Home / Services / Protocol & DeFi security
Web3 & Crypto · Protocol & DeFi securityYour code can be correct and your protocol still insolvent.
Most DeFi losses are not bugs in the usual sense — they are valid transactions that nobody modelled. We attack your protocol's economics, incentives and composability the way a well-funded adversary would, before they do.
What we test
- Threat model of the protocol: actors, capital, incentives and trust boundaries
- Flash-loan, price-manipulation and oracle-dependency attack paths
- Liquidation, collateral and bad-debt behaviour under extreme volatility
- MEV exposure: sandwiching, back-running, censorship and reorg risk
- Governance and timelock abuse, admin-key blast radius
- Bridge and cross-chain message validation, replay and finality assumptions
- Composability risk with the external protocols you integrate
- Simulation of the highest-impact scenarios with forked-mainnet tests
What you get
- Written threat model your team can keep maintaining
- Ranked attack scenarios with estimated impact in your protocol's terms
- Fork-based proof-of-concept for the scenarios that matter
- Design and parameter recommendations (caps, delays, circuit breakers)
- Follow-up review once mitigations are in place
Who it is for
Lending markets, AMMs, vaults, staking and restaking systems, bridges, stablecoins and any protocol whose safety depends on prices, liquidity or the behaviour of other protocols.
How it fits with an audit
A smart contract audit checks that the code does what it says. A protocol security review checks that what it says is safe. Most teams need both; we usually run them together so findings in one feed the other.
How an engagement runs
Scope
We agree targets, rules of engagement and what success looks like — in writing, before anything starts.
Recon
We map your full attack surface the way an adversary would, not just the assets you remembered to mention.
Exploit
We attempt real exploitation and chain small weaknesses into business-level impact.
Report
You get prioritised findings, proof-of-concept and remediation steps a developer can act on today.
Retest
We verify every fix so issues stay closed — and you get a clean report to show customers.
Questions about protocol & DeFi security
Can you review a design before any code exists?
Yes — and it is the cheapest time to find economic flaws. We work from whitepapers, specs and models and give you findings before you commit engineering time.
Do you help set parameters like LTVs, caps and fees?
We give recommendations backed by the attack scenarios we modelled. Final parameter decisions remain yours, but you make them with the adversary's view in front of you.
Other services
Smart contract audits
Web3 & Crypto
View serviceBlockchain infrastructure
Web3 & Crypto
View servicedApp penetration testing
Web3 & Crypto
View servicePenetration testing
Enterprise
View serviceRed teaming
Enterprise
View serviceCloud & identity review
Enterprise
View serviceCompliance-ready testing
Enterprise
View serviceFind out what an attacker would find first.
Send us what you want tested. We'll come back with scope, timing and a fixed quote — no sales theatre.
Start on Telegram