Smart Contract & Web3 Security Audit
Manual Solidity and EVM review, economic attack modelling, static analysis, fuzzing and invariant testing for smart contracts and protocols.
Smart-contract defects can be difficult or impossible to reverse after deployment. The audit focuses on code and economic conditions that could lead to unauthorised asset movement, loss of control, denial of service or protocol insolvency.
Manual review covers Solidity and EVM behaviour, access control, reentrancy, oracle assumptions, upgradeability, proxy patterns, MEV exposure and protocol-specific business logic. Automated tools support, but do not replace, manual analysis.
Static analysis with tools such as Slither and Mythril is combined with property-based fuzzing and invariant testing using Foundry or Echidna. Deliverables include confirmed findings, remediation guidance and a re-audit of the fixed version. EVM networks are the primary scope; other ecosystems can be agreed separately.
- EVM-first
- Ethereum & L2s; Solana/Rust & Move on request
- MiCA
- EU crypto regulatory framing
How it works
-
01
Scoping & freeze
Agree contracts, commit hash, architecture and threat model; freeze the codebase for review.
-
02
Automated baseline
Run and triage Slither and Mythril, and stand up the Foundry/Echidna harness for the codebase.
-
03
Manual deep review
Line-by-line Solidity/EVM analysis with economic and logic attack modelling against the contracts.
-
04
Fuzzing & invariants
Property-based fuzzing and invariant testing to surface edge cases and break stated guarantees.
-
05
Reporting
Severity-ranked findings with proof of impact, gas and best-practice notes, and clear remediation guidance.
-
06
Remediation re-audit
Re-review fixed code against findings and confirm closure with a final report.
Packages
- Single Contract
- Focused audit of one contract or a small module, with remediation re-audit.
- Protocol Audit Popular
- Full codebase review with fuzzing, invariant testing and re-audit.
- Protocol + Threat Model
- Protocol audit plus DeFi/economic threat modelling and MiCA security framing.
Frequently asked questions
Which chains and languages do you audit?
Our principal coverage is Solidity and EVM-compatible networks, including Ethereum and common Layer 2 platforms such as Arbitrum, Optimism, Base and Polygon. Coverage for Solana/Rust or Move-based networks is confirmed separately. Share the repository, pinned code version and target networks during scoping so we can confirm the required expertise before work begins.
Is the audit just running Slither and Mythril, or is it manual?
Manual review is central to the audit. We analyse contract logic, privilege boundaries and economic assumptions, including re-entrancy, access control, oracle manipulation, MEV and upgradeability risks. Tools such as Slither and Mythril and fuzz or invariant testing with Foundry or Echidna support the review and exercise edge cases; they do not replace human analysis.
Does an audit guarantee our contracts can’t be exploited?
No credible audit can guarantee that a contract is free of defects or cannot be exploited. The audit reduces risk within the agreed code version, scope, assumptions and time available by identifying and helping remediate the issues found. New code, dependencies, integrations, governance changes or market conditions can introduce additional risk after the audit.
How does MiCA affect our need for a security audit?
MiCA establishes authorisation and ongoing obligations for relevant crypto-asset issuers and service providers, but it does not make a smart-contract audit a universal approval mechanism. A documented audit can support evidence of ICT and security due diligence where the technology and risk profile make it relevant. The engagement scope and report can be structured to support applicable compliance work without implying regulatory approval.
Helpful tools
- Scope a test
Create a scoped brief in one minute
- Security maturity assessment
Assess your organization across six domains
All services
- Security Audits
Identify exploitable weaknesses and prioritise remediation.
- Red Team & Adversary Emulation
Test whether the organisation can prevent, detect and respond to a goal-driven attack.
- Social Engineering Assessment
Measure resilience to phishing, voice fraud and other social-engineering techniques.
Scope a test
[email protected] +371 2256 5353
Direct access to a senior specialist · Reply within 24 hours · NDA available on request