Softstack clears Edel Finance’s futures backend security review

Softstack completed an independent penetration test of Edel Finance’s perpetual futures infrastructure and found 27 security issues, including two high-severity vulnerabilities that were remediated. The review covered APIs, authentication, trading workflows and AI-agent integrations, with no open findings left at the end of the engagement.

Why it matters: - Edel Finance is building programmable trading infrastructure for tokenized equities, so weaknesses in trading APIs, authentication or settlement systems could affect market access and operational resilience. - The assessment focused on a development environment, but it tested the controls that sit behind automated trading and AI-agent integrations. - Independent testing helps financial infrastructure teams find and fix issues before they reach production.

What happened: - softstack completed an owner-authorized, grey-box penetration test of Edel Finance’s perpetual futures backend infrastructure between Oct. 8 and Oct. 13, 2026. - softstack then conducted a remediation re-test on Oct. 17, 2026. - The review covered API services, authentication and authorization controls, trading operations, AI-agent integrations, and supporting infrastructure. - The assessment also examined REST APIs, WebSocket services, Model Context Protocol interfaces, withdrawal workflows, cloud security, network exposure, and software-supply-chain controls.

The details: - The engagement identified 27 findings: 2 high severity, 5 medium, 17 low and 3 informational. - softstack and the Edel Finance engineering team remediated 25 findings and independently verified the fixes. - The remaining two low-severity findings were formally accepted as residual risk. - The final status left 0 open findings at the conclusion of the engagement. - The assessment used manual security testing, source-code-assisted analysis, infrastructure inspection and automated security tools. - Across eight testing phases, softstack performed 36 distinct security tests and examined 83 API endpoints. - The assessment confirmed that critical trading authorization controls and the tested financial transaction flows operated correctly in the development environment. - The two high-severity findings involved vulnerable software dependencies and an AI-agent-related prompt-injection risk within the Model Context Protocol integration. - Edel Finance’s engineering team merged 23 remediation pull requests during the engagement. - The final re-test confirmed 25 findings fixed and verified, 2 findings formally accepted as residual risk, and 0 remaining open findings. - Both high-severity findings were successfully remediated.

Between the lines: - The biggest issue was not a failure of core trading logic, but the broader attack surface around modern financial infrastructure, including APIs, cloud configuration and AI-agent tooling. - The result suggests the project team treated security as a development-cycle task rather than a one-time audit. - The focus on a grey-box test means the assessment balanced realistic attacker conditions with access to internal context.

What’s next: - Edel Finance can use the verified fixes and residual-risk decisions as a baseline for future hardening work. - softstack’s findings point to the need for continued testing as the trading stack, integrations and AI features evolve. - The companies presented the engagement as evidence that independent security reviews can be folded into ongoing product development rather than added after launch.

The bottom line: - Edel Finance’s futures infrastructure finished the review with no open findings, including closure of both high-severity issues.