--- title: "Get Ready for the Updated Security Model of the Hedera Smart Contract Service by July 2023" id: "15750" type: "post" slug: "get-ready-for-the-updated-security-model-of-the-hedera-smart-contract-service-by-july-2023" published_at: "2023-05-05T05:00:00+00:00" modified_at: "2025-12-08T18:26:36+00:00" url: "https://hedera.com/blog/get-ready-for-the-updated-security-model-of-the-hedera-smart-contract-service-by-july-2023/" markdown_url: "https://hedera.com/blog/get-ready-for-the-updated-security-model-of-the-hedera-smart-contract-service-by-july-2023.md" excerpt: "The security model of the Hedera Smart Contract Service has been updated with the mainnet services release v0.35.2 (March 2023). The updated model aligns the behaviors of the Hedera Smart Contract Service token system contracts with those of EVM and..." taxonomy_category: - "Uncategorized" taxonomy_post_tag: - "technical" --- [Skip to content](#content) blog # Get Ready for the Updated Security Model of the Hedera Smart Contract Service by July 2023 May 5, 2023 ![Ed Marquez](https://hedera.com//wp-content/uploads/2025/12/Headshot.jpeg) Ed Marquez Head of Developer Relations #### **What is the change?** After the security incident of March 2023, core Hedera engineers conducted a thorough analysis of the Smart Contract Service and the Hedera Token Service system contracts. No new vulnerabilities were found, but the team looked for any behavioral differences between Hedera Token Service system contract APIs and those of Ethereum Virtual Machine (EVM) or ERC token APIs that could be used maliciously. **To eliminate any possibility of such differences being used as attack vectors in the future, the consensus node software will align the behaviors of the Hedera Smart Contract Service and HTS system contracts with those of EVM and typical token APIs such as ERC 20 and ERC 721**. #### **As a developer on Hedera, what should I do?** Developers are strongly encouraged to test their applications with new contracts and UX using the new security model to avoid unintended consequences. - The new security model has been applied to contracts created from the mainnet [0.35.2](https://docs.hedera.com/hedera/networks/release-notes/services#security-updates-hedera-smart-contract-service-security-model-changes) release onwards. - **Existing contracts deployed prior to this upgrade will continue to use the previous security model for a limited time to allow for application/UX modifications.** - The previous security model will only be maintained for an approximate period of 3 months. **The current target is for the network to remove the previous security model and for all contracts to follow the new security model by the mainnet release of July 2023**. - See more information in the official [Hedera documentation](https://docs.hedera.com/hedera/networks/release-notes/services#security-updates-hedera-smart-contract-service-security-model-changes) . #### **What does the change in security model mean for smart contract developers?** The security update involves changes to entity permissions during contract executions when modifying state. In short, system contract calls (smart contract calls to the Hedera Token Service) are no longer executed with all upper caller privileges even if the authorized user provides a signature. #### After ![Image](https://hedera.com/wp-content/uploads/2025/12/1-After_2023-05-05-151305_hceq-scaled.jpg) #### Before ![Image](https://hedera.com/wp-content/uploads/2025/12/2-Before_2023-05-05-151335_irya-scaled.jpg) #### **Impact on Functionality** Below are some of the key functions impacted with the model update: - Externally owned accounts (EOAs) and contracts must now provide explicit **approval/allowance** to a contract for the approved entity to be able to **transfer** value from that account balance. - For functionality specific to HTS tokens (e.g. Pause, Freeze, or Grant KYC), a contract is authorized to perform the associated token management function only if the `ContractId` is listed as a key on the token (e.g. Pause Key, Freeze Key, or KYC Key respectively). This applies for all key structures (key list, key thresholds, etc.). Keep in mind that a contract will not be able to perform HTS management functions if the contract is not listed as a key for the token. - Users can no longer **associate** their account to HTS tokens using a smart contract. Token associations can be performed using the Hedera SDKs (also see [HIP-719](https://hips.hedera.com/hip/hip-719) for an incoming alternative via ERC interface). - While users can continue to **create HTS tokens** through smart contracts, only the smart contract used to create the token can be specified as the treasury account and/or auto-renew account (when enabled) for the token. A contract cannot specify another account for those fields. Note that a contract is still able to specify any public key as the manager of HTS functionality (e.g. Pause, Freeze, Grant KYC, etc.) - Additional information and guidance will continue to be provided in the following weeks. Note that testing your specific contracts is the best way to identify the actions you may need to take to align with the new security model of the Hedera Smart Contract Service. [Back to Blog](/blog) discover See more articles [View All](/blog) ![Image](https://hedera.com/wp-content/uploads/2026/08/Regulation_Blog-1024x576.png) August 5, 2026 ### Details decide. What digital asset policy did in July 2026 Halfway through 2026, the regulatory picture is coming into focus. Hedera Chief Policy Officer Nilmini Rubin and VP Global Policy Isadora Arredondo break down what moved in June across the [Read More](https://hedera.com/blog/details-decide-what-digital-asset-policy-did-in-july-2026/) ![Deploy Multichain Dapps](https://hedera.com/wp-content/uploads/2026/07/HH600301_DeployMultichainDapps_Final-1024x576.png) July 17, 2026 ### Deploy Multichain Dapps on Hedera in 60 Seconds with scaffold-hbar Deploying multichain dapps on Hedera has never been easier! With just one command, you can spin up a fully functional dapp using Next.js, Hardhat or Foundry, and AI agent context… [Read More](https://hedera.com/blog/deploy-multichain-dapps-on-hedera-in-60-seconds-with-scaffold-hbar/) ![Regulation is finding its form](https://hedera.com/wp-content/uploads/2026/07/Regulation_Blog-1-1024x576.png) July 13, 2026 ### Regulation is finding its form in summer 2026 Halfway through 2026, the regulatory picture is coming into focus. Hedera Chief Policy Officer Nilmini Rubin and VP Global Policy Isadora Arredondo break down what moved in June across the [Read More](https://hedera.com/blog/regulation-is-finding-its-form-in-summer-2026/) ## Ready to get started? Discover why Hedera is the trusted institutional-grade network powering the new digital economy. [Start Building](/start-building) [Contact](/contact) We use cookies to deliver the best experience on our website and to analyze traffic. By continuing to use this site, you consent to our cookie policy. Review our [Privacy Policy](/privacy) to understand how Hedera collects and uses information. Accept All CookiesAccept Necessary Cookies