The ledger is not a football pitch. But when a protocol reshapes its squad, the same cold mechanics apply: some players get cut, others get promoted, and the community is left to guess whether the move is tactical or terminal. On August 3, 2026, City Finance—a DeFi lending protocol that once boasted $2.4B in TVL—announced the omission of two key modules, SavToken and ReijndersVault, from its upcoming Security Audit Sprint (SAS). The news broke not in a press release but in a terse GitHub commit message: "Remove SavToken and ReijndersVault from QA scope for SAS-2026. "
I have seen this pattern before. In 2021, I audited a PFP minting contract where the team claimed a "strategic decision" to skip a reentrancy fix. They launched on time. The exploit hit within 48 hours. The code never lies, but the people who write it do—through omission.
Let me be clear: City Finance is not a football club. It is a smart contract system with $800M in outstanding borrows. The omission of these two modules from a security audit is not a management decision. It is a structural risk transfer. This article is the forensic autopsy of that transfer.
The squad reshaping narrative from traditional football—where managers drop players to manage squad depth or meet financial fair play—has a direct parallel in crypto: protocol teams dropping features or modules to meet launch deadlines, reduce audit costs, or hide known vulnerabilities. City Finance’s move is a textbook case of the latter.
Background: The Rise and Fracture of City Finance
City Finance launched in early 2024 as a modular lending protocol, allowing users to create isolated lending pools using custom tokens. It gained traction during the 2024-2025 mini-bull run, peaking at $2.4B TVL. The protocol’s architecture split into three core modules: the Base Lending Engine (BLE), the SavToken liquidity aggregator, and the ReijndersVault risk-adjusted yield optimizer. SavToken allowed users to deposit stablecoins and receive yield-bearing synthetic assets; ReijndersVault used a dynamic leverage algorithm to boost returns on volatile assets.
The team behind City Finance is known for rapid iteration. They ship every two weeks. But speed is the enemy of security. In my 2025 audit of their oracle integration (engagement #CF-04-2025), I found a critical input validation flaw in the ReijndersVault that allowed a flash loan attacker to manipulate the leverage multiplier. The fix was applied, but the commit history shows it was a hotfix—no regression tests, no second review. The code smelled of rushed architecture.
Now, in August 2026, the team announces a "strategic squad reshaping" under a new lead developer, Emily Maresca, who previously worked on a Layer-2 bridge that suffered a $12M exploit. The reshuffle includes promoting two junior developers to senior roles, demoting a former head of security to advisory, and—most critically—removing SavToken and ReijndersVault from the upcoming audit scope.
The SAS-2026 Scope: What Was Left Out
The audit sprint, scheduled for September 2026, covers only the BLE module and a new stablecoin integration. The official rationale, posted on the protocol’s forum: "After strategic review, SavToken and ReijndersVault are being refactored for the next generation. Their current codebase is stable and has been live for 6 months without incident. We are prioritizing the audit of new features."
This is a lie. I have the on-chain data and the code history to prove it.
Over the past 30 days, SavToken has processed 14,000 transactions, with a cumulative volume of $210M. The contract has not been patched since March 2026. The last audit for SavToken was in December 2025—eight months ago. In the DeFi world, eight months is a geological age. Vulnerabilities accumulate. The protocol’s own bug bounty program has received 23 reports for SavToken in the past quarter, 16 of which remain unaddressed. The team claims "low severity," but I have reviewed three of those reports. Two involve a reentrancy vector in the token swap function that could allow a flash loan to drain the entire pool. The team marked them as "informational."
ReijndersVault is worse. Its dynamic leverage algorithm interacts with three external oracles, each with different update frequencies. In my earlier analysis, I demonstrated that an attacker could manipulate the timing of oracle updates to cause a 5% deviation in the leverage multiplier, potentially liquidating positions without price movement. The team implemented a 30-minute delay guard, but that only shifts the attack window. The underlying math is unsound. The module has not been audited since its deployment in February 2026.
The Structural Impossibility of a Selective Audit
A security audit is not a menu. You cannot pick and choose which modules to inspect based on convenience. The system is a composite. BLE depends on SavToken for liquidity aggregation. ReijndersVault uses BLE’s interest rate model. By omitting two modules, the audit of BLE becomes a hollow exercise. The attacker doesn’t care about the audit scope; they care about the attack surface.
Consider the following: In June 2026, a hacker exploited a similar three-module protocol called TriLend. The attacker found a cross-contract reentrancy that spanned two audited modules and one unaudited module. The team had audited only the core lending engine, leaving the reward distribution module unaudited. The exploit drained $45M. The post-mortem noted that the unaudited module had been live for 10 months without incident. The same language City Finance uses today.
I am not speculating. I have built a simulation model in Python that replicates the City Finance contract interactions. I ran it on a local node farm in Nairobi over the weekend. The simulation shows that an attacker can execute a multi-step transaction that starts in SavToken, uses a flash loan to manipulate the leverage multiplier in ReijndersVault, and then exits through BLE. The entire sequence takes 2 blocks. The guard in ReijndersVault is bypassed because the oracle update is triggered by a transaction in SavToken that the guard does not check. The profit potential: $8M to $12M in a single attack.
The team’s forum post claims "no critical vulnerabilities have been identified in the past 6 months." That is true only if you define "critical" as "publicly exploited." They are relying on the absence of evidence, not evidence of absence. This is the same logic that killed Terra-Luna.
Contrarian: What the Bulls Got Right
I must be fair. The bulls argue that City Finance is following a sound engineering practice: focus audit resources on new code, not mature modules. They point to the fact that both SavToken and ReijndersVault have been live for months without a major exploit. The team has a bug bounty program with a $500K max payout. The lead developer, Maresca, has a track record of shipping fast and fixing fast.
There is a kernel of truth here. Not every module needs a full audit every quarter. The cost of a comprehensive audit for all three modules would be $150K to $250K, and the team is operating on a lean budget—$2M in treasury, down from $8M in 2025. They are prioritizing survival. In a bear market, cutting audit costs is a rational short-term move.
But rationality for the team is not rationality for the user. The protocol’s own tokenomics incentivize users to deposit into SavToken and ReijndersVault. The team is removing the safety net of an audit while continuing to promote those pools. This is a classic moral hazard. The team is betting that no exploit will occur before the refactoring is complete. The users are betting their assets.
The bulls also claim that the "squad reshaping" is a positive signal—Maresca is known for fixing technical debt. She has a history of conducting internal code reviews before audits. In her previous role, she cleaned up a bridge contract that had 18 dead functions. The argument is that the omission is temporary, and the refactored versions will be audited later.
I have heard this before. In 2022, a protocol called YieldShield promised to "refactor and audit" its yield optimizer after a minor bug. The refactoring took six months. The audit never happened. The protocol was abandoned. The code is still live on-chain, accumulating dust.
The Takeaway: Accountability Is Not a Squad Selection
Every gas leak is a story of human greed. City Finance’s decision to omit two critical modules from an audit is not a technical error. It is a deliberate choice to prioritize speed and cost over user safety. The team is not incompetent; they are calculating. They know that the probability of an exploit in the next 60 days is low, but the cost of delaying the audit is zero. They are transferring the risk to users.
I do not fix bugs; I reveal the truth you hid. The truth here is that the protocol’s TVL is already down 40% in the past 30 days. The team is scrambling to maintain relevance. The reshuffle is a distraction. The real story is that two modules are being left out to dry.
If you are a user of City Finance, ask yourself: why is the team auditing only the new features? Why not audit the code that holds your assets? The answer is that they are betting you won’t ask. The hype burns hot; logic survives the cold burn.
I will be watching the SAS-2026 results. I will compare the code changes with the commit logs. If the team is honest, they will publish the full audit report, including the scope exclusion. If they are not, the blockchain will remember.
The ledger is not a football pitch. You cannot bench a vulnerability. You either fix it, or you prepare for the autopsy.
