1.07Security testing
Smart Contract & Web3 Security Audit
Manual Solidity and EVM review aligned to the OWASP Smart Contract Top 10 and SCSVS – economic attack modelling, static analysis, fuzzing and invariant testing for smart contracts and protocols.
Smart-contract defects can be difficult or impossible to reverse after deployment. The audit focuses on code and economic conditions that could lead to unauthorised asset movement, loss of control, denial of service or protocol insolvency.
Manual review covers Solidity and EVM behaviour, access control, reentrancy, oracle assumptions, upgradeability, proxy patterns, MEV exposure and protocol-specific business logic, structured around the OWASP Smart Contract Top 10 and the OWASP SCSVS. Automated tools support, but do not replace, manual analysis.
Static analysis with tools such as Slither and Mythril is combined with property-based fuzzing and invariant testing using Foundry or Echidna. Deliverables include confirmed findings, remediation guidance and a re-audit of the fixed version. EVM networks are the primary scope; other ecosystems can be agreed separately.
A code audit is one layer of Web3 security, not the whole of it. It does not cover the signing, multisig and key-management operational surface – compromised signer devices, malicious transaction-signing interfaces and key handling drove several of 2025's largest incidents, independent of any contract bug. Assessing that surface belongs to our Red Team & Adversary Emulation, Social Engineering Assessment and Supply Chain Security & SBOM services, which we can combine with the audit.
- EVM-first
- Ethereum & L2s; Solana/Rust & Move on request
- MiCA + DORA
- EU crypto and ICT-resilience framing
How it works
- 01
Scoping & freeze
Agree contracts, commit hash, architecture and threat model; freeze the codebase for review.
- 02
Automated baseline
Run and triage Slither and Mythril, and stand up the Foundry/Echidna harness for the codebase.
- 03
Manual deep review
Line-by-line Solidity/EVM analysis with economic and logic attack modelling against the contracts.
- 04
Fuzzing & invariants
Property-based fuzzing and invariant testing to surface edge cases and break stated guarantees.
- 05
Reporting
Severity-ranked findings with proof of impact, gas and best-practice notes, and clear remediation guidance.
- 06
Remediation re-audit
Re-review fixed code against findings and confirm closure with a final report.
Packages
- Single Contract
- Focused audit of one contract or a small module, with remediation re-audit.
- Protocol AuditPopular
- Full codebase review with fuzzing, invariant testing and re-audit.
- Protocol + Threat Model
- Protocol audit plus DeFi/economic threat modelling, optional formal/symbolic verification of critical invariants, and MiCA/DORA security framing.
Frequently asked questions
What clients say about working with us
Fintech“Partnering with OffSeq on a red team engagement gave us a genuine adversarial perspective that went well beyond a traditional penetration test.”
Oskars Zīle
CISO · Eleving Group
SaaS“Instead of slowing us down, they seamlessly integrate with our fast-moving engineering team, providing proactive, high-level insights that let us fortify our systems in real time as we grow.”
Karlis Broders
CTO · Trace.Space
E-commerce“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”
Oskars Podziņš
Head of Information Security · Printful
All services
Security Audits
Identify exploitable weaknesses and prioritise remediation.
Red Team & Adversary Emulation
Test whether the organisation can prevent, detect and respond to a goal-driven attack.
Social Engineering Assessment
Measure resilience to phishing, voice fraud and other social-engineering techniques.
Scope a test
support@offseq.com+371 2256 5353
Direct access to a senior specialist · Reply within 24 hours · NDA available on request