Security review
This page describes what the review examined in Helva’s setup, and how that setup compares with common practice.
Scope and method
Section titled “Scope and method”The review covered three surfaces: how the Helva app builds the transactions you sign, the Anvil contracts Helva relies on, and Anvil’s governance upgrade of August 2026.
The method was a threat model of the full Letter of Credit life: deposit, creation, verification before a loan is activated, liquidation, redemption, early release after repayment, key management, and outside dependencies. Those dependencies are Anvil governance and the Pyth price oracle.
How Helva’s setup compares
Section titled “How Helva’s setup compares”| Area | Common practice | Helva |
|---|---|---|
| Customer records | The identity vendor keeps the file for the life of the account | The retained file stays in Switzerland. At MVP, Sumsub processes the identity check on its own servers. Helva asks Sumsub to delete that data once verification, including video identification, is complete. Deletion on their side may take about 30 days. See KYC & your data. |
| Collateral | A custodial lender holds the coins | Non-custodial collateral management. The coins stay in your own Anvil vault. You reserve a slice with a Letter of Credit. |
| Beneficiary | A hot wallet, or a single key | A role-gated LOCBeneficiary contract. Routine redemptions can only land in Helva’s Safe. The contract enforces that destination. |
| Authorizations | Signed messages that stay valid if they leak | Direct calls, gated by role. Helva does not issue signed cancel authorizations. |
| Duties | One operator can send funds anywhere | One operator can redeem or cancel. Redeem destination is fixed by the contract. Cancel returns collateral to the borrower. Moving funds out, or changing policy, needs two people. Each signer checks the hardware-wallet screen against an independent chain read. |
| Loan activation | The app’s report of the Letter of Credit is accepted | Helva reads the Letter of Credit from the chain before the loan is activated. |
| Addresses | Published only inside the app | Published on Verify your transactions, hosted separately from the app. |
| Key backup | One site, or a vendor | The three wallets involved in administration and recovery (the 2-of-3 admin Safe’s keys) are backed up in three different locations in Switzerland. No location holds two owner seeds, or a device together with its own seed. |
| Monitoring | Tied to a website | Watches and liquidation call the contracts directly. Anvil also lets anyone liquidate an unhealthy position if a watch fails. |
Residual trust assumptions
Section titled “Residual trust assumptions”- Anvil. Anvil’s owner can change the price oracle and the contracts without a timelock (a required delay before the change takes effect). After the August 2026 upgrade, collateral factors are global, so a governance change can affect an existing Letter of Credit. Helva does not control Anvil. Helva monitors governance and can redeem early if needed.
- Pyth. Prices come from the Pyth oracle. A stale price can delay a redemption until a fresh update is supplied. It does not let the caller choose where funds go.
- The beneficiary contract is upgradeable. Only the 2-of-3 admin Safe can upgrade it. Upgrades and role changes are monitored. The published address does not change. Changes are announced on Security at a glance.
Ongoing review
Section titled “Ongoing review”The same checks repeat on a schedule: before go-live, every quarter, once a year (including a recovery-key drill), and on every Anvil governance execution. The list is on Operational security.