Pre-audit checklist
What to have ready before an audit starts, and the preparation that reliably cuts both the cost and the finding count.
Request itResources
What we learn, written down.
Engineering notes, vulnerability classes we keep finding, and the reference material we use internally. Published because the next team should not have to relearn it.
Written by the engineers who shipped itNo gated marketing PDFs
Writing
Five areas we publish in.
Every article is written by someone who worked on the problem, not by a content team reading a brief.
Security
Vulnerability classes, audit method, and the bugs that keep reappearing across otherwise unrelated protocols.
4 articlesRWA and compliance
Tokenising real-world assets, the standards that govern it, and designing rules a regulator can audit later.
3 articlesDeFi engineering
Protocol mechanics: liquidation design, oracle-extractable value, and cross-protocol accounting.
2 articlesInfrastructure
Indexers, reorgs, backfills and cross-chain messaging, written from running them rather than reading about them.
2 articlesResearch
Work from further upstream, published before it becomes anybody's roadmap.
1 articleEverything
The full index, newest first, across every area we write in.
All 12 articlesReference
Material we will send you.
Three documents we use internally. Ask and we will send them, with no form and no sequence afterwards.
Threat model template
The document we write before any contract is implemented. Yours to use, whether or not we build it.
Request itSample audit report
A redacted report showing how we classify findings, write proofs of concept and describe remediation.
Request itGet in touch
Want something we have not written yet?
If you are working through a problem in this space, tell us. It may well become the next piece.
hello@xoralabs.io