Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Ethena Pay
card Assessed on Avalanche C-Chain (chain 43114)pay.ethena.fi
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: Ethena Pay names no chain or contract in any document, so the unit rests on onchain evidence plus its own terms. The FAQ pays cashback in AVAX and the boost daily in USDe; the Card Terms name Rain as program manager. On Avalanche, Rain collateral 0x6070848b... (receiving per-wallet USDe card spends) and wallet factory 0xAc66ca9A... (12335 passkey wallets with USDe/USDC daily limits) share owner Safe 0xdD2332Ca... (block 96949020). Judgment call: attribution is inferred, not stated by Ethena Pay. Excluded: the Card Terms' generic Supported Blockchains list.
Offered only in the countries listed. Checked 2026-10-09. Not scored.
The Terms of Use (s4.5) make the Services available only where Ethena Pay has expressly authorized them, and Appendix 1 (Country-Specific Terms) has sections for 47 countries. The list here is those 47, less four where Appendix 1 withholds the card or digital-asset services by default. Australia: the Spend Card is "not generally available" unless offered through a local issuer. El Salvador, Pakistan and Morocco: digital-asset services are unavailable unless Ethena Pay confirms them at onboarding, and the card spends stablecoin balances. Japan is kept, but Appendix 1 limits Japanese users to functions that are not regulated crypto or electronic-payment services. The /jurisdictions page lists 48 live countries; it adds Antigua and Barbuda, which has no section in Appendix 1, so AG is left out as the more restrictive reading. The Spend Card is not offered to US persons. s4.6 Restricted Jurisdictions (always excluded) include Crimea and the Donetsk and Luhansk regions of Ukraine, Abkhazia, South Ossetia, Northern Cyprus and Somaliland. "Live soon": USA, EU, United Kingdom, Switzerland, Canada, Taiwan, South Korea.
Conversion. The token is sold for fiat when a payment is authorised.
Synthetic stablecoin. Held at par by a hedging strategy or market mechanism rather than reserves. It can trade below par under stress, for example when funding rates turn or a venue holding the hedge fails.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
The card is a secured account: tokens in the user's Avalanche wallet contract are the Collateral, and each card spend moves USDe (or USDC) from that wallet to a Rain collateral pool, while Rain and the issuer pay the merchant in dollars over Visa. The wallet factory sets daily spend allowances for exactly two tokens, USDe and USDC. USDe is marked default because the sampled card spend and the Rain pool's balance are in USDe, and the Daily Boost is paid in USDe; no Ethena Pay document names a default. USDe is Ethena's synthetic dollar, so the card's main balance is issued within the provider's own ecosystem (the Terms list "Ethena USDe" among Ethena Pay's or its affiliates' marks). Cashback is paid separately in AVAX. Ethena Pay names no chain or token contract in its documents; the chain and addresses come from onchain reads.
Checked 2026-10-12
Evidence (4)2 verified · 2 documented
Verified
Wallet factory getDefaultDailyLimits() returns tokens [USDe 0x5d3a1Ff2b6BAb83b63cd9AD0787074081a52ef34, USDC 0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E] with 10000e18 and 10000e6 per day, the only tokens the executor can spend for card payments.
Sample card spend moved 2.25 USDe from wallet 0x6455888e... to Rain collateral 0x6070848b... via spendDailyAllowance, relayed by Ethena Pay's BatchExecutor.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 1 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every card spend needs a co-signature from Ethena Pay's executor EOA, and the BatchExecutor that relays spends has an owner pause and recipient blocklist held by a 5-of-10 Safe with undisclosed signers and no timelock. The Card Terms let Ethena Pay and the issuer block transactions for any reason, so an individual cardholder can be cut off with no notice. The user's own funds are not frozen by these powers (direct mode, see S4), but the payment path is. Judgment call: as for other card products, the documented per-account block meets anchor 0.
Evidence (4)3 verified · 1 documented
Verified
Factory getFacet(spendDailyAllowance 0x764c53bd) = AllowanceFacet 0x74bd26ad..., whose verified source requires an executor co-signature (LibAuth.verifyExecutorSignature against factory.executor() = EOA 0xe0EcdCc8185A392baB2E23721eAdb65c8cC90fFC) for every allowance spend; the executor can withhold it for any wallet.
