Six shapes of work we are usually called in for, and what we go looking for in each.
/ Smart contract audit · 10–15 days
Reentrancy and access control first, then the economics of liquidation under a stale oracle.
Outcome
2 critical, 5 high
Both criticals were reachable from a public entry point. Fixed and re-tested inside the same engagement.
/ Key management review · 8–12 days
Threshold policy, signer separation and the seed ceremony behind a platform taking client funds.
Outcome
1 quorum flaw
A recovery path let two operators reconstruct a signing key alone. Closed before the platform took custody.
/ API review · 5–10 days
Authorisation across service boundaries, where the criticals in this kind of system usually live.
Outcome
31 endpoints
Re-authorised against a single policy. No cross-tenant path left reachable at re-test.
/ Operational review · 10–15 days
Hot and cold wallet architecture, approval flows and how a deposit becomes a credited balance.
Outcome
4 controls added
Withdrawal approval separated from deposit crediting, removing a single-operator payout path.
/ Technical due diligence · 5 days
Codebase quality, key management and upgrade authority, written for readers who are not engineers.
Outcome
Priced in
Upgrade authority sat with one unrotated key. The buyer renegotiated on it rather than discovering it later.
/ Bridge review · 10–15 days
Validator assumptions, message verification and replay protection — the industry's worst category.
Outcome
1 replay path
A message could be replayed on a second chain. Caught in review, before the validator set went live.
Tell us what the system is and what you are worried about. The call takes about thirty minutes and ends with a fixed-scope, fixed-fee proposal. It costs nothing and we do not send a salesperson.