Softstack

Softstack is a Flensburg, Germany-based Web3 development, security and consulting company, founded in 2017 and known as Chainsulting until its 2024 rebrand. It fits European teams that want smart contract audits alongside penetration testing and EU/Dubai regulatory security work (MiCA, DORA, VARA) from a single ISO/IEC 27001-certified vendor. The strongest evidence-backed signal is its public GitHub audit archive, which has roughly 98 client folders and continues to receive new reports in 2026, including reports dated May and August 2026.

At a glance

Founded	2017 (about page); formerly Chainsulting (rebrand post)
Headquarters / jurisdiction	Flensburg, Germany; Softstack GmbH (homepage)
Engagement model	Private firm audit; mostly fixed-price projects (security services)
Core specialties	Smart contract audits, dApp audits, penetration testing, threat-led penetration testing, digital asset risk assessments, MiCA/DORA/VARA security testing
Ecosystems / languages	EVM (Solidity), Solana, XRP Ledger, TON, Canton, according to published reports; the repo README says it covers 20+ chains (audit repo)
Public report index	github.com/softstack/Smart-Contract-Security-Audits
Open-source tooling	None found; the GitHub org holds reports, setup guides and dev SDKs
Published pricing	Not published ("mostly fixed-price projects")

What they do

Softstack's homepage splits the business into three lines: Web3 development, Web3 security and Web3 consulting (including ISO 27001 consulting). Its security services page lists nine offerings:

• smart contract auditing
• digital asset assessment for custodians, exchanges and operators
• penetration testing
• threat-led penetration testing (TLPT) for DORA-designated entities and VARA-notified VASPs
• dApp audits covering the app, API and contract layers
• MiCA compliance security testing
• DORA compliance (ICT resilience) testing
• VARA compliance (annual pentests and audits for Dubai VASPs)
• ICT preparation

The same page says the firm "mostly work[s] on fixed-price projects." It does not publish a step-by-step audit methodology, a report-publication policy, fix-review terms or a retainer model.

The firm says it holds ISO/IEC 27001 certification from TÜV SÜD (about page). This review did not examine the certificate itself.

Specialties and ecosystem coverage

The published reports back up the EVM focus. They also show work outside the EVM that the directory listing does not mention:

• EVM / Solidity: most of the archive, including AllUnity (stablecoin, report file dated 15 May 2025) and Trusset.
• Solana: Unich ("EVM Smart Contract Solana Program Audit", March 2025).
• XRP Ledger: Ripple Multi-Purpose Token (MPT) security assessment (October 2024).
• TON: TON multisig audit (February 2023).
• Canton: Coinversa Canton smart contracts plus a backend/frontend codebase audit (March 2026).
• Institutional / off-chain work: the Anchorage Digital folder describes a confidential asset-assessment engagement. It contains only a summary and no report.

The directory lists Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Chain and Solana. EVM and Solana work is confirmed. This pass did not find a report that clearly targets each individual L2. Specialties listed in the directory (smart contracts, DeFi, penetration testing, dApp security) match the firm's own service list.

Recent public work

These come from the GitHub archive (folder listing and commit history via the commits page, checked 2026-09-24). Report-file date stamps are used where present. Older files use DDMMYYYY and newer lowercase files use MMDDYYYY, and the dates below were read accordingly.

1. Lambdaplex core contracts: two report versions dated 1 June 2026 and 5 August 2026, added June and August 2026.
2. BloomBeans smart contracts: report dated 2 April 2026, added 19 August 2026.
3. Trusset core protocol: report dated 11 May 2026, added 22 June 2026. The README describes a review of four interconnected codebases on a regulated real-world-asset tokenization platform.
4. Coinversa: Canton smart contracts and backend/frontend codebase, reports dated 17 March 2026.
5. AllUnity stablecoin: 15 May 2025.
6. Unich OTC (EVM + Solana): 11 March 2025.
7. Ripple MPT security assessment: 22 October 2024.

Earlier work in the archive includes Worldcoin WLD (September 2023), 1inch, Fetch AI and Pantos.

Research, tooling and methodology

• Tooling: No security tools were found in the GitHub org. Its public repos are the audit archive, validator/node setup guides, and Telegram Mini App and Tezos SDK code.
• Blog: The blog publishes a monthly protocol-engineering recap. Examples are the July 2026 recap (Ethereum Glamsterdam) and the June 2026 recap. It also has regulatory pieces, such as MiCAR and BaFin compliance, and an article on digital asset risk assessments for custodians and exchanges.
• Methodology / severity scheme: No standalone methodology page was found. Readers should look inside individual PDF reports.
• No disclosed CVEs credited to the firm were found in this pass.
• Self-reported figures: The audit repo README claims 1,200+ audits, $100B+ secured TVL and "zero known post audit exploits." The about page says 1,500+ audits. These are the firm's own claims and were not independently verified. In the 2024 rebrand post, the firm described itself as having 20 experts at that time.

Track record and incidents

This pass found no reputable post-audit incident that names Softstack or Chainsulting as auditor of the exploited code. For example, rekt.news's USPD write-up names other auditors, not Softstack.

Who should consider them — and who might look elsewhere

• Consider them if you are an EU or Dubai-regulated entity (a CASP, custodian, bank or token issuer) that needs smart contract audits bundled with penetration testing, TLPT or MiCA/DORA/VARA-driven security testing. That combination is the clearest theme on the firm's own pages and in its recent institutional and real-world-asset reports.
• Also a fit for: EVM token, stablecoin and tokenization projects, plus multi-codebase reviews such as the Trusset engagement.
• Look elsewhere, or ask for samples, if you need deep ZK-circuit, formal-verification or novel-cryptography review, or heavy Rust/Move protocol work. This pass found little public evidence of those areas and no open-source analysis tooling.

How to engage

The contact page offers a contact form, a published email address and a meeting-booking link. It asks for your name, email, website and a description of the need. Prepare repository access, a pinned commit, a scope list and your regulatory context (MiCA/DORA/VARA) if it applies. The firm says it mostly works on fixed-price projects (security services).

Gaps and unverified claims

• The page at softstack.io/audits currently shows what appear to be placeholder project names and statistics ("14 total audits"), so it could not be used as a report index. The GitHub archive is the usable public index.
• Several statistics on the about page render as "0+" placeholders. Audit-count claims differ between sources (1,200+ vs 1,500+).
• Team size matches the directory: 20+ team members on the about page.
• Some named clients (Anchorage Digital, 21Shares, Siemens AG, HAL Privatbank) have summary folders only, with no public report.
• The founding year of 2017 matches the directory. The directory's X and GitHub links point to accounts other than the ones the firm's homepage links (the homepage links github.com/softstack and the softstackHQ X account).
• No per-chain evidence was found for Arbitrum, Optimism or Base specifically.

Sources

1. Softstack homepage — https://softstack.io — accessed 2026-09-24
2. Softstack about page — https://softstack.io/about-us — accessed 2026-09-24
3. Softstack security services — https://softstack.io/blockchain-security — accessed 2026-09-24
4. Softstack audits page — https://softstack.io/audits — accessed 2026-09-24
5. Softstack contact page — https://softstack.io/contact — accessed 2026-09-24
6. Rebrand post (Chainsulting to Softstack) — https://softstack.io/insights/rebranding-from-chainsulting-to-softstack/ — accessed 2026-09-24
7. Softstack blog index — https://softstack.io/blog — accessed 2026-09-24
8. July 2026 protocol recap — https://softstack.io/blog/july-2026-protocol-recap — accessed 2026-09-24
9. June 2026 protocol engineering recap — https://softstack.io/blog/june-2026-protocol-engineering-recap — accessed 2026-09-24
10. MiCAR and BaFin compliance — https://softstack.io/blog/micar-and-bafin-compliance-in-2025 — accessed 2026-09-24
11. Digital asset risk assessments post — https://softstack.io/blog/digital-asset-risk-assessments-for-custodians-and-exchanges-from-smart-contracts-to-operations — accessed 2026-09-24
12. GitHub org — https://github.com/softstack — accessed 2026-09-24
13. Audit archive repo — https://github.com/softstack/Smart-Contract-Security-Audits — accessed 2026-09-24
14. Audit archive commit history — https://github.com/softstack/Smart-Contract-Security-Audits/commits/master — accessed 2026-09-24
15. Lambdaplex reports — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Lambdaplex — accessed 2026-09-24
16. BloomBeans report — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/BloomBeans — accessed 2026-09-24
17. Trusset report — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Trusset — accessed 2026-09-24
18. Coinversa reports — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Coinversa — accessed 2026-09-24
19. AllUnity report — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/AllUnity — accessed 2026-09-24
20. Unich report — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Unich — accessed 2026-09-24
21. Ripple MPT assessment — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Ripple — accessed 2026-09-24
22. TON multisig audit — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/TON — accessed 2026-09-24
23. Anchorage Digital engagement summary — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Anchorage%20Digital — accessed 2026-09-24
24. Worldcoin WLD report — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Worldcoin — accessed 2026-09-24
25. 1inch folder — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/1inch — accessed 2026-09-24
26. Fetch AI folder — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Fetch%20AI — accessed 2026-09-24
27. Pantos folder — https://github.com/softstack/Smart-Contract-Security-Audits/tree/master/Pantos — accessed 2026-09-24
28. rekt.news USPD write-up — https://rekt.news/uspd-rekt — accessed 2026-09-24