BatchExecutor (source verified on Routescan) has owner-only pause(), addBlocked() recipient blocklist and approvedRecipients allowlist; owner() = Safe 0xdD2332Ca4A4f8842EF7a4722ec087A236732b985, threshold 5 of 10 EOAs, no modules, no guard, no timelock.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Merchants are paid by Visa and the issuer offchain. The only onchain settlement step, moving USDe from the cardholder's wallet to the Rain collateral, requires an Ethena Pay executor signature and is relayed by Ethena Pay. Neither payer nor payee can settle a card payment by calling the contracts directly. The direct-mode withdrawal is an exit, not settlement.
Evidence (2)2 verified
Verified
Sample card spend tx 0xec33bce0...de9e was sent by relayer EOA 0x3219FAe3e8b2E6AF9a482937dE752b2Af656B78b to BatchExecutor 0x27f6358a... (batchExecute 0x80c3da8d) and moved 2.25 USDe from wallet 0x6455888e... to Rain collateral 0x6070848b... via spendDailyAllowance.
AllowanceFacet.spendDailyAllowance (verified source, L113-L153) checks LibAuth.verifyExecutorSignature over (token, to, amount, nonce, deadline); without the Ethena Pay executor's signature no spend can occur.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A card payment needs Ethena Pay's closed backend (authorisation, executor co-signer, relayer), Rain, Third National and Visa. No component of that path is public or has a fallback. Ethena Pay publishes no repository at all.
Evidence (2)1 verified · 1 documented
Verified
BatchExecutor authorizedCallers(0x3219FAe3...) = true and approvedRecipients(0x6070848b...) = true; batchExecute reverts NotAuthorized for any other caller.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Sanctions and jurisdiction screening exists and is disclosed in the Terms; it runs in Ethena Pay's closed backend and at Sumsub, so the neutrality of the settlement layer cannot be shown from code. The relayer contract's recipient allowlist restricts where card spends can go, not who can pay. Screening cannot be bypassed because there is no direct settlement path (C2 = 0). Disclosed in docs only, so 1.
Evidence (2)1 verified · 1 documented
Verified
BatchExecutor source carries an owner-managed recipient blocklist (addBlocked) and allowlist (approvedRecipients) applied to spend destinations; it does not screen the paying wallet.
Terms of Use s4.8 subject access to identity verification, sanctions screening and transaction monitoring; s4.6 lists Restricted Jurisdictions and lets Ethena Pay refuse access for any reason.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Spendable tokens (USDe and USDC) are enumerated in verified onchain factory config. USDC carries Circle's blacklister and pauser, and payees are not told about these powers or about Avalanche's validator set. The Card Terms' Supported Blockchains list does not name Avalanche (it reserves the right to add others). Judgment call: onchain config read from a verified-source factory counts as "enumerated in code"; the generic chain list is not treated as a misstatement because it is explicitly open-ended. 2.
Evidence (3)2 verified · 1 documented
Verified
Factory getDefaultDailyLimits() returns tokens [USDe 0x5d3a1Ff2b6BAb83b63cd9AD0787074081a52ef34, USDC 0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E] with 10000e18 and 10000e6 per day; the same limits are set on sample wallet 0x6455888e....
The Card Terms' Supported Blockchains list omits Avalanche, where the collateral actually sits; neither the Terms nor the FAQ state issuer freeze powers or chain assumptions.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The wallet logic is verified on one explorer (Routescan), but the factory implementation, which maps every wallet selector to its facet and holds the executor and global pause, is unverified anywhere. Nothing is on Sourcify apart from the beacon, and there is no public repo or build script. Some contracts verified, so 1.
Evidence (2)2 verified
Verified
The factory implementation (EIP-1967 implementation slot of 0xAc66ca9A...) returns no source on Routescan, no Sourcify match, and Snowscan shows it Unverified.
