← All Reports
⚠ HACKED — DO NOT USE

Resolv wstUSR

5.0
wstUSR (Wrapped Staked USR) / Ethereum (primary), multi-chain (Arbitrum, Base) / February 9, 2026 (Updated: March 22, 2026)
View full report on GitHub →

Score Breakdown

Overview

Resolv is a protocol maintaining USR, a stablecoin pegged to the US Dollar, backed by a delta-neutral strategy using ETH, BTC, and stablecoins. The protocol hedges spot crypto holdings with short perpetual futures positions to create a market-neutral portfolio.

wstUSR (Wrapped Staked USR) is the non-rebasing, DeFi-composable wrapper for stUSR (Staked USR). The token flow is:

  1. USR → User deposits USR into the stUSR contract → receives stUSR (a rebasing token whose balance grows as rewards accrue)
  2. stUSR → User wraps stUSR into the wstUSR contract → receives wstUSR (a non-rebasing ERC-4626 vault token whose price appreciates)
  3. Alternatively, users can deposit USR directly into wstUSR (which internally deposits into stUSR first)

wstUSR is analogous to Lido's wstETH: it's a non-rebasing wrapper around a rebasing staked token. This makes it compatible with DeFi protocols (lending, AMMs) that don't support rebasing tokens natively.

Yield source: The stUSR yield derives from the Resolv protocol's delta-neutral strategy profits. The RewardDistributor contract mints USR rewards and drips them into the stUSR contract, increasing the stUSR/USR exchange rate over time. Since wstUSR wraps stUSR, it captures the same yield through exchange rate appreciation.

Key metrics (Feb 9, 2026):

  • wstUSR Price: ~$1.13 (CoinGecko)
  • wstUSR Market Cap: ~$344.8M
  • wstUSR Supply: ~305.1M tokens
  • wstUSR Exchange Rate: 1 wstUSR = ~1.1304 USR (onchain convertToAssets(1e18))
  • stUSR Total Supply: ~347.2M (rebased, in USR terms)
  • stUSR Staked in wstUSR: ~344.9M stUSR (99.3% of all stUSR is wrapped)
  • USR Backing stUSR: ~347.2M USR held by stUSR contract
  • USR Total Supply: ~350.7M
  • 24h Trading Volume: ~$2.6M
  • stUSR APY: ~7.36% (1-year price change of wstUSR per CoinGecko)
  • Total Protocol TVL: ~$447.8M (Ethereum, DeFiLlama)

Links:

Risk Summary

Key Strengths

  • Programmatic exchange rate: Unlike RLP (where price is set offchain), wstUSR exchange rate is computed onchain via ERC-4626 standard. Anyone can verify.
  • Senior tranche: wstUSR/stUSR holders are protected by RLP, which absorbs all losses before USR is affected. wstUSR is fundamentally a yield-bearing wrapper around a USD-pegged stablecoin.
  • Extensive audit coverage: wstUSR specifically audited by Pashov, Pessimistic, and Sherlock. 14+ total protocol audits.
  • Permissionless wrapping: No whitelist needed to wrap/unwrap wstUSR/stUSR. Only minting/redeeming USR requires whitelist.
  • Strong DeFi adoption: ~$593M TVL across 25 pools. Integrated with Fluid, Curve, Morpho, Pendle, Balancer V3, Convex, Yearn.
  • 1:1 stUSR backing verified onchain: USR.balanceOf(stUSR) == stUSR.totalSupply() (verified Feb 9, 2026).

Key Risks

  • Centralized reward distribution: The RewardDistributor is controlled by the multisig. If rewards stop, wstUSR exchange rate stops growing.
  • Upgradeable proxies: Both stUSR and wstUSR are upgradeable (3-day timelock for implementation changes). A malicious upgrade could compromise funds.
  • USR peg dependency: wstUSR value is fundamentally tied to USR maintaining its $1 peg. Any USR depegging directly impacts wstUSR.
  • Whale frontrunning acknowledged: The known issue where MEV bots can frontrun reward distributions for stUSR has been acknowledged but not fixed.
  • Underlying collateral risks: wstUSR inherits all risks of the Resolv collateral pool (CEX counterparty, funding rate volatility, etc.), albeit protected by RLP as first-loss capital.

Critical Risks

  • Proxy upgrade with 3-day timelock: While the timelock provides a review window, the 3-of-5 anonymous signers could propose a malicious upgrade. The 3-day window is the only safeguard.
  • RewardDistributor is not upgradeable but is controlled by the multisig for allocating rewards. If the multisig is compromised, reward allocation could be manipulated (though this would affect yield, not principal).
Full Report

Contract Addresses

Core Token Contracts (Ethereum)

Contract Address Type
USR (Stablecoin) 0x66a1e37c9b0eaddca17d3662d6c05f4decf3e110 ERC-20, Upgradeable Proxy
stUSR (Staked USR) 0x6c8984bc7DBBeDAf4F6b2FD766f16eBB7d10AAb4 Rebasing ERC-20, Upgradeable Proxy
wstUSR (Wrapped Staked USR) 0x1202F5C7b4B9E47a1A484E8B270be34dbbC75055 ERC-4626 Vault, Upgradeable Proxy
RewardDistributor 0xbE23BB6D817C08E7EC4Cd0adB0E23156189c1bA9 Non-proxy

Proxy Implementation & Admin (Ethereum, verified onchain)

Contract Implementation ProxyAdmin
stUSR 0xba1600735a039e2b3bf1d1d2f1a7f80f45973da7 0xeb88058615eaf3e4833af053484012c4d6cbfa37
wstUSR 0x6ed5485d079d7f0cfa8e395499b3c01a6c359cc0 0xD89784610EefD4d11444788F7A85AaDfd57AF7E5

Cross-Chain Deployments

Chain wstUSR Address
Arbitrum 0x66cfbd79257dc5217903a36293120282548e2254
Base 0xb67675158b412d53fe6b68946483ba920b135ba1

Protocol Infrastructure (Ethereum)

Contract Address
USR Requests Manager 0xAC85eF29192487E0a109b7f9E40C267a9ea95f2e
USR Counter 0xa27a69Ae180e202fDe5D38189a3F24Fe24E55861
Whitelist 0x5943026E21E3936538620ba27e01525bBA311255
Fee Collector 0x6E02e225329E32c854178d7c865cF70fE1617f02
Gnosis Safe (3/5 multisig) 0xd6889f307be1b83bb355d5da7d4478fb0d2af547
TimelockController (3-day) 0x290d9544669c9c7a64f6899a0a3b28d563f6ebee
Treasury 0xacb7027f271b03b502d65feba617a0d817d62b8e

Audits and Due Diligence Disclosures

Resolv has undergone extensive auditing with 4 audit firms across 14+ audit engagements since May 2024. wstUSR and stUSR have been specifically audited in dedicated engagements.

wstUSR/stUSR-Specific Audits

# Date Scope Firm Key Findings Reports
1 May-Jun 2024 USR, stUSR, Whitelist, Request Managers, RewardDistributor MixBytes, Pessimistic stUSR core design reviewed MixBytes, Pessimistic
2 Jul-Aug 2024 wstUSR (dedicated) Pashov, Pessimistic 4 Medium + 3 Low (all resolved): rounding in unwrap, mintWithPermit wrong amount, previewWithdraw rounding, free withdraw via zero previewWithdraw, whale frontrunning rewards, EIP-4626 non-compliance, dust accumulation Pashov, Pessimistic
3 Nov-Dec 2024 Full Core Protocol (incl. wstUSR, stUSR) Sherlock 1 Medium: inflation attack on wstUSR deposits via stUSR share price manipulation (fixed via initial deposit mitigation + PR #222) Sherlock
4 Apr-May 2025 RewardDistributor with drip model (feeds stUSR) Pashov 1 Medium (withdraw bypass of claimEnabled), 2 Low (dripReward sandwiching, dust reward vesting) Pashov (Apr), Pashov (May)
5 Jul-Aug 2025 ResolvStakingV2 Pashov, MixBytes 1 Critical (rewards stolen via self-transfer, resolved), 2 Low Pashov, MixBytes

Full Audit History

The complete Resolv audit history covers 14+ engagements by MixBytes, Pashov Audit Group, Sherlock, and Pessimistic across all protocol contracts. See the RLP risk assessment for the complete audit table.

