Build, harden and maintain
Past the report: we implement the fixes, take the product over, or build it from scratch.
What it is
Reports do not fix anything. Plenty of teams finish an audit with a list of findings and nobody with the time or the specific expertise to close them properly.
We do that work: implement the fixes, harden a live product, take over a codebase someone abandoned, or build the thing from scratch with review built into the process instead of bolted on at the end.
What we examine
- Security features implemented, not just recommended: timelocks, pause paths, rate limits, monitoring.
- Harden a live product: proxy patterns, access control, key management, incident playbooks.
- Take over an inherited or abandoned codebase and bring it to a shippable state.
- Build a new Web3 product from scratch, reviewed as it is written.
- Anything we build is audited by a separate team. Nobody signs off on their own code.
- Post-launch monitoring and incident response retainers.
What you get
Working code, reviewed and tested, not a document describing code.
An independent audit of what we built, performed by auditors who did not write it.
Documentation and playbooks your own team can operate without us.
A handover that assumes we will not be here forever.
How the engagement runs
- 01
Assess
What exists, what it is worth keeping, and what has to be rebuilt. Fixed quote before work starts.
- 02
Build
Implementation in the open, with review as it is written rather than at the end.
- 03
Audit
A separate team reviews the result. Nobody signs off on their own code.
- 04
Hand over
Documentation, playbooks and a team that can run it without us.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
Is it a conflict of interest to build and audit?
It would be if the same people did both, so they do not. Anything we build is reviewed by a separate team, and we will say so in writing. If you would rather a third party audit it entirely, we support that and will hand over whatever they need.
Can you take over a codebase from a team that left?
Yes, and it is a common request. We start with an assessment of what is salvageable, because sometimes the honest answer is that a rewrite is cheaper than the archaeology.
Do you work with our existing engineers?
Usually, and it is the better outcome: your team keeps the knowledge. We can also run the work end to end when there is no team left to keep.
Often bought with
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Monitoring and incident retainer
Continuous on-chain monitoring with automated response, and a team on call when something moves.
Penetration testing
Web, mobile, API, cloud and key infrastructure tested the way a real intruder would.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote