CRX is building infrastructure to make FX risk management part of how businesses move money onchain. Its onchain rate locks combine custom contracts with USDC collateral and settlement, giving businesses a way to fix future exchange rates around the payments and revenues they actually expect.

Its ambition extends to payment platforms embedding FX rate locks directly into their own products. Bringing those capabilities onto programmable rails calls for precise financial software: collateral, counterparty permissions and settlement obligations must remain consistent throughout a trade.

CRX brought its zkVM Risk Engine and FX Clearing Core to Sherlock Audit Engine for a focused AI-only engagement. Three leading AI auditors reviewed the same scoped system: Zero Cool, SavantChat and Zellic V12.

The result was 21 distinct accepted findings from 51 submissions. Together, they identified seven more findings than the highest individual total.

The zkVM risk engine behind CRX's rate locks

Foreign-exchange exposure can change the economics of a business transaction between agreement and payment. CRX lets customers request a forward contract around a specific need, including the currency pair, direction, amount and settlement date. Its product combines competitive quoting with USDC-based collateral and settlement.

The opportunity is to make sophisticated FX risk management accessible through software that can express a customer's particular exposure and carry the resulting obligations through clearing.

Verifiable computation adds another dimension to that architecture. A zero-knowledge virtual machine can produce evidence that a particular program executed and generated its stated outputs. The program's financial rules must also express the intended behavior. A security review can examine whether permitted state changes preserve those rules under unexpected inputs and adversarial actions.

For CRX, the review reached four connected areas:

• Collateral and solvency: how obligations interact with the funds available to support them.
• Counterparty authorization: whose approval a position change requires.
• Closeout accounting: how the system handles the end of a financial position.
• Withdrawal and recovery: what happens during account cleanup or exceptional operating conditions.

These interactions make the clearing core valuable to scrutinize as a complete financial system.

A focused AI-only run through Audit Engine

CRX's submission window ran from September 3 to September 8. Its discovery roster consisted entirely of 3 leading AI auditors: Zero Cool, SavantChat and Zellic V12. Each could examine the same scoped code and submit findings independently.

CRX kept the engagement lightweight by using purpose-built AI auditors without adding separate frontier LLM runs alongside them. This describes the selected review participants; the AI auditors can use language models within their own systems.

An AI-only run lets a team bring multiple specialized auditing systems into one scoped review. Audit Engine coordinates their submissions, judging and consolidation, so the team can work from a single accepted finding set.

The workflow gave CRX a straightforward path from parallel analysis to engineering priorities:

1. Independent discovery. Three AI auditors reviewed the same scoped system using their respective approaches.
2. Judging and consolidation. All 51 submissions were judged, final severities were assigned and duplicates were consolidated.
3. One accepted finding set. CRX received 21 distinct findings, with attribution showing each auditor's contribution.

This is the practical value of Audit Engine's coordinated review model: several independent approaches can contribute to one result the engineering team can use.

Seven findings beyond the highest individual result

SavantChat identified 14 accepted findings, Zero Cool identified nine and Zellic V12 identified five. These totals include shared discoveries. After deduplication, their combined work produced 21 distinct findings.

Compared with the highest individual total of 14, combining the three added seven findings, a 50% increase in the accepted finding set for this engagement.

A wider set of priorities for CRX's engineers

CRX is building infrastructure that connects business FX needs with programmable contracts, verifiable computation and USDC clearing. It chose a focused security review that could examine the application logic across those financial operations.

Audit Engine gave the team one consolidated result from three independent AI auditors. The combined set exceeded the strongest individual result by seven accepted findings.

For teams developing specialized financial systems, this engagement shows the value of selecting multiple AI auditing approaches, measuring their contributions and consolidating their work into clear engineering priorities.

Contact Sherlock to build an AI-only review around your codebase.

‍

‍