---
title: "Oracles, NAV and proof of reserves"
author: Mariusz Szyma
date: 2026-09-15
lang: en
canonical: https://szyma.co/en/blog/rwa/oracles-and-nav/
series: "RWA: Past, Present and Future"
series_part: 6/11
series_url: https://szyma.co/en/blog/rwa/
data_as_of: 4–10 Sep 2026
---

# Oracles, NAV and proof of reserves

A tokenized fund has no price on any exchange, so some number has to be carried onto the chain before a lending market can treat that fund as collateral. This chapter follows that number from the firm that computes it to the contract that stores it, and shows what happens when nobody writes a new one. The failure that costs money in this layer is rarely a wrong value; it is an old value that no contract can tell apart from a fresh one.

## What you'll learn

- Read a NAV oracle's freshness in one call, from `updatedAt`, `roundId` and `answer`
- Tell a push feed from a pull feed, and say which one a fund NAV needs
- Name what RedStone, Chainlink and Pyth each do differently
- Separate an attestation from an audit, and both from a proof of reserve feed
- Place four documented incidents at the point in the chain where each one failed

## A blockchain is deterministic, the world is not

An **oracle** is the service that writes a number from outside the chain into a contract that other contracts can read. A contract can only read what someone has written into the chain, so every price, NAV and reserve balance a protocol acts on is there because a named party put it there. Chainlink's Data Feeds are the best-known example, and the eight contracts measured later in this chapter look exactly like them from the outside.

**Push** is the model where the provider posts the value on-chain and it sits in an aggregator contract until the provider posts another one. Nothing flows. The consumer calls `latestRoundData()` and gets back `roundId`, `answer` and `updatedAt`: the round number, the value, and the moment it was written.

**Pull** is the opposite arrangement. The data stays off-chain, signed, and whoever needs it appends it to their own transaction, which verifies the signature on-chain. Pyth works this way, and so does RedStone's pull service, which its documentation describes as signed data packages appended to calldata.

In a push feed a write happens for one of two reasons. **Deviation threshold** is a percentage move away from the stored value. **Heartbeat** is the maximum idle time after which a write happens anyway, whatever the value has done. The asset decides how far apart those two settings sit:

| Feed | Heartbeat | Deviation threshold |
|---|---|---|
| TUSD reserves | 24 hours | 5% |
| WBTC reserves | ~10 minutes | 1% |

Published parameters of two reserve feeds, per Spark, 20 July 2026. WBTC reserves can be checked on-chain every block, while TUSD reserves require asking a banking system.

Chainlink's documentation puts the freshness burden where few readers look for it: the application should check `updatedAt` itself and stop if the answer is not fresh enough. A stale feed does not return an error. It returns an old value with a truthful timestamp, and catching that is the consumer's job. The behaviour is documented, which makes it a property of the design.

## Who computes a NAV, and who only carries it

**NAV**, net asset value, is what one unit of a fund is worth: total assets minus liabilities, struck by the firm that keeps the fund's books. For BUIDL that firm is BNY Mellon, which is both custodian and administrator.

**Fund administrator** is the name of that role, the firm that maintains a fund's books under fund accounting rules and produces the official valuation. Neither the oracle, nor the token issuer, nor the chain does that work. Securitize's own SEC filings say as much. Its S-4/A amendments of 13 April, 8 May and 20 May 2026 say that Securitize "utilizes oracle providers to provide smart contracts and protocols with NAV information regarding its tokenized assets, with such NAV information provided by the respective fund administrator or transfer agent." That wording comes from EDGAR's full-text search and not from the filings themselves, so it carries snippet-level confidence; the 424B3 prospectus of 7 August 2026 was read in full and mentions no oracle provider at all. The transfer agent, the licensed firm that keeps the official list of who owns a fund's shares, is the subject of [chapter 5](/en/blog/rwa/who-holds-the-keys/).

A perfect oracle network still carries a wrong number if the administrator computes it wrong or publishes it late. Decentralization protects the number in transit and says nothing about how it was produced.

