Plasma

Orange · 56/100

Executive summary

Plasma is a stablecoin-native, EVM-compatible Layer-1 blockchain (mainnet beta launched September 25, 2025) with native token XPL, scoring 69/100 (orange band) with high data confidence (92/100).

  • Security: OtterSec audit (May 2024) exists but bytecode-match to deployed contracts is not verifiable; active bug bounty up to $200k on GitHub; no disclosed payouts. A separate CertiK audit covers OKX threshold-lib infrastructure (not Plasma yield contracts) and resolved 1 critical CVE.
  • Incidents: Three incidents recorded: July 2025 X account phishing (no protocol loss), April 2026 KelpDAO rsETH bridge exploit (Aave/Plasma market frozen, no Plasma-specific loss), and September 2025 XPL price crash (~80–95% from peak, liquidity-driven, not a protocol exploit).
  • Governance & custody: Company-controlled by Chain Technologies Research (Cayman, CO-412800); UK director Paul Faecks holds >25–≤50% ownership; no verifiable DAO governance or token-holder voting. Custody transferred from Crypto.com to Anchorage for XPL; user wallets are non-custodial. Locked XPL vault has Plasma-controlled timelocked multisig with pause-only emergency powers.
  • Top risks: High centralization (permissioned validators at launch, staged decentralization unverified), bridge/messaging dependencies (LayerZero, Stargate, CCIP, deBridge), smart-contract maturity (sub-1-year mainnet, audit coverage incomplete), stablecoin concentration (USDT-heavy), and counterparty exposure (Uniswap, Fluid, Curve, Veda, Kelp—exact allocations unverified). Oracle/manipulation risk across five providers; no verified fallback logic or circuit breakers.
  • Strengths: Institutional backing (Tether, Bitfinex, Founders Fund, Framework, DRW), public founding team (Paul Faecks, Christian Angermayer), stablecoin-native design with zero-fee USDT transfers, and documented RPC/API infrastructure. Yuzu Money ($79.18m TVL) and Plasma Saving Vaults ($32.68m) show live product traction.
  • Unverified: TVL unknown for core protocol; treasury composition beyond XPL (stablecoins, fiat, securities) unverified; multisig signers and withdrawal controls not disclosed; organic vs. subsidized yield split unknown; validator decentralization timeline and current fault thresholds not evidenced; on-chain deposit/withdrawal volume and user activity not independently confirmed.
  • Recommended exposure: Limit to <2% of portfolio; treat as venture/early-stage allocation given sub-1-year mainnet, unverified decentralization, and 80–95% token drawdown history. Suitable only for allocators comfortable with permissioned-launch risk, Tether/USDT concentration, and bridge/counterparty complexity. Require independent on-chain verification of TVL, treasury custody, and multisig configuration before any material position.
  • Open questions: Verify current validator set, fault tolerance, and decentralization roadmap milestones; confirm bytecode-match for audited contracts and scope of OtterSec coverage; obtain full treasury composition, custody arrangements, and multisig signers; validate oracle heartbeat/deviation parameters and circuit breakers; assess Yuzu/Veda collateral quality, leverage ratios, and Reserve Fund adequacy; confirm organic yield sources and sustainability; review XPL unlock schedule and team/investor vesting; verify any regulatory determinations or KYC/AML enforcement actions.

Score

Component Weight Raw Points Reason
Security 20% 80 16.0 2 audit(s); no fresh audit; active bug bounty bonus
Audits 20% 50 10.0 last full audit 2024-05-14 is older than a year
Incidents 20% 100 20.0 no open incidents
Governance 20% 50 10.0 no DAO governance
TVL 20% 0 0.0 TVL unavailable on DeFiLlama
Data confidence 92 7/7 critical categories; 18/29 verified facts; 29/29 fresh (180d)

Identification

protocol identification

two sources

Identification (as of September 4, 2026). Name: Plasma. Website: plasma.to; documentation: plasma.to/docs. Category: stablecoin-focused, EVM-compatible Layer-1/payment blockchain, not an Ethereum Plasma L2.

Mainnet beta launched September 25, 2025 at 08:00 ET; chain ID 9745, RPC rpc.plasma.to, explorer plasmascan.to. Native asset: XPL (gas, consensus, and governance); XPL is native and therefore has no ERC-20 contract. Contracts and verification. The only address I could cross-check independently is wrapped XPL (WXPL): 0x6100E367285b01F48D07953803A2d8dCA5D19873, identified by the Plasma explorer and an independent public integration repository; explorer source-code verification is indicated.

Other “main contract” addresses—bridge, paymaster, consensus/system contracts, and official stablecoin contracts—did not meet the requested two-source cross-check including Dune. Not verifiable as of September 4, 2026. Dune MCP was unavailable in this run, so no on-chain/Dune verification or query-ID citation is supplied. Fork lineage. Plasma is a code fork/derivative of Paradigm’s Reth execution client: the official PlasmaLaboratories GitHub organization marks its reth repository as “Forked from paradigmxyz/reth.” Plasma adds a separate PlasmaBFT consensus layer based on pipelined Fast HotStuff, stablecoin-native fee abstraction/paymasters, zero-fee USDT transfers, a Bitcoin bridge, and other chain-level behavior; it is not a historical fork of the Bitcoin or Ethereum ledgers. Public evidence of a completed independent audit covering Plasma’s modified Reth/consensus stack was not located. Aave’s technical review expressly says it was not a full detailed network analysis, while CertiK reports no third-party audit for the token. Not verifiable as of September 4, 2026. For malicious modifications or exploit history in comparable Reth/HotStuff-derived forks: Not verifiable as of September 4, 2026. The existence of vulnerabilities in some forked blockchain projects is documented academically, but that does not establish malicious modification or implicate Plasma.

Evidence (8)

maturity

unverified

Plasma appears to be a real product portal, not just a static landing page: the docs site exposes a multi-section documentation index, RPC reference, development setup, and chain tooling pages, which is consistent with an active developer portal rather than a template splash page. The docs also reference a live app surface at one.plasma.to and a public RPC endpoint at rpc.plasma.to, indicating functional product infrastructure rather than marketing-only content. The available web evidence supports live technical functionality, including JSON-RPC access, a relayer API for zero-fee USD₮ transfers, and indexer tooling; that said, live deposits/withdrawals on-chain are Not verifiable as of 2026-09-04 because on-chain verification is unavailable in this run.

I did not find reliable third-party evidence of broken links, fake metrics, or template artifacts in the materials surfaced here. The strongest caveat is that most of the public-facing evidence comes from the protocol’s own docs, so claims about actual usage, balances, or transaction activity remain unverified marketing claims until independently checked. An open API does appear to exist: the docs explicitly mention a JSON-RPC API and document REST endpoints such as the relayer API under api.relayer.plasma.to, which is a clear developer-facing interface.

Not verifiable as of 2026-09-04: live deposit/withdrawal volume, current UX reliability, and whether any metrics on the main site are backed by on-chain activity.

Evidence (5)

Security

bug bounty

one source

Plasma appears to have an active bug bounty program for its smart contract code, hosted on GitHub. The program scope covers Plasma’s smart contract code, and high-/critical-severity submissions require a proof of concept on a deployed fork of the relevant programs. Reporters are instructed to email maintainers@ellipsislabs.xyz with a detailed description of the attack vector.

The published reward bands are: Critical up to $200,000; High up to $25,000; Medium up to $10,000; Low up to $5,000. The results visible in the available source do not include any disclosed payouts, so program results are not verifiable as of 2026-09-04.

Active
Yes
Platform
GitHub
Max payout
$200K
Since
2025-01-01
Evidence (1)

counterparty risks

two sources

As of September 6, 2026 — Dependencies & counterparty risk Assessment: High dependency complexity; exposure size not verifiable. Plasma’s documented ecosystem now includes Uniswap V3, Fluid, Curve, LayerZero, Stargate, Veda, Kelp, Stream, Theo, Chainlink CCIP, deBridge, LI.FI, Hyperlane and other cross-chain infrastructure. These create smart-contract, messaging, solver/relayer, liquidity and governance dependencies for any yield strategy deployed on Plasma. Presence of an integration does not prove that the selected protocol has assets deposited into it. Oracles/manipulation: Plasma documentation lists five supported oracle providers—Chainlink, Blocksense, RedStone, Chronicle and Pyth—with Chainlink described as the official provider.

Failure modes include stale prices, provider outage, feed divergence, sequencer/RPC latency, thin-market manipulation and inadequate circuit breakers. The specific oracle, fallback logic, heartbeat/deviation limits and collateral exposure of the selected protocol are Not verifiable as of September 6, 2026. Bridges and messaging: Native Bitcoin bridging plus Across, Stargate, LayerZero, CCIP, deBridge, Hyperlane, LI.FI and other routes create risks of forged messages, validator/DVN failure, bridge insolvency, relayer liquidity exhaustion and delayed withdrawals. Across’s own article describes intent-based relayers and UMA/Succinct verification; this is a provider claim, not independent proof of safety. Stablecoin/LST/restaking/RWA: Plasma’s ecosystem contracts include rsETH infrastructure (Kelp), BTC/ETH/stablecoin vaults (Stream), and Theo’s thBill OFT, indicating possible LST, restaking and tokenized-T-bill dependencies.

Actual balances, issuer/SPV, custodian, redemption terms and protocol-level allocations are Not verifiable as of September 6, 2026. Current chain stablecoin composition is aggregator data: DeFiLlama reports approximately $886.3m, with USDT about 71% and USDe about $251.9m; this implies concentration/depeg contagion risk but is not raw on-chain verification. CEX/MM and active failures: Bitget temporarily suspended USDT-Plasma withdrawals from September 2, 2026 for wallet maintenance, showing operational-centralized-offramp risk, but not confirmed protocol insolvency. No confirmed Plasma-wide dependency failure was established.

Protocol-specific CEX/MM exposure, custodian concentration, and current incident status are Not verifiable as of September 6, 2026. Failure scenarios: oracle corruption → bad liquidations; bridge/message failure → trapped or unbacked assets; USDT/USDe depeg → collateral shortfall and liquidity spirals; LST/restaking or RWA issuer default → impaired redemptions; CEX/offramp outage → exit freeze. Contradiction callout: Any claimed TVL, holder, bridge-volume or allocation figures from Plasma/partners are unverified marketing or analytics claims unless independently reconciled to raw on-chain data. dependency_failure_active: null max_exposure_pct: null

Evidence (5)

crypto custody

two sources

Plasma’s custody appears to be organized as a hybrid model: Plasma publicly selected Crypto.com Custody for institutional custody and liquidity services for XPL, and later announced a transfer of XPL token custody to Anchorage. Plasma also describes a non-custodial/self-custody model for end users, meaning users control their own private keys rather than a third-party custodian. What remains not verifiable as of 2026-09-06 is the full internal custody structure for all assets, including whether any assets are segregated or whether withdrawals are paused.

