> For the complete documentation index, see [llms.txt](https://docs.usx.capital/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.usx.capital/resources/security-and-audits.md). # Security & Audits Security is our top priority. USX.Capital implements four independent security layers: professional audits, formal verification, emergency controls, and insurance reserves. ### Professional Security Audits #### **Private Transfer With USX Audit** **Auditor:** [Zellic](https://zellic.io/) **Date:** March 18, 2026 **Result:** Six findings identified with critical and high severity issues fixed before deployment **Summary:** Zellic reviewed the smart contracts for the Private Transfer With USX feature, covering encrypted recipient routing, cross-domain confirmation, and liquidity rebalancing. Six findings were identified: * 1 critical * 1 high * 4 medium **The critical and high issues were fixed before deployment**. Two of the four medium findings were also fully remediated. The remaining two medium findings are being actively addressed: **Receiver verification:** The withdrawal function is controlled by a multisig, so funds cannot be redirected without multisig approval even if the backend were compromised. Full onchain receiver verification is planned for a later release. **Test coverage:** The team is continuously expanding the test suite with integration tests for cross-chain flows. This is an ongoing effort, not a one-time fix. {% file src="/files/N5VsS9zna1HwMoz3hrC8" %} #### Mainnet Smart Contract Audit **Auditor:** [Zellic](https://zellic.io/) **Date:** October 2, 2025 **Result:** No critical or high-severity vulnerabilities identified The audit covered all mainnet smart contracts responsible for minting, redemption, collateral management, and yield distribution. All low and informational issues identified were thoroughly reviewed and remediated during the audit process before mainnet deployment. {% file src="/files/jA9DuEgS96USEWBmRmXI" %} #### Pre-Deposit Contract Audit **Auditor:** [Zellic](https://zellic.io/) **Date:** October 2, 2025 **Result:** No critical, high, medium, or low-severity vulnerabilities During the audit of pre-deposit contracts, Zellic identified one informational-level issue. No functional vulnerabilities were reported, and the issue was addressed before deployment. {% file src="/files/bbyq4WUn4lzdBggUOTAb" %} #### Blend Protocol Audits **Auditor:** Multiple firms **Audits Completed:** 8 independent audits **Result:** No critical, high, medium, or low-severity issues found Blend (the yield infrastructure layer used by USX) has undergone 8 independent security audits by leading blockchain security firms. Find their complete audit reports here: *** ### Additional Security Features #### Formal Verification Critical protocol components undergo formal verification. #### Emergency Pause Function A dedicated pause mechanism stops all fund movement if a security threat is detected. This allows the team to: * Halt minting and redemptions * Pause yield distributions * Prevent further damage while investigating issues #### Dedicated Insurance Fund 5% of all generated protocol yield is pooled into an onchain insurance fund. This reserve: * Covers emergency scenarios * Protects sUSX holders from losses * Strengthens long-term protocol stability *** ### Common Questions **Q: What does it mean when auditors find critical or high severity issues?** A: It means the audit did its job. Critical and high severity findings are serious, but finding them before deployment is exactly the point of an audit. In the Private Transfer audit, both were identified and fixed before the feature went live. **Q: Are audits a guarantee of safety?** A: Audits significantly reduce risk but don't guarantee zero exploits. They're point-in-time reviews. USX adds formal verification, pause mechanisms, and insurance for additional protection. **Q: Can I see the full audit reports?** A: Yes. Zellic audit summaries are available above. Blend's complete reports are published at [docs.blend.money](https://docs.blend.money/resources/audits). For a complete risk analysis, see [Core Protocol Risks](https://docs.usx.capital/risks/core-protocol-risks) and [External & Operational Risks](https://docs.usx.capital/risks/external-and-operational-risk). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.usx.capital/resources/security-and-audits.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.