The same split hides a second distinction. Daily publication is not daily valuation, and private credit is classically valued once a quarter. If an administrator marks a credit portfolio with a model once a quarter and then, for the following 90 days, publishes an interpolation plus accrued interest, the daily NAV is updated daily and struck quarterly. The question for an issuer is how often the portfolio is valued, not how often the number appears.

ACRED, the tokenized feeder into Apollo's diversified credit fund, does strike its NAV daily. Redemptions there are quarterly and the interval-fund structure caps them at 5% of fund assets per period. Daily NAV is not daily liquidity.

![A fund administrator or a transfer agent supplies the NAV, an oracle signs it and writes it on-chain, a price contract stores it and a lending protocol reads it, with no step checking its own freshness by default, 10 Sep 2026.](https://szyma.co/blog/img/nav-to-chain-flow.408a46d4.svg)

## Eight oracle contracts read at one moment

I read eight oracle contracts on Ethereum mainnet on 4 September 2026 at 11:08 UTC, through the public `eth.blockscout.com` endpoint. Six are `LlamaGuardOracle` contracts carrying NAV and risk parameters for tokenized funds, and two are Pendle feeds. All eight implement `AggregatorV2V3Interface`, which makes them indistinguishable from a Chainlink feed at the point where a consumer reads them.

| Oracle | Address | Last write (UTC) | Age of the data | `answer` |
|---|---|---|---|---|
| USCC | `0x129c32858fD67645Ae9FB37c9f41b81D380e29c9` | 2026-01-22 00:00 | 5,411 h ≈ 225 days | 1,145.6042 |
| ACRED | `0xE952F28c9DB1424e120d8c78aA174B0dC98200B9` | never (`roundId = 0`) | not applicable | 0.0 |
| USYC | `0x228Cb3e49EAeb10dD1B56Eeae0A8cBffD0bdF2A4` | 2026-09-03 13:56 | 21.2 h | 1.13603459 |
| USTB | `0xc11B9FbFF1739dba70D1418BC8E6828cE66f61A2` | 2026-09-03 13:25 | 21.7 h | 11.19943 |
| JAAA | `0x8fA713d4E79238E5f6eB7479bEF0B7CFA51a9Ada` | 2026-09-04 07:22 | 3.8 h | 1.048159 |
| JTRSY | `0x74c0e98b5853e418219D6bF87fD26A73182F8876` | 2026-09-04 07:22 | 3.8 h | 1.115061 |
| PT-srUSDe-22OCT2026 (Pendle) | `0xc63D0747457dA82E4dc1C6a06Fb587622137d887` | 2026-09-04 11:00 | 0.1 h | 0.049727 |
| PT (Pendle, staging) | `0x565a1214Ec02FBe0fF9e1c092005Ee3e25A6fAb4` | 2026-09-03 12:00 | 23.1 h | 0.049189 |

Two of the eight had no cadence at all. The USCC feed had not been written since 22 January 2026, which was 225 days before my read, and it returned 1,145.6042 with a truthful old timestamp and no error flag of any kind. The ACRED feed at the address I read had never been written: `roundId = 0`, `answer = 0.0`. A zero valuation is worse than a wrong one, because a valuation that is 20% off produces proportional losses while a zero produces an immediate liquidation of the whole collateral position, or, depending on which side of the trade it lands, a loan with no limit.

That second reading needs a correction. RedStone documents the contract addresses of the Securitize NAV feeds in its public relayer manifests, on Ethereum and on Polygon:

| Chain | Multi-feed adapter | `ACRED_FUNDAMENTAL` price feed |
|---|---|---|
| Ethereum | `0xd72a6BA4a87DDB33e801b3f1c7750b2d0911fC6C` | `0xD6BcbbC87bFb6c8964dDc73DC3EaE6d08865d51C` |
| Polygon | `0xcDC943EB780B66d4FECB019B041413A5a5188791` | `0xBF4Fa84B5433660a4194B5FbaF41c3d11B47ed77` |

In RedStone's multi-feed design the per-feed price contract is a thin reader over the adapter, and on that design a `roundId = 0` with `answer = 0` on some other address, such as an unused single-feed adapter, is plausible. Those documented addresses were not re-read on chain here. That comparison is open to any reader and has not been run.

