Put 10 ether into Aave and you get 10 aETH back. Put the same 10 ether into Compound v2 and you get 498.26 cETH. Both receipts earn interest, and both are redeemed for more ether than went in. The difference is where the interest shows up: in the number of tokens, or in what each token is worth. Both examples come from the UK tax authority, which uses them in its Cryptoassets Manual (CRYPTO61130) to show that two DeFi platforms can do the same job with two ways of counting.
Those receipts are called interest-bearing tokens. They are not one standard but three accounting designs, and each one behaves differently in a wallet, in a trading blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool, on a bridge and in a tax report. Below, each design is read from its contract code, with figures taken on Ethereum on 28 October 2026.
A short reminder first. A token is a smart contract that keeps a ledger of who owns how much; the lending, staking and vault protocols that issue receipts sit in the middle layers described in our guide to the DeFi stack, layer by layer. proof of stake coin with a protocol that stakes it for you and issues a transferable token (such as Lido stETH or rETH) representing the deposit plus rewards, which you can use or sell while the coins stay staked.">Liquid staking tokens such as Lido’s stETH are covered in the glossary entry on liquid staking.
Interest-bearing tokens are receipts, and there are three ways to keep the count
When you deposit an asset into a lending pool, a savings vault or a staking protocol, the contract keeps your asset and hands you a token that proves your claim. Interest accrues on the pool, not on your wallet. The receipt has to reflect that growth somehow, and the protocols have settled on three methods.
The first is the exchange-rate model. Your number of tokens never changes on its own; each token is a share of a pool, and the pool grows, so each share redeems for more of the underlying asset over time. Compound v2 cTokens, ERC-4626 vault shares such as sDAI, sUSDS and sUSDe, Lido’s wstETH and Rocket Pool’s rETH all work this way.
The second is the scaled balance. The contract stores a fixed internal number for you and multiplies it by an index that rises with interest. Your wallet shows the product, so the displayed balance climbs even though nothing is written to the chain. Aave v3 aTokens and the Compound III market token cUSDCv3 use it.
The third is rebasing by shares, the design of Lido’s stETH. You own a fixed number of internal shares; once a day an oracle report changes how much ether all shares together represent, and every holder’s balance is recalculated. From the wallet it looks like the scaled balance. Under the hood it is a different mechanism, with a daily step instead of a continuous index, and it can go down as well as up.
| Design | What changes over time | Examples |
|---|---|---|
| Exchange rate (value accrual) | The value of each token; the count stays fixed | cDAI (Compound v2), sDAI, sUSDS, sUSDe, wstETH, rETH, Aave v4 vault shares |
| Scaled balance times an index | The displayed balance, continuously | Aave v3 aTokens (aEthUSDC), Compound III cUSDCv3 |
| Rebasing by shares | The displayed balance, once per oracle report | Lido stETH |
The exchange-rate model: the token count stays put, the rate climbs
Compound v2 cTokens: the formula in the code
Compound v2 is where most DeFi users first met the exchange-rate model. In the CToken.sol contract, the rate is computed as the market’s cash plus the loans outstanding, minus the reserves the protocol keeps for itself, divided by the number of cTokens in circulation. A comment in the source spells it out: “exchangeRate = (totalCash + totalBorrows – totalReserves) / totalSupply”. When the first cToken is minted the contract uses a fixed initial rate instead.
Read the formula as a small fund. The cTokens are units of the fund. Borrowers pay interest, so total borrows grow, the numerator grows, and the number of units stays the same. Each cToken therefore redeems for a little more of the underlying asset every block in which interest accrues. In normal conditions the rate only rises; it would fall only if the market took a loss larger than its reserves, for instance bad debt from a liquidation that came too late.
HMRC’s example puts numbers on it. A user deposits 10 ether when the rate is 0.020070 ether per cETH and receives 498.26 cETH. Later the rate is 0.022371, and the same 498.26 cETH are redeemed for 11.15 ether. The extra 1.15 ether is the interest, and it never appeared as a separate payment. It was inside the rate all along. The figures are HMRC’s illustration, not market data.
A live check gives the same picture. On 28 October 2026 the cDAI contract on Ethereum returned an exchange rate of about 0.02507 DAI per cDAI, so one DAI bought roughly 39.9 cDAI. Compound v2 itself has become a small market: DefiLlama put its total value locked at 0.10 billion dollars that day, against 1.37 billion for Compound V3, which uses a different design described below.
