EVM & Solidity
Ethereum mainnet, every L2 and every EVM fork. Solidity and Vyper, proxy and upgrade patterns, storage collisions, gas griefing and the EVM's sharp edges. This is where most of our hours go.
Request an EVM auditAUDIT SERVICES
A protocol is contracts, circuits, nodes, bridges, infrastructure, ZK systems, websites, keys and the services that keep your ecosystem secure. Here is the full map of what we audit.
01 · CHAINS & ECOSYSTEMS
Different virtual machines fail in different ways. Every ecosystem below is covered by auditors who work in it daily, not visitors from another stack.
Ethereum mainnet, every L2 and every EVM fork. Solidity and Vyper, proxy and upgrade patterns, storage collisions, gas griefing and the EVM's sharp edges. This is where most of our hours go.
Request an EVM auditRust programs, with or without Anchor. Account validation, CPI attack paths, PDA misuse, missing signer checks and the concurrency problems the framework will not catch for you.
Request a Solana auditMove on both Aptos and Sui: object ownership, capability patterns, resource safety and the class of bugs that only exists in Move's model, plus the ones ported over from everywhere else.
Request a Move auditCosmos SDK chains, custom modules and IBC. State machine invariants, consensus parameters and the cross-chain message paths where critical bugs like to hide.
Request a Cosmos auditFull-chain engagements: consensus, p2p networking, mempool behavior, sequencer logic, fraud and validity proofs, and the bridge that connects your rollup to its settlement layer.
Scope a chain reviewAMMs, lending markets, perps, vaults, oracles and liquidation engines. We model the economics as carefully as the code, because most DeFi exploits are math before they are code.
Request a DeFi audit02 · SPECIALIST DOMAINS
Some systems can't be reviewed by generalists. These engagements go to auditors who build in these fields themselves.
Circom, Halo2, Noir, Plonky and custom proving systems. Under-constrained circuits, soundness gaps, trusted-setup assumptions and prover-verifier mismatches.
Review my circuitsSignature schemes, key exchange, MPC, threshold signing and custom protocol designs. We review the design on paper first, then the implementation against it.
Review my protocolSGX, TrustZone and Nitro-based designs. Attestation flows, sealing, side-channel exposure and an honest answer to what happens when the enclave's promises fail.
Review my enclaveWhere it pays off we go past manual review: invariant specs, custom fuzzing harnesses, static analysis and formal proofs for the properties you can't afford to lose.
Harden my invariants03 · PRODUCT & OPERATIONS
Chain-level security means little if the website serving it, the node running it, or the person deploying it gets owned first.
Dapp frontends, APIs, wallet integrations, cloud configuration and everything Web2 about your Web3 product. Also available as a standalone service for regular web and mobile apps.
Test my applicationNode software, validators, RPC endpoints, indexers, relayers and p2p layers. This machinery rarely gets audited, and it usually should be.
Audit my infrastructureKey ceremonies, multisig and signer policies, deployment pipelines, admin access and incident playbooks. Most protocol disasters start with operations, not code.
Review my opsecHOW TO ENGAGE
A fixed team, a fixed scope, a fixed price. Report to your inbox; public report after your fixes are verified.
Hundreds of researchers compete on your code for a prize pool. You pay for valid findings, not for time.
A standing program on our platform, public or private, with our engineers triaging every report before it reaches you.
Describe your stack in a few lines. Within 24 hours we'll tell you what we'd audit first, what can wait, and what it costs.