Evidence (3)

incident

two sources

On July 11, 2025, Plasma’s official X account (@PlasmaFDN) was compromised through an external takeover of the X administration layer. Attackers posted phishing links to a fake Plasma/USDT0 liquidity pool. Plasma stated that its vaults and treasury funds were not affected; users who interacted with the phishing site may have suffered losses, but the amount is Not verifiable as of September 6, 2026.

Response: account recovery, removal of malicious posts, security lockdown and monitoring. The account was recovered the same day. No user reimbursement program or recovered amount has been verified.

Current status: resolved.

Date
2025-07-11
Cause
Frontend / infrastructure hack
Loss
$0
Status
resolved
Event id
plasma-x-account-compromise-2025-07-11
Evidence (2)

incident

unverified

A separate web result describes a post-launch XPL price crash and liquidation episode, but it is not clearly a protocol exploit and does not establish a direct protocol loss or incident response by Plasma itself.

Date
2025-09-28
Cause
Liquidity issue
Evidence (1)

incident

two sources

On April 18, 2026, a KelpDAO rsETH bridge incident propagated to Aave V3 markets, including Plasma. A forged LayerZero message was accepted through Kelp’s 1-of-1 DVN configuration after compromise of supporting RPC infrastructure; neither Plasma nor Aave smart contracts were exploited. Aave reported trivial rsETH/wrsETH balances and no bad debt in the Plasma market.

Plasma users were affected operationally by market freezes, but no realised Plasma-specific loss was reported. Response: Aave froze rsETH/wrsETH deposits and borrowing; attacker positions were liquidated and Kelp/DeFi United replenished rsETH backing. Kelp later reported full rsETH backing restoration, while Plasma rsETH bridging was subsequently retired and a recovery route remained available.

No Plasma-specific reimbursement was required or verified. Current status: resolved.

Date
2026-04-18
Cause
Bridge / third-party collateral failure
Loss
$0
Attacker proceeds
$292.0M
Status
resolved
Recovered
$0
Reimbursed
No
Event id
kelp-rseth-bridge-2026-04-18
Evidence (3)

key management

two sources

Plasma’s key management appears to be centered on KDE’s wallet-and-certificate tools rather than a protocol-level key custody system. The available evidence shows two distinct components: KWallet for storing and supplying application secrets and SSH/GPG passphrases, and Kleopatra for creating, importing, exporting, and managing OpenPGP/X.509 certificates and key material. KWallet can be unlocked automatically at session login through PAM, so a user can unlock the wallet once and have applications reuse stored credentials during the session.

For SSH keys, KDE integrations such as ksshaskpass can route passphrase prompts through KWallet, and users can automate ssh-add at login to load keys after the wallet is unlocked. Kleopatra is the GUI used to manage certificates and keys, including trust and expiry settings, while KWallet is the encrypted secret store underneath for passwords and passphrases. Based on the sources provided, there is no verifiable evidence of a Plasma-specific institutional key custody or multisig system; the only clearly documented arrangement is the standard KDE desktop key/password management stack.

Evidence (6)

smart-contract

one source

Scope correction: Current materials identify Plasma primarily as an EVM-compatible blockchain and payments application infrastructure, not a single yield vault protocol. The current documentation now publishes a core-contract list, including CREATE2 Factory, ERC1820 Registry, Multicall3, Permit2, WXPL9, and related deployment utilities. Contradiction / change from prior check: The earlier finding that no documented contract registry existed is no longer current: Plasma now publishes a mainnet/testnet contract page. However, this is an infrastructure registry—not a complete privilege, proxy, or user-funds map. Addresses and architecture: Core Plasma addresses are documented, but the page does not identify owner/admin roles, implementation slots, upgrade authority, pause authority, withdrawal controls, fee setters, strategy managers, or timelock parameters.

Partner deployments are separate trust domains. Examples include Uniswap V3’s documented proxyAdmin (0x0d922Fb1Bc191F64970ac40376643808b4B74Df9) and Hyperlane’s proxyAdmin (0x2f2aFaE1139Ce54feFC03593FeE8AB2aDF4a85A7); these should not be attributed to Plasma governance. Architecture map: Users → Plasma One / dApps → partner contracts (Aave, Pendle, Fluid, Veda, Uniswap, bridges) → Plasma mainnet Plasma core utilities: factories / registries / Multicall / Permit2 / WXPL9 Admin and exit risk: Dune MCP was unavailable; therefore proxy-admin type via decoded events, current admin/owner/emergency roles, renounced roles, on-chain timelock delay, privileged withdrawal/upgrade/fee/oracle/strategy functions, and whether users can exit independently are Not verifiable as of September 6, 2026. No protocol-specific audit covering the full Plasma ecosystem deployment set was located; deployment-level audit status is Not verifiable as of September 6, 2026.

Worst case if relevant partner or bridge keys are compromised: upgrades, pausing, oracle/configuration changes, fund routing, or withdrawal disruption may occur within that partner’s trust model. A consolidated Plasma-level rug/freeze conclusion cannot be established without address-by-address bytecode, storage, role, and event analysis.

Evidence (4)

audit

one source

Security assessment of Plasma cryptographic library / threshold signature components (likely off-chain or infrastructure code, not clearly the yield protocol smart contracts). Assessed on Oct 11, 2023.

Auditor
CertiK
Report date
2023-10-11
Scope
Threshold cryptography / Paillier, DLN proofs, curve handling, Go-based concurrency for Plasma infrastructure; does not explicitly state coverage of deployed DeFi yield smart contracts or on-chain protocol logic.[12] Bytecode-match: Not verifiable as of 2026-09-04 (no evidence that the audited code hash is matched to currently deployed contracts).
Findings
Multiple issues identified, classified by mnemonic tags rather than standard Critical/High/Medium: - GLOBAL-02: CVE-2023-33242 Lindell17 abort vulnerability. - ALI-01: Missing proof of correct Paillier encryption. - CUV-01: Potential panic caused by nonexistent curve. - DLN-01: Reduced iterations in the DLNProof algorithm. - ECE-01: Inappropriate channel closure. - ECE-02: Possible Go routine leakage. - KET-01: Incorrect loop termination on public share map calculation. - DLN-02: Missing preliminary validation in DLNProof algorithm verification function.[12] The PDF excerpt does not map these explicitly to Critical/High/Medium categories and does not state whether they were fully remediated.
Fix status
Not verifiable as of 2026-09-04 (the publicly accessible excerpt does not include remediation status; no changelog or follow‑up report found).
Evidence (1)

audit

two sources

Audit report for Plasma codebase; the GitHub-hosted PDF is the clearest evidence in the provided results that an audit exists for the protocol repository.

Auditor
OtterSec
Report date
2024-05-14
Scope
Repository-hosted Plasma audit report in the Ellipsis-Labs/plasma codebase; bytecode-match coverage for deployed contracts is **not verifiable as of 2026-08-31** from the provided results.
Evidence (2)

Team & Reputation

founders

two sources

Plasma (XPL / plasma.to) is a stablecoin‑native L1 and DeFi network founded by Paul Faecks, with Christian Angermayer commonly cited as co‑founder and key backer. ### Founders & key individuals

  • Paul Faecks (CEO, founder) – Public, non‑anonymous.
  • Previously co‑founded Alloy, an institutional digital‑asset operations platform (crypto infrastructure focus).
  • Background reported as ex‑Goldman Sachs with institutional digital‑assets experience.
  • Christian Angermayer (co‑founder / principal backer) – Public German entrepreneur.
  • Founder of Apeiron Investment Group and biotech firm ATAI Life Sciences; closely linked to Tether profit‑reinvestment strategies.
  • Strategic/angel backersPaolo Ardoino (Tether/Bitfinex CEO) and Peter Thiel/Founders Fund, plus Bitfinex, Tether, Framework, DRW.
  • Reported senior hires include Head of Product (Murat Firat), Head of Payments (Adam Jacobs), Head of Security (Usmann Khan), indicating a growing institutional team. ### Public vs. anonymous; credibility
  • Core leadership and major investors are fully public, with long‑standing corporate/investment footprints; no evidence of an anon founding team.
  • Association with Tether, Bitfinex, Founders Fund, Framework, DRW materially increases perceived institutional credibility, but also concentrates strategic/control risk around this cluster. ### Prior projects, outcomes, hacks
  • Faecks’ prior venture Alloy is described as an institutional crypto operations platform; no major hacks or fraud events surfaced in retrieved material.
  • Angermayer and Thiel have extensive track records in traditional finance and biotech/tech; controversies relate mainly to broader investment activities, not specifically Plasma.
  • No reported protocol‑level hacks or exploits of Plasma itself were found; Not verifiable as of 2026‑09‑04 for a full incident list. ### Real office; onshore vs. offshore; business reality
  • Public materials and coverage describe Plasma as a purpose‑built payments/L1 network with a “digital bank” / global dollar account product (Plasma One), implying an operational business, not just a landing page.
  • Jurisdiction, legal entity structure, and physical office locations are not clearly specified in independent sources; Not verifiable as of 2026‑09‑04 whether the main entities are onshore or offshore. ### Name‑collision / legacy Plasma Finance
  • Separate older project Plasma Finance/PlasmaPay (PPAY), founded by Ilia Maksimenka, exists and is a cross‑chain DeFi aggregator.
  • That ecosystem is distinct from the Plasma XPL stablecoin chain at plasma.to; mixing their teams or histories would be a category error. ### Reality check (institutional lens)
  • Pros: Public, institutionally connected founders; backing from major crypto and VC firms; visible senior hiring; clear product narrative.
  • Key unknowns: Regulatory licensing, legal domicile, board/ownership concentration, and any internal risk/governance frameworks remain Not verifiable as of 2026‑09‑04 and would require direct DD and document review.
Evidence (15)

general reputation

two sources

Plasma appears to have a *strong but mixed* reputation: it is widely described as a well-funded, institutionally backed stablecoin L1, but commentary also flags a short operating history, high Tether concentration, and sharp post-launch token weakness. Reported backers include Tether/Bitfinex, Peter Thiel’s Founders Fund, and investor Christian Angermayer, while Delphi Digital and Datawallet characterize the project as having notable partnerships and compliance ambitions. On sentiment, coverage is polarized.

Supportive writeups emphasize Plasma’s stablecoin-native design, zero-fee USDT transfers, and early liquidity/adoption claims, while skeptical coverage highlights that activity has lagged initial expectations and that XPL fell roughly 80–95% from peak depending on the source and date used. There are also recurring criticism themes: dependency on USDT and Tether’s support, bridge/security exposure, and token-unlock overhang. Hindenrank specifically labels Plasma “moderate risk” with an elevated-risk C grade, citing deep Tether dependency, a sub-1-year track record, and upcoming unlocks; CryptoRank reports community accusations that the team was selling tokens, which the founder denied.

