Client Overview
Alpend is a privacy-aware institutional money market built on the Canton Network. Users supply assets to earn yield or borrow against posted collateral. Positions are confidential by default, settlement is deterministic on-chain, and every position is a contract co-signed by the user and the pool operator, so no participant can forge a deposit or hide a debt.
Key Security Challenges
Canton has no established standard checklist, and Alpend's security model lives primarily in the ledger's authorization layer, in its signatories and controllers, rather than in application-level code. Alpend needed a partner willing to learn that trust model rather than map EVM-style attack classes onto it.
As the pooled-risk layer for other institutions' regulated assets, a single unaddressed flaw in Alpend's authorization or accounting model could expose counterparties well beyond Alpend itself, raising the bar for what "secure" needed to mean before institutional onboarding.
Halborn's Solutions
Smart Contract Assessment: a full review of Alpend's Daml multi-package workspace, working through the actual contract topology and the underlying accounting model instead of applying a checklist built for EVM-style contracts.
Assets and Technologies Assessed
- Alpend's Daml multi-package workspace and contract topology
- Signatory and controller sets governing authorization across pool positions
- The on-chain risk recomputation logic spanning the full collateral basket
- The oracle path, including real on-chain signature verification for signed reports
Results Achieved
- An independent, third-party assessment returned zero critical findings across a 30-finding review, with 100% of reported findings remediated in a single commit.
- Every finding was delivered as an executable Daml Script scenario rather than a written description, giving Alpend 350 regression tests that now live permanently in its own repository.
- A security architecture writeup that Alpend can hand directly to institutional compliance and risk functions.
What Set Halborn Apart
Rather than treating findings as claims to be argued over, Halborn encoded each one as a passing test that proves the bug exists on the audited commit, paired with contrast tests isolating the exact cause. For Alpend's oracle path, which performs real on-chain signature verification, the team went a step further: they built a signed-report generator from scratch just to test it, then attacked their own generator with tampered and wrong-signer reports to confirm both were rejected.
Going Above and Beyond
More than reviewing code, Halborn engaged with the layer where Alpend's actual safety properties live: the Canton ledger's authorization rules. On a network with no established audit corpus, that meant learning Alpend's trust model on its own terms rather than translating it into a more familiar, EVM-shaped framework, and it meant building custom tooling, like the signed-report generator, purely to validate a verification path no existing harness could reach.
Akshay Sinha, Cofounder & CTO of Palladium Labs and Alpend: “Canton has no established audit corpus. Halborn didn't ask us to translate our protocol into terms they already knew. They learned the model and audited what we actually built.”
That work changed the kind of conversation Alpend can have with institutional counterparties and issuers. Diligence discussions that used to start with a design claim now start with an independent party that tried to break the system and documented exactly how. The security architecture writeup produced during the engagement gives Alpend's engineering, compliance, and executive stakeholders a shared ready account of the protocol's authorization and valuation integrity, one they can bring into onboarding conversations as-is. Alpend can now take that evidence into every institutional conversation it has on Canton, instead of asking counterparties to take its design on faith.
