Web3 and protocol audit
We attack your code so attackers can't. Ship with proof it held.
What it is
A security audit is a time-boxed expert review of a defined scope at a defined commit. Senior auditors read the code the way an attacker would: who can call what, under which conditions, and how value moves when they do.
It runs in three layers. Automated analysis sweeps for known patterns, manual review finds the logic and access-control flaws tools cannot see, and dynamic testing stresses the contract with fuzzing and invariant checks until something breaks.
What we examine
- Line-by-line smart contract review: Solidity, Vyper, Rust, Move and Cairo.
- Every chain you deploy on: EVM, Solana, Aptos, Sui, Cosmos and the rest.
- Upgrade paths under the microscope: proxies, storage layout, initialisers.
- Blockchain layer audits: consensus parameters, validator sets, staking and slashing, node and RPC configuration.
- Rollup and bridge systems: proof verification, message passing, sequencer and relayer powers.
- Access control, admin keys, timelocks and pause powers mapped to real people.
- Token standards and integrations: ERC-20, ERC-721, ERC-4626, bridges, oracles.
- Adversarial simulation: reentrancy, MEV, oracle manipulation, governance capture.
- Gas and performance optimisation notes in every report.
- Severity-ranked findings with proof of concept, then a free re-audit of your fixes.
What you get
A severity-ranked report: what breaks, how, and the fix, written so your engineers can work from it directly.
A proof of concept for every high and critical finding, so nobody argues about whether it is real.
Plain-language summaries alongside the technical detail, for the people signing off who do not read Solidity.
A re-audit of your fixes at no extra cost, and a final report that records what was resolved.
A report you can hand to an exchange, a partner or an investor without editing it first.
Technical audit report
Line-by-line code findings with severity, proof and fixes.
Read the sampleHow the engagement runs
- 01
Scope
Walkthrough, threat model and a fixed quote, before any review starts.
- 02
Review
Manual review by senior auditors, with automated analysis and fuzzing underneath it. Findings shared as we go.
- 03
Report
Severity-ranked findings, each with proof of concept, impact and a concrete fix.
- 04
Verify
You fix, we re-review, and the final report records what was resolved.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
How long does an audit take?
Most engagements run one to three weeks. Scope drives it: contract count, lines of code, how novel the design is, and whether the tests and documentation already exist. You get a fixed timeline with the quote, not an estimate that moves.
What does it cost?
Priced per engagement after scoping, never per hour, so the number in the quote is the number you pay. We quote within 48 hours of seeing the scope.
What do you need from us to start?
A frozen commit, the repository, whatever architecture notes exist, and one engineer we can ask questions. Tests and documentation make the review faster and cheaper; their absence does not stop it.
What happens when you find something critical?
You hear about it the day we find it, not in the final report. Critical findings are raised immediately so you can start fixing while the rest of the review continues.
Does a clean report mean the code is safe?
No, and any firm that says otherwise is selling you something. An audit covers a defined scope at a defined commit. It raises the cost of attacking you considerably; it cannot prove the absence of every flaw, and code changed after the review is outside it.
Do you re-audit after we fix things?
Yes, included. Submit your fixes and we verify each one, confirm nothing new was introduced, and update the final report.
Specialist reviews
Same engagement, scoped to the system you actually have. Each one is covered by the audit above; these pages go into the specifics.
Wallet and custody audit
Multisig, smart accounts, key management and the signing path, reviewed end to end.
Cross-chain bridge audit
Message passing, proof verification and validator assumptions, on both sides of the bridge.
L1 and L2 infrastructure audit
Consensus, client code, validator economics, sequencers and proof systems.
ZK and cryptography audit
Zero-knowledge circuits, proving systems and custom cryptography reviewed by people who read the maths.
Often bought with
Penetration testing
Web, mobile, API, cloud and key infrastructure tested the way a real intruder would.
Compliance and business logic audit
Every feature traced to the licence it triggers, in every market you plan to serve.
Build, harden and maintain
Engineering that implements the security work rather than recommending it.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote