Smart Contract Audit & Verification

What we check

Every audit runs against a full severity checklist plus the chain-specific traps that generic tools miss.

Universal (all chains)

• Access control & privileges — owner/admin gates, role management, upgrade authority, mis-scoped permissions
• Reentrancy & external-call ordering (checks-effects-interactions)
• Arithmetic — overflow/underflow, rounding and precision loss, share-inflation / first-depositor attacks
• Oracle & price manipulation — flash-loan, spot-vs-TWAP, stale or round-trippable feeds
• Economic & logic bugs — fee math, accounting drift, incentive gaming, MEV / sandwich exposure
• Denial of service — unbounded loops, gas griefing, storage bloat, forced reverts
• Signatures & replay — nonces, EIP-712 domains, permit / approval abuse

EVM (Solidity / Vyper) — proxy & delegatecall storage collisions, uninitialized implementations, tx.origin auth, unchecked low-level calls, Permit2 / allowance risks, UUPS & Transparent upgrade safety, selfdestruct and create2 reuse.

Solana (Rust / Anchor) — missing signer / owner checks, account substitution ("type cosplay"), unchecked discriminators, PDA seed collisions, arbitrary CPI & program-id spoofing, lamport / rent and close-account exploits, integer math, compute-budget griefing.

TON (FunC / Tact) — message-flow and bounce handling, unexpected-sender assumptions, gas accounting and out-of-gas states, replay protection, storage rent, partial execution across message hops.

How we audit

1. Scope & threat model — we map the contracts, actors, trust assumptions and the invariants that must always hold.
2. Manual line-by-line review — senior engineers who build on-chain systems daily read every path the way both an implementer and an attacker would. This is where the real bugs are found.
3. Tooling in depth — static analysis (Slither, cargo-audit, custom lints), fuzzing and invariant testing (Foundry, Echidna), and symbolic / formal methods (Halmos, Certora) where the code warrants it.
4. Proof-of-concept — every confirmed finding ships with a runnable PoC test, not just a paragraph. You can reproduce it, and you can confirm the fix.
5. Report & remediation — a severity-ranked report (Critical → Informational), each item with a concrete, tested fix, plus a free re-audit of your patches.
6. Certificate — once the re-audit is clean we issue a signed verification certificate and the full report you can hand to investors, launchpads and exchanges.

Our experience

We're a build-first studio: our engineers ship smart contracts, trading bots and on-chain settlement code every week across Solana, EVM and TON. Auditing from a builder's seat means we catch the failure modes that only surface under real, adversarial, high-value conditions — not just textbook patterns. Over 6+ years we've written and reviewed the exact systems we now audit.

Need something lighter first? Our code review & security audit is a faster, focused pass. For a full, certificate-grade audit across any major chain, this is the one.

Turnaround & pricing

From $8,000, scoped to contract size and complexity — typical turnaround is 1–2 weeks, with expedited slots available. You get a fixed quote after a short scoping call, and the fee already includes the re-audit of your fixes.