CODESPECT

Institutional real-world asset platforms need security review that reflects how they will operate in practice. We worked with @ChainLabCTU (@CVUTFEL) on an institutional RWA platform for tokenised bonds supporting SME financing on EBSI.

The scope covered two Solidity codebases across bond lifecycle logic, identity controls, custody, account abstraction, recovery, and WebAuthn validation. The engagement combined a private CODESPECT review with a SpecSiege community audit contest.

The case study explains how the two review layers supported broader coverage and helped prepare institutional RWA infrastructure for production. The link to the case study is in the reply ⏬

Devcon 8 in Mumbai (@EFDevcon) is behind us

A week of deep technical talks and many conversations about where crypto security already delivers and where it still falls short.

Our takeaways:
- Formal verification was one of the big themes. Mathematically proving that code does what it should is powerful, and we are curious how fast it matures.
- But no proof protects you from a malicious .vscode folder. Clone a “take-home task” during a fake interview, an auto-run task fires the moment you open the folder, and keys are gone. Perfect contracts, same loss.
- Smart contract security is one layer of Web3 security, not all of it. Recent incidents keep proving it. Infra and opsec deserve the same investment as audits.

Rule #1: never open untrusted repos on a machine that holds keys or wallets. If you have to look at one, do it in a disposable VM, never on your main workstation.

Thanks to everyone we met and talked with during the week. See you at the next one in Lisbon.

Smart contract audit of @HyperHive_Fi is complete.

HyperHive is an ERC-4626 yield vault on HyperEVM.

Our focus areas:
• Reward accrual vs. actual reward backing
• ERC-4626 entry points and limits under pause and solvency conditions

Every finding was fixed or acknowledged. Thanks to the HyperHive team for a smooth collaboration.

Full report below⏬

Glad to support Telescope ahead of launch with our AI auditor tool, SpecSabre.

It looks at the code from a different angle, helping Telescope strengthen the operation of their protocol and uncover special edge cases that could arise.

Eight years of work to defend against a computer that doesn’t exist yet.

NIST started standardising post-quantum algorithms in 2016. The first standards landed only in 2024.

If you verify signatures on-chain, the next step affects you directly.

A big theme of Day 1 at @EFDevcon was the next step: preparing Ethereum for the post-quantum era. New cryptography is being built with formal verification in mind.

The bar goes up. The risk doesn’t disappear; it moves:
→ a proof is only as good as the spec it checks against → serialisation, key handling, and client or contract integration often remain outside the proof
→ signatures get much bigger: ECDSA 65 B vs. ML-DSA 2.4 KB+ and SLH-DSA 7.8 KB+.

For contracts adopting these schemes, that changes calldata, verification, and gas costs.

Writing signature verification today? Enforce the exact encoding of every algorithm you support, but keep the interface versioned and extensible so new algorithms can be added safely.

Verified crypto plus audited integration. You need both.