AEREDIUM introduces AERSeal to eliminate single-key control over smart contracts.

      AEREDIUM has introduced AERSeal, a security solution aimed at smart contracts. Its purpose is to prevent a single compromised private key from allowing an attacker to take control of a contract.

      Smart contracts typically depend on one private key for authorizing critical operations, such as minting assets, upgrading the contract, or modifying administrative settings. If that key is stolen, an individual could gain control. Conversely, if the key is lost, the organization risks losing access to those capabilities permanently.

      AERSeal mitigates this single point of failure by employing a threshold signing system. This system operates on AERKey, AEREDIUM’s key infrastructure. Rather than keeping a complete private key in one place, control is distributed among several key shares, each housed in a separate hardware-attested enclave. The full key is never reconstructed; instead, the shares work together to produce signatures utilizing the CGGMP24 threshold signing protocol.

      Multiple Approval Requirements

      Organizations utilizing AERSeal have the option to establish an M-of-N approval policy, dictating who can authorize actions and how many approvals are necessary. For instance, a business might require three out of five authorized signatories to approve a contract upgrade. Signatories can approve requests using passkeys, and the threshold cluster then generates the required signature.

      This method aims to prevent any single individual or device from unilaterally executing a smart contract’s administrative functions, which is crucial when attackers increasingly target key holders through impersonation and social engineering tactics rather than the code itself.

      Before activation, AERSeal identifies the contract's privileged functions and ensures control over them transitions to the threshold key, subsequently verifying this transfer on-chain. There’s no need for the existing smart contract to be moved or redeployed. AERSeal currently caters to contracts running on Ethereum Virtual Machine networks and other EVM-compatible blockchains.

      Verifying the Key Independently

      According to AEREDIUM, customers are able to independently verify the threshold key assigned to their contract without relying solely on the company's assertions. The verification process employs address derivation and a signed fresh challenge to confirm both the derivation and ownership of the key, and this can also be completed offline.

      The onboarding process consists of six steps: verifying identity or business, registering the contract, validating the cryptographic key, transferring administrative permissions, confirming on-chain, and activating the selected approval policy.

      “AERSeal is the first complete product to implement AERKey from start to finish,” stated Albert Dadon, founder and CEO of AEREDIUM. “The aim is to eliminate the notion that control over an entire smart contract should rely on a single private key,” he added.

      Limitations of AERSeal

      It’s important to note that AERSeal does not eliminate vulnerabilities present in a smart contract’s foundational code; its focus is more specific. It lessens the security and operational risks that arise when privileged contract functions are dependent on a single private key.

      This product is part of AEREDIUM’s AER360 product suite and is provided by Aeredium Network LLC.