Benboy

Neutrl has no exposure to Resolv USR or wstUSR, and no allocations have been made to RLP. We are actively monitoring the situation for any second-order effects that may impact curators or broader ecosystem participants. All active positions and exposures, supported by ZK-verified attestations from @AccountableData, can be independently verified here: accountable.neutrl.finance

When we built Neutrl, we looked at how others in the space structured the issuance and redemption of their stablecoins. A common pattern: off-chain systems where a backend server signs orders, sets the price, and decides how much stablecoin you get for your collateral. The problem? If that server or signer key gets compromised, someone can mint millions of stablecoins out of thin air for pennies. We've seen it happen. We weren't comfortable with that. We believe well-designed smart contracts are harder to compromise than web2 infrastructure — servers get hacked, keys get leaked, infra goes down. So we went fully on-chain. When you mint NUSD, the contract queries Chainlink oracles directly at execution time, wrapped in the Euler ERC-7726 standard for additional safety checks. No backend decides your quote. No off-chain signer involved. There's no privileged role that can dictate how much NUSD gets minted for a deposit — the oracle gives the price, the contract does the math, that's it. We also don't blindly trust whatever the oracle returns. If the price of a collateral drops below a threshold we've set, the transaction reverts. We'd rather block a mint than risk giving someone a bad quote. But on-chain design alone isn't the full picture. Defense in depth matters. We use @HypernativeLabs for real-time threat monitoring — they are one of our pauser role on our contracts and can freeze operations the moment something looks off. tl;dr how we think about security at Neutrl: oracle pricing on-chain with no off-chain signers to compromise, price bounds that revert instead of giving bad quotes, per-block limits enforced in the contract, and Hypernative watching 24/7 with the ability to pause.

Following the recent DNS hijacking incident, the Neutrl domain has been successfully migrated to neutrl.finance and is now secured on a new DNS provider. Neutrl smart contracts have been unpaused and are fully operational. ALL USER FUNDS ARE SAFE. Protocol NAV, including reserves and user funds, remains secure within Neutrl’s custodial wallets, supported by a custody framework and off-exchange settlement (OES) that isolates funds from front-end and infrastructure risks. Users should no longer interact with neutrl[.]fi under any circumstances and should only use the new domain moving forward. The .fi domain will be sunset. As an added precaution, users who interacted with the compromised domain are advised to review and revoke permissions via revoke[.]cash, including any Permit2 approvals associated with the following malicious addresses: 0x23f2741EaA0045038e9b52100CdcC890163dE53F 0xa0Adf074056E41dfB892aFC69881E15073b384b9 Please also revoke any approvals associated with addresses you do not recognize. We extend our sincere gratitude to the teams at @0xGroomLake and @SEAL_911, whose support and expertise were instrumental in our response. Their work in strengthening security across the ecosystem is invaluable. Additional updates will be shared as they become available, along with a full post-mortem.

Following the recent DNS hijacking incident, the Neutrl domain has been successfully migrated to neutrl.finance and is now secured on a new DNS provider. Neutrl smart contracts have been unpaused and are fully operational. ALL USER FUNDS ARE SAFE. Protocol NAV, including reserves and user funds, remains secure within Neutrl’s custodial wallets, supported by a custody framework and off-exchange settlement (OES) that isolates funds from front-end and infrastructure risks. Users should no longer interact with neutrl[.]fi under any circumstances and should only use the new domain moving forward. The .fi domain will be sunset. As an added precaution, users who interacted with the compromised domain are advised to review and revoke permissions via revoke[.]cash, including any Permit2 approvals associated with the following malicious addresses: 0x23f2741EaA0045038e9b52100CdcC890163dE53F 0xa0Adf074056E41dfB892aFC69881E15073b384b9 Please also revoke any approvals associated with addresses you do not recognize. We extend our sincere gratitude to the teams at @0xGroomLake and @SEAL_911, whose support and expertise were instrumental in our response. Their work in strengthening security across the ecosystem is invaluable. Additional updates will be shared as they become available, along with a full post-mortem.

Update on the ongoing security incident: We are currently working with @0xGroomLake on the investigation. Initial findings suggest the DNS provider hosting the app domain was socially engineered, allowing an attacker to redirect the domain. Neutrl smart contracts remain secure and have been temporarily paused as a precaution. Please do not interact with the protocol until further notice is provided. We will continue to share updates as more information becomes available as well as a full post mortem.