ERC1450

Introduction#

Halborn was engaged by StartEngine to conduct a security assessment of the ERC-1450 Upgradeable Security Token. The assessment was performed from December 15th, 2025 to December 18th, 2025 with reviewed commit hashes and scope details documented in the Scope section of this report.

The ERC-1450 implementation provides a regulated security token framework designed for compliant issuance, transfer, and lifecycle management of tokenized securities. The system enforces restricted transfers through an RTA-controlled workflow, supports regulation-specific batch tracking, and integrates fee-based transfer requests with broker delegation. Upgradeability is implemented using the UUPS proxy pattern, while administrative control and governance are delegated to a multisignature RTA proxy to reduce single-key risk and enable controlled upgrades.

Assessment Summary#

A full-time security engineer was assigned by Halborn to perform a targeted review of the smart contracts in scope. The engineer is a blockchain and smart contract security specialist with advanced penetration - testing and smart - contract auditing skills, and extensive knowledge of multiple blockchain protocols.

The purpose of the assessment was to:

• Identify potential security issues within the smart contracts.

• Confirm that smart contract functionality operates as intended.

In summary, Halborn identified several areas for improvement to minimize both the likelihood and potential impact of security risks, which were partially addressed by the StartEngine team. The primary issues include:

• Enforce protocol-calculated fees and reject zero or user-defined fee amounts to prevent fee bypass across all tokens.

• Enforce strict mutual exclusivity between ETH and ERC20 fee payments.

• Replace all usages of '.transfer' with '.call' and explicitly handle the return value.

• Enforce frozen account checks consistently across all token movement paths.

• Introduce an explicit expiration or deadline mechanism for multisig operations.

• Revert if the request is already rejected or executed.

• Track reserved fees associated with pending transfer requests separately from withdrawable fees.

Scope#