All audits

Traditional · Digital Asset Risk Assessment

Anchorage Digital

softstack completed an asset assessment engagement for Anchorage Digital. Findings for this engagement are confidential and the report is available on request.

Key facts

Client
Anchorage Digital
Type
Digital Asset Risk Assessment
Market cap
$50.0B as of 2024-03-20

About the project

Anchorage Digital is an institutional digital asset platform operated by Anchor Labs, founded in 2017 in San Francisco. Its subsidiary Anchorage Digital Bank holds a national trust charter from the U.S. Office of the Comptroller of the Currency. The platform covers custody, trading, staking, settlement, and stablecoin issuance.

Methodology

Review process

  1. Scoping and threat modelling

    The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.

  2. Automated analysis

    Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.

  3. Manual code review

    Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.

  4. Adversarial testing

    Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.

  5. Reporting

    Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.

  6. Remediation verification

    Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.

FAQ

The deliverable for this engagement is covered by a confidentiality agreement, so the findings are not published. softstack can share the report on request where Anchorage Digital approves it.

Disclaimer

This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.