A comprehensive audit blended manual expert review with automated testing, followed by remediation and re-validation, concentrating on critical areas like registered-minter access on BEAN, STA reward accounting, BEAN-denominated loan mechanics, supply-based reward tiers, Merkle-based airdrop claims, and multisig-governed registry administration.

BloomBeans is a decentralized Ethereum-based protocol using BEAN as its utility token, governed by on-chain reward rates and a capped supply of 21 billion BEAN, with MiCA Regulation (EU) 2023/1114 providing context for its tokenization.

Leadership underscored security as paramount for a code-governed protocol, highlighting a rigorous remediation process that resulted in zero open issues at the end of the audit.

Softstack conducted an independent security audit of the full BloomBeans core contract suite, uncovering 17 findings and resolving all, leaving no open issues in the final report.

For further information, BloomBeans and Softstack provide contact details and links to legal documents, official sites, and security inquiries; the press release notes the audit report is available on request and that MiCA references are regulatory context rather than legal advice.

Representative fixes include preventing principal-lockout in STA rewards at maturity, prohibiting retroactive changes to reward tables, adding pause and transfer restrictions to STA loan flows, hardening Merkle claim encoding and airdrop root updates, and migrating sensitive operations to multisig governance.

The severity of findings was 1 High, 7 Medium, and 9 Low; all issues were resolved, followed by a dedicated re-validation round against the audited codebase.

The audit scope covered Bean (ERC-20), Income and Savings STAs (ERC-1155), SavingsData and metadata libraries, GlobalMarker, Airdrop, Referral, Registry, Event, and Formatters.

BloomBeans’ STA mechanism enables minting Savings and Income instruments as BEAN-denominated assets that deliver predetermined rewards via the GlobalMarker system, usable for distributions, collateral, or on-chain transfers, and involving referral rewards and Merkle-based airdrops.