ERC-4626 turned the share model into a standard
Every protocol that copied the cToken idea used to write its own functions, so each integration needed custom code. EIP-4626, “Tokenized Vaults”, created on 22 December 2021 and now final, fixed a common interface. A vault share must be an ERC-20 token. The vault declares its underlying asset with asset(), reports what it holds with totalAssets(), and converts between shares and assets with convertToShares and convertToAssets. Deposits and withdrawals go through deposit, mint, withdraw and redeem, each with a preview function that shows the result before you sign.
Two details from the standard matter to users. The conversion functions must round down, so the vault never hands out a fraction of a unit it does not hold; and the standard itself warns that the preview figures can be moved by on-chain conditions and are not always safe to use as a price.
sDAI, sUSDS and sUSDe read on 28 October 2026
Three large savings tokens answer to the ERC-4626 interface on Ethereum. sDAI and sUSDS hold DAI and USDS and earn the savings rates set by Sky; how those rates are set and what backs them is the subject of our lesson on yield-bearing stablecoins. sUSDe holds Ethena’s USDe and passes on the revenue explained in our lesson on Ethena’s USDe. Here only the accounting matters: all three keep your share count fixed and raise the rate.
| Token | Underlying | Assets per share | Assets in the vault |
|---|---|---|---|
| sDAI | DAI | 1.182282 | 163.37 million DAI |
| sUSDS | USDS | 1.114361 | 4.672 billion USDS |
| sUSDe | USDe | 1.255285 | 1.190 billion USDe |
Figures from convertToAssets and totalAssets, read on chain on 28 October 2026 at Ethereum block 26,290,415 (about 09:45 UTC). In practice, 100 sDAI redeemed that morning gave 118.23 DAI.
sUSDe adds two wrinkles. According to Ethena’s documentation, reward payments into the contract occur every 8 hours and vest linearly over the next 8 hours, so the rate rises smoothly instead of jumping, which removes the reward for anyone trying to deposit just before a payment and leave just after. And redeeming is not instant: the contract has a cooldown between the request and the release of USDe, which read 86,400 seconds, one day, on 28 October 2026. A vault share can be a perfect claim on paper and still take time to turn back into its asset.
Aave v4 moved its deposits to vault shares
Aave v4 went live on Ethereum on 30 March 2026, according to Aave’s announcement, with a design in which a central Liquidity Hub holds the assets and “Spokes” plug into it with their own risk rules. The token side of the deposit is handled by a contract called TokenizationSpoke, which the contract source describes as an “ERC4626 compliant wrapper to tokenize one listed asset of the connected Hub”. In other words, the newest Aave represents a deposit with the exchange-rate model, while Aave v3 keeps its aTokens. The old design still dominates: on 28 October 2026 DefiLlama counted 16.51 billion dollars in Aave V3 and 0.75 billion in Aave V4.
How an Aave aToken balance grows without a transaction
A scaled balance multiplied by the liquidity index
Open a wallet that holds aEthUSDC, the Aave v3 receipt for USDC on Ethereum, and refresh it a minute later: the balance has moved. No transfer arrived. The reason is in the AToken contract. The function balanceOf, which every wallet calls to show a balance, does not return a stored number. It takes the scaled balance stored for your address and multiplies it by the reserve’s normalised income, the liquidity index, a number that started at 1.0 when the reserve was created and only goes up.
When you deposit, the contract divides your amount by the current index and stores the result, rounded down. When you withdraw, it divides the amount by the index again and burns that many scaled units, rounded up. Both roundings favour the pool, by a fraction of the smallest unit. Aave’s documentation puts the outcome plainly: balanceOf “will always return the most up to date balance of the user”, principal and yield together.
Take the live figure. On 28 October 2026 the Aave v3 Ethereum pool returned an index of 1.19139 for USDC. Someone who had supplied 1,000 USDC when the index stood at 1.0 would now see 1,191.39 USDC. Someone depositing 1,000 USDC that day receives a scaled balance of about 839.35; if the index later reaches 1.2, the same stored number shows as about 1,007.22 USDC. The stored figure never changed. Only the multiplier did.
