Penetration testing
The contract is not the whole product. We attack everything around it.
What it is
Most Web3 losses do not start in the contract. They start in an admin panel with a weak session, a leaked deploy key, an API that trusts the client, or a cloud role with more permission than anyone remembered granting.
A penetration test is an authorised, scoped attack on that surface: the front end, the APIs, the cloud account, the CI pipeline and the machines holding keys. We go as far as a real intruder would, then write down exactly how we got there.
What we examine
- Web and mobile application testing: authentication, session handling, business logic abuse.
- API testing: authorisation gaps, rate limits, injection, data exposure.
- Cloud and infrastructure review: IAM roles, storage exposure, network boundaries, secrets handling.
- CI/CD pipeline review: who can ship code, and what stops them shipping something malicious.
- Key management and signer infrastructure: where private keys live and who can reach them.
- Social engineering and phishing simulation, when the scope allows it.
- Full attack-path narrative: not a list of ports, but how one weakness chains into the next.
What you get
An attack narrative that walks the path from first foothold to worst outcome.
Severity-ranked findings with reproduction steps, evidence and remediation.
An executive summary that states plainly what an attacker could have done.
A retest of your fixes once remediation is complete.
How the engagement runs
- 01
Scope
Targets, rules of engagement and authorisation agreed in writing, plus a fixed quote.
- 02
Recon
We map what you actually expose, which is usually more than the diagram shows.
- 03
Exploit
Controlled exploitation of what we find, chaining weaknesses the way an intruder would.
- 04
Report
Attack paths, evidence and fixes, followed by a retest once you have closed them.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
How is this different from a smart contract audit?
An audit reads code that runs on chain. A penetration test attacks everything else: the app, the APIs, the cloud, the pipeline, the key infrastructure. Teams that buy only the audit are protecting a fraction of the attack surface.
Will it take our production systems down?
No. Destructive testing is out of scope unless you ask for it in writing and we agree a window. Everything else is designed to prove access without disrupting service.
Do you need production access?
Usually a staging environment that mirrors production is enough. Where a finding only exists in production, we agree that separately, in writing, with a named contact on your side.
What authorisation do you need?
Written confirmation that you own or are entitled to have the targets tested, including anything hosted by a third party. We do not start without it.
Often bought with
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Monitoring and incident retainer
Continuous on-chain monitoring with automated response, and a team on call when something moves.
Build, harden and maintain
Engineering that implements the security work rather than recommending it.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote