All audits

Web3 · Smart contract audit

Minted

softstack completed a smart contract audit of Minted's Core Contracts (Canton Network / DAML) in May 2026, reporting 40 findings (5 high, 11 medium and 24 low), of which 32 were resolved or mitigated before the final report. The signed report is available on request.

Key facts

Client
Minted
Completed
Type
Smart contract audit
Chains
Canton
Commit
393fd96f3226

About the project

Minted is a stablecoin protocol built on the Canton Network, where mUSD is issued one-for-one against USDC. Canton provides the accounting, compliance and settlement layer, which suits regulated financial applications. The protocol's DAML templates cover on-ledger minting, staking, lending, governance and compliance controls.

Scope

Source repositorygithub.com/luthatdude/Minted-mUSD-Canton

Components reviewed

11 modules
  1. CantonDirectMint
  2. CantonSMUSD
  3. CantonLending
  4. CantonBoostPool
  5. CantonLoopStrategy
  6. InterestRateService
  7. Compliance
  8. Governance
  9. Upgrade
  10. MintedMUSD / V3 (InstitutionalAssetV4)
  11. UserPrivacySettings

Findings

0Critical
5High
11Medium
24Low
0Informational

32 of 40 findings resolved before the final report.

Methodology

Review process

  1. Scoping and threat modelling

    The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.

  2. Automated analysis

    Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.

  3. Manual code review

    Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.

  4. Adversarial testing

    Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.

  5. Reporting

    Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.

  6. Remediation verification

    Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.

FAQ

The review reported 40 findings: 5 high, 11 medium and 24 low. 32 of 40 were resolved or mitigated before the final report.

The review covered the code in github.com/luthatdude/Minted-mUSD-Canton at commit 393fd96. The published report lists every file covered.

This report covers the code as reviewed in May 2026 at commit 393fd96. Any code changed after that point is outside the reviewed scope.

The deliverable for this engagement is covered by a confidentiality agreement, so the findings are not published. softstack can share the report on request where Minted approves it.