A transparent, repeatable security process built on industry-leading tools and frameworks. Every engagement follows the same rigorous standard.
Our methodology aligns with the Security Alliance (SEAL) frameworks, the emerging industry standard for Web3 security. We map every engagement to the relevant SEAL domains to ensure comprehensive coverage.
Automated detection of known vulnerability patterns, code quality issues, and gas optimizations, augmented by AI review using custom skills and domain-specific models to surface deeper issues across the codebase.
Business logic, access control, economic attacks, cross-contract interactions, oracle manipulation, reentrancy, front-running.
Stateful fuzzing and property-based testing against the invariants the manual review surfaced. Reserved for protocols where reasoning alone is not enough: complex math (AMM curves, interest accrual, exchange rates, share accounting) and novel designs with no battle-tested reference implementation.
Every finding is re-checked against the client fix: the original attack path is replayed, the surrounding code is reviewed for regressions, and any harness from the previous phase is re-run.
A public double-check of the institutional audit. After the four phases close, the codebase is opened to a contest capped at 50 researchers, selected by CODESPECT from the applicant pool rather than thrown open to anyone who registers. A curated field keeps the signal high and the duplicate noise low, while still putting many independent adversaries on the same code. Best for protocols that want a second, wider opinion before mainnet.
Our methodology extends across all five service pillars
Severity is determined by combining Likelihood and Impact
| Severity Level | Impact: High | Impact: Medium | Impact: Low |
|---|---|---|---|
| Likelihood: High | Critical | High | Medium |
| Likelihood: Medium | High | Medium | Low |
| Likelihood: Low | Medium | Low | Low |
Substantial loss of assets (more than 10%) within the protocol or significant disruption to the majority of users.
Losses affect less than 10% globally or impact only a portion of users, but are still considered unacceptable.
Losses may be inconvenient but are manageable: griefing attacks that can be resolved or minor inefficiencies such as gas costs.
Very likely to occur: either easy to exploit or difficult but highly incentivized.
Likely only under certain conditions or moderately incentivized.
Unlikely unless specific conditions are met, or there is little-to-no incentive for exploitation.
Must be addressed immediately if already deployed.
Must be resolved before deployment (or urgently if already deployed).
It is recommended to fix.
Can be fixed if desired but is not crucial.
Do not pose a direct security risk but provide useful information the audit team wants to communicate formally.
Indicate that certain portions of the code deviate from established smart contract development standards.
Daily progress updates during every engagement
No black-box processes
Full PoC exploits for all Critical and High findings
Fix verification included at no additional cost
Published audit reports (with client approval)
Browse our published audit reports or get a free 30-minute assessment.