Executive Summary
A global payments provider developed a token-based settlement platform to support digital-asset settlement in the European market. Because the reviewed workflow connected financial processing, application services, blockchain settlement, and an upgradeable token contract, weaknesses at one layer could affect transaction authorization, record consistency, or service continuity. CertiK conducted an independent, multi-layer security assessment covering the in-scope applications, APIs, private-blockchain environment, and smart contract. The engagement produced documented findings, remediation guidance, and verification evidence for the reviewed systems and versions, supporting internal security governance for the provider’s European business and relevant MiCA- and DORA-related readiness processes.
Key Challenges
Securing a Settlement Product That Spans Financial and Blockchain Operations
The settlement-token platform relied on an interconnected set of financial and technical processes. Each purchase, transfer, or redemption had to pass through business validation, risk controls, financial processing, and blockchain settlement while remaining consistent from the initial request through final execution and reconciliation.
This created a broader risk profile than that of a conventional application or standalone smart contract. A weakness at one stage—or in the interaction between stages—could result in incorrect balances, unauthorized token activity, interrupted settlement, or discrepancies between internal financial records and blockchain state. Such failures could have direct financial and operational consequences and create concerns for governance and regulatory review.
The provider therefore needed to evaluate the in-scope settlement lifecycle as a connected business service and determine whether controls remained effective across application, financial-processing, and blockchain boundaries before the platform entered regulated operation.
Validating Alignment Between Design and Implementation
Some of the most consequential risks in a settlement-token platform originate in its architecture: how responsibilities are separated, how privileged and upgrade actions are controlled, how trust boundaries are defined, and how financial records remain aligned with blockchain state during normal processing and failure scenarios.
These risks could not be adequately evaluated through a point-in-time test of externally exposed systems or an isolated smart contract audit. The provider needed an assessment that could examine the assumptions behind the architecture and compare them with the actual source code, configurations, and observed system behavior.
The assessment also needed to identify gaps between intended and implemented controls and provide practical guidance that engineering teams could apply before launch and as the platform evolved.
Producing Independent Security Evidence for MiCA and DORA Readiness
A regulated digital-asset product in Europe requires more than internal security testing. The provider needed an independent assessment that clearly documented what had been reviewed, how the work had been performed, which security areas had been evaluated, and how relevant improvements were verified.
The resulting evidence had to serve several audiences at once. Engineering teams needed enough technical substance to act on the conclusions, while risk, compliance, management, and regulatory stakeholders needed a clear view of the platform’s security and operational-resilience posture. Without a credible third-party report, it would be more difficult to demonstrate that the relevant ICT systems and blockchain-based products had received appropriate independent scrutiny for MiCA- and DORA-related processes.
CertiK’s Solution
Assessing the Platform as One Connected Business Service
CertiK first worked with the provider’s engineering and security teams to understand the complete lifecycle of the settlement-token platform. The review followed how customer and institutional requests were validated, processed, recorded, settled, and reconciled. This business-first view allowed CertiK to focus on failure scenarios with potential consequences for transaction integrity, privileged token operations, financial-record consistency, and service availability.
Based on that model, CertiK combined source-code review, application and API penetration testing, configuration assessment, private-blockchain review, and smart contract auditing. Testers examined whether controls remained effective across system boundaries. Manual testing addressed areas that automated tools alone could not adequately evaluate, including business-logic enforcement, concurrent processing, privilege separation, exception handling, upgrade controls, and interactions between off-chain records and blockchain settlement.
Building an Assessment That Supports Regulatory and Governance Review
CertiK structured the engagement and final reporting to support both technical remediation and governance and compliance processes for the provider’s European business. The deliverable documented the assessed scope and versions, methodology, limitations, relevant control areas, findings, remediation status, and verification activities. This created a traceable record of what had been independently reviewed while keeping the conclusions within the boundaries of the engagement.
The assessment considered the security and operational-resilience concerns relevant to regulated financial services, including controlled access to sensitive functions, integrity of business processing, operational monitoring, recovery readiness, and secure administration of the blockchain-based product. Presenting the work in this structure made the deliverable useful to technical teams while also allowing risk, compliance, and external reviewers to understand the purpose and outcome of the assessment.
Comparing Architectural Intent with Actual Implementation and Supporting Remediation
CertiK used threat modeling to challenge the assumptions behind the platform’s architecture and identify how legitimate features could be misused or combined across trust boundaries. The team then compared those scenarios with the actual code, configuration, and observed behavior to determine whether the intended safeguards were consistently implemented.
Throughout the engagement, CertiK maintained direct communication with the provider’s teams. Reviewers clarified business intent, raised issues as they were validated, discussed remediation options, and independently checked relevant updates. This shortened the feedback cycle and allowed security decisions to be made while engineering context was still available. It also created a shared understanding of the platform that can be reused for future releases, architecture changes, and new integrations.
Value Delivered
A Stronger Security Position Before Regulated Operation
The provider’s European business received an integrated assessment of the complete settlement-token business lifecycle rather than separate conclusions for individual technologies. This provided a clearer view of whether the platform’s financial, operational, and blockchain controls worked together as intended and where additional hardening was needed before regulated use.
Independent Evidence for MiCA- and DORA-Related Processes
The final report documented what CertiK reviewed, how the assessment was performed, what limitations applied, and which remediation activities were verified. The provider’s European business could use this evidence in internal security and risk governance and as technical input to relevant MiCA- and DORA-related processes.
Reduced Uncertainty Around Critical Settlement Controls
CertiK independently verified relevant remediation within the reviewed settlement workflow. This reduced uncertainty for the provider’s European business around the integrity of token activity, the consistency of financial records and blockchain settlement, the protection of sensitive functions, and the resilience of critical operations.
Preparing a Regulated Tokenization or Settlement Platform for Launch?
CertiK supports financial institutions and payment companies with integrated Web3 architecture review, application and infrastructure assessment, private-blockchain and smart contract security, remediation verification, and regulatory-oriented reporting.
