Audit log

Every state-changing event for RISEx: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-22 17:04:26Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,509,833

   sig

   3GYRhaxbUbL2…QwEfM649copyexplorer ↗

   hash

   9afux6cHhrnU…VvfSsg5wcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (13570 B) ▸

   {"actor":"system:backfill","investigation_id":"07cb2698-dd92-4b8e-bde3-565f771a50fc","kind":"publish","page_slug":"risex","published_at":"2026-08-22T17:04:26.633Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"RISEx","sections":[{"content":"On August 3, 2026 at approximately 07:21 UTC, an unauthorized withdrawal of 673,011.56 USDC occurred from the RWA strategy connected to RISEx's XLP vault. According to the team's public disclosure on X, the root cause was a misconfiguration in the RWA strategy smart contract present since the vault's deployment on July 13, 2026 — leaving the vulnerability exploitable for 21 days before it was detected. The team reported detecting the issue within minutes of occurrence, deploying a patch by 08:09 UTC on the same day. RISEx engaged SEAL 911, a 24/7 blockchain emergency security response service, and stated it was attempting to contact the address involved to negotiate a return of funds. No recovery of the stolen funds has been publicly confirmed. The team confirmed via post-incident review that this was the only unauthorized withdrawal in the affected period, and that no equivalent misconfigurations existed in other vault strategies. RISEx and its broader exchange operations were described as unaffected and continuing normally.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"},{"credibility":2,"name":"SlowMist Hacked — RISEx entry, August 3, 2026","type":"community_report","url":"https://hacked.slowmist.io/"}]},{"content":"The exploit was caused by a misconfiguration in the smart contract governing the XLP vault's RWA strategy, not a novel or complex attack vector. The misconfigured contract was deployed on July 13, 2026, and remained live and exploitable for 21 days without detection. The amount drained — 673,011.56 USDC — fell below the platform's withdrawal throttling thresholds, which the team acknowledged meant existing safeguards did not trigger an alert or block the withdrawal. No third-party audit had been completed or published for RISEx at the time of the exploit. The team's own FAQ, as of July 2026, stated that contracts had undergone only internal reviews and were 'in the process of third-party audits,' with no firm, scope, or timeline named. An independent review by PerpFinder, published July 23, 2026, noted that DefiLlama's protocol metadata recorded zero completed audits for RISEx and assigned a security rating of 3.5 out of 10 for the platform. The absence of a completed external audit at deployment is a contributing structural factor in this incident.","heading":"Root Cause: Smart-Contract Misconfiguration","severity":"critical","sources":[{"credibility":1,"name":"RISEx FAQ — audit status disclosure","type":"official","url":"https://docs.risechain.com/docs/risex/faq"},{"credibility":2,"name":"PerpFinder — RISEx Stats and Security Assessment 2026","type":"research","url":"https://perpfinder.com/perps/risex"},{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"}]},{"content":"RISEx compensated all XLP vault depositors in full using a portion of the fees generated by the RISEx protocol during July 2026. The team stated that XLP depositors' funds were not subject to loss as a result of this event. No external capital raise, token issuance, or community governance vote was required to fund the compensation. The stolen USDC itself was not recovered — the compensation was sourced from accrued protocol revenue. There is no publicly available postmortem with a detailed technical breakdown of the misconfiguration as of the time of this investigation.","heading":"Depositor Compensation","severity":"high","sources":[{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"}]},{"content":"As of the date of the August 3, 2026 exploit, RISEx had no completed, published third-party smart-contract security audit. The platform's own FAQ acknowledged that internal reviews had been conducted and that third-party audits were in progress, but named no auditing firm, defined no scope, and provided no estimated completion date. This posture was in place while the platform operated on Ethereum mainnet (via RISE Chain) and held real USDC