The other six show a measurable rhythm. JAAA and JTRSY had been refreshed 3.8 hours before the read, USYC and USTB 21 to 22 hours before it, which on a Friday morning points back to a Thursday afternoon write. For those four, the daily NAV cadence claimed in provider materials is a property anyone can check on-chain. Across the eight, the spread between the freshest value and the stalest one, measured in the same moment, is four orders of magnitude.

I read the `RoleGranted` events on three of the eight contracts, USCC, USYC and ACRED, and in those three there is no node network under the standard interface. The `WRITER_ROLE`, which is the permission to write a value, is held in all three by a `LlamaGuardOracleProxy` contract, and `DEFAULT_ADMIN_ROLE` sits on externally owned accounts: two different ones for USYC and ACRED, one for USCC. What stands behind the write on the other five was not read. The only built-in guard is `maxPriceDeviation`, a cap in basis points on how far a new value may move from the previous one, where the comment in the code states that zero disables the check. Seven of the eight returned a confirmed zero. On USCC the call reverts, so the state of that parameter is unknown, and a missing reading is not a confirmed zero.

> **Watch out:** conformance to the interface says nothing about where the data came from. Anyone can deploy a contract implementing `AggregatorV3Interface` and write whatever they like into it with a single key. What settles an integration is who writes and how often, and both of those are on-chain readings, answerable without asking a sales team.

![Age of the data in eight NAV, risk and rate oracle contracts read at the same moment, from 6 minutes to 225 days, with one never written at all, 4 Sep 2026.](https://szyma.co/blog/img/nav-oracle-staleness.ba076820.svg)

The read measures the state of eight contracts, not their use. I did not establish that any live market prices collateral from these addresses.

## Why aggregating ten sources does nothing for a fund NAV

The default oracle recipe takes a price from ten venues, drops the outliers and publishes the median. It assumes the asset has a market. Securitize's filing states that assets on its platform are not freely traded on a secondary market and have no continuous market price, and that their value follows from a NAV computed off-chain. Ten copies of one administrator's number are one source copied ten times.

**TSSO**, the Trusted Single Source Oracle, is the answer RedStone and Securitize announced on 1 July 2025: rather than pretend there are many sources, make the single source verifiable. RedStone's post defines it as a cryptographically verifiable oracle architecture purpose-built for real world assets, and describes every NAV update under it as carrying a full cryptographic payload of asset ID, price, timestamp, sequence number, previous record hash and previous record signature. That post names no funds and does not use the word pilot; the pilot framing came from CoinDesk's report of the same day.

> **Example:** RedStone publishes daily NAV feeds under TSSO for BUIDL, ACRED, HLSCOPE, VBILL, STAC, BRSRV and HINC. Every Securitize NAV feed listed in its public relayer manifests is a push feed, and its posts document STAC and BRSRV as push and pull both. The deviation trigger is set per feed and not once: the Ethereum multi-feed adapter defaults to 0.5% with a 24-hour heartbeat, Polygon's to 0.1%, and the manifest sets 0.01% for `ACRED_FUNDAMENTAL`.

## RedStone and Chainlink, one interface and two architectures

RedStone has been Securitize's primary oracle partner since 12 March 2025. It runs both delivery models as equals: its docs treat push and pull as first-class, and its own comparison post claims it is the only provider to offer both models cross-chain.

Chainlink's line for this asset class is called SmartData and has three members. Proof of Reserve reports the status of reserves. NAVLink delivers net asset value by calculating total assets minus liabilities for tokenized funds and portfolios. SmartAUM reports assets under management. The current documentation confirms all three as live and gives no launch date for any of them. Around them sit Data Feeds (push), Data Streams (pull, verified on-chain), CCIP for cross-chain messages and token transfers, the Automated Compliance Engine, which the docs now describe as Private Beta, and the Chainlink Runtime Environment, generally available since 4 November 2025. Securitize adopted NAVLink to price its tokenized funds as collateral on Aave Horizon, with VanEck's VBILL among the first qualifying assets.

Chronicle is the second provider on some of the same funds. The Block reported on 26 March 2026 that BUIDL is verified on-chain by Chronicle Proof of Asset; a Chronicle Proof of Asset feed for STAC appears only in a search summary of Chronicle's own blog, undated, because chroniclelabs.org returned 403 and 429 when the page was fetched. Both company names appear in Securitize's S-4/A amendments of 13 April, 8 May and 20 May 2026. Pyth is the architectural contrast to both, and the three read differently once the docs are open side by side:

| Provider | Who signs the data | How it reaches the chain |
|---|---|---|
| RedStone | independent nodes sign data packages off-chain | push: permissionless relayers submit on deviation or heartbeat · pull: the user appends the signed package to calldata |
| Chainlink Data Feeds | Off-Chain Reporting: a leader aggregates a report, a quorum of node operators co-signs it | one on-chain transaction per round; the aggregator verifies the quorum and exposes the median |
| Pyth | first-party publishers submit prices, combined into one aggregate on Pythnet | relayed cross-chain via Wormhole; anyone can post the update on-chain |

Neither provider publishes a price for any of this. RedStone's pricing page returned HTTP 404 when it was checked on 10 September 2026, and no per-feed pricing for NAVLink, Proof of Reserve or SmartAUM appears anywhere in Chainlink's documentation.

> **My take:** the most detailed public comparison of these three providers is RedStone's own, published 30 March 2026. It claims 50+ push and 120+ pull chains for RedStone against 29 push and 40+ pull for Chainlink, plus zero mispricing events. Those are a company's claims about itself and about a competitor, and none of the competitor figures were independently verified. They are useful as a statement of what RedStone thinks matters in this market and useless as a scoreboard.

![Push versus pull against market price versus NAV without a market: RedStone TSSO and Chainlink NAVLink both sit in push plus NAV, and the pull plus NAV quadrant stays empty, 10 Sep 2026.](https://szyma.co/blog/img/oracle-models-quadrant.64603391.svg)

RedStone Settle, launched 28 April 2026, addresses the timing mismatch RedStone states in its own words: lending protocols liquidate in seconds, while RWA redemption takes 30 to 180 days. Its product page puts the market at "$30B+" tokenized RWAs onchain, which is RedStone's phrasing. Everything below about how Settle works is RedStone's own account, from that product page and the launch post; no Settle integration documentation was located. RedStone gives it three parts. An auctioneer watches positions in real time and, when one crosses the liquidation threshold, broadcasts to all registered solver engines, collects bids and submits the highest valid offer on-chain, in 300 milliseconds to minutes. Every solver, the company says, is KYC-verified and whitelisted per RWA token type before it may take part, which RedStone calls "a structural condition of participation, not a post-hoc check." An executor contract is then said to settle atomically, bundling price update, solver callback, repayment and collateral release into one transaction that reverts entirely if any part fails, with solvers earning the spread between the discounted settlement price and face value at maturity. RedStone discloses no settlement volume for the product.

![RedStone Settle in its own description: a monitored position, an auction among KYC-verified solvers lasting 300 milliseconds to minutes, and one atomic transaction that repays the lender while the solver waits for the fund's normal redemption, 28 Apr 2026.](https://szyma.co/blog/img/redstone-settle-flow.6199e6e6.svg)

## Proof of reserve answers a different question

**Attestation** is an accounting firm testing an assertion the issuer has made, at one moment, under professional standards, and signing a report on it. **Audit** is an opinion on a full set of financial statements for a period, including internal controls. USDC's reserves are attested monthly, and who performs that attestation is contested in my own notes: one account has Circle moving USDC reporting to Grant Thornton in 2025, another names Deloitte & Touche LLP for both the attestations and Circle's own statements since fiscal 2022, a third describes a Grant Thornton to Deloitte migration in fiscal 2022. I do not settle it here, and the better question is whether the firm attesting the reserves is the firm auditing the statements. The BUIDL fund gets an annual audit from PwC. An attestation confirms far less than the word suggests: it does not cover whether the reserve's composition is appropriate, whether the assets were unencumbered, or whether the reserves existed the day before and the day after.

