{"investigation":{"slug":"sovryn","entity_name":"Sovryn","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Sovryn is a Bitcoin-backed decentralized finance protocol built on the Rootstock (RSK) sidechain, offering lending, borrowing, margin trading, and AMM services with its native SOV governance token. The protocol suffered a confirmed $1.1 million price manipulation exploit in October 2022 targeting its legacy lending pools, with approximately half of funds recovered via developer intervention. A separate critical smart contract vulnerability was disclosed via bug bounty in March 2021 but was not exploited. ZachXBT has flagged the entity; no detailed public post from ZachXBT specifically detailing Sovryn allegations was independently located at time of investigation.","sections":[{"content":"Sovryn launched in December 2020 as a non-custodial, permissionless DeFi platform built on RSK (Rootstock), a Bitcoin-merge-mined sidechain with EVM compatibility. The protocol provides Bitcoin-denominated lending, borrowing, margin trading, and automated market maker (AMM) functionality. Core contributors include Edan Yago, who serves as project lead and public spokesperson. Sovryn raised $2.1 million in an oversubscribed seed round led by Greenfield One with participation from Collider Ventures and Monday Capital. A subsequent $10 million funding round was reported in March 2021, with discussions involving investor Anthony Pompliano ('Pomp'). The SOV governance token has a maximum supply of 100 million tokens; founder and early-founder allocations totaling approximately 39.5 million SOV were subject to vesting schedules of 10 to 36 months. As of 2025-2026, the protocol remains active, with TVL reported at approximately $44.7 million on Rootstock in Q4 2025, though this represented a 33.9% quarter-over-quarter decline.","heading":"Protocol Overview","sources":[{"url":"https://www.coindesk.com/tech/2020/12/15/defi-on-bitcoin-gets-a-boost-as-sovryn-launches-on-rsk-sidechain","name":"coindesk.com","type":"other","credibility":3},{"url":"https://sovryn.com/all-things-sovryn/sovryn-raises-10m-offers-1-2m-bug-bounty","name":"sovryn.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2021/03/24/bitcoin-based-defi-project-sovryn-near-agreement-on-10m-investment-from-pomp","name":"coindesk.com","type":"other","credibility":3},{"url":"https://wiki.sovryn.com/en/technical-documents/tokenomics","name":"wiki.sovryn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 4, 2022, an attacker exploited a vulnerability in Sovryn's legacy Lend/Borrow protocol, draining 44.93 RBTC and 211,045 USDT — a total value exceeding $1.1 million at the time of the attack. The exploit targeted the iToken price calculation mechanism in the RBTC and USDT lending pools. iTokens are interest-bearing tokens representing a depositor's share of a lending pool; their price updates with each pool interaction, creating an attack surface for flash loan-based manipulation. The attacker executed a multi-step sequence: purchasing WRBTC (Wrapped RBTC) via a flash swap on RskSwap, borrowing additional WRBTC from Sovryn's lending contract using their own XUSD as collateral, providing liquidity to the RBTC lending contract, closing the loan via a XUSD swap, redeeming iRBTC tokens, and completing the RskSwap flash swap repayment. This sequence manipulated the reported iToken price such that the attacker could withdraw substantially more RBTC than was originally deposited. Security firm Halborn confirmed the root cause was an unsafe external call in the closeWithDeposit function combined with defective price calculation code. Sovryn developers detected unusual activity shortly after the exploit began and placed the protocol in maintenance mode. Five blockchain addresses were identified as associated with the attacker. Sovryn reported recovering approximately half the value of the exploit through coordinated developer action, with the Sovryn Exchequer treasury committed to covering any unrecovered user losses. The exploit did not affect the Zero protocol or user funds held outside the two targeted lending pools.","heading":"October 2022 Price Manipulation