Blockchain Security Audit
Smart contracts are public, hold real value and usually cannot be patched after deployment, so a single bug can be expensive. A blockchain security audit reviews your contracts, dApp and supporting infrastructure for vulnerabilities before attackers find them.
I combine smart contract review with the web, API and infrastructure testing I do every day, because many Web3 incidents start off-chain: in a front end, an API, a key management process or a bridge.
What I audit
- Smart contracts: code review for logic flaws, access control, reentrancy, oracle manipulation and economic attacks.
- Blockchain protocols: security review of protocol design and implementation.
- dApps: the smart contracts plus the web front end and APIs that users interact with.
- Crypto wallets and exchanges (DEX and CEX): key handling, transaction signing and account security.
- Cross-chain bridges: message verification, validator trust and asset accounting.
- Supporting infrastructure: penetration testing of the servers, APIs and cloud environments behind the project.
Ecosystems
Ethereum and EVM chains (Solidity), Cosmos (Cosmos SDK, CosmWasm), Solana and Substrate/Polkadot. Ask me about others.
How I work
- Scoping: agree the repositories and commit hash, documentation and deployment details.
- Understanding the design: walk through the intended behaviour and trust assumptions with your team.
- Manual review and testing: line-by-line review supported by static analysis and test cases for suspected issues.
- Reporting: each finding with severity, impact, proof of concept and a recommended fix.
- Fix review: verifying the fixes before deployment.
What you get
- An audit report you can share with your users and investors.
- Severity-rated findings with proof of concept and fix guidance.
- A review of your fixes.
Get started
Tell me what you want tested, how large it is and when you need it, and we can agree a scope. Contact me to discuss your blockchain project.