Partnership and integration analysis
Independent review of their product before you connect it to yours.
What it is
An integration is a permission. The moment your contracts trust theirs, their bugs, their admin keys and their compliance position become risks to your users.
We review the partner's product as an attacker would, then map precisely what their system can do to yours once connected, and what it would cost you if they were compromised tomorrow.
What we examine
- Security review of the partner's contracts and infrastructure.
- Integration surface mapped: exactly what their contracts can do to yours.
- Shared-custody and permission analysis before any approval is signed.
- Compliance and licensing verification for your operating markets.
- Business continuity and dependency analysis.
- Go or no-go in writing, plus monitoring options once you connect.
What you get
A go or no-go recommendation in writing, with the conditions that would change it.
The integration risk map: every permission you grant and what it enables.
Contingency guidance: what you do on the day they are compromised.
Monitoring rules specific to this dependency, ready to deploy.
How the engagement runs
- 01
Scope
The integration, the permissions involved and what you stand to lose. Fixed quote.
- 02
Review
Their contracts and infrastructure assessed independently of their own audit.
- 03
Map
Every permission the integration grants, traced to what it would allow.
- 04
Decide
Go, no-go or conditions, in writing, with monitoring you can turn on afterwards.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
They already have an audit. Why commission this?
Their audit answers their question: is our code sound. Yours is different: what can their code do to us. A clean report on their side says nothing about the permissions you are about to grant.
Can you review a partner who will not share code?
Yes, from deployed bytecode, on-chain behaviour and public documentation. It is a weaker review and we will say so in the report rather than implying coverage we did not have.
What if we have already integrated?
Then we assess the live exposure and prioritise what to unwind or guard first. Late is better than never, and the monitoring matters more in that case.
Often bought with
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Investor due diligence
Independent technical and regulatory review of a product before your capital moves.
Monitoring and incident retainer
Continuous on-chain monitoring with automated response, and a team on call when something moves.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote