RISEx XLP Vault RWA Strategy Misconfiguration

T-X (July 13, 2026): RISEx deploys a Real World Asset (RWA) strategy linked to its XLP vault. A misconfiguration in the strategy's access control is introduced at deployment and remains undetected for approximately three weeks. T0 (August 3, 2026, 07:21:58 UTC, block 18135959): An unauthorized withdrawal of 673,011.565895 USDC.e occurs from the RWA strategy. The transaction is initiated by caller address 0xAAb85f96FeB6DaAc1E171e7e4B0118B16f1BB66d interacting with contract 0x04a7934245c9B804082e391Ee077c130d31B10a5. Funds are routed internally through two RiseVault contracts, then to a TransparentUpgradeableProxy, and finally to a USDCMintBurnAdapter contract, which burns the USDC.e — indicating an off-chain or cross-chain redemption pathway rather than a simple wallet transfer. T+minutes: RISEx's team detects the unauthorized withdrawal within minutes of its occurrence, per their own subsequent public statement. T+48 minutes (08:09 UTC): The team deploys a patch resolving the misconfiguration; all other components of the RISEx platform continue operating normally throughout the incident and its remediation. Post-incident (same day, 18:47:14 UTC): RISEx publishes an official statement via its X account confirming the exploit, the patch timeline, and stating that XLP vault depositors have been fully compensated using a portion of the platform's July fee revenue. The team states it reviewed every transaction and deployment during the affected period and confirmed this was the only unauthorized withdrawal to have occurred. No user funds remain lost as a result; the incident is closed with 100% compensation to affected depositors, funded entirely by the platform rather than external insurance or third-party recovery.