QuillAudits | Blockchain Security & OPSEC🥷

Meet Preetam Rao, CEO of QuillAudits | Blockchain Security & OPSEC🥷, onstage at CoinFerenceX The Best Event, Singapore. With nearly a decade of experience in Web3 security, Preetam leads a premier firm that has safeguarded over $3 billion in on-chain value across more than 1,500 projects. He is actively redefining the industry's approach to smart contract safety, driving the critical shift from one-off audits to always-on, autonomous trust. 📍 5–6 Oct 2026 📍 Gardens by the Bay, Singapore Stay tuned; more big names are dropping soon. 📅 RSVP on Luma: luma.com/cfx-tbe-summit 🤝 Sponsor or partner: https://lnkd.in/gT-TuJyz #CoinFerenceX #TheBestEvent #QuillAudits

Meet Preetam Rao, CEO of QuillAudits | Blockchain Security & OPSEC🥷, onstage at CoinFerenceX The Best Event, Singapore. With nearly a decade of experience in Web3 security, Preetam leads a premier firm that has safeguarded over $3 billion in on-chain value across more than 1,500 projects. He is actively redefining the industry's approach to smart contract safety, driving the critical shift from one-off audits to always-on, autonomous trust. 📍 5–6 Oct 2026 📍 Gardens by the Bay, Singapore Stay tuned; more big names are dropping soon. 📅 RSVP on Luma: luma.com/cfx-tbe-summit 🤝 Sponsor or partner: https://lnkd.in/gT-TuJyz #CoinFerenceX #TheBestEvent #QuillAudits

Quill Findings: Missing Access Control in Tokenized Real Estate This is the second blog in our series Quill Findings, where we share about interesting findings. We audited a real estate tokenization protocol, where properties are NFT shares. The vulnerabiltiy allowed any user to buy these property shares for free. And bypassing the whole buyProperty() flow. Root cause for it is a trusted proxy inherited by every seller token approvals, then it let anyone to use it. We have broken down the finding in detail with a working PoC and recommendations. Blog link in comment 👇

Arc Chain is EVM compatibility. That compatibility covers execution, not behavior, a contract that passes every check on Ethereum can still fail on Arc, and it won't fail at compile time. Here is what changes for a Solidity contract moving from Ethereum to Arc: • USDC is the native gas token, not an ERC-20 held by the contract. • The same token exposes two decimal views 18 and 6, depending on how it's read. • SELFDESTRUCT moves USDC out of the contract, and a subsequent transfer call then reverts. • CallFrom preserves the original msg.sender, so any access control or authorization logic built around msg.sender needs to be re-verified. • Transfers to the zero address revert. • Transfers to a blocklisted address revert. • A standard Anvil will not surface any of the above, tests pass locally and fail on Arc. None of this produces a compiler warning. It surfaces at runtime, usually in withdraw logic, balance accounting, or post-SELFDESTRUCT state. Teams porting Ethereum contracts to Arc should treat this as a pre-deployment checklist, not an afterthought. Full technical breakdown in comment 👇

Security should not enter the conversation days before a tokenized offering goes live. It should be built into the journey from day one. We’re pleased to share that QuillAudits is joining Issuant OS to support secure tokenized asset issuance. Issuant OS brings the workflows required to structure, issue and operate offerings into one system. With QuillAudits available through its service provider ecosystem, issuers can access adversarial smart contract audits, economic and logic testing, dApp and infrastructure assessments, incident response and continuous on-chain monitoring when needed. Why does this matter? Finding the right security team should not slow down an issuer’s launch. This collaboration gives teams a clearer path from architecture and issuance to post-launch operations, with security expertise available throughout the process. We’re excited to work with the Issuant team and help issuers reduce technical risk at every stage of a tokenized offering.

