Skip to main content
• 6 min read

RISEx XLP Misconfiguration:
$673K Unauthorized USDC Withdrawal

$673,011.56 USDC was withdrawn from RISEx's XLP-linked RWA strategy after a deployment misconfiguration; July fees fully covered depositors within hours.

AUTOSEC.DEVAUTOSEC.DEV
RISEx XLP Misconfiguration: $673K Unauthorized USDC Withdrawal
  • Incident Date: August 3, 2026
  • Target: RISEx XLP vault-linked RWA strategy
  • Target Overview: RISEx is a non-custodial perpetual futures exchange built on RISE Chain. The affected component was a real-world asset (RWA) strategy associated with its XLP liquidity vault, not the independently operating RISEx trading platform.
  • Total Loss: 673,011.56 USDC (~$673,011.56) withdrawn from the strategy; RISEx covered the full amount with a portion of its July fee revenue, leaving XLP depositors with $0 in losses
  • Transaction Sender: 0xAAb85f96FeB6DaAc1E171e7e4B0118B16f1BB66d — not publicly attributed by RISEx
  • Exploit Transaction: 0xc52560bec154a3d5533a321bd9805305a5076194573ddb2fbb059059ace3e987
  • Affected Network: RISE Chain
  • Attack Vector: RWA strategy deployment misconfiguration — exact parameter and authorization failure not disclosed [NEEDS VERIFICATION]

Incident Review & Technical Details​

1. Attack Path​

  1. A misconfiguration entered production on July 13: RISEx said the affected RWA strategy had been misconfigured since its deployment on July 13, 2026. The project has not disclosed the incorrect parameter, initializer, permission, or contract-level condition that made an unauthorized withdrawal possible.
  2. An unauthorized withdrawal executed at 07:21 UTC: On August 3, address 0xAAb8...B66d submitted transaction 0xc525...e987 to contract 0x04a7...B10a5. The RISE explorer records 673,011.565895 USDC.e moving from contract 0x2C03...F818, which matches RISEx's rounded incident figure of 673,011.56 USDC. RISEx published the transaction but did not identify the sender as an attacker or disclose how that address discovered the configuration error.
  3. The RISE-side withdrawal split into two branches: Blockscout shows the received amount divided into 350,000 USDC.e and 323,011.565895 USDC.e paths through two RiseVault proxies. Each branch transferred 1 USDC.e to the same contract, while the remaining 349,999 USDC.e and 323,010.565895 USDC.e passed through a USDCMintBurnAdapter and were burned. This is the visible RISE-side execution; the reviewed sources do not document the destination-chain settlement or final receiving address.
  4. Existing withdrawal throttles did not activate: RISEx said the RISE bridge, RISEx, and XLP vault each had withdrawal throttles intended to limit exploit impact. The 673,011.56 USDC withdrawal remained below the applicable thresholds, so those controls did not stop it.
  5. RISEx detected and patched the issue within 48 minutes: The team said it detected the anomaly within minutes and completed the patch by 08:09 UTC. It then used part of the fees RISEx generated in July to cover the full strategy loss.

2. Impact Scope​

  • Strategy-Level Loss: The XLP-linked RWA strategy lost 673,011.56 USDC (~$673,011.56) in one unauthorized withdrawal.
  • Depositor Impact: RISEx fully covered the loss from July fee revenue before disclosure, so XLP depositors incurred $0 in losses and their principal was reported as unaffected.
  • Trading Platform Scope: RISEx said the exchange operated independently and continued functioning normally. The reviewed sources do not report an outage, trading-engine compromise, or unauthorized withdrawal from another strategy.
  • Configuration Scope: RISEx reviewed every transaction and deployment in the affected period and the configuration of all other XLP strategies. It reported no equivalent misconfiguration and identified this as the only unauthorized withdrawal.
  • Control-Limit Gap: Multiple withdrawal throttles existed, but the unauthorized amount was below their thresholds. The controls reduced only withdrawals large enough to cross a configured limit and did not prevent this transaction.
  • Secondary Scam Risk: RISEx warned that it would not contact users first, had created no recovery form or claim process, and advised users not to connect wallets to links claiming to relate to the incident.

3. Official Statements​

  • RISEx: In its August 3 disclosure, RISEx attributed the withdrawal to a strategy misconfiguration present since July 13, said it was not a novel attack or third-party dependency failure, and confirmed that depositors had been made whole.
  • On-Chain Evidence: The RISE explorer transaction confirms the August 3 timestamp, transaction sender, contract call, and 673,011.565895 USDC.e transfer on RISE Chain.
  • SEAL 911: RISEx said it engaged SEAL 911 for fund tracing and was attempting to contact the address involved about returning the funds. No independent SEAL 911 statement was located in the reviewed sources.

4. Investigation Progress​

RISEx patched the configuration, reimbursed the strategy from July fee revenue, reviewed other transactions and deployments, and began tracing with SEAL 911. As of August 10, 2026, no reviewed source confirmed that any funds had been returned, and the post-mortem promised in the initial disclosure had not been located.

Several technical questions remain open:

  • Which configuration value or authorization rule enabled the withdrawal, and why deployment validation did not reject it on July 13.
  • Whether 0xAAb8...B66d was controlled by the ultimate beneficiary or merely submitted the RISE-side bridge transaction.
  • Which destination address received the corresponding asset after the RISE-side USDC.e burn.
  • The exact throttle values at the RISE bridge, RISEx, and XLP vault layers, and whether limits have since been reduced or made strategy-specific.
  • Whether the transaction was possible through a public function, a permissioned role with incorrect configuration, or another mechanism.

AUTOSEC.DEV Solution​

Preventing a repeat requires treating deployment configuration, vault authorization, and withdrawal limits as one enforceable security boundary.

  1. Secure Code Review — RISEx's RWA strategy entered production on July 13 with a configuration that permitted a 673,011.56 USDC unauthorized withdrawal. AUTOSEC.DEV reviews initializer parameters, role assignments, deployment scripts, upgrade paths, and cross-contract invariants together, adding tests that fail deployment when a strategy can release assets outside its intended caller and destination policy.
  2. Security Strategy & Planning — RISEx had throttles at the bridge, exchange, and vault layers, yet the withdrawal remained below every relevant threshold. AUTOSEC.DEV designs strategy-specific exposure limits, aggregate velocity controls, destination allowlists, and circuit breakers so several individually valid layers do not reproduce the same blind spot.
  3. Incident Response — RISEx engaged SEAL 911 and began tracing while trying to contact the address involved. AUTOSEC.DEV supports transaction reconstruction across bridge boundaries, evidence preservation, address attribution, coordination with stablecoin issuers and exchanges, and a verified recovery ledger that distinguishes reimbursed users from recovered assets.

Reference​