Audit reports

All Case Studies

Case Studies

About

Careers

Brand Assets

Invest

Company

Audits 

Services

Mitigate weaknesses in your smart contract and improve its functionality with a double line-to-line code analysis and a separate review by a lead auditor.

Secure the entire architecture and implementation layers of your blockchain protocol with professional security audits and testing.

Proactively detect vulnerabilities in your Web3 project by subjecting your systems to a simulated cyberattack in a secure and controlled environment.

Identify vulnerabilities in applications interacting with blockchain networks with secure code review and static security analysis.

Code review & static security analysis for crypto wallet apps.

Code review & security analysis for cross-chain crypto bridges.

Receive only relevant bug reports or undergo crowdsourced penetration testing with the help of thousands of ethical hackers curated by HackenProof.

Enhance transparency in crypto exchanges with independent on-chain proof of assets’ true collateralization.

Assess and strengthen your security practices, identify vulnerabilities, and safeguard valuable digital assets in the ever-evolving cryptocurrency landscape.

Ensure your token model robustness and efficiency and convey trust to investors and community with our thorough, independent audit of protocol economic security.

Solutions

Featured ecosystems

By Languages

Blog

Company 

Discover

Insights

Industry news

Network

Hacken news

Resources

Smart Contract Audit

Blockchain Protocol Audit 

Blockchain Penetration Testing

dApp Audit

Cross-Chain Bridge Audit

Crypto Wallet Audit

Bug Bounty

Proof of Reserves Audit

Solidity

Rust

Move

Solana

Near

Polkadot 

Cosmos 

Optimism

Ethereum (EVM) 

Avalanche

Fantom

Polygon

Aptos

zkSync

Arbitrum

Radix

Linea

MetaMask

Smart Contract Audit Solutions

Terms and Conditions 

Privacy Policy

Best Practices For Secure MetaMask Snaps Development

Bitcoin Layer 2 Uncovered: Exploring Its Growth & Key Projects To Watch In 2024

<p>The primary approach for creating smart contracts involves using languages specifically designed for the Ethereum Virtual Machine (EVM), such as Solidity and Vyper. While these languages were purpose-built for Ethereum, when compiled to 256-bit runtimes, the EVM smart contracts inadvertently face slower execution times.</p>



<p>Enter, WebAssembly, or Wasm. With its ability to match the semantics of a CPU architecture like ARM or x86, Wasm paves the way for near-native execution. Let’s explore how Wasm modular blockchain apps can transform Web3.</p>



<h3 class="wp-block-heading">Introduction to WebAssembly</h3>



<p>WebAssembly (Wasm) is a binary instruction format for a stack-based virtual machine. It has four number types of 32- and 64-bit integers and floats (i32, f32, i64, and f64) and uses linear memory. Wasm has rapidly emerged as a portable, performance-oriented solution that is compatible with most web browsers. This makes it an appealing target for most Web3 developers.</p>



<p>With its minimalistic design and superior execution efficiency, Wasm is widely adopted by prominent blockchain platforms, including Radix, Near, and EOSIO, where it serves as the runtime for smart contracts.</p>



<p>The full list of blockchain protocols supporting compilation to Wasm is steadily growing.</p>



<figure class="wp-block-image size-large"><img src="https://wp.hacken.io/wp-content/uploads/2024/03/Blockchain-Protocols-Supporting-WebAssembley-1024x480.jpg" alt="Radix

Near

EOSIO

Astar &amp; Shiden

Elrond

Cosmos SDK

Polkadot SDK

Internet Computer

Kusama

Secret

Casper

Vexanium

Parity's Kovan testnet for Ethereum" class="wp-image-21986"/></figure>



<h3 class="wp-block-heading">Understanding Wasm Smart Contracts</h3>



<p>Most Wasm smart contracts are written in Rust and Go. Other popular languages for this task include nk!, C/C#/C++, AssemblyScript, TypeScript, Motoko, and many others.</p>



<p>Like most contracts, Wasm smart contracts mostly involve contract storage, permission, and account management logic. Unlike contracts for traditional execution environments, Wasm contracts are modular and can be easily modified to meet specific requirements, given the appropriate blockchain implementation. The same base logic can drive different blockchains, modifying only the interface layer. This feature makes Wasm an advantageous choice for creating cross-compatible and efficient dApps, as it provides a general-purpose virtual machine and bytecode—all within a secure, high-performance environment.</p>



<p>Overall, a Wasm smart contract reflects a paradigm shift in contract development, eliminating the need to create a specialized language for each platform. Powered by a configurable virtual machine, these contracts ensure secure and scalable execution, dividing the load evenly for effective maintenance.</p>



<h2 class="wp-block-heading">The Case for Wasm in Smart Contracts</h2>



<h3 class="wp-block-heading">Efficient and Fast</h3>



<p>Wasm executes at near-native speeds thanks to the key technical advantage of a 32-bit word size, particularly when compared to 256-bit architectures typically utilized by blockchains such as Bitcoin/Ethereum and their copies.</p>



<p><strong>The challenge with 256-bit runtimes. </strong>Platforms like Ethereum's EVM and all their forks operate on a 256-bit word size. This size refers to the amount of data a CPU's internal data registers can process simultaneously. However, procedures involving 256-bit integers or cryptographic functions can be computationally intensive, leading to slower execution times. Besides, modern hardware usually supports smaller word sizes, meaning that 256-bit operations must be emulated, adding to the inefficiency.</p>



<p><strong>The efficiency of Wasm32</strong>. In contrast, Wasm uses a 32-bit word size in its runtimes (Wasm32). This smaller word size is designed to align with the physical machine semantics of modern hardware, enabling it to execute with increased efficiency. This alignment makes Wasm vastly more efficient compared to 256-bit runtimes for integer operations, consensus algorithms, and more blockchain operations, with speed improvements potentially in the thousands.</p>



<h3 class="wp-block-heading">Broader Technical Characteristics</h3>



<p><strong>Size</strong>: While sometimes larger, Wasm contracts size is generally comparable with EVM and aligns with the space-constrained blockchain environment, enabling the delivery of smart contracts over the Internet.</p>



<p><strong>Security</strong>: Like most VMs, Wasm offers a memory-safe, sandboxed execution environment for non-web embeddings and enforces the web environment's same-origin and permissions security policies.</p>



<p><strong>Language support</strong>: In theory, Wasm allows developers to compile a Wasm module from various high-level languages, including Rust, C/C++, C#, Typescript, Haxe, and Kotlin, among others, granting high flexibility and inclusivity. However, the variety is constrained by the limitations of the blockchain platform as it also requires SDK and API for a given language from blockchain devs.</p>



<p><strong>Cross-platform portability: </strong>Binary format allows for efficient execution for both web and non-web embeddings—meaning the same set of codes can extensively run on different platforms without much alteration required. For now, this merit is not as important from the blockchain perspective.</p>



<h2 class="wp-block-heading">Wasm Limitations</h2>



<h3 class="wp-block-heading">Debugging</h3>



<p>While debugging features are common across virtual machines, Wasm's debugging tools for blockchain applications are still evolving, making EVM debugging potentially easier due to the availability of established tools.</p>



<p>EVM is currently favored for smart contract debugging, but Wasm still provides at least some testing capability. Similarly to almost every VM, Wasm’s binary format allows for quicker parsing and execution. Wasm also offers a human-readable <a href="https://developer.mozilla.org/en-US/docs/WebAssembly/Understanding_the_text_format">text format</a> (.wat) for debugging and testing, but this is very rarely used in practice.</p>



<h3 class="wp-block-heading">Memory Safety</h3>



<p>Wasm's design as an object file format executed in the browser notably lacks integrated memory safety mechanisms such as stack canaries and address space layout randomization (ASLR). It’s important to note that this limitation is not important in the blockchain context.</p>



<p>See full WebAssembly Specification <a href="https://webassembly.github.io/spec/core/index.html">here</a>. </p>



<h2 class="wp-block-heading">Wasm Smart Contract Vulnerabilities</h2>



<p>Wasm smart contracts have inherent vulnerabilities, much like Ethereum smart contracts. For example, analyzing 4616 smart contracts on EOS, researchers have <a href="https://ietresearch.onlinelibrary.wiley.com/doi/full/10.1049/blc2.12029">identified</a> 13 real-world vulnerable contracts.</p>



<p>Wasm smart contracts are often compiled from memory-unsafe languages like C and C++. This deficiency exposes Wasm to classic vulnerabilities like stack overflow, which are otherwise tough to exploit in native binaries due to inherent mitigations.</p>



<p>Compounding this vulnerability, certain environments even provide developers with built-in functions like <code>memcpy()</code> and <code>strcpy()</code>. While useful, these functions can inadvertently lead to stack overflow issues if not used cautiously.</p>



<p>General-purpose languages weren't designed to write smart contracts. To bridge this gap, we can leverage suitable libraries. For instance, Rust can write smart contracts effectively but requires a lot of code in its current state, dampening its ease of use. It is also worth noting that while Rust offers excellent support enforcing <a href="https://doc.rust-lang.org/book/ch03-01-variables-and-mutability.html">immutability</a>, this feature is seldom used.</p>



<p>Despite its impressive characteristics, the inherent vulnerabilities in Wasm smart contracts necessitate enhanced security measures through a more thorough <a href="https://hacken.io/services/blockchain-security/smart-contract-security-audit/">code review</a> during development and execution.&nbsp;</p>



<h2 class="wp-block-heading">Language Support &amp; Development Tools</h2>



<p>The <a href="https://webassembly.org/getting-started/developers-guide/">extensive language support</a> of Wasm is an impressive feature, supporting C/C++,&nbsp; Rust, AssemblyScript, C#, Dart, Via Flutter, F# Go, Kotlin, Swift, D, Pascal, Zig, and Grain (provided that a blockchain platform also supports it).</p>



<h3 class="wp-block-heading">Development Tools For WASM</h3>



<p>Currently, WASM lacks EVM-level tooling for developers, as noted <a href="https://medium.com/supercolony/tools-for-smart-contracts-in-polkadot-60453341e934">here</a>. Key problems are inadequate documentation, lack of dedicated development tools and live public networks to run the contract, and few existing projects to guide newcomers. </p>



<p>Despite these challenges, some tools do exist:</p>



<ol>
<li><strong>LLVM: </strong>Wasm benefits from over 2 decades of progress in modular and reusable compiler and toolchain technologies with the <a href="https://llvm.org/">LLVM Compiler Infrastructure</a>.</li>



<li><strong>Wasmcov</strong>: Rust library and an associated binary that provides automated coverage analysis of Wasm executables. Developed by Hacken, it specifically addresses the lack of automated test coverage tools for Wasm. Learn more <a href="https://hacken.io/hacken-news/code-coverage-for-wasm/">here</a>.</li>



<li><strong>WASMOD</strong>: Wasm overflow detector that combines bytecode instrumentation, run-time validation, and grey-box fuzzing to detect integer overflow and stack overflow vulnerabilities. Not an actual open-source tool (a research <a href="https://ietresearch.onlinelibrary.wiley.com/doi/full/10.1049/blc2.12029">prototype</a>), but can be implemented into one.</li>
</ol>



<p>Note: the vast majority of Wasm smart contract development tools are platform-dependent, meaning they will only work with the intended blockchain.</p>



<h3 class="wp-block-heading">Developing Smart Contracts In WASM Using Ink!</h3>



<p>One of the ways to start writing Wasm smart contracts is through a Rust language extension that uses the Contracts pallet called !ink. Using a Rust-like syntax, it supports multiple constructor functions and offers variable storage entries, all while hiding the raw implementation details. Ink! also offers a vulnerability analyzer and dApp Boilerplate. With ink! you can use the following tools:</p>



<ul>
<li>Swanky Suite: All-in-one suite with many features, such as a local contract development node with instant finality, a prebuilt Docker image for a ready dev environment, project templates, compilation, and types generation for ink! projects, Typescript-based integration testing, network account management, and smart contract deployment support within the Polkadot ecosystem.</li>



<li>OpenBrush: Open-source library created to provide basic and advanced contract programming features to new ink! developers.</li>
</ul>



<p>Overall, for some developers, extensions like ink! may offer a gateway into Wasm smart contracts.</p>



<h2 class="wp-block-heading">Wasm's Future Outlook</h2>



<p>Talking about the future, let’s focus on the Wasm paradigm in smart contract development. It is truly game-changing. Instead of having to create a specialized language for smart contracts for every platform, the industry can use Wasm with a limited VM as a security layer. A configurable VM used by many is going to be a good place to split maintenance costs.</p>



<p>Further, the modular nature of Wasm empowers smart contracts to be created as truly executable code on a blockchain, which can be easily adapted based on specific requirements. For example, the same base logic for yield calculation can be utilized across two different blockchains simply by adjusting the "interface" layer, enabling seamless scaling across different protocols.</p>



<p>Wasm's potential isn't just limited to blockchain applications. As an efficient intermediate language (IL), Wasm aspires to become a third architectural model for cross-platform applications, transcending beyond the blockchain-specific use case. The fact that Wasm can be instrumented effectively not only for blockchain but also for a diverse set of platforms – from web browsers to embedded systems – greatly broadens its scope of influence in the future of software development.</p>



<p>In essence, the future for Wasm smart contracts is promising. With robust security, cross-platform compatibility, performance efficiency, and scalability, we can be talking about a new paradigm shift in smart contract development with Wasm.</p>



<p>As we look ahead, the adoption of Wasm will continue to rise, with many projects and protocols incorporating it into their infrastructure, reaffirming its transformative potential in the blockchain ecosystem.</p>

WebAssembly (WASM) Smart Contracts: Their Role In Future Blockchain Ecosystems

<p>VeChain stands at the forefront of blockchain innovation, offering robust solutions that enhance business operations and supply chain management. A pivotal component of VeChain's ecosystem is its Account Abstraction Layer (AAL), designed to streamline user interactions by abstracting complexities associated with blockchain transactions.</p>



<p>In December 2023, Hacken conducted a comprehensive audit of VeChain's Account Abstraction, awarding it a perfect 10/10 score.</p>



<h2 class="wp-block-heading">Audit Overview</h2>



<p>The technical audit of VeChain's Account Abstraction Layer (AAL) was meticulously designed to evaluate its security, code quality, and documentation depth, with a specific focus on its innovative implementation of <a href="https://hacken.io/discover/erc-4337-account-abstraction/">ERC-4337</a>, adapted from Eth-Infinitism.</p>



<h3 class="wp-block-heading">About Account Abstraction</h3>



<p>ERC-4337 introduces a revolutionary approach to <a href="https://hacken.io/discover/account-abstraction/">account abstraction in Ethereum</a>, eliminating the need for users to hold Ether for transaction fees. It facilitates user-friendly interactions with the blockchain through the integration of "bundlers" and "Smart Contract Wallets" (SCWs), significantly enhancing transaction flexibility and smart contract operability.</p>



<h3 class="wp-block-heading">VeChain’s Implementation of ERC-4337</h3>



<p>VeChain's AAL, leveraging this standard, includes advanced features such as the ability for the BasePaymaster owner to manage VTHO tokens through functions like addStake(), unlockStake(), and withdrawStake(), enabling precise control over staking and withdrawal processes. This audit scrutinized the AAL's adherence to these technical specifications, aiming to ensure that VeChain's implementation not only met but surpassed the rigorous requirements set forth by blockchain security standards.</p>



<h2 class="wp-block-heading">Methodology</h2>



<p>The audit methodology utilized automated tools for initial vulnerability identification, followed by detailed manual testing to probe deeper into identified issues.</p>



<p>Manual testing was pivotal, focusing on areas like misconfigured access controls, insecure API endpoints, and inadequate encryption practices, which automated tools might overlook.&nbsp;</p>