collateral in user-facing vaults. PerpFinder's July 2026 review noted the absence of any audit record in DefiLlama's protocol metadata and characterized this as the most critical risk factor for the platform, advising users to treat deposits as risk capital. The August 3 exploit materialized precisely in the context of this audit gap — a misconfigured vault contract deployed without completed external review.","heading":"Audit and Security Posture","severity":"high","sources":[{"credibility":1,"name":"RISEx FAQ — audit status disclosure","type":"official","url":"https://docs.risechain.com/docs/risex/faq"},{"credibility":2,"name":"PerpFinder — RISEx Stats and Security Assessment 2026","type":"research","url":"https://perpfinder.com/perps/risex"}]},{"content":"RISEx is a product of Rise Labs, the company behind RISE Chain. Co-founders include Sam Battenally (CEO), Sasha Mai Herbert (CGO), and Hai Nguyen (CTO). RISE Chain raised $8 million in funding from investors including Galaxy Ventures, Vitalik Buterin (Ethereum co-founder), Finality Capital Partners, EtherFi, OrangeDAO, DACM, P2 Ventures, and Stani Kulechov (Aave founder). An earlier $3.2 million seed round in September 2024 included Sam Kazemian and Anthony Sassano. The platform reported over $3 billion in cumulative trading volume during its early access phase prior to launching a public points and rewards program ('Ignite' Season 1) in July 2026. The team's response to the August 3 incident — rapid patching, engagement of SEAL 911, and full depositor compensation from protocol revenue — is consistent with an operational team, though the pre-existing audit gap remains a documented deficiency.","heading":"Team and Backing","severity":"low","sources":[{"credibility":2,"name":"Galaxy Ventures Backs RISE Chain — The Defiant","type":"news_article","url":"https://thedefiant.io/news/press-releases/galaxy-ventures-backs-rise-chain-8m-raised-to-launch-fastest-zone-for-real-time-apps-on-ethereum"},{"credibility":2,"name":"RISEx Launches Ignite Season 1 Points Program — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/risex-launches-ignite-season-1-points-program-following-3b-in-volume-during-the-early-access-phase"},{"credibility":2,"name":"RISE Chain $8M Raise — CMO Intern","type":"news_article","url":"https://www.cmointern.com/2025/06/rise-chain-raises-8m-to-power-infinite.html?m=1"}]},{"content":"RISEx is a fully on-chain perpetual-futures exchange with native real-world asset (RWA) trading, operating on RISE Chain (an Ethereum Layer 2). The XLP vault is the platform's flagship liquidity vault. At the time of the exploit, RISEx's withdrawal throttles on the RISE bridge, the exchange itself, and the XLP vault did not trigger, because the drained amount was below the configured thresholds. This indicates that risk controls may not be sized for the actual asset concentrations in individual vault strategies. No completed third-party audit had been published as of August 3, 2026; any audit reports completed after that date have not been confirmed in publicly available sources as of this investigation. Users considering depositing to RISEx vaults should verify current audit publication status directly through official RISEx channels.","heading":"Platform Context and Ongoing Risk","severity":"medium","sources":[{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"},{"credibility":1,"name":"RISEx — The unified exchange (docs)","type":"official","url":"https://docs.risechain.com/docs/risex"}]}],"sources_used":[{"credibility":2,"name":"RISEx official incident disclosure on X (risextrade)","type":"social_media","url":"https://x.com/risextrade/status/2084350396609520105"},{"credibility":2,"name":"SlowMist Hacked — RISEx entry","type":"community_report","url":"https://hacked.slowmist.io/"},{"credibility":1,"name":"RISEx FAQ — official audit status","type":"official","url":"https://docs.risechain.com/docs/risex/faq"},{"credibility":1,"name":"RISEx — The unified exchange (official docs)","type":"official","url":"https://docs.risechain.com/docs/risex"},{"credibility":2,"name":"PerpFinder — RISEx Stats and Security Assessment 2026","type":"research","url":"https://perpfinder.com/perps/risex"},{"credibility":2,"name":"Galaxy Ventures Backs RISE Chain — The Defiant","type":"news_article","url":"https://thedefiant.io/news/press-releases/galaxy-ventures-backs-rise-chain-8m-raised-to-launch-fastest-zone-for-real-time-apps-on-ethereum"},{"credibility":2,"name":"RISE