5.5 Smart Contract Vulnerabilities
Why most execution-layer losses come from keys and signers rather than faulty code, how the freeze, forced-transfer, mint, and upgrade powers a regulated token must carry double as its attack surface, what bridges and lending markets add to a token's dependencies, what an audit can certify, and who decides when code and documents disagree.
Smart contracts do not remove discretion. They move it into keys. A regulated token is built to be frozen, reversed, reissued, and upgraded, because securities law, sanctions rules, and court orders require that someone can do those things. Its execution layer is a modest amount of code surrounded by privileged keys, upgrade paths, signing services, and cross-chain verifiers, each able to change what the code does. The loss record of 2024 to 2026 shows attackers going after exactly those.
One limit on the evidence comes first. No large exploit of a regulated tokenized fund's own contract appears in the public loss data as of 28 September 2026. DefiLlama's hack database tags exactly one of its 1,288 incidents with the target type "RWA": Aurellion, on Arbitrum, on 12 May 2026, for about $456,0001. The argument is therefore from shared architecture: the incidents below happened at exchanges, lending protocols, and bridges that use the same admin keys, proxies, mint permissions, and cross-chain links as tokenized funds. They are analogues, not a record of RWA failures.
Section 5.4 argued that tokenization makes an asset easier to move but not easier to sell, through exit capacity, liquidity mismatch, block-speed runs, whitelists, and pool depth. The redemption contracts, pause functions, and allowlists it described are themselves smart contracts, and this section asks how they fail. Section 2.4 named smart contracts the execution layer and closed on the FSB's warning that coding errors may be hard to resolve once a contract is deployed: "That is the bridge to Section 5.5." Its accountability map listed "holders of privileged contract roles" among the parties accountable for execution, and this section starts from that row. Section 3.4 said Chapter 5 would treat smart contract and composability risk "as first-order rather than incidental." Both halves of that promise are kept below.
Most Losses Come From Keys, Not Code
IOSCO's DeFi policy report puts the pattern in one line: "At a high level, exploits and attacks in DeFi target access control points." Once such a point is compromised, an attacker can "commandeer the ability to alter token balances, interfere with governance processes, change the initial parameters and functionality of a smart contract, and circumvent protections such as multi-signature (multi-sig) procedures"2. That reads close to the feature list of a regulated token.
The theft data agrees. Chainalysis found that "Private key compromises accounted for the largest share of stolen crypto in 2024, at 43.8%"3. Of the more than $3.4 billion stolen from January to early December 2025, Bybit accounted for $1.5 billion, part of what Chainalysis calls "sophisticated attacks on private key infrastructure and signing processes"4. The FBI attributed the Bybit theft to North Korean actors it calls "TraderTraitor"5. Sygnia, which examined the signers' machines, found that JavaScript behind Safe{Wallet}'s web interface had been modified two days earlier to manipulate transactions for one specific Bybit cold wallet6. The multisig contract did what its signers approved. The signers approved a transaction the tampered interface had altered.
By this paper's calculation from DefiLlama's database, which classifies each incident by cause, the 429 incidents dated 2025 and 2026 total $4.95 billion, and those classified as social engineering (31.3%) or key compromise (20.3%) account for 51.6% of that value, while reentrancy, the textbook code bug, accounts for 0.9%1. The categories are DefiLlama's and mix exchanges, protocols, and wallets, so the split is indicative. It is still far from the picture of a contract undone by a clever bug.
The FSB notes that smart contracts are integral to tokenisation "but their security practices are still evolving"7. And an RWA token carries more privileged functions than an ordinary DeFi token, not fewer.
The Controls Regulators Require Are Also the Keys Attackers Want
ERC-3643, the permissioned-token standard Section 2.4 introduced for its eligibility checks, also lists what a compliant token must be able to do. It must have "a recovery system in case an investor loses access to his private key" and must be able to freeze tokens "partially or totally," pause the token, mint and burn, and "force transfers from an Agent wallet"8. An owner appoints the agents who exercise those powers. Tokeny's developer documentation calls the owner wallet "the Master Key to your ERC-3643" and warns that it "cannot be restored nor forced"9. ERC-7943, a real-world asset token interface proposed in June 2025 and now Final, provides for freezing and for "enforcement transfers for legal compliance," and its security considerations warn about exactly those functions: "Unauthorized access could lead to asset theft. Secure patterns (multisig, timelocks) are highly recommended"10.
Market infrastructure bodies and supervisors point to the same powers. The control principles DTCC, Clearstream, and Euroclear published with BCG call for "an embedded kill switch or process to halt all activity, which can be accessed by a role with elevated permissions"11. Hong Kong's SFC suggests, as a cybersecurity control, "a burning and re-issuance mechanism, with an aim to mitigating hacking risk and theft"12. IOSCO describes Franklin Templeton's on-chain fund as one in which "the transfer agent has unilateral control over all transactions involving the securities"13. Section 5.2 read that correction power as the register overriding the chain; here it is a key someone else could want. Each is a sensible control. Each is also a key.
Table 1 sets these powers beside incidents in which the same kind of key failed; none involves a regulated fund.
| Power | Why a regulated token carries it | In the wrong hands | Where the same kind of key failed |
|---|---|---|---|
| Freeze and pause | Sanctions, court orders, incident response | Locks holders out | Used defensively in the cases cited: Venus 2025, KelpDAO 2026 |
| Forced transfer and recovery | Lost keys, erroneous transfers, court orders | Moves any holder's balance | None in this section's sources; ERC-7943 names theft as the risk |
| Mint and burn | Subscriptions and redemptions | Creates unbacked supply | Resolv, March 2026 |
| Upgrade | Bug fixes, new chains, new features | Replaces the rules | Zoth, March 2025 |
| Owner or admin | Appointing the holders of the powers above | Hands over every power above | Drift, April 2026 |
Drift is the starkest case. By Chainalysis's account, which rests on the protocol's own investigation and "has not yet been independently verified," Solana's Drift Protocol moved on 26 March 2026 to "a new 2/5 threshold Security Council multisig with zero timelock." Attackers had already induced council members to pre-sign transactions, and on 1 April used them to take admin control: "Withdrawal limits were removed, vault permissions were overridden, and funds began moving"14. The loss was $285 million by Chainalysis's figure and $295 million in DefiLlama's141.
At Zoth, which Halborn calls "a real-world asset (RWA) restaking protocol," an attacker holding the key to the proxy contract's deployer address performed a malicious upgrade in March 2025 and drained an estimated $8.4 million, recorded as $8.85 million by DefiLlama151. At Resolv in March 2026, minting depended on an off-chain service holding a privileged key, and "the smart contract itself did not enforce any maximum limit on minting," so the attacker minted around 80 million USR. In Chainalysis's words, "The code worked exactly as intended"16.
The same powers contain damage. Venus paused its protocol within 20 minutes of a September 2025 attack4, and KelpDAO's pause blocked a second $95 million theft in April 202617. The question is therefore not whether privileged roles exist, since regulation requires them, but how they are split, how many signatures they need, whether a delay separates approval from execution, and whether the contract caps what one key can do. Drift had a threshold without a delay. Resolv had a key without a cap. The same holds for the keys Section 5.1 left to this section, those that can move a stock token's multiplier or halt its feed in a single transaction: they are privileged roles over the facts a contract acts on.
An Upgradeable Token Is a Promise About Who Holds the Upgrade Key
The tokens this paper has followed most closely do not run fixed code. They run behind a proxy, a contract whose address stays fixed for holders while the logic behind it can be replaced by whoever holds upgrade authority. This paper's inspection of their Ethereum contracts on 28 September 2026 shows that BUIDL, USTB, OUSG, USDY, USYC, and PAXG are all upgradeable proxies, which anyone can check from public contract storage181920212223. Upgrade authority takes different forms, from a multi-signature wallet to a time-locked controller to a single address, and on-chain data shows only the address, not who controls the key or how it is held; a single address may be an institutionally custodied key with controls of its own. This paper does not grade them; the point is that a holder's exposure depends on them.
Upgradeability answers a real problem. The FSB warns that coding errors "may not be easily resolved once deployed"7, and a proxy lets an issuer fix them, add chains, or follow a rule change. Immunefi names the cost: upgradeability "adds a lot of complexity to the process, and for some, defeats the purpose of blockchain's immutability and decentralization"24.
Hostile upgrades are one failure. Zoth's attacker installed one with a stolen key. At Bybit, the altered transaction used a delegate call to "replace the contract's implementation with a malicious version," a feature Sygnia notes is common "in upgradable and modular smart contract systems"6. Honest upgrades are the other. At Nomad in August 2022, "A routine upgrade on the implementation of one of Nomad's proxy contracts marked a zero hash value as a trusted root," and $190 million was drained25. In February 2022 a whitehat disclosed "an upgradeable proxy implementation self-destruct bug" in Wormhole's core bridge contract on Ethereum and received a record $10 million bounty24. Wormhole is the bridge Securitize selected for all of its tokenized assets, as Section 4.2 recorded. Aurellion, the one RWA-tagged incident in DefiLlama's data, is classified as an uninitialized proxy1.
For a holder, the code audited today is the code the upgrade key permits tomorrow. Hong Kong's SFC requires prior consultation for "material changes to the tokenisation arrangements," which "may require prior approval"12. Whether a contract upgrade is such a change, and who must approve one before it executes, is a supervisory question Chapter 6 takes up.