WalletDiamond, all ten facets returned by getAllSelectors()/getFacet(), BatchExecutor and RainCollateral are verified on Routescan (Snowtrace) only; Sourcify has only the UpgradeableBeacon 0xc831Ea25... (match); Snowscan shows them Unverified.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Contract source is public through explorer verification; the app, backend, executor, relayer, API and indexer are not, and no API schema is published. Judgment call: explorer-verified source counts as "contracts only" (1) rather than "nothing" (0).
Evidence (1)1 verified
Verified
The only public code is explorer-verified contract source (wallet diamond, facets, BatchExecutor); gh search for ethenapay/ethena-pay/pay.ethena.fi and the ethena-labs org (13 repos) found no Ethena Pay SDK, app, backend or contract repository.
Can a stranger reach a working deployment from the README? O3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
There is no README, repo or deploy script, and the factory that wires the wallets together is unverified, so no self-host path exists. Reproduction not attempted.
Evidence (1)1 verified
Verified
No repository, README or deploy instructions exist; the verified sources depend on an unverified factory implementation.
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
ABIs and event definitions can be pulled from the explorer for the wallet facets, but nothing is versioned in a repo, there is no API schema, and no export format is published. Judgment call: explorer ABIs are more than "none" but less than repo files, so 1.
Evidence (1)1 verified
Verified
Facet ABIs and events (AllowanceSpent, DirectWithdrawal, DirectModeInitiated) are available only from explorer verification; there is no repo, no API schema and no payee export.
Does every repository needed to run the product carry an OSI-approved license? F1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Explorer-verified facets carry SPDX MIT headers, but required components (factory implementation, executor co-signer, relayer, backend, Rain, issuer) are closed and there are no repos. 0.
Evidence (1)1 verified
Verified
Factory implementation source is unpublished; executor, relayer, backend and app are closed; there is no repository carrying any license.
Does a production deployment need a proprietary plugin or hosted-only service? F3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The card product cannot run without Ethena Pay's proprietary executor service, backend and Rain's program; there is no open alternative.
Evidence (1)1 verified
Verified
spendDailyAllowance, executorTokenWithdrawal, executorExternalCall and externalApprove all require LibAuth.verifyExecutorSignature from the factory's executor, an Ethena Pay key.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Collection goes well beyond settlement needs (identity, biometrics, source of funds, device data). It is disclosed in the privacy policy, with GDPR lawful bases for EEA/UK users, but not in any code or versioned repo document, so the documented cap applies: 1.
Evidence (1)1 documented
Documented
Privacy Policy lists name, address, date of birth, government ID, taxpayer ID, proof of address, source of funds and biometric or liveness data, plus device and usage data, shared with KYC/AML providers, card issuers and networks.
What do calldata and events reveal about who paid whom for what? P3
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No merchant data goes onchain, but every card spend is a public transfer from one long-lived wallet to a known Ethena Pay/Rain collateral address, so anyone can read a cardholder's spend amounts and timing; daily USDe boost payouts from a single Safe tag the wallet further. No fresh addresses. Judgment call: linkage is minimal but not documented to users, so below 2; it is not plaintext metadata, so 1 rather than 0.
Evidence (2)1 verified · 1 documented
Verified
The card spend emits Transfer and AllowanceSpent(token, to, amount) from the long-lived user wallet to the shared Rain collateral 0x6070848b...; no merchant or order data appears onchain.
The privacy policy describes collecting public wallet addresses from public blockchain networks but does not tell users that card spends are publicly visible and linkable to their wallet.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Rain, Third National, Visa, Sumsub and Privy all see payment or identity data; they are disclosed in the Terms only and cannot be swapped by the user. The app is closed, so further third parties (analytics, RPC) cannot be inventoried.
Evidence (1)1 documented
Documented
Terms incorporate third-party terms for Sumsub (identity verification), Privy (authentication and embedded wallet) and Iron (fiat), and the Card Terms name Rain, Third National and Visa.
Who holds funds between payer and payee, and can the provider redirect them? S1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07Disputed
Balances sit in the user's own wallet contract, but the Ethena Pay executor key can move up to 10,000 USDe and 10,000 USDC per wallet per day to an arbitrary address without the user's signature; the relayer contract's recipient allowlist does not bind direct calls to the wallet. At spend, funds pass to a Rain-controlled collateral pool. This contradicts the FAQ's "no access" statement. The provider can redirect funds (bounded per day), so 0.