Bug Bounty

  • Platform: Immunefi
  • Maximum Bounty: $500,000
  • Critical Reward: 10% of funds at risk, up to $500K (minimum $100K guaranteed)
  • High Reward: $50,000 - $100,000
  • Medium Reward: $5,000
  • Program Type: Primacy of Impact
  • wstUSR/stUSR in scope: Yes, both contracts are covered

Known acknowledged issues:

  • Whale frontrunning of reward distribution (stUSR): A user can monitor the mempool for dripReward transactions, deposit USR into stUSR before rewards are distributed, and withdraw after to capture a portion. The team acknowledges this.
  • EIP-4626 partial non-compliance (wstUSR): totalAssets() returns stUSR.totalSupply() instead of USR managed specifically by wstUSR. Resolved in later versions.

Historical Track Record

  • Production History: stUSR and wstUSR launched alongside the core protocol in September 2024. In production for ~17 months.
  • TVL Growth: wstUSR market cap ~$344.8M. stUSR TVL ~$347M (DeFiLlama). The vast majority (99.3%) of stUSR is wrapped as wstUSR.
  • Exchange Rate History: wstUSR has appreciated from ~$1.00 (launch) to ~$1.13 (Feb 2026), representing ~13% cumulative yield. ATL was $0.59 (likely from low initial liquidity/launch pricing per CoinGecko). ATH is $1.13 (current).
  • CRITICAL INCIDENT (March 22, 2026): A single EOA holding SERVICE_ROLE on the USR Counter contract exploited the requestSwap() → completeSwap() flow. The attacker deposited ~100K USDC via requestSwap(), then the SERVICE_ROLE EOA called completeSwap() minting 50M USR (not the ~100K owed). A second mint followed for 30M USR. Total: ~80M USR minted without corresponding collateral. The attacker wrapped USR to wstUSR (for better DEX liquidity), dumped across KyberSwap and Velora at $0.50–$0.88, converted proceeds to ETH via Uniswap V4 and MetaMask Swaps. ~$25M+ extracted from ~$200K input. ~36M USR still held by attacker (worth ~$2M at depressed prices), still being dumped.
  • Root cause: No onchain issuance caps, no collateral ratio enforcement in completeSwap(), no oracle sanity checks, no multisig requirement on SERVICE_ROLE, no proof of reserves oracle.
  • Underlying Stability: USR peg collapsed to $0.50–$0.88 during the dump.
  • Protocol TVL: ~$447.8M total Resolv protocol TVL on Ethereum (DeFiLlama) prior to incident.

Funds Management

Token Mechanism (stUSR → wstUSR)

stUSR is a rebasing ERC-20 token (similar to Lido's stETH):

  • Underlying token: USR
  • Users deposit USR to receive stUSR shares
  • stUSR uses an internal shares model: balanceOf(user) = shares[user] * totalPooled / totalShares
  • When the RewardDistributor drips USR rewards into the stUSR contract, the totalPooled USR increases, causing all stUSR balances to grow proportionally
  • Onchain state (verified Feb 9, 2026):
    • totalSupply() (rebased): ~347.2M stUSR
    • totalShares(): ~307.1B internal shares
    • underlyingToken(): USR (0x66a1e...)
    • USR held by stUSR contract: ~347.2M (1:1 backing verified)

wstUSR is an ERC-4626 vault (similar to Lido's wstETH):

  • Underlying asset: USR (per asset() = 0x66a1e...)
  • wstUSR wraps stUSR internally -- holds ~344.9M stUSR (99.3% of all stUSR)
  • Non-rebasing: wstUSR balance stays constant, but convertToAssets() increases over time
  • Exchange rate onchain (verified Feb 9, 2026):
    • convertToAssets(1e18) = 1.1304 USR per wstUSR
    • convertToShares(1e18) = 0.8846 wstUSR per USR
    • totalAssets() = ~344.9M USR
    • totalSupply() = ~305.1M wstUSR
  • maxDeposit() = type(uint256).max (no deposit cap)

Reward Distribution

The RewardDistributor contract (0xbE23BB6D817C08E7EC4Cd0adB0E23156189c1bA9) was originally responsible for feeding yield to stUSR:

  • Was designed to mint USR rewards and transfer them to the stUSR contract
  • Uses a drip model: rewards are linearly vested over a DRIP_DURATION period
  • SERVICE_ROLE revoked on May 26, 2025 (block 22566879) — RewardDistributor can no longer mint USR. Any call to distribute() would revert.
  • Not a proxy contract (non-upgradeable)

USR Minting — SERVICE_ROLE Holders (verified March 22, 2026)

The USR contract uses SERVICE_ROLE (0xd8a7a7...) to gate minting. The mint() function has no supply cap or rate limit.

Address Contract Can Mint? Constraints
0xd6889f307be1b83bb355d5da7d4478fb0d2af547 Gnosis Safe (3/5 multisig) YES NONE — can mint any amount to any address. Granted today (block 24711594).
0xAC85eF29192487E0a109b7f9E40C267a9ea95f2e USR Requests Manager YES Requires prior collateral deposit + whitelist
0xa27a69ae180e202fde5d38189a3f24fe24e55861 USR Counter (TheCounter) YES Requires prior token deposit via requestSwap()
0x60a7b7915980ed34fde6e239618fadcf67897c37 UsrRedemptionExtension NO Has role but only burns, never mints

CRITICAL — EXPLOIT (March 22, 2026): A single EOA with SERVICE_ROLE exploited the USR Counter's completeSwap() function. The kill chain: attacker called requestSwap() depositing ~100K USDC, then the SERVICE_ROLE EOA called completeSwap() minting 50M USR (instead of ~100K). A second mint followed for 30M USR. Total ~80M unbacked USR minted. The attacker then wrapped USR → wstUSR (better DEX liquidity) and dumped across KyberSwap + Velora at $0.50–$0.88, converting to ETH via Uniswap V4. ~$25M+ extracted from ~$200K input.

Root cause: completeSwap() does not enforce that the minted amount matches the deposited collateral. There were no onchain issuance caps, no collateral ratio checks, no oracle sanity checks, no multisig requirement on the SERVICE_ROLE EOA, and no proof of reserves oracle.

Accessibility

  • Wrapping/Unwrapping wstUSR: Permissionless. Anyone can:
    • deposit(uint256 usrAmount) → deposit USR, receive wstUSR
    • wrap(uint256 stUSRAmount) → wrap stUSR, receive wstUSR
    • unwrap(uint256 wstUSRAmount) → burn wstUSR, receive stUSR
    • redeem(uint256 wstUSRAmount) → burn wstUSR, receive USR
  • Staking USR to stUSR: Permissionless. Anyone can deposit USR into stUSR.
  • Minting/Redeeming USR: Requires allowlisted wallets (whitelisted by Resolv Digital Assets Ltd). Uses requestMint()/requestBurn() flow on USR Requests Manager.
  • Atomic operations: Wrapping/unwrapping wstUSR and staking/unstaking stUSR are atomic single-transaction operations. Minting/redeeming USR is a multi-step backend process (1-24h).
  • Fees: No fees for wrap/unwrap or stake/unstake operations.

Collateralization

  • wstUSR backing: wstUSR is 100% backed by stUSR, which is 100% backed by USR. Verified onchain: stUSR contract holds ~347.2M USR for ~347.2M stUSR supply (pre-incident).
  • USR backing: COMPROMISED. ~80M USR was minted on March 22, 2026 without corresponding collateral via the USR Counter completeSwap() exploit. USR is no longer fully backed by the delta-neutral collateral pool.
  • No leverage: wstUSR does not add leverage -- it is a direct wrapper around the staked stablecoin.
  • Risk hierarchy: Unlike RLP, wstUSR is in the senior tranche -- RLP absorbs all losses before any impact to USR/stUSR/wstUSR holders. However, the unbacked mint may exceed RLP's absorption capacity.

