I had a great chat with a really cool guy the other day. He shared an audit report from a well-known security firm that had audited a Canton Network / DAML project. Afterward, I tracked down a second public DAML audit from the same firm, took both audit scopes, and pointed our Valves security tool at them to see how it would do.
The results were very encouraging.
What the tool found
- It identified 10 of the 12 validated issues reported across both audits.
- The two it "missed" it had actually downgraded to informational - it saw them, but assessed them as below the material-harm floor, which matches how we would have triaged them by hand.
- It also flagged 50+ additional potential issues that we are currently validating.
Across the two scopes, the tool matched exact root causes and fixes on the security-relevant
findings - permissionless confirmation creation, a 1-of-1 quorum
misconfiguration that collapses to zero-confirmation execution, mutable votes with no
cooldown, validator rewards routed to a third party, missing expiry checks caught by an
asymmetry lens, and an unhashed secret, among others. On one scope it recovered every
validated finding; on several it found a second bug in the same mechanism.
Why this matters
DAML and Canton are a different world from the EVM. The attacker model splits authority from visibility, privacy is a first-class security property, and the bug classes that matter often have no Solidity analog. Tooling that was built for public, permissionless chains does not transfer cleanly - which is exactly why we have been building for this ecosystem specifically.
Teams most likely paid significant amounts for audits like these. Recovering the vast majority of a firm's validated findings automatically - and surfacing dozens of fresh candidates on top - is a strong signal of where this is heading.
If you are building on Canton / DAML, we would love to help. Reach out and we will put your codebase through the same process.
Secure your codebase - valvessecurity.com