<p>This methodical approach emphasized real-world attack scenarios, ensuring a comprehensive assessment by simulating potential threat vectors. It aimed at uncovering not just superficial <a href="https://hacken.io/discover/smart-contract-vulnerabilities/">vulnerabilities</a> but also intricate security flaws that could compromise the system's integrity, providing a robust framework for securing VeChain's AAL against sophisticated cyber threats.</p>



<h2 class="wp-block-heading">Key Findings and Insights</h2>



<p>The audit uncovered several issues of varying severities, from medium to low; no critical or high issues were found. Here are some key insights:</p>



<ul>
<li>We found a medium-severity issue related to redundant gas reservation, which could impact transaction efficiency.</li>



<li>Low severity issues included potential execution reversion from incorrect revert reason sizes and inconsistencies in user operation hash generation.</li>
</ul>



<p>These findings underscored areas for enhancement, all of which were promptly addressed by VeChain's development team.</p>



<h2 class="wp-block-heading">Security Enhancements and Best Practices</h2>



<p>VeChain addressed audit findings, achieving a perfect total and security score of 10/10. Enhancements included optimizations to gas reservation processes and improvements in error handling and hash generation mechanisms. The audit's recommendations also led VeChain to adopt new <a href="https://hacken.io/discover/smart-contract-security-guide/">best practices in secure smart contract development</a> and documentation.</p>



<h2 class="wp-block-heading">Conclusion</h2>



<p>The audit significantly bolstered the security and functionality of VeChain's Account Abstraction Layer. By embracing the audit's findings and recommendations, VeChain demonstrated its commitment to security and reliability. This case study not only highlights the critical role of comprehensive audits in blockchain ecosystem development but also VeChain's dedication to continual improvement and innovation.</p>

Ensuring the Integrity of VeChain’s Account Abstraction Layer: A Case Study

Smart Contract Auditing Tools Reviewed: Pros, Cons, And The Need For Manual Checks

<p><a href="https://www.radixdlt.com/">Radix</a> is a layer-1 network for Web3 and DeFi decentralized applications (dApps) and users. It seeks to create a scalable, secure-by-design, and composable DeFi platform through its Radix Engine application layer and its Cerberus consensus layer.</p>



<p>The Radix Engine has undergone a comprehensive security audit by Hacken, receiving the highest possible score of 10 out of 10. As a member of <a href="https://hacken.io/partners/">Hacken Partnership Network</a>, Radix also enjoyed priority access to our leading L1/L2 Audit Team.</p>



<p>While the full report is available on our <a href="https://hacken.io/audits/radix/">website</a>, let’s explore this case in more detail.</p>



<h2 class="wp-block-heading">Audit Objectives</h2>



<p>The audit aimed to evaluate the Radix Engine's security, code quality, documentation, and architectural integrity, ensuring it meets high standards for scalable DeFi development.</p>



<h3 class="wp-block-heading">Radix Engine Overview</h3>



<p>The core focus of the audit was the Radix Engine, the main execution component of the Radix layer-1 network. Built on WebAssembly Virtual Machine (WAVM), it offers a specialized environment for running dApps with a focus on DeFi use cases. Scrypto is an asset-oriented smart contract language to create dApps that execute within the Radix Engine. The engine uses well-defined finite state machines (FSMs) to control tokens and other assets, guaranteeing secure and predictable DeFi transactions.</p>



<p>In 2023, the engine's WASM interface received a substantial update, providing a more refined low-level WASM API and improving its Scrypto function export signatures. This revision simplified Scrypto contract execution, aligning with the network's objective of making DeFi dApp development more efficient and secure. The update also necessitated a third-party security review.</p>



<h2 class="wp-block-heading">Methodology</h2>



<p>Employing a <a href="https://hacken.io/discover/smart-contract-audit-process/">comprehensive audit approach</a>, Hacken’s premier L1/L2 Audit Team combined automated tools with manual testing to thoroughly assess the Radix Engine, ensuring a detailed and effective analysis. The audit scope covered a wide array of components and functionalities to guarantee the system's security and efficiency:</p>



<ul>
<li><strong>Protocol Audit</strong>: In-depth examination of native blueprints, account and access controllers, resource management (including vaults, buckets, and proofs), package and transaction processors, consensus and validation mechanisms, and authentication practices. This comprehensive review included an analysis of attack scenarios such as permission escalation and auth bypass.</li>



<li><strong>Costing and Limit Models: </strong>Review of costing and limits implementation to ensure resilience against attacks affecting liveness, finality, eclipse, and double-spending. This involved a detailed analysis of potential attack scenarios.</li>



<li><strong>VM Engine: </strong>Evaluation of the VM implementation, including instruction sets and state transition mechanisms. The audit also reviewed common VM vulnerabilities and conducted attack scenario analyses focusing on gas, race conditions, stack, DoS, and state implosion risks.</li>



<li><strong>Protocol and VM Tests</strong>: Extensive testing environment setup, including fuzz tests focused on resource invariants to identify vulnerabilities within the VM and protocol.</li>
</ul>



<p>This meticulous methodology aimed to uncover and address potential vulnerabilities across the Radix Network, ensuring a secure and robust platform for DeFi applications.</p>



<p>The audit was conducted against the code state during development, prior to the mainnet release.</p>



