Daml Smart Contract Audit: What Reviewers Check on Canton

Video transcript

Do Daml contracts need an audit? Yes, if they hold value. Canton enforces who must authorize each action, not whether the logic is right.

When a builder asked this on the Canton forum, one reply put it plainly. Daml is still software. It avoids reentrancy, but logic, privacy and upgrade bugs remain.

Guardian's review of LayerZero's Canton DAML code returned 71 findings, one of them High, in application code.

Canton enforces the authority you declare. Reviewers check what it binds to: caller-named parties, caller-supplied contract IDs, inherited authority, checks that run once, and governance one member can freeze.

Privacy fails both ways. Observers can overshare, or a party cannot see a contract it must settle, leaving the flow dependent on off-ledger disclosure.

Under Smart Contract Upgrade, the compiler allows additions and rejects removals or type changes. But existing contracts' computed signatories and observers must stay unchanged, or transactions abort.

Before each upgrade, check the new DAR, trace every stored contract ID, confirm one live config, and coordinate vetting across validators so workflows do not get stuck.

Firms quote Daml audits privately. One general benchmark calls ten to forty thousand dollars per auditor per week not uncommon. Guardian's main LayerZero Daml reviews ran six to 18 days.

Every Guardian smart contract audit runs two competing teams. Read the full checklist below, or get a quote at guardian.security.

In January 2026, a developer building a finance platform asked on the Canton forum: “Before going live does Daml smart contracts need to be audited like solidity?”

One reply said Daml “can/should be audited”: “This is still software and consequently must be checked for any system with real value.”

The same reply noted Daml is “not vulnerable to common Solidity attacks like reentrancy”.

So Daml rules out some bug classes. Logic, privacy and upgrade bugs remain, and those are what a reviewer checks.

Do Daml Contracts Need Audits?

Daml gives strong guarantees about who acts. Every template declares its signatories, and every choice declares its controllers.

Canton's security guide says the protocol enforces those declarations, and “no amount of API manipulation can bypass them”.

It cannot know whether those declarations, and the logic around them, match your intent. That logic lives in your ensure clauses, assertions and choice bodies.

Guardian's 2026 review of LayerZero's Canton DAML code returned 71 findings, one of them High (Canton DAML report).

The High sat in application code. An inbound amount could pass acceptance, then overflow at finalization, leaving a stuck callback and nothing minted (H-01).

Authorization and Signatories

A create needs its signatories. An exercise needs the choice's controllers.

Inside a choice, the consequences run with the authority of the controllers plus the signatories of the contract exercised on. Authority does not pass on transitively.

So the question is which values authority is bound to. Guardian's LayerZero reports show the patterns:

• Parties the caller names. The finalizer chose the receiver hint, so a transfer could settle to a sibling party (Canton DAML, I-02).
• Inherited authority. Untrusted app code ran with a funded party's authority and could spend the fee (L-09).
• Contract IDs from the caller. A payout path trusted whatever transfer factory the caller supplied (M-12).
• Checks that run once. Receive checks were not replayed on the callback path, so a delegated admin could mint through a forged callback (M-08).
• Unanimous governance. Accept and reject needed every member, so one member could freeze governance (Canton DAML, M-02).
• Admin paths around a multisig. A single admin could change OneSig's signers and quorum without a quorum signature (OneSig on Canton, M-02).

None of these breaks Canton's rules. Each needed a reviewer to ask what the code should require.

Privacy and Divulgence

Canton shows each party only what it is entitled to see. Signatories always see a contract; observers see it because the template declares them.

Anyone who sees an action also sees the creates and archives it produces. Parties to a transaction “may learn about” the contracts it uses, which Canton calls divulgence.

So privacy depends on how each application is written, and it fails both ways.

Too much visibility

• A batch commitment showed every request ID to each request's observers (Canton DAML, I-12).
• Monitoring observers could read OneSig's full signer set, quorum and seed (OneSig on Canton, I-02).

Too little visibility

A party must see a contract to authorize a choice on it. Leave it out, and the flow depends on off-ledger disclosure.

• A newly added executor was authorized but could not see the OneSig anchor it had to exercise (OneSig on Canton, L-10).
• An admin role grant did not make the holder a factory observer, so delegated actions waited on disclosure (Canton DAML, I-20).

Explicit disclosure fills the gap, but delivery happens outside Daml. Canton's docs name HTTPS, SFTP and email as examples.

A disclosed payload is authenticated by its contract ID. The docs still recommend checking its contents, such as the issuer, in the choice body.

