Least Authority

Most of the work of Least Authority concerns code where a mathematical error breaks the security of the whole system: implementations of zero-knowledge proofs, secure multi-party computation and consensus protocols. The team audits projects in Rust, Go, Python, C and C++, Solidity, Cairo, Circom, Noir, Haskell, OCaml and other languages.

World, the project behind the World ID, had Least Authority audit its cryptography and its uniqueness check, which runs on secure multi-party computation. Least Authority uses AI tools to speed up parts of an audit, and its researchers review and validate every output before a finding goes into the report.

A Least Authority audit starts with a call about the security needs of the project, followed by a proposal with timeline and budget. The researchers then review the code together with the development team, which can preview findings while the work is still running.

Once the team has addressed the issues, Least Authority verifies the changes and delivers the final report, and publication stays optional for the client. Like every smart contract audit, such a report covers one code version, so later upgrades need a review of their own.

In 2015 Least Authority wrote a security report for Ethereum that identified the issues behind the later DAO hack. The privacy coin Zcash also started inside Least Authority Enterprises and was spun out into the Electric Coin Company, a former sibling company of the Berlin firm.

Since March 2024 Least Authority has been the Zcash Ecosystem Security Lead, funded by the Zcash Community Grants program. In that role it has audited the NU6 network upgrades of the Zebra and Zcashd node software and the Lightwalletd infrastructure, and it advises Zcash projects on incident response.

Least Authority TFA GmbH has its seat in the Berlin postal district 10243, with a subsidiary in the United States, Least Authority USA Inc., and one in Singapore. The team works largely remotely, and the Berlin office has hosted meetups of the blockchain scene in Berlin, among them the Berlin event of ZconV, the Zcash conference.

Least Authority is a member of Bundesblock, the German blockchain association, and works with the security research community of Bugcrowd. Before it opened the Singapore subsidiary, the firm went through the Southeast Asia market access program of German Accelerator.

The company name comes from the principle of least authority, also known in information security as the principle of least privilege. Under this rule, every component of a system receives only the rights it needs for its own task and no more, so a compromised part cannot take over the rest.

The same idea guides the products of Least Authority, which builds privacy-preserving software on open source, such as the encrypted storage service PrivateStorage. The firm releases its own code as open source and supports non-profit and human rights organizations with secure tools.