Contract layer
- Line-by-line manual review
- Upgradeable proxies and storage layout
- Access control and privileged roles
- Token standard conformance
- Cross-chain message handling
- Reentrancy and external call safety
Security
Find it before mainnet does.
Security reviews and testing for smart contracts and the systems around them. We model how your protocol can fail, read the code by hand, and try to break it before anyone else gets the chance.
Manual review firstFuzz and invariant testingProof of concept where reproducible
Coverage
What we review.
Protocol & economics
- Invariant and state-machine analysis
- Oracle manipulation and price feeds
- Liquidation and solvency logic
- Fee, reward and accounting drift
- MEV and ordering exposure
- Governance attack surface
Operational
- Key management and signer policy
- Deployment and upgrade procedure
- Node and RPC exposure
- Front-end and signing flows
- Relayer and keeper services
- CI/CD and secrets handling
Process
How an audit runs.
Scope and threat model
We agree the commit, the contracts in scope and what the system must guarantee. Anything outside that is stated up front.
Manual review
Line-by-line reading of the code and the design behind it. Most real findings come from reading, not from tools.
Automated testing
Static analysis, fuzzing, invariant campaigns and mainnet-fork simulation against real liquidity and oracle data.
Report and fixes
Findings classified by severity, each with a concrete fix and a proof of concept where it can be reproduced. We review your fixes before you publish.
Method
What we test with.
Tools catch the known classes. People catch the ones specific to your design.
Manual reviewSlitherAderynSemgrepEchidnaMedusaFoundry invariantsHalmosMainnet-fork simulationTenderly
Deliverables
What you receive.
Severity-classified findingsEvery issue rated on impact and likelihood, with the reasoning shown.
Proof of concept where reproducibleExecutable where it is exploitable. No hand-waving about theoretical risk.
Concrete remediationThe fix we would make, not a link to a blog post about the vulnerability class.
A publishable final reportWritten to be read by your investors and integrators, not just your engineers.
Questions
Before you ask.
How long does an audit take?
It depends on scope and complexity, not lines of code. Send the repository and we will give you a window and a price before you commit to anything.
What do you need from us to start?
A commit hash, the contracts in scope, any existing tests and documentation, and someone who can answer design questions.
What happens if you find something critical mid-audit?
You hear about it that day, not in the final report.
Get in touch
Want your code reviewed?
Send the repository and the commit you want looked at. We will come back with scope, timeline and price.
hello@xoralabs.io