cryptosecurity

Re treats independent security review as a standing requirement, not a one-time milestone. Sherlock recently completed a security audit of the NAV oracle stack, which publishes the daily onchain value of reUSD and reUSDe.
The Importance of Oracle Audits
Oracles are a critical component of DeFi infrastructure. An oracle is the connection between a protocol and the outside world: the mechanism that brings offchain price data onchain for smart contracts to act on.
Lending Markets: need to know what a borrower's collateral is worth.Perpetuals Exchanges: require the price of the asset being traded.Stablecoins: must continually track the value of the reserves behind them.
That data doesn't exist onchain on its own; an oracle reports it, and every contract downstream treats that report as a source of truth.
That very importance of oracles also makes them a constant target. A protocol's smart contracts will act automatically on any price they're handed, so they can be targeted via oracle exploits even if they're written and audited perfectly. If an exploit corrupts the price that an oracle reports, the contract has no way to know it. It executes exactly as designed, but it does so on a number that is false, with the potential for the protocol to be drained of millions of dollars in the process.
That threat is real, not hypothetical. DeFi protocols were drained of roughly $40 million via oracle exploits in July alone, and one affected protocol was forced to shut down operations entirely. For any protocol that prices assets onchain, oracle security is a continuous and existential concern. Any responsible engineering team stays diligent as a matter of course, but that diligence has a limit: a team can test only for the failures it can foresee. Independent auditors are a critical bulwark to cover anything that the team may have missed.
About the Audit
As the means by which the daily mint and redeem price for reUSD and reUSDe are published onchain, Re's NAV oracle is the most consequential pricing component in the protocol. That published figure is the reference integrators read from and the value that the protocol's smart contracts use when minting and redeeming.
The oracle is therefore one of the highest-value surfaces an attacker can reach: if the published figure were wrong, everything downstream that trusted it would be wrong alongside it. That makes independent review essential, and Re treats it that way.
Toward this end, Re contracted with Sherlock [1], a security firm built around adversarial review, structured so that independent researchers are rewarded for the vulnerabilities they surface. For this engagement, security researchers KupiaSec and vinica_boy examined the NAV oracle stack from July 15 to 18, 2026.
The Results
Sherlock sorts audit findings into three categories:
High: directly exploitable security vulnerabilities that require urgent attentionMedium: security vulnerabilities that may not be directly exploitable or may be exploitable only under certain conditions, and must be addressedLow/Informational: non-exploitable, informational findings that do not pose a security risk or impact the system's integrity, and are not considered a priority for remediation
Re's audit produced zero High, one Medium, and five Low/Informational findings.
The single Medium finding was not exploitable by an unprivileged outside attacker; it required control of an authorized NAV-submission key. Even with that key, however, an attacker could only have raised the NAV slightly beyond the system's intended cap by splitting one increase into several smaller steps, rather than moved it freely. The underlying issue was a gap between how the system behaved and how its documentation described it.
The Low/Informational findings were all minor edge cases, none of them exploitable by an outside attacker.
All issues were addressed before the audit report was published, as confirmed by the report itself. The report may be viewed here [2].
A Commitment to Security and Transparency
This audit adds to an existing record rather than beginning a new one. Re maintains an ongoing commitment to security and transparency.
Re's smart contracts have been audited [3] by Hacken and Certora across multiple engagements and formally verified by Certora. The protocol's reserves are attested daily by The Network Firm and published onchain through Chainlink. The Sherlock audit brings the newest and most price-critical component of the system under the same discipline. The onchain component of Re's business is held to the same scrutiny the offchain reinsurance side has always required: no one extends trust to an unexamined balance sheet. All audit results are available to users on the Re App (https://app.re.xyz).
About Re
Re is the onchain protocol connecting real-world reinsurance capital with decentralized finance. Its flagship product, reUSD, is a deposit token issued by Resilience Foundation Cayman LLC and made available to non-U.S. persons in specific geographies. The Re ecosystem brings together the onchain "re" protocol at re.xyz, operated by Resilience Foundation Cayman LLC, with the regulated reinsurance business under the "Cover Re" brand at coverre.com, operated by Cover Reinsurance SPC Ltd., a Cayman Islands Class B(iii) licensed exempted segregated portfolio company. Resilience Foundation, Resilience (BVI) Ltd, and Resilience Inv SPC do not provide insurance or reinsurance services and do not hold an insurance license. Learn more at re.xyz.
About Sherlock
Sherlock provides complete lifecycle security for onchain systems, from development through launch and live operations. Its work spans private audits, contests, AI-native security reviews, bug bounties, and exploit coverage, giving teams different ways to pressure-test code before and after it reaches production. For Re, Sherlock conducted a private audit of the NAV oracle stack, focusing on the contracts and integrations responsible for pricing reUSD and reUSDe onchain. Learn more at sherlock.xyz.
Learn More
For a full accounting of protocol metrics, visit the Re App. For more on the protocol, visit the Re docs.
