In February 2026, Halborn conducted a smart contract security assessment of the Ern protocol. The engagement ran from February 16 to February 17, 2026. The final report was published on February 27, 2026, and is publicly available here.
About Halborn
Halborn is a blockchain security firm specializing in smart contract assessments, protocol audits, penetration testing, and security advisory services. The firm has conducted audits across a broad range of DeFi protocols and blockchain infrastructure projects. The engineer assigned to the Ern engagement holds expertise in DeFi yield mechanisms, tokenized vault architectures, and reward distribution systems.
Scope
The assessment covered two contracts: Ern.sol, the core vault contract responsible for managing deposits, withdrawals, and yield accrual; and RewardsDistributor.sol, the contract responsible for converting stablecoin yield into Bitcoin and distributing it to depositors. The review was conducted against the production commit deployed to Ethereum mainnet.
Findings
Halborn identified 16 findings across all severity levels: zero critical, one high, one medium, ten low, and four informational. All findings were reviewed and addressed by the Ern team prior to the report's publication date.
The high severity finding identified a condition under which a user could deposit immediately before a scheduled yield conversion and withdraw immediately after, receiving Bitcoin yield disproportionate to their time in the protocol. The Ern team addressed this through the early withdrawal fee mechanism, which applies a 0.1% fee to withdrawals made within 48 hours of deposit, making the described behavior economically unviable.
The medium severity finding identified a condition under which users could front-run allocation reductions to claim rewards at a higher rate than intended. This was accepted as a known protocol design trade-off.
Audit archive
All Ern audit reports, including the full Halborn assessment, are archived at github.com/ernorg/audits