Chain $8M Raise announcement — CMO Intern","type":"news_article","url":"https://www.cmointern.com/2025/06/rise-chain-raises-8m-to-power-infinite.html?m=1"},{"credibility":2,"name":"RISEx Launches Ignite Season 1 — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/risex-launches-ignite-season-1-points-program-following-3b-in-volume-during-the-early-access-phase"},{"credibility":2,"name":"RISEx Launches Ignite Season 1 — Blockchain Magazine","type":"news_article","url":"https://blockchainmagazine.net/risex-launches-ignite-season-1-points-program-following-3b-in-volume-during-the-early-access-phase/"},{"credibility":1,"name":"Ethereum Layer-2 RISE Unveils RISEx — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2025/11/12/ethereum-layer-2-rise-unveils-risex-and-marketcore-to-build-global-on-chain-markets"},{"credibility":2,"name":"CCN — Biggest DeFi Hacks and Exploits of 2026","type":"news_article","url":"https://www.ccn.com/education/crypto/defi-hacks-exploits-causes-crypto-stolen-2026/"},{"credibility":1,"name":"RISEx vault — official product page","type":"official","url":"https://vault.rise.trade/en/vault"}],"summary":"RISEx is a fully on-chain perpetual-futures exchange built on RISE Chain, backed by Galaxy Ventures and Vitalik Buterin. On August 3, 2026, an unauthorized withdrawal of 673,011.56 USDC was drained from the XLP vault's RWA strategy due to a smart-contract misconfiguration that had been present and exploitable since the vault's July 13, 2026 deployment — a 21-day undetected window. No completed third-party security audit existed for RISEx at the time of the exploit; the team patched the issue by 08:09 UTC the same day and compensated depositors from July protocol fees, but the stolen funds were not recovered.","timeline":[{"date":"2024-09-01","event":"Rise Labs closes a $3.2 million seed round including Vitalik Buterin, Sam Kazemian, and Anthony Sassano.","source":"CMO Intern / RISE Chain funding coverage","source_url":"https://www.cmointern.com/2025/06/rise-chain-raises-8m-to-power-infinite.html?m=1"},{"date":"2025-11-12","event":"RISE Chain announces RISEx and MarketCore, positioning as a global on-chain markets infrastructure on Ethereum Layer 2.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2025/11/12/ethereum-layer-2-rise-unveils-risex-and-marketcore-to-build-global-on-chain-markets"},{"date":"2025-06-01","event":"RISE Chain raises $8 million in a second round led by Galaxy Ventures, with participation from Finality Capital Partners, EtherFi, OrangeDAO, and others.","source":"The Defiant","source_url":"https://thedefiant.io/news/press-releases/galaxy-ventures-backs-rise-chain-8m-raised-to-launch-fastest-zone-for-real-time-apps-on-ethereum"},{"date":"2026-07-13","event":"RISEx deploys the XLP vault RWA strategy smart contract — containing a misconfiguration that leaves the vault exploitable. No completed third-party audit exists at deployment.","source":"RISEx official incident disclosure on X","source_url":"https://x.com/risextrade/status/2084350396609520105"},{"date":"2026-07-23","event":"PerpFinder publishes a security assessment of RISEx noting zero completed audits in DefiLlama metadata and assigning a security rating of 3.5/10.","source":"PerpFinder — RISEx Stats 2026","source_url":"https://perpfinder.com/perps/risex"},{"date":"2026-07-24","event":"RISEx launches the 'Ignite' Season 1 public points and rewards program following $3 billion in cumulative trading volume.","source":"CryptoDaily","source_url":"https://cryptodaily.co.uk/2026/07/risex-launches-ignite-season-1-points-program-following-3b-in-volume-during-the-early-access-phase"},{"date":"2026-08-03","event":"At approximately 07:21 UTC, an unauthorized withdrawal of 673,011.56 USDC is executed from the XLP vault's RWA strategy due to the misconfiguration present since July 13.","source":"RISEx official incident disclosure on X / SlowMist Hacked","source_url":"https://x.com/risextrade/status/2084350396609520105"},{"date":"2026-08-03","event":"By 08:09 UTC, RISEx patches the misconfiguration. The team engages SEAL 911, reviews all transactions, and confirms no other unauthorized withdrawals occurred. XLP depositors are made whole from July protocol fees.","source":"RISEx official incident disclosure on X","source_url":"https://x.com/risextrade/status/2084350396609520105"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f831876f-6c86-4144-802d-68596a9d19c3copy
2. #2reviewby reviewerreviewer

