Why an audit is not optional
Smart contracts are immutable by design. Unlike a website or an app, where you ship a fix the moment you find a bug, a deployed contract keeps behaving exactly as written — flaws included. An attacker can exploit a weakness indefinitely, and you cannot stop them unless a pause mechanism or upgrade proxy was designed in from the start.
The losses across the industry run into the billions, and the overwhelming majority came from well-understood failure patterns: reentrancy, arithmetic that wraps around, permissions set on the wrong function, or a price feed that a single actor can manipulate. Every one of those is findable by someone reading the code systematically before launch.
There is a commercial reason too. Serious investors and most exchanges ask for an audit report before they will consider a project. Without one you are filtered out early, regardless of how good the underlying idea is.
What we look for
We work in two layers. Automated analysis sweeps for the known vulnerability patterns quickly and cheaply. Then a human reads the code line by line against what it is supposed to do — which is where the logic flaws surface, and those are usually the dangerous ones.
- Reentrancy — external calls made before state is updated, the root cause of several of the largest exploits on record
- Access control — privileged functions left unguarded, or guarded by the wrong modifier
- Integer overflow and underflow — arithmetic that silently wraps and inverts a balance
- Oracle manipulation — reliance on a single price source that a flash loan can move
- Front-running and transaction ordering — logic that lets someone profit by inserting a transaction ahead of yours
- Business logic errors — reward formulas, fee splits and vesting conditions that do not match the stated intent
- Gas inefficiency — wasted cost on every single call, paid by your users forever
- Centralisation risk — owner powers that are broader than the project admits, such as unlimited minting or the ability to freeze other people transfers
How the engagement runs
- Code and intentWe take the source you actually plan to deploy plus documentation of how it should behave. You cannot call code wrong without first knowing what right looks like.
- Automated sweepStatic analysis and fuzzing clear the known patterns so human time goes to the parts that need judgement.
- Manual reviewFunction by function against intended behaviour. This is where logic flaws are found.
- Proof-of-concept exploitsFor anything suspicious we write a test that attempts the attack, so findings are demonstrated rather than asserted.
- Preliminary reportFindings rated Critical / High / Medium / Low / Informational, each with the attack path and a concrete fix.
- Re-audit after fixesOnce your team has remediated, we verify the changes and issue the final report.
What you receive
- A full report listing every finding, its severity and its exact location in the code
- A written attack path for each issue, with proof-of-concept code where applicable
- Remediation guidance that is specific enough to act on, not just a description of the problem
- A final report after fixes, suitable for exchange applications and investor due diligence
- Architectural recommendations — whether you need a pause function, which proxy pattern fits, how to structure multi-sig control
Our audit versus a big-name firm
Our job is to find and close everything before launch. Firms like CertiK or SlowMist add something different: a badge the market recognises, which matters for major exchange listings. The efficient path is to audit with us first so the real issues are gone, then submit to an external firm. Their re-audit passes are typically far cheaper than a first pass on raw code, so this usually costs less overall.
Tooling and coverage
Solidity, Vyper, Hardhat, Foundry, Slither, Mythril, Echidna and project-specific test suites. We cover contracts on any EVM-compatible network — Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche — as well as private chains built in-house.
Frequently asked questions
How long does an audit take?
It scales with size and complexity. A standard token contract takes a few days. A multi-contract DeFi or staking system can run one to two weeks. We give a firm estimate once we have seen the code.
What do you need from us to start?
The source code you intend to deploy, plus documentation or a walkthrough of how each function should behave. Existing tests help us understand intent faster.
Will you fix what you find?
We can. As a matter of good practice the reviewer and the fixer should be different people to keep the review independent, so if you want us to remediate we assign a separate team.
Can you audit a contract that is already deployed?
Yes, and you should. Even though the code cannot change, knowing where the weaknesses are lets you plan — migrate to a new contract, cap the value held, or warn users before someone else finds it.
Will your report satisfy an exchange listing?
Exchange requirements vary. Some accept any competent independent audit, others name specific firms. Tell us which exchange you are targeting and we will check their criteria and prepare accordingly.
Do you fix contracts that already have problems?
Yes — both vulnerabilities found in review and contracts behaving differently from intent. Where a contract is already deployed and cannot be changed, we help plan the route out, such as migrating to a new contract with state transfer for existing holders.
When should a pre-sale security review happen?
Once the code is stable but before deployment, while fixes still cost nothing. Finding problems after a sale has opened leaves far fewer options and affects people who have already bought.
Can you write and audit the contract in one engagement?
Yes, but we assign separate teams to writing and reviewing so the review stays independent. For maximum independence we recommend a further external audit after we have closed the issues we find.
Talk to us before you commit
Tell us what you are trying to solve. Our solution architects reply within 24 hours with an initial scope and approach, at no cost. If we think what you are asking for is not worth building, we will say so.