Security & Audits
Security is our top priority. USX.Capital implements four independent security layers: professional audits, formal verification, emergency controls, and insurance reserves.
Professional Security Audits
Private Transfer With USX Audit
Auditor: Zellic
Date: March 18, 2026
Result: Six findings identified with critical and high severity issues fixed before deployment
Summary: Zellic reviewed the smart contracts for the Private Transfer With USX feature, covering encrypted recipient routing, cross-domain confirmation, and liquidity rebalancing.
Six findings were identified:
1 critical
1 high
4 medium
The critical and high issues were fixed before deployment. Two of the four medium findings were also fully remediated.
The remaining two medium findings are being actively addressed:
Receiver verification: The withdrawal function is controlled by a multisig, so funds cannot be redirected without multisig approval even if the backend were compromised. Full onchain receiver verification is planned for a later release.
Test coverage: The team is continuously expanding the test suite with integration tests for cross-chain flows. This is an ongoing effort, not a one-time fix.
Mainnet Smart Contract Audit
Auditor: Zellic
Date: October 2, 2025
Result: No critical or high-severity vulnerabilities identified
The audit covered all mainnet smart contracts responsible for minting, redemption, collateral management, and yield distribution. All low and informational issues identified were thoroughly reviewed and remediated during the audit process before mainnet deployment.
Pre-Deposit Contract Audit
Auditor: Zellic
Date: October 2, 2025
Result: No critical, high, medium, or low-severity vulnerabilities
During the audit of pre-deposit contracts, Zellic identified one informational-level issue. No functional vulnerabilities were reported, and the issue was addressed before deployment.
Blend Protocol Audits
Auditor: Multiple firms
Audits Completed: 8 independent audits
Result: No critical, high, medium, or low-severity issues found
Blend (the yield infrastructure layer used by USX) has undergone 8 independent security audits by leading blockchain security firms. Find their complete audit reports here: https://docs.blend.money/resources/audits
Additional Security Features
Formal Verification
Critical protocol components undergo formal verification.
Emergency Pause Function
A dedicated pause mechanism stops all fund movement if a security threat is detected. This allows the team to:
Halt minting and redemptions
Pause yield distributions
Prevent further damage while investigating issues
Dedicated Insurance Fund
5% of all generated protocol yield is pooled into an onchain insurance fund. This reserve:
Covers emergency scenarios
Protects sUSX holders from losses
Strengthens long-term protocol stability
Common Questions
Q: What does it mean when auditors find critical or high severity issues?
A: It means the audit did its job. Critical and high severity findings are serious, but finding them before deployment is exactly the point of an audit. In the Private Transfer audit, both were identified and fixed before the feature went live.
Q: Are audits a guarantee of safety?
A: Audits significantly reduce risk but don't guarantee zero exploits. They're point-in-time reviews. USX adds formal verification, pause mechanisms, and insurance for additional protection.
Q: Can I see the full audit reports?
A: Yes. Zellic audit summaries are available above. Blend's complete reports are published at docs.blend.money.
For a complete risk analysis, see Core Protocol Risks and External & Operational Risks.
Last updated