<h2 class="wp-block-heading">Audit Findings</h2>



<p>A critical issue, namely a lack of 2nd resource address validation, was identified and fixed. Multiple instances within the resource blueprints allowed for interactions between two resources without confirming their identical type. A prime example was the put function in the fungible vault, which omitted a crucial check to ensure the Bucket's resource type aligned with the vault's. The Radix development team <a href="https://www.radixdlt.com/blog/radix-engine-code-audit#second-audit-results">indicated the cause as a regression</a> resulting from a refactor of the related code immediately before the audit began.</p>



<p>This oversight allowed for the possibility of depositing Buckets containing different token types into a vault designed for a specific token, leading to a potential unauthorized conversion of token types. For instance, a non-XRD token could have been wrongly inserted into an XRD vault, potentially enabling the unrestricted creation of new XRD tokens.</p>



<p>This vulnerability was marked with a critical severity level due to its implications for token integrity and system security. The recommendation was to implement strict validation checks during resource interactions to ensure the compatibility of resource types, alongside comprehensive logging and monitoring to detect and prevent such discrepancies.</p>



<p>There were also 2 low-severity issues, including an overflow in the compare_current_time function and a potential supply chain attack in Scrypto dependency management. All identified vulnerabilities were confirmed and fixed by the Radix team prior to their mainnet release.&nbsp;</p>



<p>The full report is public and can be accessed at <a href="https://hacken.io/audits/radix/">https://hacken.io/audits/radix/</a></p>



<h3 class="wp-block-heading">Code and Architecture Quality</h3>



<p>The Radix Engine audit report highlights exceptional code and architecture quality, each scoring a perfect 10 out of 10. The codebase is well-crafted, organized, and developer-friendly, featuring robust testing and adhering to best practices. The architecture is innovative, supporting an efficient and secure development environment, despite minor performance issues.</p>





<h2 class="wp-block-heading">Conclusion</h2>



<p>The comprehensive audit of the Radix Engine by Hacken, which scored 10 out of 10, underscores the commitment to advancing blockchain technology safety and enhancing the security, code quality, and reliability of the Radix platform. This partnership between Hacken and Radix, marking Hacken as the first authority for Radix-based project audits, significantly boosts the Radix ecosystem's security. This collaboration not only reinforces the robustness of dApps developed on Radix but also instills greater confidence among users and developers. It reflects Hacken's deep expertise in Radix's technology stack and its dedication to making Web3 safer, further advancing the industry and strengthening the partnership.</p>

Blockchain Protocol Audit For Radix Engine

<p>In the evolving landscape of finance and investment, tokenization of real-world assets (RWAs) stands out as a revolutionary concept, blending traditional assets with modern blockchain technology.&nbsp;</p>



<p>Unlike many things in crypto, tokenization is not another hype term. It’s hard to dismiss RWA tokenization as a fad when figures like Larry Fink, the CEO of BlackRock–the world’s largest investment management firm–have repeatedly advocated for asset tokenization.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
https://twitter.com/RadarHits/status/1746155031265489197
</div></figure>



<p>On top of that, in 2023, the Federal Reserve Board <a href="https://www.federalreserve.gov/econres/feds/files/2023060r1pap.pdf">suggested</a> that “tokenization may become a larger part of the digital asset ecosystem.” Today, the biggest financial institutions in the world–European Investment Bank and J.P. Morgan–have already tokenized bonds and other securities to lower the barriers to entry into otherwise inaccessible markets. At the same time, the top DeFi protocols like MakerDAO and FRAX pioneered RWAs to gain more stability.</p>



<h2 class="wp-block-heading">What Are Real-World Assets?&nbsp;</h2>



<p>Real-world assets encompass tangible and intangible assets, including stocks, bonds, real estate, commodities, luxury items, and equities. These assets form the backbone of the everyday economy, representing value in physical and legal forms.</p>



<h2 class="wp-block-heading">What Is Asset Tokenization?</h2>



<p>Asset tokenization is the process of converting rights to an asset into a digital token on a blockchain. Just like owning a stock equates to owning a part of a publicly traded company, owning a digital token equates to owning any real-world asset. This transformation facilitates the division of assets into shareable and tradeable units, enhancing their liquidity and accessibility.&nbsp;</p>



<h3 class="wp-block-heading">Blockchain Technology</h3>



<p>Tokenization involves critical components such as blockchain technology, valuation mechanisms, and redemption processes, underscoring its potential to bridge digital and traditional financial markets. The process leverages smart contracts to automate management, offering a secure, efficient, and transparent method of handling investments.&nbsp;</p>



<p>To be more specific, the majority of existing tokenization projects are deployed as ERC-20 tokens on the permissionless (i.e., public) blockchain such as Ethereum or Polygon. There are a few permissioned blockchains, such as GS DAP and HSBC Orion, used by the European Investment Bank, and Onyx Digital Assets, used by J.P. Morgan.</p>



<h3 class="wp-block-heading">Use Cases for RWA Tokenization</h3>



<p>The market value of tokenized assets on permissionless blockchains, estimated at <a href="https://www.federalreserve.gov/econres/feds/files/2023060r1pap.pdf">$2.15 billion</a> as of May 2023, illustrates the growing variety and adoption of tokenized assets. This table outlines the diverse range of asset types that have been tokenized, showcasing the innovative intersection of traditional finance and blockchain technology.</p>



<figure class="wp-block-table is-style-stripes has-small-font-size"><table><tbody><tr><td>Asset Type</td><td>Description</td><td>Tokenization Examples</td></tr><tr><td>Financial assets</td><td>Monetary assets held for investment and easily tradable. They include stocks, bonds, bank deposits, and other instruments representing a financial claim or contractual obligation.</td><td>1. European Investment Bank: Issued pound sterling and euro-denominated bonds on HSBC Orion and Goldman Sachs' GS DAP platforms, utilizing CBDC tokens for instant settlement and fiat cash for coupon payouts.<br><br>2. Obligate: A platform that enables companies to issue bonds and commercial paper directly on blockchains, offering ERC-20 tokens representing the bonds.<br>3. Goldfinch: Issues pool-specific tokens for diversified pools of financial assets, likely related to debt instruments.<br>4. Onyx by J.P. Morgan: A blockchain-based platform for tokenizing and transacting digital assets, including government securities and intraday repo transactions.<br>5. MatrixDock: Issues stablecoins backed by U.S. treasury securities and reverse repurchase agreements.<br>6. Ondo Finance: Offers tokenized ETFs referencing various funds, including those linked to U.S. Treasuries and Money Market Funds.</td></tr><tr><td>Equity</td><td>Ownership shares in companies or ventures that can appreciate in value over time.</td><td>1. Hacken: Issued 100 tokens for 10% of the total stake in the company.<br>2. Aktionariat (DAKS): Issues tokens for private equity investments, representing equity in companies.</td></tr><tr><td>Commodities &amp; Physical Assets</td><td>Basic interchangeable goods; valuable physical assets such as artwork and precious metals.</td><td>1. Agrotoken: Provides tokenized agricultural commodities (soybeans, corn, wheat) with tokens.<br>2. Paxos Trust: Custodies and tokenizes assets like gold, offering 24/7 settlement and physical redemption.<br>3. Tangible (TNFTs): Tokenizes tangible items like wine, gold, and watches into NFTs.<br>4. TG Commodities Limited: Issues Tether Gold, providing a direct link between each token and a specific quantity of gold.</td></tr><tr><td>Real Estate</td><td>Direct investments in land, buildings, and property</td><td>1. RealT: Collects residential properties to tokenize the membership interests in the LLC owning the property, allowing fractional ownership.<br>2. Lofty: Enables fractional ownership of U.S. rental properties through tokenization on the Algorand blockchain.<br>3. Tangible (USD): Represents real estate investments with tokens that correspond to real-world properties.</td></tr></tbody></table></figure>



<h2 class="wp-block-heading">Potential Benefits of Tokenizing RWAs:</h2>



<p>Tokenizing RWAs is a gateway for traditional institutions in the blockchain world and offers groundbreaking changes for investment and asset ownership. According to the <a href="https://www.federalreserve.gov/econres/feds/files/2023060r1pap.pdf">Federal Reserve Board</a>, the greatest benefit is “lowering barriers to entry into otherwise inaccessible markets and improving the liquidity of such markets.”</p>



<h3 class="wp-block-heading">Key Benefits</h3>



<ul>
<li><strong>Fractional ownership: </strong>Individual investment in portions of specific assets, such as commercial or residential real estate, making them even more targeted and precise than existing real estate investment trusts (REITs).</li>



<li><strong>Improved market access:</strong> Makes previously unreachable or prohibitively expensive markets accessible to the average investor.</li>



<li><strong>Enhanced liquidity: </strong>Fractional ownership, coupled with a wider investor base through tokenization, can enhance the fluidity of assets that are typically hard to liquidate.</li>



<li><strong>Faster transaction settlements:</strong> Transferring and settling tokenized assets is often faster than traditional asset dealings.</li>



<li><strong>Programmable features: </strong>The application of smart contracts in tokenization can streamline various investment and management aspects, like dividend distribution, voting rights, and changes in ownership, improving efficiency and security.</li>



<li><strong>Transparency</strong>: Onchain monitoring of asset purchasing is way better than quarterly reports, individual countries’ tax records, and other kinds of register tracking</li>



<li><strong>More stable Web3</strong>: For Web3 projects, RWA tokenization adds low-risk collateral to the mix. Incorporating RWAs can dampen the cyclical nature of on-chain yields and improve the stability of DeFi products. MakerDAO's use of RWAs, for example, has significantly contributed to the economic health of its DAI stablecoin.</li>
</ul>



<h2 class="wp-block-heading">Challenges of Tokenized Real-World Assets&nbsp;</h2>



<p>Despite its potential, tokenization faces problems such as market volatility, security and privacy, and complex legal and regulatory requirements.</p>



<h3 class="wp-block-heading">Key Challenges</h3>



<ul>
<li><strong>Crypto market volatility</strong>: The Federal Reserve's paper points out the financial stability implications of tokenization, noting the potential for systemic risks due to the interconnections between the inherently volatile crypto ecosystem and the traditional financial system.</li>



<li><strong>Technical standardization</strong>: Lack of universal standards across blockchain platforms creates interoperability issues. Standardized protocols and APIs are needed to facilitate smooth token exchange and integration into existing financial systems without disruptions.</li>



<li><strong>Security and privacy:</strong> <a href="https://hacken.io/insights/2023-security-report/">$1.9B</a> was stolen from crypto in 2023. The success of the RWA tokenization thus largely depends on the security and reliability of the entire blockchain architecture, meaning that projects undertaking tokenization must implement rigorous <a href="https://hacken.io/services/blockchain-security/smart-contract-security-audit/">third-party audits</a> as part of a broader security strategy.</li>



