Centrifuge has formally verified 1,589 properties of its core components using the Certora Prover. That is a lot of math pointed at one codebase.
For a protocol that handles onchain asset management and real-world asset infrastructure, the work goes to the core of what it sells. Moving funds is easy. Proving the code does exactly what it promises, every time, is the hard part.
What Centrifuge actually verified
The verification documentation is dated October 2026. Independent researcher Alex Zoid carried out the work.
Alongside the 1,589 verified properties, the effort included an analysis of 1,445 mutants. That second number deserves a moment of attention, because it is where the real stress test happens.
Formally, mutants are deliberately altered versions of the code, and a good set of rules should catch them. If someone sneaks a flaw into the code and the verification rules shrug, the rules are not doing their job. Running 1,445 mutants is a way of testing whether the 1,589 properties have real teeth.
The verified properties target the protocol’s core logic, which operates across multiple chains. That logic supports fund distribution, portfolio management and the enforcement of investment mandates.
How this fits into Centrifuge’s V3 roadmap
The verification is one piece of a multi-layered security strategy tied to Centrifuge’s V3 series, which spans 2026. Each release in that series took on a different job.
V3.1 focused on scalable multichain distribution. V3.2 tackled multi-asset portfolio management, and V3.3 centered on enforceable investment mandates.
Those three themes map neatly onto what the verified properties cover. In other words, the math was aimed at the features the protocol has been building all year, rather than at some dusty corner of the codebase.
Formal verification also does not replace Centrifuge’s existing defenses. The protocol has previously undergone audits by BurraSec, Sherlock and yAudit. It also runs ongoing security reviews and a bug bounty program.
The Certora Prover was open-sourced in February 2025, which widened access to a class of tooling that had been more gated.
What this means for Centrifuge and the RWA sector
Real-world asset protocols sit at an awkward intersection. They need to convince traditional finance players that onchain systems can meet their standards, while operating in an environment where a single bug can drain a contract in minutes.
There are limits worth keeping in mind. Formal verification proves that code satisfies the properties someone wrote down, so the quality of the outcome depends on whether the right properties were chosen. It also covers the components in scope, not every integration, oracle or offchain process that a real-world asset system relies on. That is precisely why Centrifuge still leans on audits, reviews and a bug bounty alongside the proofs.
Centrifuge has not paired the verification with any token-specific announcement. The work stands as a security milestone rather than a commercial one.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.