Prepared by:
HALBORN
Last Updated 10/03/2025
Date of Engagement: September 16th, 2025 - September 17th, 2025
100% of all REPORTED Findings have been addressed
All findings
5
Critical
1
High
0
Medium
0
Low
1
Informational
3
Spiko engaged Halborn to conduct a security assessment of the Stellar Smart Account contracts, beginning on September 16th, 2025, and ending on September 18th, 2025. This security assessment was scoped to the smart contracts located in the Spiko-Tech Stellar Contracts GitHub repository. Commit hashes and further details can be found in the Scope section of this report.
Spiko provides the on-chain backbone for tokenising real-world fund shares on Stellar. It couples a permissioned fungible-token contract (representing each share) with a central access-control registry and a redemption module that burns tokens when investors cash out in the off-chain fund. By enforcing roles, whitelisting and escrowed redemptions, the suite bridges traditional assets and blockchain while preserving regulatory and operational safeguards.
The team at Halborn assigned a full-time security engineer to verify the security of the smart contracts. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.
The purpose of this assessment is to:
Ensure that smart contract functions operate as intended
Identify potential security issues with the smart contracts
In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which have been completely addressed by the Spiko team. The main ones were the following:
Correct the redemption execution logic so that token burns are performed from the Redemption contract balance rather than from the user account to prevent pending redemptions and locked escrowed funds.
Prevent the admin role from being renounced without an alternative recovery mechanism by overriding or replacing the default renounce_admin flow with an explicit rotation/proposal-accept process.
Ensure idempotency keys and events are only consumed/emitted when an operation produces a real state change (reject empty-batch and zero-amount operations).
Move fixed, non-parameterized initialization logic into the constructor to eliminate unnecessary public initialization entrypoints and reduce deployment sequencing risk.
Improve in-code documentation to reduce misconfiguration and improve auditability.
Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy in regard to the scope of this assessment. Manual testing was emphasized to uncover flaws in logic, process, and contract interaction, while automated tools supported the detection of dependency vulnerabilities and unsafe coding patterns.
The following phases and associated tools were used during the assessment:
Research into the architecture, purpose, and operational model of the Stellar Smart Account system.
Manual code review and walk-through of all contracts.
Verification of initialization flows and prevention of double-init or bypass conditions.
Analysis of upgrade and migration flows.
Review of cross-contract interactions and fail-closed behavior on errors.
Scanning of Rust code for vulnerabilities and unsafe usage.
Review and improvement of integration tests.
Verification of integration test execution and addition of new ones where required.
| EXPLOITABILITY METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Attack Origin (AO) | Arbitrary (AO:A) Specific (AO:S) | 1 0.2 |
| Attack Cost (AC) | Low (AC:L) Medium (AC:M) High (AC:H) | 1 0.67 0.33 |
| Attack Complexity (AX) | Low (AX:L) Medium (AX:M) High (AX:H) | 1 0.67 0.33 |
| IMPACT METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Confidentiality (C) | None (C:N) Low (C:L) Medium (C:M) High (C:H) Critical (C:C) | 0 0.25 0.5 0.75 1 |
| Integrity (I) | None (I:N) Low (I:L) Medium (I:M) High (I:H) Critical (I:C) | 0 0.25 0.5 0.75 1 |
| Availability (A) | None (A:N) Low (A:L) Medium (A:M) High (A:H) Critical (A:C) | 0 0.25 0.5 0.75 1 |
| Deposit (D) | None (D:N) Low (D:L) Medium (D:M) High (D:H) Critical (D:C) | 0 0.25 0.5 0.75 1 |
| Yield (Y) | None (Y:N) Low (Y:L) Medium (Y:M) High (Y:H) Critical (Y:C) | 0 0.25 0.5 0.75 1 |
| SEVERITY COEFFICIENT () | COEFFICIENT VALUE | NUMERICAL VALUE |
|---|---|---|
| Reversibility () | None (R:N) Partial (R:P) Full (R:F) | 1 0.5 0.25 |
| Scope () | Changed (S:C) Unchanged (S:U) | 1.25 1 |
| Severity | Score Value Range |
|---|---|
| Critical | 9 - 10 |
| High | 7 - 8.9 |
| Medium | 4.5 - 6.9 |
| Low | 2 - 4.4 |
| Informational | 0 - 1.9 |
Critical
1
High
0
Medium
0
Low
1
Informational
3
| Security analysis | Risk level | Remediation Date |
|---|---|---|
| Redemption execution burns from user account instead of redemption contract | Critical | Solved - 09/21/2025 |
| Admin can renounce and leave contract without admin | Low | Solved - 09/21/2025 |
| Idempotency keys and zero-amount / empty-batch operations can be consumed without effective work | Informational | Solved - 09/21/2025 |
| Initialize placed outside constructor without variable inputs | Informational | Solved - 09/21/2025 |
| Insufficient in-code documentation | Informational | Solved - 09/21/2025 |
//Critical
//Low
//Informational
//Informational
//Informational
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
// Download the full report
Stellar Contracts
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed
