Audit log

Every state-changing event for RISEx: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-22 17:04:26Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   9afux6cHhrnU…VvfSsg5wcopysha256 → base58

   verifying row…

   canonical bytes (13570 B) ▸

   {"actor":"system:backfill","investigation_id":"07cb2698-dd92-4b8e-bde3-565f771a50fc","kind":"publish","page_slug":"risex","published_at":"2026-08-22T17:04:26.633Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"RISEx","sections":[{"content":"On August 3, 2026 at approximately 07:21 UTC, an unauthorized withdrawal of 673,011.56 USDC occurred from the RWA strategy connected to RISEx's XLP vault. According to the team's public disclosure on X, the root cause was a misconfiguration in the RWA strategy smart contract present since the vault's deployment on July 13, 2026 — leaving the vulnerability exploitable for 21 days before it was detected. The team reported detecting the issue within minutes of occurrence, deploying a patch by 08:09 UTC on the same day. RISEx engaged SEAL 911, a 24/7 blockchain emergency security response service, and stated it was attempting to contact the address involved to negotiate a return of funds. No recovery of the stolen funds has been publicly confirmed. The team confirmed via post-incident review that this was the only unauthorized withdrawal in the affected period, and that no equivalent misconfigurations existed in other vault strategies. RISEx and its broader exchange operations were described as unaffected and continuing normally.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"},{"credibility":2,"name":"SlowMist Hacked — RISEx entry, August 3, 2026","type":"community_report","url":"https://hacked.slowmist.io/"}]},{"content":"The exploit was caused by a misconfiguration in the smart contract governing the XLP vault's RWA strategy, not a novel or complex attack vector. The misconfigured contract was deployed on July 13, 2026, and remained live and exploitable for 21 days without detection. The amount drained — 673,011.56 USDC — fell below the platform's withdrawal throttling thresholds, which the team acknowledged meant existing safeguards did not trigger an alert or block the withdrawal. No third-party audit had been completed or published for RISEx at the time of the exploit. The team's own FAQ, as of July 2026, stated that contracts had undergone only internal reviews and were 'in the process of third-party audits,' with no firm, scope, or timeline named. An independent review by PerpFinder, published July 23, 2026, noted that DefiLlama's protocol metadata recorded zero completed audits for RISEx and assigned a security rating of 3.5 out of 10 for the platform. The absence of a completed external audit at deployment is a contributing structural factor in this incident.","heading":"Root Cause: Smart-Contract Misconfiguration","severity":"critical","sources":[{"credibility":1,"name":"RISEx FAQ — audit status disclosure","type":"official","url":"https://docs.risechain.com/docs/risex/faq"},{"credibility":2,"name":"PerpFinder — RISEx Stats and Security Assessment 2026","type":"research","url":"https://perpfinder.com/perps/risex"},{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"}]},{"content":"RISEx compensated all XLP vault depositors in full using a portion of the fees generated by the RISEx protocol during July 2026. The team stated that XLP depositors' funds were not subject to loss as a result of this event. No external capital raise, token issuance, or community governance vote was required to fund the compensation. The stolen USDC itself was not recovered — the compensation was sourced from accrued protocol revenue. There is no publicly available postmortem with a detailed technical breakdown of the misconfiguration as of the time of this investigation.","heading":"Depositor Compensation","severity":"high","sources":[{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"}]},{"content":"As of the date of the August 3, 2026 exploit, RISEx had no completed, published third-party smart-contract security audit. The platform's own FAQ acknowledged that internal reviews had been conducted and that third-party audits were in progress, but named no auditing firm, defined no scope, and provided no estimated completion date. This posture was in place while the platform operated on Ethereum mainnet (via RISE Chain) and held real