Is Pando Leaf Safe?
Risk Grade: C (50/100)
Pando Leaf is rated as elevated risk — multiple novel mechanisms and notable interaction risks.
Elevated risk — major infrastructure exploit in 2023 with incomplete recovery, combined with non-standard custody and oracle mechanisms that concentrate trust in a small node set.
Pando Leaf is a CDP (Collateralized Debt Position) protocol on the Mixin Network that lets users mint pUSD stablecoins by depositing cryptocurrency collateral like BTC and ETH. Inspired by MakerDAO, it uses a unique Mixin Trusted Group (MTG) multi-signature system instead of traditional smart contracts. With approximately $14M in TVL, Pando Leaf was significantly impacted by the September 2023 Mixin Network hack that resulted in ~$200M in total losses across the ecosystem, with Pando Leaf losing 70% of its ETH and 90% of its USDT collateral. The C grade reflects the combination of this major security incident, non-standard oracle infrastructure, and the custodial trust assumptions inherent in the MTG model.
TVL
$14M
Mechanisms
6
Interactions
5
Value Grade
D
Key Risks for Pando Leaf Users
Mixin Network infrastructure risk: The September 2023 hack proved that Pando Leaf's underlying infrastructure can be compromised, with users only receiving 50% reimbursement for losses — this exact scenario has already occurred
Non-standard security model: Unlike most DeFi protocols that use transparent smart contracts, Pando Leaf relies on a small group of MTG nodes for custody and execution, requiring users to trust this node set rather than verifiable code
Oracle centralization: Price feeds come through MTG node consensus rather than established oracle networks, creating potential for delayed or inaccurate pricing during volatile markets
Limited ecosystem liquidity: Operating exclusively on Mixin Network means limited secondary market depth for pUSD and restricted exit options during stress events
Top Risk Factors
- •Mixin Network infrastructure dependency — the September 2023 hack resulted in ~$200M in losses across the Mixin ecosystem, with Pando Leaf losing 70% of ETH and 90% of USDT collateral
- •Non-standard oracle mechanism — relies on MTG (Mixin Trusted Group) node consensus for price feeds rather than established oracle networks like Chainlink
- •Custodial trust assumptions — MTG multi-signature model requires trusting a small set of nodes rather than decentralized smart contract execution
Risk Score Breakdown
Pando Leaf's highest risk area is Track Record (15/15). Here's how each dimension contributes to the overall 50/100 score:
Read the Full Pando Leaf Risk Report
This protocol has 2 collapse scenarios. 1 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Considering an investment?