only. They do not assess code correctness, reserves, legal structure or off-chain key custody, and they are not investment advice.
Issuers can clear or document these findings with a 24h Collateral Onboarding & Delta Clearance Attestation ($5,000 USDC flat): block-pinned audit, docs / config reconciliation PR, Base EAS Aligned attestation and a Curator Diligence Dossier for the forum thread.

For issuers

Issuing PAXGy (Paxos Labs)? Reconcile & Anchor 24h Institutional Clearance

Reconcile documentation drift, verify multisig and timelock control planes across archive RPCs, prepare an upstream docs reconciliation PR, and anchor a Base EAS Aligned Attestation + Curator Diligence Dossier within 24 hours.

Request 24h Clearance ($5,000 USDC) →Request Commercial Invoice (PDF)