CICADA Finance has paused its rtUSQ protocol after identifying a smart contract vulnerability that allowed an attacker to mint an abnormal quantity of rtUSQ and use the tokens to acquire ltCIC from the wrtUSQ/ltCIC liquidity pool. The project says no user funds were lost and that the financial impact was absorbed by protocol-owned liquidity, although a verified loss figure has not yet been released.
All rtUSQ-related activity has been suspended while the team investigates. CICADA has told users not to deposit, withdraw, convert, trade or provide liquidity involving rtUSQ, wrtUSQ, ltCIC or related assets through its interface, contracts or decentralized exchanges. The shutdown is broader than the exploited transaction itself, effectively freezing the rtUSQ ecosystem while the affected tokens are neutralized.
Abnormal rtUSQ Mint Reached Protocol-Owned Liquidity
In CICADA Finance’s August 14 security notice, the project described the vulnerability as a rare boundary condition in the rtUSQ contract. The attacker used the improperly minted rtUSQ to obtain ltCIC from the protocol’s wrtUSQ/ltCIC pool. CICADA maintains that the affected liquidity belonged to the protocol and that customer deposits held separately in managed accounts were not exposed.
The protocol also argues that its redemption design restricted the attacker’s ability to extract value. ltCIC must ultimately exit through rtUSQ redemption, which operates through a monthly window, while liquidity available for instant redemption is deliberately limited. CICADA has now suspended instant redemption and says the attacker’s position cannot be freely converted into stablecoins. Those containment claims remain CICADA’s assessment while the technical investigation is still underway.
rtUSQ had undergone external security review before the incident. Beosin’s January 2026 audit covered rtUSQ, its rebase module, wrapped rtUSQ and the rtUSQ vault, identifying several business-logic and contract risks at the time. The audit shows that the contract system had already received formal and manual review, but an audit cannot establish that every possible execution edge case has been eliminated.
Full Loss and Remediation Details Still Pending
CICADA says it is tracing activity associated with the exploit and sharing relevant information with exchanges and other parties. It has also stated that it will not honor redemption, conversion or withdrawal requests involving improperly minted assets. The protocol has not yet published the final loss calculation, detailed vulnerability mechanics or completed remediation plan.
A full post-mortem is expected once the review is completed. Until then, the incident remains contained according to CICADA rather than independently resolved. Restoring normal operations will depend on demonstrating that the minting flaw has been corrected and that rtUSQ’s redemption and liquidity mechanisms can safely reopen without exposing users to the same boundary condition.