CICADA Finance Security Incident Notice

CICADA Finance - Security Incident Notice

CICADA Finance has identified a smart contract vulnerability affecting the rtUSQ protocol. We are sharing what we know now and what we are doing about it.

1. No user funds were lost, and your deposits are safe
   The liquidity affected by this incident was protocol-owned, not user funds. Our core assets are held separately in managed, segregated exchange accounts that were never exposed to this vulnerability. Those accounts are operating normally and the assets within them are 100% unaffected.

2. What happened
   An attacker exploited a rare boundary condition in the rtUSQ contract, which resulted in an abnormal quantity of rtUSQ being minted. The attacker used this to acquire ltCIC from the wrtUSQ/ltCIC liquidity pool. Because ltCIC can only be exited through rtUSQ redemption, which operates on a monthly window rather than instant redemption, and because the instant-redemption liquidity available is deliberately limited, the value the attacker could actually extract was tightly capped. The realized loss is small and was absorbed by protocol-owned liquidity.

3. The attacker's position is contained
   The improperly minted rtUSQ and the ltCIC the attacker now holds cannot be freely converted into stablecoins. rtUSQ instant redemption is paused, and we are neutralising the improperly minted tokens. This position poses no further material risk to users.

4. We have paused the protocol
   All rtUSQ-related interactions are suspended. Until further notice, do not transact, convert, deposit, withdraw, or provide liquidity for rtUSQ, wrtUSQ, ltCIC, or related assets through the CICADA front-end, our smart contracts, or any DEX.

5. What comes next
   We are completing a full technical post-mortem and remediation plan, including the verified loss figure and the steps taken to neutralise the attacker's position. We will publish the detailed report once the review is complete.

6. Protect yourself
   Rely only on CICADA's official channels. Be alert to any direct message, link, or wallet signature request impersonating our team. CICADA Finance will never DM you first, and will never ask you to connect your wallet to "recover", "verify", or "unlock" funds. Any account or link promising refunds is a scam.

7. Notice to anyone attempting to exploit this vulnerability
   Assets obtained through this exploit are illegitimate. CICADA Finance will not honour, process, or settle any redemption, conversion, or withdrawal request tied to exploited or improperly minted assets. Anyone who acquires or attempts to extract value from these assets does so at their own risk and may incur losses. All related on-chain activity is being traced and shared with exchanges and relevant parties.