**Proof of reserve** is the on-chain form of that narrow question, a feed that publishes whether the backing exists rather than what it is worth. Chainlink runs one inside SmartData, and RedStone runs its own product of the same name.

Chainlink's documentation discloses the limitation that decides how much such a feed is worth in an analysis. Cross-chain proof of reserve feeds that use a contract managing a list of addresses can differ in configuration, and where that manager is self-reporting, the feed may cover balances from addresses whose ownership has not been cryptographically confirmed; Chainlink Labs adds that it is not responsible for the accuracy of self-reported data. A proof of reserve therefore verifies that the named addresses hold the named funds, and not that those addresses belong to the issuer, unless the configuration of that particular feed ensures it. Checking the configuration of a specific feed belongs in the product analysis.

## Four incidents, three of them not an oracle-network problem

| Incident | Date | Loss | Where it failed | Source |
|---|---|---|---|---|
| Stream Finance / xUSD | 4 Nov 2025 | ~93 mn USD lost, ~285 mn USD contagion | pricing source | 🟡 |
| Moonwell, cbETH feed | Feb 2026 | 1.78 mn USD bad debt | consumer configuration | 🟡 |
| Moonwell, MAMO token | Aug 2026 | 8.7 mn USD | thin-liquidity manipulation | 🟡 |
| Ostium, Arbitrum | 15 Jul 2026 | 23.75 mn USD in USDC | oracle exploit | 🔴 |

On 4 November 2025 Stream Finance disclosed that an external manager had lost about 93 mn USD of its assets, and the contagion across everything that depended on it was later put at about 285 mn USD. A lending protocol was pricing xUSD at 1.06 USD while the market paid about 0.86 USD, because the valuation came from a hardcoded price or from the protocol's own reported NAV rather than from a feed. No feed failed, because nobody was querying one. The gap between roughly 500 mn USD of declared TVL and about 170 mn USD verifiable on-chain was computable from public data before the collapse.

The Moonwell pair separates two mechanisms that usually get filed under the same phrase. February 2026 was a misconfigured cbETH feed on Base and 1.78 mn USD of bad debt, with no attacker involved anywhere in the story. August 2026 was a price-oracle exploit through the MAMO token that drained 8.7 mn USD, reported as the third oracle-related failure at the same protocol in eleven months.

The fourth row belongs in the table. Ostium, a derivatives platform for real world assets on Arbitrum, lost USDC to an oracle exploit, and the only sources for its date and amount are tertiary, so both stay in the table under a 🔴 mark. My two earlier Polish write-ups grade that figure differently, 🔴 in one and 🟡 in the other, and this chapter takes the more conservative mark.

Three of these four sit outside the oracle network: a pricing source reporting on itself, a consumer configured wrongly, and a market thin enough to move. Decentralizing the node network prevents none of them. The fourth mechanism carries no loss figure yet, and it is the one measured earlier in this chapter: a value that ages while nobody attacks anything.

## Key takeaways

1. A push feed holds one value until someone writes another, and a consumer that never reads `updatedAt` cannot tell a value written on 22 January 2026 from one written this morning.
2. On 4 September 2026 at 11:08 UTC the USCC NAV oracle on Ethereum mainnet returned data 225 days old with no error, and the ACRED contract at the address I read had never been written at all.
3. RedStone documents its Securitize NAV feed contracts on Ethereum and on Polygon, and on that design a zero read against some other address, such as an unused single-feed adapter, is plausible; the documented addresses were not re-read on chain for this chapter.
4. Seven of the eight contracts read returned `maxPriceDeviation = 0`, which disables the deviation check; on USCC the call reverts and the state of the parameter is unknown.
5. An oracle carries a NAV rather than computing one: per Securitize's S-4/A amendments of 13 April, 8 May and 20 May 2026, at snippet-level confidence, the number comes from the fund administrator or the transfer agent.
6. RedStone publishes daily NAV under TSSO for seven funds tokenized through Securitize: every such feed in its manifests is push, STAC and BRSRV are documented as push and pull both, and the deviation trigger is per feed. Chainlink's NAVLink prices Securitize-tokenized funds as collateral on Aave Horizon.
7. Of four documented incidents between November 2025 and August 2026, three failed at the pricing source, at the consumer's configuration or in a thin market, and a more decentralized node network would have prevented none of them.
8. Neither RedStone nor Chainlink publishes a price for these feeds, and RedStone's pricing page returned HTTP 404 on 10 September 2026.

