What we audit

We’ve worked extensively with the Solana Foundation on auditing the Solana Core code, along with Account Compression.

Our experience doesn’t end there: we’ve taken this deep knowledge and applied it to our audits on a number of well-known protocols building within the ecosystem, including Marginfi, Parcl, Jupiter, Mayan, Jito, Ellipsis Phoenix, Raydium, Tensor, Squads, Kamino, GooseFX, Pyth, and more.

We’ve audited many projects and teams within the Ethereum and Ethereum-compatible space. We’re experts in Solidity, and have audited the entire Ethereum stack, down to the compiler.

We’ve audited teams like Vyper, LayerZero, Wormhole, Euler, and MetaMask. We’ve also worked extensively with Uniswap, serving on their bridge committee and researching malicious hook usage in Uni v4.

We’ve partnered with Sui Foundation and Mysten Labs to audit and secure the Sui blockchain since pre-mainnet. This includes audits on the validator client, the Sui framework, and various peripheral components including ZK Login, the native bridge, token standard, and more.

Our experience doesn’t end with Sui itself: we’ve taken this deep knowledge and applied it to our audits on a number of well-known protocols building within the ecosystem, including Drife, Scallop, Aftermath, Navi, Cetus, Volo, and Haedal.

We’re extremely familiar with the Aptos ecosystem: we’ve partnered with Aptos itself to secure the chain since testnet. Some of our other partners in the ecosystem include Thala, Aires Markets, Cetus, Econia, Pontem, Tortuga, Laminar Markets, PancakeSwap, and more.

We’ve also worked with existing protocols as they integrate or otherwise interact with Aptos, including Switchboard, Wormhole, LayerZero, and Pyth.

We’ve audited many projects and teams within Cosmos. We’re familiar with both the Cosmos SDK and CosmWasm, having experience with teams across the ecosystem. We also have an ongoing retainer with Binary Builders to audit the Cosmos SDK itself.

We apply this familiarity with Cosmos to our partners, which include teams and projects like Skip Protocol, Wormhole, Osmosis, Lava Network, Tailwind, and Stargaze Infinity.

We’ve partnered with the NEAR team on NEAR’s proof of personhood identity system, ”I am Human”. This system creates a soulbound NFT, granting each user access to features within the NEAR ecosystem like election participation, establishing on-chain reputation, engagement in grassroots funding, and more.

We’ve also audited teams building on NEAR, like Wormhole, Mintbase, Stader, and Proximity Labs.

We’ve audited many protocols in the Decentralized Finance space, across many chains. We’ve audited across a wide range of products, including DEXes, AMMs, and Order books, along with a variety of staking, vesting, structured products, perps, and borrowing/lending protocols. Many of our team members use DeFi products daily, and many of our partner teams are experts in mechanism design and protocol design.

Some notable audits we’ve completed include Jupiter’s perps, Haedal’s liquid staking protocol, Vertex’s LBA, Mango Markets v4, Scallop, PancakeSwap, Ellipsis Phoenix, Laminar Markets, and Parcl Finance.

Bridges, though relied on very heavily by users, are often a weak link when it comes to exploits. Our goal is to ensure that bridges are as safe and secure as possible. We’ve audited across a variety of bridges and crosschain applications, and have worked with teams like LayerZero, Folks Finance, Synonym, and Mayan. We’ve also partnered with Wormhole on their Sui, Aptos, and Near integrations.

We’ve worked on a variety of wallet projects, like Easy Wallet, Pontem’s mobile wallet, and Versa Wallet. We also have a deep connection to MetaMask Snaps, having audited more than half a dozen Snaps from teams like Nocturne, Bayan, Drift, and Algorand. We’ve also published novel research around vulnerabilities in the Metamask Snap execution layer, and partner with MetaMask for ongoing security research.

Our infrastructure audit experience does not stop at DeFi. We’ve audited critical NFTFi infrastructure across many different ecosystems.

We’ve worked extensively with teams like Tensor, Solana’s #1 NFT trading platform, Flooring, an NFT protocol that enables users to trade their NFTs for ERC20 tokens, and Stargaze Infinity Swap, an NFT AMM built on Cosmos that allows users to earn swap fees by providing liquidity in NFT pools.

We’ve worked with a wide range of projects, from qualified custodians to exchanges to mobile firmware. We’ve discovered bugs across these systems and published the research. We have familiarity with a wide range of execution environments, programming languages, and design paradigms. The teams we work with to support infrastructure include Backpack Exchange, Tensor, and Tiplink.

We love compilers. We’ve worked with a number of different compiler targets. We’re partnered with Vyper to audit their compiler, and develop differential fuzzing infrastructure. We’ve also reviewed the Move compiler rewrite on behalf of Aptos, and discovered vulnerabilities in Solana’s LLVM backend and solc.

We have extensive experience when it comes to zero-knowledge proofs. Our past audits include Elusiv, a compliant privacy-preserving payment protocol built on zero-knowledge proofs on Solana, and Solana’s confidential transfer extensions, auditing the software development kit that contains code utilized by the token-2022 extension.

Additionally, we’ve audited ZK Login, a circom-based JWT validation service, as part of our partnership with Mysten Labs.

We’re a team of white-hat hackers, and we back that up with initiatives like our $1 post-hack audit and our active participation in Seal 911.

As members of Seal 911, we join war rooms and work incidents even when the affected parties aren’t our clients.

Teams shouldn’t have to make even more hard decisions during an active exploit. The $1 post-hack program lets us help when they need it most.

We track new security incidents closely. When we find patterns or attack vectors that affect our clients, we notify them and publish the work.

We’re not limited to the chains and languages mentioned above. We love niche languages. We’ve audited code written in Solidity, Vyper, Solana Rust, CosmWasm, Go, Aptos Move, Sui Move, Javascript, Circom, Halo 2, and more. We also help secure various web2 frontend and backends, including those written in Javascript, Rust, and Python. We’ve worked with teams building on chains like Optimism, Arbitrum, Polygon, Algorand, Stellar, Sei, StarkNet, and more.

This includes teams like SoroSwap, Blend Capital, Sei, and more.