> For the complete documentation index, see [llms.txt](https://docs.usx.capital/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.usx.capital/resources/security-and-audits.md). # Security & Audits Security is our top priority. USX.Capital implements four independent security layers: professional audits, formal verification, emergency controls, and insurance reserves. ### Professional Security Audits #### **Private Transfer With USX Audit** **Auditor:** [Zellic](https://zellic.io/) **Date:** March 18, 2026 **Result:** Six findings identified with critical and high severity issues fixed before deployment **Summary:** Zellic reviewed the smart contracts for the Private Transfer With USX feature, covering encrypted recipient routing, cross-domain confirmation, and liquidity rebalancing. Six findings were identified: * 1 critical * 1 high * 4 medium **The critical and high issues were fixed before deployment**. Two of the four medium findings were also fully remediated. The remaining two medium findings are being actively addressed: **Receiver verification:** The withdrawal function is controlled by a multisig, so funds cannot be redirected without multisig approval even if the backend were compromised. Full onchain receiver verification is planned for a later release. **Test coverage:** The team is continuously expanding the test suite with integration tests for cross-chain flows. This is an ongoing effort, not a one-time fix. {% file src="/files/N5VsS9zna1HwMoz3hrC8" %} #### Mainnet Smart Contract Audit **Auditor:** [Zellic](https://zellic.io/) **Date:** October 2, 2025 **Result:** No critical or high-severity vulnerabilities identified The audit covered all mainnet smart contracts responsible for minting, redemption, collateral management, and yield distribution. All low and informational issues identified were thoroughly reviewed and remediated during the audit process before mainnet deployment. {% file src="/files/jA9DuEgS96USEWBmRmXI" %} #### Pre-Deposit Contract Audit **Auditor:** [Zellic](https://zellic.io/) **Date:** October 2, 2025 **Result:** No critical, high, medium, or low-severity vulnerabilities During the audit of pre-deposit contracts, Zellic identified one informational-level issue. No functional vulnerabilities were reported, and the issue was addressed before deployment. {% file src="/files/bbyq4WUn4lzdBggUOTAb" %} #### Blend Protocol Audits **Auditor:** Multiple firms **Audits Completed:** 8 independent audits **Result:** No critical, high, medium, or low-severity issues found Blend (the yield infrastructure layer used by USX) has undergone 8 independent security audits by leading blockchain security firms. Find their complete audit reports here: *** ### Additional Security Features #### Formal Verification Critical protocol components undergo formal verification. #### Emergency Pause Function A dedicated pause mechanism stops all fund movement if a security threat is detected. This allows the team to: * Halt minting and redemptions * Pause yield distributions * Prevent further damage while investigating issues #### Dedicated Insurance Fund 5% of all generated protocol yield is pooled into an onchain insurance fund. This reserve: * Covers emergency scenarios * Protects sUSX holders from losses * Strengthens long-term protocol stability *** ### Common Questions **Q: What does it mean when auditors find critical or high severity issues?** A: It means the audit did its job. Critical and high severity findings are serious, but finding them before deployment is exactly the point of an audit. In the Private Transfer audit, both were identified and fixed before the feature went live. **Q: Are audits a guarantee of safety?** A: Audits significantly reduce risk but don't guarantee zero exploits. They're point-in-time reviews. USX adds formal verification, pause mechanisms, and insurance for additional protection. **Q: Can I see the full audit reports?** A: Yes. Zellic audit summaries are available above. Blend's complete reports are published at [docs.blend.money](https://docs.blend.money/resources/audits). For a complete risk analysis, see [Core Protocol Risks](https://docs.usx.capital/risks/core-protocol-risks) and [External & Operational Risks](https://docs.usx.capital/risks/external-and-operational-risk). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.usx.capital/resources/security-and-audits.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.