Overview
Europeum, the designated operator of the European Blockchain Services Infrastructure (EBSI), engaged Hacken to audit Europeum-EDIC’s core smart contract stack.
Hacken conducted nine separate audits covering identity, issuer accreditation, authorisation, timestamping, document tracking, and the upgrade and deployment infrastructure supporting these services.
Europeum has published all nine audit reports in full, including the findings, severity ratings, remediation status and rationale for accepted findings.
About Europeum and EBSI
Europeum (Europeum-EDIC) is a European Digital Infrastructure Consortium established by Member States to operate and scale European digital infrastructure. It is headquartered in Brussels, co-funded by the European Union, and is the designated operator of EBSI.
Europeum provides infrastructure for trusted digital services across borders and sectors, from verifying credentials and records to proving product origin and provenance and managing digital assets. This can help organizations, for example, verify qualifications across countries, trace products through supply chains, or issue tokenized assets on trusted European infrastructure. Ten Member States are part of the consortium, with more than 35 node operators running the network across those states.
Hacken previously supported EBSI through smart contract audits in 2023 and subsequent penetration testing of EDIC systems.
Audit Approach
EBSI is a European digital infrastructure designed to strengthen digital trust across Europe. It provides infrastructure services for anchoring, trust chains, tokenization, and product traceability, enabling organizations to verify data, assets, and transactions across digital ecosystems, with infrastructure operated across participating European countries.
Given the interconnected nature of these services, Hacken assessed nine core components individually while also reviewing their dependencies and shared controls. The audits covered areas including access control, data integrity, identity management, registry interactions and contract lifecycle management.
Across the nine audits, Hacken identified 107 findings: one Critical, five High, 13 Medium, 14 Low and 74 Informational.
Key Areas Assessed
The audits covered several interconnected areas of EBSI’s infrastructure.
- Access control and authorisation. The assessment examined the enforcement of permissions governing privileged operations, including interactions among authorisation mechanisms, shared registries, and policy controls.
- Identity and trust chains. The scope included decentralised identifiers, key lifecycle management, issuer accreditation, and the relationships through which trust is established and maintained between participating entities.
- Data integrity and provenance. Hacken assessed the mechanisms governing the storage, modification, removal, and indexing of registry information across services supporting document and data provenance.
- Contract lifecycle management. The engagement further evaluated controls governing contract deployment, upgrades, migration procedures, and contract implementation administration.
Together, these areas provided coverage of both the application-level smart contracts and the controls supporting their operation within the EBSI environment.
“Security is a fundamental requirement for digital infrastructure supporting cross-border services in Europe. As the European Blockchain Services Infrastructure continues to develop, independent security assessment helps ensure that the underlying technology is built and maintained to the security standards expected of infrastructure serving public-sector use cases. Our work with Hacken is part of this commitment to maintaining a secure and trustworthy EBSI infrastructure.” – said Marc-Antoine Lemaire, CTO of Europeum.
Audit Results
Following the audit and remediation process, 89 findings were resolved, 15 were accepted, and three were mitigated.
Read the full Hacken audit reports for all nine Europeum-EDIC core services: hacken.io/audits/europeum/
Request a Smart Contract Audit
Hacken provides smart contract security audits for blockchain protocols, registries and infrastructure across permissioned and permissionless environments.
Each engagement combines automated analysis, manual security review and proof-of-concept development, performed by Hacken's in-house security team.