Exploit","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-sovryn-hack-october-2022","name":"halborn.com","type":"other","credibility":3},{"url":"https://sovryn.com/all-things-sovryn/interim-exploit-update","name":"sovryn.com","type":"other","credibility":3},{"url":"https://cryptopotato.com/bitcoin-defi-protocol-sovryn-gets-hacked-for-over-1-million/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://cryptodaily.co.uk/2022/10/defi-protocol-sovryn-suffers-exploit-1-1-million-stolen","name":"cryptodaily.co.uk","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=more-than-1-1-million-stolen-from-sovryn-defi-protocol","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 11, 2021, a whitehat researcher identified as 'Turbo' submitted a critical and a high-severity vulnerability to Sovryn's Immunefi bug bounty program. The critical vulnerability was an authorization bypass in the borrow() and marginTrade() functions: the protocol failed to validate that the receiver of collateralized loan proceeds matched the borrower's address. This would have allowed a malicious actor to request a loan using another user's idle collateral, effectively stealing an amount equal to that collateral. The maximum funds directly at risk were assessed at approximately 6,798.17 USDT at the time of disclosure. A secondary high-severity vulnerability in margin trading could have pushed users into undesirable positions but was not assessed to enable direct theft. Sovryn implemented a fix requiring that msg.sender match the borrower or trader address. The vulnerability was not exploited in the wild. Sovryn paid the researcher $76,568 in total — a base payout of $50,000 for the critical finding, increased for the high-severity bug and a 15% bonus then in effect. This incident demonstrated the value of Sovryn's bug bounty program, which at the time offered the largest bounty on Immunefi.","heading":"March 2021 Critical Smart Contract Vulnerability","sources":[{"url":"https://medium.com/immunefi/sovryn-loan-vulnerability-postmortem-ffaf4d1d688f","name":"medium.com","type":"other","credibility":3},{"url":"https://sovryn.com/all-things-sovryn/bitcoin-based-defi-protocol-sovryn-raises-10m-offers-1-2m-bug-bounty","name":"sovryn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The SOV governance token launched with a maximum supply of 100 million tokens. At its all-time high on approximately October 7, 2021, SOV traded near $44.00–$44.91. As of 2025–2026, the token trades at a discount of approximately 99.85% from its all-time high, with a circulating supply in the range of 50–64 million SOV and a market capitalization reported between approximately $2 million and $14 million across data sources. The significant price decline is consistent with broader crypto market conditions but is notable in magnitude. Founders were allocated 25 million SOV with three-year vesting, and an early founders group received 14.52 million SOV with 10–24 month vesting schedules. No public evidence of coordinated insider token dumps or rug-pull mechanics was independently verified at the time of this investigation; however, the concentration of founder and early-founder allocations (approximately 39.5% of maximum supply) represents a structural governance and price-impact risk.","heading":"Token Economics and Price Performance","sources":[{"url":"https://wiki.sovryn.com/en/technical-documents/tokenomics","name":"wiki.sovryn.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/sovryn","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/sovryn/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory enforcement actions by the SEC, CFTC, DOJ, or international equivalents against Sovryn or its core contributors were identified at the time of this investigation. Sovryn has published its own analysis arguing that it operates as a decentralized entity outside SEC jurisdiction and that no legal precedent yet establishes SOV as a security under the Howey Test. The protocol is incorporated through a decentralized governance structure (Bitocracy) rather than a traditional legal entity. No court filings, OFAC designations, or government sanctions were located.","heading":"Regulatory and Legal Status","sources":[{"url":"https://sovryn.com/all-things-sovryn/sovryn-defi-sec-regulation-crypto-exchanges","name":"sovryn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"AVOID.NET's intake records indicate that Sovryn was flagged by on-chain investigator ZachXBT. At the time of this investigation, no specific public post from ZachXBT's verified accounts (x.com/zachxbt or @investigations on Telegram) detailing the nature of the Sovryn flag was independently located through web research. The flag may