MAINNETBETA

secondfi.io

5.9MODERATEhigh
6 sectionsrun #1
Findings7 critical13 high10 medium
DEPGOVTKNAUDCTR
Last analyzed 20d ago runs

Summary

SecondFi is EMURGO's Cardano self-custody wallet and neofinance platform (rebranded from Yoroi in April 2026), not an on-chain DeFi protocol with smart contract TVL. A June 2026 deterministic nonce flaw in proprietary web wallet signing software let attackers reconstruct private keys from public blockchain data, draining ~16M ADA (~$2.4M) from 374 addresses; independent estimates put total exposure above $20M. The platform remains in maintenance mode with no published security audit reports despite years of marketing claims. Overall risk is elevated (5.9/10), driven by dependency, audit, and governance gaps rather than smart contract exposure.

Trust Assumptions

Users must trust that EMURGO's wallet signing code generates cryptographically secure, unpredictable nonces; that EMURGO-operated backends (zero.yoroiwallet.com) serve accurate chain data; and that third-party integrations (DexHunter, Steelswap, Wirex card rails) behave honestly. Following the June 2026 incident, users of affected addresses must also trust EMURGO's undisclosed third-party custodian holding ~129M ADA in emergency rescue funds, the unnamed post-incident security auditor, and EMURGO leadership (CEO Phillip Pon) to manage claims and platform restoration without on-chain enforceability.

What Could Go Wrong

Affected wallet addresses remain permanently compromised at the key level—restoring a seed phrase to another wallet does not fix the flaw—so any remaining or future funds sent to those addresses can be drained. EMURGO could resume operations before independent audit findings are published, leaving unverified signing code in production. The undisclosed emergency custodian holding ~129M ADA rescue funds creates counterparty risk if custodian identity, controls, or claim governance fail, and centralized EMURGO backend or DEX aggregator compromise could mislead users into signing malicious transactions even after a patch.

Recommendation

Do not deposit new funds into SecondFi or any address previously used with its web wallet until a named auditor publishes a full post-mortem and verified fix for the nonce/key-generation path. Treat all addresses that signed transactions via the SecondFi web wallet as permanently burned; migrate only to freshly generated keys on a different wallet. Monitor for publication of the post-incident security review, custodian identity disclosure, and compensation timeline before reassessing. The absence of public audits, bug bounty, and on-chain governance makes this unsuitable for material capital allocation until transparency and independent verification improve.

Key Findings (30)

critical
Demonstrated Emergency Powers Override Self-Custody Narrativecentralization
critical
No On-Chain Contracts in Discoverydata-gap
critical
Deterministic Nonce Flaw in Proprietary Signersigning
critical
Undisclosed Third-Party Custodian for Emergency Rescuecustodian
critical
No Publicly Verifiable Audit Reports Despite Marketing Claimsaudit-gap
critical
June 2026 Exploit Proves Key-Generation Code Was Insufficiently Securedincident
critical
June 2026 Deterministic Nonce Wallet Exploitincident
high
Primary Risk Is Off-Chain Wallet Signing, Not Smart Contractsoff-chain
high
Corporate Control, Not Decentralized Protocol Governancecentralization
high
No Multisig, Timelock, or On-Chain Upgrade Governancecentralization
high
Key Person and Institutional Concentration at EMURGOkey_person_risk
high
Security Incident Impairs Token Access for Affected Usersoperational
high
Centralized EMURGO Backend Dependencyinfrastructure
high
Cardano Node and Indexer Stackinfrastructure
high
DEX Aggregator Dependencies for In-App Swapsprotocol
high
Post-Incident Audits In Progress but Unpublishedaudit-gap
high
No On-Chain Smart Contracts — Audit Scope Is Off-Chain Wallet Softwaredata-gap
high
SecondFi Rebrand Introduced New Unaudited Code Pathsaudit-gap
high
Emergency Response and Custodial Rescueresponse
high
No On-Chain Smart Contracts — Wallet Infrastructure Riskdata-gap
medium
No Public Smart Contract Audit Reportsaudit-coverage
medium
Cardano DRep Governance Is Network-Level, Not Product Governancegovernance_process
medium
Custodian and Recovery Governance Undisclosedtransparency
medium
NIGHT Airdrop Integration — Third-Party Token Exposurethird_party_token
medium
Cardano On-Chain Oracle Script Feeds (Not Chainlink)oracle
medium
Wirex Visa Card Issuer Dependencycounterparty
medium
EMURGO Cryptographic Library Stacksigning
medium
Hardcoded Third-Party API Credentials in Sourcesupply-chain
medium
Fiat On-Ramp Partners (Banxa, Encryptus)protocol
medium
No Immunefi or Public Bug Bounty Programbug-bounty

Analysis Sections

SecondFi is not a DeFi protocol with on-chain contract governance. It is a corporate EMURGO-operated Cardano wallet/neofinance platform with no discoverable smart contracts, multisigs, or timelocks to audit. Product control rests with EMURGO leadership (CEO Phillip Pon), not a DAO. Marketing emphasizes self-custody, but the June 2026 incident demonstrated centralized emergency powers: maintenance-mode shutdown and unilateral movement of ~129M ADA to an undisclosed third-party custodian. Cardano DRep participation (Yoroi brand) is separate Cardano network governance and does not govern SecondFi product decisions. On-chain EVM verification was not possible (no contracts; ALCHEMY_RPC_URL unset).