Provability

  • wstUSR exchange rate: Calculated programmatically onchain via ERC-4626 convertToAssets()/convertToShares(). Based on stUSR.totalSupply() / stUSR.totalShares() ratio. Anyone can verify.
  • stUSR backing: USR held by stUSR contract is fully onchain and verifiable. USR.balanceOf(stUSR) == stUSR.totalSupply() (verified).
  • Reward distribution: The RewardDistributor drip schedule is observable onchain. The amount and frequency of reward allocations are controlled by a privileged role.
  • Underlying USR collateral: Verified via Apostro dashboard and protocol collateral pool dashboard.

Liquidity Risk

Primary Exit Mechanisms

  1. Unwrap to stUSR → Unstake to USR: Atomic operations. wstUSR → stUSR → USR, all permissionless and instant.
  2. Redeem USR to USDC/USDT/ETH: Uses USR Requests Manager. Requires whitelist. Processed within 1-24 hours by backend.
  3. DEX swap: Sell wstUSR directly on Curve, Fluid, Balancer, or other DEXes.

DEX Liquidity (Feb 9, 2026, via DeFiLlama & CoinGecko)

Protocol Chain Pool TVL 7d Volume
Curve Ethereum DOLA-wstUSR $37.3M $3.8M
Fluid DEX Ethereum wstUSR-USDC $3.7M $15.8M
Fluid DEX Arbitrum wstUSR-USDC $591K $1.4M
Fluid DEX Base USDC-wstUSR $403K $1.5M
Total DEX ~$42.2M ~$22.5M/7d

Lending Market Integrations (wstUSR as collateral)

Protocol Chain TVL Notes
Fluid Lending Ethereum $65.5M + $34.3M + $333K wstUSR/USDC, wstUSR/USDT, wstUSR/GHO pairs
Fluid Lending Arbitrum $11.7M + $7.5M wstUSR/USDT, wstUSR/USDC pairs
Morpho Arbitrum $4.6M + $1.2M wstUSR collateral vaults
Morpho Ethereum $25K wstUSR collateral vault
Total Lending ~$125.1M

Additional DeFi Integrations

Protocol Chain TVL Notes
Convex Ethereum $37.2M DOLA-wstUSR Curve LP
Inverse Finance (FiRM) Ethereum $37.2M + $2.2M DOLA-wstUSR lending + Yearn vault
Pendle Ethereum $118K wstUSR yield tokenization
Rheo Ethereum $1.3M PT-wstUSR-29JAN2026
StakeDAO Ethereum $20K DOLA-wstUSR
Yearn Ethereum $69K DOLA-wstUSR vault
Total Additional ~$78.1M

Liquidity Summary

  • Total wstUSR/stUSR DeFi TVL: ~$593M across 25 pools (DeFiLlama)
  • 24h Trading Volume: ~$2.6M (CoinGecko)
  • Primary liquidity: Fluid (lending + DEX), Curve DOLA-wstUSR pool
  • Instant unwrap: wstUSR → stUSR → USR is atomic and permissionless (no delay)
  • USR redemption: 1-24h via backend, requires whitelist
  • Multi-chain: Available on Ethereum (primary), Arbitrum, Base, Plasma via LayerZero OFT

Centralization & Control Risks

Governance

  • Multisig: All core contracts controlled by a 3-of-5 Gnosis Safe at 0xd6889f307be1b83bb355d5da7d4478fb0d2af547. Controls DEFAULT_ADMIN_ROLE for stUSR, wstUSR, USR, RewardDistributor, and all infrastructure contracts.
  • Timelock: A 3-day OpenZeppelin TimelockController at 0x290d9544669c9c7a64f6899a0a3b28d563f6ebee owns all ProxyAdmin contracts. Contract upgrades require a 3-day delay.
  • ProxyAdmins: stUSR ProxyAdmin at 0xeb88058615eaf3e4833af053484012c4d6cbfa37, wstUSR ProxyAdmin at 0xD89784610EefD4d11444788F7A85AaDfd57AF7E5. Both owned by the timelock.
  • Split architecture: Multisig controls operational parameters directly (no delay) -- pausing, role grants, parameter changes. Timelock only gates proxy upgrades.
  • Onchain governance not yet live: stRESOLV token exists but Snapshot voting has not been initiated.
  • All 5 signers are EOAs (not publicly identified).