Evidence (3)2 verified · 1 claimed
Verified
Sample wallet dailyLimit(USDe) = 10000e18 (and USDC 10000e6); AllowanceFacet.spendDailyAllowance transfers up to that amount per UTC day to any `to` address on the executor's signature alone, with no user signature.
Card spends land in Rain collateral 0x6070848b... (holding 372898.73 USDe); RainCollateral.withdrawAsset is onlyController (Rain), and owner() is Safe 0xdD2332Ca....
Who can change the contract code, and with how much notice? S2
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
All wallet logic is upgradeable through the factory, which a 5-of-10 Safe with undisclosed EOA signers can upgrade instantly via its ProxyAdmin; the 48-hour UPGRADE_DELAY inside the factory does not bind that path. The factory implementation is unverified. Multisig admin, no effective timelock, so 1.
Evidence (2)2 verified
Verified
Factory is a TransparentUpgradeableProxy whose EIP-1967 admin slot holds ProxyAdmin 0xdDaFfdB1c5f0774ee734cF3491AaFd4f0A678127; ProxyAdmin owner() = Safe 0xdD2332Ca... (5-of-10, no modules, no guard). The factory's own UPGRADE_DELAY() = 172800 s covers its scheduleUpgrade path only; ProxyAdmin.upgradeAndCall has no delay.
Wallet beacon owner() = factory 0xAc66ca9A..., implementation() = WalletDiamond 0xb4446DA2...; every wallet's fallback resolves facets through factory.getFacet(), so replacing the factory implementation changes all 12335 wallets at once.
How large an allowance does the SDK ask users to grant, and for how long? S3
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
There are no ERC-20 approvals; the wallet grants Ethena Pay's executor a refilling daily allowance of 10,000 USDe and 10,000 USDC by default, spendable to any address. Judgment call: bounded and refilling, but not limited to one receiver and not disclosed to users outside verified source, so the lower anchor 1.
Evidence (1)1 verified
Verified
getDefaultDailyLimits() sets 10000 USDe and 10000 USDC per UTC day on every new wallet at initialization (WalletDiamond._applyDefaultAllowances); the allowance is not bound to a receiver.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
S1: funds sit in the user's wallet contract. C2: no direct settlement path (0). C3: closed single-vendor backend (0). O3: no self-host path. If Ethena Pay disappears, the card stops, but a user can enter direct mode and withdraw with their own key after 1 hour, by calling the verified facets manually (no public frontend or documented procedure exists). The path depends on facet mappings the admin Safe can change instantly (S2). Judgment call: a working exit exists only as a manual contract call, so 1, not 2.
Evidence (1)1 verified
Verified
Factory getFacet(directTokenWithdrawal 0x35f48b04) = WithdrawalFacet 0xbAdea7a2..., which transfers tokens on a wallet-owner signature alone once direct mode is active; DirectModeFacet.initiateDirectMode (owner signature only) activates after 1 hour and is not blocked by global pause.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 4
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Ethena Pay wallet updates: UserProxyFactoryBeacon, BatchExecutor, WalletDiamond facets (Auth, Recovery, Allowance, Withdrawal, DirectMode, ExecutorExternalCall, ExternalApprove, ERC1271) and libraries Review window 10-29 June 2026, before the September launch. The report names no commit, and the factory implementation on Avalanche is unverified, so the audited code was not tied to the deployment. Guardian rated confidence 3 of 5.
Unknown
3 high, 14 medium, 39 low, 25 informational over two rounds; 25 resolved, 11 partly, 45 acknowledged
Ethena Pay wallet contracts: UserProxyFactoryBeacon, WalletDiamond, AllowanceFacet, AuthFacet, DirectModeFacet, RecoveryFacet, WithdrawalFacet and libraries (14 files) at 9122473f53 Repository chainnodesorg/ethenapay-wallet-contracts (not public); remediation commit 498c18fb29c0. Superseded in part by the July 2026 updates review.
Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest at 6f578d5b9c Contest ran 2-8 December 2024 on b432939a; 6f578d5 is the fix commit. The Rain repo is private and the RainCollateral implementation on Avalanche was not compared with it.
Shared component: Safe smart account v1.4.0 core contracts, used by the 5-of-10 owner Safe of the factory and executor at eb93dbb0f6 Owner Safe 0xdD2332Ca... proxies the canonical SafeL2 v1.4.1 singleton 0x29fcB43b... (slot 0 read 2026-10-13). Safe says 1.4.1 added one ERC-4337 opcode bugfix after this audit and was not re-audited.
Partly
2 medium, 1 low, 6 warnings, 2 info; one warning fixed, the rest acknowledged
Compiled from: Guardian's public report repo (github.com/GuardianAudits/Audits, Ethena folder), the crypticdefense/audits list (which still marks the EthenaPay Wallet and EthenaSafeGuard audits private), web searches for Ethena Pay audits, the Sherlock report repo for Rain, Rain's security page (audits under NDA, Sherlock named), and the docs/ audit folder of github.com/safe-fndn/safe-smart-account for the owner Safe. Guardian's April 2026 Execution Guard (EthenaSafeGuard) review is not listed: the owner Safe's guard slot is zero. Ethena's SOC 2 Type II report is not a code audit. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 9 evidenced, 0 attested, 0 absent, 0 not applicable, 36 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
none
Virtual card issuance, replacement and activation free; no account, monthly, inactivity or closure fee
Pricing page (effective 1 September 2026, updated 30 September 2026); fees may change under Terms s6.2.
fx
payer
Visa's conversion fee passed through at cost (about 1%); no cross-border fee; USD purchases free
Pricing page s2.2 and Spend Card Terms Important Disclosures.
cashout
payer
ATM 1.00 USD + 0.65% where ATM access is available, plus any operator surcharge
Pricing page s2.2 and Spend Card Terms.
cashout
payer
Bank off-ramp fees set by Iron / MoonPay and shown at the time of the transaction
Pricing page s4 Third-Party Fees; the launch post says withdrawals cost a "nominal" amount without a figure.
card
payer
Late payment up to 40 USD; returned payment up to 29 USD
Spend Card Terms penalty fees (secured card; collateral can be liquidated).
Network gas for the card spend is paid by Ethena Pay's relayer (CROPS C2/S3 findings), not shown as a user fee. Rewards (cashback in AVAX, Daily Boost in USDe) are not fees and are not recorded.
Documented
Pricing page, account fees and card transaction fees.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Hybrid: self-custody with a provider-controlled spend path
Balances sit in the user's own wallet contract, but Ethena Pay's executor key can move up to 10,000 USDe and 10,000 USDC per wallet per day to any address, and card spends pass into a Rain-controlled collateral pool. Agrees with the S1 finding (score 0, disputed against the FAQ's "no access" claim).
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licences and registrations
Unknown
No licence found for any party in the card path. Ethena Pay's Terms say it is not licensed by any financial regulator in the user's country and rely on third parties' home authorisations. The Spend Card Terms name Third National as issuer and Rain (Signify Holdings, Inc.) as programme manager, without a regulator or licence number; FDIC BankFind lists no active institution named Third National. Iron Network UAB and MoonPay USA LLC (ramps) were not checked against the Lithuanian or US registers.
Documented
Terms of Use Appendix 1, General Provisions, regulatory status.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2026-06-02 (block 87002584): Rain collateral BeaconProxy 0x6070848b... on Avalanche, which receives card spends; the wallet factory 0xAc66ca9A... followed at block 87652557 (2026-06-10)
Attribution of these contracts to Ethena Pay is inferred in the provider file (judgment call in primary_chain.basis). Public launch was 3 September 2026 (launch post).