Every Bridge Adds a Verifier to Your Token's Trust Set
Section 4.2 showed why issuers go multichain and what it costs: Securitize chose Wormhole for all of its tokenized assets, Ondo moves USDY through LayerZero with three named verifiers and daily rate limits, and every bridge "is a new party in Section 2.4's dependency chain." That party confirms that a token burned or locked on one chain may be minted or released on another. If it confirms something false, tokens appear with nothing behind them.
IOSCO's tokenization report warns that smart contracts used as bridges "can be a source of potential vulnerability which malicious actors can target for cyber-attacks"13. Its DeFi report records, citing a blockchain analytics firm, that of the $3.1 billion stolen from DeFi protocols in 2022, "64% was attributable to attacks on cross-chain bridges"2. The BIS's 2026 Annual Economic Report counts weak interoperability mechanisms among the flaws that "can disrupt transfers, hinder redemptions and erode confidence in both the underlying rails and the tokens circulating on them"26.
Ronin's bridge needed "five out of the nine validator signatures." In March 2022 an attacker controlled four Sky Mavis validators and one run by Axie DAO and drained 173,600 ETH and 25.5 million USDC. Sky Mavis's diagnosis: "The root cause of our attack was the small validator set"27.
KelpDAO's rsETH bridge, built on LayerZero, lost 116,500 rsETH, about $292 million, on 18 April 2026. LayerZero Labs' report, citing attribution to the North Korean group TraderTraitor, describes a socially engineered developer, poisoned internal RPC nodes, and a forged message attested by LayerZero Labs' own verifier: "The impact was made possible by the affected OApp's single-verifier configuration"28. Kelp has said that setup was the default for new deployments at the time, and LayerZero has said it recommended more than one verifier17. Either way, LayerZero Labs' verifier now "will refuse to sign as the sole required attestor on any channel"28. Chainalysis concluded that "this was not a smart contract hack, but a sophisticated attack on off-chain infrastructure"17. The verifier count Ondo publishes is not a detail.
Liquid Network shows the chain itself as a dependency. On 6 September 2026 an attacker used a consensus bug to create "approximately 4,000 LBTC with no bitcoin behind it" and redeemed it through a peg-out service whose signing key "was kept online despite the Federation Charter requiring it to be kept offline"29. The network halted that evening, and user transactions resumed on 10 September, nearly four days later. Blockstream states that the other tokenized assets on Liquid "were unaffected by the incident, though they were unavailable while the network was paused"29. Section 4.2 counted $1.55 billion of tokenized assets on Liquid on 20 September 2026, nine from one platform, STOKR. Untouched assets that cannot move are the BIS warning in concrete form.
RWA issuers configure this layer differently. Spiko chose Chainlink "after carefully evaluating the security properties of various interoperability providers"30, and Centrifuge's messaging contract requires "a configurable threshold of adapter confirmations"31. These are configuration choices, and configuration sits outside the code an audit reviews.
Composability Means Inheriting Every Protocol a Token Touches
Section 3.4 argued that composability, shown by BUIDL's use as collateral on Crypto.com and Deribit, transmits stress for the same reason it creates value, and Section 4.1 added Aave Horizon, where qualified institutions post USTB, USCC, JTRSY, and JAAA as collateral. The FSB warns that composability "could introduce greater complexity and opacity to tokenised financial markets"7, and IOSCO sees tokenized money market funds "increasingly being used as stablecoin reserve assets or collateral for crypto-related transactions"13.
The rsETH exploit shows how that transmission works. rsETH is not an RWA token, but it was used as tokenized funds are meant to be, as lending collateral. Of the 116,500 rsETH stolen, 89,567 were deposited on Aave, against which the attacker borrowed 82,650 WETH worth $190.86 million32. Aave's incident report states that "Aave's smart contracts were not compromised at any point during this event." Aave's Protocol Guardian froze rsETH across every Aave V3 deployment and later froze WETH on six markets, and the report modelled bad debt of $123.7 million to $230.1 million depending on how losses were allocated32. The exposure landed on WETH lenders who had never held rsETH, through a verifier configuration they had no reason to know about.
Isolation worked where it existed. The 12 Aave V3 markets that did not list rsETH, Horizon among them, were "unaffected by definition"32. A market that accepts a small set of RWA tokens inherits their dependencies, not everyone's.
An RWA token accepted as collateral therefore brings every bridge, mint key, and admin key behind it into the lending market, and the market's depositors take them on unseen. Looping that collateral is Section 5.3's subject, exiting a frozen market is Section 5.4's, and pricing the token is the oracle problem of Section 5.1.