The index is not rewritten every second. It is updated, with interest compounded, each time someone supplies, borrows, repays or withdraws in that reserve. Between two updates the contract extrapolates it in a straight line: the current supply rate times the seconds elapsed, divided by the seconds in a year, applied to the last stored index. That is why the balance seems to tick continuously in a wallet while the chain only records a new index when the reserve is touched.
Why the wallet moves and the block explorer stays quiet
Because balanceOf is a read-only function recomputed on every call, accruing interest writes nothing on chain. There is no Transfer event, so a block explorer’s token history shows your deposit, your withdrawal and any transfer, and nothing in between. Wallet apps and portfolio trackers that rebuild your balance from transfer events will undercount; those that call the contract will be right. If two tools disagree about an aToken balance, the contract’s own read function is the referee.
Transfers have a quirk of their own. Moving an aToken moves a scaled amount, computed with the index at that moment, so the recipient’s displayed balance can differ from what you typed by a unit or two of the smallest denomination. Apps usually offer a “max” option for full withdrawals precisely to avoid leaving dust behind.
Compound III: the c in cUSDCv3 does not mean cToken
The name misleads. Compound III, also called Comet, issues no cToken at all. The USDC market on Ethereum is itself an ERC-20 contract with the symbol cUSDCv3, and its balanceOf function returns your stored principal times a base supply index brought up to date, divided by a scaling constant. That is the Aave method, not the Compound v2 method. Same letter c, different accounting: a cUSDCv3 balance grows in your wallet, a cDAI balance does not.
Read the rate yourself in a few clicks
You can check every figure in this lesson without a wallet, without gas and without signing anything. Etherscan’s “Read Contract” tab calls the view functions directly. Never paste a seed phrase or connect a wallet to do this; reading is public.
- Open the wstETH contract (0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0) on etherscan.io, go to Contract, then Read Contract, and click
stEthPerToken. The answer has 18 decimals: 1247327196… means 1.2473 stETH per wstETH. - Open sDAI (0x83F20F44975D03b1b09e64809B757c47f942BEeA), find
convertToAssets, enter 1000000000000000000 (one token with 18 decimals) and query. The result is the DAI value of one sDAI. - Open the Aave v3 Pool (0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2). If the Read tab sends you to an implementation contract, use “Read as Proxy”. Call
getReserveNormalizedIncomewith the USDC address (0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48). The answer has 27 decimals: divide by 10 to the 27th to get the index. - Repeat a week later and compare. The growth between your two readings is the yield earned in that week, before any fees taken elsewhere.
Rebasing against value accrual: stETH, wstETH and rETH side by side
stETH: shares, a daily oracle report, and balances that can fall
Lido‘s stETH is the best-known rebasing token. According to the Lido tokens integration guide, the contract does not store balances. It stores shares. Your balance is your shares multiplied by the total ether pooled by Lido, divided by the total number of shares. Once a day, oracles report the balance of Lido’s validators on the consensus layer, the pooled total changes, and every holder’s balance is recalculated at once.
The guide describes the safeguards. Nine oracle daemons run by node operators chosen by the DAO report independently, and a report takes effect once five of the nine agree. Sanity checks cap the reported annual rate at 27% and refuse a drop in staked ether of more than 5%. If the oracles do not reach a quorum, no rebase happens that day, and the next successful report catches up.
Two consequences surprise newcomers. A rebase can be negative: if validators are slashed or penalised, balances shrink, although Lido notes that daily rebases had never been negative when its guide was written. And stETH emits no Transfer event on a rebase, which the guide itself flags as a departure from strict ERC-20 behaviour. The guide also warns that transfers can move 1 or 2 wei less than requested, because the share arithmetic involves integer division.
The size of a daily step is small. Lido’s API gave a 7-day moving average APR of 2.32% on 28 October 2026 (last data point 27 October, 12:22 UTC). At that rate, a holder of 10 stETH sees the balance rise by about 0.00064 stETH a day. Lido’s TVL stood at 23.08 billion dollars on DefiLlama the same day.
wstETH: the same stake in a wrapper that keeps still
wstETH is stETH wrapped into the exchange-rate model. One wstETH represents one fixed unit of Lido shares, so its count never moves; the stETH it can be unwrapped into grows with each rebase. On 28 October 2026 the contract’s stEthPerToken returned 1.2473, which is exactly the ratio of Lido’s pooled ether (9,687,874 stETH) to its total shares (7,766,907). Unwrap 1 wstETH that day and you get 1.2473 stETH.
