Resolv Protocol

Summary

Resolv Protocol, built by Abu Dhabi-based Resolv Labs (founded 2023 by Ivan Kozlov, Fedor Cmilev, and Tim Shekikhachev), launched on Ethereum mainnet in September 2024 as a "true delta-neutral" stablecoin system. Its stablecoin USR was backed by ETH (later also BTC) hedged with short perpetual futures, while a second token, RLP (Resolv Liquidity Pool), acted as a leveraged junior tranche that absorbed protocol risks — negative funding, liquidation losses, counterparty failures — in exchange for amplified yield. The design was widely seen as an evolution of Ethena's basis-trade model with an explicit, tokenized insurance layer. Resolv Labs raised a $10M seed round (Cyber.Fund, Maven11, Coinbase Ventures, Arrington Capital, Robot Ventures, Animoca Ventures, and others) and launched the RESOLV governance token in June 2025. On March 22, 2026, an attacker who had compromised off-chain infrastructure credentials used the protocol's privileged minting role to create 80 million unbacked USR, extracting roughly $25M and crashing USR from $1 to as low as ~$0.025. The collateral pool itself was untouched, and Resolv executed a structured recovery (1:1 USDC for pre-incident holders), but the original protocol was not relaunched.

Design (Mechanism)

Resolv's core innovation was tranching a delta-neutral stablecoin:

• USR (senior tranche): A USD-pegged stablecoin minted and redeemed 1:1 against collateral. Backing came from ETH/BTC held in staking and custody, paired with short perpetual futures so the portfolio had near-zero delta — the dollar value of the backing was insensitive to crypto price moves. Yield came from staking rewards plus perp funding rates. USR could be staked as stUSR/wstUSR to receive yield.
• RLP (junior tranche / insurance layer): Also minted and redeemed against collateral, RLP tokenized the protocol's excess collateral. RLP holders earned a leveraged share of protocol profits but stood first in line for losses: negative funding periods, exchange counterparty incidents, and liquidation slippage hit RLP's floating price before USR's backing. This made USR "overcollateralized" by the RLP buffer.
• Off-exchange custody and ops: Hedging positions ran on centralized perp venues via institutional custody (Fireblocks), with an off-chain operational layer managing mint/redeem settlement. Critically, swap completion was executed by a privileged SERVICE_ROLE address; post-incident analysis noted the completion path lacked on-chain mint caps, oracle checks, or bounds validation against the original request.
• Governance/token: The RESOLV token (TGE June 2025) governed the protocol and was later used as the in-kind component of the post-exploit recovery.

Contracts were audited repeatedly (including multiple MixBytes engagements covering the Treasury and extensions), and an Immunefi bug bounty ran — but the fatal flaw was in the off-chain trust architecture, not audited contract logic.

Outcome

Through 2025 Resolv scaled into one of the larger delta-neutral stablecoins, with USR integrated across Curve, Morpho, Aave, Euler, Pendle and other venues, and expanded to BTC collateral and additional chains. On March 22, 2026 at 02:21 UTC, an attacker — who per Resolv's postmortem had pivoted from a compromised third-party project into Resolv's GitHub, then into cloud infrastructure, ultimately obtaining signing authority for the minting contract — minted 50M and then 30M USR in two transactions. The tokens were dumped across Curve, KyberSwap and Velodrome, extracting ~$25M in ETH and depegging USR by ~97% within minutes; contagion hit integrated lending markets and vaults. Resolv paused contracts about three hours after the first mint, revoked credentials, and neutralized 46M USR via burns and blacklisting. The collateral pool was intact throughout. The recovery plan (published May 26, 2026): 1:1 USDC for pre-incident USR holders, 0.5 USDC for post-incident buyers, ~0.71 USDC for RLP holders, topped up with 10% of RESOLV supply (70% of it to RLP holders), claimable May 26–August 26, 2026. By late March, 98% of whitelist redemptions were complete and no internal involvement was found. Resolv pivoted to "Vault Street," a permissioned tokenized-RWA yield business (primeUSD), rather than relaunching USR/RLP.

Why it worked

• The tranche structure genuinely worked as designed against market risk: RLP absorbed negative-funding and volatility losses for over a year while USR held its peg, validating tokenized junior/senior risk splitting.
• Delta-neutral basis yield plus staking gave USR competitive "real yield" without relying on token emissions, driving strong integrations and growth in a crowded post-Ethena field.
• Even after catastrophe, full collateralization of the pre-attack supply enabled a credible recovery — pre-incident holders were made whole in USDC, a rarity for a 97% depeg.

Why it failed or underperformed

• The entire on-chain risk edifice depended on one off-chain trust root: a SERVICE_ROLE key that could complete mints without on-chain caps, oracle sanity checks, or request-bounds validation. A supply-chain compromise (contractor credentials → GitHub → cloud → signing authority) turned that key into an unlimited printing press.
• Detection and response lagged: roughly three hours passed between the first illicit mint and contract pause — an eternity when unbacked stablecoins are being dumped into DEX liquidity.
• The RLP insurance tranche was scoped to market risks; it could not (and arguably should not) absorb an infrastructure compromise, so losses spilled into integrators (Morpho, Aave, Euler vaults) and post-incident buyers.

Lessons

• Audits and tranched insurance address contract and market risk, but a stablecoin is only as strong as its most privileged off-chain key; mint authority needs on-chain rate limits, caps, and request/completion bounds validation regardless of who signs.
• Supply-chain security is protocol security: the attack began at a third-party project where a contractor had worked, not at Resolv itself — CI/CD credentials and cloud IAM are part of the trust base.
• Time-to-pause is a core protocol parameter; automated anomaly detection and permissionless or automated circuit breakers on abnormal mint volume would have capped this at a fraction of the damage.
• Keeping collateral segregated and intact made an orderly, differentiated recovery possible (1:1 for pre-incident holders, haircuts for opportunistic buyers) — a template other exploited protocols have lacked.

Redesign (EDITORIAL — hypothesis, not fact)

This is editorial speculation. A redesigned Resolv would make minting trust-minimized: hard-coded on-chain mint caps per epoch, completion amounts bounded to the originating request plus oracle-verified pricing, and a multi-party threshold signer set with heterogeneous infrastructure so no single credential chain can reach signing authority. An automated circuit breaker should pause mints when supply growth deviates from deposits (e.g., >2x rolling-hour baseline), and DEX-facing modules could enforce a redemption-priority delay on freshly minted USR, making dump-style monetization slower than detection. Finally, RLP's mandate could be split: a market-risk tranche (as before) plus a separately capitalized, explicitly priced operational-risk backstop, so integrators can underwrite infrastructure risk rather than discovering it in a depeg.