Siemens AG Issues €330M Tokenised Bond on Blockchain — Audited by Softstack
Softstack audited the smart contracts for Siemens AG’s €330M tokenised bond, settled via central bank money on institutional blockchain rails.
VARA Compliance Testing for Dubai VASPs
Why Choose Softstack?
Everyone can talk. We prefer to let our work and our clients speak for us. Get to know us and see the difference.
In-house Team
All of our team members are full-time employees — no freelancers, no outsourcing, no uncontrolled risks.
Clear and Fair Pricing
No hidden fees or vague estimates. We mostly work on fixed-price projects and deliver what we promise, without excuses.
Proven Experience
Since 2017, we have been building cutting-edge solutions in Web3, AI, and enterprise-grade digital solutions.
Made in Germany
Headquartered and operating fully in Germany, ensuring high standards, data protection, and reliability.
Fast and Reliable
Clear updates, short response times, and full transparency throughout the project.
Lean Team
You work directly with our leadership. The CEO is personally involved, and we operate with a lean, effective scrum-based approach for speed and clarity.
Rated by clients on
Service includes
You'll find the following service aspects in our offer.
- VARA Rulebook-aligned annual pentest and VA programme
- Vulnerability assessments for infrastructure and applications
- Smart contract effectiveness, enforceability, and robustness audits
- Pre-launch testing before new systems, apps, and products
- Wallet, custody, and key-management security review inputs
- Threat-led penetration testing (TLPT) when VARA notifies
- Remediation tracking and inspection-ready evidence packs
- Coordination with your compliance and technology governance teams
Our VARA Testing Process
1
Licence and activity scoping
Map your VARA-licensed VA Activities, critical systems, custody architecture, and smart contracts that must be covered under the Technology and Information Rulebook.
2
Testing plan against Rule I.E
Define annual vulnerability assessments and penetration tests, plus smart contract effectiveness and robustness reviews before new systems, applications, or products go live.
3
Independent third-party execution
Run qualified, independent assessments across infrastructure, applications, and relevant smart contracts. Document results so evidence is ready if VARA requests it.
4
TLPT path when notified
If VARA requires threat-led penetration testing, structure intelligence-led red teaming of critical functions with suitable external testers and controlled production testing.
5
Remediation and inspection pack
Track findings to closure with formal remediation evidence. Package reports and retest notes for internal governance and VARA inspection readiness.
Clients think we're pretty awesome
...but don't take our word for it
FAQ
Under the VARA Technology and Information Rulebook, VASPs must engage a qualified, independent third-party auditor for vulnerability assessments and penetration testing at least annually, and before introducing new systems, applications, or products. Where relevant to VA Activities, that includes comprehensive smart contract audits of effectiveness, enforceability, and robustness. Results must be available to VARA on request.
VARA may notify a VASP to carry out advanced TLPT where it is necessary and proportionate to the VASP’s risk profile and criticality. TLPT is not the same as a standard annual pentest. It is intelligence-led adversarial testing of critical functions, typically with strict tester suitability, insurance, and confidentiality requirements.
Scope follows the licence and Rulebook: annual cadence, pre-change testing, smart contract coverage where relevant, documented evidence for inspection, and optional TLPT if notified. We design the work so security findings and compliance artefacts stay aligned.
Yes. We audit on-chain components and test off-chain apps, APIs, and infrastructure that support exchange, custody, brokerage, and related VA Activities. That combination matches how most VASPs actually operate.
At least once a year as a baseline, and before major product or system launches. After material architecture changes, retest the affected surfaces. If VARA notifies TLPT, plan a longer programme with threat intelligence, red teaming, and remediation windows.