## Glossary

- **Oracle**: the service that writes a number from outside the chain into a contract other contracts can read. It moves data and does not create it.
- **NAV (net asset value)**: what one unit of a fund is worth, computed as total assets minus liabilities by the firm that keeps the fund's books.
- **Fund administrator**: the firm that maintains a fund's books under fund accounting rules and strikes the official valuation. BNY Mellon plays this role for BUIDL.
- **Push feed**: a value stored in an aggregator contract, replaced when the provider writes a new one. Chainlink Data Feeds work this way, and so does every Securitize NAV feed listed in RedStone's public relayer manifests.
- **Pull feed**: data signed off-chain and appended to the user's own transaction, verified on-chain at that moment. Pyth and RedStone's pull service work this way.
- **Heartbeat**: the maximum idle time in a push feed, after which a write happens whatever the value has done. The TUSD reserve feed uses 24 hours.
- **Deviation threshold**: the percentage move against the stored value that triggers a write. The WBTC reserve feed uses 1%.
- **`updatedAt` and stale data**: the timestamp of the last write. Data older than an application can tolerate is stale, and the oracle raises no error about it.
- **Attestation**: an accounting firm testing and signing off an issuer's assertion at one moment. Weaker and narrower than an audit of the financial statements.
- **Proof of reserve**: a feed reporting whether the reserves backing a token exist. It answers existence rather than value, and its worth depends on how the address list behind it is managed.

## Go deeper

- [Who holds the keys](/en/blog/rwa/who-holds-the-keys/): the same asymmetry, an off-chain source of truth with an on-chain mirror, explains both admin powers and a stale NAV.
- [RWA in DeFi](/en/blog/rwa/rwa-in-defi/): a stale or zero-valued NAV feed is the mechanism behind the collateral risk described there.
- [Who's who](/en/blog/rwa/whos-who/): RedStone gets a full profile there, built on the architecture set out in this chapter.
- 🟢 Chainlink Documentation, *Data Feeds*, *SmartData* and *Data Streams*, docs.chain.link, accessed 10 September 2026.
- 🟢 RedStone Blog, *RedStone x Securitize Unveil TSSO*, 1 July 2025.
- 🟢 SEC EDGAR, Securitize Holdings, Inc., Form S-4/A amendments of 13 April, 8 May and 20 May 2026, on who supplies NAV to smart contracts.

## Sources

**Author's own on-chain reading, 4 September 2026, 11:08 UTC (🟢 primary)**

- Ethereum mainnet through the public `eth.blockscout.com` endpoint: `description()`, `decimals()`, `latestRoundData()` and `maxPriceDeviation()` on the eight addresses listed in the table; `RoleGranted` events on the USCC, USYC and ACRED oracles to identify holders of `WRITER_ROLE` and `DEFAULT_ADMIN_ROLE`; current block timestamp for the age calculation.
- `LlamaGuardOracle` source code (BUSL-1.1) read from `0xc63D0747457dA82E4dc1C6a06Fb587622137d887`, including the comment stating that `maxPriceDeviation = 0` disables the deviation check.