   2026-08-25 03:25:11Z
   Score: 42 → 42 (no score change)
   The core factual spine of the page — the exploit amount, date, root cause, patch time, absence of a completed audit, and compensation mechanism — is independently corroborated by SlowMist's Hacked tracker and directly fetched official/research sources (RISEx FAQ, PerpFinder). However, several operational details about the incident response (SEAL 911 engagement, negotiation attempt, 'only one unauthorized withdrawal') rely solely on the implicated party's own unfetchable X post with no independent corroboration found. The 'Team and Backing' section contains a clear factual overstatement in its cited timeline entry (describing a $4M Galaxy Ventures round as an '$8 million' second raise, with a date roughly a week off), and the Ignite Season 1 launch date in the timeline (July 24) conflicts with the page's own cited source (July 20).
   anchoranchored

   chain

   ●mainnet-betaslot 443,511,156

   sig

   3HhLwMPrvTzu…h4tjLvFvcopyexplorer ↗

   hash

   9rEnMsAaKLdr…qwGvjrP7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1183 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-25T03:25:11.568Z","decision":"review","investigation_id":"07cb2698-dd92-4b8e-bde3-565f771a50fc","new_score":42,"page_slug":"risex","prev_score":42,"reason":"The core factual spine of the page — the exploit amount, date, root cause, patch time, absence of a completed audit, and compensation mechanism — is independently corroborated by SlowMist's Hacked tracker and directly fetched official/research sources (RISEx FAQ, PerpFinder). However, several operational details about the incident response (SEAL 911 engagement, negotiation attempt, 'only one unauthorized withdrawal') rely solely on the implicated party's own unfetchable X post with no independent corroboration found. The 'Team and Backing' section contains a clear factual overstatement in its cited timeline entry (describing a $4M Galaxy Ventures round as an '$8 million' second raise, with a date roughly a week off), and the Ignite Season 1 launch date in the timeline (July 24) conflicts with the page's own cited source (July 20).","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ab5fcd64-6d47-4a78-b736-76e576b96c3ccopy
3. #3review reviseby judgejudge

   2026-08-25 03:25:11Z
   Score: 42 → 29 (-13)
   The page's central factual spine — the 673,011.56 USDC exploit amount, the August 3, 2026 date, the July 13 misconfiguration root cause, the 08:09 UTC patch, the absence of a completed audit, and the fee-funded compensation — is independently corroborated by SlowMist's tracker and directly fetched official/research sources, so the core incident narrative holds up (claim_findings[2],[3],[4],[5],[6]). However, a disputed finding shows the page overstates a June 2025 funding round as an '$8 million raise' when cited sources describe it as a $4M round (with $8M being a cumulative two-round total) and gets the date off by roughly a week (claim_findings[24]). More significantly, nearly every operational detail that casts RISEx's incident response favorably — its SEAL 911 engagement, its negotiation attempt, its claim that only one withdrawal occurred, and its explanation of why withdrawal throttles didn't trigger — rests solely on the implicated party's own unfetchable X post with no independent corroboration found (claim_findings[8],[9],[10],[12]), a gap the reviewer separately flagged as high-priority (coverage_gaps: 'independent security-firm confirmation'). A second high-priority gap notes the page omits any on-chain forensic detail (attacker address, transaction hash) for the drained funds. Additional partially-supported findings include a launch date that contradicts the page's own cited source (July 24 vs. July 20, claim_findings[26]) and an investor roster only fully corroborated by an uncited source (claim_findings[19]). These issues warrant correction and additional sourcing but do not undermine the page's core allegation.
   anchoranchored

