Home / Services / Smart contract audits
Web3 & Crypto · Smart contract auditsSmart contract audits that end with an exploit, not an opinion.
We read every line of your Solidity, Rust or Move code the way an attacker would, model the economics around it, and prove each critical finding with a working exploit. You get a report your engineers can act on today and your users can trust.
What we test
- Line-by-line manual review of every contract in scope
- Access control, initialisers, upgradeability and storage layout
- Arithmetic, rounding and accounting — share/asset conversions, fee maths
- Reentrancy (single, cross-function, cross-contract and read-only)
- Oracle, price and liquidity assumptions under adversarial conditions
- Token standards and integrations (ERC-20/721/1155/4626, permit, hooks)
- Gas and denial-of-service vectors in loops, callbacks and batch operations
- Static analysis and fuzzing to back up — never replace — the manual review
What you get
- Findings ranked Critical / High / Medium / Low / Informational
- Working proof-of-concept test for every Critical and High
- Concrete remediation per finding, with code where it helps
- Executive summary for non-technical stakeholders
- Free retest of all fixes and a clean final report you can publish
Who it is for
Protocols preparing a mainnet launch or a major upgrade, teams integrating third-party contracts, and projects that already had an audit but shipped significant changes since. If real funds will sit behind the code, it should be audited by hand before they do.
How long it takes
Most audits run one to three weeks depending on code size and complexity. We scope around the code, not the launch date — a rushed audit misses exactly the logic flaws you are paying us to find. For urgent reviews we can fast-track where capacity allows.
Languages and stacks
Solidity and Vyper on EVM chains (Ethereum, Arbitrum, Optimism, Base, Polygon, BNB Chain and others), Rust on Solana, NEAR and Cosmos/CosmWasm, Move on Aptos and Sui, and Cairo on Starknet.
How an engagement runs
Scope
We agree targets, rules of engagement and what success looks like — in writing, before anything starts.
Recon
We map your full attack surface the way an adversary would, not just the assets you remembered to mention.
Exploit
We attempt real exploitation and chain small weaknesses into business-level impact.
Report
You get prioritised findings, proof-of-concept and remediation steps a developer can act on today.
Retest
We verify every fix so issues stay closed — and you get a clean report to show customers.
Questions about smart contract audits
How much does a smart contract audit cost?
It depends on lines of code, complexity and how much economic modelling is needed. Send us the repository (under NDA) and we come back with a fixed quote within a couple of days — no hourly surprises.
Do you provide a public audit report?
Yes. After the retest we issue a final report you can publish or share with investors and users. Findings you prefer to keep private can be redacted.
Is a single audit enough?
For high-value protocols, no. Pair the audit with a review after every significant change, and consider a second independent firm or a public contest for critical systems.
Other services
Protocol & DeFi security
Web3 & Crypto
View serviceBlockchain infrastructure
Web3 & Crypto
View servicedApp penetration testing
Web3 & Crypto
View servicePenetration testing
Enterprise
View serviceRed teaming
Enterprise
View serviceCloud & identity review
Enterprise
View serviceCompliance-ready testing
Enterprise
View serviceFind out what an attacker would find first.
Send us what you want tested. We'll come back with scope, timing and a fixed quote — no sales theatre.
Start on Telegram