An Audit Is a Snapshot, Not a Guarantee
IOSCO's DeFi report is blunt: "a typical smart contract audit may only verify whether the code implements a particular design, but it may not give any meaningful assurances as to whether, for example, the design is fit for a particular purpose, can be misused by the designer or others, functions in the way it purports to function, or is governed in the way it purports to be governed." And unlike financial statement audits, "DeFi code assessments are voluntary, and are not subject to internationally-adopted standards"2.
Balancer shows the limit at scale. On 3 November 2025, attackers took more than $120 million from Balancer v2 pools and its forks33. OpenZeppelin, one of its auditors, wrote that the codebase "was reviewed by four independent audit firms, each firm was engaged to focus on different scopes of the protocol," and that the attack vector sat in code "added after the OpenZeppelin audit concluded"33. Certora, which formally verified properties of the same pools in 2022, acknowledged that those properties "were not strong enough to detect the rounding error that caused the recent exploit"34. In March 2026 Balancer's co-founder wound down Balancer Labs, citing "real and ongoing legal exposure"35.
Cetus lost over $200 million on 22 May 2025 to a faulty overflow check introduced when its code was ported to Sui; Dedaub notes that a later audit "found no issues beyond informational findings"36. Liquid's first bug came from a 2018 commit, and the August 2026 fix for it introduced the second bug that was exploited: "No reviewer, internal or external, identified this risk prior to exploitation"29. Kelp adds configuration. OpenZeppelin titled its analysis "$292 Million Lost, Zero Bugs Found" and called point-in-time audits "by definition, snapshots"37. Most firms cited here sell security services, so their conclusions are attributed rather than adopted.
Institutions expect audits anyway. The DTCC, Clearstream, and Euroclear principles want all smart contract code "tested for vulnerabilities, bugs, performance issues, or defects by an independent third-party auditor"11, and the SFC wants product providers to show that their smart contracts "are not subject to any contract vulnerabilities or security flaws with a high level of confidence"12. The gap between that expectation and what IOSCO says an audit certifies, with no international standard behind it, is one of the questions Chapter 6 inherits.
When Code and Documents Disagree, Someone Has to Decide
The FSB notes that irreversibility "can present fragilities in certain scenarios, such as instances of human error or involvement in fraudulent activities, where the need to reverse a transaction arises"7. Reversal has since become common, decided by whoever holds the relevant keys. Sui validators representing 90.9% of stake approved an upgrade that moved frozen Cetus funds "without a signature from the hackers"38. Cronos rolled its chain back 10,961 blocks after the Tectonic exploit of 30 August 2026, reversing about $111.2 million of affected value by Certora's reconstruction39.
For a tokenized security, the code is rarely the last word. IOSCO notes that the legal status of smart contracts varies across jurisdictions, "posing risks to the legal rights of investors that place reliance on such contracts"13. When chain and documents disagree, the documents and a court decide, the ground Section 5.2 covered on legal title, where even a register kept on the ledger counts as proof of ownership only in the absence of fraud. The SFC requires offering documents to state "whether off-chain or on-chain settlement is final"12, which asks the same question in advance.
Regulators require reversibility, and reversibility requires someone to hold keys. Who may hold them, under what threshold, delay, and oversight, and who approves an upgrade, are supervisory questions for Chapter 6. One question sits beneath them. A security council's freeze, a validator vote, or a court order is issued in one place, while a token and its holders are spread across many. Whether such a decision is recognised elsewhere, and which law governs the transfer it reverses, is where Section 5.6 turns, to jurisdictional fragmentation.
- The execution layer fails mostly at its keys, not its code. Chainalysis attributes 43.8% of 2024's stolen crypto to private key compromises, and the $1.5 billion Bybit theft came from signers approving a transaction a tampered interface had altered. No large exploit of a regulated fund's own contract appears in the loss data yet; the risk is argued from shared architecture.
- The powers a regulated token must carry are the powers an attacker wants. ERC-3643 requires recovery, freeze, pause, mint and burn, and forced transfer, and ERC-7943 warns that unauthorized access to its enforcement functions "could lead to asset theft"; at Drift, Zoth, and Resolv, admin, deployer, and mint keys were turned against their own protocols.
- A token depends on more than its contract. BUIDL, USTB, OUSG, USDY, USYC, and PAXG are upgradeable proxies on Ethereum, and every bridge or chain a token uses joins its trust set, as the single-verifier KelpDAO loss of about $292 million and the nearly four-day Liquid Network halt showed.
- Composability hands a failure downstream. 89,567 stolen rsETH posted on Aave left modelled bad debt of $123.7 million to $230.1 million for WETH lenders who never held rsETH, while Horizon, Aave's RWA market, did not list the token and was unaffected.
- An audit is a snapshot of one scope. IOSCO notes that code assessments are voluntary and follow no international standard, and Balancer v2, reviewed by four audit firms and partly formally verified, still lost more than $120 million.