Use cases

What an engagement looks like.

Six shapes of work we are usually called in for, and what we go looking for in each.

Engagements

Six shapes of work

Digital assets

/ Smart contract audit · 10–15 days

A lending protocol before mainnet

Reentrancy and access control first, then the economics: what liquidations do when the oracle is stale and the market is moving one way.

Custody

/ Key management review · 8–12 days

An MPC signing service

Threshold policy, signer separation, the seed ceremony, and whether a quorum can be reconstructed by anyone who should not be able to reconstruct one.

Fintech

/ API review · 5–10 days

A payments backend adding a digital asset product

Authorisation across service boundaries, token handling, and the OAuth and JWT decisions that are usually where the criticals turn out to live.

Exchange

/ Operational review · 10–15 days

A VASP's withdrawal path, end to end

Hot and cold wallet architecture, approval flows, insider threat controls, and how a deposit becomes a credited balance.

Investor

/ Technical due diligence · 5 days

A protocol two weeks from a term sheet

Codebase quality, key management, upgrade authority and admin control. What is actually being acquired, written for people who are not engineers.

Cross-chain

/ Bridge review · 10–15 days

A message-passing bridge

Validator set assumptions, message verification and replay protection. Historically the most catastrophic category in this industry, and still the least examined.

Lines of code reviewed: 340k
Critical findings issued: 61
Value secured under review: $2.1bn

Start here

Request a scope call. We tell you what it needs.

Tell us what the system is and what you are worried about. The call takes about thirty minutes and ends with a fixed-scope, fixed-fee proposal. It costs nothing and we do not send a salesperson.

Email: hello@cernosec.com
Response time: One working day.