Professionals: auditors, oracles and advisers
A smart-contract auditor who certifies code as free of critical vulnerabilities, and whose report is published to attract users, is in the position of any professional who makes a statement knowing that a class of persons will rely on it. Singapore applies the Hedley Byrne principle through the Spandeck framework and asks whether the auditor assumed responsibility to the claimant and whether the claimant's reliance was reasonable.1 Audit reports invariably contain disclaimers stating that they are provided to the protocol alone, that they do not guarantee the absence of bugs and that no third party may rely on them. Such disclaimers are effective to negate assumption of responsibility to users unless the auditor's conduct contradicts them, for example by allowing its name and badge to be displayed on the protocol's interface as a mark of safety. Oracle providers who feed prices into lending protocols face the same analysis, with the added difficulty that a manipulated price may have been caused by a third party's market activity and the oracle merely reported it.
Notes
- Hedley Byrne & Co Ltd v Heller & Partners Ltd [1964] AC 465 (HL), applied in Singapore through Spandeck [2007] SGCA 37 at [81]–[83]. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.