Visit the Re App: https://app.re.xyz
#reinsurance #CryptoSecurity #AuditReport
Sources
https://sherlock.xyzhttps://sherlock-files.ams3.digitaloceanspaces.com/reports/2026.07.25%20-%20Final%20-%20Re.xyz%20Collaborative%20Audit%20Report%201784984640.pdfhttps://docs.re.xyz/transparency-and-data-show-me-the-receipts/audits-attestations-custody-structure
Disclosures
This blog post is for informational and educational purposes only and does not constitute investment, legal, tax, or financial advice. Nothing in this article should be construed as an offer or solicitation to buy or sell any security, token, or financial product.
Affiliate disclosure. The "re" brand, the re protocol, and re.xyz are operated by Resilience Foundation Cayman LLC ("Resilience Foundation"), an Exempted Limited Guarantee Foundation Company incorporated in the Cayman Islands with Limited Liability with registered number IC-414560, together with its affiliate Resilience (BVI) Ltd and Resilience Inv SPC. Resilience Foundation, Resilience BVI, and Resilience Inv do not provide insurance or reinsurance services, do not act as insurance broker or agent, and do not hold an insurance license. All regulated reinsurance activities are conducted exclusively by Cover Reinsurance SPC Ltd. ("Cover Re SPC"), a Class B(iii) licensed exempted segregated portfolio company in the Cayman Islands, operating under the "Cover Re" brand at coverre.com.
Risk disclosure. Digital assets and blockchain-based products involve significant risk, including the potential loss of principal, smart contract vulnerabilities, liquidity constraints, and regulatory uncertainty. Any references to APR, returns, or performance are not guaranteed, and past performance is not a reliable indicator of future results.
Regulatory environment. The regulatory environment for digital assets, stablecoins, tokenized real-world assets, and onchain financial products is dynamic and continues to evolve across jurisdictions. The information in this post reflects the understanding as of the date of publication and may not reflect subsequent legal or regulatory developments. Readers should consult qualified legal, tax, and financial professionals before making any decisions.
Terms apply. For full terms, disclosures, and risk disclaimers, please see the Re website (https://re.xyz), Terms of Service (https://re.xyz/terms), and Disclaimers (https://docs.re.xyz/disclaimers).

今晚一个容易被低估的热信号，不是涨跌，而是一则安全事件。
首尔警方披露，假 Flare 质押网站盗走了价值 850 万美元的 XRP。很多人看到这种新闻，第一反应还是“别乱点链接”。这当然没错，但如果只停在安全提醒，还是低估了它对普通用户的真实杀伤力。
真正贵的，往往不是当下少掉的那一笔币，而是后面整条资金安排被一起打断。
为什么这么说？
因为对大多数人来说，链上资产并不是孤立存在的。有人拿它覆盖下个月房租，有人准备拿它付团队协作工具和广告预算，也有人只是想把一部分利润落下来，变成未来两周能用、能花、能应急的钱。
一旦资产在错误的链接里被转走，损失会立刻从“账面亏损”升级成“现金流断层”。
第一层影响，是计划被迫中断。
你原本以为自己只是持有一笔波动资产，实际上你持有的是未来几天的付款能力。订阅要续，差旅要订，工资和报销要打，生活开销不会因为链上出了事就自动暂停。很多人到这一步才发现，自己没有把“可波动的钱”和“近期要用的钱”分开。
第二层影响，是时间成本被放大。
安全事件发生后，最麻烦的常常不是截图、报警、提交材料这些动作本身，而是你会被迫在最不想动脑的时候，重新搭建一条新的资金路径。原本已经熟悉的提取、结算、支付节奏突然失效，接下来每一笔现实支出都开始变得不确定。
第三层影响，是决策开始变形。
人在资金链条被打断时，最容易做出两类错误决定：一类是为了补损失继续冒险，另一类是为了求快，临时走自己并不熟悉的路径。前者会把风险继续放大，后者则会把操作失误和费用损耗一起放大。
所以，比“别点假链接”更重要的，是提前给资金后半程留后路。
我更建议把钱至少拆成三层。
第一层是波动仓，接受价格起伏，但默认这部分不是马上要花的钱。
第二层是缓冲仓，覆盖未来 7 到 30 天的现实开销，重点不是收益率，而是稳定、可调度、可回退。
第三层是即用仓，专门服务已经确定会发生的支付动作，比如订阅、差旅、日常消费、团队小额支出。它最重要的标准不是“理论上能不能转”，而是临到要用时能不能顺滑完成。
很多人平时只研究前半程：怎么买、怎么赚、怎么涨。可一旦市场有波动，或者安全事件突然发生，真正决定体验的往往是后半程：怎么落袋、怎么提取、怎么接到现实生活。
这也是为什么我一直觉得，普通用户最该提前演练的，不是下一次暴涨时怎么买，而是如果今晚就要把一部分资金变成可支配余额，自己的路径是否足够顺、足够稳、足够有备用方案。
如果你最近就在整理这条后半程动线，payall.pro 这类偏实际支付与资金衔接的入口，可以作为参考。重点不是追求某个“最优解”，而是尽早把熟悉、可执行、能回退的方案准备好。
安全新闻真正提醒我们的，从来不只是防骗。
它提醒的是：账上有币，不等于手里有钱。真正稳的人，防的不只是价格波动，也防现金流突然断掉。
#XRP #CryptoSecurity