Audit Services

What we audit, what it covers, and what it costs

Solidity Audits

Line-by-line review of your contracts, in separate passes for security, logic, architecture, and code quality. One reviewer hunting one class of bug at a time.

Security Analysis

  • Reentrancy vulnerabilities
  • Access control issues
  • Oracle manipulation
  • Flash loan attacks
  • MEV vulnerabilities

Logic Verification

  • Mathematical correctness
  • Boundary conditions
  • Edge cases
  • State transitions

Architecture Review

  • Contract design
  • Upgrade patterns
  • Integration points
  • Gas efficiency

Code Quality

  • Documentation gaps
  • Naming conventions
  • Test coverage analysis
  • Maintainability concerns

Periphery Audits

The code around your contracts: keepers, bots, dashboards, and backends in TypeScript, Rust, Python, or Go. This is where on-chain security assumptions quietly break.

Contract Integration

  • ABI usage
  • Transaction construction
  • Event handling
  • Gas estimation

Security Review

  • Credential handling
  • Injection vulnerabilities
  • Authentication flows
  • Error handling

Reliability Analysis

  • Retry mechanisms
  • Timeout handling
  • Race conditions
  • Error recovery

Logic Review

  • Business logic flaws
  • Async/concurrency issues
  • Calculation errors
  • Edge cases

ZK Circuit Audits

Soundness and privacy review of zero-knowledge circuits and the on-chain verifiers that consume them — Noir circuits, Honk/Plonk verifier wrappers, and the application contracts at the cryptographic seam. Available standalone or alongside a Solidity audit.

Circuit Soundness

  • Missing constraints
  • Range checks on field elements
  • Conservation predicates
  • Hash domain separation
  • Membership proofs

Witness Privacy

  • Public-input leakage
  • Proof-hiding verification
  • Salt entropy
  • Constraint-shape side channels

Verifier Binding

  • Public-input vector binding
  • Proof envelope decoding
  • Verifying-key pinning
  • Nullifier derivation

Integration Seam

  • Circuit ↔ verifier ↔ consumer wiring
  • Commitment binding
  • Replay and fork protection
  • Toolchain reproducibility

Optional Add-ons

Available as add-ons to any audit. Priced into the same day rate, scoped up front.

Economic Analysis

Game theory review, incentive alignment verification, value extraction path identification, and protocol economics analysis.

Gas Optimization

Storage patterns, loop optimizations, calldata vs memory usage, and other gas efficiency improvements.

Test Quality Review

Coverage analysis, assertion quality, fuzz/invariant test patterns, and testing methodology recommendations.

Pricing

Our pricing is based on a weighted source lines of code (SLOC) model. Core business logic weighs more heavily than interfaces and libraries, ensuring accurate scoping and fair pricing.

$1,500
per day

Audit duration is determined during scoping based on codebase complexity. You get the day count, the total, and what each day buys before you commit to anything. For reference: established firms bill $2,000–$5,000+ per auditor-day for the same shape of work.

Founders' rates

We're new, and early trust deserves a real discount. The first three Cimora engagements are priced at:

FIRST
$750
per day
SECOND
$1,000
per day
THIRD
$1,250
per day

Standard rate applies from the fourth engagement on. Same scope discipline, same report, same verification round at every tier.

What's included:

  • PDF report with every finding, severity-rated
  • Severity ratings and remediation recommendations
  • One round of fix verification included
  • Single point of contact throughout engagement

Straight Answers

Why are your rates below the big firms'?

Because we're new, and you're paying for eyes, not a logo. The process is the same shape the established firms run; the discount is for trusting us before the track record is long.

Why principal-led instead of a rotating team?

Audits fail by dilution. A principal who owns the whole engagement, running separate specialized passes, beats a rotating cast sharing a deadline. And if your codebase needs more coverage than we can give it in the window you have, we'll say so at scoping instead of stretching.

What if you don't find anything serious?

Then the report says so, briefly. We don't pad reports with informational findings to justify the invoice.

What do you need from us to start?

Read access to the repository, whatever documentation exists, and a pinned commit. If there are ZK circuits, the exact toolchain versions too, so proofs are reproducible.

Ready to secure your protocol?

Tell us what you’re shipping and when. We’ll tell you what it needs.

Request an Audit