**Primary documentation (🟢)**

- Chainlink Documentation, *Data Feeds*: feeds are not a stream, deviation threshold and heartbeat mechanics, the application's duty to check `updatedAt`.
- Chainlink Documentation, *Proof of Reserve Feed Addresses* and *SmartData Feed Addresses*: the self-reporting wallet address manager disclosure and the disclaimer on self-reported data.
- Chainlink Documentation, *SmartData*: Proof of Reserve, NAVLink (total assets minus liabilities), SmartAUM; *Data Streams*; *ACE* (Private Beta); Chainlink blog, *Chainlink Runtime Environment Now Live*, 4 November 2025 (`research/chainlink.md` §A).
- Chainlink announcement of Securitize's NAVLink adoption for Aave Horizon collateral, with VanEck's VBILL as a first qualifying asset (`research/chainlink.md` §B, Summary item 2).
- SEC EDGAR, Securitize Holdings, Inc., Form S-4/A amendments of 13 April, 8 May and 20 May 2026 (accessions 0001213900-26-042685, -053457, -059300): NAV supplied by the respective fund administrator or transfer agent and moved by oracle providers, and both RedStone and Chronicle named. Reached through EDGAR full-text search, at snippet-level confidence; the filings themselves run 23 to 33 MB and were not fetched in full (`research/redstone.md` §0 item 6).
- SEC EDGAR, Securitize Holdings, Inc., Form 424B3 (2026): no continuous market price for platform assets. The 7 August 2026 424B3 was read in full and contains no mention of RedStone, Chronicle or "oracle"; the 5 June 2026 424B3 was not checked (`research/redstone.md` §0 item 6).
- RedStone Blog, *RedStone x Securitize Unveil TSSO*, 1 July 2025: the TSSO definition and the cryptographic payload per update (`research/redstone.md` §0 item 1).
- RedStone Blog, *Tokenize the World*, 6 July 2026, and the BRSRV and HINC posts, 12 and 18 August 2026: daily NAV feeds for BUIDL, ACRED, HLSCOPE, VBILL, STAC, BRSRV and HINC; ACRED and HLSCOPE described as push, STAC as "push and pull models", BRSRV as push on a 24-hour heartbeat plus pull (`research/redstone.md` §C).
- RedStone relayer manifests on GitHub: Securitize NAV feed contracts documented on Ethereum (multi-feed adapter `0xd72a6BA4a87DDB33e801b3f1c7750b2d0911fC6C`, default triggers 0.5% / 24 h; `ACRED_FUNDAMENTAL` `0xD6BcbbC87bFb6c8964dDc73DC3EaE6d08865d51C` at 0.01%) and on Polygon (adapter `0xcDC943EB780B66d4FECB019B041413A5a5188791`, default 0.1% / 24 h; `ACRED_FUNDAMENTAL` `0xBF4Fa84B5433660a4194B5FbaF41c3d11B47ed77`), all push on `redstone-primary-prod` (`research/redstone.md` §0 items 5 and 8).
- RedStone documentation, push and pull models (`research/redstone.md` §B, §E); RedStone Settle product page and launch post, 28 April 2026, including the "$30B+" figure, the three-layer mechanism and the 300-millisecond auction floor (`research/redstone.md` §D).
- Pyth documentation, *How Pyth Works* and *Cross-chain*: first-party publishers, aggregation on Pythnet, Wormhole relay (`research/redstone.md` §E).
- RedStone pricing page returning HTTP 404, and the absence of published pricing for NAVLink, Proof of Reserve and SmartAUM (`research/redstone.md` §0 item 9; `research/chainlink.md` §C).
- Securitize and Apollo press release, 30 January 2025: ACRED's daily subscription and daily NAV structure (`research/redstone.md` §0 item 2).

