OpenZeppelin secures CACEIS Bank euro stablecoin EURXT, ahead of issuance under MiCA

Crédit Agricole CACEIS is a European asset servicing group providing custody, fund administration, and related services to institutional investors. CACEIS Bank is authorized by the French ACPR under MiCA for crypto-asset services and is issuing EURXT, the Euro eXchange Token, a euro stablecoin designed as an electronic money token under the MiCA framework.

Each token represents one euro of issuer liability, redeemable at par. The issuer's regulatory obligations, including freeze, seizure, permissioned issuance, and a controlled redemption path, are enforced directly in the contract that holds and moves the asset. OpenZeppelin secured EURXT ahead of issuance, reviewing the contract together with the governance and operating framework behind it.

The Challenge

Issuing a regulated euro stablecoin is a different security problem from launching a permissionless one. An electronic money token under MiCA is a liability of the issuer, subject to supervisory obligations that have to be enforceable onchain. Three pressures defined the kind of security provider CACEIS Bank needed:

• Regulatory obligations had to hold at the contract level: freeze and seizure, permissioned issuance, a controlled redemption path, and strictly separated administrative powers are required capabilities for a MiCA electronic money token. A failure in any of them is a regulatory problem as well as a technical one.
• Every compliance control is also an attack surface: a blacklist, a regulatory seizure path, an emergency pause, gas-sponsored transactions relayed through the custody platform, and six privileged roles all interact with one another. Securing the system requires assessing how these controls affect each other, in addition to verifying each control individually.
• Pre-launch, with no room to patch after issuance: the security review had to happen before the first token existed, on a timeline set by an issuance date. At this stage, architectural recommendations can still be adopted freely, without backwards-compatibility constraints.

CACEIS Bank needed a security provider with expertise in both regulated-instrument design and smart contract security, the ability to review the onchain code against the off-chain procedure that governs it, and the capacity to deliver inside a launch window.

OpenZeppelin’s Solution

A Full Security Review of the EURXT Contracts

OpenZeppelin secured the production-intended contracts: the EURXT token together with its supporting libraries, with the exact reviewed code recorded in the report so there is no ambiguity about what was covered. Everything outside that boundary was explicitly documented as out of scope.

The review assessed the full surface of a regulated issuance system:

• Issuance and redemption designed around a controlled, single-destination redemption path
• Compliance controls including a blacklist enforced on every transfer path and a paired regulatory seizure flow
• Six roles gating every privileged operation
• The standard token interface with signature-based approvals and gas-sponsored transactions relayed through the Taurus custody platform
• An emergency pause able to halt all token movement.

Within 48 hours of completing the review, OpenZeppelin delivered the initial report, with the final report following within ten days.

Security Coverage Across the Code and the Operating Procedure

Alongside the code, OpenZeppelin worked from CACEIS' business specification, technical reference, governance policy, and operations manual, mapping each onchain role to the off-chain custody group responsible for signing for it.

This made it possible to assess whether the deployed system behaves as the regulated design intends: minting only follows received fiat, burns only follow confirmed payouts, and seizures reach only compliant destinations.

A Documented Security Model for Every Privileged Role

The engagement produced a written security model covering all six privileged roles: what each actor is trusted to do, and which of those expectations the contract does not enforce onchain.

Each assumption becomes a concrete requirement for CACEIS' deployment runbooks and continuous monitoring, so any drift from the modeled behavior is detected early. For a supervised institution, that documentation carries directly into the evidence base for ongoing regulatory conversations.

The Results

No Critical, High, or Medium Severity Issues

The security review identified no critical, high, or medium severity issues. It also identified no defect that would allow unauthorized minting, unauthorized burning, theft of holder balances, or evasion of the pause, blacklist, or role-based access control model.

For a regulated instrument that carries issuer liability, this is the result the business, its counterparties, and its supervisor need to see.

18 Findings & Recommendations Delivered, All Incorporated Before Issuance

Beyond the clean severity result, OpenZeppelin delivered 18 findings and recommendations spanning key management, deployment ordering, the redemption flow, incident response, and long-term upgrade safety. Because the review happened pre-launch, every one could still be acted on freely.

CACEIS Bank acknowledged the three low severity findings and decided to include the fixes in the next version of the smart contract, the version taken to launch.

A Security Model CACEIS Bank Can Operate Against

CACEIS Bank came away with a documented security model: what each privileged role is trusted to do, which expectations the contract does not enforce onchain, and where the boundary sits between the onchain system and the custody and settlement infrastructure around it.

Backed by thorough internal documentation covering the full deployment and operating procedure, that model carries directly into runbooks, monitoring, and supervisory evidence. It gives CACEIS Bank the security foundation to issue and operate a regulated euro stablecoin.