In Web3, trust is built in code. Softstack audited the BloomBeans protocol on Ethereum, reviewing the full core smart contract suite and supporting the team through remediation. The result: 17 findings identified, 17 findings resolved, and no open issues remaining in the final report.

Client: BloomBeans

Project: Ethereum core smart contract suite (BEAN, STAs, GlobalMarker, and supporting systems)

Industry: Web3 / DeFi

Service: Smart contract security audit (manual code review, automated security testing, and remediation re-validation)

What BloomBeans Does

BloomBeans is a decentralized financial protocol built on Ethereum. Its native token, BEAN, serves as the system's currency: a utility token under MiCA Regulation (EU) 2023/1114, in which all protocol interactions are denominated.

The protocol is designed around a transparent, code-governed emission schedule with a maximum supply of 21 billion BEAN and an emission rate that decreases as total supply grows. The reward rate itself is set on-chain by the GlobalMarker system through supply-based tiers, making the rules visible and verifiable directly in the contracts.

Users interact with the protocol by minting their own ERC-1155 Smart Trustless Assets (STAs) in two forms: Savings and Income. These assets are not issued by BloomBeans. Users commit a principal BEAN amount for a chosen period, and the protocol generates mathematically predetermined BEAN rewards at the reward rate set by the GlobalMarker system.

Why the Contract Logic Matters

STAs sit at the center of the BloomBeans design because they combine several on-chain functions. An STA can be:

  • held to receive scheduled BEAN distributions;
  • used as collateral for BEAN-denominated smart contract loans; or
  • transferred peer-to-peer on-chain.

That flexibility makes correctness essential. The protocol also supports referral rewards, Merkle-based airdrops, and an event-driven reward system for community participation. When financial behavior is enforced directly by code, reward calculations, transfer restrictions, and privileged admin actions all need to work exactly as intended. There is no manual override once flawed logic is deployed on-chain.

Audit Scope and Methodology

The engagement combined manual expert review with automated security testing, followed by a dedicated remediation round in which each issue was re-validated against the updated codebase.

The review covered the full core suite, including:

  • the Bean (ERC-20) token with registered-minter access control;
  • the Income and Savings STA (ERC-1155) contracts, including loan mechanics and migration support;
  • SavingsData and metadata libraries for on-chain accounting;
  • GlobalMarker, which manages supply-based reward-rate tiers;
  • Airdrop, with dual Merkle claim systems;
  • Referral, for tiered reward distribution;
  • Registry, for contract address management under multisig governance;
  • Event, for time-based reward allotments; and
  • Formatters, for on-chain metadata rendering.

The Outcome: 17 Findings, All Resolved

The audit identified 17 findings total:

  • 1 high
  • 7 medium
  • 9 low

BloomBeans resolved all 17, and the final report closed with no open findings.

Full audit report: softstack BloomBeans smart contracts security audit report

What Remediation Improved

The most important takeaway is not just the count. It is what the remediation improved:

  • Reward-accounting integrity. The highest-severity issue involved a scenario in which STA principal could become permanently locked once all scheduled rewards had been claimed at maturity. Other findings addressed retroactive changes to reward and accounting tables that could affect already minted STAs. These fixes protect the core promise that an STA behaves according to the terms fixed at mint time.
  • Safer loan mechanics. The review surfaced issues in STA-backed loan flows, including missing pause checks and the ability to transfer an STA while it was pledged against an active loan. The remediation strengthened these paths and removed opportunities for inconsistent or unsafe state transitions.
  • Stronger access control. Several privileged operations were tightened, including moving sensitive reward-parameter updates from single-owner control to multisig governance and correcting validation flow to better align with secure smart contract patterns.
  • More resilient claim logic. The airdrop system was hardened by addressing non-standard Merkle leaf encoding and restricting unsafe post-launch changes to the Merkle root.
  • Improved governance robustness. Registry administration and reward-tier boundary logic were corrected to reduce centralization risk and avoid tier-selection edge cases.

About Softstack

softstack GmbH is a European cybersecurity company, founded in 2017. We provide smart contract audits, blockchain security reviews, Web3 penetration testing, and digital asset risk assessments for protocols, enterprises, token issuers, and regulated digital asset institutions. softstack is ISO 27001 certified and has completed 1,600+ audits across 20+ chains, securing more than $100B in TVL with zero known post-audit exploits.

If you are building DeFi protocols, token systems, or on-chain reward infrastructure and want the same level of scrutiny, reach out at hello@softstack.io or visit softstack.io.

Legal note

For legal and token documentation on BloomBeans, see bloombeans.io/bloombeans-legal-ath21.pdf.

This article is provided for informational purposes and is not legal advice. References to MiCA reflect the regulatory context in which BloomBeans operates and are not a regulatory determination by any competent authority.