Wrapping is popular. With 3,693,376 wstETH in circulation at that rate, about 47.6% of all stETH sat inside the wrapper on 28 October 2026, by our calculation from the two contracts. Lending markets prefer it: Lido’s guide notes that Aave v3 and v4 take wstETH as collateral, while Aave v2 had needed a custom contract to handle stETH.
rETH: an exchange rate from the start
Rocket Pool did not need a wrapper. Its rETH token was built on the exchange-rate model: in the RocketTokenRETH contract, the ether value of an amount of rETH is that amount times the network’s total ether balance, divided by the rETH supply. Both totals come from balances reported by the Rocket Pool network, not from a market price. The rate moves periodically, as the network reports its balances, while the count in your wallet stays the same; the contract returned 1.1746 ether per rETH on 28 October 2026.
Which design suits which use
| Question | Exchange rate (wstETH, rETH, sDAI, cDAI) | Scaled balance (aTokens, cUSDCv3) | Rebasing by shares (stETH) |
|---|---|---|---|
| Wallet balance | Fixed | Rises continuously | Changes once a day, up or down |
| Value per token | Rises | Stays near 1 underlying | Stays near 1 ether |
| Transfer events for yield | None needed | None | None |
| Simple DEX pools | Work | Rewards leak | Rewards leak |
| Generic bridges | Work | Usually unsupported | Usually unsupported |
| Lending collateral | Priced as rate times underlying | Rarely used outside its own protocol | Usually wrapped first |
The rows on pools and bridges follow from the code and from the protocols’ own documentation, discussed next. “Rewards leak” means the yield goes somewhere other than to the liquidity provider who owns it.
What the design changes for pools, bridges and lending markets
DEX pools: a rebase that lands in the wrong pocket
A classic constant-product pool records its reserves as numbers in storage and compares them with the tokens it actually holds. Uniswap v2’s pair contract has two functions for the gap: skim sends any tokens above the recorded reserves to whoever calls it, and sync folds them into the reserves. When a rebasing token held by the pool grows, the excess goes either to the first person who calls skim or, at the next sync, into the pool’s price. Either way the liquidity providers do not receive their staking rewards as a separate, owned amount.
Lido says as much. Its guide states that Maker, Uniswap and SushiSwap “are not designed for rebasable tokens” and that listing stETH on them can cost holders their daily rewards. Its own list of pools reflects the rule: a stETH/ETH pool on Curve, built to handle stETH, and wstETH/ETH pools on Uniswap V3 and Balancer v2. Lido built wstETH largely to fill that gap.
Bridges: rewards that end up locked
Bridges usually lock a token on one chain and mint a copy on another, a mechanism explained in our lesson on bridges, cross-chain liquidity and intents. The locked balance on the source chain is supposed to equal the copies in circulation. A rebasing token breaks that equality every day.
The protocols’ own documents agree. Lido’s guide says “most cross-chain token bridges have no mechanics to handle rebases” and that the rewards, in the common case, become locked in the bridge contract. The Optimism Standard Bridge documentation says the bridge does not support rebasing tokens “because they can cause bridge accounting errors”. Arbitrum’s token bridge page asks issuers of interest-bearing tokens to make sure the interest does not “simply accrue to the bridge contracts”. Lido’s answer is to bridge wstETH, whose count does not change, and to send its exchange rate to the other chain; on most networks the bridged wstETH cannot be unwrapped locally.
Collateral: pricing a share is an oracle problem
A lending market that accepts wstETH or a vault share as collateral needs a price for it, and it usually builds one by multiplying the token’s exchange rate by the price of the underlying asset. Our previous lesson on advanced DeFi oracles covers price feeds in general. Exchange-rate tokens add two failure modes of their own, and both have happened.
The first is a rate that is capped too tightly. Aave uses a Correlated Asset Price Oracle, CAPO, that limits how fast a token’s exchange rate may rise, as a defence against manipulation. On 10 March 2026, according to The Block relaying Chaos Labs, the CAPO settings on Aave’s Ethereum Core and Prime markets used a wstETH rate of about 1.1939 while the market rate was about 1.228, a 2.85% understatement. About 10,938 wstETH, roughly 26 million dollars, were liquidated across about 34 accounts, liquidators earned about 499 ether, and there was no bad debt. The cause given: a snapshot ratio and timestamp had fallen out of line because an off-chain process ignored an on-chain limit of 3% every three days. Chaos Labs said the episode “did not reflect a flaw in the underlying CAPO or offchain risk oracle design”. Compensation was to come from 141.5 ether recovered plus up to 345 ether from the Aave DAO treasury.
