Softstack Completes Smart Contract Security Audit of BloomBeans Protocol

Softstack, an ISO 27001-certified European cybersecurity firm, has completed an independent smart contract security audit of the BloomBeans protocol.

Softstack,(opens in new tab) an ISO 27001-certified European cybersecurity firm, has completed an independent smart contract security audit of the BloomBeans protocol. The engagement covered the protocol’s full core contract suite and resulted in 17 findings identified, 17 findings resolved, and no open findings remaining in the final report.

BloomBeans is a decentralized financial protocol built on Ethereum. Its native token, BEAN, serves as the system’s currency: a utility token under MiCA Regulation (EU) 2023/1114, in which all protocol interactions are denominated. The protocol operates with a maximum supply of 21 billion BEAN and an emission rate that decreases as total supply grows, with reward rates set on-chain by the GlobalMarker system.

The audit combined manual expert review with automated security testing, followed by a dedicated remediation and re-validation phase. The review focused on the areas most critical to the BloomBeans architecture, including registered-minter access control on the BEAN token, reward-accounting logic for user-minted Smart Trustless Assets (STAs), BEAN-denominated loan mechanics, supply-based reward-rate tiers, Merkle-based airdrop claims, and multisig-governed registry administration.

Also Read: IT Tech Pulse Exclusive Interview with Ken Claffey Chief Executive Officer and President of VDURA

Audit Scope
The reviewed suite included:
– Bean (ERC-20): Utility token with registered-minter access control
– Income and Savings STAs (ERC-1155): User-minted Smart Trustless Assets with BEAN-denominated loan mechanics and migration support
– SavingsData and metadata libraries: On-chain accounting and metadata support
– GlobalMarker: Supply-based reward-rate tiers
– Airdrop: Dual Merkle claim systems
– Referral: Tiered reward distribution
– Registry: Contract address management with multisig governance
– Event: Time-based reward allotments
– Formatters: On-chain metadata rendering

Results
– 17 findings identified and 17 findings resolved
– Severity breakdown: 1 High, 7 Medium, 9 Low
– No open findings remained after remediation and re-check
– All fixes were verified in a dedicated re-validation round against the audited codebase

Representative fixes included resolving a principal-lockout condition in STA reward claims at maturity; preventing retroactive changes to reward tables that could affect existing STA accounting; adding pause checks and transfer restrictions to STA loan flows; hardening Merkle claim encoding and root update behavior for airdrops; and migrating sensitive administrative operations to multisig governance.

Write to us [⁠wasim.a@demandmediaagency.com] to learn more about our exclusive editorial packages and programmes.