<li><strong>Proof of ownership</strong>: Valid token issuance may be a problem in proving the legitimacy and asset origin accurately on-chain.</li>



<li><strong>Legal and regulation</strong>: Different jurisdictions' laws on digital assets, securities, and taxation affect tokenized RWAs. Compliance with U.S. law is a separate topic altogether.</li>
</ul>



<h2 class="wp-block-heading">Real-World Assets in DeFi</h2>



<p>RWAs play a crucial role in expanding the DeFi ecosystem, with platforms like MakerDAO and Frax Finance integrating RWAs to secure collateral options, offer more diversified services, and generate higher revenue from crypto-native assets.</p>



<p>Since 2020, MakerDAO has pursued this strategy to strengthen its stablecoin, DAI. Today, <a href="https://www.galaxy.com/insights/research/rwas-and-their-impact-on-defi/">46%</a> of DAI are collateralized against various off-chain RWAs (e.g., Centrifuge, BlockTower, Monetalis) with a total exposure of $2.5 billion. This approach brought in nearly $120 million, or 48% of the total revenue, and this made DAI more stable. Frax Finance has also embraced RWAs, particularly to stabilize its native stablecoin, FRAX. Another top DeFi protocol, Aave, is in the initial stages of integrating RWAs.</p>



<h2 class="wp-block-heading">Hacken Equity Tokenization</h2>



<p>The journey is only getting started, and Hacken recognizes the immense potential of bridging tokens with RWAs for our long-term growth. That’s why we offer <a href="https://hacken.io/rwa/">the first-ever opportunity to enter 10% of Web3 company equity through the native token, $HAI</a>.</p>



<h3 class="wp-block-heading">Overview</h3>



<p>We have launched an equity tokenization initiative, enabling the transition of $HAI token holders to equity shareholders. This innovative approach offers a direct pathway for investors to acquire a stake in the company, leveraging blockchain technology for equity management.</p>



<h3 class="wp-block-heading">Mechanisms</h3>



<ul>
<li><strong>Equity allocation</strong>: Hacken has allocated 10% of its equity to be available, divided into 100 exclusive tokens, also referred to as slots. Each slot corresponds to an investment of 1 million of HAI tokens, representing a 0.1% ownership stake in Hacken.</li>



<li><strong>Community private offering</strong>: The initiative is structured as a Community Private Offering. This way, we emphasize the engagement of $HAI holders in Hacken's growth trajectory. Some of the most loyal $HAI holders have been with us for 6 years now, and it’s our way to give them a clear path to becoming legal owners of not just a token but the company itself.</li>



<li><strong>Valuation: </strong>As a departure from typical tokenization strategies, operations exclusively involve HAI, a token subject to market volatility. Consequently, estimating the final slot cost in dollar value poses challenges due to its inherent fluctuations. However, this approach brings notable advantages. For instance, it significantly simplifies the entry for existing HAI holders and serves as an additional direct token utility.</li>



<li><strong>Participation conditions: </strong>To ensure inclusivity and a sensible number of new shareholders, the minimum participation condition is 1 slot (or million $HAI). Participants are not limited in the number of slots they can buy, but the total supply is capped to 100 slots.</li>



<li><strong>Tokenization partner</strong>: Tokenizing 10% of your company is a complex process that involves solving many legal and regulatory challenges. We have decided to allocate additional expertise to make things right by signing with Brickken, a leading tokenization provider.</li>



<li><strong>Strategic aims</strong>: While the broader vision includes a potential public offering by 2027, there are also diverse exit strategies, such as post-offering P2P trading and equity buybacks.</li>
</ul>



<h3 class="wp-block-heading">Claim Your Spot</h3>



<p>Hacken equity is available in $HAI in early March 2024. Only 100 slots are available. Reserve your slot by joining the wait list <a href="https://hacken.io/rwa/">here</a>.</p>



<div id="blog-request-quote-container"></div>



<h2 class="wp-block-heading">Conclusions&nbsp;</h2>



<p>The integration of traditional financial mechanisms into the blockchain through real-world asset tokenization is not merely a buzzword; it's an evolving reality with substantial influence from the biggest institutions in the world. Tokenizing RWAs marks a significant shift in how we approach investment, ownership, and asset management in the digital era.</p>



<p>By leveraging blockchain technology, RWA tokenization offers notable benefits such as democratizing investment access to stocks, bonds, equity, and commodities, enhancing asset liquidity, and streamlining trading. It also underscores the necessity for elevated security standards to mitigate smart contract and blockchain risks.</p>



<p>In line with these developments, Hacken is pioneering equity tokenization, allowing $HAI holders to transition to equity shareholders and benefit from the reliability, shape the sector's future, and enjoy classical exit options.</p>

Tokenization Of Real-World Assets (RWAs): Explanations & Future Outlook

<p><a href="https://cryptostake.com/">Cryptostake</a>, a non-custodial and high-reward staking service for proof-of-stake blockchains like Ethereum, Polkadot, and Cosmos, entrusted Hacken with performing an independent security assessment of their mobile applications. Specifically, non-custodial wallets for iOS and Android.</p>



<p>As a result of Hacken’s most thorough mobile <a href="https://hacken.io/services/penetrationtesting/">penetration testing</a>, Cryptostake Wallets received a maximum 10/10 score. Let’s take a closer look.</p>



