← Tropykus RSKreviewed 2026-10-21 · 21 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Tropykus RSK against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed 1unverifiable 4link rot 3partially supported 3confirmed 104 corrections pending · 0 applied
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #8[disputed][awaiting moderator]in section: June 2023 Exploit: rBTC Micro-Market Rounding Error
“No public confirmation of fund recovery has been verified.”
reviewerNo public confirmation of fund recovery has been verified.This is a credible, publicly reported fact that contradicts the page's claim no confirmation exists. CriptoNoticias (fetched directly) quotes the CEO confirming completed reimbursement by July 17, 2023, and BeInCrypto reports the company paid out more than the original loss to offset Bitcoin's price appreciation in the interim.Proposed correction (not yet applied)Tropykus CEO Mauricio Tovar stated in a July 2023 interview that all affected users had been fully reimbursed by July 17, 2023; BeInCrypto separately reported the protocol repaid slightly more (about 6.3% extra) than the dollar amount originally lost, to account for Bitcoin's price rising from roughly $26,000 at the time of the exploit to over $31,000 by the time of repayment.
unverifiable
4 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #5[unverifiable][awaiting moderator]in section: June 2023 Exploit: rBTC Micro-Market Rounding Error
“The attacker exploited a redeem rounding error vulnerability to manipulate the exchange rate within that market, enabling withdrawal of more funds than legitimately entitled and the use of a flash loan in stablecoins.”
reviewerThe attacker used a flash loan in stablecoins as part of the exchange-rate manipulation.Could not independently confirm the flash-loan mechanic; the cited article was unreachable (repeated 502s) and no other source mentions this detail. Not contradicted, just unverified. - #9[unverifiable][awaiting moderator]in section: Team Response and Remediation
“The team pledged to reimburse 100% of the stablecoins lost and 100% of the Bitcoin lost at a fixed reference price of $30,000 per BTC.”
reviewerThe team pledged to reimburse 100% of stablecoins lost and 100% of Bitcoin lost at a fixed reference price of $30,000 per BTC.Plausible and internally consistent with later reporting on the top-up payment, but the specific $30,000 figure could not be independently confirmed since the primary Medium source was inaccessible (403) on every fetch attempt. - #17[unverifiable][awaiting moderator]in section: Team, Investors, and Organizational Background
“The protocol has raised $700,000 from investors including Outlier Ventures, Pomp Investments, and RootstockLabs.”
reviewerThe protocol has raised $700,000 from investors including Outlier Ventures, Pomp Investments, and RootstockLabs.Outlier Ventures' relationship to Tropykus is confirmed, and a search aggregator (Bouncewatch) independently places an Outlier Ventures venture round on September 18, 2023, matching the timeline date. However, the specific $700,000 total and the inclusion of Pomp Investments and RootstockLabs as co-investors could not be verified because both primary cited funding-database pages (Crunchbase, Tracxn) blocked direct fetch. - #18[unverifiable][awaiting moderator]in the timeline
“Tropykus Finance closes a venture funding round, raising $700,000 total from Outlier Ventures, Pomp Investments, and RootstockLabs.”
reviewerTropykus Finance closed a venture funding round on 2023-09-18, raising $700,000 total from Outlier Ventures, Pomp Investments, and RootstockLabs.Same underlying verification gap as the section 4 funding claim — the date is plausible and partly corroborated, but the dollar amount and full investor list rest on sources this review could not directly access.
link rot
3 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #13[link rot][awaiting moderator]in section: Team Response and Remediation
“https://hackenproof.com/public-bug-bounty-list/tropykus-bug-bounty-program”
reviewerHackenProof hosts/lists the Tropykus bug bounty program at the cited URL.The specific Tropykus program page is gone; the bounty itself is real and live on Immunefi (see above), but this particular citation no longer resolves to Tropykus-specific content. Could not confirm a live replacement URL by direct fetch (Immunefi's own pages 404'd for this tool), so recommending removal rather than a guessed replacement. - #14[link rot][awaiting moderator]in the cited sources
“https://hackenproof.com/public-bug-bounty-list/tropykus-bug-bounty-program”
reviewerHackenProof hosts/lists the Tropykus bug bounty program (duplicate citation in sources_used).Same underlying dead link as the sections[2] citation; grouped under the same defect. - #21[link rot][awaiting moderator]in the cited sources
“https://www.altcoinbuzz.io/defi/tropykus-and-emerging-economies/”
reviewerAltcoin Buzz published an article on Tropykus and emerging economies at the cited URL.This source is listed in sources_used but is not cited inline by any section. Its content has drifted away from Tropykus entirely, so it no longer supports any claim on the page.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #11[partially supported][awaiting moderator]in section: Team Response and Remediation
“New product offerings, including Bitcoin Pro (BPro) and RifUSD markets, were subsequently launched.”
reviewerNew product offerings, including Bitcoin Pro (BPro) and RifUSD markets, were subsequently launched.BPro market existence is directly confirmed in the GitHub repo. 'RifUSD' appears to be the page's informal name for what the codebase calls the kUSDRIF market; the underlying product exists but the branding label is unconfirmed. - #15[partially supported][awaiting moderator]in section: Smart Contract and Oracle Risk Profile
“No formal Tier 1 security audit reports have been located by this investigation.”
