This is “code that cannot fail”: L1s, L2s, bridges, core infra. We test consensus assumptions, cryptographic invariants, and economic attack surfaces—not just code style.
Consensus and finality assumptions (where applicable)
Validator incentives and slashing conditions
Bridge/message-passing integrity
Cryptographic primitive usage and integration
Client software and upgrade paths
Monitoring and operational failure modes
invariants, actors, and failure definitions
technical + economic attacker capabilities
clients, proofs, economics, upgrade paths
where it materially improves confidence
network-wide impact narratives
Systemic-risk findings with clear blast radius
Concrete failure scenarios and conditions
Fix direction focused on invariants and incentives
Retest confirmation (when fixes land)
Frequently Asked Questions
We audit core infrastructure such as L1/L2 consensus mechanisms, bridge protocols, validator software, client implementations, and upgrade mechanisms. This is critical 'code that cannot fail'—a single bug can impact the entire network.
Bridges often hold billions in locked assets, and L2s secure entire ecosystems. A single vulnerability can lead to massive fund loss across thousands of users, making the impact far greater than typical dApp exploits.
We review cross-chain message validation, relayer trust assumptions, finality guarantees, withdrawal proofs, and replay resistance. Most bridge hacks exploit weak message verification or relayer compromise—we test both
Yes, when they're custom or novel. We verify signature schemes, hash functions, zero-knowledge proof implementations, and randomness generation. We don't re-audit standard libraries (like OpenZeppelin's ECDSA), but custom crypto gets scrutinized.
Consensus logic, validator software, node clients, upgrade mechanisms, governance systems, economic incentives, slashing conditions, and any on-chain logic that secures network integrity.
Operational security review: key management, RPC exposure, DDoS resilience, and update procedures. We also test whether validators can collude, censor, or manipulate consensus.
Yes—eclipse attacks, Sybil attacks, network partitioning, and timing-based exploits. Protocol security extends beyond code into network topology and peer behavior.
A blockchain security audit firm with the goal of making the Web3 space more secure through innovative and effective solutions.