   chain

   ●mainnet-betaslot 443,511,172

   sig

   4Zj4Y8i77GNu…cdWXmDE3copyexplorer ↗

   hash

   8J2wZmQzMUK2…EemVi82Zcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2001 B) ▸

   {"actor":"judge","decided_at":"2026-08-25T03:25:11.568Z","decision":"review_revise","investigation_id":"07cb2698-dd92-4b8e-bde3-565f771a50fc","new_score":29,"page_slug":"risex","prev_score":42,"reason":"The page's central factual spine — the 673,011.56 USDC exploit amount, the August 3, 2026 date, the July 13 misconfiguration root cause, the 08:09 UTC patch, the absence of a completed audit, and the fee-funded compensation — is independently corroborated by SlowMist's tracker and directly fetched official/research sources, so the core incident narrative holds up (claim_findings[2],[3],[4],[5],[6]). However, a disputed finding shows the page overstates a June 2025 funding round as an '$8 million raise' when cited sources describe it as a $4M round (with $8M being a cumulative two-round total) and gets the date off by roughly a week (claim_findings[24]). More significantly, nearly every operational detail that casts RISEx's incident response favorably — its SEAL 911 engagement, its negotiation attempt, its claim that only one withdrawal occurred, and its explanation of why withdrawal throttles didn't trigger — rests solely on the implicated party's own unfetchable X post with no independent corroboration found (claim_findings[8],[9],[10],[12]), a gap the reviewer separately flagged as high-priority (coverage_gaps: 'independent security-firm confirmation'). A second high-priority gap notes the page omits any on-chain forensic detail (attacker address, transaction hash) for the drained funds. Additional partially-supported findings include a launch date that contradicts the page's own cited source (July 24 vs. July 20, claim_findings[26]) and an investor roster only fully corroborated by an uncited source (claim_findings[19]). These issues warrant correction and additional sourcing but do not undermine the page's core allegation.","score_delta":-13,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a8a96c1f-4eb2-45c8-b9bc-b6770e3e3599copy
4. #4reviewby reviewerreviewer

   2026-09-09 03:05:15Z
   Score: 29 → 29 (no score change)
   Findings-only fact-check (retroactive anchor of stored findings)
   anchoranchored

   chain

   ●mainnet-betaslot 445,506,639

   sig

   4Wx3CXDgKoao…6UobmJGzcopyexplorer ↗

   hash

   FDccCogwxJ6K…CZB1NUx3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (698 B) ▸

   {"actor":"reviewer","artifact_identity":"80b34fee0c90c1199e13b192edd6a1a3","decided_at":"2026-09-07T07:08:12.824971+00:00","decision":"review","findings_count":16,"findings_rows_hash":"ee3c4981e8bc76206047113eef2d44e3d99c2ac87c9017c94504d58111493629","investigation_id":"07cb2698-dd92-4b8e-bde3-565f771a50fc","mode":"findings_only_retroactive","new_score":29,"page_content_hash":"17fa7648023770aafa07f1a43fa62a5c608f26f70b9a411d5706a4163f0997ae","page_slug":"risex","prev_score":29,"reason":"Findings-only fact-check (retroactive anchor of stored findings)","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7f8bf578-274c-49ca-b74e-89e3d16ac482copy