Written by: Eric, Foresight News

Around 10:21 Beijing time today, Resolv Labs, which issues the stablecoin USR using a Delta neutral strategy, was hacked. An address starting with 0x04A2 minted 50 million USR from the Resolv Labs protocol using 100,000 USDC.

As the incident came to light, USR fell to around $0.25, and as of the time of writing, it has rebounded to around $0.8. The price of the RESOLV token also saw a short-term drop of nearly 10%.

The hacker then repeated the process, minting another 30 million USR with 100,000 USDC. With the significant decoupling of USR, arbitrage traders quickly took action, and many lending markets on Morpho that support USR and wstUSR as collateral have nearly been drained, while the Lista DAO on the BNB Chain has also paused new loan requests.

The affected lending agreements are not limited to these. In the design of the Resolv Labs protocol, users can also mint an RLP token that has greater price volatility and higher returns, but must bear compensation liabilities when the protocol incurs losses. Currently, the circulation of RLP tokens is nearly 30 million, with the largest holder, Stream Finance, holding over 13 million RLP, with a net risk exposure of about $17 million.

That's right, Stream Finance, which was previously hit by the xUSD crisis, may face another blow.

As of the time of writing, the hacker has converted USR into USDC and USDT and continues to buy Ethereum, having already purchased over 10,000. Using 200,000 USDC, they have extracted over $20 million in assets, finding their 'hundredfold coin' during the bear market.

Once again exploited due to 'lack of rigor'

The sharp decline on October 11 last year caused many stablecoins issued using Delta neutral strategies to incur collateral losses due to ADL (automatic deleveraging). Some projects that executed strategies using altcoins suffered even more severe losses or went directly bankrupt.

This time, the attacked Resolv Labs also issued USR using a similar mechanism. The project announced the completion of a $10 million seed round financing led by Cyber.Fund and Maven11, with participation from Coinbase Ventures in April 2025, and the token RESOLV was launched at the end of May and early June.

However, the reason for the attack on Resolv Labs was not extreme market conditions, but rather the design of the mechanism for minting USR was 'not rigorous enough.'

Currently, no security company or official has analyzed the reasons for this hacking incident. The DeFi community YAM has preliminarily concluded through analysis that the attack was likely caused by the SERVICE_ROLE used by the protocol's backend to provide parameters to the minting contract being controlled by hackers.

According to Grok's analysis, when users mint USR, they initiate requests on-chain and call the contract's requestMint function, with parameters including:

_depositTokenAddress: Address of the deposited token;

_amount: Amount deposited;

_minMintAmount: Minimum expected amount of USR to receive (slippage protection).

After that, users will deposit USDC or USDT into the contract. The project team's backend SERVICE_ROLE monitors requests, using the Pyth oracle to check the value of the deposited assets, then calls the completeMint or completeSwap function to determine the actual amount of USR minted.

The problem lies in the fact that the minting contract completely trusts the _mintAmount provided by the SERVICE_ROLE, believing that this number has been verified off-chain by Pyth, so it did not set upper limit restrictions and did not verify on-chain through an oracle, directly executing mint(_mintAmount).

Accordingly, YAM suspects that hackers controlled the SERVICE_ROLE that should have been controlled by the project team (possibly due to internal oracle failure, collusion, or key theft), directly setting _mintAmount to 50 million during minting, achieving an attack event that minted 50 million USR with 100,000 USDC.

Ultimately, Grok concluded that Resolv did not consider the possibility of the address (or contract) used to receive user minting requests being controlled by hackers when designing the protocol. When the request to mint USR was submitted to the final minting contract, no maximum minting amount was set, nor did it allow the minting contract to use an on-chain oracle for secondary verification, directly trusting all parameters provided by the SERVICE_ROLE.

Prevention measures were also inadequate.

In addition to speculating on the reasons for the hack, YAM also pointed out the project's inadequate crisis response preparations.

YAM stated on X that Resolv Labs paused the protocol only three hours after the first hack was completed, with about one hour of delay due to the need to collect four signatures for the multi-signature transaction. YAM believes that an emergency pause should require only one signature, and authority should be distributed as much as possible to team members or trusted external operators, which could increase awareness of on-chain anomalies, improve the likelihood of a quick pause, and better cover different time zones.

Although the suggestion that a single signature can pause the protocol is somewhat radical, requiring multiple signatures across different time zones to pause the protocol could indeed delay important matters during emergencies. Introducing trusted third parties that continuously monitor on-chain behavior or using monitoring tools with emergency pause protocol permissions are the 'lessons learned' from this incident.

Attacks on DeFi protocols are no longer limited to contract vulnerabilities. The incident involving Resolv Labs warns project teams that no assumptions about protocol security should be trusted in any link, and all parameters involved must be verified at least twice, even the backend operated by the project team.