Right-sized
From a single contract to a multi-service protocol. We'll tell you if a sprint is enough or if it isn't.
Services
Senior review, scoped to what matters.
We work best as a small, embedded research partner rather than a large vendor. Engagements are sized to the risk in front of you — a single contract, a protocol upgrade, or a full codebase — and priced for senior attention, not headcount.
01
Smart-contract audits
Line-by-line manual review of on-chain logic: token accounting, access control and roles, upgrade and proxy patterns, oracle dependencies, and the economic assumptions that hold the system together. We pair reading with targeted invariant and property tests so the important guarantees are written down, not just believed.
02
Protocol & codebase review
The code around the contracts: bridges and message passing, keepers and bots, indexers, signing services, and node tooling. We trace trust boundaries and failure modes end to end. Outside crypto, we take on general codebase audits where the stakes justify a senior look.
03
Bug bounty research
We work systematically: mapping the full attack surface, validating every finding adversarially before we surface it, and checking the codebases that share lineage with the target. Hunting and validation against live programs, triage support, clear disclosure write-ups, and verification once a fix lands — a partner to your program, not a firehose.
04
Threat modeling
Practical attack-path mapping for teams that want scope clarity before a review begins — assets, actors, trust boundaries, and the handful of scenarios worth the most attention.
05
Remediation review
Fix validation, regression checks, and a concise verified-fix memo. Useful on its own when another party did the original review and you want an independent confirmation.
06
Security advisory
Ongoing, low-volume support for teams that would rather have a senior researcher on call than retain a large firm — design reviews, second opinions, and disclosure handling.
:: scope · evidence · fix ::
A report you can act on
Plain enough for engineering execution, polished enough for a board or a community update.
Verified, not assumed
We re-test fixes and document residual risk so closeout means something.
Scoping
Not sure which one you need?
Send a short description of the system and your concern. We'll suggest the smallest engagement that answers the question honestly.