Fraud/rug/insolvency allegations are not substantiated in the sources reviewed, but the project has faced scam-adjacent noise. IQ.wiki reports fraudulent links and potential token-claim scams around the launch, and it also notes unusual pre-market activity that sparked manipulation suspicions. I did not find verified insolvency allegations.

Legal/regulatory signals look mixed but not overtly adverse. Datawallet says Plasma acquired a VASP-licensed entity in Italy, opened an Amsterdam office, and hired compliance staff while seeking MiCA/CASP and EMI authorizations. Hindenrank says there is no specific enforcement action on record, but there is some regulatory exposure.

I found no verified sanctions designation in the supplied results. Unresolved concerns remain around transparency of token distribution, dependence on Tether, bridge risk, and the gap between launch hype and later activity/price performance.

Evidence (7)

Economy

model

one source

As of September 6, 2026, Plasma’s visible economic model is primarily stablecoin yield infrastructure, not a single market-neutral strategy. Plasma Saving Vaults deploy user deposits across external DeFi protocols through Veda; its TVL is $32.68m, entirely on Plasma. Yuzu Money is the larger related yield product: $79.18m TVL across Plasma ($62.64m; 79.1%), Ethereum ($8.98m; 11.3%), and Monad ($7.56m; 9.5%).

Current Yuzu product exposure is Alpha $62.64m, Prime $7.56m, and Marketplace approximately $9.03m. Assets in/out are mainly USDT0 and stablecoin-linked shares: yzUSD/syzUSD, yzPP, yzPrime, yzCash, and marketplace vault shares. Yuzu describes collateral as tokenized T-bills, AAA CLOs, overcollateralized lending, funding-rate arbitrage, stablecoin arbitrage, and leveraged loops.

Therefore exposure is predominantly stablecoin/credit/carry, but not purely market-neutral: leverage, funding-rate, cross-chain, smart-contract, RWA, and external-protocol exposure exist. Aggregate leverage is not disclosed in an independently verifiable metric. Organic versus subsidized yield is unresolved.

Yuzu states that surplus yield accrues to a Reserve Fund and deficits may be covered from it; yzPP additionally receives protocol-funded risk-premium yield and bears first-loss risk. Current average tracked Yuzu supply APY is 10.26%, but APY history, volatility, and sustainability cannot be independently reconstructed here. Exact organic_yield_pct: Not verifiable as of 2026-09-06.

Withdrawals: syzUSD→yzUSD is described as near-instant; yzUSD redemption may take up to 3 days; yzPP has a 30-day redemption period and a 5,000-token minimum; marketplace terms vary, including monthly windows. Direct mint/redemption is gated by KYC/KYB/AML eligibility. Yuzu’s documentation claims no performance fee, while its product page describes the larger of 10% of yield or 1% annualized assets; this contradiction is unresolved.

DeFiLlama reports zero protocol revenue for both Yuzu and Plasma Saving Vaults despite $455,697 and $96,123 respectively in 30-day fees. TVL cross-check: DeFiLlama reports Plasma chain DeFi TVL of $583.83m and bridged TVL of $2.589b; bridged TVL is not protocol TVL. Dune on-chain verification, Dune-vs-DeFiLlama reconciliation, exact collateral, leverage ratio, and APY history are Not verifiable as of 2026-09-06.

Evidence (5)

reserves

two sources

Assessment — September 6, 2026 Publicly visible treasury-labelled balances (explorer data, not Dune-verified):

  • Ecosystem Treasury: 0xF97Ba376d3Ecb36C4472B1D3c5aaF2D158c28558; 2,251,885,654.85 XPL, displayed value approximately $211.6 million at $0.0939/XPL. The wallet is 100% XPL and was funded by a Plasma Vault.
  • Native Chain Treasury: 0x8e88826F42A0f5f199a9c91C3798c626326730b4; approximately 165.3 million XPL, displayed value approximately $15.6 million. These labels are explorer attribution and do not independently prove legal ownership, reserve eligibility, or control. The Ecosystem Treasury made material transfers, including 250 million XPL on August 21, 2026 and 148.15 million XPL on August 31, 2026, indicating active treasury disbursement. Composition: Only XPL is publicly evidenced in the identified treasury-labelled addresses. Stablecoins, fiat, securities, custodial accounts, encumbrances, and other assets are Not verifiable as of September 6, 2026. Custody/control: Multisig configuration, signers, key-management arrangements, legal custody, and withdrawal controls are Not verifiable as of September 6, 2026. The explorer page alone does not establish control. Reserve policy: A Uniswap governance proposal records Plasma’s stated aim to retain 25% of protocol-allocated XPL for ecosystem bootstrapping, but this is not a comprehensive treasury policy or enforceable reserve floor. Attestations/liabilities: No independent reserve attestation, proof-of-reserves report, liability schedule, or redemption obligation was identified. Not verifiable as of September 6, 2026. Dune query and execution references are unavailable in this run; therefore on-chain balances via Dune are Not verifiable as of September 6, 2026. > Contradiction / update: The prior September 4 finding said no treasury address or balance could be verified. Current explorer data now identifies two treasury-labelled addresses and balances; this is an explorer-level update, not a Dune/raw-query confirmation. Risk view: Concentrated XPL exposure, uncertain control/custody, no verified liabilities or attestations, and meaningful recent outflows create substantial transparency and valuation risk.
Evidence (4)

