A transparent, repeatable security process built on industry-leading tools and frameworks. Every engagement follows the same rigorous standard.
Our methodology aligns with the Security Alliance (SEAL) frameworks, the emerging industry standard for Web3 security. We map every engagement to the relevant SEAL domains to ensure comprehensive coverage.
Slither, Aderyn, AI-assisted analysis
Automated detection of known vulnerability patterns, code quality issues, and gas optimizations, augmented by AI review using custom skills and domain-specific models to surface deeper issues across the codebase.
Baseline findings report, false positive triage, AI-flagged risk areas
Foundry fuzz testing, Trident
Property-based testing, invariant checking, edge case discovery.
Custom fuzz harnesses, failing test cases for identified issues
Senior-only review, minimum two auditors
Business logic, access control, economic attacks, cross-contract interactions, oracle manipulation, reentrancy, front-running.
Detailed findings with PoC exploits where applicable
Halmos
Mathematical proofs for critical invariants (token conservation, exchange rate monotonicity, access control correctness).
Best for AMMs, lending protocols, stablecoins, bridges
Our methodology extends across all six service pillars
Severity is determined by combining Likelihood and Impact
| Severity Level | Impact: High | Impact: Medium | Impact: Low |
|---|---|---|---|
| Likelihood: High | Critical | High | Medium |
| Likelihood: Medium | High | Medium | Low |
| Likelihood: Low | Medium | Low | Low |
Substantial loss of assets (more than 10%) within the protocol or significant disruption to the majority of users.
Losses affect less than 10% globally or impact only a portion of users, but are still considered unacceptable.
Losses may be inconvenient but are manageable — griefing attacks that can be resolved or minor inefficiencies such as gas costs.
Very likely to occur — either easy to exploit or difficult but highly incentivized.
Likely only under certain conditions or moderately incentivized.
Unlikely unless specific conditions are met, or there is little-to-no incentive for exploitation.
Must be addressed immediately if already deployed.
Must be resolved before deployment (or urgently if already deployed).
It is recommended to fix.
Can be fixed if desired but is not crucial.
Do not pose a direct security risk but provide useful information the audit team wants to communicate formally.
Indicate that certain portions of the code deviate from established smart contract development standards.
Daily progress updates during every engagement
No black-box processes
Full PoC exploits for all Critical and High findings
Fix verification included at no additional cost
Published audit reports (with client approval)
Browse our published audit reports or get a free 30-minute assessment.