Audits Published by Halborn
BTCfi enters its next phase with the help of some of the greatest security-focused minds in the industry.
We have made it to the end of our security audit with Halborn.
Halborn's institutional-grade security team reviewed Alkanes from top to bottom. This is the SUBFROST-native protocol delivering smart contracts to Bitcoin L1. This audit covered the Alkanes runtime, Protorune, the DIESEL contract, METASHREW indexer underneath it, and the RPC infrastructure around the protocol.
Additionally, they covered the dependencies between these repos and the live systems with capital, such as SUBFROST, our AMM, and the FIRE vault contract. Their job was to find anything that could go wrong, and they were thorough about it.
Here is the link to the full detailed audit report.
What came out of it
Most of what Halborn found lived at the edges: unusual inputs, rare combinations of transactions, and math right at the limits of what a number can hold. The work was about making Alkanes and SUBFROST more precise and more predictable in those corners.
A few examples:
- Alkanes indexes Runes alongside its own assets, and several rare cases were tightened so that Alkanes tracks every Rune exactly the same way the canonical Ord indexer does.
- Anywhere the indexer does work on behalf of someone else, like loading a contract or answering a request, that work now has a fixed limit.
- DIESEL's supply cap is now checked against the full supply after every mint, so the cap will always be enforced down to the last unit. DIESEL is a popular Bitcoin-native asset.
- METASHREW now recovers cleanly when a chain reorganization leaves blocks out of order.
We also adopted all of Halborn's recommendations for the RPC infrastructure that serves the protocol.
Every finding in the report has been addressed. Each one is tied to a specific change in the code and a test that shows it is fixed.
Where things stand
At the time of this writing, Alkanes is at v3.0.0-rc.3 and METASHREW is at v9.1.0-rc.1. Together they include every fix from the audit.
The protocol changes took effect at Bitcoin block 972,000, and the 6 public indexers switched over at that same block.
The indexer is now much faster. The heaviest block we have seen on mainnet, with more than 7,400 mints, went from 213 seconds to under 60 seconds, and the typical block indexes more than twice as fast.
These upgrades make the indexer framework more reliable as well. Blocks are written all at once or not at all, indexing is strictly deterministic, and every request has its own timeout so one slow request can't hold up the others.
We also tightened up how the software is built and released, and added aSECURITY.mdso anyone who finds an issue has a private way to report it.
Before these repos were tagged, we tested it against real mainnet data and real DIESEL state, and a test indexer running the new release has matched our production indexers block for block.
Our own team, at the same time
While Halborn was deep in their audit process, our internal security team ran its own review in parallel across everything else we run: our code repositories, our current and future SUBFROST deployments, our infrastructure and our operational security. A lot of that work was routine, like reviewing configurations and rotating credentials, but it is the kind of work that keeps a platform safe over the long run.
Thank you
A big thank you to Halborn. Their team was rigorous and they pushed our metaprotocol harder than anyone has before. Thank you as well to the developers who worked through this with us, and to our community for your patience while we did it right.
What we have now is a much stronger foundation for SUBFROST and for every person and institution who uses it.
What comes next
The post-audit release of Alkanes moves us one step closer to the economic vision we have for Bitcoin itself. We see Bitcoin as more than a store of value. We see it as a whole economy that can run on its own base layer, already being proven out with AMMs, DeFi vaults, launchpads and valuable Bitcoin-native assets with capital behind them.
This concludes the first institutional-grade audit of any Bitcoin metaprotocol. We encourage serious development teams and investors to contact us to build the future of Bitcoin as we know it.
*The full detailed audit report, not just the executive summary, is made available on the Halborn website: *https://www.halborn.com/audits/subfrost