Verified
Creation tx 0x0ebf2458...4a0e (creator 0x21ebc2f2..., via factory 0x154f9755...); code size 0 at block 87002583 and 1345 at 87002584 (2026-06-02 14:53:40 UTC). Wallet factory proxy creation tx 0x062bcda8...409c at block 87652557 (2026-06-10 11:29:34 UTC), code size 0 at the block before.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident report found on pay.ethena.fi (legal hub, FAQ, support, insights launch post) or docs.ethena.fi; the product launched on 3 September 2026. Ethena Pay has no public repository.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2026-06-01: Ethena Pay Spend Card Terms take effect (issuer Third National, programme manager Rain). source
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not observable
A card spend emits AllowanceSpent from each user's wallet proxy (about 12,300 wallets, not listed) and a USDe Transfer from the USDe token into Rain collateral 0x6070848b...; the listed BatchExecutor's event carries only call counts, and the spec cannot filter token transfers by recipient. Card spends cannot be summed over listed contracts alone.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement, security page or trust centre found on pay.ethena.fi (/security returns 404; legal hub, FAQ, privacy, terms, disclaimers read). Rain and Third National not checked.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown implied from the component list
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown implied from the component list
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown implied from the component list
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown implied from the component list
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown implied from the component list
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown implied from the component list
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown implied from the component list
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Unknown implied from the component list
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Sign-in uses passkeys with Face ID or fingerprint (the passkey is the wallet owner key per CROPS findings); no separate second factor is described. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
The privacy policy states access controls, encryption "where appropriate", network security, monitoring and logging; the launch post claims data "encrypted end to end". No data classification and no TLS version stated; no TLS scan recorded. source 1
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Published retention table: KYC/CDD 5 years after the relationship ends; transactions 5 years; screening results relationship + 5 years; account profile account life + 1 year; device and usage data 12 months; support records 3 years; security incident records 5 years. Data is deleted or anonymised at the end of the period or on a valid deletion request, subject to exceptions. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Ethena Pay Ltd. (Malta) is data controller under the GDPR, with a designated data protection contact; no DPIA statement and no processor list by name (categories only). Card data is shared with the issuer under the card terms. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown implied from the component list
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Unknown implied from the component list
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Ethena Pay Ltd., Malta, company C 114576 (Terms of Use, Appendix 1 general provisions); the card agreement is with the issuer Third National, with Signify Holdings, Inc. d/b/a Rain as programme manager; ramps with Iron Network UAB or MoonPay USA LLC; KYC with Sumsub; wallet auth with Privy. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Ethena (the USDe issuer) presents Ethena Pay as its own distribution channel for USDe, funded on Ethena's economics (reserve yield on USDe, interchange); the Daily Boost is a discretionary Ethena Pay subsidy. No financial statements found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Ethena Pay may terminate with notice where practicable, or immediately without notice on legal, third-party-provider, fraud or breach grounds; after closure balances "could remain in your control, could be returned to you, or could be frozen or locked", which Ethena Pay says it does not control. The issuer may cancel the card at any time with or without notice. The user can close the account in the app. source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Yes. The privacy policy says automated decision-making and profiling (watchlist matching, risk-scoring models, behavioural analytics) are used for identity verification, sanctions screening, fraud detection, transaction monitoring and eligibility, and can suspend accounts or block transactions; some features use machine learning. source 1
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
Only an override path is documented (EEA/UK users may request human review and contest a decision, except where the decision is needed for the contract or required by law). No monitoring, validation, decommissioning or bias evaluation documentation found. source 1
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
User wallet contracts (WalletDiamond beacon proxies and facets)
contracts
Yes
MIT
Ethena Pay (owner Safe 0xdD2332Ca...)
Yes
Wallet factory implementation (facet registry, executor, global pause)
Ethena Pay launched on 2026-09-03. It publishes no repository, contract address or chain; the Avalanche deployment was found from USDe Transfer logs (Ethena Pay's FAQ pays boost in USDe daily and cashback in AVAX) and tied together through shared owner Safe 0xdD2332Ca.... Attribution to Ethena Pay is an inference, recorded as a judgment call in primary_chain.basis. All reads pinned to Avalanche block 96949020. Explorer citations use the Routescan API (snowtrace.io and routescan.io pages return 403 to curl). A third-party audit list (crypticdefense/audits) mentions private Guardian audits of an "EthenaPay Wallet" and "EthenaSafeGuard"; no report is public, so S6 is unknown.
