Audits
AstralBeam's contracts and off-chain infrastructure undergo independent third-party security review before any mainnet deployment.
Completed & In-Progress Audits
| Audit | Scope | Firm | Status | Report |
|---|---|---|---|---|
| Bridge Security Audit | EVM Locker contracts, Casper EthClient + TokenFactory contracts, relayer network (P2P mesh, attestation & verification logic), REST API | Halborn | Remediation review in progress | Link will be published upon completion |
The audit covers the full trust surface of the bridge:
- Smart contracts - the
MultiSigERC20Locker(EVM) and theEthClient/TokenFactory(Casper), including upgrade paths, signature threshold enforcement, replay protection, and fee handling - Relayer network - independent event verification, the M-of-N co-signing protocol, P2P transport security (mTLS), and fail-closed behavior
- Off-chain services - the public REST API and its data integrity guarantees
Our Security Process
- Every finding is tracked to resolution and re-verified by the auditor before closure
- Security-relevant changes ship through the same audited pipeline - no direct-to-production changes
- The Security Model page documents the trust assumptions and threat analysis in detail
Responsible Disclosure
Found a vulnerability? Please report it privately to security@astralbeam.io. We ask that you do not disclose publicly until we've had the opportunity to remediate. We're grateful to researchers who help keep bridge users safe.