Findings (7)

criticalDemonstrated Emergency Powers Override Self-Custody Narrative

Marketing claims users 'hold the keys' and retain full control. During the June 2026 wallet-generation exploit, EMURGO/SecondFi engineering teams unilaterally placed the platform in maintenance mode (pausing all front-end transactions) and executed emergency rescue measures that moved ~129M ADA to an independent third-party custodian. Custodian identity, multisig structure, and user recourse mechanisms are not publicly disclosed. This contradicts pure self-custody assumptions and shows EMURGO retains operational authority over user fund flows in crisis scenarios.

SecondFi Security FAQemergency rescue measures were triggered to secure the available ~129M ADA... held securely by an independent, qualified third-party custodian for the benefit of affected wallet addresses
secondfi.ioYou hold the keys — not us, not anyone
highCorporate Control, Not Decentralized Protocol Governance

SecondFi is operated by EMURGO, the for-profit Cardano co-founding entity. Discovery classifies governanceType as 'corporate (EMURGO subsidiary)'. Product decisions, incident response, and platform availability are controlled by EMURGO leadership—not by on-chain voting, a DAO, or user governance. Cardano founder Charles Hoskinson publicly confirmed IOG has no ownership, control, or business relationship with SecondFi, isolating accountability to EMURGO alone.

discovery.json"governanceType": "corporate (EMURGO subsidiary)", "parentOrganization": "EMURGO"
CointelegraphHoskinson said SecondFi is not an Input Output Global product and stressed that there is no ownership, control, or business relationship between the wallet and IOG.
highNo Multisig, Timelock, or On-Chain Upgrade Governance

No protocol smart contracts, Gnosis Safe multisigs, timelocks, or on-chain governance contracts were identified. Wallet software updates are distributed via app stores and browser extension channels under EMURGO control. There is no community vote, proposal queue, or enforced delay on product changes. Open-source code exists at github.com/Emurgo/yoroi (Apache 2.0), but release authority and signing keys remain centralized.

discovery.json"githubUrl": "https://github.com/Emurgo/yoroi", "contracts": []
contract scancontracts/ directory absent; no onlyOwner, timelock, or multisig patterns found in local artifacts
highKey Person and Institutional Concentration at EMURGO

Incident communications are led by EMURGO CEO Phillip Pon. Platform restoration, audit engagement, and custodian arrangements are decided internally by EMURGO without disclosed governance committees, board oversight structures, or public vote mechanisms. Wirex partnership (Visa debit card issuer) adds a second centralized dependency for payment features. No Immunefi bug bounty or public governance forum was identified for SecondFi-specific product decisions.

SecondFi Security FAQMessage from Phillip Pon, CEO of EMURGO
discovery.json"immunefiBugBounty": false
mediumCardano DRep Governance Is Network-Level, Not Product Governance

EMURGO/Yoroi operates a registered Cardano DRep (drep1ytvlwvyjmzfyn56n0zz4f6lj94wxhmsl5zky6knnzrf4jygpyahug) enabling users to delegate ADA voting power for Cardano protocol governance actions. After the SecondFi rebrand, the Yoroi brand continues independently as a DRep. This is Cardano ledger governance participation—not governance over SecondFi wallet software, custodian decisions, or platform policy. Users cannot vote on SecondFi feature changes, incident response, or custodian selection via DRep delegation.

EMURGO press releasethe Yoroi brand will continue independently within the ecosystem as a DRep (Delegated Representative), supporting governance participation
EMURGO DRep registrationEMURGO's DRep ID: drep1ytvlwvyjmzfyn56n0zz4f6lj94wxhmsl5zky6knnzrf4jygpyahug
mediumCustodian and Recovery Governance Undisclosed

Following the exploit, ~129M ADA was routed to an unnamed 'independent, qualified third-party custodian.' An external accounting firm was engaged to verify holdings, but custodian identity, governance structure (multisig threshold, signers), withdrawal policy, and user claim process governance are not publicly documented as of the analysis date. Users must trust EMURGO's custodian selection and verification process without independent on-chain enforceability.

SecondFi Security FAQAn external accounting firm has been engaged to independently verify those holdings.
infoNo Smart Contracts Available for On-Chain Governance Audit

Discovery returned an empty contracts array and the contracts/ directory is absent. Standard DeFi governance checks (owner(), admin(), multisig threshold, timelock delay) cannot be performed. ALCHEMY_RPC_URL is not set; even if available, SecondFi operates on Cardano with off-chain wallet infrastructure rather than EVM protocol contracts.

discovery.json"contracts": []
environmentALCHEMY_RPC_URL=NOT_SET; contracts/ directory missing

Governance Checklist

On-chain protocol contracts identifiedEmpty contracts array; wallet platform not DeFi TVL protocol
Multisig (not EOA) on core contractsNo contracts to verify; not applicable to off-chain wallet infra
Timelock on upgrades/admin actions
On-chain DAO governance for product decisionsCorporate EMURGO control only
Cardano network DRep participation availableYoroi/EMURGO DRep for Cardano protocol votes—not SecondFi product governance
Emergency pause/rescue powers disclosedDemonstrated June 2026: maintenance mode + 129M ADA custodian transfer
Self-custody claims match operational realityMarketing claims contradicted by centralized emergency fund rescue

Control Entities

corporate_operatorEMURGO
drepcardanoYoroi / EMURGO DRep
custodiancardanoUndisclosed third-party custodian
partnerWirex

Governance Assessment Metrics

Smart contracts audited for admin controls
0contracts
On-chain governance type
None (corporate)
RPC verification performed
Skipped
Platform status
Maintenance mode
Loading dependency graph…