Halborn Completes Independent Review of Our MPC Engine

The Vault has completed an independent security assessment of the Rust codebase behind its multi-party computation (MPC) custody engine, conducted by Halborn. The engagement was carried out by security engineers with dedicated backgrounds in cryptography and MPC, and covered the core cryptographic protocol library, the signer service, and the transport layer coordinating communication between parties.

Understanding the Assessment

The Vault's custody architecture is built on MPC. Instead of generating a private key in one place, the key is generated jointly across separate parties, so no single party ever holds the complete key at any point. Those parties work together to sign transactions, refresh their shares over time, and recover access if a share is lost, all without the full key ever being reconstructed in one place.

Halborn's review focused on confirming that these cryptographic protocols behave as intended, that key shares are handled and stored safely across their lifecycle, and that the signer service communicates and coordinates securely with other parties. Across the assessment, 33 issues were identified, including 2 rated critical and 4 rated high. Every issue raised has been remediated and verified by Halborn.

What This Means for Our Clients

• Independent verification of the cryptography, not just the interface. MPC security depends on protocol-level correctness. A review by engineers specialised in cryptography and MPC gives institutions assurance that goes beyond a standard application security test.
• A documented remediation record. Every finding identified during the assessment has been addressed and confirmed, giving risk and compliance teams a concrete basis for due diligence rather than a general assurance.
• Reduced counterparty risk in key management. Because no single party ever holds a complete key, and the protocols coordinating that distribution have been independently reviewed, institutions can evaluate a custody design that has been tested against real implementation risk, not only against its specification on paper.
• A foundation to build on. This review sits alongside The Vault's existing licensing and audit programme, and will be repeated as the MPC engine evolves.

Scope of the Assessment

Halborn's review covered:

• The core cryptographic library implementing The Vault's MPC protocols, including distributed key generation, threshold signing, share refresh, and recovery.
• The signer service responsible for participating in each MPC operation.
• The transport and relay layer coordinating communication between parties.

This assessment marks a step toward a longer-term goal: open-sourcing the MPC library itself. An independently reviewed and remediated codebase is a natural prerequisite for that move, and this assessment brings The Vault closer to making its core cryptography open for public scrutiny, not only for institutional clients.

Next step is moving the library to open source.