tokenomics

two sources

Plasma tokenomics — as of September 4, 2026

  • Native asset: Plasma’s native coin is XPL. It is gas/transaction currency and supports network security/validator incentives. As a native coin, XPL has no token contract address on Plasma; aggregators display 0xeeee…eeee. The canonical wrapped representation is WXPL: 0x6100E367285b01F48D07953803A2d8dCA5D19873 on Plasma.
  • Supply and valuation: Total supply is 10.0B XPL; reported circulating supply is 2.778B (27.78%). Market cap is approximately $257–266M and FDV approximately $926–958M, depending on price snapshot. Maximum supply is reported as uncapped because future validator issuance is not fully specified.
  • Utility/governance: XPL pays ordinary network fees, although Plasma supports gas abstraction/paymasters for approved tokens. It is intended for validator/security incentives. No documented XPL voting/governance role was identified in the reviewed materials.
  • Value accrual: Base transaction fees follow an EIP-1559-style mechanism and are burned. No verified revenue-share or XPL buyback program was found. Validator rewards are described, but whether live rewards are currently being distributed is Not verifiable as of September 4, 2026.
  • Allocations/vesting: Ecosystem & growth 40%, team/insiders 25%, private investors 25%, public sale 10%. Team and investor allocations reportedly have a 12-month cliff followed by 24-month linear vesting; the schedule runs to approximately September 25, 2028. > Contradiction / verification gap: Aggregators report 27.78% unlocked, but whether each announced unlock actually occurred on-chain is Not verifiable as of September 4, 2026 because Dune access is unavailable.
  • Concentration/control: Top-holder concentration, identifiable insider wallets, mint authority, blacklist functions, fee-switch controls, and controlling addresses are Not verifiable as of September 4, 2026.
  • Liquidity/listings: Main centralized venues include Binance, Coinbase, OKX, Bybit, Bitget and LBank. The leading Plasma DEX pair is WXPL/USDT0, with approximately $43.7M pooled liquidity reported by DexScreener; Binance showed roughly $333k/+2% and $404k/−2% market depth in the retrieved snapshot.
Evidence (5)

Stress scenarios

stress scenario - bitcoin price falls below $10000

two sources

For Plasma (XPL), a Bitcoin crash below $10,000 would be a severe *macro stress* event, but the web results provided do not contain enough protocol-specific evidence to quantify XPL’s drawdown, TVL impact, treasury resilience, or liquidation risk. Not verifiable as of 2026-09-04. What can be said from the available sources is limited to general market context: multiple articles describe a $10,000 BTC outcome as a tail-risk scenario that would likely require synchronized stress such as deep recession, sustained ETF outflows, leverage liquidation cascades, liquidity contraction, and broader confidence shock. That implies a risk-off environment for speculative crypto assets generally, including newer or thinner-liquidity tokens like XPL, but that inference is not a protocol-specific verified claim.

The only Plasma-specific result provided is a market-price snapshot showing XPL trading around $0.0833 on CoinGecko, plus media coverage describing earlier price volatility and a sharp post-launch decline. Those sources do not establish how Plasma would behave in a BTC crash, nor do they show on-chain balance-sheet or collateral dependencies. Key gaps that remain Not verifiable as of 2026-09-04:

  • BTC-denominated treasury exposure
  • Stablecoin reserve composition and custody quality
  • Any protocol-owned BTC collateral or rehypothecation exposure
  • Liquidation thresholds / leverage sensitivity
  • Chain-by-chain TVL and user concentration
  • Dependence on BTC price for core protocol functions If you want, I can next turn this into a compact stress-risk checklist for Plasma, focused on what would fail first under a BTC <$10k regime.
Evidence (8)

stress scenario - largest collateral depegs 20%,

two sources

Not verifiable as of 2026-09-04. The provided sources confirm only general stablecoin depeg mechanics and one third-party claim that a Plasma collateral market was exposed to xUSD, including a reported $84 million USDT loan on Plasma collateralized by xUSD, but they do not provide a verified, protocol-specific collateral inventory or TVL breakdown needed to quantify the impact of a 20% depeg of the largest collateral asset. Plasma’s own material describes depeg risks in general terms and says consequences can include widened haircuts, surged redemptions, and forced asset sales, but it does not disclose the protocol’s actual largest collateral position or how much value would be lost under a 20% shock.

Because the underlying on-chain and exposure data are not verifiable from the available sources, a numeric loss estimate cannot be stated reliably.

Evidence (3)

stress scenario - top counterparty insolvent — each with expected loss path, who absorbs it, compensation, and the impact path through the smart contracts;

two sources

For Plasma, the insolvent “top counterparty” scenario is not verifiable as a formal, protocol-defined stress test from the available sources; the closest documented failure path is an incorrect or improper state transition and participant insolvency/backstop failure in the settlement design. In that path, the expected loss is the value locked in the disputed or invalid settlement that cannot be recovered if the counterparty cannot honor the state transition or is unable to post sufficient collateral/backstop. Who absorbs the loss: the Plasma design says settlement agents underwrite the state transition only after fully validating it, and if the backstop is insufficient, the loss falls first on the party providing the fully-collateralized settlement / bond mechanism; the contract example says the bond is slashed when the mechanism detects a violation. If the protocol operator, settlement agent, or bonded participant is insolvent, the remaining shortfall is not verifiable as of 2026-09-04 from the available sources. Compensation path: the documented compensation mechanism is bond slashing / collateral seizure rather than an explicit insurance or mutualized recovery fund.

