Traditional · Smart Contract Audit
21Shares
softstack completed a security engagement for 21Shares. Findings for this engagement are confidential and the report is available on request.
Key facts
- Client
- 21Shares
- Type
- Smart Contract Audit
- Market cap
- $3.3B as of 2026-08-31
About the project
21Shares is a digital asset investment firm best known for its crypto exchange-traded products. Founded in 2018 and based in Zurich, it issues exchange-traded products that track individual cryptocurrencies and crypto indices. Those products are listed on regulated European exchanges and sold through ordinary brokerage accounts.
Methodology
Review process
Scoping and threat modelling
The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.
Automated analysis
Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.
Manual code review
Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.
Adversarial testing
Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.
Reporting
Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.
Remediation verification
Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.
FAQ
The deliverable for this engagement is covered by a confidentiality agreement, so the findings are not published. softstack can share the report on request where 21Shares approves it.
Disclaimer
This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.