preferred on
Points of Focus
- A single key can mint, burn, freeze, or deactivate KYC on HKDAP
- HKDAP’s KYC revocation logic does not execute due to a code error
- BlockSec found the contract diverges from five HKMA guideline clauses.
BlockSec published an onchain security review of HKDAP on August 14, 2026, examining the deployed contract behind Hong Kong’s first regulated stablecoin, live on Ethereum mainnet since Anchorpoint launched its institutional beta on August 12.
The review’s conclusion is critical: ‘it is not production-ready.’ Nothing in BlockSec’s findings suggests this kind of independent, third-party contract review happened before the token went live to institutional users with a Hong Kong Monetary Authority license attached.
Live. Licensed. Not ready.
That's BlockSec's verdict on HKDAP, Hong Kong's first licensable stablecoin—two days after its institutional launch.
One key can mint, burn, freeze, or deactivate KYC. No timelock. One address holds six overlapping roles, including its own audit…
— QDay (@QDayOfficial) August 17, 2026
BlockSec found that minting, burning, freezing, and KYC deactivation each execute with a single signature from one account, no second signer, and no timelock required at any step. The firm traced this to a live transaction, the most recent HKDAP mint at the time of its review, in which the same key both requested and executed the issuance within a single transaction.
Upgrades to the token contract and its five compliance modules require two signatures, one account holding one role plus any of three accounts holding a second role, meaning as few as two people can replace any part of the system’s logic.
The compliance controls central to a licensed stablecoin do not work as written
The review’s more specific finding concerns HKDAP’s KYC system. A function meant to revoke a wallet’s access when the identity provider that vouched for it is later de-registered contains a loop that never executes because of a comparison BlockSec traces to a coding error in the loop’s exit condition.
Separately, a function meant to validate the cryptographic proof submitted during KYC registration ignores the proof entirely and returns true regardless of what is submitted, including an empty string.
BlockSec was careful to scope its findings to what onchain code shows. The firm stated it makes no claims about reserve backing or off-chain key custody, areas outside what a smart contract review can establish.
A licensed issuer, five points of divergence
Anchorpoint holds one of only two stablecoin issuer licenses the Hong Kong Monetary Authority granted out of 36 applicants, and BlockSec mapped its findings directly against the HKMA’s own Guideline on Supervision of Licensed Stablecoin Issuers.
The review found HKDAP diverges from five separate clauses, including the requirement that high-risk operations not be executable by a single party, that duties be segregated across authorized personnel, and that compliance controls like KYC and blacklisting function effectively.
One account, BlockSec found, holds six separate roles at once, including issuance authority and all four auditor roles meant to review it.
BlockSec also flagged a separate defect in HKDAP’s fund-destruction function: it correctly reduces total supply but emits a transfer event to the contract’s own address rather than to a null address and never actually credits the contract with the destroyed balance.
This mismatch would cause an indexer reconstructing supply from onchain events to diverge from the chain’s true state.
What comes next
BlockSec’s review closes on a specific point: the contract’s ‘Beta Access’ label does not change its risk profile, since it is live on mainnet and represents a real claim on Hong Kong dollars regardless of how it is described.
Whether Anchorpoint addresses these findings before HKDAP’s planned retail expansion, targeted for as early as the end of 2026, remains an open question. The answer will test whether Hong Kong’s narrow, two-license approach to stablecoin regulation actually screened for what its own guideline requires.
Share
Most read articles