QuillAudits Joins the Issuant OS : Issuant today announces that QuillAudits | Blockchain Security & OPSEC joins the Issuant OS to Support Secure Tokenized Asset Issuance.   Why this matters
Every provider onboarded into the Issuant OS has been vetted to operate inside a live offering, so issuers aren't starting from a cold search. Adding QuillAudits means one more proven, issuer-ready partner is available the moment it's needed and one less decision an issuer has to de-risk alone. Quotes “Bringing QuillAudits onto Issuant OS is one more step toward fixing the fragmented lifecycle of financial instrument creation. Security review has always been a separate, disconnected step for issuers this puts it directly into the same workflow where the instrument is actually being structured and issued.” — Juan Mari CEO, Issuant 
"We see a strong shared opportunity to make security native to the issuer journey, rather than treating it as a final-stage checkpoint. By making QuillAudits available through Issuant OS, issuers can access adversarial smart contract review and continuous monitoring alongside the workflows they use to structure, issue and operate tokenized offerings.” — Preetam Rao, Co-founder and CEO, QuillAudits   About Issuant
Issuant is the operating system for offerings and entities. Headquartered in US and built under U.S. regulatory frameworks, Issuant lets companies structure, issue, and manage offerings or entities then make them programmable and controllable from a single dashboard through tokenization. It pairs Issuant OS,  with Issuance Teams, a professional-services arm that maps each client's path towards tokenization and either trains their team to run it or executes it alongside them. Issuant supports multi-asset issuance across equity, debt, real estate, and fund vehicles, with compliance enforced at the moment of transfer. Learn more at issuant.com   About QuillAudits
QuillAudits is a Web3 security company that secures smart contracts, protocols and tokenized-asset infrastructure from architecture through post-launch monitoring. QuillAudits has completed more than 1,500 audits, reviewed over 1 million lines of code and helped secure more than $3 billion in total value locked. We support issuers, RWA and tokenization platforms, DeFi protocols and blockchain infrastructure teams through smart contract audits, economic and logic testing, dApp and infrastructure assessments, incident response and on-chain monitoring.   Website: Your Leading Blockchain Security Auditor | QuillAudits

We’re starting Quill Findings. These are detailed write-ups of issues our auditors catch in client engagements. Not a recap. The actual path: what broke, why it was easy to miss, and what the fix was. The first one is Eligibility Replay in Tokenized Assets. The protocol was a gold-backed vault. Each bar had a custody certificate NFT. Customers received claim tokens against that certificate. On withdrawal, they burned the claims and took the gold. The vault never burned the certificate. It sent it back with the customer, still valid. Deposit that same NFT again and the vault mints a second batch of claim tokens. One bar. Two claims. Full breakdown in the comments.

Dubai has issued 50 crypto licenses. 39 are operational. That gap is worth paying attention to. It points to something teams consistently underestimate: getting licensed by VARA and staying licensed are two different challenges. The second is where most of the risk sits. VARA's framework isn't built around a one-time approval. It expects continuous evidence that a real operation is running behind the license: A named CISO. An accountable individual, not a line on a form. Documented key management, so custody doesn't depend on institutional memory. Reserves audited every six months. Verified on a schedule, not asserted once at launch. What we see repeatedly is teams treating the license as the finish line. They invest heavily in the initial audit, clear it, then let the operational discipline lapse. That's the very discipline the license was meant to guarantee. That's where the distance between "licensed" and "operational" opens up. The license gets you in. Sustaining it is the ongoing work. Full breakdown of all four VARA rulebooks, the pre-launch checklist, and what actually triggers a suspension is in the comments 👇

You think you're signing a harmless transaction. But the Safe interface can show you one thing while a completely different transaction hits the chain. That's what happened in the Bybit hack. Malicious JavaScript injected into the Safe UI tricked signers into approving what looked like a routine transaction, while the attacker quietly moved funds in the background. The number of signers who approve means nothing if none of them can actually see what they're signing. Our auditor Abhinav Sharma breaks down exactly how the attack worked in this clip from our Multisig Inspector webinar, and why the real safeguard is verifying the transaction itself, not trusting the interface in front of you. If your team signs through a multisig, this is worth five minutes. Link to the tool and the full webinar in the comments 👇

Dubai last weekend. Three hours inside VARA's rulebook with RWA founders and compliance teams. One section does most of the work. Section E requires a VASP to engage an independent third party for vulnerability assessment and penetration testing, including smart contract audits, at least once a year and before any new system goes live. Section D separately requires no single point of failure in key access. Most of what gets sold as compliance in this market addresses one clause of E and nothing in D. One code audit, once. The incident data says the rulebook has it right. Code bugs accounted for 59 per cent of Web3 incidents in the first half of 2026 and 11.5 per cent of the money lost. Key compromise took $ 444 m. Phishing took $ 366 m. Between January 2025 and July 2026, 147 of the 245 breached platforms had passed an audit. The audits were fine. They were scoped to the contract, and the attacker never touched the contract. The discussion in the room went the same way. Upgrade keys, freeze functions, oracles, and what happens when a tokenised transfer goes wrong. None of that shows up in a code audit. The part I would still want a lawyer's read on is "before any new system." Whether that means every release or only a new product changes the cost of compliance by a lot. This is why we work across the whole lifecycle of a protocol as one team, before launch and after it. The audit is one piece of that. Security usually breaks in the handoff between vendors, and we don't have one. About 36 UAE-linked teams have worked with us this way. One question for people running licensed platforms here. When a tokenised transfer goes wrong, which record wins on your platform: the chain or the registry? And who decided that?