> For the complete documentation index, see [llms.txt](https://docs.re.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.re.xyz/transparency-and-data-show-me-the-receipts/audits-attestations-custody-structure.md).
# Audits / attestations / custody structure
## Smart Contract Audits
The protocol has been audited by Certora (formal verification, Sept 2025) and by Hacken across three engagements (NAV Oracle Apr 2025, Core Contracts Dec 2024, DeFi Contracts Sept 2024).
## Reserve Attestations
The Network Firm performs daily Agreed-Upon Procedures (AUP) attestations on offchain reserve balances and custody ownership. Results are published via Chainlink oracles. The most recent full AUP report is the[ October 2025 AUP Report](https://storage.googleapis.com/foundation-files/AUP-Report-2025.pdf).
This is not a self-reported balance; it is an independent firm verifying custodial account balances and wallet ownership, and publishing the results through decentralized oracle infrastructure every day.
## Custody Structure
Onchain custody. Deposit vaults are onchain smart contracts. Idle capital sweeps daily into Fireblocks institutional custody vaults governed by multisig policy. This minimizes smart contract exposure for capital that isn’t actively needed for redemptions.
Offchain custody. Deployed capital sits in Section 114 trust accounts, a U.S. regulatory structure that holds reinsurance collateral in segregated bank accounts, separate from the reinsurer’s general assets. This gives ceding insurers regulatory credit for the reinsurance arrangement and ensures depositor capital isn’t commingled with Cover Re SPC Ltd.’s operating funds.
Legal structure. Cover Reinsurance SPC, Ltd. is a Cayman Islands Class B(iii) insurer regulated by the Cayman Islands Monetary Authority (CIMA), acting for and on behalf of Cover Reinsurance Segregated Portfolio #1 (SP1) for reUSD and reUSDe business. Cover Re SPC Ltd. is unaffiliated with Resilience Foundation; the two operate as separate legal entities, with distinct governance and independent CIMA oversight of the reinsurer. The segregated portfolio structure ring-fences reinsurance liabilities from any other activities. Notes are purchased by Resilience Inv SPC (Cayman) through separate segregated portfolios: Portfolio 1 for the reUSD cell, Portfolio 2 for the reUSDe cell. Resilience (BVI) Ltd. (incorporated October 23, 2024) issues the reUSD and reUSDe tokens; proceeds are contributed to the SPC under trust and contribution arrangements. Resilience Foundation (Cayman, incorporated October 7, 2024) governs the protocol and acts as agent for token holders.
Principal-at-Risk Notes. The legal instrument connecting onchain deposits to offchain capital is a Principal-at-Risk Note, not a surplus note. Cover Reinsurance SPC Ltd. issued a $100M Program on April 2, 2026, under a Master Terms and Conditions document, with a five-year term (matures April 2, 2031) and rollover by mutual agreement up to five additional years. Coupon is 30-Day Average SOFR plus a tranche spread (500 bps for M1, 950 bps for M2), payable annually in arrears and subject to CIMA-mandated Solvency Condition and Collateral Requirement deferral gates with catch-up payments on deferrals. The Notes are unsecured, limited-recourse obligations of Cover Re SPC Ltd.'s SP1 only, with no cross-portfolio recourse, no recourse to general assets, and no guarantees from any other entity. They are subordinated to cedent and policyholder claims and rank ahead of equity distributions. Every drawdown and repayment is recorded in the Surplus Note Registry contract and emits NoteDraw / NoteRepay events onchain. reUSD and reUSDe token holders have no direct legal claim on §114 trust assets; their economic exposure is through the Note. The program received CIMA approval.
## Access Control and Who Signs Off
The protocol uses UUPS upgradeability with a 48-hour timelock and governance MPC 3-of-5 for all upgrades.
For day-to-day operations, critical roles are separated across four dedicated controller wallets. There is no single admin key nor any single point of failure:
| Role | Controller | Mechanism | Permissions |
| ------------------ | ------------------------------------------ | ---------- | ------------------------------------------------------- |
| Oracle Config | 0x49BC5A880f77247A348764DdB95951cd9212A0ee | MPC 3-of-5 | Configure price feeds for deposit and collateral tokens |
| Redemptions Config | 0xEE16bE0374f2eFb34218affC1a8EbEe9310c47f8 | MPC 3-of-5 | Set redemption limits, top-up redemption vault |
| Access Manager | 0x80a62B72dF1136aCBc57141FB67Aa46812fECAFc | MPC 5-of-8 | Assign and revoke privileged roles |
| Custodian Manager | 0x9b6d7f2de2E4569297C7e88531E47679cEbE6eC9 | MPC 3-of-5 | Add and remove collateral custodians |
Any upgrade or config change published onchain can be traced back to one of these wallets. The 48-hour timelock means any user can see a queued action and exit the protocol before it takes effect, should they disagree with it.
## Oracle Guardrails
The NAV oracle is monotonic (values only move upward). Daily upward moves are capped at 20%/365, and the maximum per-update deviation is enforced onchain. Daily updates are pushed by a dedicated NAV updater role; emergency updates require a 3-of-5 multisig.
The daily NAV reflects yield generated by backing assets. It does not incorporate day-to-day spot price fluctuations of sUSDe, USDC, or other collateral. The sUSDe oracle used for mints and redeems is a spot oracle with an upper cap at the intrinsic exchange rate, so small basis dislocations cannot push the quoted price above redemption value. The 6 bps redemption fee provides an additional buffer against minor fluctuations. The redemption contract also enforces a hard revert if USDe spot is below $0.99, preventing redemptions at dislocated prices during a depeg. For larger depeg events beyond the spot-cap threshold, the protocol pauses instant redemptions on detection, assesses fair value, and reopens only after the oracle reflects the adjustment.
## Emergency Pause
Pause is executed through the Access Manager (MPC 5-of-8) and the Redemptions Config wallet (MPC 3-of-5). Authority sits with a geographically distributed set of individuals. Trigger criteria are narrow: peg dislocation on sUSDe or other reserve assets beyond threshold bands; oracle failure or stale feeds or detected manipulation; a smart contract exploit or critical vulnerability in a protocol dependency; custody or counterparty compromise at Fireblocks or the §114 trust custodian; regulatory action requiring cessation of redemptions under CIMA or a relevant jurisdiction;or operational failures in the mint or redemption pipeline that would produce incorrect accounting.
Unpause requires approval from the executive and risk teams, followed by a 48-hour delay before it takes effect. The 48-hour clock runs from the onchain unpause approval event on the Redemptions Config wallet.
***
*For educational and informational purposes only. Nothing on this Site is investment, financial, legal, or tax advice, or an offer, solicitation, or recommendation to buy, sell, or hold any digital asset, including reUSD and reUSDe. Yields are not guaranteed and all figures are illustrative, not a promise of return; past performance is not a reliable indicator of future results. Digital assets involve significant risk, including total loss of principal — the Tokens are not bank deposits and are not insured by any government agency. The Tokens are available only to eligible non-U.S. persons in permitted jurisdictions and are subject to KYC/AML requirements. The binding terms of the applicable agreements govern and prevail over this summary. See our full* [*Disclosures*](https://re.xyz/disclosure) *for important additional information.*\
\ *Cover Re SPC is unaffiliated with Resilience Foundation. The protocol governs token issuance and capital routing. The reinsurer operates independently under CIMA oversight.*