MetaMask USD (MUSD)

MetaMask USD: a wallet-native stablecoin built on M0

MetaMask USD, or mUSD, is a dollar-denominated token issued through Bridge and implemented with M0’s extension framework. Its practical value depends less on token speculation than on reserve access, approved conversion routes, MetaMask distribution, and the administrators controlling its smart contracts.

What mUSD is designed to do

MetaMask USD is a stablecoin intended to keep a value close to one U.S. dollar while serving as a native balance inside MetaMask. MetaMask announced the asset on August 21, 2025, describing it as a wallet-integrated token for on-ramps, swaps, transfers, bridging, decentralized finance, and later card payments. The announcement identifies Bridge, a Stripe company, as the issuer and M0 as the on-chain infrastructure provider. These are project descriptions of the product model; they do not by themselves establish reserve quality, redemption performance, or broad adoption.

For users, the main distinction is distribution rather than a novel payment unit. MetaMask presents mUSD as an asset that can be bought through integrated payment providers or obtained by swapping other tokens, with availability and payment methods varying by region. The token is therefore aimed at MetaMask users who want a dollar-denominated balance without first moving funds to a separate exchange. The practical experience still depends on the wallet interface, third-party on-ramp providers, network fees, and the liquidity available on the selected chain.

How the M0 architecture works

The published mUSD repository describes the token as an M0 extension derived from MYieldToOne. In this design, mUSD is a non-rebasing ERC-20 representation associated with the underlying M token, while yield from the underlying system is directed to a single configurable yield recipient rather than distributed by changing each holder’s token balance. This makes the asset easier to use in ordinary DeFi contracts than a rebasing token, but it also means that the holder’s return profile and the system’s economics depend on components outside the basic ERC-20 transfer function.

M0’s SwapFacility is described as the exclusive router for wrapping and unwrapping operations. Approved users can deposit M and receive mUSD, or return mUSD through the facility to obtain M, subject to the framework’s permissions and configuration. The Diligence review explains the same lifecycle and notes that approved swappers can increase or reduce mUSD supply through these operations. This is not an algorithmic free-floating stablecoin mechanism: the token’s operation relies on the M0 framework, approved conversion actors, the underlying real-world-asset structure, and the issuer’s operational processes.

The token’s role on Ethereum and Linea

MetaMask initially announced mUSD for Ethereum and Linea, positioning it as a settlement and liquidity asset for Linea’s DeFi ecosystem. The official contract repository lists the same mUSD proxy address, 0xacA92e438df0B2401fF60dA7E4337B687a2435DA, in its deployment table for Ethereum and Linea, while showing different implementation addresses by network. That arrangement is a useful operational detail: users should verify both the network and the contract address before transferring funds, because a token name and ticker alone are not sufficient identification.

The intended users include MetaMask customers moving between fiat on-ramps, wallets, DeFi applications, and payment products. MetaMask’s documentation also identifies mUSD as the token used by its Money Account and as an asset that can fund MetaMask Card, although access to those products may depend on jurisdiction, account configuration, supported networks, and changing product rules. The asset’s usefulness therefore depends on integration decisions made by MetaMask and external protocols rather than on the token contract alone.

Control, upgrades, and compliance functions

mUSD is not governed solely by permissionless token holders. The published contract materials describe an upgradeable proxy and administrative roles covering pausing, account freezing, forced transfers, yield-recipient management, and other configuration tasks. The Diligence report says the default administrator can change privileged roles, while the proxy administrator can upgrade the implementation. A freeze manager can disable activity for selected accounts, and a forced-transfer manager can move assets from frozen accounts. These controls may be useful for compliance or incident response, but they introduce material reliance on key management and administrator conduct.

The August 2025 Diligence assessment reported no significant security vulnerabilities in the reviewed mUSD contract and said minor or informational findings were fixed or acknowledged. The report also makes clear that its scope covered the mUSD token contract, not the full M0 framework or every off-chain reserve and operational process. An audit is evidence about the reviewed code and test period; it is not a guarantee against later upgrades, compromised privileged keys, reserve problems, bridge or provider failures, or mistakes elsewhere in the system.

What users still need to verify

MetaMask describes mUSD as backed one-for-one by dollar assets and its newer product material refers to short-term U.S. Treasury bills held through regulated custody. The independent audit, however, emphasizes that the value behind mUSD is exposed to off-chain real-world assets and that the broader M0 framework was outside the audit scope. Users should therefore distinguish a stated reserve policy from independently verified, current evidence about assets, liabilities, redemption rights, custody arrangements, and the entities responsible for each step.

The central practical question is not whether mUSD resembles a dollar on ordinary days, but how the system behaves under stress. A pause can stop regular transfers and conversion activity; a frozen account may require administrator action; and the ability to upgrade the token means the future rules are not fixed permanently by the deployed code. Network support, liquidity, payment-provider access, and regional eligibility can also change independently of the ticker. mUSD is best understood as a wallet-distributed stablecoin with significant issuer, infrastructure, reserve, and administrator dependencies.

Key takeaways

• mUSD is a wallet-native stablecoin issued through Bridge and implemented with M0 infrastructure.
• Its architecture wraps or represents the M0 M token through an M0 extension and SwapFacility rather than operating as an independent governance token.
• MetaMask initially launched mUSD on Ethereum and Linea, with utility tied to wallet integrations, DeFi liquidity, on-ramps, and payment products.
• The contract includes pause, freeze, forced-transfer, yield-recipient, and upgrade controls, creating meaningful administrator and key-management dependencies.
• The published audit found no significant vulnerabilities in the reviewed mUSD contract, but it did not cover the full M0 framework or off-chain reserve operations.

Risks and open questions

• Reserve exposure is partly off-chain, so users must rely on the issuer, Bridge, M0 infrastructure, custody arrangements, and redemption processes.
• Privileged administrators can pause activity, freeze accounts, force transfers from frozen accounts, alter roles, or upgrade the token implementation.
• The Diligence review did not cover the complete M0 framework, all operational dependencies, or the full reserve and redemption process.
• Liquidity and usability depend on MetaMask integrations, approved swappers, DeFi venues, payment providers, supported networks, and regional eligibility.
• Users can receive an impostor token if they verify only the name or ticker instead of the network and official contract address.