relate to the October 2022 exploit, the token's price trajectory, or concerns not yet publicly elaborated. This section will be updated if a primary ZachXBT source is identified. Readers should treat the ZachXBT flag as a signal warranting caution pending further primary source verification.","heading":"ZachXBT Flag","sources":[{"url":"https://t.me/s/investigations","name":"t.me","type":"other","credibility":3}],"severity":"medium"},{"content":"As of late 2024 through early 2026, Sovryn remains an active protocol. The team published a '2024 Development Report' and a 'Transformative 2024' recap, highlighting the launch of a Rune Bridge enabling Bitcoin and ERC20-compatible Rune Token deposits, the BitcoinOS initiative (SIP-0083), enhanced Zero protocol and BoB network integrations, and continued AMM and lending pool improvements. A financial report covering Q4 2024 through Q4 2025 was published on the Sovryn forum. TVL on RSK declined 33.9% quarter-over-quarter to approximately $44.7 million in Q4 2025, partly attributable to broader market conditions per Messari's State of Rootstock Q4 2025 report. The protocol does not appear to be abandoned or in wind-down status.","heading":"Current Status and Activity","sources":[{"url":"https://wiki.sovryn.com/en/project/2024-development","name":"wiki.sovryn.com","type":"other","credibility":3},{"url":"https://sovryn.com/all-things-sovryn/sovryns-transformative-2024","name":"sovryn.com","type":"other","credibility":3},{"url":"https://forum.sovryn.com/t/sovryn-financial-report-q4-2024-q4-2025/3548","name":"forum.sovryn.com","type":"other","credibility":3},{"url":"https://messari.io/report/state-of-rootstock-q4-2025","name":"messari.io","type":"other","credibility":3},{"url":"https://defillama.com/protocol/sovryn","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-12-15","event":"Sovryn launches on Rootstock (RSK) sidechain, offering Bitcoin-native DeFi lending and trading.","source":""},{"date":"2021-03-11","event":"Whitehat researcher 'Turbo' discloses a critical authorization bypass vulnerability via Immunefi bug bounty; vulnerability not exploited. Sovryn pays $76,568 bounty and patches the flaw.","source":""},{"date":"2021-03-24","event":"Reports emerge of Sovryn being near a $10 million investment agreement involving Anthony Pompliano ('Pomp'), per CoinDesk.","source":""},{"date":"2021-10-07","event":"SOV token reaches all-time high of approximately $44.91.","source":""},{"date":"2022-10-04","event":"Price manipulation exploit drains 44.93 RBTC and 211,045 USDT (approximately $1.1 million) from legacy lending pools via iToken flash loan attack. Sovryn places protocol in maintenance mode; approximately half of funds recovered.","source":""},{"date":"2022-12-11","event":"SOV token reaches all-time low of approximately $0.021.","source":""},{"date":"2024-11","event":"Sovryn Bitocracy approves SIP-0083, formalizing Sovryn's role as a contributor to the BitcoinOS initiative and launching the $BOS token.","source":"","date_original":"2024-11-01"},{"date":"2025","event":"Sovryn publishes 2024 Development Report and financial summary covering Q4 2024 through Q4 2025; TVL reported at approximately $44.7 million on RSK, down 33.9% quarter-over-quarter.","source":"","date_original":"2025-01-01"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2020/12/15/defi-on-bitcoin-gets-a-boost-as-sovryn-launches-on-rsk-sidechain","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260915185219/https://www.coindesk.com/tech/2020/12/15/defi-on-bitcoin-gets-a-boost-as-sovryn-launches-on-rsk-sidechain","credibility":3,"archive_timestamp":"2026-09-15T18:52:19+00:00"},{"url":"https://sovryn.com/all-things-sovryn/sovryn-raises-10m-offers-1-2m-bug-bounty","name":"sovryn.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2021/03/24/bitcoin-based-defi-project-sovryn-near-agreement-on-10m-investment-from-pomp","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260915171458/https://www.coindesk.com/business/2021/03/24/bitcoin-based-defi-project-sovryn-near-agreement-on-10m-investment-from-pomp","credibility":3,"archive_timestamp":"2026-09-15T17:14:58+00:00"},{"url":"https://wiki.sovryn.com/en/technical-documents/tokenomics","name":"wiki.sovryn.com","type":"other","archive_url":"http://web.archive.org/web/20260821172714/https://wiki.sovryn.com/en/technical-documents/tokenomics","credibility":3,"archive_timestamp":"2026-08-21T17:27:14+