Deployment verification
The audited code and the live code are not always the same code.
What it is
An audit signs off a commit. What goes live is a build of that commit, deployed with constructor arguments, initialised in a particular order, wired to particular addresses, and handed to particular role holders. Any of those can differ from what was reviewed, by accident or otherwise.
Deployment verification closes that gap: we compare the deployed bytecode, configuration and permissions against the audited artefact and tell you, in writing, whether the thing holding user funds is the thing we approved.
What we examine
- Deployed bytecode compared against a reproducible build of the audited commit.
- Constructor arguments and initialisation order checked against the intended values.
- Proxy wiring verified: implementation address, admin, and who can change either.
- Role holders enumerated on chain and matched to the people they are supposed to be.
- External addresses confirmed: oracles, routers, treasuries, fee recipients.
- Pause, timelock and upgrade paths tested live rather than assumed from the source.
- Chain and network confirmed, because the right contract on the wrong chain is still wrong.
What you get
A match-or-mismatch statement per item, with the on-chain evidence for each.
Anything that differs from the audited artefact, flagged with what it changes.
A short verification note you can publish alongside the audit report.
How the engagement runs
- 01
Collect
The audited commit, the build recipe and the deployed addresses. Fixed quote.
- 02
Rebuild
We reproduce the build ourselves rather than trusting an artefact handed to us.
- 03
Compare
Bytecode, configuration, permissions and wiring, item by item against the chain.
- 04
State
A written verdict, including anything that differs and what it means.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
We were already audited. Why is this separate?
Because the audit ends at the commit. Between that commit and mainnet there is a build, a deployment script, a set of constructor arguments and a handover of keys, none of which the audit observed. Real incidents live in that gap.
How long does it take?
Usually a day or two. It is one of the cheapest checks available and one of the few that can be done after everything else is finished.
What if the build is not reproducible?
Then that is the first finding. A build you cannot reproduce is a build nobody can verify, including you, and we will say so plainly before going further.
Can you verify a deployment you did not audit?
Yes, against whatever report and commit exist. We will state clearly which parts we could confirm and which we could not.
Often bought with
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Monitoring and incident retainer
Continuous on-chain monitoring with automated response, and a team on call when something moves.
Formal verification
Mathematical proof that a critical property holds for every reachable state, not just the tested ones.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote