Before a mainnet launch or upgrade
Review once behavior is stable enough to test, while changes are still cheap.
We review contracts, runtimes, consensus, and bridges across EVM and non-EVM systems, and publish reports with client permission.
When this fits
Review once behavior is stable enough to test, while changes are still cheap.
A new dependency moves your trust boundary whether or not anyone redrew it.
Reconstruct the failure path and check for related weaknesses.
Review the system and address findings before an ecosystem or exchange assessment.
Where it breaks
We review contract logic, runtime behavior, consensus, and cross-chain verification.
Permissions, state transitions, accounting, upgrade paths, and economic assumptions.
Virtual machines, gas and resource metering, host functions, and node client behavior.
Validator incentives, safety and liveness, reorg handling, and upgrade coordination.
Message verification, relayer assumptions, replay, and what a compromised chain can claim.
Your engagement team
Specialists matched to your protocol stack and the layers in scope.
Specialist Advisor
Security specialist with 60+ Web3 reviews across DeFi, L1s, bridges, oracles, and other critical infrastructure. At Kraken, worked on the security of funding services, custody, APIs, and on-chain systems.
Specialist Advisor
Offensive security specialist with 10+ years of experience, 100+ public audits across 8+ ecosystems, and OSCP, OSCE, eWPT, and eWPTX certifications. At ING and Binance, worked across red teaming, exploit development, infrastructure, and high-scale digital asset systems.
Specialist Advisor
Security engineer and trainer with around 10 years of experience across application and protocol security. At ZKsync, reviewed Solidity and Rust code, including account abstraction, then built AI-assisted vulnerability-analysis workflows.
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Services
Start here for contract logic, permissions, accounting, and upgrades. Most of our published reports are this work.
Explore serviceUse this when the risk is beneath the application layer, in runtimes, consensus, nodes, or bridges.
Explore serviceUse this when the risk is in a proof system, circuit, signature scheme, privacy protocol, or post-quantum design.
Explore serviceUse this for the off-chain code around the protocol: indexers, relayers, backends, and clients.
Explore servicePublished work
NEAR Intents Security Review
Medium Potential Funds Stealing From Users Via Repeating Failed Intents
NEAR Intents Passkeys Pull Request Security Review
Medium Potential DoS of The Main Functionality Through Malicious Solvers
NEAR Smart Contract Security Review
Critical Race Condition in Borrow Functionality
Describe the protocol, planned changes, and launch date. We will help define the scope and timing.
Discuss your scope