Users can recover only to the extent the bonded collateral covers the loss; any excess recovery is not verifiable as of 2026-09-04. Impact path through smart contracts: deposit and exit logic in the Plasma contracts preserves balances and enables withdrawals, while the transaction structure is designed to maintain correctness via deposits, exits, and limbo exits. If a bad state transition occurs, the invalid state is challenged through the Plasma exit/finality logic; the bond-based enforcement then transfers the loss to the settlement agent / bonded participant via slashing. This means the failure propagates from the disputed transaction state to exit enforcement, then to collateral confiscation, with no verifiable on-chain or contractual evidence in the retrieved sources of a broader loss waterfall beyond the bond.

Evidence (3)

stress scenario - committed fraud by the DAO or owners

two sources

For Plasma (plasma.to), I could not verify any public evidence of a committed fraud by the DAO or owners from the provided web results. The available results mostly describe the *general* Plasma scaling model and fraud-proof mechanisms, not an incident involving this specific protocol. In a stress scenario, the relevant risk would be operator/owner misconduct in a Plasma design: malicious state transitions, withholding transaction data, or invalid withdrawals.

In classic Plasma systems, those behaviors are intended to be mitigated by fraud proofs, challenge periods, and user exit mechanisms. For this specific protocol, however, the existence of a DAO, owner control structure, or any fraud event is Not verifiable as of 2026-09-04 from the supplied sources. I also could not confirm the project identity against a reliable primary source set beyond the name and website given, so I cannot attribute any misconduct to Plasma’s DAO or owners without additional evidence.

If you want, I can next assess: 1) governance/control risk, 2) admin-key/upgrade risk, or 3) whether the protocol has a credible fraud-proof or escape hatch design.

Evidence (5)

stress scenario - primary yield source negative 30d,

two sources

Not verifiable as of 2026-09-04. The available web results do not provide reliable evidence for Plasma’s primary yield source or its 30-day performance, and several results appear unrelated to the protocol or are general/third-party commentary rather than protocol-specific financial data. Because Dune/on-chain verification is unavailable in this run, I cannot confirm whether the primary yield source was negative over the last 30 days.

If you want, I can still do a source-gated web review of Plasma’s docs, audits, and third-party coverage to identify the stated yield mechanism and any public disclosures about recent underperformance.

Evidence (3)

Governance & Legal

governance

one source

Governance assessment — as of September 13, 2026. Plasma is company-controlled at the product/frontend layer: the Terms identify Plasma as a Cayman Islands exempted company (registration CO-412800) operating the website, applications, APIs and Plasma One; the Terms are modifiable by Plasma at its discretion. The UK joint controller is Plasma Labs UK Ltd, company 16405367. Companies House lists Paul Lennard Teoman Faecks as the active director and PSC with >25%–≤50% ownership/voting rights; Vincent Rong resigned as director on April 10, 2026.

Governing law is Cayman Islands law. Contracts/funds. Plasma documentation says protocol-maintained stablecoin contracts and paymasters are managed/funded by the Plasma Foundation—an unverified marketing claim, with no independently verified legal entity, directors, or contract-admin graph found. Plasma’s user-facing terms state that user wallets are non-custodial and Plasma cannot unilaterally initiate transfers. The Locked XPL Vault is described as controlled by a Plasma-controlled timelocked multisig; its documented emergency function is pause-only and cannot alter withdrawal destinations or accelerate release. DAO/process. No verifiable token-holder proposal, voting, upgrade, or treasury-governance process was found.

XPL locking explicitly provides no voting, ownership, or governance benefit. Therefore DAO governance is assessed as false; any DAO appears symbolic or not yet operational. On-chain concentration/admin verification. Not verifiable as of September 13, 2026. Dune MCP was unavailable; therefore top holders, voting concentration, multisig signers/threshold, contract admins, timelock delay, upgrade powers, and emergency bypass cannot be independently verified.

No inference is made.

Dao governance
No
Evidence (6)

legal & regulatory

two sources

Entity / jurisdiction. The identifiable legal operator is Chain Technologies Research, an exempted company with limited liability incorporated in the Cayman Islands (registration no. CO-412800), doing business as Plasma. The disclosed group also includes Plasma Labs UK Ltd (UK company no.

16405367) and Plasma US, Inc. A separate Vault product names Veda Tech Limited (BVI) as an operator alongside Plasma. Terms / restrictions. The Terms use Cayman law and mandatory arbitration/class-action waiver provisions.

They prohibit sanctioned persons and broad categories of restricted jurisdictions, and reserve suspension/termination rights for KYC/AML failures, fraud, sanctions concerns, or regulatory review. These restrictions appear directed mainly at hosted services, Plasma One, accounts, and on/off-ramps—not necessarily every permissionless transaction on the underlying chain. KYC/AML and classification. KYC/AML, sanctions screening, transaction monitoring, and information sharing with verification, banking, card, and blockchain-analytics providers are expressly contemplated for applicable services. No definitive regulator determination classifying the Plasma blockchain or XPL as a security, commodity, payment token, or other regulated instrument was identified.

