GHO

Proposal 268 executed on 15 July 2023. It enrolled Aave V3 Ethereum and FlashMinter as the first facilitators, with initial buckets of 100 million and 2 million GHO. The former let borrowers create GHO against Aave collateral; the latter minted and repaid within one transaction for arbitrage and liquidations.

The launch design separated token code from credit permission. A facilitator could mint and burn only within its bucket; Governance could choose facilitators and capacity. The initial 1.5% rate and 30% stkAAVE discount were parameters, not permanent holder promises.

An integration fault soon tested the distinction. Aave Guardian paused the GHO reserve on 25 August 2023 at 1:37:35 CET. Aave Companies investigated and coordinated remediation with BGD Labs and Certora; AIP 308 was created on 27 August and executed on 1 September. The episode showed why permission paths matter even when the token contract itself is not upgradeable.

Aave’s interface says a borrower supplies eligible collateral, borrows GHO, then repays principal and accrued interest. Falling health can lead to collateral liquidation under the market’s rules. The user’s debt is therefore distinct from the GHO later circulating in someone else’s wallet.

The interest has an explicit destination: the Aave DAO treasury. At launch it was collected through GHO-specific debt machinery; V3.4 aligned GHO with ordinary reserve accounting so interest accrues to the treasury as aTokens and a Direct Minter supplies inventory. The old stkAAVE discount path was removed.

Treasury revenue does not turn every GHO into a revenue share. An ordinary holder can transfer or use the token, but reviewed records do not grant AAVE voting power, pro-rata Collector assets, borrower collateral, equity or a claim on interest.

The Stability Module offers a second route. A user exchanges GHO and an approved stablecoin under a price strategy, fee schedule and exposure cap. Its original fixed 1:1 reference creates an arbitrage band; capacity, fees and freeze state mean it is not an unconditional promise to hand over one bank dollar.

GSM architecture kept evolving. Yield-bearing stataGSMs put underlying stablecoins into Aave markets, and 2026 RemoteGSM separated a GhoDirectFacilitator, GhoReserve and multiple capped GSMs. The reserve holds pre-minted inventory; modules draw and return it rather than each acting as an independent minter.

Control follows the modules. Governance can upgrade GSM proxies and change their strategy; a GHO GSM Steward adjusts bounded fees and exposure; oracle swap freezers and the Executor can stop swaps. These powers can contain a bad reference asset, but they also create liveness and administrator dependencies.

GHO expanded from Ethereum through Chainlink CCIP. Ethereum-to-L2 accounting locks tokens on Ethereum and mints corresponding supply remotely; supported non-Ethereum routes can burn and mint. Governance enables lanes and networks, while bridge limits and rate limits can be stewarded.

The current Ethereum permission inventory draws a sharp line. GHO itself is non-upgradeable, facilitators alone call mint and burn, the Level 1 Executor controls facilitator membership, and Governance plus the Bucket Steward control capacity. Direct Minter and GSM proxies remain upgradeable; a 2-of-3 Gho Risk Council operates bounded steward functions.

This is why “DAO-controlled” needs a wiring diagram. AAVE-family voting authorizes governance, executors perform approved changes, councils tune bounded parameters, oracle roles freeze selected swaps, and CCIP carries messages. A GHO holder sits at the end of those systems with a transferable token, not a ballot or an issuer redemption certificate.