USDC collateral in user-facing vaults. PerpFinder's July 2026 review noted the absence of any audit record in DefiLlama's protocol metadata and characterized this as the most critical risk factor for the platform, advising users to treat deposits as risk capital. The August 3 exploit materialized precisely in the context of this audit gap — a misconfigured vault contract deployed without completed external review.","heading":"Audit and Security Posture","severity":"high","sources":[{"credibility":1,"name":"RISEx FAQ — audit status disclosure","type":"official","url":"https://docs.risechain.com/docs/risex/faq"},{"credibility":2,"name":"PerpFinder — RISEx Stats and Security Assessment 2026","type":"research","url":"https://perpfinder.com/perps/risex"}]},{"content":"RISEx is a product of Rise Labs, the company behind RISE Chain. Co-founders include Sam Battenally (CEO), Sasha Mai Herbert (CGO), and Hai Nguyen (CTO). RISE Chain raised $8 million in funding from investors including Galaxy Ventures, Vitalik Buterin (Ethereum co-founder), Finality Capital Partners, EtherFi, OrangeDAO, DACM, P2 Ventures, and Stani Kulechov (Aave founder). An earlier $3.2 million seed round in September 2024 included Sam Kazemian and Anthony Sassano. The platform reported over $3 billion in cumulative trading volume during its early access phase prior to launching a public points and rewards program ('Ignite' Season 1) in July 2026. The team's response to the August 3 incident — rapid patching, engagement of SEAL 911, and full depositor compensation from protocol revenue — is consistent with an operational team, though the pre-existing audit gap remains a documented deficiency.","heading":"Team and Backing","severity":"low","sources":[{"credibility":2,"name":"Galaxy Ventures Backs RISE Chain — The Defiant","type":"news_article","url":"https://thedefiant.io/news/press-releases/galaxy-ventures-backs-rise-chain-8m-raised-to-launch-fastest-zone-for-real-time-apps-on-ethereum"},{"credibility":2,"name":"RISEx Launches Ignite Season 1 Points Program — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/risex-launches-ignite-season-1-points-program-following-3b-in-volume-during-the-early-access-phase"},{"credibility":2,"name":"RISE Chain $8M Raise — CMO Intern","type":"news_article","url":"https://www.cmointern.com/2025/06/rise-chain-raises-8m-to-power-infinite.html?m=1"}]},{"content":"RISEx is a fully on-chain perpetual-futures exchange with native real-world asset (RWA) trading, operating on RISE Chain (an Ethereum Layer 2). The XLP vault is the platform's flagship liquidity vault. At the time of the exploit, RISEx's withdrawal throttles on the RISE bridge, the exchange itself, and the XLP vault did not trigger, because the drained amount was below the configured thresholds. This indicates that risk controls may not be sized for the actual asset concentrations in individual vault strategies. No completed third-party audit had been published as of August 3, 2026; any audit reports completed after that date have not been confirmed in publicly available sources as of this investigation. Users considering depositing to RISEx vaults should verify current audit publication status directly through official RISEx channels.","heading":"Platform Context and Ongoing Risk","severity":"medium","sources":[{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"},{"credibility":1,"name":"RISEx — The unified exchange (docs)","type":"official","url":"https://docs.risechain.com/docs/risex"}]}],"sources_used":[{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"},{"credibility":2,"name":"SlowMist Hacked — RISEx entry","type":"community_report","url":"https://hacked.slowmist.io/"},{"credibility":1,"name":"RISEx FAQ — official audit status","type":"official","url":"https://docs.risechain.com/docs/risex/faq"},{"credibility":1,"name":"RISEx — The unified exchange (official docs)","type":"official","url":"https://docs.risechain.com/docs/risex"},{"credibility":2,"name":"PerpFinder — RISEx Stats and Security Assessment 2026","type":"research","url":"https://perpfinder.com/perps/risex"},{"credibility":2,"name":"Galaxy Ventures Backs RISE Chain — The Defiant","type":"news_article","url":"https://thedefiant.io/news/press-releases/galaxy-ventures-backs-rise-chain-8m-raised-to-launch-fastest-zone-for-real-time-apps-on-ethereum"},{"credibility":2,"name":"RISE Chain $8M Raise announcement — CMO Intern","type":"news_article","url":"https://www.cmointern.com/2025/06/rise-chain-raises-8m-to-power-infinite.html?m=1"},{"credibility":2,"name":"RISEx Launches Ignite Season 1 — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/risex-launches-ignite-season-1-points-program-following-3b-in-volume-during-the-early-access-phase"},{"credibility":2,"name":"RISEx Launches Ignite Season 1 — Blockchain Magazine","type":"news_article","url":"https://blockchainmagazine.net/risex-launches-ignite-season-1-points-program-following-3b-in-volume-during-the-early-access-phase/"},{"credibility":1,"name":"Ethereum Layer-2 RISE Unveils RISEx — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2025/11/12/ethereum-layer-2-rise-unveils-risex-and-marketcore-to-build-global-on-chain-markets"},{"credibility":2,"name":"CCN — Biggest DeFi Hacks and Exploits of 2026","type":"news_article","url":"https://www.ccn.com/education/crypto/defi-hacks-exploits-causes-crypto-stolen-2026/"},{"credibility":1,"name":"RISEx vault — official product page","type":"official","url":"https://vault.rise.trade/en/vault"}],"summary":"RISEx is a fully on-chain perpetual-futures exchange built on RISE Chain, backed by Galaxy Ventures and Vitalik Buterin. On August 3, 2026, an unauthorized withdrawal of 673,011.56 USDC was drained from the XLP vault's RWA strategy due to a smart-contract misconfiguration that had been present and exploitable since the vault's July 13, 2026 deployment — a 21-day undetected window. No completed third-party security audit existed for RISEx at the time of the exploit; the team patched the issue by 08:09 UTC the same day and compensated depositors from July protocol fees, but the stolen funds were not recovered.","timeline":[{"date":"2024-09-01","event":"Rise Labs closes a $3.2 million seed round including Vitalik Buterin, Sam Kazemian, and Anthony Sassano.","source":"CMO Intern / RISE Chain funding coverage","source_url":"https://www.cmointern.com/2025/06/rise-chain-raises-8m-to-power-infinite.html?m=1"},{"date":"2025-11-12","event":"RISE Chain announces RISEx and MarketCore, positioning as a global on-chain markets infrastructure on Ethereum Layer 2.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2025/11/12/ethereum-layer-2-rise-unveils-risex-and-marketcore-to-build-global-on-chain-markets"},{"date":"2025-06-01","event":"RISE Chain raises $8 million in a second round led by Galaxy Ventures, with participation from Finality Capital Partners, EtherFi, OrangeDAO, and others.","source":"The Defiant","source_url":"https://thedefiant.io/news/press-releases/galaxy-ventures-backs-rise-chain-8m-raised-to-launch-fastest-zone-for-real-time-apps-on-ethereum"},{"date":"2026-07-13","event":"RISEx deploys the XLP vault RWA strategy smart contract — containing a misconfiguration that leaves the vault exploitable. No completed third-party audit exists at deployment.","source":"RISEx official incident disclosure on X","source_url":"https://x.com/risextrade/status/2084350396609520105"},{"date":"2026-07-23","event":"PerpFinder publishes a security assessment of RISEx noting zero completed audits in DefiLlama metadata and assigning a security rating of 3.5/10.","source":"PerpFinder — RISEx Stats 2026","source_url":"https://perpfinder.com/perps/risex"},{"date":"2026-07-24","event":"RISEx launches the 'Ignite' Season 1 public points and rewards program following $3 billion in cumulative trading volume.","source":"CryptoDaily","source_url":"https://cryptodaily.co.uk/2026/07/risex-launches-ignite-season-1-points-program-following-3b-in-volume-during-the-early-access-phase"},{"date":"2026-08-03","event":"At approximately 07:21 UTC, an unauthorized withdrawal of 673,011.56 USDC is executed from the XLP vault's RWA strategy due to the misconfiguration present since July 13.","source":"RISEx official incident disclosure on X / SlowMist Hacked","source_url":"https://x.com/risextrade/status/2084350396609520105"},{"date":"2026-08-03","event":"By 08:09 UTC, RISEx patches the misconfiguration. The team engages SEAL 911, reviews all transactions, and confirms no other unauthorized withdrawals occurred. XLP depositors are made whole from July protocol fees.","source":"RISEx official incident disclosure on X","source_url":"https://x.com/risextrade/status/2084350396609520105"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f831876f-6c86-4144-802d-68596a9d19c3copy