Complexity and quality analysis of the codebase — files, SLoC, composability, test coverage, documentation — plus a review of previous audits and an intro call with your engineers. This is what the scope and the quote are built from, and it is where we say so if we think the review should be larger or smaller than you asked for.
Each auditor reviews the code alone and commits a hash of their findings before anyone compares notes. Nobody can see what the others have found, so nobody anchors on it. A team that talks early converges on the same handful of bugs; a team that commits blind does not. We then reveal, triage and issue an intermediate report.
Findings are pooled and the team goes deep on the hardest issues together, with a prize pool paid per bug. The incentive is deliberate: it keeps every auditor hunting through the final day rather than coasting once the report outline exists.
We review your fixes, re-test the remediation — typically one to two days — and deliver the final amended report. Every finding carries severity, impact, a reproduction and a concrete remediation.
The median engagement is staffed with four people including the technical lead, and 86% run with three or more. Coverage is largely a function of how many independent people read the code carefully, and one reviewer — however senior — has one set of blind spots. Team size for every published engagement is on its customer page.
Our auditors are full-time employees, not contractors and not an anonymous crowd. The people who built the reputation are the people who do the work, and they are still here.
Every auditor fully understands the protocol before tooling enters the picture. Automated analysis supplements protocol-specific reasoning; it does not replace it. Most of what matters in DeFi is business logic that no scanner has a rule for.
Backends, APIs, custody, infrastructure and frontends are in scope when they carry risk. A protocol that is sound onchain can still lose funds through the backend that feeds it.
The people who lead these engagements are named on the team page, and the team size for every published engagement is on its customer page. If you want to know who will be assigned to yours, ask before you sign — see what to ask an audit firm.
The primary method. Everything else is support.
A blockchain integration testing toolkit for exercising protocol interactions end to end, and a fake-deposit scanner built for exchanges and custodians — the class of bug that lets an attacker credit a deposit that never settled.
A custom workflow run at kickoff that clears most of the routine issues, so auditor time goes to the complex and non-trivial vulnerabilities rather than to what a machine can already find.
Foundry, Echidna and ityFuzz for fuzzing and invariant testing, plus Slither and our open-source semgrep-smart-contracts rulepack. Useful as a floor; none of it finds protocol-specific business logic.
Every finding we publish a count for is an issue recorded in our internal tracker during the engagement, rated Critical, High, Medium, Low or Informational by the auditor who found it and confirmed at triage. Informational findings are included in totals because excluding them would flatter the numbers.
The counts on every customer page come from that tracker, not from a marketing spreadsheet. Across 146 published engagements they total 1356 findings, of which 71 were critical and 136 high. You can download the whole dataset and check the arithmetic.
We do not publish remediation status. Whether a client fixed a given issue is their disclosure to make, not ours.
Scoping starts with a look at the repository and a call with your engineers.