A reviewer asks for:

• Every observer on every template, and why it needs the whole payload.
• Every contract each choice fetches, and who sees that transaction.
• Every flow that depends on disclosure, and who delivers it.

Upgrades and Package Versions

Every Daml package has a name and version. Under Smart Contract Upgrade (SCU), a new version lives on the ledger beside the old one.

Existing contracts stay tied to the version that created them. Newer code can read and exercise them when compatibility permits.

Canton's upgrade compatibility rules, in short:

The compiler is not the whole check. For existing contracts, “the computed signatories and observers must remain unchanged”, or the transaction aborts.

The ensure clause is re-evaluated too. Canton warns that adding ensure False leaves existing contracts “with no way to archive them”.

Then rollout. “A package cannot be used until it is vetted”, and a new choice needs every stakeholder's validator to vet the new DAR.

Canton's deployment guide warns that uncoordinated transitions “can cause command submission failures, resulting in workflows getting stuck.”

The same risk shows up inside application code:

• An admin recovery could archive a holding locked by a pending transfer, orphaning the callback that stored its ID (Canton DAML, I-11).
• A signed batch reused a config's archived contract ID after an earlier call replaced it, so the batch aborted (OneSig on Canton, L-15).
• If a migration left two live configs, a caller could pick the more permissive one (Canton DAML, I-03).

Before each upgrade, check:

1. The new DAR against the SCU rules, including unchanged signatories and observers.
2. Every stored ContractId, and what happens when its target is archived.
3. That each config or rule has one live instance after migration.
4. The vetting order across validators, and a switch-over date for counterparties.
5. That the DAR rebuilds from source. Canton says builds are deterministic.

Cost and Timeline

Firms quote Daml audits privately. We know of no public price record for one.

The closest public benchmark is general, not Daml-specific.

The Arbitrum Audit Program proposal (February 2025) says it is “not uncommon for projects to pay $10k to $40k per auditor per week”, depending on complexity.

For timeline, Guardian's two public Daml reports for LayerZero give real windows:

Offchain code is scoped separately: LayerZero's TypeScript validator stack was its own engagement.

Ask any firm for the engineer-weeks, reviewers and fix rounds a quote covers. Our audit pricing comparison shows what public records say.

How Guardian Reviews Daml

Guardian has reviewed LayerZero's Daml on Canton, from its send and receive paths to OneSig. The LayerZero client story has the full timeline.

Each smart contract audit runs the Guardian Standard: two competing teams on one scope, one manual and one driving frontier AI, over an invariant fuzzing suite.

For validators and keys, see Canton Network security. Every engagement type is on the audits and pentests page.

Frequently Asked Questions

Do Daml smart contracts need an audit?

Yes, when they hold value. Canton enforces the signatories and controllers you declare, not whether they and the logic around them are right. Guardian's Canton DAML review for LayerZero found one High among 71 findings.

What does Canton's authorization model not catch?

Authority bound to the wrong values: parties or contract IDs a caller supplies, checks that run only at creation, and governance one member can block. It also cannot tell whether observers overshare or a flow depends on off-ledger disclosure.

Can a Daml contract be upgraded?

Yes. Under Smart Contract Upgrade, a new package version sits beside the old one, and existing contracts can be exercised through compatible newer code. Fields cannot be removed or retyped, and existing contracts' computed signatories and observers must not change.

How much does a Daml audit cost?

Firms quote privately; we know of no public Daml price record. The Arbitrum Audit Program proposal calls $10k to $40k per auditor per week not uncommon for audits generally. Guardian's main LayerZero Daml reviews ran six to 18 calendar days.

Sources

• Canton Network Forum: Daml Smart contracts need auditing like Solidity? (from January 18, 2026)
• Canton Network Docs: Daml Authorization Model
• Canton Network Docs: Security Best Practices
• Canton Network Docs: Privacy Model Explained
• Canton Network Docs: Explicit Contract Disclosure
• Canton Network Docs: Smart Contract Upgrades Overview
• Canton Network Docs: Upgrade Compatibility
• Canton Network Docs: Package Selection
• Canton Network Docs: Deploying Upgrades
• Canton Network Docs: Package Management
• Arbitrum Forum: Arbitrum Audit Program proposal (February 6, 2025)
• Guardian: LayerZero Canton DAML report (April 3, 2026)
• Guardian: LayerZero Canton VER report (May 7, 2026)
• Guardian: LayerZero OneSig on Canton report (September 4, 2026)
• Guardian: LayerZero client story
• Guardian: Smart contract audit
• Guardian: Canton Network Security for Banks and Asset Managers
• Guardian: What Top Auditors Charge