Programmability

  • wstUSR exchange rate: Fully programmatic. Calculated onchain via ERC-4626 standard: convertToAssets() = stUSR totalSupply / totalShares. No admin input needed for exchange rate.
  • stUSR rebasing: Programmatic based on USR balance in the contract. When RewardDistributor drips USR, balances rebase automatically.
  • Reward distribution: Controlled by a privileged role on the RewardDistributor. The allocateReward() function is called by an admin to set reward amounts. The drip schedule is then programmatic.
  • Wrapping/unwrapping: Fully programmatic, no admin involvement.

External Dependencies

  • USR stability: wstUSR's value is fundamentally tied to USR maintaining its $1 peg. USR is backed by the delta-neutral collateral pool.
  • RewardDistributor: A single non-proxy contract controlled by the multisig. If it stops distributing rewards, wstUSR exchange rate stops growing (no loss of principal, just no yield).
  • LayerZero: Used for cross-chain bridging of wstUSR (OFT standard).
  • Underlying collateral dependencies: Same as the broader Resolv protocol -- CEX counterparty risk (Binance, Deribit, Bybit), DeFi integrations (Aave, Lido, EtherFi), oracle providers (Pyth, Chainlink, Chronicle, RedStone).

Operational Risk

  • Team Transparency: Team is partially doxxed via CoinGecko (Ivan Kozlov CEO, Tim Shekikhachev CPO, Fedor Chmilev CTO with LinkedIn/Twitter). Not prominently displayed on protocol website.
  • Company founded: 2023 (Resolv Labs).
  • Legal Structure: Two BVI entities: Resolv Labs Ltd (frontend/app) and Resolv Digital Assets Ltd (RDAL) (token issuance, collateral pool). A Resolv Foundation manages protocol revenue.
  • Jurisdiction: British Virgin Islands (BVI).
  • Investors: $10M seed round led by Cyber Fund and Maven 11. Other investors: Coinbase Ventures, Arrington Capital, Robot Ventures, Animoca Brands, Ether.fi.
  • Documentation: Comprehensive litepaper at docs.resolv.xyz. Quarterly reports and parameter updates published.
  • Incident Response: No documented incident response plan found. Bug bounty and onchain monitoring exist.

Monitoring

wstUSR Exchange Rate Monitoring

  • wstUSR contract: 0x1202F5C7b4B9E47a1A484E8B270be34dbbC75055
    • Monitor convertToAssets(1e18) for exchange rate changes. Current: ~1.1304 USR/wstUSR.
    • Alert: If exchange rate decreases (should only ever increase). Any decrease indicates a potential issue with the stUSR contract or reward distribution.
    • Alert: If exchange rate growth stops for >48 hours (indicates RewardDistributor has stopped dripping rewards).
    • Monitor Deposit, Withdraw events for large deposits/withdrawals (>$1M).
    • Threshold: Alert on single deposits/withdrawals >$5M (potential whale activity or stress signals).

stUSR Backing Verification

  • stUSR contract: 0x6c8984bc7DBBeDAf4F6b2FD766f16eBB7d10AAb4
    • Monitor USR.balanceOf(stUSR) vs stUSR.totalSupply(). These should be approximately equal (1:1 backing).
    • Alert: If USR.balanceOf(stUSR) < stUSR.totalSupply() * 0.99 (under-collateralization by >1%).
    • Monitor totalShares() and totalSupply() for the shares-to-tokens ratio.
    • Monitor Transfer events for large movements (>$5M).

