Digital Asset Clearing Center said CertiK has completed a security audit of smart-contract code used in specified components of its ChainFusion technology platform, a review focused on privileged functions, role-based permissions and access-control logic as the Hong Kong-based firm develops infrastructure for tokenised bonds.
The Aug. 17 announcement said CertiK delivered a final report setting out its findings and recommendations. Digital Asset Clearing Center did not publish the report’s detailed findings in the release, but described the review as part of its work to support retail digital asset bonds and strengthen platform controls around on-chain issuance, ownership and settlement processes.
The engagement places a security specialist in the development cycle of a platform intended to connect traditional financial systems with public and private blockchain networks. In bond tokenisation, smart contracts can govern records of ownership, programmed payments and settlement instructions. Weaknesses in administrative access or permission settings could create risks well beyond a conventional software error, particularly where tokenised securities are designed to operate with automated lifecycle events.
Wei, co-founder and chairwoman of Digital Asset Clearing Center, said the firm commissioned the audit while advancing work on retail digital asset bonds and associated controls. Yang, director of security engineering at CertiK, said the review addressed security considerations arising as tokenised assets become more closely linked to mainstream financial markets.
Audit focused on administrative controls
The audit concentrated on privileged functions and role-based access control, two areas that determine who can make changes to a smart contract and under what circumstances. Such permissions may be needed to pause a system, update approved participants, respond to a technical issue or manage issuance and redemption functions.
Those powers also require close governance. A poorly structured permission model can allow an unauthorized party, or an authorized party acting outside intended limits, to alter key contract functions. Auditors typically examine whether administrative roles are properly separated, whether sensitive actions are restricted and whether the code’s intended controls work in practice.
Digital Asset Clearing Center said the review covered the in-scope code rather than presenting the audit as an assessment of every element of ChainFusion. That distinction is relevant for platforms that combine blockchain contracts with custody systems, transaction-monitoring tools, fiat-payment connections and off-chain operating processes.
The company described ChainFusion as a system designed to bridge conventional finance with both public and private blockchain networks. Its proposed infrastructure includes a unified dual-core clearing rail, hybrid custody, automated back-office tools, Delivery-versus-Payment processes and a cross-border stablecoin liquidity hub.
Delivery-versus-Payment, or DvP, links the transfer of an asset to the corresponding payment, seeking to prevent one side of a transaction from completing while the other does not. Applying that structure to tokenised bonds would require reliable coordination between on-chain token transfers and the payment rail used for settlement.
Bond tokenisation adds operational demands
The company framed the audit against rising activity in Hong Kong’s digital bond market. Hong Kong has already used distributed-ledger technology for digital green bond issuance, including a multi-currency HK$6 billion, or about US$766 million, offering. Such government-led issuance has provided a practical test case for tokenised securities workflows, even as market participants continue to develop common operating, legal and technical standards.
Digital bonds can reduce manual reconciliation by placing ownership records and certain bond events on shared digital infrastructure. The model also raises questions over identity checks, custody, transfer restrictions, redemption procedures and interoperability with existing payment systems. A blockchain record alone does not remove those operational requirements; it shifts many of them into software rules, institutional processes and the legal framework governing the instrument.
Digital Asset Clearing Center said its platform uses hot-cold wallet segregation and real-time know-your-transaction and anti-money-laundering screening. Hot wallets are connected to networks for operational use, while cold wallets are generally kept offline to reduce exposure to online attacks. KYT screening monitors transaction activity for potential compliance risks, complementing participant onboarding and other controls.
The firm said its services are designed for authorized institutional participants and intended to meet regulatory requirements. It also said it follows the core criteria contained in circulars announced by the Securities and Futures Commission and the Hong Kong Monetary Authority.
Its stated model includes integrations with China’s Cross-Border Interbank Payment System, or CIPS, and routing for CIPS and e-CNY fiat flows into tokenised real-world assets. These features remain part of the company’s platform ambitions, but they point to the practical challenge facing tokenisation projects: a bond token has to fit within existing payment, custody and compliance arrangements before it can function as a useful financial instrument.
CertiK cites global audit experience
CertiK, which is headquartered in New York and was founded in 2017, said it has identified more than 119,000 vulnerabilities and protected more than $600 billion in digital assets across more than 150 countries and regions. The company also said it operates under SOC 2 Type II and ISO 27001 standards.
Digital Asset Clearing Center separately said it was named a Gold winner in the Banking-as-a-Service Innovation category at Juniper Research’s Fintech Payments Awards 2026. According to the company’s release, the Future Digital Awards are reviewed by a Juniper Research analyst panel against set criteria before judging-panel verification.
For ChainFusion, the CertiK review gives the company an external assessment of the code governing selected on-chain controls as it positions its infrastructure for digital bond use. The harder next stage lies in translating audited contract logic into production systems where issuance, custody, compliance screening, payment settlement and regulatory oversight must operate together.
Explore how tokenisation is reshaping traditional finance in Asia—learn more in this detailed overview of regional digital-asset trends.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