reviewerNo formal Tier 1 security audit reports have been located for Tropykus.The claim may be accurate, but the existence of an 'audits' folder in the official repo — unexamined by this review — means the negative claim is not as fully substantiated as stated. Recommend the investigation examine the repo's audits directory directly before asserting none exists. - #16[partially supported][awaiting moderator]in section: Team, Investors, and Organizational Background
“Tropykus Finance was founded in 2021 by Mauricio Tovar (CEO), Mesi Rendon (CTO), and Diego Mazo.”
reviewerTropykus Finance was founded in 2021 by Mauricio Tovar (CEO), Mesi Rendon (CTO), and Diego Mazo.The three names are well corroborated as co-founders. The specific CEO/CTO title split could not be confirmed by any independently reachable source; most coverage describes all three simply as co-founders.
confirmed
10 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Protocol Overview
“The protocol is a fork of Compound Finance's codebase, adapted for Latin American users with a focus on Bitcoin-collateralized loans and stablecoin savings.”
reviewerTropykus is a fork of Compound Finance's codebase, adapted for Latin American users with Bitcoin-collateralized loans and stablecoin savings.Multiple independent sources (GitHub repo structure, DefiLlama classification, Immunefi program scope) corroborate the Compound V2 fork characterization. - #2[confirmed][no action needed]in section: Protocol Overview
“The protocol launched on RSK testnet in April 2021 and reached mainnet in May 2021, later expanding to Polygon zkEVM in May 2023.”
reviewerTropykus launched on RSK testnet in April 2021 and reached mainnet in May 2021.Month-level dates match the cited RootstockLabs blog; could not pin the exact day for either date. - #3[confirmed][no action needed]in the timeline
“Tropykus deploys experimental version on Polygon zkEVM, integrating API3 self-funded dAPIs for price oracles.”
reviewerTropykus deployed an experimental version on Polygon zkEVM on 2023-05-24, integrating API3 self-funded dAPIs for price oracles.Date and oracle-provider detail both corroborated by independent Spanish- and English-language reporting. - #4[confirmed][no action needed]in section: June 2023 Exploit: rBTC Micro-Market Rounding Error
“On June 14, 2023, Tropykus suffered a targeted attack on its rBTC micro-market, a custom market offering approximately 3% yield that was not part of Compound Finance's original codebase.”
reviewerOn June 14, 2023, Tropykus suffered an exploit on its rBTC micro-market via a redeem rounding error, losing approximately $150,000 (about 10% of deposits).Date, dollar amount, and percentage are corroborated across DefiLlama, Rekt, and two independent Spanish-language outlets. - #6[confirmed][no action needed]in section: June 2023 Exploit: rBTC Micro-Market Rounding Error
“Tropykus identified two attacker-controlled addresses and reported them to relevant parties to flag them across other chains.”
reviewerTropykus identified two attacker-controlled addresses and reported them, and temporarily took the platform offline.Corroborated by an independent outlet distinct from the page's cited sources. - #7[confirmed][no action needed]in section: June 2023 Exploit: rBTC Micro-Market Rounding Error
“Tropykus issued a deadline of June 16, 2023 at 23:59 GMT-5 for the attacker to contact them before initiating legal proceedings, and offered the attacker the $50,000 bug bounty reward available on Immunefi had they disclosed the vulnerability responsibly.”
reviewerTropykus set a June 16, 2023 23:59 GMT-5 deadline for the attacker, offering the $50,000 Immunefi bounty as an alternative to legal action.Core elements (deadline threat, bounty-as-alternative) corroborated by a second outlet; the precise timestamp rests on the single cited BeInCrypto source, which could not be directly re-fetched. - #10[confirmed][no action needed]in section: Team Response and Remediation
“The protocol reverted to Compound Finance's unmodified original codebase, discontinuing the vulnerable rBTC micro-market that had been a custom addition.”
reviewerThe protocol reverted to Compound Finance's unmodified original codebase and discontinued the vulnerable rBTC micro-market.Confirmed via an independently fetched CriptoNoticias article describing the same remediation in substance. - #12[confirmed][no action needed]in section: Team Response and Remediation
“The team described the incident as deeply disappointing given the existence of a public bug bounty program through Immunefi, which offered up to $50,000 for critical vulnerability disclosures.”
reviewerA public Immunefi bug bounty program offered up to $50,000 for critical vulnerability disclosures.The $50,000 Immunefi program is confirmed to exist and predate the exploit, though the page's own cited source for this (HackenProof) is dead — see separate link_rot finding. - #19[confirmed][no action needed]in section: Team, Investors, and Organizational Background
“No regulatory actions or government investigations have been identified against the entity or its founders as of this investigation.”
reviewerNo regulatory actions or government investigations have been identified against Tropykus or its founders.A negative claim is inherently hard to fully confirm, but no contradicting reports were found across multiple targeted searches, consistent with the page's statement. - #20[confirmed][no action needed]in section: ZachXBT Association: Evidence Assessment
“Readers should treat the ZachXBT association as alleged and unverified until a primary source is produced.”
reviewerNo verifiable ZachXBT post or investigation specifically addressing Tropykus RSK could be located; the association should be treated as alleged and unverified.This section models good practice: flagging an intake claim as unverified rather than asserting it. Independent research corroborates the absence of any public ZachXBT-Tropykus connection.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.