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-sovryn-hack-october-2022","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260322055930/https://www.halborn.com/blog/post/explained-the-sovryn-hack-october-2022","credibility":3,"archive_timestamp":"2026-03-22T05:59:30+00:00"},{"url":"https://sovryn.com/all-things-sovryn/interim-exploit-update","name":"sovryn.com","type":"other","archive_url":"http://web.archive.org/web/20260819195904/https://sovryn.com/all-things-sovryn/interim-exploit-update","credibility":3,"archive_timestamp":"2026-08-19T19:59:04+00:00"},{"url":"https://cryptopotato.com/bitcoin-defi-protocol-sovryn-gets-hacked-for-over-1-million/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20260610190621/https://cryptopotato.com/bitcoin-defi-protocol-sovryn-gets-hacked-for-over-1-million/","credibility":3,"archive_timestamp":"2026-06-10T19:06:21+00:00"},{"url":"https://cryptodaily.co.uk/2022/10/defi-protocol-sovryn-suffers-exploit-1-1-million-stolen","name":"cryptodaily.co.uk","type":"other","archive_url":"https://web.archive.org/web/20260829131523/https://cryptodaily.co.uk/2022/10/defi-protocol-sovryn-suffers-exploit-1-1-million-stolen","credibility":3,"archive_timestamp":"2026-08-29T13:15:23+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=more-than-1-1-million-stolen-from-sovryn-defi-protocol","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260307062448/https://www.web3isgoinggreat.com/?id=more-than-1-1-million-stolen-from-sovryn-defi-protocol","credibility":3,"archive_timestamp":"2026-03-07T06:24:48+00:00"},{"url":"https://medium.com/immunefi/sovryn-loan-vulnerability-postmortem-ffaf4d1d688f","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20250930112952/https://medium.com/immunefi/sovryn-loan-vulnerability-postmortem-ffaf4d1d688f","credibility":3,"archive_timestamp":"2025-09-30T11:29:52+00:00"},{"url":"https://sovryn.com/all-things-sovryn/bitcoin-based-defi-protocol-sovryn-raises-10m-offers-1-2m-bug-bounty","name":"sovryn.com","type":"other","archive_url":"http://web.archive.org/web/20251008094017/https://sovryn.com/all-things-sovryn/bitcoin-based-defi-protocol-sovryn-raises-10m-offers-1-2m-bug-bounty","credibility":3,"archive_timestamp":"2025-10-08T09:40:17+00:00"},{"url":"https://www.coingecko.com/en/coins/sovryn","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20260522173034/https://www.coingecko.com/en/coins/sovryn","credibility":3,"archive_timestamp":"2026-05-22T17:30:34+00:00"},{"url":"https://coinmarketcap.com/currencies/sovryn/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260522173035/https://coinmarketcap.com/currencies/sovryn/","credibility":3,"archive_timestamp":"2026-05-22T17:30:35+00:00"},{"url":"https://sovryn.com/all-things-sovryn/sovryn-defi-sec-regulation-crypto-exchanges","name":"sovryn.com","type":"other","archive_url":"http://web.archive.org/web/20260124015417/https://sovryn.com/all-things-sovryn/sovryn-defi-sec-regulation-crypto-exchanges","credibility":3,"archive_timestamp":"2026-01-24T01:54:17+00:00"},{"url":"https://t.me/s/investigations","name":"t.me","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://wiki.sovryn.com/en/project/2024-development","name":"wiki.sovryn.com","type":"other","archive_url":"https://web.archive.org/web/20260829143345/https://wiki.sovryn.com/en/project/2024-development","credibility":3,"archive_timestamp":"2026-08-29T14:33:45+00:00"},{"url":"https://sovryn.com/all-things-sovryn/sovryns-transformative-2024","name":"sovryn.com","type":"other","archive_url":"http://web.archive.org/web/20260124015338/https://sovryn.com/all-things-sovryn/sovryns-transformative-2024","credibility":3,"archive_timestamp":"2026-01-24T01:53:38+00:00"},{"url":"https://forum.sovryn.com/t/sovryn-financial-report-q4-2024-q4-2025/3548","name":"forum.sovryn.com","type":"other","archive_url":"http://web.archive.org/web/20260416144935/https://forum.sovryn.com/t/sovryn-financial-report-q4-2024-q4-2025/3548","credibility":3,"archive_timestamp":"2026-04-16T14:49:35+00:00"},{"url":"https://messari.io/report/state-of-rootstock-q4-2025","name":"messari.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://defillama.com/protocol/sovryn","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20251012180309/https://defillama.com/protocol/sovryn","credibility":3,"archive_timestamp":"2025-10-12T18:03:09+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:47.801153+00:00","updated_at":"2026-09-15T20:46:38.729287+00:00"}}