Audit Services
What we audit, what it covers, and what it costs
Solidity Audits
Full-coverage review of your contracts, in separate passes for security, logic, architecture, and code quality — a dedicated specialized agent per class of bug, not one reviewer skimming for all of them at once.
Security Analysis
- Reentrancy vulnerabilities
- Access control issues
- Oracle manipulation
- Flash loan attacks
- MEV vulnerabilities
Logic Verification
- Mathematical correctness
- Boundary conditions
- Edge cases
- State transitions
Architecture Review
- Contract design
- Upgrade patterns
- Integration points
- Gas efficiency
Code Quality
- Documentation gaps
- Naming conventions
- Test coverage analysis
- Maintainability concerns
Periphery Audits
The code around your contracts: keepers, bots, dashboards, and backends in TypeScript, Rust, Python, or Go. This is where on-chain security assumptions quietly break.
Contract Integration
- ABI usage
- Transaction construction
- Event handling
- Gas estimation
Security Review
- Credential handling
- Injection vulnerabilities
- Authentication flows
- Error handling
Reliability Analysis
- Retry mechanisms
- Timeout handling
- Race conditions
- Error recovery
Logic Review
- Business logic flaws
- Async/concurrency issues
- Calculation errors
- Edge cases
ZK Circuit Audits
Soundness and privacy review of zero-knowledge circuits and the on-chain verifiers that consume them — Noir circuits, Honk/Plonk verifier wrappers, and the application contracts at the cryptographic seam. Available standalone or alongside a Solidity audit.
Circuit Soundness
- Missing constraints
- Range checks on field elements
- Conservation predicates
- Hash domain separation
- Membership proofs
Witness Privacy
- Public-input leakage
- Proof-hiding verification
- Salt entropy
- Constraint-shape side channels
Verifier Binding
- Public-input vector binding
- Proof envelope decoding
- Verifying-key pinning
- Nullifier derivation
Integration Seam
- Circuit ↔ verifier ↔ consumer wiring
- Commitment binding
- Replay and fork protection
- Toolchain reproducibility
Optional Add-ons
Available as add-ons to any audit. Each is priced as a fixed percentage of the base fee, scoped up front.
Gas Optimization · +20%
Storage patterns, loop optimizations, calldata vs memory usage, and other gas efficiency improvements.
Test Quality Review · +15%
Coverage analysis, assertion quality, fuzz/invariant test patterns, and testing methodology recommendations.
Periphery Test Review · +15%
Off-chain test coverage and quality for the keepers, bots, and backends that drive the contracts.
Pricing
Flat rate by project size. Your weighted in-scope SLOC — core business logic weighs more heavily than interfaces and libraries — sets the tier. You know the price before you commit: no hourly meter, no surprise total.
For reference: established firms bill $20,000–$100,000+ for the same shape of work. Optional specialized passes are a fixed percentage of the base — see Add-ons above.
What's included:
- PDF report with every finding, severity-rated
- Severity ratings and remediation recommendations
- A runnable proof-of-concept exploit for every high & critical finding
- Economic & game-theory review
- One round of fix verification included
- Single point of contact throughout engagement
Straight Answers
Why are your rates below the big firms'?
Because our cost structure is different. A purpose-built AI pipeline runs the specialized passes, so you're not paying a team of humans by the hour or a big firm's overhead. You still get a named principal who scopes the work, reviews the findings, proves the serious ones, and signs the report — we just pass the efficiency on.
Who actually does the audit — a person or an AI?
Both, by design. A purpose-built pipeline runs the specialized passes and drafts the findings; a named principal scopes the engagement, reviews everything it surfaces, proves the serious findings with a runnable exploit, and signs the report. The automation gives you coverage a single human can't match in a fixed window; the principal gives you judgment and accountability. If your codebase needs more than we can responsibly cover, we say so at scoping instead of stretching.
What if you don't find anything serious?
Then the report says so, briefly. We don't pad reports with informational findings to justify the invoice.
What do you need from us to start?
Read access to the repository, whatever documentation exists, and a pinned commit. If there are ZK circuits, the exact toolchain versions too, so proofs are reproducible.
Ready to secure your protocol?
Tell us what you’re shipping and when. We’ll tell you what it needs.