All audits

Web3 · Smart contract audit

Bitburo

softstack completed a smart contract audit of Bitburo's Rebalancer Contract & Keeper in October 2026, reporting 4 findings (1 low and 3 informational). The full report is published in the softstack public audit archive.

Key facts

Client
Bitburo
Completed
Type
Smart contract audit
Chains
Base
Languages
Solidity, TypeScript
Commit
b5ed2cb2b42a

About the project

Bitburo is a non-custodial savings application developed by Pinhead B.V. in Eindhoven. It keeps a balance at a fixed split of 80 percent Bitcoin and 20 percent euros, and rebalances when that split drifts, at most once a day. Deposits are in EURC, and the application buys cbBTC through an immutable contract on Base. The user holds the keys, and the application can swap but cannot withdraw.

Scope

Source repositorygithub.com/pinhead-io/bitburo_contracts

Components reviewed

2 modules · 2 files
  1. src/Rebalancer.sol
  2. keeper/keeper.ts

Findings

0Critical
0High
0Medium
1Low
3Informational

Methodology

Review process

  1. Scoping and threat modelling

    The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.

  2. Automated analysis

    Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.

  3. Manual code review

    Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.

  4. Adversarial testing

    Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.

  5. Reporting

    Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.

  6. Remediation verification

    Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.

FAQ

The review reported 4 findings: 1 low and 3 informational.

2 source files were reviewed in github.com/pinhead-io/bitburo_contracts at commit b5ed2cb. The published report lists every file covered.

This report covers the code as reviewed in October 2026 at commit b5ed2cb. Any code changed after that point is outside the reviewed scope.