RewardDistributor Monitoring

  • RewardDistributor: 0xbE23BB6D817C08E7EC4Cd0adB0E23156189c1bA9
    • Monitor RewardDripped events -- tracks when rewards are released to stUSR.
    • Alert: If no RewardDripped event for >48 hours (rewards should drip approximately daily).
    • Monitor RewardAllocated events -- tracks when new reward amounts are set.
    • Threshold: Alert if allocated reward amount changes by >50% from previous allocation (significant yield change).
    • Monitor USR balance of RewardDistributor -- this is the pending rewards to be dripped.

Governance & Proxy Monitoring

  • Multisig: 0xd6889f307be1b83bb355d5da7d4478fb0d2af547

    • Monitor for owner changes, threshold changes, module additions.
    • Alert: Immediately on any signer replacement or threshold change.

  • Timelock: 0x290d9544669c9c7a64f6899a0a3b28d563f6ebee

    • Monitor CallScheduled, CallExecuted, Cancelled events.
    • Alert: Immediately on any CallScheduled event (3-day window to review proxy upgrades).
    • Cross-reference scheduled calls against stUSR ProxyAdmin (0xeb8805...) and wstUSR ProxyAdmin (0xD89784...) addresses.

  • stUSR ProxyAdmin: 0xeb88058615eaf3e4833af053484012c4d6cbfa37

    • Monitor for Upgraded events on stUSR proxy (implementation change).
    • Alert: Immediately on any implementation change.

  • wstUSR ProxyAdmin: 0xD89784610EefD4d11444788F7A85AaDfd57AF7E5

    • Monitor for Upgraded events on wstUSR proxy (implementation change).
    • Alert: Immediately on any implementation change.

Liquidity Monitoring

  • Curve DOLA-wstUSR pool: Monitor TVL. Current: ~$37.3M.

    • Alert: If pool TVL drops below $10M (liquidity deterioration).
    • Alert: If pool imbalance exceeds 80/20 in either direction (potential depegging pressure).

  • Fluid lending markets (Ethereum):

    • wstUSR/USDC: TVL $65.5M
    • wstUSR/USDT: TVL $34.3M
    • Alert: If utilization rate exceeds 98% (liquidity crunch risk).
    • Alert: If wstUSR collateral liquidations occur (signals stress).

  • CoinGecko wstUSR price: Monitor for deviations from expected exchange rate.

    • Alert: If CoinGecko price deviates >2% from onchain convertToAssets() * USR_price (indicates market mispricing or DEX imbalance).

USR Collateral Pool Monitoring

  • USR Collateralization Ratio: Monitor via Apostro dashboard.
    • Alert: If CR drops below 120% (approaching stress levels for the entire Resolv system).
    • Alert: If CR drops below 110% (RLP redemption gate triggers -- indirect impact on wstUSR if USR confidence is shaken).
  • USR Peg: Monitor USR price on DEXes.
    • Alert: If USR deviates >0.5% from $1.00 peg (significant depegging).
    • Alert: If USR deviates >2% from $1.00 peg (critical depegging -- wstUSR value directly impacted).

Monitoring Frequency

Category Frequency Priority
Timelock scheduled calls Real-time Critical
Proxy upgrade events Real-time Critical
Multisig signer changes Real-time Critical
wstUSR exchange rate Every 6 hours High
stUSR backing (USR balance) Every 6 hours High
RewardDistributor drip events Daily High
USR peg stability Hourly High
DEX pool TVL/balance Hourly Medium
Lending market utilization Hourly Medium
USR Collateralization Ratio Daily Medium

Reassessment Triggers

  • TRIGGERED (March 22, 2026): ~80M unbacked USR minted via completeSwap() exploit. ~$25M+ extracted. Score overridden to 5.0.
  • Reassessment conditions: Only reassess if Resolv (1) fully accounts for the unbacked mint (burns or collateralizes the 80M USR), (2) revokes all EOA SERVICE_ROLE grants, (3) implements onchain issuance caps and collateral ratio checks in completeSwap(), and (4) submits to an independent audit of the incident and remediation.
Submit report inaccuracy