**Credible secondary (🟡)**

- Spark, *Real-Time Reserve Attestation*, 20 July 2026: TUSD (24 hours / 5%) and WBTC (~10 minutes / 1%) feed parameters.
- CoinDesk, *Securitize, RedStone Pilot 'Trusted Single Source Oracle' to Secure Tokenized Fund NAVs*, 1 July 2025: the pilot framing, which RedStone's own post does not use.
- Unchained, 9 May 2025: ACRED redemptions quarterly, no more than 5% of fund assets per period.
- CCN, BlockEden and Tiger Research, November 2025: the Stream Finance disclosure of 4 November 2025, the ~93 mn USD loss, the ~285 mn USD contagion, the 1.06 USD versus ~0.86 USD pricing, and the ~500 mn USD declared against ~170 mn USD verifiable TVL.
- cryptonews.com, February 2026: Moonwell's 1.78 mn USD of bad debt from a cbETH oracle misconfiguration on Base.
- crypto.news and TechTimes, 27 August 2026: the 8.7 mn USD MAMO exploit, described as the third oracle-related failure at Moonwell in eleven months.
- The Block, 26 March 2026: Chronicle Proof of Asset for BUIDL, with RedStone remaining primary data provider (`research/redstone.md` §C).
- Knowledge-base module 7 (`baza-wiedzy/07-oracles-data.md`): the attestation and audit definitions, the monthly USDC attestation with its three conflicting accounts of Circle's attestor, and the annual PwC audit of the BUIDL fund.

**Company claims, flagged as such (🟢 source, interested party)**

- RedStone comparison post, 30 March 2026: 50+ push and 120+ pull chains for RedStone, 29 push and 40+ pull for Chainlink, zero mispricing events; "the only provider to offer both models cross-chain" (`research/redstone.md` §E).
- RedStone Settle product page: "$30B+" tokenized RWAs onchain.

**Tertiary (🔴, context only)**

- coingabbar and hokanews: the Ostium exploit of 15 July 2026 and the 23.75 mn USD figure, which no primary source confirms.
- Search summary of Chronicle's blog, undated: the parallel Chronicle Proof of Asset claim for STAC. chroniclelabs.org returned 403 and 429 on fetch, so no page was retrieved (`research/redstone.md` §C, §H).

## Caveats

The on-chain read measures state, not use. I established that the USCC value was 225 days old and that the ACRED contract I read had never been written. I did not establish that any live lending market prices collateral from those addresses. The overlap between the assets these contracts cover and Aave Horizon's collateral list is a strong coincidence and not proof, and nothing in this chapter asserts a failure of that market.

The ACRED zero has a documented alternative explanation that this chapter did not test. RedStone publishes the Securitize NAV feed contracts for both Ethereum and Polygon, and on its multi-feed design a zero read against some other address, such as an unused single-feed adapter, is plausible. Those documented addresses were not re-read on chain here, so the alternative stands as plausible and unverified.

The filing attribution carries its own limit. The sentence on who supplies NAV comes from Securitize's S-4/A amendments through EDGAR's full-text search, at snippet-level confidence; the filings run 23 to 33 MB and were not fetched in full, the 5 June 2026 424B3 was not checked at all, and the 7 August 2026 424B3 that was read in full mentions no oracle provider.

Who attests USDC's reserves is unresolved in my own sources, which give three accounts of Circle's attestor history and do not settle the direction of the migration. The monthly cadence comes from my issuer table, not from those three accounts, and what they disagree about is the firm's name.

The write path was read on three of the eight contracts, not eight. `RoleGranted` events were pulled for USCC, USYC and ACRED only, so the claim about a proxy writer and EOA admins covers those three and no more.

USCC's deviation guard is unknown, not zero. The `maxPriceDeviation()` call on that address reverts, so the contract most likely does not expose the function. Recording that as a confirmed zero would be the most tempting and most misleading mistake available in this dataset.

One chain and one moment. The read covers Ethereum mainnet only, and the age of a feed's data is an instantaneous number: a contract that was 225 days stale on 4 September 2026 could have been written the next day. Every figure here can be read again at the address given.

The Ostium loss rests on tertiary sources only, so its date and amount stay in the incident table under a 🔴 mark and out of the prose, and it carries no weight in the argument beyond illustrating a mechanism. My two earlier Polish write-ups grade that figure differently, 🔴 and 🟡, and this chapter takes the more conservative mark. HLSCOPE's underlying NAV-strike cadence is unresolved: RWA.xyz lists monthly subscription and redemption while RedStone's own post implies a daily NAV, and no source settles it. RedStone's "$30B+" figure is the company's own and its methodology is not stated. Nobody has published what share of RWA losses is attributable to each of the four mechanisms above; the four incidents are illustrations of distinct mechanisms rather than a representative sample.