<h2 class="wp-block-heading">Penetration Testing Overview</h2>



<p>Cryptostake's non-custodial mobile app gives users complete control over their private keys, necessitating robust security measures to protect against breaches. Recognizing the critical importance of safeguarding user autonomy and asset security, Cryptostake approached Hacken for a thorough security assessment. In our assessment, we employed active exploitation techniques to benchmark security against industry best practices and evaluate apps’ robustness.</p>



<p>The penetration test, conducted over a month from September 23 to October 23, 2023, followed a <em>gray box methodology</em>. This approach included intelligence gathering, service detection, vulnerability analysis, and business logic flow assessments. The assessment was comprehensive, mapping the application's code against industry standards and employing international methodologies like OWASP.</p>



<figure class="wp-block-image"><img src="https://lh7-us.googleusercontent.com/5yMMszfWykG8O5N_vhiZgN-k0U3E0TpgPYVdWGJmkw6OMtjbOKHRW0wi3KA9adGzTYghgLIY2_cNwqxWHXa_-6nzJ1IV_sXQ1e_7KmzcTRBm57XKspx_aoTP6dqAwGWfR4Sv1QNUU_2N3X9rN4n60Mk" alt=""/><figcaption class="wp-element-caption"><em>Cyclical approach to security assessment employed by Hacken</em>.</figcaption></figure>



<p>The primary objectives were to identify technical and functional vulnerabilities, estimate their severity, model probable attack vectors, and provide a prioritized list of recommendations.</p>



<h2 class="wp-block-heading">Key Findings and Impact Analysis</h2>



<p>We identified no critical, high, or medium-severity issues threatening the system. The only vulnerabilities that were found were low severity and exclusively for Android. The iOS app contained no issues. The Cryptostake team has since taken the Android app offline to introduce the recommended fixes.</p>



<h3 class="wp-block-heading">Low-Severity Issues:</h3>



<p>Low-level security issues, classified with a CVSS score of 0.1 to 3.9, represent vulnerabilities that are easier to exploit due to low exploitation difficulty but grant only minimal access privileges to attackers. Their impact on system security is relatively lower because the level of access they provide is restricted.</p>



<p>The Cryptostake Android app’s low-level security issues included vulnerabilities that allow operation on rooted and jailbroken devices, bypassing of password brute-forcing protection, biometric access bypass, issues with invalidation upon biometric enrollment, allowance of third-party keyboards, potential exposure of sensitive data through screenshots, and insufficient logout procedures, alongside cryptography issues related to hardcoded values.</p>



<p>Here’s a more detailed breakdown:</p>



<ol>
<li>The app could be launched on rooted or jailbroken devices, posing a risk to sensitive user data. To mitigate this, Hacken recommended implementing root and jailbreak detection using tools like Google's SafetyNet Attestation API and specialized libraries or custom checks​​​​.</li>



<li>Time-based brute-force protection was bypassable by changing the system time, which could allow unlimited login attempts. The recommendation was to rely on an independent and secure time source for enforcing time-based restrictions​​.</li>



<li>Biometric authentication was found to be event-bound and bypassable, risking sensitive information leaks. Enhanced security was advised by incorporating cryptography into the biometric authentication workflow, using CryptoObject for cryptographic operations, and special flags like kSecAccessControlTouchIDAny to protect keychain items​​.</li>



<li>Insufficient logout controls meant sessions were not properly invalidated, which could lead to unauthorized access. Proper session management with session invalidation or expiration upon logout was recommended​​.</li>



<li>The application's code contained development comments indicating missing security functionality and potential weaknesses. Removing all development information and debugging messages from the production app before deployment was suggested​​.</li>



<li>The app supported an outdated SDK version with multiple unfixed vulnerabilities. It was advised to set a minimum SDK version that restricts the app to devices with security patches or that are still supported​​.</li>



<li>Third-party keyboards allowed within the app could potentially leak personally identifiable information. It was recommended to use the native keyboard for entering sensitive data and to inform users about possible risks​​.</li>



<li>iOS’s feature of taking screenshots when an app goes into the background could expose sensitive data. Blurring the screen during app switching was suggested as a countermeasure​​.</li>



<li>The hardcoded salt in password hashing made creating rainbow tables for brute-force attacks possible. Using robust hashing algorithms like scrypt, bcrypt, or PBKDF2 was recommended instead of hardcoded crypto primitives​​.</li>
</ol>



<p>The security assessment concluded with Hacken rating Cryptostake Wallets a perfect 10 out of 10. This high score reflects system robustness and resilience.&nbsp;</p>



<p>The assessment found only low severity and informational issues, indicating no direct path for an external attacker to compromise the system fully. Moreover, Cryptostake has taken the Android app offline for upgrades, while no issues were found for the iOS app.&nbsp;</p>



<p>This finding is crucial for Cryptostake's users, who engage in self-custodial crypto staking, which requires high trust in the platform's security capabilities.</p>



<h2 class="wp-block-heading">Conclusions</h2>



<p>Cryptostake's proactive approach in engaging with Hacken for thorough mobile penetration testing underscores its commitment to providing a secure and reliable staking service for its users.&nbsp;<br>Given a recent high-profile Ledger hack, regular assessments of <a href="https://hacken.io/discover/wallet-security/">crypto wallets' security</a> are vital in a landscape where threats are constantly evolving, ensuring that platforms like Cryptostake can continue to offer safe and uninterrupted services to their users.</p>

Oleh Malanii

Get our latest updates and expert insights on Web3 security