Tradecraft AMM - Obsidian

1. INTRODUCTION

Obsidian engaged Halborn to conduct a security assessment on their DAML application beginning on December 15th, 2025 and ending on December 29th, 2025. The security assessment was scoped to the repository listed with commit hash, and further details in the Scope section of this report.

2. ASSESSMENT SUMMARY

The team at Halborn was provided four weeks for the engagement and assigned two full-time security engineers to verify the security of the smart contracts. The security engineers are blockchain and smart contract security experts with advanced penetration testing and smart contract hacking skills, and deep knowledge of multiple blockchain protocols.

The purpose of the assessment is to:

• Identify potential security issues within the different smart contracts and services.

• Ensure that smart contract and services functionality operates as intended.

In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which were successfully addressed by the Obsidian team. The main ones were the following:

• Store the LP configuration and allocation factory inside the AMM at creation and use those stored values instead of relying on caller input. If external input must remain, add strict validation so only the correct LP configuration and factory are accepted.

• Ensure that all transfer fee parameters are fully protocol controlled and cannot be influenced by user supplied inputs.

• Adjust allocation timing checks so valid allocations are still permitted during the full settlement window, aligning execution behavior with expected Splice semantics.

• Guarantee uniqueness of AMM instances by deriving a deterministic identifier from the underlying asset pair and blocking the creation of duplicate pools.