The second is a rate that can be pushed up. On 27 February 2025, on zkSync, an attacker used about 4 million dollars borrowed through an Aave flash loan to inflate the exchange rate of wUSDM, Mountain Protocol’s ERC-4626 wrapper, from 1.06 to 1.7 by donating assets to the vault, then exploited the inflated collateral on Venus Protocol. The Block’s account of the Chaos Labs post-mortem puts Venus’s net loss at over 716,000 dollars and the attacker’s profit at about 200,000, and quotes the conclusion that ERC-4626 “does not include safeguards against manipulated exchange rates when used in lending protocols”. The lesson for integrators is the one EIP-4626 already wrote down: a vault’s spot rate is a display figure, not a safe price without a cap or a delay. How lending markets set those limits, and how liquidations work, comes in a later lesson.
Taxes on interest-bearing tokens: what HMRC and the IRS say, and what they leave open
No tax authority we checked has published rules on interest-bearing tokens as such: none addresses rebases, scaled balances or wrapping by name. What exists are general rules that may apply, and the UK is the only one that uses aTokens and cTokens as examples. None of what follows is tax advice; the figures that matter for your return are the rate and the dollar or sterling value at each deposit, wrap, unwrap and withdrawal, so keep them.
United Kingdom. HMRC’s Cryptoassets Manual uses the 10 aETH and 498.26 cETH examples from the start of this lesson and says the return “may be treated as taxable income”, depending on the terms of the platform. For capital gains, CRYPTO61620 says that if the depositor gives up beneficial ownership, receiving a liquidity token is a disposal: “This is an exchange of one token for another token.” A policy paper of 13 July 2026 announces that from 6 April 2027 certain lending and liquidity-pool arrangements become “no gain, no loss” for individuals and trustees. It does not cover receipt tokens of every kind, liquid staking or wrapping by name, and until then the manual’s existing rules apply. Our guide to crypto taxes in the United Kingdom has the general rules.
United States. The IRS’s Revenue Ruling 2023-14 holds that a cash-method taxpayer who stakes a proof-of-stake cryptocurrency includes the fair market value of validation rewards in gross income in the year the taxpayer gains “dominion and control” over them. The ruling does not mention liquid staking tokens, wrapped tokens, lending or DeFi, and we found no IRS guidance on aTokens, rebases or wrapping. Whether a stETH rebase, an aToken balance that grows by the second, or a rising wstETH rate is income when it accrues or only when you sell is a question the IRS has not answered for these designs. Our guide to crypto taxes in the United States covers the settled parts.
Tax software has to pick an interpretation anyway, and different tools tag the same rebase as a reward, as interest or as nothing. That is a software choice, not law. Wrapping stETH into wstETH, or swapping USDC for aUSDC by depositing, may also be treated as a disposal in one jurisdiction and ignored in another.
Five checks before you hold an interest-bearing token
- Find out which of the three designs you hold. A fixed count with a rising rate, a balance that ticks up continuously, or a balance that steps once a day: the token’s documentation or its
balanceOfcode tells you. - Measure yield in the underlying asset, not in token units. For wstETH, rETH or sDAI, compare the rate at two dates; for aTokens and stETH, compare the balance, then subtract any deposits you made.
- Check that every app on your path supports the design: the wallet or tracker, the pool you want to add liquidity to, the bridge, the lending market. If one of them is not built for rebasing tokens, use the wrapped version.
- Ask where a lending market gets its price for the token and whether the exchange rate is capped or delayed. A cap that lags, or none at all, has already cost users money.
- Know your exit before you enter: an instant redemption, a cooldown such as sUSDe’s one day on 28 October 2026, a withdrawal queue, or a sale on a market at whatever discount the market offers that day.
With these designs in hand, the next lesson of the path turns to the protocols that issue most of these receipts: how crypto lending and borrowing work, how interest rates follow pool utilisation, and what happens when collateral falls.
