Institutional real-world asset platforms need security review that reflects how they will operate in practice. We worked with @ChainLabCTU (@CVUTFEL) on an institutional RWA platform for tokenised bonds supporting SME financing on EBSI. The scope covered two Solidity codebases across bond lifecycle logic, identity controls, custody, account abstraction, recovery, and WebAuthn validation. The engagement combined a private CODESPECT review with a SpecSiege community audit contest. The case study explains how the two review layers supported broader coverage and helped prepare institutional RWA infrastructure for production. The link to the case study is in the reply ⏬

Some of Ethereum’s most famous bugs don’t exist by design on Soroban (@StellarOrg). Soroban is Stellar’s smart contract platform. Its designers learned from EVM bugs and built protections into the host. How: → reentrancy is blocked by the host → no delegatecall or selfdestruct → require_auth() handles signatures and replay protection → constructors run atomically at deploy Still a risk: → Authorisation. A missing or misplaced require_auth() lets anyone act without permission. → Math and rounding. Rounding in the user’s favour can be exploited repeatedly, and casts silently truncate values. → Upgrades. update_current_contract_wasm replaces the contract’s code. The risk lies in who can trigger the upgrade and in incompatible data between versions. New risk: → State archival. Every storage entry has a TTL (time to live) and gets archived or deleted unless it’s extended. So Soroban doesn’t solve every problem. Some security risks remain; others shift to new areas. Still, it’s good to see teams building new VMs thinking about security. As a security company, we can only appreciate these efforts.

Meet our founder in Lisbon next week.

Tokenised real-world assets aren’t spread evenly across chains. Issuers have clear favourites. Can you guess the top 3 chains? Ranked by RWA active AUM (DefiLlama): 🥇Ethereum 🥈BNB Chain 🥉Stellar The #3 spot may surprise many, but Stellar’s RWA holdings now exceed even Solana’s. Beyond AUM, it’s fair to look at DeFi usage too. There, Solana jumps ahead, and Stellar drops sharply. Not a bad sign. It points to more conservative investors. Security-wise, the risk doesn’t disappear. It shifts from DeFi integrations to the issuer.

This is very inconvenient for both businesses and users. It shows the importance of blockchain for redundancy. We are glad there is always an alternative.

Link to the article: codespect.net/blog/beyond-th… END OF TWEET

Week in review at CODESPECT: Heads or tails, your protocol deserves to land safe. On-chain: we wrapped up security work for @SuperVegaXYZ. Off-chain: we focused on Web2 infrastructure, APIs and access. We also went deep on CRA and DORA. Why should security testers care about regulation? Because clients need more than a list of vulnerabilities. They need evidence to back their security claims. And that evidence has to cover APIs, authentication and backend systems too.

🔐Secure signing begins with your code, not the user. Ask yourself three questions before an attacker does: ☐ Can a hardware wallet display your transaction in readable form? ☐ Does your product’s multisig restrict what can be signed? ☐ Is your frontend protected against tampering? If the answer is “not sure”, you just found your first finding.

“We have a multisig. We’re safe.” Three signers can approve the same malicious transaction if they trust one compromised interface. For crypto and RWA teams, pentest the signing workflow too. How independent are your approvals?

Price targets. Deadlines. Automatic payouts. Contract logic matters. We completed a smart contract audit of @SuperVegaXYZ, a @Starknet options protocol now in beta. The report remains private for now. Great working with the team.

The more a protocol touches Web2, the less its security depends on the contract alone. RWAs, oracles and fiat-backed stablecoins show it best. Many of the largest hacks start in systems that hold authority over the contract. Case in point: Bybit. Safe’s contract was never broken, yet $1.5B left via a compromised signing UI. What to watch: custody, KYC, mint and redeem backends, price feeds, signer infra. Pentests cover much of it. Secure both sides. Hybrid protocols need audit + pentest.

CRA and DORA can overlap wherever regulated finance relies on software products. In DeFi, RWA is where that overlap shows most clearly. What applies today, and what needs to be tested? The tables below break it down. As you can see, you don’t have to cover it alone. CODESPECT helps on both layers: smart contract audits on-chain and also penetration testing off-chain.

Got DORA covered? Great. But DORA covers the firm. The Cyber Resilience Act (CRA) covers the product. Since 11 September, manufacturers must report actively exploited product vulnerabilities once they become aware of them. Wallets, apps, SDKs and browser extensions may be in scope in the EU. ⏱️ 24h: early warning ⏱️ 72h: vulnerability notification ⏱️ 14 days after a fix or mitigation is available: final report For certain breaches, fines can reach €15M or 2.5% of worldwide annual turnover. CODESPECT helps you find vulnerabilities before attackers do through smart contract audits and penetration testing of your apps and APIs.

Our pleasure to always support Solana community in Czech Republic.