AEREDIUM launches AERSeal to end single-key control of smart contracts

AEREDIUM has launched AERSeal, a security product for smart contracts. It exists to stop a single compromised private key from handing an attacker control of a contract.

Smart contracts often rely on one private key to authorise sensitive operations. Those include minting assets, upgrading the contract, or changing administrative settings. If someone steals that key , they may be able to take control . If the key goes missing, the organisation could permanently lose access to those functions.

AERSeal replaces this single point of failure with a threshold signing system. It runs on AERKey, AEREDIUM’s key infrastructure .

Rather than storing a complete private key in one location, the system divides control across multiple key shares. Each share sits in a separate hardware-attested enclave. The system never reconstructs the full key. Instead, the shares collectively produce signatures using the CGGMP24 threshold signing protocol.

Organisations using AERSeal can set an M-of-N approval policy. The policy determines who may authorise an action and how many approvals it requires.

For example, a company could require three out of five authorised signatories to approve a contract upgrade. Signatories approve requests using passkeys . The threshold cluster then generates the necessary signature.

The approach aims to prevent any single person or device from independently exercising a smart contract’s administrative powers. That matters at a time when attackers increasingly target the people holding keys, through impersonation and social engineering , rather than the code itself.

Before the system activates, AERSeal identifies the contract’s privileged functions. It requires control over them to move to the threshold key. It then verifies onchain that the transfer is complete.

The existing smart contract does not need to move or redeploy. AERSeal currently supports contracts on Ethereum Virtual Machine networks and other EVM-compatible blockchains.

AEREDIUM says customers can independently verify the threshold key assigned to their contract. They do not have to rely solely on the company’s confirmation.

The verification process uses address derivation and a signed fresh challenge. Together, these demonstrate both the derivation and possession of the key. Customers can also complete this process offline.

Onboarding has six steps. It covers identity or business verification, contract registration, and cryptographic key verification. It then moves to the transfer of administrative permissions, onchain confirmation, and activation of the customer’s chosen approval policy.

“AERSeal is the first complete product to put AERKey into operation from end to end,” said Albert Dadon, founder and CEO of AEREDIUM, in a statement. “The goal is to remove the idea that control over an entire smart contract should depend on one private key,” he added.

AERSeal does not remove vulnerabilities from a smart contract’s underlying code. Its focus is narrower. It reduces the security and operational risks that arise when privileged contract functions sit behind a single private key.

The product belongs to AEREDIUM’s AER360 product family. Aeredium Network LLC provides it.

Contributed article. Not produced by the TNW newsroom and does not reflect the editorial stance of TNW.