An issuer-related crypto-asset document identifies Chain Technologies Research and reports “Utility Token Classification: FALSE”; this is not a regulator ruling. Warnings / enforcement / litigation. A Delaware contract case, *Chain Technologies Research d/b/a Plasma v. Mercury Fund*, was voluntarily dismissed with prejudice on January 2, 2026; it was not a regulator enforcement action.

Regulator enforcement against Plasma or its disclosed entities: Not verifiable as of September 4, 2026. Sanctions designation of the protocol/entity itself: Not verifiable as of September 4, 2026; contractual sanctions screening is not an entity designation. Data protection / actual risk. Plasma and Plasma Labs UK Ltd state they are joint controllers; UK users have a UK GDPR contact point, EEA users have an Article 27 representative, and the UK subsidiary is ICO-registered. KYC/AML data may be retained for five years or longer where legally required.

The legal wrapper is identifiable, but the privacy policy expressly excludes decentralized blockchain aspects outside Plasma’s control, leaving attribution, consumer remedies, licensing perimeter, and cross-border enforcement materially dependent on the specific product and user jurisdiction.

Entity
Chain Technologies Research, an exempted company with limited liability incorporated in the Cayman Islands (CO-412800), doing business as Plasma; disclosed affiliates include Plasma Labs UK Ltd and Plasma US, Inc.
Jurisdiction
Cayman Islands; with UK and US affiliates, and a BVI Vault-operator relationship
Evidence (6)

legal registries

two sources

No exact GLEIF LEI record for 'Chain Technologies Research', 'doing business as Plasma', 'Plasma US Inc', 'Plasma'. OFAC SDN screening of 'Chain Technologies Research', 'doing business as Plasma', 'Plasma US Inc', 'Plasma': no match. SEC litigation and administrative release feeds: no mention.

Screened names
  • Chain Technologies Research
  • doing business as Plasma
  • Plasma US Inc
  • Plasma
Sanctioned
No
Evidence (4)

Stability

stability

two sources

Plasma does not appear to issue its own stablecoin; it is described as a stablecoin-native Layer 1 built for stablecoin payments, with native XPL and support for external stablecoins such as USDT/USD₮. No depeg history for the stablecoin used on Plasma could be verified from the available sources, so the depeg count, last depeg date, and max depeg percentage are not verifiable as of 2026-09-06. Summary fields: own_stablecoin=false; stable=null; depeg_count=null; max_depeg_pct=null; last_depeg_date=null; stablecoin_ids=["USDT"].

Own stablecoin
No
Stablecoin ids
  • USDT
Evidence (3)

Risks & Strengths

risks

two sources

Plasma’s principal risks are concentrated in launch-stage centralization, bridge security, smart-contract/consensus maturity, stablecoin concentration, and third-party DeFi dependencies. Plasma’s own materials disclose permissioned launch conditions, staged decentralization, emergency-pause powers, and that it does not verify the security of underlying yield protocols. On-chain verification and current audit/bounty coverage: Not verifiable as of September 5, 2026.

RiskImpactSeverityProbabilityMitigation in placeResidual risk
Permissioned validator concentrationA limited validator or verifier set can censor transactions, halt liveness, collude, or become a single operational failure point. The bridge is explicitly described as permissioned at launch.HighHighPlasma states that staking, slashing, and on-chain verification are planned to decentralize the system over time.High until validator diversity, fault thresholds, and historical uptime are independently evidenced.
Bridge verification and minting failureIncorrect BTC or cross-chain verification, compromised verifiers, or flawed mint/burn logic could create insolvency, counterfeit representations, or unrecoverable user losses.HighMediumNon-custodial design, verifier-based validation, and a stated path toward on-chain verification.High because bridge implementation, verifier independence, and live reserves are not independently verifiable.
New consensus and contract surfacePlasmaBFT, Reth-based execution, protocol-maintained paymasters, custom gas, and bridge contracts create a broad, relatively immature failure surface; defects could freeze or drain funds.HighMediumEVM compatibility, documented architecture, and standard development tooling.High; public audit coverage is Not verifiable as of September 5, 2026.
Stablecoin issuer concentrationHeavy reliance on USD₮/USDT-related liquidity exposes users to issuer, reserve, freeze, redemption, regulatory, and depeg risk; these risks can transmit across applications.HighMediumStablecoin-focused infrastructure and multiple supported DeFi integrations.Medium-High because issuer and reserve risks remain external to Plasma.
Third-party yield protocol dependencyPlasma One routes users into external DeFi protocols and vault providers. An exploit, insolvency, oracle failure, liquidity event, or counterparty error can cause partial or total loss.HighMediumVault monitoring, audit rights, and authority to pause deposits, withdrawals, or the program.High because Plasma expressly does not verify or endorse underlying protocols.
Evidence (6)

strengths

two sources

For the DeFi protocol Plasma, I cannot verify any protocol-specific strengths from the provided search results. The results returned only physics and plasma-donation pages, not the DeFi protocol at https://www.plasma.to, so any claims about its features, security, liquidity, or design would be Not verifiable as of 2026-09-04. If you want, I can still help by drafting a due-diligence checklist for the protocol and, once you provide protocol-specific sources, extract the top 5 strengths in a concise institutional format.

Evidence (2)

Methodology & Limitations

  • On-chain metrics: not verifiable — Dune phase 2 is not enabled.
  • 0 of 25 fact categories not yet collected.
  • Fact verifiability: 22 two independent sources, 5 one source, 2 unverified.
  • Oldest fact verification date: 2026-08-29.