Sovryn confirms Babelfish reward inventory extraction on Rootstock
Sovryn identified 15 transactions that extracted 69,381.254896 XUSD from the Babelfish reward inventory. A sequence could create and reverse an imbalance while retaining its reward. The affected mint and redemption flows are stopped.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Babelfish XUSD conversion and reward inventory. Ordinary XUSD transfers and approvals are outside the containment stop.
- crypto
- In the wild
- Yes
- Sovryn documented 15 successful reward-paying transactions.
What happened
The reward calculation paid for apparent improvements to the reserve mix. An attacker could first create the imbalance, then reverse it and collect the reward. The project says the DOC and DLLR principal used in the examined transactions returned. The 69,381.254896 XUSD figure measures rewards taken from the inventory in those transactions. Sovryn has not published the final residual loss or found an equal shortfall in remaining XUSD backing on this evidence alone.
The ownership stop removed the conversion contract’s XUSD mint and burn authority. Sovryn tested a rewards-off option locally and says production changes still need qualification and approval. It has yet to certify any Babelfish-specific recovered amount or open a claim. The earlier Rootstock lending and AMM attacks use separate accounting.
Crime-scene timeline
Nov 4, 2026
Reward extraction and containment
The identified reward transactions ran from 04:14:50 to 04:59:36 UTC. Babelfish’s conversion contract lost its XUSD mint and burn authority at 08:05:49 UTC.
Nov 10, 2026
Sovryn publishes the technical and recovery findings
Sovryn discloses the reward calculation flaw, the amount identified and the continued conversion restrictions.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Sovryn attack disclosurePrimaryDocuments the economic flaw, 15 identified transactions and the reward-inventory accounting.
- Sovryn mitigation and recovery manifestPrimaryDocuments the verified ownership stop, ordinary transfer scope and pending production remediation.