Softstack, an ISO 27001-certified European cybersecurity firm, has completed an independent smart contract security audit of the BloomBeans protocol.
Softstack, an ISO 27001-certified European cybersecurity firm, has completed an independent smart contract security audit of the BloomBeans protocol. The engagement covered the protocol’s full core contract suite and resulted in 17 findings identified, 17 findings resolved, and no open findings remaining in the final report.
BloomBeans is a decentralized financial protocol built on Ethereum. Its native token, BEAN, serves as the system’s currency: a utility token under MiCA Regulation (EU) 2023/1114, in which all protocol interactions are denominated. The protocol operates with a maximum supply of 21 billion BEAN and an emission rate that decreases as total supply grows, with reward rates set on-chain by the GlobalMarker system.
Also Read: CIO Influence Interview with Hugo Dozois-Caouette, CTO and Co-founder at MaintainX
The audit combined manual expert review with automated security testing, followed by a dedicated remediation and re-validation phase. The review focused on the areas most critical to the BloomBeans architecture, including registered-minter access control on the BEAN token, reward-accounting logic for user-minted Smart Trustless Assets (STAs), BEAN-denominated loan mechanics, supply-based reward-rate tiers, Merkle-based airdrop claims, and multisig-governed registry administration.
Audit Scope
The reviewed suite included:
– Bean (ERC-20): Utility token with registered-minter access control
– Income and Savings STAs (ERC-1155): User-minted Smart Trustless Assets with BEAN-denominated loan mechanics and migration support
– SavingsData and metadata libraries: On-chain accounting and metadata support
– GlobalMarker: Supply-based reward-rate tiers
– Airdrop: Dual Merkle claim systems
– Referral: Tiered reward distribution
– Registry: Contract address management with multisig governance
– Event: Time-based reward allotments
– Formatters: On-chain metadata rendering
Results
– 17 findings identified and 17 findings resolved
– Severity breakdown: 1 High, 7 Medium, 9 Low
– No open findings remained after remediation and re-check
– All fixes were verified in a dedicated re-validation round against the audited codebase
Representative fixes included resolving a principal-lockout condition in STA reward claims at maturity; preventing retroactive changes to reward tables that could affect existing STA accounting; adding pause checks and transfer restrictions to STA loan flows; hardening Merkle claim encoding and root update behavior for airdrops; and migrating sensitive administrative operations to multisig governance.
Catch more CIO Insights: What Does “Job-Ready” Really Mean in IT and Cybersecurity?
[To share your insights with us, please write to psen@itechseries.com ]
