Deployments
This page lists governance-authorized production deployments of the Pendle PT implementation. A deployment is added only after its contracts, CRE workflow identities, permissions, and supported markets have been finalized and publicly verifiable.
Pending governance authorization
The contracts below are deployed and verified on Ethereum mainnet, and their addresses are published in the Aave address book. They are not yet authorized to change any pool parameter: that requires AIP 515 to execute, registering the agents and granting them RISK_ADMIN. Workflow identities and agent IDs are minted by that execution and are published here once it completes.
Networks
| Network | Status | Supported PT markets | Governance authorization |
|---|---|---|---|
| Ethereum | Deployed 21 August 2026, pending authorization | PT-srUSDe-22OCT2026 | AIP 515, ARFC |
Smart contracts
LlamaRisk components, deployed for this implementation:
| Component | Address | Verification |
|---|---|---|
RiskOracle | 0x683d1A91599F971252Ef171eF1F987172be8369A | Verified |
PTParameterRegistry | 0x37370932045d20C01A62b3e7c21134A1C6365D38 | Verified |
LlamaguardRiskOracleRouter | 0x1D85000D54ea1185C43E4f2b32833524d3cF3507 | Verified |
LlamaGuardOracle (PT-srUSDe-22OCT2026) | 0xc63D0747457dA82E4dc1C6a06Fb587622137d887 | Verified |
AaveDiscountRateAgent | 0x529e2374afB38AC465D71979E7540ad93C05F6c5 | Verified |
AaveEModeAgent | 0xbe2840440d4f77CD98CEC2de09913e6851907744 | Verified |
Aave-operated components this implementation reads and writes through. These are canonical Aave contracts, not deployed by LlamaRisk:
| Component | Address |
|---|---|
AgentHub | 0x95E3015c67EF62B866cC28ca5A9AB5017A55e336 |
RangeValidationModule | MiscEthereum.RANGE_VALIDATION_MODULE |
One LlamaGuardOracle is deployed per PT market. Its decimals, description and version are immutable and it keeps a single round series, so two PT markets cannot share one instance.
CRE workflows
Three workflows run in the Aave DAO CRE organization, which owns and deploys them. A workflow identity hashes the compiled binary together with its configuration and its registered owner, so each identity is reproducible from the committed source.
| Workflow | Workflow ID | Registered owner | Build reference |
|---|---|---|---|
| Market-state / EMA | Published after AIP execution | Aave DAO CRE organization safe | cre/pendle_ema_oracle |
| Discount-rate | Published after AIP execution | Aave DAO CRE organization safe | cre/pendle_discount_rate_oracle |
| Risk-parameter | Published after AIP execution | Aave DAO CRE organization safe | cre/pendle_risk_parameters_oracle |
Workflow identities depend on the agent IDs carried in each configuration, and those IDs are assigned when the AIP registers the agents. They are therefore published only once execution completes and the identities are final.
Permissions and controls
LlamaRisk operates the publication stack and can stop or narrow it at any time. Aave governance owns the authority that makes published values binding, and can revoke it at any time. Neither side can move a pool parameter alone.
| Configuration | Published value |
|---|---|
RiskOracle, Router, registry owner | LlamaRisk Risk Oracle Admin safe |
| Registry updater | LlamaRisk Risk Oracle Admin safe |
| Router updater | LlamaRisk Risk Oracle Admin safe, limited to enabling, disabling and throttling existing routes |
| Router guardian, pause authority | Aave Protocol Guardian. Pause only; unpause is owner-only |
AgentHub owner | Aave Ethereum executor. Agent registration is governance-only |
| Agent administrator | Aave Protocol Guardian, so a misbehaving agent can be disabled without a governance cycle |
RISK_ADMIN grant | Aave ACLManager, granted by the AIP. This is the grant that makes an agent binding |
| Supported update types | PendleDiscountRateUpdate, EModeCategoryUpdate |
Validation ranges and delays
Bounds are enforced by the RangeValidationModule per injection, and are absolute rather than relative, applying symmetrically in both directions.
| Agent | Update type | Minimum delay | Expiration period | Maximum change per injection |
|---|---|---|---|---|
| Discount rate | PendleDiscountRateUpdate | 48 hours | 48 hours | ±100 bps |
| eMode | EModeCategoryUpdate | 72 hours | 72 hours | ±50 bps |
The eMode bound applies to EModeLTV, EModeLiquidationThreshold and EModeLiquidationBonus alike.
The Router applies its own per-route throttle in front of these, so a publication must satisfy both. The workflows read the active range configuration from the RangeValidationModule on every run rather than from committed configuration, so a bound changed on chain takes effect on the next run without a workflow redeployment.
Operations
| Resource | Link |
|---|---|
| Governance proposal | AIP 515 |
| Governance discussion | ARFC thread |
| Deployment transactions | Published after AIP execution |
| Verified source revisions | Published after AIP execution |
| Monitoring dashboard | To be published |
| Incident and operational contacts | To be published |